ExpRefreshTimeZoneInformation
UINT8 __stdcall ExpRefreshTimeZoneInformation(){
char v0;
_BOOL4 v1;
char v2;
_EJOB *v3;
CHAR v4;
_EJOB *CurrentServerSilo;
__int64 v6;
_EX_TIMEZONE_STATE *ExTimeZoneState;
__int64 v8;
__int64 v9;
NTSTATUS v10;
__int64 v11;
_EJOB *v12;
INT64 v13;
UINT8 v14;
CHAR v15;
INT64 v16;
BOOL SiloTimeZoneMarker;
_RTL_DYNAMIC_TIME_ZONE_INFORMATION *p_TimeZoneInformation;
_EX_TIMEZONE_STATE *v20;
__int64 v21;
__int128 v22;
unsigned int LowPart;
_LARGE_INTEGER v24;
unsigned int Bias;
UINT8 v26;
_LARGE_INTEGER v27;
_LARGE_INTEGER v28;
int v29;
UINT64 *p_CurrentTimeZoneId;
int StandardBias;
_RTL_DYNAMIC_TIME_ZONE_INFORMATION *v32;
_EX_TIMEZONE_STATE *v33;
__int128 v34;
__int128 v35;
INT64 v36;
__int16 Year;
__int64 v38;
__int16 v39;
INT64 a6;
INT64 a7;
_LARGE_INTEGER LocalTime;
CHAR v43[8];
_LARGE_INTEGER Time;
_LARGE_INTEGER v45;
INT64 a3;
__int64 v47;
__int64 Buffer;
VOID *Key;
_LARGE_INTEGER SystemTime;
_LARGE_INTEGER v51;
INT64 QuadPart;
_TIME_FIELDS TimeFields;
INT64 v54;
_RTL_DYNAMIC_TIME_ZONE_INFORMATION TimeZoneInformation;
__int16 a5[264];
v2 = v0;
memset(&TimeZoneInformation, 0i64, sizeof(TimeZoneInformation));
LOBYTE(v1) = 0;
SystemTime.QuadPart = 0i64;
v51.QuadPart = 0i64;
v3 = 0i64;
v45.QuadPart = 0i64;
v4 = 1;
Buffer = 0i64;
TimeFields = 0i64;
*(_DWORD *)v43 = v1;
CurrentServerSilo = PsGetCurrentServerSilo();
ExTimeZoneState = PsGetServerSiloGlobals(CurrentServerSilo)->ExTimeZoneState;
if( ExTimeZoneState->TimeZone.WorkItem.WorkerRoutine )
{
v4 = 0;
}
else
{
ExpInitializeTimeChangeWorker(
(__int64)&ExTimeZoneState->TimeZone,
(KDEFERRED_ROUTINE *)ExpTimeZoneDpcRoutine,
CurrentServerSilo,
v6,
(__int64)CurrentServerSilo);
ExpInitializeTimeChangeWorker(
(__int64)&ExTimeZoneState->NextYear,
ExpNextYearDpcRoutine,
CurrentServerSilo,
v8,
(__int64)CurrentServerSilo);
ExpInitializeTimeChangeWorker(
(__int64)&ExTimeZoneState->Century,
(KDEFERRED_ROUTINE *)ExpCenturyDpcRoutine,
CurrentServerSilo,
v9,
(__int64)CurrentServerSilo);
ExTimeZoneState->NextCenturyTimeFieldsInLocalTime = 0i64;
ExTimeZoneState->NextYearTimeFieldsInLocalTime = 0i64;
*(_DWORD *)&ExTimeZoneState->NextCenturyTimeFieldsInLocalTime.Month = 65537;
ExTimeZoneState->NextCenturyTimeFieldsInLocalTime.Milliseconds = 1;
*(_DWORD *)&ExTimeZoneState->NextYearTimeFieldsInLocalTime.Month = 65537;
ExTimeZoneState->NextYearTimeFieldsInLocalTime.Milliseconds = 1;
}
v10 = 0;
v11 = 3i64;
if( v2 )
{
if( !ExpReadSiloTimeZoneMarker() )
{
LODWORD(v12) = PsAttachSiloToCurrentThread(0i64);
v3 = v12;
}
v10 = RtlQueryDynamicTimeZoneInformation(&TimeZoneInformation);
if( v3 )
PsDetachSiloFromCurrentThread(v3);
}
else if( PsIsCurrentThreadInServerSilo()
&& (SiloTimeZoneMarker = ExpReadSiloTimeZoneMarker(),
p_TimeZoneInformation = &TimeZoneInformation,
!SiloTimeZoneMarker) )
{
v20 = ExTimeZoneState;
v21 = 3i64;
v13 = 128i64;
do
{
*(_OWORD *)&p_TimeZoneInformation->tzi.Bias = *(_OWORD *)&v20->TimeZoneInformation.tzi.Bias;
*(_OWORD *)&p_TimeZoneInformation->tzi.StandardName[6] = *(_OWORD *)&v20->TimeZoneInformation.tzi.StandardName[6];
*(_OWORD *)&p_TimeZoneInformation->tzi.StandardName[14] = *(_OWORD *)&v20->TimeZoneInformation.tzi.StandardName[14];
*(_OWORD *)&p_TimeZoneInformation->tzi.StandardName[22] = *(_OWORD *)&v20->TimeZoneInformation.tzi.StandardName[22];
*(_OWORD *)&p_TimeZoneInformation->tzi.StandardName[30] = *(_OWORD *)&v20->TimeZoneInformation.tzi.StandardName[30];
*(_OWORD *)&p_TimeZoneInformation->tzi.StandardStart.Milliseconds = *(_OWORD *)&v20->TimeZoneInformation.tzi.StandardStart.Milliseconds;
*(_OWORD *)&p_TimeZoneInformation->tzi.DaylightName[4] = *(_OWORD *)&v20->TimeZoneInformation.tzi.DaylightName[4];
p_TimeZoneInformation = (_RTL_DYNAMIC_TIME_ZONE_INFORMATION *)((char *)p_TimeZoneInformation + 128);
v22 = *(_OWORD *)&v20->TimeZoneInformation.tzi.DaylightName[12];
v20 = (_EX_TIMEZONE_STATE *)((char *)v20 + 128);
*(_OWORD *)&p_TimeZoneInformation[-1].TimeZoneKeyName[122] = v22;
--v21;
}
while( v21 );
*(_OWORD *)&p_TimeZoneInformation->tzi.Bias = *(_OWORD *)&v20->TimeZoneInformation.tzi.Bias;
*(_OWORD *)&p_TimeZoneInformation->tzi.StandardName[6] = *(_OWORD *)&v20->TimeZoneInformation.tzi.StandardName[6];
*(_OWORD *)&p_TimeZoneInformation->tzi.StandardName[14] = *(_OWORD *)&v20->TimeZoneInformation.tzi.StandardName[14];
}
else
{
v10 = RtlQueryDynamicTimeZoneInformation(&TimeZoneInformation);
}
if( v10 < 0 )
{
++ExTimeZoneState->RefreshFailures;
ExpSystemIsInCmosMode = 1;
ExpLogRefreshTimeZoneInformationQueryFail((PLEARNING_MODE_DATA *)(unsigned int)v10, v4);
v15 = 0;
v16 = 1i64;
LABEL_11:
EtwTraceTimeZoneInformationRefresh(
v16,
(unsigned int)ExTimeZoneState->LastTimeZoneBias,
ExTimeZoneState->CurrentTimeZoneId,
v15,
v4);
return 0;
}
LowPart = KUSER_SHARED_DATA.SystemTime.LowPart;
v24.QuadPart = *(_QWORD *)&KUSER_SHARED_DATA.SystemTime.LowPart - ExTimeZoneState->TimeZoneBias.QuadPart;
Time = v24;
if( !TimeZoneInformation.DynamicDaylightTimeDisabled )
{
if( TimeZoneInformation.TimeZoneKeyName[0] )
{
RtlTimeToTimeFields((INT64 *)&Time, (WORD *)&TimeFields, v13);
if( RtlpCheckDynamicTimeZoneInformation(&TimeZoneInformation, TimeFields.Year) )
{
LOBYTE(v1) = 1;
*(_DWORD *)v43 = 1;
LABEL_28:
RtlpSetTimeZoneInformationWorker(&TimeZoneInformation, 0x1B0ui64);
goto LABEL_29;
}
}
}
if( v4 )
{
LODWORD(a6) = 520;
if( RtlGetPersistedStateLocation(
(WCHAR *)L"TimeZoneInformationSettings",
L"TargetNtPath",
0i64,
0i64,
a5,
a6,
(INT64)&v54) >= 0 )
{
Key = 0i64;
v1 = RtlpGetRegistryHandle(0i64, (const WCHAR *)a5, 0, &Key) == -1073741772;
*(_DWORD *)v43 = v1;
if( Key )
ZwClose((_HANDLE)Key);
if( v1 )
goto LABEL_28;
}
}
LABEL_29:
Bias = TimeZoneInformation.tzi.Bias;
a3 = -1i64;
QuadPart = -1i64;
LODWORD(v47) = TimeZoneInformation.tzi.Bias;
if( !TimeZoneInformation.tzi.StandardStart.Month || !TimeZoneInformation.tzi.DaylightStart.Month )
{
KeCancelTimer((INT64)&ExTimeZoneState->TimeZone.Timer);
p_CurrentTimeZoneId = (UINT64 *)&ExTimeZoneState->CurrentTimeZoneId;
ExTimeZoneState->CurrentTimeZoneId = 0;
v28.QuadPart = 0i64;
LocalTime.QuadPart = 0i64;
goto LABEL_52;
}
if( !RtlCutoverTimeToSystemTime(&TimeZoneInformation.tzi.StandardStart, &SystemTime, &Time, v14) )
{
LODWORD(v11) = 2;
LABEL_33:
++ExTimeZoneState->RefreshFailures;
ExpSystemIsInCmosMode = 1;
ExpLogRefreshTimeZoneInformationCutoverFail((INT64)&TimeZoneInformation, v4, &a3, v11);
v15 = v1;
v16 = (unsigned int)v11;
goto LABEL_11;
}
v27 = SystemTime;
a3 = SystemTime.QuadPart;
if( !RtlCutoverTimeToSystemTime(&TimeZoneInformation.tzi.DaylightStart, &v51, &Time, v26) )
goto LABEL_33;
QuadPart = v51.QuadPart;
if( v24.QuadPart >= v51.QuadPart && v24.QuadPart >= v27.QuadPart )
{
LocalTime.QuadPart = 0i64;
v28.QuadPart = 0i64;
v29 = (v27.QuadPart <= v51.QuadPart) + 1;
LABEL_43:
p_CurrentTimeZoneId = (UINT64 *)&ExTimeZoneState->CurrentTimeZoneId;
ExTimeZoneState->CurrentTimeZoneId = v29;
goto LABEL_48;
}
if( v51.QuadPart < v27.QuadPart )
{
if( v24.QuadPart < v51.QuadPart || v24.QuadPart >= v27.QuadPart )
{
v28 = v51;
LocalTime = v51;
v29 = 1;
}
else
{
v28 = v27;
v29 = 2;
LocalTime = v27;
}
goto LABEL_43;
}
if( v24.QuadPart >= v27.QuadPart && v24.QuadPart < v51.QuadPart )
{
v28 = v51;
LocalTime = v51;
p_CurrentTimeZoneId = (UINT64 *)&ExTimeZoneState->CurrentTimeZoneId;
ExTimeZoneState->CurrentTimeZoneId = 1;
LABEL_49:
StandardBias = TimeZoneInformation.tzi.StandardBias;
goto LABEL_50;
}
v28 = v27;
p_CurrentTimeZoneId = (UINT64 *)&ExTimeZoneState->CurrentTimeZoneId;
LocalTime = v27;
v29 = 2;
ExTimeZoneState->CurrentTimeZoneId = 2;
LABEL_48:
StandardBias = TimeZoneInformation.tzi.DaylightBias;
if( v29 != 2 )
goto LABEL_49;
LABEL_50:
v11 = 3i64;
Bias = StandardBias + v47;
LABEL_52:
if( ExTimeZoneState->LastTimeZoneBias != Bias )
{
LODWORD(a7) = 0;
LODWORD(a6) = 0;
Buffer = 0xFFFFFFFF00000000ui64;
ZwUpdateWnfStateData(&WNF_SEB_TIME_ZONE_CHANGE, &Buffer, 8ui64, 0i64, 0i64, a6, a7);
EtwTraceTimeZoneBiasChange(Bias, (unsigned int)ExTimeZoneState->LastTimeZoneBias);
}
ExTimeZoneState->LastTimeZoneBias = Bias;
v32 = &TimeZoneInformation;
ExTimeZoneState->TimeZoneBias.QuadPart = 10000000i64 * (int)(60 * Bias);
v33 = ExTimeZoneState;
do
{
*(_OWORD *)&v33->TimeZoneInformation.tzi.Bias = *(_OWORD *)&v32->tzi.Bias;
*(_OWORD *)&v33->TimeZoneInformation.tzi.StandardName[6] = *(_OWORD *)&v32->tzi.StandardName[6];
*(_OWORD *)&v33->TimeZoneInformation.tzi.StandardName[14] = *(_OWORD *)&v32->tzi.StandardName[14];
*(_OWORD *)&v33->TimeZoneInformation.tzi.StandardName[22] = *(_OWORD *)&v32->tzi.StandardName[22];
*(_OWORD *)&v33->TimeZoneInformation.tzi.StandardName[30] = *(_OWORD *)&v32->tzi.StandardName[30];
*(_OWORD *)&v33->TimeZoneInformation.tzi.StandardStart.Milliseconds = *(_OWORD *)&v32->tzi.StandardStart.Milliseconds;
*(_OWORD *)&v33->TimeZoneInformation.tzi.DaylightName[4] = *(_OWORD *)&v32->tzi.DaylightName[4];
v33 = (_EX_TIMEZONE_STATE *)((char *)v33 + 128);
v34 = *(_OWORD *)&v32->tzi.DaylightName[12];
v32 = (_RTL_DYNAMIC_TIME_ZONE_INFORMATION *)((char *)v32 + 128);
*(_OWORD *)&v33[-1].NextSystemCutoverInUTC.anonymous_0.LowPart = v34;
--v11;
}
while( v11 );
v35 = *(_OWORD *)&v32->tzi.Bias;
ExpSystemIsInCmosMode = 0;
*(_OWORD *)&v33->TimeZoneInformation.tzi.Bias = v35;
*(_OWORD *)&v33->TimeZoneInformation.tzi.StandardName[6] = *(_OWORD *)&v32->tzi.StandardName[6];
*(_OWORD *)&v33->TimeZoneInformation.tzi.StandardName[14] = *(_OWORD *)&v32->tzi.StandardName[14];
RtlSetSystemGlobalData((INT64)v32, p_CurrentTimeZoneId);
RtlTimeToTimeFields((INT64 *)&Time, (WORD *)&TimeFields, v36);
if( v28.QuadPart )
{
ExLocalTimeToSystemTime(&LocalTime, &ExTimeZoneState->NextSystemCutoverInUTC);
KiSetTimerEx(
&ExTimeZoneState->TimeZone.Timer,
ExTimeZoneState->NextSystemCutoverInUTC,
0i64,
0,
&ExTimeZoneState->TimeZone.Dpc);
}
Year = TimeFields.Year;
ExTimeZoneState->NextCenturyTimeFieldsInLocalTime.Year = 100 * (TimeFields.Year / 100 + 1);
RtlTimeFieldsToTime(&ExTimeZoneState->NextCenturyTimeFieldsInLocalTime, &v45);
ExLocalTimeToSystemTime(&v45, &ExTimeZoneState->NextCenturyTimeInUTC);
KiSetTimerEx(
&ExTimeZoneState->Century.Timer,
ExTimeZoneState->NextCenturyTimeInUTC,
0i64,
0,
&ExTimeZoneState->Century.Dpc);
ExTimeZoneState->NextYearTimeFieldsInLocalTime.Year = Year + 1;
RtlTimeFieldsToTime(&ExTimeZoneState->NextYearTimeFieldsInLocalTime, &v45);
ExLocalTimeToSystemTime(&v45, &ExTimeZoneState->NextYearTimeInUTC);
KiSetTimerEx(
&ExTimeZoneState->NextYear.Timer,
ExTimeZoneState->NextYearTimeInUTC,
0i64,
0,
&ExTimeZoneState->NextYear.Dpc);
_InterlockedAdd(&KUSER_SHARED_DATA.TimeZoneBiasStamp, 1u);
ExpWriteTimeZoneBias((UINT64 *)&ExTimeZoneState->TimeZoneBias.QuadPart);
if( LocalTime.QuadPart )
v38 = ExTimeZoneState->NextSystemCutoverInUTC.QuadPart;
else
v38 = ExTimeZoneState->NextYearTimeInUTC.QuadPart - 10000;
ExpWriteTimeZoneBiasStartEnd(LowPart, v38);
_InterlockedAdd(&KUSER_SHARED_DATA.TimeZoneBiasStamp, 1u);
if( !*(&stru_140CF2E80 + 1829) )
RtlSetActiveTimeBias((unsigned int)ExTimeZoneState->LastTimeZoneBias);
v39 = TimeFields.Year;
if( TimeFields.Year != ExTimeZoneState->LastDynamicTimeZoneYear )
{
if( RtlpUpdateDynamicTimeZones(TimeFields.Year) )
ExTimeZoneState->LastDynamicTimeZoneYear = v39;
}
ExpLogRefreshTimeZoneInformationSuccess((INT64)&TimeZoneInformation, v4, &a3, &QuadPart, (INT64 *)&LocalTime);
EtwTraceTimeZoneInformationRefresh(
0i64,
(unsigned int)ExTimeZoneState->LastTimeZoneBias,
*(unsigned int *)p_CurrentTimeZoneId,
v43[0],
v4);
return 1;
}Referenced by:
ExpReadLeapSecondData
ExpRefreshSystemTime
ExpSetSystemTime
ExpTimeZoneInitSiloState
NtSetSystemTime