NtCreateTimer

NTSTATUS __stdcall NtCreateTimer(
        VOID **TimerHandle,
        _ACCESS_MASK DesiredAccess,
        POBJECT_ATTRIBUTES ObjectAttributes,
        _TIMER_TYPE TimerType,
        VOID *a5){
  INT8 v5; 
  VOID **v6; 
  char PreviousMode; 
  int inserted; 
  _QWORD *v9; 
  INT64 v10; 
  _EPROCESS *Process; 
  _EJOB *volatile Job; 
  _ETHREAD *CurrentThread; 
  __int64 v15; 
  VOID *Flags; 
  UINT64 Flagsa; 
  UINT64 ObjectBodySize; 
  UINT64 PagedPoolCharge; 
  UINT64 NonPagedPoolCharge; 
  PVOID DeferredContext; 
  PVOID Handle; 
  __int64 v23; 

  v5 = TimerType;
  v6 = TimerHandle;
  DeferredContext = 0i64;
  Handle = 0i64;
  if( (unsigned int)TimerType > SynchronizationTimer )
    return -1073741582;
  PreviousMode = KeGetCurrentThread()->PreviousMode;
  if( PreviousMode )
  {
    TimerHandle = (VOID **)0x7FFFFFFF0000i64;
    if( (unsigned __int64)v6 < 0x7FFFFFFF0000i64 )
      TimerHandle = v6;
    *TimerHandle = *TimerHandle;
  }
  LODWORD(NonPagedPoolCharge) = 0;
  LODWORD(PagedPoolCharge) = 0;
  LODWORD(ObjectBodySize) = 328;
  LOBYTE(TimerType) = PreviousMode;
  LOBYTE(TimerHandle) = PreviousMode;
  inserted = ObCreateObjectEx(
               (UINT64)TimerHandle,
               ExTimerObjectType,
               ObjectAttributes,
               *(UINT64 *)&TimerType,
               Flags,
               ObjectBodySize,
               PagedPoolCharge,
               NonPagedPoolCharge,
               &DeferredContext,
               0i64);
  if( inserted >= 0 )
  {
    v9 = DeferredContext;
    KeInitializeDpc((PRKDPC)((char *)DeferredContext + 160), (PKDEFERRED_ROUTINE)ExpTimerDpcRoutine, DeferredContext);
    KeInitializeTimerEx((INT64)v9, v5);
    v9[8] = 0i64;
    *((_BYTE *)v9 + 304) = 0;
    v9[32] = 0i64;
    v9[33] = 0i64;
    v23 = (__int64)(v9 + 35);
    v9[35] = 0i64;
    if( PreviousMode )
    {
      Process = KeGetCurrentThread()->ApcState.Process;
      if( (Process->Pcb._bf_0 & 0x10) != 0 )
      {
        Job = Process->Job;
        if( Job )
        {
          CurrentThread = (_ETHREAD *)KeGetCurrentThread();
          --CurrentThread->Tcb.SpecialApcDisable;
          v15 = (__int64)Job + 56;
          ExAcquireResourceExclusiveLite((UINT64)Job + 56, 1, v10);
        }
        else
        {
          v15 = 56i64;
        }
        v9 = DeferredContext;
        PsInsertVirtualizedTimer(Process, v23);
        if( Job )
        {
          ExReleaseResourceLite((PERESOURCE)v15);
          KiLeaveGuardedRegionUnsafe((__int64)KeGetCurrentThread());
          v9 = DeferredContext;
        }
      }
      else
      {
        v9 = DeferredContext;
      }
    }
    LODWORD(Flagsa) = 0;
    inserted = ObInsertObjectEx(v9, 0i64, (unsigned int)DesiredAccess, 0i64, Flagsa, 0i64, &Handle);
    if( inserted >= 0 )
      *v6 = Handle;
  }
  return inserted;
}

Referenced by: