NtQueryTimer

INT64 __fastcall NtQueryTimer(
        VOID *TimerHandle,
        INT64 TimerInformationClass,
        VOID *TimerInformation,
        INT64 TimerInformationLength,
        UINT64 *ReturnLength,
        INT64 a6,
        INT64 a7,
        INT64 a8){
  KPROCESSOR_MODE v11; 
  __int64 v12; 
  __int64 v13; 
  UINT64 *v14; 
  NTSTATUS v15; 
  int v16; 
  __int64 v17; 
  UINT64 v18; 
  PVOID Object; 
  if( (_DWORD)TimerInformationClass )
    return 3221225475i64;
  if( (_DWORD)TimerInformationLength != 16 )
    return 3221225476i64;
  v11 = *((_BYTE *)KeGetCurrentThread() + 562);
  if( v11 )
  {
    if( ((unsigned __int8)TimerInformation & 3) != 0 )
      ExRaiseDatatypeMisalignment();
    v12 = 0x7FFFFFFF0000i64;
    v13 = 0x7FFFFFFF0000i64;
    if( (unsigned __int64)TimerInformation < 0x7FFFFFFF0000i64 )
      v13 = (__int64)TimerInformation;
    *(_BYTE *)v13 = *(_BYTE *)v13;
    *(_BYTE *)(v13 + 15) = *(_BYTE *)(v13 + 15);
    v14 = ReturnLength;
    if( ReturnLength )
    {
      if( (unsigned __int64)ReturnLength < 0x7FFFFFFF0000i64 )
        v12 = (__int64)ReturnLength;
      *(_DWORD *)v12 = *(_DWORD *)v12;
    }
  }
  else
  {
    v14 = ReturnLength;
  }
  Object = 0i64;
  v15 = ObReferenceObjectByHandle(TimerHandle, 1u, ExTimerObjectType, v11, &Object, 0i64);
  if( v15 >= 0 )
  {
    v16 = *((_DWORD *)Object + 1);
    v17 = *(_QWORD *)&KUSER_SHARED_DATA.InterruptTime.LowPart;
    v18 = KeQueryTimerDueTime((KTIMER *)Object) - v17;
    HalPutDmaAdapter((PADAPTER_OBJECT)Object);
    if( v11 )
    {
      *((_BYTE *)TimerInformation + 8) = v16;
      *(_QWORD *)TimerInformation = v18;
      if( v14 )
        *(_DWORD *)v14 = 16;
    }
    else
    {
      *((_BYTE *)TimerInformation + 8) = v16;
      *(_QWORD *)TimerInformation = v18;
      if( v14 )
        *(_DWORD *)v14 = 16;
    }
  }
  return(unsigned int)v15;
}

Referenced by: