IDA Free and _time64 decompilation?

51 Views Asked by At

I'm trying to understand this line specifically: now_int = time64(0);

Reading the docs for time, _time32, _time64, time64() accepts a pointer or NULL and should return a __time64_t type.

In the decompiled code, it takes a parameter 0 and returns the current UNIX timestamp.

int unknown_seed_stuff()
{
    int now_int; // eax
    double now_double; // xmm0_8

    now_int = time64(0);
    srand(now_int);
    now_double = (double)time64(0);
    if ( now_double >= 2147483647.0 )
        now_double = now_double * 0.5;
    prng_seed_0 = now_double;
    dword_FF9268 = time64(0) ^ 0xC;
    return atexit(nullsub_141);
}

This is the disassembly for the code above.

.text:00413CB0 unknown_seed_stuff proc near            ; DATA XREF: .rdata:00D263D0↓o
.text:00413CB0                 push    esi
.text:00413CB1                 mov     esi, ds:_time64
.text:00413CB7                 push    0               ; Time
.text:00413CB9                 call    esi ; _time64
.text:00413CBB                 push    eax             ; Seed
.text:00413CBC                 call    ds:srand
.text:00413CC2                 push    0               ; Time
.text:00413CC4                 call    esi ; _time64
.text:00413CC6                 add     esp, 0Ch
.text:00413CC9                 mov     ecx, eax
.text:00413CCB                 call    __ltod3
.text:00413CD0                 comisd  xmm0, ds:MAXINT
.text:00413CD8                 jb      short loc_413CE2
.text:00413CDA                 mulsd   xmm0, ds:qword_E69F70
.text:00413CE2
.text:00413CE2 loc_413CE2:                             ; CODE XREF: unknown_seed_stuff+28↑j
.text:00413CE2                 push    0               ; Time
.text:00413CE4                 movsd   prng_seed_0, xmm0
.text:00413CEC                 call    esi ; _time64
.text:00413CEE                 xor     eax, 0Ch
.text:00413CF1                 push    offset nullsub_141 ; void (__cdecl *)()
.text:00413CF6                 mov     dword_FF9268, eax
.text:00413CFB                 call    _atexit
.text:00413D00                 add     esp, 8
.text:00413D03                 pop     esi
.text:00413D04                 retn
.text:00413D04 unknown_seed_stuff endp

And that's at the offset of ds:_time64 (when time64() is called):

.idata:00D25410 ; __time64_t (__cdecl *time64)(__time64_t *Time)
.idata:00D25410 _time64         dd offset msvcr120__time64
.idata:00D25410                                         ; CODE XREF: unknown_seed_stuff+9↑p
.idata:00D25410                                         ; unknown_seed_stuff+14↑p ...

Why does it accept 0 instead of a pointer or NULL, and why does it not return a __time64_t type but the value of the timestamp (as int32 no less)?

0

There are 0 best solutions below