MASM32编程将TimeStamp/UTC转换为具体日期时间的几个有用函数代码

　　这两天在编写一个读取系统事件日志的程序，其中结构变量EVENTLOGRECORD中成员TimeGenerated和TimeWritten的值为：

The time at which this entry was submitted. This time is measured in the number of seconds elapsed since 00:00:00 January 1, 1970, Universal Coordinated Time.

即从格林尼治时间1970年1月1日夜里12：00开始的秒数。

Windows系统好像没有直接提供将其转换为对应的年月日、时分秒的API函数。

Google了一下，在
http://www.asmcommunity.net/board/index.php?topic=18369.0
找到了donkey网友提供的方法，整理如下：

BaseTimeLowequ0D53E8000h
BaseTimeHighequ19DB1DEh


StampToLocalDateTimeprocdwStamp:dword,lpstLocalTime:dword
localstUtcFileTime:FILETIME
localstLocalFileTime:FILETIME

moveax,dwStamp
movedx,10000000
muledx
addeax,BaseTimeLow
adcedx,BaseTimeHigh

movstUtcFileTime.dwLowDateTime,eax
movstUtcFileTime.dwHighDateTime,edx
invokeFileTimeToLocalFileTime,addrstUtcFileTime,addrstLocalFileTime
invokeFileTimeToSystemTime,addrstLocalFileTime,lpstLocalTime

ret
StampToLocalDateTimeendp


LOCALE_SYSTEM_DEFAULTequ0
g_szFmtDatedb"yyyy-M-d",0
printDateproclpstDate:dword
localbuf[12]:byte
invokeGetDateFormat,LOCALE_SYSTEM_DEFAULT,NULL,lpstDate,offsetg_szFmtDate,addrbuf,sizeofbuf
m_InsTxtaddrbuf
ret
printDateendp

;LOCALE_SYSTEM_DEFAULTequ0
g_szFmtTimedb"H:m:ss",0
printTimeproclpstTime:dword
localbuf[9]:byte
invokeGetTimeFormat,LOCALE_SYSTEM_DEFAULT,NULL,lpstTime,offsetg_szFmtTime,addrbuf,sizeofbuf
m_InsTxtaddrbuf
ret
printTimeendp


g_szFmtDateTimedb"%d-%d-%d%d:%d:%d",0
printDateTimeproclpstDateTime:DWORD
localbuf[30]:byte

pusha
movedi,lpstDateTime
movzxeax,(SYSTEMTIMEptr[edi]).wYear
movzxebx,(SYSTEMTIMEptr[edi]).wMonth
movzxecx,(SYSTEMTIMEptr[edi]).wDay
movzxedx,(SYSTEMTIMEptr[edi]).wHour
movzxesi,(SYSTEMTIMEptr[edi]).wMinute
movzxedi,(SYSTEMTIMEptr[edi]).wSecond

invokewsprintf,addrbuf,addrg_szFmtDateTime,eax,ebx,ecx,edx,esi,edi
popa

ret
printDateTimeendp