Function at 0x1400268f0
Capabilities:
Create thread
Log keystrokes via application hook
Set current directory

Disassembly:
mov byte [rsp + 0x10], dl
mov r11, rsp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x670
mov rax, qword [0x140104200]
xor rax, rsp
mov qword [rsp + 0x660], rax
mov r13, r8
mov byte [rsp + 0x40], cl
mov qword [r11 - 0x468], r8
mov byte [rsp + 0x48], r9b
xor edi, edi
lea rax, str.Runner_is_starting._Elevated_openOobe_openScoobe
mov qword [rsp + 0x190], rax
mov qword [rsp + 0x198], 0x39
mov qword [r11 - 0x570], rdi
mov qword [r11 - 0x578], rdi
mov qword [r11 - 0x568], rdi
movaps xmm0, xmmword [rsp + 0x190]
movdqa xmmword [rsp + 0x1c0], xmm0
movups xmm1, xmmword [rsp + 0x130]
movaps xmmword [rsp + 0x270], xmm1
movsd xmm0, qword [rsp + 0x140]
movsd qword [rsp + 0x280], xmm0
lea rax, [r11 + 0x28]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [r11 - 0x4e8]
lea rdx, [r11 - 0x438]
mov rcx, qword [0x14010fc20]
call fcn.14002bb80
lea rcx, [rdi - 4]
call qword [sym.imp.USER32.dll_SetProcessDpiAwarenessContext]
mov rax, qword [0x140104ee0]
movups xmm0, xmmword [rax - 0x10]
movups xmmword [rsp + 0x440], xmm0
cmp qword [0x140104ef8], rdi
je 0x1400269f7
mov ecx, 5
int 0x29
mov qword [0x140104f00], rdi
mov qword [0x140104f08], rdi
lea r9, [0x140104ef8]
lea r8, [0x140104ed8]
lea rdx, section..text
lea rcx, [rsp + 0x440]
call qword [sym.imp.api_ms_win_eventing_provider_l1_1_0.dll_EventRegister]
test eax, eax
jne 0x140026a47
mov r8, qword [0x140104ee0]
movzx r9d, word [r8]
lea edx, [rax + 2]
mov rcx, qword [0x140104ef8]
call qword [sym.imp.api_ms_win_eventing_provider_l1_1_0.dll_EventSetInformation]
movzx ecx, byte [rsp + 0x40]
call fcn.14003d5b0
nop
cmp qword [0x14010cf58], 0
jne 0x140026a9b
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x14002d5c0]
lea ecx, [r9 + 0xd]
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov qword [0x14010cf58], rax
test rax, rax
jne 0x140026a9b
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
lea r8, str.centralized_kb_hook
mov edx, eax
lea rcx, str.SetWindowsHookEx
call fcn.140026460
nop
cmp byte [rsp + 0x48], 0
jne 0x140026b34
cmp byte [rsp + 0x6d0], 0
je 0x140026b34
mov ecx, 1
call fcn.1400816b0
mov qword [rsp + 0x1f0], rax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x14002ba70]
xor edx, edx
xor ecx, ecx
call fcn.140088258
mov qword [rsp + 0x60], rax
test rax, rax
je 0x1400275e5
cmp dword [rsp + 0x68], 0
je 0x1400275c8
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x1d0], xmm0
lea rcx, [rsp + 0x1d0]
call fcn.14007e3ac
test eax, eax
jne 0x1400275d2
xorps xmm0, xmm0
movaps xmmword [rsp + 0x200], xmm0
movdqa xmmword [rsp + 0x60], xmm0
mov ecx, 1
call fcn.1400816b0
mov qword [rsp + 0x120], rax
lea rcx, [rsp + 0xe8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x14002baa0]
xor edx, edx
xor ecx, ecx
call fcn.140088258
mov qword [rsp + 0xe0], rax
test rax, rax
je 0x14002772e
cmp dword [rsp + 0xe8], 0
je 0x1400275da
movaps xmm0, xmmword [rsp + 0xe0]
movdqa xmmword [rsp + 0x1e0], xmm0
lea rcx, [rsp + 0x1e0]
call fcn.14007e3ac
test eax, eax
jne 0x1400275f4
xorps xmm0, xmm0
movaps xmmword [rsp + 0x210], xmm0
movdqa xmmword [rsp + 0xe0], xmm0
mov ecx, 1
call fcn.1400816b0
mov qword [rsp + 0x88], rax
lea rcx, [rsp + 0xd8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x14002bad0]
xor edx, edx
xor ecx, ecx
call fcn.140088258
mov qword [rsp + 0xd0], rax
test rax, rax
je 0x14002771c
cmp dword [rsp + 0xd8], 0
je 0x1400275fc
movaps xmm0, xmmword [rsp + 0xd0]
movdqa xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x90]
call fcn.14007e3ac
test eax, eax
jne 0x140027606
xorps xmm0, xmm0
movaps xmmword [rsp + 0x220], xmm0
movdqa xmmword [rsp + 0xd0], xmm0
mov r8d, 0x104
lea rdx, [rsp + 0x450]
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x450]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea rcx, [rsp + 0x450]
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_SetCurrentDirectoryW]
test eax, eax
jne 0x140026ca3
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edx, eax
lea r8, str.PowerToys___runner
lea rcx, str.Change_Directory_to_Executable_Path
call fcn.140026460
lea rax, str.PowerToys.FancyZonesModuleInterface.dll
mov qword [rsp + 0x2b0], rax
mov qword [rsp + 0x2b8], 0x27
lea rax, str.PowerToys.powerpreview.dll
mov qword [rsp + 0x2c0], rax
mov qword [rsp + 0x2c8], 0x1a
lea rax, str.PowerToys.ImageResizerExt.dll
mov qword [rsp + 0x2d0], rax
mov qword [rsp + 0x2d8], 0x1d
lea rax, str.PowerToys.KeyboardManager.dll
mov qword [rsp + 0x2e0], rax
mov qword [rsp + 0x2e8], 0x1d
lea rax, str.PowerToys.Launcher.dll
mov qword [rsp + 0x2f0], rax
mov qword [rsp + 0x2f8], 0x16
lea rax, str.WinUI3Apps_PowerToys.PowerRenameExt.dll
mov qword [rsp + 0x300], rax
mov qword [rsp + 0x308], 0x27
lea rax, str.PowerToys.ShortcutGuideModuleInterface.dll
mov qword [rsp + 0x310], rax
mov qword [rsp + 0x318], 0x2a
lea rax, str.PowerToys.ColorPicker.dll
mov qword [rsp + 0x320], rax
mov qword [rsp + 0x328], 0x19
lea rax, str.PowerToys.AwakeModuleInterface.dll
mov qword [rsp + 0x330], rax
mov qword [rsp + 0x338], 0x22
lea rax, str.PowerToys.FindMyMouse.dll
mov qword [rsp + 0x340], rax
mov qword [rsp + 0x348], 0x19
lea rax, str.PowerToys.MouseHighlighter.dll
mov qword [rsp + 0x350], rax
mov qword [rsp + 0x358], 0x1e
lea rax, str.PowerToys.MouseJump.dll
mov qword [rsp + 0x360], rax
mov qword [rsp + 0x368], 0x17
lea rax, str.PowerToys.AlwaysOnTopModuleInterface.dll
mov qword [rsp + 0x370], rax
mov qword [rsp + 0x378], 0x28
lea rax, str.PowerToys.MousePointerCrosshairs.dll
mov qword [rsp + 0x380], rax
mov qword [rsp + 0x388], 0x24
lea rax, str.PowerToys.PowerAccentModuleInterface.dll
mov qword [rsp + 0x390], rax
mov qword [rsp + 0x398], 0x28
lea rax, str.PowerToys.PowerOCRModuleInterface.dll
mov qword [rsp + 0x3a0], rax
mov qword [rsp + 0x3a8], 0x25
lea rax, str.PowerToys.PastePlainModuleInterface.dll
mov qword [rsp + 0x3b0], rax
mov qword [rsp + 0x3b8], 0x27
lea rax, str.WinUI3Apps_PowerToys.FileLocksmithExt.dll
mov qword [rsp + 0x3c0], rax
mov qword [rsp + 0x3c8], 0x29
lea rax, str.WinUI3Apps_PowerToys.RegistryPreviewExt.dll
mov qword [rsp + 0x3d0], rax
mov qword [rsp + 0x3d8], 0x2b
lea rax, str.WinUI3Apps_PowerToys.MeasureToolModuleInterface.dll
mov qword [rsp + 0x3e0], rax
mov qword [rsp + 0x3e8], 0x33
lea rax, str.WinUI3Apps_PowerToys.HostsModuleInterface.dll
mov qword [rsp + 0x3f0], rax
mov qword [rsp + 0x3f8], 0x2d
lea rax, str.WinUI3Apps_PowerToys.Peek.dll
mov qword [rsp + 0x400], rax
mov qword [rsp + 0x408], 0x1d
lea rax, str.WinUI3Apps_PowerToys.EnvironmentVariablesModuleInterface.dll
mov qword [rsp + 0x410], rax
mov qword [rsp + 0x418], 0x3c
lea rax, str.PowerToys.MouseWithoutBordersModuleInterface.dll
mov qword [rsp + 0x420], rax
mov qword [rsp + 0x428], 0x30
lea rax, str.PowerToys.CropAndLockModuleInterface.dll
mov qword [rsp + 0x430], rax
mov qword [rsp + 0x438], 0x28
xorps xmm0, xmm0
movdqu xmmword [rsp + 0xb0], xmm0
mov qword [rsp + 0xc0], rdi
mov edx, 0x19
call fcn.14002b4c0
mov qword [rsp + 0xb0], rax
lea r12, [rax + 0x190]
mov qword [rsp + 0xc0], r12
mov r8d, 0x190
lea rdx, [rsp + 0x2b0]
mov rcx, rax
call fcn.140083ba0
mov qword [rsp + 0xb8], r12
lea rax, str.PowerToys.VideoConferenceModule.dll
mov qword [rsp + 0x118], rax
lea rcx, str.mf.dll
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_1.dll_LoadLibraryA]
test rax, rax
je 0x140026fe3
mov rcx, rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
lea r8, [rsp + 0x118]
mov rdx, r12
lea rcx, [rsp + 0xb0]
call fcn.14002b700
mov r12, qword [rsp + 0xb8]
mov rbx, qword [rsp + 0xb0]
mov qword [rsp + 0xa8], r12
lea r14, str.C:_a_work1_s_src_runnerpowertoy_module.cpp
lea r15, str.class_PowertoyModule___cdecl_load_powertoy_const_class_std::basic_string_view_wchar_t_struct_std::char_traits_wchar_t____
mov qword [rsp + 0x80], rbx
cmp rbx, r12
je 0x140027130
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x1a0], xmm0
mov dword [rsp + 0x148], 0x10
mov dword [rsp + 0x14c], 0x1a
mov qword [rsp + 0x150], r14
mov qword [rsp + 0x158], r15
mov rcx, qword [rbx]
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_1.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x14002760e
lea rdx, str.powertoy_create
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
test rax, rax
je 0x14002761b
call rax
test rax, rax
je 0x140027657
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0x70]
call fcn.140023c60
lea rcx, [rsp + 0x70]
call fcn.1400241a0
nop
call fcn.140023980
mov rsi, rax
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rcx]
call qword [rdx + reloc.OLEAUT32.dll_VariantClear]
mov qword [rsp + 0xa0], rax
lea r9, [rsp + 0x70]
lea r8, [rsp + 0xa0]
lea rdx, [rsp + 0x230]
mov rcx, rsi
call fcn.14002b860
nop
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x1400270e5
mov rax, qword [rcx]
call qword [rax + 0x40]
nop
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1400270f6
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
nop
add rbx, 0x10
jmp 0x140027001
call fcn.14001fcc0
lea rcx, [rsp + 0x290]
call fcn.14001cf10
nop
movzx edx, byte [rsp + 0x40]
lea rcx, [rsp + 0x290]
call fcn.14003ac10
lea rcx, [rsp + 0x290]
call fcn.140034570
cmp byte [rsp + 0x6b8], 0
je 0x140027331
mov byte [rsp + 0x110], 0
mov r14, qword [r13 + 0x10]
test r14, r14
je 0x1400272bb
mov r15, r13
cmp qword [r13 + 0x18], 0x10
jb 0x140027193
mov r15, qword [r13]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
mov r9d, r14d
mov r8, r15
xor edx, edx
mov ecx, 0xfde9
call sub.api_ms_win_core_string_l1_1_0.dll_MultiByteToWideChar
mov r12d, eax
test eax, eax
jne 0x1400271cc
mov rbx, rdi
mov rsi, rdi
mov rdx, rdi
mov rcx, rdi
mov rax, rdi
mov r8, rdi
mov r9, rdi
jmp 0x140027209
mov ecx, r12d
call fcn.14001b320
mov rbx, rax
mov rsi, rax
mov rax, qword [rax + 0x10]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rax
mov r9d, r14d
mov r8, r15
xor edx, edx
mov ecx, 0xfde9
call sub.api_ms_win_core_string_l1_1_0.dll_MultiByteToWideChar
mov rdx, rbx
mov rcx, rbx
mov rax, rbx
mov r8, rbx
mov r9, rbx
mov qword [rsp + 0x80], rbx
cmp byte [rsp + 0x110], 0
je 0x140027243
test rsi, rsi
je 0x14002722a
mov rdx, qword [rdx + 0x10]
mov r8d, dword [rcx + 4]
jmp 0x140027234
lea rdx, [0x1400d9e70]
mov r8, rdi
lea rcx, [rsp + 0xf0]
call fcn.1400084e0
jmp 0x14002728c
xorps xmm0, xmm0
movups xmmword [rsp + 0xf0], xmm0
mov qword [rsp + 0x100], rdi
mov qword [rsp + 0x108], rdi
test rax, rax
je 0x14002726d
mov rdx, qword [r8 + 0x10]
mov r8d, dword [r9 + 4]
jmp 0x140027277
lea rdx, [0x1400d9e70]
mov r8, rdi
lea rcx, [rsp + 0xf0]
call fcn.1400086a0
mov byte [rsp + 0x110], 1
test rbx, rbx
je 0x1400272bb
mov eax, 0xffffffff
lock xadd dword [rbx + 0x18], eax
sub eax, 1
jne 0x14002738f
call sub.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap
mov rcx, rax
mov r8, qword [rsp + 0x80]
xor edx, edx
call sub.api_ms_win_core_heap_l1_1_0.dll_HeapFree
mov byte [rsp + 0x128], 0
lea rax, [rsp + 0x248]
mov qword [rsp + 0x88], rax
mov byte [rsp + 0x268], 0
cmp byte [rsp + 0x110], 0
je 0x140027302
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0x248]
call fcn.1400083a0
mov byte [rsp + 0x268], 1
lea r8, [rsp + 0x120]
xor edx, edx
lea rcx, [rsp + 0x248]
call fcn.140038db0
nop
cmp byte [rsp + 0x110], 0
je 0x140027331
lea rcx, [rsp + 0xf0]
call fcn.140008470
cmp byte [rsp + 0x48], 0
je 0x14002740d
call fcn.140033dc0
mov ecx, 1
call fcn.1400816b0
mov qword [rsp + 0x88], rax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x14003a4b0]
xor edx, edx
xor ecx, ecx
call fcn.140088258
mov qword [rsp + 0x60], rax
test rax, rax
je 0x1400276c9
cmp dword [rsp + 0x68], 0
je 0x1400276a5
jmp 0x14002739c
test eax, eax
js 0x1400276b0
jmp 0x1400272bb
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x90]
call fcn.14007e3ac
test eax, eax
jne 0x1400276b6
mov ecx, 1
call fcn.1400816b0
mov qword [rsp + 0x88], rax
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x140032610]
xor edx, edx
xor ecx, ecx
call fcn.140088258
mov qword [rsp + 0x70], rax
test rax, rax
je 0x14002770d
cmp dword [rsp + 0x78], 0
je 0x1400276be
jmp 0x14002748b
cmp byte [rsp + 0x6d0], 0
je 0x1400273bf
mov ecx, 1
call fcn.1400816b0
mov qword [rsp + 0x88], rax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x14003a500]
xor edx, edx
xor ecx, ecx
call fcn.140088258
mov qword [rsp + 0x60], rax
test rax, rax
je 0x1400276ea
cmp dword [rsp + 0x68], 0
je 0x1400276d8
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x90]
call fcn.14007e3ac
test eax, eax
jne 0x1400276e2
jmp 0x1400273bf
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x90]
call fcn.14007e3ac
test eax, eax
jne 0x1400276f9
mov byte [rsp + 0xac], 0
mov rdx, qword [rsp + 0xa8]
call fcn.140026550
mov ebx, eax
mov rdx, qword [rsp + 0x2a8]
cmp rdx, 8
jb 0x14002750d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x290]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140027508
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140027701
call fcn.1400816f4
mov qword [rsp + 0x2a0], rdi
mov qword [rsp + 0x2a8], 7
mov word [rsp + 0x290], di
mov rcx, qword [rsp + 0xb0]
test rcx, rcx
je 0x140027570
mov rdx, qword [rsp + 0xc0]
sub rdx, rcx
and rdx, 0xfffffffffffffff0
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002756a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140027707
call fcn.1400816f4
nop
jmp 0x140027580
mov rcx, qword [0x140104ef8]
mov dword [0x140104ed8], edi
mov qword [0x140104ef8], rdi
call qword [sym.imp.api_ms_win_eventing_provider_l1_1_0.dll_EventUnregister]
nop
mov rcx, r13
call fcn.14000e490
mov eax, ebx
mov rcx, qword [rsp + 0x660]
xor rcx, rsp
call fcn.140081690
add rsp, 0x670
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov ecx, 1
call fcn.14007dcb0
mov ecx, eax
call fcn.14007dc74
nop
mov ecx, 1
call fcn.14007dcb0
nop
mov dword [rsp + 0x68], edi
mov ecx, 6
call fcn.14007dcb0
nop
mov ecx, eax
call fcn.14007dc74
nop
mov ecx, 1
call fcn.14007dcb0
mov ecx, eax
call fcn.14007dc74
nop
lea rcx, [rsp + 0x148]
call fcn.140023710
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
mov dword [rsp + 0x160], 0x15
mov dword [rsp + 0x164], 0x10
mov qword [rsp + 0x168], r14
mov qword [rsp + 0x170], r15
lea rcx, [rsp + 0x160]
call fcn.140023710
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
mov dword [rsp + 0x178], 0x1b
mov dword [rsp + 0x17c], 0x10
mov qword [rsp + 0x180], r14
mov qword [rsp + 0x188], r15
mov edx, 0x80004003
lea rcx, [rsp + 0x50]
call fcn.14001b2f0
lea rdx, [rsp + 0x178]
mov ecx, dword [rax]
call fcn.14001bf90
nop
mov ecx, 1
call fcn.14007dcb0
nop
call fcn.14008e104
nop
mov ecx, eax
call fcn.14007dc74
nop
mov ecx, 1
call fcn.14007dcb0
nop
mov dword [rsp + 0x68], edi
mov ecx, 6
call fcn.14007dcb0
nop
mov ecx, 1
call fcn.14007dcb0
mov ecx, eax
call fcn.14007dc74
nop
mov dword [rsp + 0x68], edi
mov ecx, 6
call fcn.14007dcb0
nop
mov ecx, eax
call fcn.14007dc74
nop
call fcn.140088774
nop
call fcn.140088774
nop
mov dword [rsp + 0x78], edi
mov ecx, 6
call fcn.14007dcb0
nop
mov dword [rsp + 0xd8], edi
mov ecx, 6
call fcn.14007dcb0
nop
mov dword [rsp + 0xe8], edi
mov ecx, 6
call fcn.14007dcb0
int3