RtlpQueryTimeZoneInformationWorker
NTSTATUS __stdcall RtlpQueryTimeZoneInformationWorker(VOID *DynamicTimeZoneInformation, size_t TimeZoneInformationSize){
NTSTATUS result;
int v5;
NTSTATUS v6;
int v7;
void *Key;
int v9[2];
__int64 v10;
int v11[2];
__int64 v12;
__int128 v13[36];
Key = 0i64;
v9[1] = 0;
v11[1] = 0;
v7 = 0;
v13[0] = 0i64;
result = RtlpGetTimeZoneInfoHandle(0, &Key);
if( result >= 0 )
{
memset(DynamicTimeZoneInformation, 0i64, TimeZoneInformationSize);
memset(&v13[1], 0i64, 0x230u);
v9[0] = 0x400000;
DWORD2(v13[1]) = 288;
*(_QWORD *)&v13[2] = L"Bias";
v10 = (__int64)DynamicTimeZoneInformation + 4;
*((_QWORD *)&v13[5] + 1) = L"StandardName";
*(_QWORD *)&v13[6] = v9;
*((_QWORD *)&v13[2] + 1) = DynamicTimeZoneInformation;
*(_QWORD *)&v13[9] = L"StandardBias";
*((_QWORD *)&v13[9] + 1) = (char *)DynamicTimeZoneInformation + 84;
*((_QWORD *)&v13[12] + 1) = L"StandardStart";
*(_QWORD *)&v13[13] = (char *)DynamicTimeZoneInformation + 68;
*((_DWORD *)DynamicTimeZoneInformation + 17) = -16;
v12 = (__int64)DynamicTimeZoneInformation + 88;
*(_QWORD *)&v13[16] = L"DaylightName";
*((_QWORD *)&v13[16] + 1) = v11;
*((_QWORD *)&v13[19] + 1) = L"DaylightBias";
*(_QWORD *)&v13[20] = (char *)DynamicTimeZoneInformation + 168;
*(_QWORD *)&v13[23] = L"DaylightStart";
v11[0] = 0x400000;
*((_QWORD *)&v13[23] + 1) = (char *)DynamicTimeZoneInformation + 152;
*((_DWORD *)DynamicTimeZoneInformation + 38) = -16;
LODWORD(v13[3]) = 0x4000000;
LODWORD(v13[5]) = 288;
DWORD2(v13[6]) = 0x1000000;
DWORD2(v13[8]) = 288;
LODWORD(v13[10]) = 0x4000000;
LODWORD(v13[12]) = 288;
DWORD2(v13[13]) = 50331648;
DWORD2(v13[15]) = 288;
LODWORD(v13[17]) = 0x1000000;
LODWORD(v13[19]) = 288;
DWORD2(v13[20]) = 0x4000000;
DWORD2(v13[22]) = 288;
LODWORD(v13[24]) = 50331648;
if( TimeZoneInformationSize >= 0x1B0 )
{
LODWORD(v13[0]) = 0x1000000;
*((_QWORD *)&v13[0] + 1) = (char *)DynamicTimeZoneInformation + 172;
*((_QWORD *)&v13[25] + 1) = RtlpQueryTimeZoneKeyNameRoutine;
*((_QWORD *)&v13[26] + 1) = L"TimeZoneKeyName";
*(_QWORD *)&v13[27] = v13;
*(_QWORD *)&v13[30] = L"DynamicDaylightTimeDisabled";
*((_QWORD *)&v13[30] + 1) = &v7;
DWORD2(v13[27]) = 0;
DWORD2(v13[29]) = 288;
LODWORD(v13[31]) = 0x4000000;
}
LOBYTE(v5) = RtlpQueryRegistryValues((_KTRAP_FRAME *)0x40000000, (_KEXCEPTION_FRAME *)Key);
v6 = v5;
if( v5 >= 0 && TimeZoneInformationSize >= 0x1B0 )
*((_BYTE *)DynamicTimeZoneInformation + 428) = v7 != 0;
ZwClose((_HANDLE)Key);
return v6;
}
return result;
}Referenced by:
EtwpAddLogHeader
RtlQueryDynamicTimeZoneInformation
RtlQueryTimeZoneInformation