Convert assembly ADC to C#

Question

I have this dissassembled routine from an executable but I am having troubles to translate it to C#.

.text:005C9290 ; =============== S U B R O U T I N E =======================================
.text:005C9290
.text:005C9290 ; Attributes: bp-based frame
.text:005C9290
.text:005C9290 sub_5C9290      proc near               ; CODE XREF: .text:00574256p
.text:005C9290                                         ; sub_5ACC50+68p ...
.text:005C9290
.text:005C9290 SystemTimeAsFileTime= _FILETIME ptr -8
.text:005C9290 arg_0           = dword ptr  8
.text:005C9290
.text:005C9290                 push    ebp
.text:005C9291                 mov     ebp, esp
.text:005C9293                 push    ecx
.text:005C9294                 push    ecx
.text:005C9295                 lea     eax, [ebp+SystemTimeAsFileTime]
.text:005C9298                 push    eax             ; lpSystemTimeAsFileTime
.text:005C9299                 call    ds:GetSystemTimeAsFileTime
.text:005C929F                 mov     eax, [ebp+SystemTimeAsFileTime.dwLowDateTime]
.text:005C92A2                 mov     ecx, [ebp+SystemTimeAsFileTime.dwHighDateTime]
.text:005C92A5                 push    0
.text:005C92A7                 add     eax, 2AC18000h
.text:005C92AC                 push    offset unk_989680
.text:005C92B1                 adc     ecx, 0FE624E21h
.text:005C92B7                 push    ecx
.text:005C92B8                 push    eax
.text:005C92B9                 call    sub_5D0500
.text:005C92BE                 mov     ecx, [ebp+arg_0]
.text:005C92C1                 test    ecx, ecx
.text:005C92C3                 jz      short locret_5C92C7
.text:005C92C5                 mov     [ecx], eax
.text:005C92C7
.text:005C92C7 locret_5C92C7:                          ; CODE XREF: sub_5C9290+33j
.text:005C92C7                 leave
.text:005C92C8                 retn
.text:005C92C8 sub_5C9290      endp
.text:005C92C8
.text:005C92C9

However, I have this pseudo-code from this function generated by IDA Pro:

__int64 __cdecl sub_5C9290(int a1)
{
  __int64 result; // qax@1
  unsigned __int64 v2; // ST00_8@1
  struct _FILETIME SystemTimeAsFileTime; // [sp+0h] [bp-8h]@1

  GetSystemTimeAsFileTime(&SystemTimeAsFileTime);
  HIDWORD(v2) = ((_DWORD)SystemTimeAsFileTime.dwLowDateTime >= 0xD53E8000u)
              + SystemTimeAsFileTime.dwHighDateTime
              - 27111903;
  LODWORD(v2) = SystemTimeAsFileTime.dwLowDateTime + 717324288;
  result = sub_5D0500(v2, (unsigned int)&unk_989680, 0);
  if ( a1 )
    *(_DWORD *)a1 = result;
  return result;
}

One problems is that code won't compile, this code doesn't make sense:

HIDWORD(v2) = ((_DWORD)SystemTimeAsFileTime.dwLowDateTime >= 0xD53E8000u)
              + SystemTimeAsFileTime.dwHighDateTime
              - 27111903;

Also one problem is the ADC command which all I can find is that it is exactly as ADD but it also adds the CARRY FLAG to the result, but I can't find any ways to reproduce this command in C#. And what about all those HIDWORD and LODWORD macros?

Answer 1

This is 64-bit math. The compiler has to do the addition in two steps because the processor can only work 32 bits at a time. And carry has to be propagated from the low addition to the high one - same way when you do addition of multiple-digit numbers on paper.

Here's what the current version of the decompiler (1.7) produces (after fixing the function prototype):

result = sub5D0500(time - 116444736000000000i64, 10000000i64);

And (just a guess) if you rename sub5D0500 to __alldiv (compiler helper function for 64-bit division), it becomes:

result = (time - 116444736000000000i64) / 10000000;

Apparently you're looking at MSVC's _time64 implementation. From time64.c:

/*
 * Number of 100 nanosecond units from 1/1/1601 to 1/1/1970
 */
#define EPOCH_BIAS  116444736000000000i64
[...]
__time64_t __cdecl _time64 (
        __time64_t *timeptr
        )
{
        __time64_t tim;
        FT nt_time;
        GetSystemTimeAsFileTime( &(nt_time.ft_struct) );
        tim = (__time64_t)((nt_time.ft_scalar - EPOCH_BIAS) / 10000000i64);
        if (timeptr)
                *timeptr = tim;         /* store time if requested */
        return tim;
}