Proposals / #1013

Type the log cleanup reference time as a FILETIME pointer

applied · by Commit-Will · submitted 2026-11-02, applied 2026-11-02

Ghidra v1846 · 3cfe190

The first input is an address to a real FILETIME object, not an int32_t timestamp. The sole caller passes GetLocalTime output to the original SystemTimeToFileTime import, then forwards that exact FILETIME output address in ECX. The target captures this base and reads DWORD+4, the registered FILETIME.dwHighDateTime field, comparing it with another FILETIME produced locally by the same API. Use existing FILETIME * for pRefFileTime while preserving its chosen name, ECX:4 storage, second filename pointer, void result and ordinary fastcall. This changes only the input type; no timestamp signedness, deletion age/calendar/parser/conversion-success, filesystem action or runtime behavior is asserted.

Changes 1, applied together

1. Retype variable win 0x0040f3d0 ECX

   typeint32_t→FILETIME *