NtSetTimerEx

NTSTATUS __stdcall NtSetTimerEx(
        VOID *TimerHandle,
        _TIMER_SET_INFORMATION_CLASS TimerSetInformationClass,
        VOID *TimerSetInformation,
        UINT64 TimerSetInformationLength,
        INT64 a5,
        INT64 a6,
        INT64 a7,
        INT64 a8){
  __int128 *v8; 
  char PreviousMode; 
  char *v11; 
  unsigned int v12; 
  _COUNTED_REASON_CONTEXT *v13; 
  _BYTE *v14; 
  INT64 v15; 
  INT32 *v16; 
  int v17; 
  _OBJECT_TYPE *v18; 
  NTSTATUS v19; 
  NTSTATUS result; 
  UINT64 v21; 
  UINT64 v22; 
  char ImportantTimer[4]; 
  _DWORD v24[3]; 
  PVOID Object; 
  __int128 v26; 
  __int128 v27; 
  __int128 v28; 

  v8 = (__int128 *)TimerSetInformation;
  v26 = 0i64;
  v27 = 0i64;
  v28 = 0i64;
  ImportantTimer[0] = 0;
  *(_QWORD *)&v24[1] = 0i64;
  PreviousMode = KeGetCurrentThread()->PreviousMode;
  if( PreviousMode && (_DWORD)TimerSetInformationLength )
  {
    if( ((unsigned __int8)TimerSetInformation & 3) != 0 )
      ExRaiseDatatypeMisalignment();
    v11 = (char *)TimerSetInformation + (unsigned int)TimerSetInformationLength;
    if( (unsigned __int64)v11 > 0x7FFFFFFF0000i64 || v11 < TimerSetInformation )
      MEMORY[0x7FFFFFFF0000] = 0;
  }
  if( TimerSetInformationClass )
    return -1073741821;
  if( (_DWORD)TimerSetInformationLength != 48 )
    return -1073741820;
  if( PreviousMode )
  {
    v26 = *(_OWORD *)TimerSetInformation;
    v27 = *((_OWORD *)TimerSetInformation + 1);
    v28 = *((_OWORD *)TimerSetInformation + 2);
    v8 = &v26;
  }
  v12 = *((_DWORD *)v8 + 8);
  if( v12 > 0x7FFFFFFF )
    return -1073741583;
  v13 = (_COUNTED_REASON_CONTEXT *)*((_QWORD *)v8 + 3);
  if( !v13 )
  {
LABEL_14:
    v14 = (_BYTE *)*((_QWORD *)v8 + 5);
    v24[0] = *((_DWORD *)v8 + 9);
    v15 = *((_QWORD *)v8 + 2);
    v16 = (INT32 *)*((_QWORD *)v8 + 1);
    Object = 0i64;
    v17 = ObReferenceObjectByHandle(TimerHandle, 2ui64, 0i64, PreviousMode, &Object, 0i64);
    if( v17 < 0 )
    {
LABEL_19:
      if( v17 >= 0 && v17 != 1073741861 )
        return v17;
      goto LABEL_36;
    }
    v18 = (_OBJECT_TYPE *)ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ (unsigned __int8)*((char *)Object - 24) ^ (unsigned __int64)(unsigned __int8)((unsigned __int16)((_WORD)Object - 48) >> 8)];
    if( v18 == ExpIRTimerObjectType )
    {
      if( !v16 && !v15 && !*(_QWORD *)&v24[1] && !v24[0] && !v14 )
      {
        v19 = ExpSetTimerObject2(Object);
        goto LABEL_18;
      }
      ObfDereferenceObjectWithTag(Object, 0x746C6644ui64);
      v17 = -1073741811;
    }
    else
    {
      if( v18 == ExTimerObjectType )
      {
        LODWORD(v22) = v24[0];
        LODWORD(v21) = v12;
        v19 = ExpSetTimerObject(
                (UINT64)Object,
                PreviousMode,
                (INT64 *)v8,
                v16,
                v15,
                *(INT64 *)&v24[1],
                ImportantTimer[0],
                v21,
                v22,
                v14);
LABEL_18:
        v17 = v19;
        goto LABEL_19;
      }
      ObfDereferenceObjectWithTag(Object, 0x746C6644ui64);
      v17 = -1073741788;
    }
LABEL_36:
    if( *(_QWORD *)&v24[1] )
      PoDestroyReasonContext(*(_DIAGNOSTIC_CONTEXT **)&v24[1]);
    return v17;
  }
  result = PoCaptureReasonContext(v13, PreviousMode, 0i64, 0, (UINT8 *)ImportantTimer, (_DIAGNOSTIC_CONTEXT **)&v24[1]);
  if( result >= 0 )
  {
    v12 = *((_DWORD *)v8 + 8);
    goto LABEL_14;
  }
  return result;
}

Referenced by: