EtwpInitializeTimeStamp

VOID __stdcall EtwpInitializeTimeStamp(_WMI_LOGGER_CONTEXT *LoggerContext){
  unsigned __int64 v2; 
  _ETW_REF_CLOCK *p_ReferenceTime; 
  char v4; 
  _LARGE_INTEGER v5; 
  _LARGE_INTEGER v6; 
  _LARGE_INTEGER v7; 
  unsigned int ClockType; 
  unsigned int v9; 
  _LARGE_INTEGER v10; 
  INT64 v11[2]; 
  _LARGE_INTEGER v12; 
  __int64 v13; 

  switch( LoggerContext->ClockType )
  {
    case 2u:
      v2 = 0i64;
      break;
    case 3u:
      v2 = 3i64;
      break;
    case 4u:
      v13 = 0i64;
      if( ((int(__fastcall *)(__int64 *))off_140C009E0[0])(&v13) < 0 )
      {
        LoggerContext->ClockType = 1;
        goto LABEL_5;
      }
      v2 = 2i64;
      break;
    default:
      LoggerContext->ClockType = 1;
LABEL_5:
      v2 = 1i64;
      break;
  }
  LoggerContext->GetCpuClock = v2;
  p_ReferenceTime = &LoggerContext->ReferenceTime;
  if( (LoggerContext->Flags & 2) == 0 )
  {
    if( LoggerContext->ClockType == 3 )
    {
      LoggerContext->ReferenceTime.StartPerfClock = EtwpGetLoggerTimeStamp((INT64)LoggerContext);
      KeQuerySystemTimePrecise(&LoggerContext->ReferenceTime.StartTime);
      goto LABEL_14;
    }
    LODWORD(v13) = 0;
    v12.QuadPart = 0i64;
    *(_OWORD *)v11 = 0i64;
    RtlGetMultiTimePrecise((INT64)v11);
    v4 = v13;
    v5 = (_LARGE_INTEGER)v11[1];
    v6 = (_LARGE_INTEGER)v11[0];
    if( (v13 & 5) == 5 )
    {
      v7 = v12;
      ClockType = LoggerContext->ClockType;
      p_ReferenceTime->StartTime = v12;
      switch( ClockType )
      {
        case 2u:
          LoggerContext->ReferenceTime.StartPerfClock = v7;
          break;
        case 1u:
          LoggerContext->ReferenceTime.StartPerfClock = v6;
          break;
        case 4u:
          LoggerContext->ReferenceTime.StartPerfClock = v5;
LABEL_30:
          if( ClockType == 4 )
            goto LABEL_14;
          break;
      }
      if( (v4 & 3) == 3 )
        LoggerContext->ReferenceQpcDelta = v5.QuadPart - v6.QuadPart;
      goto LABEL_14;
    }
    LoggerContext->ReferenceTime.StartPerfClock = EtwpGetLoggerTimeStamp((INT64)LoggerContext);
    KeQuerySystemTimePrecise(&LoggerContext->ReferenceTime.StartTime);
    LoggerContext->Flags &= ~0x8000000u;
    ClockType = LoggerContext->ClockType;
    goto LABEL_30;
  }
  v9 = LoggerContext->ClockType;
  p_ReferenceTime->StartTime.QuadPart = *(&ExBootDevicesRemovedEvent + 191);
  LoggerContext->ReferenceQpcDelta = *(&ExBootDevicesRemovedEvent + 247);
  if( v9 == 3 )
  {
    LoggerContext->ReferenceTime.StartPerfClock.QuadPart = *(&ExBootDevicesRemovedEvent + 192);
  }
  else
  {
    v10 = (_LARGE_INTEGER)*(&ExBootDevicesRemovedEvent + 246);
    if( v9 == 2 )
      v10 = (_LARGE_INTEGER)*(&ExBootDevicesRemovedEvent + 191);
    LoggerContext->ReferenceTime.StartPerfClock = v10;
  }
LABEL_14:
  LoggerContext->RealtimeReferenceTime = *p_ReferenceTime;
}

Referenced by: