RtlGetMultiTimePrecise

NTSTATUS __stdcall RtlGetMultiTimePrecise(INT64 a1){
  int v1; 
  int *v2; 
  __int64 v3; 
  char v4; 
  __int64 v5; 
  unsigned __int8 QpcSystemTimeIncrementShift; 
  int v7; 
  _QWORD *SharedPageVa; 
  volatile unsigned __int64 QpcBias; 
  UINT64 PerformanceCounter; 
  int v11; 
  __int64 v12; 
  __int64 QpcShift; 
  volatile unsigned __int64 v15; 
  unsigned __int64 BaselineSystemTimeQpc; 
  unsigned __int64 QpcSystemTimeIncrement; 
  __int64 v18; 
  __int64 TickLock; 
  char v21; 
  int *v22; 

  v22 = v2;
  v21 = v1;
  v3 = 0i64;
  v4 = v1;
  BaselineSystemTimeQpc = 0i64;
  v5 = 0i64;
  v18 = 0i64;
  QpcSystemTimeIncrementShift = 0;
  v15 = 0i64;
  QpcShift = 0i64;
  QpcSystemTimeIncrement = 0i64;
  if( v1 )
  {
    v7 = v1 & 4;
    SharedPageVa = HvlGetSharedPageVa();
    while( 1 )
    {
      TickLock = RtlBeginReadTickLock((__int64 *)&KUSER_SHARED_DATA.TimeUpdateLock);
      if( v7 )
      {
        BaselineSystemTimeQpc = KUSER_SHARED_DATA.BaselineSystemTimeQpc;
        QpcSystemTimeIncrement = KUSER_SHARED_DATA.QpcSystemTimeIncrement;
        QpcSystemTimeIncrementShift = KUSER_SHARED_DATA.QpcSystemTimeIncrementShift;
        v18 = *(_QWORD *)&KUSER_SHARED_DATA.SystemTime.LowPart;
      }
      if( (v4 & 2) != 0 && SharedPageVa )
      {
        QpcShift = KUSER_SHARED_DATA.QpcShift;
        do
        {
          do
          {
            v5 = SharedPageVa[3];
            QpcBias = KUSER_SHARED_DATA.QpcBias;
            v15 = KUSER_SHARED_DATA.QpcBias;
            PerformanceCounter = KeQueryPerformanceCounter(0i64);
          }
          while( v5 != SharedPageVa[3] );
        }
        while( QpcBias != KUSER_SHARED_DATA.QpcBias );
        v7 = v4 & 4;
      }
      else
      {
        PerformanceCounter = KeQueryPerformanceCounter(0i64);
      }
      if( KUSER_SHARED_DATA.TimeUpdateLock == TickLock )
        break;
      _mm_pause();
    }
    v11 = 0;
    if( (v21 & 1) != 0 )
    {
      *(_QWORD *)a1 = PerformanceCounter;
      v11 = 1;
    }
    if( (v4 & 2) != 0 && !QpcShift && v5 )
    {
      *(_QWORD *)(a1 + 8) = v5 + PerformanceCounter - v15;
      v11 |= 2u;
    }
    if( (v4 & 4) != 0 )
    {
      if( PerformanceCounter > BaselineSystemTimeQpc )
      {
        v12 = PerformanceCounter - BaselineSystemTimeQpc - 1;
        if( QpcSystemTimeIncrementShift )
          v12 <<= QpcSystemTimeIncrementShift;
        v3 = ((unsigned __int64)v12 * (unsigned __int128)QpcSystemTimeIncrement) >> 64;
      }
      *(_QWORD *)(a1 + 16) = v3 + v18;
      v11 |= 4u;
    }
    *v22 = v11;
  }
  else
  {
    *v2 = 0;
  }
  return 0;
}

Referenced by:

EtwpGetTimeStampAndQpcDelta
EtwpInitialize
EtwpInitializeTimeStamp