RtlGetMultiTimePrecise
INT64 __fastcall RtlGetMultiTimePrecise(INT64 a1){
int v1;
int *v2;
__int64 v3;
char v4;
__int64 v5;
unsigned __int8 QpcSystemTimeIncrementShift;
__int64 v7;
int v8;
__int64 v9;
volatile unsigned __int64 QpcBias;
LARGE_INTEGER PerformanceCounter;
int v12;
__int64 v13;
__int64 QpcShift;
volatile unsigned __int64 v16;
unsigned __int64 BaselineSystemTimeQpc;
unsigned __int64 QpcSystemTimeIncrement;
__int64 v19;
INT64 TickLock;
char v22;
int *v23;
v23 = v2;
v22 = v1;
v3 = 0i64;
v4 = v1;
BaselineSystemTimeQpc = 0i64;
v5 = 0i64;
v19 = 0i64;
QpcSystemTimeIncrementShift = 0;
v16 = 0i64;
QpcShift = 0i64;
QpcSystemTimeIncrement = 0i64;
if( v1 )
{
LOBYTE(v7) = HvlGetSharedPageVa((KWAIT_BLOCK *)a1, v1, (UINT8)v2);
v8 = v4 & 4;
v9 = v7;
while( 1 )
{
TickLock = RtlBeginReadTickLock((INT64 *)&KUSER_SHARED_DATA.TimeUpdateLock);
if( v8 )
{
BaselineSystemTimeQpc = KUSER_SHARED_DATA.BaselineSystemTimeQpc;
QpcSystemTimeIncrement = KUSER_SHARED_DATA.QpcSystemTimeIncrement;
QpcSystemTimeIncrementShift = KUSER_SHARED_DATA.QpcSystemTimeIncrementShift;
v19 = *(_QWORD *)&KUSER_SHARED_DATA.SystemTime.LowPart;
}
if( (v4 & 2) != 0 && v9 )
{
QpcShift = KUSER_SHARED_DATA.QpcShift;
do
{
do
{
v5 = *(_QWORD *)(v9 + 24);
QpcBias = KUSER_SHARED_DATA.QpcBias;
v16 = KUSER_SHARED_DATA.QpcBias;
PerformanceCounter = KeQueryPerformanceCounter(0i64);
}
while( v5 != *(_QWORD *)(v9 + 24) );
}
while( QpcBias != KUSER_SHARED_DATA.QpcBias );
v8 = v4 & 4;
}
else
{
PerformanceCounter = KeQueryPerformanceCounter(0i64);
}
if( KUSER_SHARED_DATA.TimeUpdateLock == TickLock )
break;
_mm_pause();
}
v12 = 0;
if( (v22 & 1) != 0 )
{
*(LARGE_INTEGER *)a1 = PerformanceCounter;
v12 = 1;
}
if( (v4 & 2) != 0 && !QpcShift && v5 )
{
*(_QWORD *)(a1 + 8) = v5 + PerformanceCounter.QuadPart - v16;
v12 |= 2u;
}
if( (v4 & 4) != 0 )
{
if( PerformanceCounter.QuadPart > BaselineSystemTimeQpc )
{
v13 = PerformanceCounter.QuadPart - BaselineSystemTimeQpc - 1;
if( QpcSystemTimeIncrementShift )
v13 <<= QpcSystemTimeIncrementShift;
v3 = ((unsigned __int64)v13 * (unsigned __int128)QpcSystemTimeIncrement) >> 64;
}
*(_QWORD *)(a1 + 16) = v3 + v19;
v12 |= 4u;
}
*v23 = v12;
}
else
{
*v2 = 0;
}
return 0i64;
}Referenced by:
EtwpGetTimeStampAndQpcDelta
EtwpInitialize
EtwpInitializeTimeStamp