KeQuerySystemTime/NtCreateEvent.