RtlGetMultiTimePrecise
NTSTATUS __stdcall RtlGetMultiTimePrecise(INT64 a1){
int v1;
int *v2;
__int64 v3;
char v4;
__int64 v5;
unsigned __int8 QpcSystemTimeIncrementShift;
int v7;
_QWORD *SharedPageVa;
volatile unsigned __int64 QpcBias;
UINT64 PerformanceCounter;
int v11;
__int64 v12;
__int64 QpcShift;
volatile unsigned __int64 v15;
unsigned __int64 BaselineSystemTimeQpc;
unsigned __int64 QpcSystemTimeIncrement;
__int64 v18;
__int64 TickLock;
char v21;
int *v22;
v22 = v2;
v21 = v1;
v3 = 0i64;
v4 = v1;
BaselineSystemTimeQpc = 0i64;
v5 = 0i64;
v18 = 0i64;
QpcSystemTimeIncrementShift = 0;
v15 = 0i64;
QpcShift = 0i64;
QpcSystemTimeIncrement = 0i64;
if( v1 )
{
v7 = v1 & 4;
SharedPageVa = HvlGetSharedPageVa();
while( 1 )
{
TickLock = RtlBeginReadTickLock((__int64 *)&KUSER_SHARED_DATA.TimeUpdateLock);
if( v7 )
{
BaselineSystemTimeQpc = KUSER_SHARED_DATA.BaselineSystemTimeQpc;
QpcSystemTimeIncrement = KUSER_SHARED_DATA.QpcSystemTimeIncrement;
QpcSystemTimeIncrementShift = KUSER_SHARED_DATA.QpcSystemTimeIncrementShift;
v18 = *(_QWORD *)&KUSER_SHARED_DATA.SystemTime.LowPart;
}
if( (v4 & 2) != 0 && SharedPageVa )
{
QpcShift = KUSER_SHARED_DATA.QpcShift;
do
{
do
{
v5 = SharedPageVa[3];
QpcBias = KUSER_SHARED_DATA.QpcBias;
v15 = KUSER_SHARED_DATA.QpcBias;
PerformanceCounter = KeQueryPerformanceCounter(0i64);
}
while( v5 != SharedPageVa[3] );
}
while( QpcBias != KUSER_SHARED_DATA.QpcBias );
v7 = v4 & 4;
}
else
{
PerformanceCounter = KeQueryPerformanceCounter(0i64);
}
if( KUSER_SHARED_DATA.TimeUpdateLock == TickLock )
break;
_mm_pause();
}
v11 = 0;
if( (v21 & 1) != 0 )
{
*(_QWORD *)a1 = PerformanceCounter;
v11 = 1;
}
if( (v4 & 2) != 0 && !QpcShift && v5 )
{
*(_QWORD *)(a1 + 8) = v5 + PerformanceCounter - v15;
v11 |= 2u;
}
if( (v4 & 4) != 0 )
{
if( PerformanceCounter > BaselineSystemTimeQpc )
{
v12 = PerformanceCounter - BaselineSystemTimeQpc - 1;
if( QpcSystemTimeIncrementShift )
v12 <<= QpcSystemTimeIncrementShift;
v3 = ((unsigned __int64)v12 * (unsigned __int128)QpcSystemTimeIncrement) >> 64;
}
*(_QWORD *)(a1 + 16) = v3 + v18;
v11 |= 4u;
}
*v22 = v11;
}
else
{
*v2 = 0;
}
return 0;
}Referenced by:
EtwpGetTimeStampAndQpcDelta
EtwpInitialize
EtwpInitializeTimeStamp