NtSetSystemTime

NTSTATUS __stdcall NtSetSystemTime(_LARGE_INTEGER *SystemTime, _LARGE_INTEGER *PreviousTime){
  char PreviousMode; 
  __int64 v6; 
  LONGLONG QuadPart; 
  NTSTATUS v8; 
  char v9; 
  _LARGE_INTEGER v10; 
  INT64 v11; 
  __int64 HasCapability; 
  _LARGE_INTEGER OldTime; 
  _LARGE_INTEGER NewTime; 
  _LARGE_INTEGER Time; 
  _UNICODE_STRING CapabilityName; 
  _TIME_FIELDS TimeFields; 

  OldTime.QuadPart = 0i64;
  NewTime.QuadPart = 0i64;
  Time.QuadPart = 0i64;
  TimeFields = 0i64;
  LOBYTE(HasCapability) = 0;
  *(_QWORD *)&CapabilityName.Length = 2228256i64;
  CapabilityName.Buffer = L"systemManagement";
  if( SystemTime )
  {
    PreviousMode = KeGetCurrentThread()->PreviousMode;
    if( !SeSinglePrivilegeCheck(*(_QWORD *)&SeSystemtimePrivilege, PreviousMode)
      && (RtlIsMultiSessionSku()
       || RtlCapabilityCheck(0i64, &CapabilityName, (UINT8 *)&HasCapability) < 0
       || !(_BYTE)HasCapability)
      || PsIsCurrentThreadInServerSilo() )
    {
      return -1073741727;
    }
    if( PreviousMode )
    {
      if( ((unsigned __int8)SystemTime & 3) != 0 )
        ExRaiseDatatypeMisalignment();
      v6 = 0x7FFFFFFF0000i64;
      if( PreviousTime )
      {
        if( ((unsigned __int8)PreviousTime & 3) != 0 )
          ExRaiseDatatypeMisalignment();
        if( (unsigned __int64)PreviousTime < 0x7FFFFFFF0000i64 )
          v6 = (__int64)PreviousTime;
        *(_BYTE *)v6 = *(_BYTE *)v6;
        *(_BYTE *)(v6 + 7) = *(_BYTE *)(v6 + 7);
      }
      QuadPart = SystemTime->QuadPart;
      NewTime = *SystemTime;
    }
    else
    {
      QuadPart = SystemTime->QuadPart;
      NewTime = *SystemTime;
    }
    if( HIDWORD(QuadPart) > 0x20000000 )
      return -1073741811;
    ExAcquireTimeRefreshLock(1u);
    ExpSetSystemTime(1u, 0, TimeChangeApplication, NewTime, &OldTime);
    SeAuditSystemTimeChange(OldTime, NewTime);
    ExReleaseTimeRefreshLock();
    if( PreviousTime )
      *PreviousTime = OldTime;
    return 0;
  }
  if( PsIsCurrentThreadInServerSilo() )
  {
    ExAcquireTimeRefreshLock(1u);
    ExpRefreshTimeZoneInformation();
    ExReleaseTimeRefreshLock();
    return 0;
  }
  v8 = -1073741811;
  ExAcquireTimeRefreshLock(1u);
  v9 = ExpSystemIsInCmosMode;
  if( (unsigned __int8)HalQueryRealTimeClock(&TimeFields)
    && RtlTimeFieldsToTime(&TimeFields, &Time)
    && ExpRefreshTimeZoneInformation() )
  {
    v10 = *(_LARGE_INTEGER *)&KUSER_SHARED_DATA.SystemTime.LowPart;
    OldTime = *(_LARGE_INTEGER *)&KUSER_SHARED_DATA.SystemTime.LowPart;
    if( !*(&stru_140CF2E80 + 1829) )
    {
      if( v9 )
      {
        ExLocalTimeToSystemTime(&Time, &NewTime);
        KeSetSystemTime(&NewTime, &OldTime, 0i64);
        goto LABEL_29;
      }
      ExSystemTimeToLocalTime(&OldTime, &Time);
      RtlTimeToTimeFields((INT64 *)&Time, (WORD *)&TimeFields, v11);
      HalSetRealTimeClock(&TimeFields.Year);
      v10 = OldTime;
    }
    NewTime = v10;
LABEL_29:
    PoNotifySystemTimeSet(&NewTime, &OldTime, TimeChangeTimeZone);
    v8 = 0;
  }
  ExReleaseTimeRefreshLock();
  return v8;
}

Referenced by: