I have this dissassembled routine from an executable but I am having troubles to translate it to C#.
.text:005C9290 ; =============== S U B R O U T I N E =======================================
.text:005C9290
.text:005C9290 ; Attributes: bp-based frame
.text:005C9290
.text:005C9290 sub_5C9290 proc near ; CODE XREF: .text:00574256p
.text:005C9290 ; sub_5ACC50+68p ...
.text:005C9290
.text:005C9290 SystemTimeAsFileTime= _FILETIME ptr -8
.text:005C9290 arg_0 = dword ptr 8
.text:005C9290
.text:005C9290 push ebp
.text:005C9291 mov ebp, esp
.text:005C9293 push ecx
.text:005C9294 push ecx
.text:005C9295 lea eax, [ebp+SystemTimeAsFileTime]
.text:005C9298 push eax ; lpSystemTimeAsFileTime
.text:005C9299 call ds:GetSystemTimeAsFileTime
.text:005C929F mov eax, [ebp+SystemTimeAsFileTime.dwLowDateTime]
.text:005C92A2 mov ecx, [ebp+SystemTimeAsFileTime.dwHighDateTime]
.text:005C92A5 push 0
.text:005C92A7 add eax, 2AC18000h
.text:005C92AC push offset unk_989680
.text:005C92B1 adc ecx, 0FE624E21h
.text:005C92B7 push ecx
.text:005C92B8 push eax
.text:005C92B9 call sub_5D0500
.text:005C92BE mov ecx, [ebp+arg_0]
.text:005C92C1 test ecx, ecx
.text:005C92C3 jz short locret_5C92C7
.text:005C92C5 mov [ecx], eax
.text:005C92C7
.text:005C92C7 locret_5C92C7: ; CODE XREF: sub_5C9290+33j
.text:005C92C7 leave
.text:005C92C8 retn
.text:005C92C8 sub_5C9290 endp
.text:005C92C8
.text:005C92C9
However, I have this pseudo-code from this function generated by IDA Pro:
__int64 __cdecl sub_5C9290(int a1)
{
__int64 result; // qax@1
unsigned __int64 v2; // ST00_8@1
struct _FILETIME SystemTimeAsFileTime; // [sp+0h] [bp-8h]@1
GetSystemTimeAsFileTime(&SystemTimeAsFileTime);
HIDWORD(v2) = ((_DWORD)SystemTimeAsFileTime.dwLowDateTime >= 0xD53E8000u)
+ SystemTimeAsFileTime.dwHighDateTime
- 27111903;
LODWORD(v2) = SystemTimeAsFileTime.dwLowDateTime + 717324288;
result = sub_5D0500(v2, (unsigned int)&unk_989680, 0);
if ( a1 )
*(_DWORD *)a1 = result;
return result;
}
One problems is that code won't compile, this code doesn't make sense:
HIDWORD(v2) = ((_DWORD)SystemTimeAsFileTime.dwLowDateTime >= 0xD53E8000u)
+ SystemTimeAsFileTime.dwHighDateTime
- 27111903;
Also one problem is the ADC
command which all I can find is that it is exactly as ADD
but it also adds the CARRY FLAG
to the result, but I can't find any ways to reproduce this command in C#.
And what about all those HIDWORD
and LODWORD
macros?
add
followed by anadc
to just be an extended (in this case, 64-bit) addition. In this particular case a 64-bit constant (0FE624E212AC18000h
) is being added to a two-limb value made up ofecx:eax
.D53E8000h
is-2AC18000h
. The snippet confusing you is merely the calculation of the carry value.