NtSetSystemTime

INT64 __fastcall NtSetSystemTime(_LARGE_INTEGER *SystemTime, _LARGE_INTEGER *PreviousTime){
  INT8 v4; 
  __int64 v6; 
  LONGLONG QuadPart; 
  unsigned int v8; 
  char v9; 
  LARGE_INTEGER v10; 
  char HasCapability[8]; 
  union _LARGE_INTEGER SystemTimea; 
  LARGE_INTEGER NewTime; 
  union _LARGE_INTEGER Time; 
  UNICODE_STRING SourceString; 
  struct _TIME_FIELDS TimeFields; 
  SystemTimea.QuadPart = 0i64;
  NewTime.QuadPart = 0i64;
  Time.QuadPart = 0i64;
  TimeFields = 0i64;
  HasCapability[0] = 0;
  *(_QWORD *)&SourceString.Length = 2228256i64;
  SourceString.Buffer = L"systemManagement";
  if( SystemTime )
  {
    v4 = *((_BYTE *)KeGetCurrentThread() + 562);
    if( !SeSinglePrivilegeCheck(*(_QWORD *)&SeSystemtimePrivilege, v4)
      && (RtlIsMultiSessionSku()
       || (int)RtlCapabilityCheck(0i64, &SourceString, (UINT8 *)HasCapability) < 0
       || !HasCapability[0])
      || PsIsCurrentThreadInServerSilo() )
    {
      return 3221225569i64;
    }
    if( v4 )
    {
      if( ((unsigned __int8)SystemTime & 3) != 0 )
        ExRaiseDatatypeMisalignment();
      v6 = 0x7FFFFFFF0000i64;
      if( PreviousTime )
      {
        if( ((unsigned __int8)PreviousTime & 3) != 0 )
          ExRaiseDatatypeMisalignment();
        if( (unsigned __int64)PreviousTime < 0x7FFFFFFF0000i64 )
          v6 = (__int64)PreviousTime;
        *(_BYTE *)v6 = *(_BYTE *)v6;
        *(_BYTE *)(v6 + 7) = *(_BYTE *)(v6 + 7);
      }
      QuadPart = SystemTime->QuadPart;
      NewTime = *SystemTime;
    }
    else
    {
      QuadPart = SystemTime->QuadPart;
      NewTime = *SystemTime;
    }
    if( HIDWORD(QuadPart) > 0x20000000 )
      return 3221225485i64;
    ExAcquireTimeRefreshLock(1u);
    ExpSetSystemTime(1, 0, 1, NewTime, (__int64 *)&SystemTimea);
    SeAuditSystemTimeChange(SystemTimea, NewTime);
    ExReleaseTimeRefreshLock();
    if( PreviousTime )
      *PreviousTime = SystemTimea;
    return 0;
  }
  if( PsIsCurrentThreadInServerSilo() )
  {
    ExAcquireTimeRefreshLock(1u);
    ExpRefreshTimeZoneInformation();
    ExReleaseTimeRefreshLock();
    return 0;
  }
  v8 = -1073741811;
  ExAcquireTimeRefreshLock(1u);
  v9 = ExpSystemIsInCmosMode;
  if( (unsigned __int8)HalQueryRealTimeClock(&TimeFields)
    && RtlTimeFieldsToTime(&TimeFields, &Time)
    && (unsigned __int8)ExpRefreshTimeZoneInformation() )
  {
    v10 = *(LARGE_INTEGER *)&KUSER_SHARED_DATA.SystemTime.LowPart;
    SystemTimea = *(union _LARGE_INTEGER *)&KUSER_SHARED_DATA.SystemTime.LowPart;
    if( !ExpRealTimeIsUniversal )
    {
      if( v9 )
      {
        ExLocalTimeToSystemTime(&Time, &NewTime);
        KeSetSystemTime(&NewTime, &SystemTimea, 0i64);
        goto LABEL_29;
      }
      ExSystemTimeToLocalTime(&SystemTimea, &Time);
      RtlTimeToTimeFields(&Time, &TimeFields);
      HalSetRealTimeClock(&TimeFields);
      v10 = SystemTimea;
    }
    NewTime = v10;
LABEL_29:
    PoNotifySystemTimeSet(&NewTime, &SystemTimea, 3ui64);
    v8 = 0;
  }
  ExReleaseTimeRefreshLock();
  return v8;
}

Referenced by: