VOID __stdcall KeQueryBootTimeValues(_LARGE_INTEGER *SystemTime, _LARGE_INTEGER *BootTime, UINT64 *BootTimeBias){
unsigned __int8 CurrentIrql;
CurrentIrql = KeGetCurrentIrql();
__writecr8(2ui64);
*SystemTime = *(_LARGE_INTEGER *)&KUSER_SHARED_DATA.SystemTime.LowPart;
*BootTime = KeBootTime;
*BootTimeBias = KeBootTimeBias;
__writecr8(CurrentIrql);
}