Function at 0x140024460
Capabilities:
Create thread
Log keystrokes via application hook
Set current directory

Disassembly:
mov byte [rsp + 0x10], dl
mov r11, rsp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x660
mov rax, qword [0x1400f1200]
xor rax, rsp
mov qword [rsp + 0x650], rax
mov r13, r8
mov byte [rsp + 0x40], cl
mov qword [r11 - 0x458], r8
mov byte [rsp + 0x48], r9b
xor edi, edi
lea rax, str.Runner_is_starting._Elevated_openOobe_openScoobe
mov qword [rsp + 0x190], rax
mov qword [rsp + 0x198], 0x39
mov qword [r11 - 0x560], rdi
mov qword [r11 - 0x568], rdi
mov qword [r11 - 0x558], rdi
movaps xmm0, xmmword [rsp + 0x190]
movdqa xmmword [rsp + 0x1c0], xmm0
movups xmm1, xmmword [rsp + 0x130]
movaps xmmword [rsp + 0x270], xmm1
movsd xmm0, qword [rsp + 0x140]
movsd qword [rsp + 0x280], xmm0
lea rax, [r11 + 0x28]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [r11 - 0x4d8]
lea rdx, [r11 - 0x428]
mov rcx, qword [0x1400fc7f0]
call fcn.1400297d0
lea rcx, [rdi - 4]
call qword [sym.imp.USER32.dll_SetProcessDpiAwarenessContext]
mov rax, qword [0x1400f1ee0]
movups xmm0, xmmword [rax - 0x10]
movups xmmword [rsp + 0x430], xmm0
cmp qword [0x1400f1ef8], rdi
je 0x140024567
mov ecx, 5
int 0x29
mov qword [0x1400f1f00], rdi
mov qword [0x1400f1f08], rdi
lea r9, [0x1400f1ef8]
lea r8, [0x1400f1ed8]
lea rdx, section..text
lea rcx, [rsp + 0x430]
call qword [sym.imp.api_ms_win_eventing_provider_l1_1_0.dll_EventRegister]
test eax, eax
jne 0x1400245b7
mov r8, qword [0x1400f1ee0]
movzx r9d, word [r8]
lea edx, [rax + 2]
mov rcx, qword [0x1400f1ef8]
call qword [sym.imp.api_ms_win_eventing_provider_l1_1_0.dll_EventSetInformation]
movzx ecx, byte [rsp + 0x40]
call fcn.140039fe0
nop
cmp qword [0x1400f9f28], 0
jne 0x14002460b
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x14002afe0]
lea ecx, [r9 + 0xd]
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov qword [0x1400f9f28], rax
test rax, rax
jne 0x14002460b
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
lea r8, str.centralized_kb_hook
mov edx, eax
lea rcx, str.SetWindowsHookEx
call fcn.140024070
nop
cmp byte [rsp + 0x48], 0
jne 0x1400246a4
cmp byte [rsp + 0x6c0], 0
je 0x1400246a4
mov ecx, 1
call fcn.140078e70
mov qword [rsp + 0x1f0], rax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x1400296c0]
xor edx, edx
xor ecx, ecx
call fcn.14007f9bc
mov qword [rsp + 0x60], rax
test rax, rax
je 0x1400250e4
cmp dword [rsp + 0x68], 0
je 0x1400250c7
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x1d0], xmm0
lea rcx, [rsp + 0x1d0]
call fcn.140075ba8
test eax, eax
jne 0x1400250d1
xorps xmm0, xmm0
movaps xmmword [rsp + 0x200], xmm0
movdqa xmmword [rsp + 0x60], xmm0
mov ecx, 1
call fcn.140078e70
mov qword [rsp + 0x120], rax
lea rcx, [rsp + 0xe8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x1400296f0]
xor edx, edx
xor ecx, ecx
call fcn.14007f9bc
mov qword [rsp + 0xe0], rax
test rax, rax
je 0x140025227
cmp dword [rsp + 0xe8], 0
je 0x1400250d9
movaps xmm0, xmmword [rsp + 0xe0]
movdqa xmmword [rsp + 0x1e0], xmm0
lea rcx, [rsp + 0x1e0]
call fcn.140075ba8
test eax, eax
jne 0x1400250f3
xorps xmm0, xmm0
movaps xmmword [rsp + 0x210], xmm0
movdqa xmmword [rsp + 0xe0], xmm0
mov ecx, 1
call fcn.140078e70
mov qword [rsp + 0x88], rax
lea rcx, [rsp + 0xd8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x140029720]
xor edx, edx
xor ecx, ecx
call fcn.14007f9bc
mov qword [rsp + 0xd0], rax
test rax, rax
je 0x140025215
cmp dword [rsp + 0xd8], 0
je 0x1400250fb
movaps xmm0, xmmword [rsp + 0xd0]
movdqa xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x90]
call fcn.140075ba8
test eax, eax
jne 0x140025105
xorps xmm0, xmm0
movaps xmmword [rsp + 0x220], xmm0
movdqa xmmword [rsp + 0xd0], xmm0
mov r8d, 0x104
lea rdx, [rsp + 0x440]
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x440]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea rcx, [rsp + 0x440]
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_SetCurrentDirectoryW]
test eax, eax
jne 0x140024813
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edx, eax
lea r8, str.PowerToys___runner
lea rcx, str.Change_Directory_to_Executable_Path
call fcn.140024070
lea rax, str.PowerToys.FancyZonesModuleInterface.dll
mov qword [rsp + 0x2b0], rax
mov qword [rsp + 0x2b8], 0x27
lea rax, str.PowerToys.powerpreview.dll
mov qword [rsp + 0x2c0], rax
mov qword [rsp + 0x2c8], 0x1a
lea rax, str.PowerToys.ImageResizerExt.dll
mov qword [rsp + 0x2d0], rax
mov qword [rsp + 0x2d8], 0x1d
lea rax, str.PowerToys.KeyboardManager.dll
mov qword [rsp + 0x2e0], rax
mov qword [rsp + 0x2e8], 0x1d
lea rax, str.PowerToys.Launcher.dll
mov qword [rsp + 0x2f0], rax
mov qword [rsp + 0x2f8], 0x16
lea rax, str.WinUI3Apps_PowerToys.PowerRenameExt.dll
mov qword [rsp + 0x300], rax
mov qword [rsp + 0x308], 0x27
lea rax, str.PowerToys.ShortcutGuideModuleInterface.dll
mov qword [rsp + 0x310], rax
mov qword [rsp + 0x318], 0x2a
lea rax, str.PowerToys.ColorPicker.dll
mov qword [rsp + 0x320], rax
mov qword [rsp + 0x328], 0x19
lea rax, str.PowerToys.AwakeModuleInterface.dll
mov qword [rsp + 0x330], rax
mov qword [rsp + 0x338], 0x22
lea rax, str.PowerToys.FindMyMouse.dll
mov qword [rsp + 0x340], rax
mov qword [rsp + 0x348], 0x19
lea rax, str.PowerToys.MouseHighlighter.dll
mov qword [rsp + 0x350], rax
mov qword [rsp + 0x358], 0x1e
lea rax, str.PowerToys.MouseJump.dll
mov qword [rsp + 0x360], rax
mov qword [rsp + 0x368], 0x17
lea rax, str.PowerToys.AlwaysOnTopModuleInterface.dll
mov qword [rsp + 0x370], rax
mov qword [rsp + 0x378], 0x28
lea rax, str.PowerToys.MousePointerCrosshairs.dll
mov qword [rsp + 0x380], rax
mov qword [rsp + 0x388], 0x24
lea rax, str.PowerToys.PowerAccentModuleInterface.dll
mov qword [rsp + 0x390], rax
mov qword [rsp + 0x398], 0x28
lea rax, str.PowerToys.PowerOCRModuleInterface.dll
mov qword [rsp + 0x3a0], rax
mov qword [rsp + 0x3a8], 0x25
lea rax, str.PowerToys.PastePlainModuleInterface.dll
mov qword [rsp + 0x3b0], rax
mov qword [rsp + 0x3b8], 0x27
lea rax, str.WinUI3Apps_PowerToys.FileLocksmithExt.dll
mov qword [rsp + 0x3c0], rax
mov qword [rsp + 0x3c8], 0x29
lea rax, str.WinUI3Apps_PowerToys.RegistryPreviewExt.dll
mov qword [rsp + 0x3d0], rax
mov qword [rsp + 0x3d8], 0x2b
lea rax, str.WinUI3Apps_PowerToys.MeasureToolModuleInterface.dll
mov qword [rsp + 0x3e0], rax
mov qword [rsp + 0x3e8], 0x33
lea rax, str.WinUI3Apps_PowerToys.HostsModuleInterface.dll
mov qword [rsp + 0x3f0], rax
mov qword [rsp + 0x3f8], 0x2d
lea rax, str.WinUI3Apps_PowerToys.Peek.dll
mov qword [rsp + 0x400], rax
mov qword [rsp + 0x408], 0x1d
lea rax, str.PowerToys.MouseWithoutBordersModuleInterface.dll
mov qword [rsp + 0x410], rax
mov qword [rsp + 0x418], 0x30
lea rax, str.PowerToys.CropAndLockModuleInterface.dll
mov qword [rsp + 0x420], rax
mov qword [rsp + 0x428], 0x28
xorps xmm0, xmm0
movdqu xmmword [rsp + 0xb0], xmm0
mov qword [rsp + 0xc0], rdi
mov edx, 0x18
call fcn.140029040
mov qword [rsp + 0xb0], rax
lea r12, [rax + 0x180]
mov qword [rsp + 0xc0], r12
mov r8d, 0x180
lea rdx, [rsp + 0x2b0]
mov rcx, rax
call fcn.14007b320
mov qword [rsp + 0xb8], r12
lea rax, str.PowerToys.VideoConferenceModule.dll
mov qword [rsp + 0x118], rax
lea rcx, str.mf.dll
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_1.dll_LoadLibraryA]
test rax, rax
je 0x140024b38
mov rcx, rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
lea r8, [rsp + 0x118]
mov rdx, r12
lea rcx, [rsp + 0xb0]
call fcn.140029280
mov r12, qword [rsp + 0xb8]
mov rbx, qword [rsp + 0xb0]
mov qword [rsp + 0xa8], r12
lea r14, str.C:_a_work1_s_src_runnerpowertoy_module.cpp
lea r15, str.class_PowertoyModule___cdecl_load_powertoy_const_class_std::basic_string_view_wchar_t_struct_std::char_traits_wchar_t____
mov qword [rsp + 0x80], rbx
cmp rbx, r12
je 0x140024c85
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x1a0], xmm0
mov dword [rsp + 0x148], 0x10
mov dword [rsp + 0x14c], 0x1a
mov qword [rsp + 0x150], r14
mov qword [rsp + 0x158], r15
mov rcx, qword [rbx]
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_1.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x14002510d
lea rdx, str.powertoy_create
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
test rax, rax
je 0x14002511a
call rax
test rax, rax
je 0x140025156
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0x70]
call fcn.140021a50
lea rcx, [rsp + 0x70]
call fcn.140021ec0
nop
call fcn.140021770
mov rsi, rax
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rcx]
call qword [rdx + reloc.OLEAUT32.dll_VariantClear]
mov qword [rsp + 0xa0], rax
lea r9, [rsp + 0x70]
lea r8, [rsp + 0xa0]
lea rdx, [rsp + 0x230]
mov rcx, rsi
call fcn.1400293e0
nop
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140024c3a
mov rax, qword [rcx]
call qword [rax + 0x40]
nop
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140024c4b
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
nop
add rbx, 0x10
jmp 0x140024b56
call fcn.14001d9c0
lea rcx, [rsp + 0x290]
call fcn.14001abe0
nop
movzx edx, byte [rsp + 0x40]
lea rcx, [rsp + 0x290]
call fcn.140037970
lea rcx, [rsp + 0x290]
call fcn.140031770
cmp byte [rsp + 0x6a8], 0
je 0x140024e86
mov byte [rsp + 0x110], 0
mov r14, qword [r13 + 0x10]
test r14, r14
je 0x140024e10
mov r15, r13
cmp qword [r13 + 0x18], 0x10
jb 0x140024ce8
mov r15, qword [r13]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
mov r9d, r14d
mov r8, r15
xor edx, edx
mov ecx, 0xfde9
call sub.api_ms_win_core_string_l1_1_0.dll_MultiByteToWideChar
mov r12d, eax
test eax, eax
jne 0x140024d21
mov rbx, rdi
mov rsi, rdi
mov rdx, rdi
mov rcx, rdi
mov rax, rdi
mov r8, rdi
mov r9, rdi
jmp 0x140024d5e
mov ecx, r12d
call fcn.140019270
mov rbx, rax
mov rsi, rax
mov rax, qword [rax + 0x10]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rax
mov r9d, r14d
mov r8, r15
xor edx, edx
mov ecx, 0xfde9
call sub.api_ms_win_core_string_l1_1_0.dll_MultiByteToWideChar
mov rdx, rbx
mov rcx, rbx
mov rax, rbx
mov r8, rbx
mov r9, rbx
mov qword [rsp + 0x80], rbx
cmp byte [rsp + 0x110], 0
je 0x140024d98
test rsi, rsi
je 0x140024d7f
mov rdx, qword [rdx + 0x10]
mov r8d, dword [rcx + 4]
jmp 0x140024d89
lea rdx, [0x1400c73d0]
mov r8, rdi
lea rcx, [rsp + 0xf0]
call fcn.140007410
jmp 0x140024de1
xorps xmm0, xmm0
movups xmmword [rsp + 0xf0], xmm0
mov qword [rsp + 0x100], rdi
mov qword [rsp + 0x108], rdi
test rax, rax
je 0x140024dc2
mov rdx, qword [r8 + 0x10]
mov r8d, dword [r9 + 4]
jmp 0x140024dcc
lea rdx, [0x1400c73d0]
mov r8, rdi
lea rcx, [rsp + 0xf0]
call fcn.1400075d0
mov byte [rsp + 0x110], 1
test rbx, rbx
je 0x140024e10
mov eax, 0xffffffff
lock xadd dword [rbx + 0x18], eax
sub eax, 1
jne 0x140024ee4
call sub.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap
mov rcx, rax
mov r8, qword [rsp + 0x80]
xor edx, edx
call sub.api_ms_win_core_heap_l1_1_0.dll_HeapFree
mov byte [rsp + 0x128], 0
lea rax, [rsp + 0x248]
mov qword [rsp + 0x88], rax
mov byte [rsp + 0x268], 0
cmp byte [rsp + 0x110], 0
je 0x140024e57
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0x248]
call fcn.1400072d0
mov byte [rsp + 0x268], 1
lea r8, [rsp + 0x120]
xor edx, edx
lea rcx, [rsp + 0x248]
call fcn.140035da0
nop
cmp byte [rsp + 0x110], 0
je 0x140024e86
lea rcx, [rsp + 0xf0]
call fcn.1400073a0
cmp byte [rsp + 0x48], 0
je 0x140024f62
call fcn.140031160
mov ecx, 1
call fcn.140078e70
mov qword [rsp + 0x88], rax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x140037220]
xor edx, edx
xor ecx, ecx
call fcn.14007f9bc
mov qword [rsp + 0x60], rax
test rax, rax
je 0x1400251c8
cmp dword [rsp + 0x68], 0
je 0x1400251a4
jmp 0x140024ef1
test eax, eax
js 0x1400251af
jmp 0x140024e10
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x90]
call fcn.140075ba8
test eax, eax
jne 0x1400251b5
mov ecx, 1
call fcn.140078e70
mov qword [rsp + 0x88], rax
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x14002fe10]
xor edx, edx
xor ecx, ecx
call fcn.14007f9bc
mov qword [rsp + 0x70], rax
test rax, rax
je 0x140025206
cmp dword [rsp + 0x78], 0
je 0x1400251bd
jmp 0x140024fe0
cmp byte [rsp + 0x6c0], 0
je 0x140024f14
mov ecx, 1
call fcn.140078e70
mov qword [rsp + 0x88], rax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x140037270]
xor edx, edx
xor ecx, ecx
call fcn.14007f9bc
mov qword [rsp + 0x60], rax
test rax, rax
je 0x1400251e9
cmp dword [rsp + 0x68], 0
je 0x1400251d7
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x90]
call fcn.140075ba8
test eax, eax
jne 0x1400251e1
jmp 0x140024f14
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x90]
call fcn.140075ba8
test eax, eax
jne 0x1400251f8
mov byte [rsp + 0xac], 0
mov rdx, qword [rsp + 0xa8]
call fcn.140024160
mov ebx, eax
lea rcx, [rsp + 0x290]
call fcn.1400073a0
nop
mov rcx, qword [rsp + 0xb0]
test rcx, rcx
je 0x14002506f
mov rdx, qword [rsp + 0xc0]
sub rdx, rcx
and rdx, 0xfffffffffffffff0
mov rax, rcx
cmp rdx, 0x1000
jb 0x140025069
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140025200
call fcn.140078eb4
nop
jmp 0x14002507f
mov rcx, qword [0x1400f1ef8]
mov dword [0x1400f1ed8], edi
mov qword [0x1400f1ef8], rdi
call qword [sym.imp.api_ms_win_eventing_provider_l1_1_0.dll_EventUnregister]
nop
mov rcx, r13
call fcn.14000cfa0
mov eax, ebx
mov rcx, qword [rsp + 0x650]
xor rcx, rsp
call fcn.140078e50
add rsp, 0x660
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov ecx, 1
call fcn.1400754c8
mov ecx, eax
call fcn.14007548c
nop
mov ecx, 1
call fcn.1400754c8
nop
mov dword [rsp + 0x68], edi
mov ecx, 6
call fcn.1400754c8
nop
mov ecx, eax
call fcn.14007548c
nop
mov ecx, 1
call fcn.1400754c8
mov ecx, eax
call fcn.14007548c
nop
lea rcx, [rsp + 0x148]
call fcn.140021530
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
mov dword [rsp + 0x160], 0x15
mov dword [rsp + 0x164], 0x10
mov qword [rsp + 0x168], r14
mov qword [rsp + 0x170], r15
lea rcx, [rsp + 0x160]
call fcn.140021530
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
mov dword [rsp + 0x178], 0x1b
mov dword [rsp + 0x17c], 0x10
mov qword [rsp + 0x180], r14
mov qword [rsp + 0x188], r15
mov edx, 0x80004003
lea rcx, [rsp + 0x50]
call fcn.140019240
lea rdx, [rsp + 0x178]
mov ecx, dword [rax]
call fcn.140019e90
nop
mov ecx, 1
call fcn.1400754c8
nop
call fcn.140085864
nop
mov ecx, eax
call fcn.14007548c
nop
mov ecx, 1
call fcn.1400754c8
nop
mov dword [rsp + 0x68], edi
mov ecx, 6
call fcn.1400754c8
nop
mov ecx, 1
call fcn.1400754c8
mov ecx, eax
call fcn.14007548c
nop
mov dword [rsp + 0x68], edi
mov ecx, 6
call fcn.1400754c8
nop
mov ecx, eax
call fcn.14007548c
nop
call fcn.14007fed8
nop
mov dword [rsp + 0x78], edi
mov ecx, 6
call fcn.1400754c8
nop
mov dword [rsp + 0xd8], edi
mov ecx, 6
call fcn.1400754c8
nop
mov dword [rsp + 0xe8], edi
mov ecx, 6
call fcn.1400754c8
int3