EtwTraceSystemTimeChange

VOID __stdcall EtwTraceSystemTimeChange(_LARGE_INTEGER *NewTime, _LARGE_INTEGER *OldTime, UINT64 ChangeReason){
  _EPROCESS *Process; 
  __int64 *ImageFileName; 
  int v7; 
  int v8; 
  int v9; 
  int v10; 
  __int64 v11; 
  __int64 v12[2]; 
  LONGLONG QuadPart; 
  LONGLONG v14; 
  _EVENT_DATA_DESCRIPTOR UserData; 
  _LARGE_INTEGER *v16; 
  __int64 v17; 
  int *v18; 
  __int64 v19; 
  __int64 v20; 
  int v21; 
  int v22; 
  __int64 *v23; 
  __int64 v24; 
  _EVENT_DATA_DESCRIPTOR v25; 
  LONGLONG *p_QuadPart; 
  __int64 v27; 
  LONGLONG *v28; 
  __int64 v29; 
  int *v30; 
  __int64 v31; 
  int *v32; 
  __int64 v33; 
  __int64 v34; 
  int v35[2]; 
  int *v36; 
  __int64 v37; 
  int v38; 

  v38 = ChangeReason;
  v12[0] = 0x20000i64;
  v12[1] = (__int64)&word_1409A1550;
  Process = KeGetCurrentThread()->ApcState.Process;
  LODWORD(v11) = (unsigned int)PsGetProcessId(Process);
  ImageFileName = (__int64 *)Process->SeAuditProcessCreationInfo.ImageFileName;
  if( !ImageFileName || !*(_WORD *)ImageFileName )
    ImageFileName = v12;
  if( *(&stru_140C00F40 + 1820) > 5u && tlgKeywordOn((__int64)&stru_140C00F40 + 7280, 0x400000000000i64) )
  {
    QuadPart = NewTime->QuadPart;
    v10 = v8;
    p_QuadPart = &QuadPart;
    v14 = OldTime->QuadPart;
    v28 = &v14;
    v9 = v38;
    v30 = &v9;
    v32 = v35;
    v34 = ImageFileName[1];
    v35[0] = *(unsigned __int16 *)ImageFileName;
    v36 = &v10;
    v27 = 8i64;
    v29 = 8i64;
    v31 = 4i64;
    v33 = 2i64;
    v35[1] = 0;
    v37 = 4i64;
    tlgWriteTransfer_EtwWriteTransfer(
      (__int64)&stru_140C00F40 + 7280,
      (unsigned __int8 *)byte_14002B80D,
      0i64,
      0i64,
      8u,
      &v25);
  }
  if( *(&ExBootDevicesRemovedEvent + 380) )
  {
    UserData.Ptr = (unsigned __int64)NewTime;
    v18 = &v38;
    *(_QWORD *)&UserData.Size = 8i64;
    v16 = OldTime;
    v17 = 8i64;
    v19 = 4i64;
    v7 = *((unsigned __int16 *)ImageFileName + 1);
    v20 = ImageFileName[1];
    v23 = &v11;
    v21 = v7;
    v22 = 0;
    v24 = 4i64;
    EtwWrite(*(&ExBootDevicesRemovedEvent + 380), &KernelSystemTimeChange, 0, 5u, &UserData);
  }
}

Referenced by: