Function at 0x18011ac40
Capabilities:
Log keystrokes via polling
Spoof parent pid

Disassembly:
jmp 0x18011ac40
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x3c0
lea rdi, [rsp + 0x50]
mov ecx, 0xdc
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x3d0]
mov rax, qword [0x1805a6200]
xor rax, rsp
mov qword [rsp + 0x3b8], rax
mov dword [rsp + 0x50], 0xc0000001
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x78], 0
mov byte [rsp + 0x114], 0
cmp qword [rsp + 0x3d8], 0
je 0x18011acc1
mov rax, qword [rsp + 0x3d8]
cmp qword [rax], 0
jne 0x18011accb
mov eax, 0xc0000001
jmp 0x18011b4da
mov rax, qword [rsp + 0x3d8]
mov rcx, rax
call sym.ProcessMonitor.dll_PhExpandEnvironmentStrings
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jne 0x18011acfd
mov rax, qword [rsp + 0x3d8]
mov rcx, rax
call fcn.180006dd0
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
lea r9, [rsp + 0x68]
lea r8, [rsp + 0xb8]
lea rdx, [rsp + 0x88]
mov rcx, rax
call sym.ProcessMonitor.dll_PhParseCommandLineFuzzy
cmp qword [rsp + 0x68], 0
je 0x18011ad32
mov rax, qword [rsp + 0x68]
cmp qword [rax], 0
jne 0x18011ad4c
lea rcx, [rsp + 0x88]
call fcn.180006dd0
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.180003fd0
cmp qword [rsp + 0x68], 0
je 0x18011ad5f
mov rax, qword [rsp + 0x68]
cmp qword [rax], 0
jne 0x18011ad7b
cmp qword [rsp + 0x68], 0
je 0x18011ad71
mov rcx, qword [rsp + 0x68]
call sym.ProcessMonitor.dll_PhDereferenceObject
mov eax, 0xc0000001
jmp 0x18011b4da
cmp qword [rsp + 0xb8], 0
je 0x18011ad98
lea rcx, [rsp + 0xb8]
call fcn.180006dd0
mov qword [rsp + 0x78], rax
lea rdx, [rsp + 0xe8]
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax + 8]
call fcn.1800036c0
test eax, eax
jl 0x18011ade7
mov eax, dword [rsp + 0x108]
and eax, 0x10
test eax, eax
je 0x18011adcd
mov dword [rsp + 0x378], 1
jmp 0x18011add8
mov dword [rsp + 0x378], 0
movzx eax, byte [rsp + 0x378]
mov byte [rsp + 0x114], al
movzx eax, byte [rsp + 0x114]
test eax, eax
jne 0x18011ae08
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax + 8]
call sym.ProcessMonitor.dll_PhDoesFileExistsWin32
movzx eax, al
test eax, eax
jne 0x18011ae30
xor r9d, r9d
xor r8d, r8d
mov rax, qword [rsp + 0x58]
mov rdx, qword [rax + 8]
mov rax, qword [rsp + 0x3d0]
mov rcx, qword [rax]
call fcn.180019bc0
mov dword [rsp + 0x50], eax
jmp 0x18011b4a0
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf0
mov rax, qword [rsp + 0x3d0]
mov rcx, qword [rax + 0x10]
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 1
je 0x18011ae72
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
test eax, eax
jge 0x18011aeb8
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
test eax, eax
jge 0x18011aeb8
mov rcx, qword [rsp + 0x78]
call fcn.1800082b0
mov qword [rsp + 0x380], rax
mov rcx, qword [rsp + 0x68]
call fcn.1800082b0
mov r9b, 1
mov rcx, qword [rsp + 0x380]
mov r8, rcx
mov rdx, rax
mov rax, qword [rsp + 0x3d0]
mov rcx, qword [rax]
call fcn.180019bc0
mov dword [rsp + 0x50], eax
jmp 0x18011b4a0
mov dword [rsp + 0x124], 0xffffffff
mov qword [rsp + 0x138], 0
mov qword [rsp + 0x148], 0
mov qword [rsp + 0x238], 0
mov qword [rsp + 0x258], 0
mov qword [rsp + 0x278], 0
mov qword [rsp + 0x298], 0
mov dword [rsp + 0x2a4], 0
mov r8d, 0x70
xor edx, edx
lea rcx, [rsp + 0x1b0]
call fcn.180013180
mov dword [rsp + 0x1b0], 0x70
mov dword [rsp + 0x1ec], 1
mov eax, 0xa
mov word [rsp + 0x1f0], ax
xor ecx, ecx
call fcn.1800197f0
mov qword [rsp + 0x138], rax
call qword [sym.imp.USER32.dll_GetShellWindow]
mov qword [rsp + 0x198], rax
cmp qword [rsp + 0x198], 0
jne 0x18011af9c
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x3d0]
call fcn.180019dd0
movzx eax, al
test eax, eax
je 0x18011af97
mov dword [rsp + 0x50], 0
jmp 0x18011b3e1
lea rdx, [rsp + 0x124]
mov rcx, qword [rsp + 0x198]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp dword [rsp + 0x124], 0xffffffff
jne 0x18011afc9
mov dword [rsp + 0x50], 0xc0000001
jmp 0x18011b3e1
lea rcx, [rsp + 0x300]
call sym.ProcessMonitor.dll_PhGetOwnTokenAttributes
mov eax, dword [rax + 8]
and eax, 1
test eax, eax
je 0x18011afed
mov dword [rsp + 0x388], 0x21000
jmp 0x18011aff8
mov dword [rsp + 0x388], 0
mov ecx, dword [rsp + 0x124]
call fcn.18000b5e0
mov ecx, dword [rsp + 0x388]
bts ecx, 7
mov r8, rax
mov edx, ecx
lea rcx, [rsp + 0x148]
call fcn.180011720
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jge 0x18011b031
jmp 0x18011b3e1
lea r9, [rsp + 0x238]
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
test eax, eax
jne 0x18011b066
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x18011b066
call fcn.180010890
mov dword [rsp + 0x50], eax
jmp 0x18011b3e1
mov rcx, qword [rsp + 0x238]
call sym.ProcessMonitor.dll_PhAllocate
mov qword [rsp + 0x218], rax
lea r9, [rsp + 0x238]
xor r8d, r8d
mov edx, 1
mov rcx, qword [rsp + 0x218]
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
test eax, eax
jne 0x18011b0ab
call fcn.180010890
mov dword [rsp + 0x50], eax
jmp 0x18011b3e1
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 8
lea r9, [rsp + 0x148]
mov r8d, 0x20000
xor edx, edx
mov rcx, qword [rsp + 0x218]
call qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
test eax, eax
jne 0x18011b0f6
call fcn.180010890
mov dword [rsp + 0x50], eax
jmp 0x18011b3e1
lea rcx, [rsp + 0x318]
call sym.ProcessMonitor.dll_PhGetOwnTokenAttributes
mov eax, dword [rax + 8]
and eax, 1
test eax, eax
je 0x18011b127
lea r8, [rsp + 0x258]
mov edx, 0x15
mov rcx, qword [rsp + 0x148]
call sym.ProcessMonitor.dll_PhGetObjectSecurity
lea rcx, [rsp + 0x330]
call sym.ProcessMonitor.dll_PhGetOwnTokenAttributes
mov eax, dword [rax + 8]
and eax, 1
test eax, eax
je 0x18011b14b
mov dword [rsp + 0x38c], 0x20000
jmp 0x18011b156
mov dword [rsp + 0x38c], 0
mov eax, dword [rsp + 0x38c]
or eax, 8
lea r8, [rsp + 0x188]
mov edx, eax
mov rcx, qword [rsp + 0x148]
call fcn.180006550
test eax, eax
jl 0x18011b20b
lea rcx, [rsp + 0x348]
call sym.ProcessMonitor.dll_PhGetOwnTokenAttributes
mov eax, dword [rax + 8]
and eax, 1
test eax, eax
je 0x18011b1b0
lea r8, [rsp + 0x278]
mov edx, 0x15
mov rcx, qword [rsp + 0x188]
call sym.ProcessMonitor.dll_PhGetObjectSecurity
call fcn.18000ffe0
test rax, rax
je 0x18011b1fd
call fcn.18000ffe0
mov qword [rsp + 0x390], rax
xor r8d, r8d
mov rdx, qword [rsp + 0x188]
lea rcx, [rsp + 0x298]
mov rax, qword [rsp + 0x390]
call qword [0x180c63010]
test eax, eax
je 0x18011b1fd
mov eax, dword [rsp + 0x2a4]
or eax, 2
mov dword [rsp + 0x2a4], eax
mov rcx, qword [rsp + 0x188]
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, dword [rsp + 0x2a4]
or eax, 0x194
mov dword [rsp + 0x398], eax
mov rcx, qword [rsp + 0x138]
call fcn.1800082b0
mov qword [rsp + 0x3a0], rax
mov rcx, qword [rsp + 0x78]
call fcn.1800082b0
mov qword [rsp + 0x48], 0
lea rcx, [rsp + 0x168]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov ecx, dword [rsp + 0x398]
mov dword [rsp + 0x28], ecx
lea rcx, [rsp + 0x1b0]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x3a0]
mov r9, rcx
mov r8, qword [rsp + 0x298]
mov rdx, rax
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax + 8]
call sym.ProcessMonitor.dll_PhCreateProcessWin32Ex
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jl 0x18011b37f
lea rcx, [rsp + 0x360]
call sym.ProcessMonitor.dll_PhGetOwnTokenAttributes
mov eax, dword [rax + 8]
and eax, 1
test eax, eax
je 0x18011b33d
cmp qword [rsp + 0x258], 0
je 0x18011b2ec
mov r8, qword [rsp + 0x258]
mov edx, 0x15
mov rcx, qword [rsp + 0x168]
call sym.ProcessMonitor.dll_PhSetObjectSecurity
cmp qword [rsp + 0x278], 0
je 0x18011b33d
lea r8, [rsp + 0x188]
mov edx, 0xc0000
mov rcx, qword [rsp + 0x168]
call fcn.180006550
test eax, eax
jl 0x18011b33d
mov r8, qword [rsp + 0x278]
mov edx, 0x15
mov rcx, qword [rsp + 0x188]
call sym.ProcessMonitor.dll_PhSetObjectSecurity
mov rcx, qword [rsp + 0x188]
call qword [sym.imp.ntdll.dll_NtClose]
lea rdx, [rsp + 0x2b8]
mov rcx, qword [rsp + 0x168]
call fcn.18000a110
test eax, eax
jl 0x18011b361
mov ecx, 0xffffffff
call qword [sym.imp.USER32.dll_AllowSetForegroundWindow]
mov rcx, qword [rsp + 0x168]
call qword [sym.imp.ntdll.dll_NtResumeProcess]
mov rcx, qword [rsp + 0x168]
call qword [sym.imp.ntdll.dll_NtClose]
jmp 0x18011b3e1
mov eax, dword [rsp + 0x50]
shr eax, 0x10
and eax, 0xfff
cmp eax, 7
jne 0x18011b3e1
mov eax, dword [rsp + 0x50]
and eax, 0xffff
cmp eax, 0x2e4
jne 0x18011b3e1
mov rcx, qword [rsp + 0x78]
call fcn.1800082b0
mov qword [rsp + 0x3a8], rax
mov rcx, qword [rsp + 0x68]
call fcn.1800082b0
mov r9b, 1
mov rcx, qword [rsp + 0x3a8]
mov r8, rcx
mov rdx, rax
mov rax, qword [rsp + 0x3d0]
mov rcx, qword [rax]
call fcn.180019bc0
mov dword [rsp + 0x50], eax
cmp qword [rsp + 0x298], 0
je 0x18011b419
call fcn.18000be60
test rax, rax
je 0x18011b419
call fcn.18000be60
mov qword [rsp + 0x3b0], rax
mov rcx, qword [rsp + 0x298]
mov rax, qword [rsp + 0x3b0]
call qword [0x180c63010]
cmp qword [rsp + 0x278], 0
je 0x18011b431
mov rcx, qword [rsp + 0x278]
call sym.ProcessMonitor.dll_PhFree
cmp qword [rsp + 0x258], 0
je 0x18011b449
mov rcx, qword [rsp + 0x258]
call sym.ProcessMonitor.dll_PhFree
cmp qword [rsp + 0x218], 0
je 0x18011b46f
mov rcx, qword [rsp + 0x218]
call qword [sym.imp.KERNEL32.dll_DeleteProcThreadAttributeList]
mov rcx, qword [rsp + 0x218]
call sym.ProcessMonitor.dll_PhFree
cmp qword [rsp + 0x148], 0
je 0x18011b488
mov rcx, qword [rsp + 0x148]
call qword [sym.imp.ntdll.dll_NtClose]
cmp qword [rsp + 0x138], 0
je 0x18011b4a0
mov rcx, qword [rsp + 0x138]
call sym.ProcessMonitor.dll_PhDereferenceObject
cmp qword [rsp + 0x68], 0
je 0x18011b4b2
mov rcx, qword [rsp + 0x68]
call sym.ProcessMonitor.dll_PhDereferenceObject
cmp qword [rsp + 0x78], 0
je 0x18011b4c4
mov rcx, qword [rsp + 0x78]
call sym.ProcessMonitor.dll_PhDereferenceObject
cmp qword [rsp + 0x58], 0
je 0x18011b4d6
mov rcx, qword [rsp + 0x58]
call sym.ProcessMonitor.dll_PhDereferenceObject
mov eax, dword [rsp + 0x50]
mov rdi, rax
mov rcx, rsp
lea rdx, [0x18049a600]
call fcn.180014e20
mov rax, rdi
mov rcx, qword [rsp + 0x3b8]
xor rcx, rsp
call fcn.18000ce90
add rsp, 0x3c0
pop rdi
ret