GetBootSystemTime

VOID __fastcall GetBootSystemTime(_LOADER_PARAMETER_EXTENSION *Extension, _LARGE_INTEGER *SystemTime){
  bool v3; 
  __int64 v5; 
  __int64 v6; 
  NTSTATUS v7; 
  unsigned __int64 v8; 
  unsigned __int64 v9; 
  ULONGLONG v10; 
  ULONGLONG v11; 
  TIME_FIELDS TimeFields; 
  ULONGLONG pullResult; 
  unsigned __int64 v14; 
  v14 = 0i64;
  pullResult = 0i64;
  v3 = (*((_BYTE *)Extension + 2624) & 1) == 0;
  v5 = *((_QWORD *)Extension + 325);
  TimeFields = 0i64;
  if( v3 && !ExpRealTimeIsUniversal )
    v5 += *(_QWORD *)(PsGetCurrentServerSiloGlobals()[133] + 440);
  v6 = ((__int64(__fastcall *)(unsigned __int64 *))off_140C007F0)(&v14);
  v7 = RtlULongLongMult(v6 - *((_QWORD *)Extension + 326), 0x989680ui64, &pullResult);
  v10 = pullResult / v14;
  if( v7 < 0 )
  {
    v8 = v9 / v14;
    v10 = 10000000 * (v9 / v14) + 10000000 * (v9 % v14) / v14;
  }
  v11 = v10 + v5;
  v3 = (*((_BYTE *)Extension + 2624) & 2) == 0;
  pullResult = v11;
  if( v3 )
  {
    if( !ExpRealTimeIsUniversal )
      pullResult = v11 - *(_QWORD *)(PsGetCurrentServerSiloGlobals()[133] + 440);
    RtlpTimeToTimeFields((LARGE_INTEGER *)&pullResult, &TimeFields, (LARGE_INTEGER)v8);
    HalSetRealTimeClock(&TimeFields);
  }
  else if( (qword_140C19658 & 4) == 0 && (unsigned __int8)HalQueryRealTimeClock(&TimeFields) )
  {
    if( !RtlpTimeFieldsToTime(&TimeFields.Year, (INT64 *)&pullResult) || ExpRealTimeIsUniversal )
      v11 = pullResult;
    else
      v11 = *(_QWORD *)(PsGetCurrentServerSiloGlobals()[133] + 440) + pullResult;
  }
  SystemTime->QuadPart = v11;
}

Referenced by: