### System Versioning Functions

Source: https://github.com/kasperskylab/hrtng/blob/master/bin/plugins/literal.txt

Documentation for functions related to version checking and file installation, including flags for various conditions and installation behaviors.

```APIDOC
## VerFindFile

### Description
Finds a file in the system with options for shared file identification.

### Method
N/A (Function Signature)

### Endpoint
N/A

### Parameters
#### Query Parameters
- **Flags** (integer) - Optional - Combination of flags.
  - VFFF_ISSHAREDFILE (0x1): Indicates the file is a shared file.

### Request Example
N/A

### Response
N/A

## VerInstallFile

### Description
Installs a file with options for forcing installation and preventing deletion of old versions.

### Method
N/A (Function Signature)

### Endpoint
N/A

### Parameters
#### Query Parameters
- **Flags** (integer) - Optional - Combination of flags.
  - VIFF_FORCEINSTALL (0x1): Forces the installation.
  - VIFF_DONTDELETEOLD (0x2): Prevents deletion of old versions.

### Request Example
N/A

### Response
N/A

## VerSetConditionMask

### Description
Sets a condition mask for version comparison with flags for various version components.

### Method
N/A (Function Signature)

### Endpoint
N/A

### Parameters
#### Query Parameters
- **Flags** (integer) - Optional - Combination of flags.
  - VER_MINORVERSION (0x1): Specifies minor version.
  - VER_MAJORVERSION (0x2): Specifies major version.
  - VER_BUILDNUMBER (0x4): Specifies build number.
  - VER_PLATFORMID (0x8): Specifies platform ID.
  - VER_SERVICEPACKMINOR (0x10): Specifies minor service pack version.
  - VER_SERVICEPACKMAJOR (0x20): Specifies major service pack version.
  - VER_SUITENAME (0x40): Specifies suit name.

### Request Example
N/A

### Response
N/A

## VerifyVersionInfo

### Description
Verifies the version information of the operating system against specified conditions.

### Method
N/A (Function Signature)

### Endpoint
N/A

### Parameters
#### Query Parameters
- **Flags** (integer) - Optional - Combination of flags.
  - VER_MINORVERSION (0x1): Checks minor version.
  - VER_MAJORVERSION (0x2): Checks major version.
  - VER_BUILDNUMBER (0x4): Checks build number.
  - VER_PLATFORMID (0x8): Checks platform ID.
  - VER_SERVICEPACKMINOR (0x10): Checks minor service pack version.
  - VER_SERVICEPACKMAJOR (0x20): Checks major service pack version.
  - VER_SUITENAME (0x40): Checks suit name.
  - VER_PRODUCT_TYPE (0x80): Checks product type.

### Request Example
N/A

### Response
N/A
```

--------------------------------

### Simple Assignment Example

Source: https://github.com/kasperskylab/hrtng/blob/master/doc/struct-bld.md

The plugin automatically handles simple assignments like this during the scanning process.

```C
v1 = this;
```

--------------------------------

### Original Stack String Assignments

Source: https://github.com/kasperskylab/hrtng/blob/master/doc/stk-str.md

Example of raw stack assignments representing a filename string before processing.

```C
    Str2 = 115;
    v72 = 101;
    v73 = 114;
    v74 = 118;
    v75 = 105;
    v76 = 99;
    v77 = 101;
    v78 = 115;
    v79 = 46;
    v80 = 101;
    v81 = 120;
    v82 = 101;
    v83 = 0;
    if (wcsicmp(&Filename, &Str2))
```

--------------------------------

### Example literal.txt Configuration

Source: https://github.com/kasperskylab/hrtng/blob/master/doc/enum.md

Provides a sample 'literal.txt' file demonstrating the structure for defining enum and bitmask substitutions for functions like CreateFileW and structs like addrinfo.

```plaintext
CreateFile
 2 bits
  FILE_ALL_ACCESS 0x1f01ff
  GENERIC_ALL 0x10000000
  GENERIC_EXECUTE 0x20000000
  GENERIC_WRITE 0x40000000
  GENERIC_READ 0x80000000
 3 bits
  FILE_SHARE_READ 0x1
  FILE_SHARE_WRITE 0x2
  FILE_SHARE_DELETE 0x4
 5 enum
  CREATE_NEW 0x1
  CREATE_ALWAYS 0x2
  OPEN_EXISTING 0x3
  OPEN_ALWAYS 0x4
  TRUNCATE_EXISTING 0x5
6 bits
  FILE_ATTRIBUTE_READONLY 0x1
  FILE_ATTRIBUTE_HIDDEN 0x2
  FILE_ATTRIBUTE_SYSTEM 0x4
  FILE_ATTRIBUTE_NORMAL 0x80

STRUCT addrinfo
 ai_family enum
  AF_INET 0x2
  AF_INET6 0x17
 ai_socktype enum
  SOCK_STREAM 0x1
  SOCK_DGRAM 0x2
  SOCK_RAW 0x3
 ai_protocol enum
  IPPROTO_IP 0x0
  IPPROTO_ICMP 0x1
  IPPROTO_TCP 0x6
 IPPROTO_UDP 0x11
```

--------------------------------

### Example of Automatically Generated Inline

Source: https://github.com/kasperskylab/hrtng/blob/master/doc/deinline.md

This is an example of how an automatically generated inline function might appear in pseudocode. The naming convention indicates the group and number of similar basic blocks matched.

```c
v10 = inline_5_2_10_11_(v9);
```

--------------------------------

### Dummy Struct Creation Result

Source: https://context7.com/kasperskylab/hrtng/llms.txt

Example of the structure definition generated by the dummy struct creation feature.

```c
struct struc_100 {
    _DWORD field_0;
    _DWORD field_4;
    // ... or empty with just:
    _BYTE gap0[0x100];
};
```

--------------------------------

### Example of Library Inline Representation

Source: https://github.com/kasperskylab/hrtng/blob/master/doc/deinline.md

This shows how library inlines, such as those from standard libraries or custom collections, are represented in pseudocode. These are typically more descriptive than automatically generated inlines.

```c
crypto.rc4.set_key(ctx, key, keylen);
```

```c
stl.string.dtor(str);
```

--------------------------------

### Decompile Obfuscated Code Example

Source: https://context7.com/kasperskylab/hrtng/llms.txt

Handles obfuscation patterns like junk operations or using jump/ret as control flow. Requires positioning the cursor at the entry point of the obfuscated code.

```c
// Handles obfuscation patterns like:
xxx = (off_1400197B8 + 0x44927437A5E3AB1CLL)(0, x, y, z);
// or
__asm { jmp rax }
```

--------------------------------

### Build hrtng Plugin from Source

Source: https://context7.com/kasperskylab/hrtng/llms.txt

Build the hrtng plugin from source using CMake and the IDA SDK. This involves cloning the repository, copying necessary SDK headers, configuring CMakeLists.txt, building the project, and installing the plugin files.

```bash
# Clone with submodules (Crypto++ library)
cd src
git clone --recurse-submodules https://github.com/KasperskyLab/hrtng.git

# Copy hexrays.hpp (not needed for IDA 9.0+)
cp IDA_DIR/plugins/hexrays_sdk/include/hexrays.hpp IDASDK_DIR/include/

# Configure CMakeLists.txt with correct SDK path
# Edit: SET(IDASDK_VER "93") and SET(IDASDK_DIR ...)

# Build
mkdir bld && cd bld
cmake <path-to/hrtng/src>
cmake --build . --config Release -j 4 --clean-first

# For SDK < 9.1, add to IDASDK/include/range.hpp in class rangeset_t:
# const rangevec_t &as_rangevec() const { return bag; }

# Install
cp hrtng.dll IDA_DIR/plugins/
cp hrtng/bin/plugins/apilist.txt IDA_DIR/plugins/
cp hrtng/bin/plugins/literal.txt IDA_DIR/plugins/
```

--------------------------------

### Recast Item Example

Source: https://github.com/kasperskylab/hrtng/blob/master/doc/recast.md

Demonstrates the pseudocode structure and assignment where the 'Recast item' operation can be applied to change variable types.

```pseudocode
{
  type1 v1;
  type2 v2
  v2 = (type2)v1;
}
```

--------------------------------

### Identify Obfuscated Pseudocode Patterns

Source: https://github.com/kasperskylab/hrtng/blob/master/doc/deob.md

Examples of pseudocode patterns that may require the Alt-F5 forced decompilation feature.

```c
  xxx = (off_1400197B8 + 0x44927437A5E3AB1CLL)(0, x, y, z);
  // or
  __asm { jmp     rax }
```

--------------------------------

### Enum Substitution Example

Source: https://github.com/kasperskylab/hrtng/blob/master/doc/enum.md

Demonstrates how numeric constants are automatically replaced with named enum and bitmask values when the plugin is active. Ensure 'literal.txt' is present in the IDA plugins folder for this functionality.

```c
// call without plugin
hFile = CreateFileW(&FileName, 0x80000000, 7u, 0, 3u, 0x80u, 0);

// became with plugin to:
hFile = CreateFileW(&FileName, GENERIC_READ, FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, 0, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, 0);
```

--------------------------------

### Example pseudocode for decryption

Source: https://github.com/kasperskylab/hrtng/blob/master/doc/appcall.md

A typical pseudocode pattern where a decryption function is called with a key and a pointer to encrypted data.

```c
    str = decrypt(178325499, &unk_B8012EB0);
```

--------------------------------

### Identify compilation error for older IDA SDKs

Source: https://github.com/kasperskylab/hrtng/blob/master/README.md

Example of the error message encountered when building with IDA SDK versions prior to 9.1.

```text
hrtng/src/deob.cpp:912:60: error: ‘class rangeset_t’ has no member named ‘as_rangevec’
     fc.create("tmpfc2", ranges.as_rangevec(), 0);//!!! add line into range.hpp, class rangeset_t: "const rangevec_t &as_rangevec() const { return bag; }"
```

--------------------------------

### Configure and build the project

Source: https://github.com/kasperskylab/hrtng/blob/master/README.md

Standard CMake build sequence for the hrtng plugin.

```bash
mkdir bld && cd bld
cmake <path-to/hrtng/src>
cmake --build . --config Release -j 4 --clean-first
```

--------------------------------

### IDA Pro Disassembly Example

Source: https://github.com/kasperskylab/hrtng/blob/master/doc/fix-stack.md

This is an example of assembly code from IDA Pro where the stack pointer delta might be wrongly calculated for indirect calls.

```assembly
10004D9E 020 40                    inc     eax
10004D9F 020 50                    push    eax
10004DA0 024 6A 08                 push    8
10004DA2 028 FF 96 E4 00 00 00     call    dword ptr [esi+0E4h]
10004DA8 020 50                    push    eax
10004DA9 024 FF 96 E8 00 00 00     call    dword ptr [esi+0E8h]
10004DAF 020 8B D8                 mov     ebx, eax
```

--------------------------------

### Clone the hrtng repository

Source: https://github.com/kasperskylab/hrtng/blob/master/README.md

Initializes the repository with required submodules.

```bash
cd src
git clone --recurse-submodules https://github.com/KasperskyLab/hrtng.git
```

--------------------------------

### Recast Item Transformation

Source: https://context7.com/kasperskylab/hrtng/llms.txt

Example of variable type changes based on cast expressions in pseudocode.

```c
{
  type1 v1;
  type2 v2;
  v2 = (type2)v1;
}
```

--------------------------------

### Disassembly instruction for offset conversion

Source: https://github.com/kasperskylab/hrtng/blob/master/doc/offsetof.md

Example of a disassembly instruction that can be converted using the T hotkey or menu options.

```Assembly
    mov     eax, [edx+3Ch]
```

--------------------------------

### HeapCreate Flags

Source: https://github.com/kasperskylab/hrtng/blob/master/bin/plugins/literal.txt

Flags for creating a heap.

```APIDOC
## HeapCreate Flags

### Description
Flags to control the creation of a new heap.

### Flags
- **HEAP_NO_SERIALIZE** (0x1)
- **HEAP_GENERATE_EXCEPTIONS** (0x4)
```

--------------------------------

### System and Window Management Constants

Source: https://github.com/kasperskylab/hrtng/blob/master/bin/plugins/literal.txt

Documentation for common Windows API constants used in system configuration, window positioning, and thread management.

```APIDOC
## SetThreadPriority

### Description
Defines the priority levels for a thread.

### Parameters
#### Priority Values
- **THREAD_PRIORITY_NORMAL** (0x0)
- **THREAD_PRIORITY_ABOVE_NORMAL** (0x1)
- **THREAD_PRIORITY_HIGHEST** (0x2)
- **THREAD_PRIORITY_TIME_CRITICAL** (0xf)
- **THREAD_PRIORITY_IDLE** (0xfffffff1)
- **THREAD_PRIORITY_LOWEST** (0xfffffffe)
- **THREAD_PRIORITY_BELOW_NORMAL** (0xffffffff)

## SetWindowPos

### Description
Defines flags for window positioning and sizing operations.

### Parameters
#### Z-Order Constants
- **HWND_TOP** (0x0)
- **HWND_BOTTOM** (0x1)
- **HWND_NOTOPMOST** (0xfffffffe)
- **HWND_TOPMOST** (0xffffffff)

#### Window Pos Flags
- **SWP_NOSIZE** (0x1)
- **SWP_NOMOVE** (0x2)
- **SWP_NOZORDER** (0x4)
- **SWP_SHOWWINDOW** (0x40)
- **SWP_HIDEWINDOW** (0x80)

## ShowWindow

### Description
Defines the show state of a window.

### Parameters
#### Show States
- **SW_HIDE** (0x0)
- **SW_SHOWNORMAL** (0x1)
- **SW_SHOWMINIMIZED** (0x2)
- **SW_SHOWMAXIMIZED** (0x3)
- **SW_RESTORE** (0x9)
```

--------------------------------

### Windows API Constants

Source: https://github.com/kasperskylab/hrtng/blob/master/bin/plugins/literal.txt

Reference documentation for various Windows API constants and flags.

```APIDOC
## SetFilePointerEx

### Description
Defines the move method for file pointer operations.

### Parameters
#### Move Method
- **FILE_BEGIN** (0x0) - Move from the beginning of the file.
- **FILE_CURRENT** (0x1) - Move from the current position.
- **FILE_END** (0x2) - Move from the end of the file.

## SetGraphicsMode

### Description
Defines the graphics mode for the device context.

### Parameters
#### Modes
- **GM_COMPATIBLE** (0x1)
- **GM_ADVANCED** (0x2)

## SetHandleInformation

### Description
Defines flags for handle information.

### Parameters
#### Flags
- **HANDLE_FLAG_INHERIT** (0x1)
- **HANDLE_FLAG_PROTECT_FROM_CLOSE** (0x2)

## SetPriorityClass

### Description
Defines the priority class for a process.

### Parameters
#### Classes
- **NORMAL_PRIORITY_CLASS** (0x20)
- **IDLE_PRIORITY_CLASS** (0x40)
- **HIGH_PRIORITY_CLASS** (0x80)
- **REALTIME_PRIORITY_CLASS** (0x100)
- **BELOW_NORMAL_PRIORITY_CLASS** (0x4000)
- **ABOVE_NORMAL_PRIORITY_CLASS** (0x8000)
```

--------------------------------

### Patch Conditional Jumps

Source: https://github.com/kasperskylab/hrtng/blob/master/doc/deob.md

Example of code patterns targeted by the 'Allow Patching' option, which converts double conditional jumps into unconditional jumps.

```asm
jle short loc_403F2E
<between jumps, may be something meaningless like NOPs, removed away by microcode optimizer>
jg  short loc_403F2E
```

```asm
jmp short loc_403F2E ; ;patched: jle loc_403F2E
```

--------------------------------

### Accessing structure members via raw pointer arithmetic

Source: https://github.com/kasperskylab/hrtng/blob/master/doc/neg-offs.md

Example of code using raw pointer offsets to access members of an IMAGE_SECTION_HEADER structure.

```c
    p_VSize = (__int64)&pe->OptionalHeader.SizeOfInitializedData + pe->FileHeader.SizeOfOptionalHeader;
    do
    {
      Size = *(_DWORD *)(p_VSize + 8);
      if ( *(_DWORD *)p_VSize < Size )
        Size = *(_DWORD *)p_VSize;
      memmove((void *)(newImgBase + *(unsigned int *)(p_VSize + 4)), &oldImgBase[*(unsigned int *)(p_VSize + 12)], Size);
      ++i;
      p_VSize += sizeof(IMAGE_SECTION_HEADER);
    }
    while ( pe->FileHeader.NumberOfSections > i );
```

--------------------------------

### Set IDA SDK Version and Directory

Source: https://github.com/kasperskylab/hrtng/blob/master/src/CMakeLists.txt

Configures the IDA SDK version and its directory. Ensure the SDK is present at the specified path relative to the source directory.

```cmake
SET(IDASDK_VER "93" CACHE STRING "93" )
SET(IDASDK_DIR ${CMAKE_SOURCE_DIR}/../../idasdk${IDASDK_VER} CACHE STRING "ida-sdk/src")
MESSAGE("${PROJECT_NAME}")
MESSAGE("Using IDA SDK dir: ${IDASDK_DIR}")
MESSAGE("-------------------")
```

--------------------------------

### Desktop Management Functions

Source: https://github.com/kasperskylab/hrtng/blob/master/bin/plugins/literal.txt

Functions for opening and managing desktop environments, including access rights and options.

```APIDOC
## OpenDesktop

### Description
Opens a desktop object with specified flags for access and account handling.

### Method
Not specified (typically a function call, not an HTTP method)

### Endpoint
Not applicable

### Parameters
#### Enum Parameters
- **DF_ALLOWOTHERACCOUNTHOOK** (enum) - Value: 0x1
- **DESKTOP_READOBJECTS** (enum) - Value: 0x1
- **DESKTOP_CREATEWINDOW** (enum) - Value: 0x2
- **DESKTOP_CREATEMENU** (enum) - Value: 0x4
- **DESKTOP_HOOKCONTROL** (enum) - Value: 0x8
- **DESKTOP_JOURNALRECORD** (enum) - Value: 0x10
- **DESKTOP_JOURNALPLAYBACK** (enum) - Value: 0x20
- **DESKTOP_ENUMERATE** (enum) - Value: 0x40
- **DESKTOP_WRITEOBJECTS** (enum) - Value: 0x80
- **DESKTOP_SWITCHDESKTOP** (enum) - Value: 0x100

### Request Example
```
// Example usage (conceptual)
HDESK hDesk = OpenDesktop(szDesktopName, dwFlags, fInherit, pSecAttrs);
```

### Response
#### Success Response
Returns a handle to the opened desktop.

#### Response Example
```
// Conceptual response
HDESK hDesk = ...;
```

## OpenInputDesktop

### Description
Opens the input desktop with specified flags for access and account handling.

### Method
Not specified (typically a function call, not an HTTP method)

### Endpoint
Not applicable

### Parameters
#### Enum Parameters
- **DF_ALLOWOTHERACCOUNTHOOK** (enum) - Value: 0x1
- **DESKTOP_READOBJECTS** (enum) - Value: 0x1
- **DESKTOP_CREATEWINDOW** (enum) - Value: 0x2
- **DESKTOP_CREATEMENU** (enum) - Value: 0x4
- **DESKTOP_HOOKCONTROL** (enum) - Value: 0x8
- **DESKTOP_JOURNALRECORD** (enum) - Value: 0x10
- **DESKTOP_JOURNALPLAYBACK** (enum) - Value: 0x20
- **DESKTOP_ENUMERATE** (enum) - Value: 0x40
- **DESKTOP_WRITEOBJECTS** (enum) - Value: 0x80
- **DESKTOP_SWITCHDESKTOP** (enum) - Value: 0x100

### Request Example
```
// Example usage (conceptual)
HINPUTDESK hDesk = OpenInputDesktop(dwFlags, fInherit, pSecAttrs);
```

### Response
#### Success Response
Returns a handle to the opened input desktop.

#### Response Example
```
// Conceptual response
HINPUTDESK hDesk = ...;
```
```

--------------------------------

### IDA Pro Decompiled Code Example

Source: https://github.com/kasperskylab/hrtng/blob/master/doc/fix-stack.md

This is the decompiled C-like code corresponding to the assembly snippet above, illustrating IDA's incorrect assumption about arguments for indirect calls.

```c
    v3 = ((int (__stdcall *)(int, size_t))::api->GetProcessHeap)(8, v5);
    v4 = (const void *)((int (__stdcall *)(int))api->HeapAlloc)(v3);
```

--------------------------------

### Link Libraries for HRTNG Plugin

Source: https://github.com/kasperskylab/hrtng/blob/master/src/CMakeLists.txt

Links the 'cryptopp' library to the 'hrtng' and 'hrtng_64' targets. The 'hrtng_64' target is linked only if UNI64 is not set (i.e., for 32-bit builds).

```cmake
IF(NOT ${UNI64})
  TARGET_LINK_LIBRARIES(hrtng_64 cryptopp)
ENDIF()
TARGET_LINK_LIBRARIES(hrtng    cryptopp)
```

--------------------------------

### Identify Decompiler-Breaking Trash Code

Source: https://github.com/kasperskylab/hrtng/blob/master/doc/deob.md

Example of code structures that may cause the decompiler to incorrectly convert conditional jumps to unconditional ones, necessitating the 'Fast CFG' option.

```asm
  mov     eax, 1
  dec     eax
  jz      short loc_xxx
; some trashy code that breaks decompiler
```

--------------------------------

### String Comparison and Conversion Functions

Source: https://github.com/kasperskylab/hrtng/blob/master/bin/plugins/literal.txt

Provides documentation for functions related to string comparison and conversion, including various flags for case sensitivity, space, and symbol ignoring.

```APIDOC
## VarBstrCmp

### Description
Compares two BSTR strings with various normalization options.

### Method
N/A (Function Signature)

### Endpoint
N/A

### Parameters
#### Query Parameters
- **Flags** (integer) - Optional - Combination of normalization flags.
  - NORM_IGNORECASE (0x1): Ignores case during comparison.
  - NORM_IGNORENONSPACE (0x2): Ignores non-space characters.
  - NORM_IGNORESYMBOLS (0x4): Ignores symbols.
  - NORM_IGNOREWIDTH (0x8): Ignores character width differences.
  - NORM_IGNOREKANATYPE (0x40): Ignores Kana type differences.
  - NORM_IGNOREKASHIDA (0x40000): Ignores Kashida characters.

### Request Example
N/A

### Response
N/A

## VarBstrFromBool

### Description
Converts a boolean value to a BSTR string with options for date/time value display.

### Method
N/A (Function Signature)

### Endpoint
N/A

### Parameters
#### Query Parameters
- **Flags** (integer) - Optional - Combination of flags.
  - VAR_TIMEVALUEONLY (0x1): Includes time value only.
  - VAR_DATEVALUEONLY (0x2): Includes date value only.
  - LOCALE_NOUSEROVERRIDE (0x80000000): Uses system default locale settings.

### Request Example
N/A

### Response
N/A

## VarBstrFromCy

### Description
Converts a currency value to a BSTR string with options for date/time value display.

### Method
N/A (Function Signature)

### Endpoint
N/A

### Parameters
#### Query Parameters
- **Flags** (integer) - Optional - Combination of flags.
  - VAR_TIMEVALUEONLY (0x1): Includes time value only.
  - VAR_DATEVALUEONLY (0x2): Includes date value only.
  - LOCALE_NOUSEROVERRIDE (0x80000000): Uses system default locale settings.

### Request Example
N/A

### Response
N/A

## VarBstrFromDate

### Description
Converts a date value to a BSTR string with various formatting options.

### Method
N/A (Function Signature)

### Endpoint
N/A

### Parameters
#### Query Parameters
- **Flags** (integer) - Optional - Combination of flags.
  - VAR_TIMEVALUEONLY (0x1): Includes time value only.
  - VAR_DATEVALUEONLY (0x2): Includes date value only.
  - VAR_CALENDAR_HIJRI (0x8): Uses Hijri calendar.
  - VAR_FOURDIGITYEARS (0x40): Uses four-digit years.
  - LOCALE_NOUSEROVERRIDE (0x80000000): Uses system default locale settings.

### Request Example
N/A

### Response
N/A

## VarBstrFromDec

### Description
Converts a decimal value to a BSTR string with options for date/time value display.

### Method
N/A (Function Signature)

### Endpoint
N/A

### Parameters
#### Query Parameters
- **Flags** (integer) - Optional - Combination of flags.
  - VAR_TIMEVALUEONLY (0x1): Includes time value only.
  - VAR_DATEVALUEONLY (0x2): Includes date value only.
  - LOCALE_NOUSEROVERRIDE (0x80000000): Uses system default locale settings.

### Request Example
N/A

### Response
N/A

## VarBstrFromDisp

### Description
Converts a display value to a BSTR string with options for date/time value display.

### Method
N/A (Function Signature)

### Endpoint
N/A

### Parameters
#### Query Parameters
- **Flags** (integer) - Optional - Combination of flags.
  - VAR_TIMEVALUEONLY (0x1): Includes time value only.
  - VAR_DATEVALUEONLY (0x2): Includes date value only.
  - LOCALE_NOUSEROVERRIDE (0x80000000): Uses system default locale settings.

### Request Example
N/A

### Response
N/A

## VarBstrFromI2

### Description
Converts a 16-bit integer to a BSTR string with options for date/time value display.

### Method
N/A (Function Signature)

### Endpoint
N/A

### Parameters
#### Query Parameters
- **Flags** (integer) - Optional - Combination of flags.
  - VAR_TIMEVALUEONLY (0x1): Includes time value only.
  - VAR_DATEVALUEONLY (0x2): Includes date value only.
  - LOCALE_NOUSEROVERRIDE (0x80000000): Uses system default locale settings.

### Request Example
N/A

### Response
N/A

## VarBstrFromI4

### Description
Converts a 32-bit integer to a BSTR string with options for date/time value display.

### Method
N/A (Function Signature)

### Endpoint
N/A

### Parameters
#### Query Parameters
- **Flags** (integer) - Optional - Combination of flags.
  - VAR_TIMEVALUEONLY (0x1): Includes time value only.
  - VAR_DATEVALUEONLY (0x2): Includes date value only.
  - LOCALE_NOUSEROVERRIDE (0x80000000): Uses system default locale settings.

### Request Example
N/A

### Response
N/A

## VarBstrFromR4

### Description
Converts a 32-bit floating-point number to a BSTR string with options for date/time value display.

### Method
N/A (Function Signature)

### Endpoint
N/A

### Parameters
#### Query Parameters
- **Flags** (integer) - Optional - Combination of flags.
  - VAR_TIMEVALUEONLY (0x1): Includes time value only.
  - VAR_DATEVALUEONLY (0x2): Includes date value only.
  - LOCALE_NOUSEROVERRIDE (0x80000000): Uses system default locale settings.

### Request Example
N/A

### Response
N/A

## VarBstrFromR8

### Description
Converts a 64-bit floating-point number to a BSTR string with options for date/time value display.

### Method
N/A (Function Signature)

### Endpoint
N/A

### Parameters
#### Query Parameters
- **Flags** (integer) - Optional - Combination of flags.
  - VAR_TIMEVALUEONLY (0x1): Includes time value only.
  - VAR_DATEVALUEONLY (0x2): Includes date value only.
  - LOCALE_NOUSEROVERRIDE (0x80000000): Uses system default locale settings.

### Request Example
N/A

### Response
N/A

## VarBstrFromUI1

### Description
Converts an unsigned 8-bit integer to a BSTR string with options for date/time value display.

### Method
N/A (Function Signature)

### Endpoint
N/A

### Parameters
#### Query Parameters
- **Flags** (integer) - Optional - Combination of flags.
  - VAR_TIMEVALUEONLY (0x1): Includes time value only.
  - VAR_DATEVALUEONLY (0x2): Includes date value only.
  - LOCALE_NOUSEROVERRIDE (0x80000000): Uses system default locale settings.

### Request Example
N/A

### Response
N/A

## VarCmp

### Description
Compares two variant values with various normalization options.

### Method
N/A (Function Signature)

### Endpoint
N/A

### Parameters
#### Query Parameters
- **Flags** (integer) - Optional - Combination of normalization flags.
  - NORM_IGNORECASE (0x1): Ignores case during comparison.
  - NORM_IGNORENONSPACE (0x2): Ignores non-space characters.
  - NORM_IGNORESYMBOLS (0x4): Ignores symbols.
  - NORM_IGNOREWIDTH (0x8): Ignores character width differences.
  - NORM_IGNOREKANATYPE (0x40): Ignores Kana type differences.
  - NORM_IGNOREKASHIDA (0x40000): Ignores Kashida characters.

### Request Example
N/A

### Response
N/A

## VarDateFromStr

### Description
Converts a string to a date value with options for time and date value display.

### Method
N/A (Function Signature)

### Endpoint
N/A

### Parameters
#### Query Parameters
- **Flags** (integer) - Optional - Combination of flags.
  - VAR_TIMEVALUEONLY (0x1): Includes time value only.
  - VAR_DATEVALUEONLY (0x2): Includes date value only.
  - LOCALE_NOUSEROVERRIDE (0x80000000): Uses system default locale settings.

### Request Example
N/A

### Response
N/A

## VarDecFromStr

### Description
Converts a string to a decimal value with options for time and date value display.

### Method
N/A (Function Signature)

### Endpoint
N/A

### Parameters
#### Query Parameters
- **Flags** (integer) - Optional - Combination of flags.
  - VAR_TIMEVALUEONLY (0x1): Includes time value only.
  - VAR_DATEVALUEONLY (0x2): Includes date value only.
  - LOCALE_NOUSEROVERRIDE (0x80000000): Uses system default locale settings.

### Request Example
N/A

### Response
N/A

## VarFormatFromTokens

### Description
Formats a variant from tokens with calendar and substitution options.

### Method
N/A (Function Signature)

### Endpoint
N/A

### Parameters
#### Query Parameters
- **Flags** (integer) - Optional - Combination of flags.
  - VAR_CALENDAR_HIJRI (0x8): Uses Hijri calendar.
  - VAR_FORMAT_NOSUBSTITUTE (0x20): Disables substitution.

### Request Example
N/A

### Response
N/A

## VarFormatNumber

### Description
Formats a number with calendar options.

### Method
N/A (Function Signature)

### Endpoint
N/A

### Parameters
#### Query Parameters
- **Flags** (integer) - Optional - Combination of flags.
  - VAR_CALENDAR_HIJRI (0x8): Uses Hijri calendar.

### Request Example
N/A

### Response
N/A

## VarFormatPercent

### Description
Formats a percentage with calendar options.

### Method
N/A (Function Signature)

### Endpoint
N/A

### Parameters
#### Query Parameters
- **Flags** (integer) - Optional - Combination of flags.
  - VAR_CALENDAR_HIJRI (0x8): Uses Hijri calendar.

### Request Example
N/A

### Response
N/A

## VarI1FromStr

### Description
Converts a string to an 8-bit integer with locale override option.

### Method
N/A (Function Signature)

### Endpoint
N/A

### Parameters
#### Query Parameters
- **Flags** (integer) - Optional - Combination of flags.
  - LOCALE_NOUSEROVERRIDE (0x80000000): Uses system default locale settings.

### Request Example
N/A

### Response
N/A

## VarI2FromStr

### Description
Converts a string to a 16-bit integer with options for date/time value display.

### Method
N/A (Function Signature)

### Endpoint
N/A

### Parameters
#### Query Parameters
- **Flags** (integer) - Optional - Combination of flags.
  - VAR_TIMEVALUEONLY (0x1): Includes time value only.
  - VAR_DATEVALUEONLY (0x2): Includes date value only.
  - LOCALE_NOUSEROVERRIDE (0x80000000): Uses system default locale settings.

### Request Example
N/A

### Response
N/A

## VarI4FromStr

### Description
Converts a string to a 32-bit integer with options for date/time value display.

### Method
N/A (Function Signature)

### Endpoint
N/A

### Parameters
#### Query Parameters
- **Flags** (integer) - Optional - Combination of flags.
  - VAR_TIMEVALUEONLY (0x1): Includes time value only.
  - VAR_DATEVALUEONLY (0x2): Includes date value only.
  - LOCALE_NOUSEROVERRIDE (0x80000000): Uses system default locale settings.

### Request Example
N/A

### Response
N/A

## VarMonthName

### Description
Retrieves the name of a month with calendar options.

### Method
N/A (Function Signature)

### Endpoint
N/A

### Parameters
#### Query Parameters
- **Flags** (integer) - Optional - Combination of flags.
  - VAR_CALENDAR_HIJRI (0x8): Uses Hijri calendar.

### Request Example
N/A

### Response
N/A

## VarR4FromStr

### Description
Converts a string to a 32-bit floating-point number with options for date/time value display.

### Method
N/A (Function Signature)

### Endpoint
N/A

### Parameters
#### Query Parameters
- **Flags** (integer) - Optional - Combination of flags.
  - VAR_TIMEVALUEONLY (0x1): Includes time value only.
  - VAR_DATEVALUEONLY (0x2): Includes date value only.
  - LOCALE_NOUSEROVERRIDE (0x80000000): Uses system default locale settings.

### Request Example
N/A

### Response
N/A

## VarR8FromStr

### Description
Converts a string to a 64-bit floating-point number with options for date/time value display.

### Method
N/A (Function Signature)

### Endpoint
N/A

### Parameters
#### Query Parameters
- **Flags** (integer) - Optional - Combination of flags.
  - VAR_TIMEVALUEONLY (0x1): Includes time value only.
  - VAR_DATEVALUEONLY (0x2): Includes date value only.
  - LOCALE_NOUSEROVERRIDE (0x80000000): Uses system default locale settings.

### Request Example
N/A

### Response
N/A

## VarUI1FromStr

### Description
Converts a string to an unsigned 8-bit integer with locale override option.

### Method
N/A (Function Signature)

### Endpoint
N/A

### Parameters
#### Query Parameters
- **Flags** (integer) - Optional - Combination of flags.
  - LOCALE_NOUSEROVERRIDE (0x80000000): Uses system default locale settings.

### Request Example
N/A

### Response
N/A

## VarUI2FromStr

### Description
Converts a string to an unsigned 16-bit integer with options for date/time value display.

### Method
N/A (Function Signature)

### Endpoint
N/A

### Parameters
#### Query Parameters
- **Flags** (integer) - Optional - Combination of flags.
  - VAR_TIMEVALUEONLY (0x1): Includes time value only.
  - VAR_DATEVALUEONLY (0x2): Includes date value only.
  - LOCALE_NOUSEROVERRIDE (0x80000000): Uses system default locale settings.

### Request Example
N/A

### Response
N/A

## VarUI4FromStr

### Description
Converts a string to an unsigned 32-bit integer with options for date/time value display.

### Method
N/A (Function Signature)

### Endpoint
N/A

### Parameters
#### Query Parameters
- **Flags** (integer) - Optional - Combination of flags.
  - VAR_TIMEVALUEONLY (0x1): Includes time value only.
  - VAR_DATEVALUEONLY (0x2): Includes date value only.
  - LOCALE_NOUSEROVERRIDE (0x80000000): Uses system default locale settings.

### Request Example
N/A

### Response
N/A

## VarWeekdayName

### Description
Retrieves the name of a weekday with calendar options.

### Method
N/A (Function Signature)

### Endpoint
N/A

### Parameters
#### Query Parameters
- **Flags** (integer) - Optional - Combination of flags.
  - VAR_CALENDAR_HIJRI (0x8): Uses Hijri calendar.

### Request Example
N/A

### Response
N/A
```

--------------------------------

### Build Stack String in C

Source: https://context7.com/kasperskylab/hrtng/llms.txt

Reconstructs strings built character-by-character on the stack. Supports optional decryption and mixed assignment types. Ensure to start from the first assignment for correct string separation.

```c
// Context menu: "Build stack string (B)"
// Context menu: "Build stack string and decrypt (Shift-B)"

// Before - individual assignments:
Str2 = 115;
v72 = 101;
v73 = 114;
v74 = 118;
v75 = 105;
v76 = 99;
v77 = 101;
v78 = 115;
v79 = 46;
v80 = 101;
v81 = 120;
v82 = 101;
v83 = 0;
if (wcsicmp(&Filename, &Str2))
```

```c
// After - right-click on Str2, select "Build stack string":
services.exe[0] = 's'; // services.exe
services.exe[1] = 'e';
services.exe[2] = 'r';
services.exe[3] = 'v';
services.exe[4] = 'i';
services.exe[5] = 'c';
services.exe[6] = 'e';
services.exe[7] = 's';
services.exe[8] = '.';
services.exe[9] = 'e';
services.exe[10] = 'x';
services.exe[11] = 'e';
services.exe[12] = 0;
if ( wcsicmp(&Filename, (const wchar_t *)services.exe) )
```

--------------------------------

### Add IDA Plugin Target

Source: https://github.com/kasperskylab/hrtng/blob/master/src/CMakeLists.txt

Defines the main IDA plugin target 'hrtng' and lists all its source files. This is the core command for building the plugin.

```cmake
ADD_IDA_PLUGIN(hrtng 
  hrtng.cpp
  apihashes.cpp
  appcall.cpp
  appcall_view.cpp
  cast.cpp
  callrefs.cpp
  comhelper.cpp
  config.cpp
  crpp.cpp
  ctreeg.cpp
  decr.cpp
  deinline.cpp
  deob.cpp
  regrefs.cpp
  helpers.cpp
  invert_if.cpp
  idb2pat.cpp
  lit.cpp
  MicrocodeExplorer.cpp
  microavx.cpp
  msig.cpp
  opt.cpp
  new_struc_place.cpp
  new_struc_view.cpp
  new_struct.cpp
  structures.cpp
  refactoring.cpp
  rename.cpp
  unflat.cpp
  varval.cpp
  )
```

--------------------------------

### CreateWindowEx API Flags

Source: https://github.com/kasperskylab/hrtng/blob/master/bin/plugins/literal.txt

Defines the extended window styles and standard window styles used when creating windows.

```APIDOC
## CreateWindowEx Flags

### Description
Extended styles and standard window styles for window creation.

### Parameters
#### Request Body
- **WS_EX_TOPMOST** (enum) - 0x8
- **WS_EX_TOOLWINDOW** (enum) - 0x80
- **WS_CAPTION** (bits) - 0xc00000
- **WS_VISIBLE** (bits) - 0x10000000
```

--------------------------------

### CreateService API Constants

Source: https://github.com/kasperskylab/hrtng/blob/master/bin/plugins/literal.txt

Enumerations and bitwise flags for service configuration and access rights.

```APIDOC
## CreateService Constants

### Description
Constants defining service access rights, types, start types, and error control.

### Parameters
#### Request Body
- **SERVICE_ALL_ACCESS** (enum) - 0xf01ff
- **SERVICE_AUTO_START** (enum) - 0x2
- **SERVICE_ERROR_CRITICAL** (enum) - 0x3
```

--------------------------------

### Create DEC File using IDC Script

Source: https://github.com/kasperskylab/hrtng/blob/master/doc/create_dec.md

Use this IDC script to create .dec files in batch mode. Run it with IDA using the command `idat -A -Screate_dec.idc sample.idb`.

```idc
#include <idc.idc>
static main()
{
  batch(1);
  create_dec();
  qexit(0);
}
```

--------------------------------

### Navigate Extended Cross-References

Source: https://context7.com/kasperskylab/hrtng/llms.txt

Access enhanced cross-reference navigation to view decompiler context for calls and variables.

```c
// Menu: "Jump/Jump to xref Ex (Shift-X)"

// Features:
// - Register/stack variable references from current instruction
// - Function xrefs with call context (arguments visible)
// - Global variable xrefs with usage context
// - Helper call navigation within current function (inlines)

// Usage:
// 1. Position cursor on register, call, or global variable
// 2. Press Shift-X
// 3. Navigate results showing pseudocode context

// Tip: Clear decompilation cache with ` key if xrefs incorrect
// Then re-run "Jump to xref globally"
```

--------------------------------

### CertGetCertificateChain

Source: https://github.com/kasperskylab/hrtng/blob/master/bin/plugins/literal.txt

Builds a certificate chain context.

```APIDOC
## CertGetCertificateChain

### Description
Builds a certificate chain starting from an end certificate.

### Flags
- **CERT_CHAIN_CACHE_END_CERT** (0x1)
- **CERT_CHAIN_THREAD_STORE_SYNC** (0x2)
- **CERT_CHAIN_USE_LOCAL_MACHINE_STORE** (0x8)
- **CERT_CHAIN_REVOCATION_CHECK_CHAIN** (0x20000000)
```

--------------------------------

### File and Event Handling Functions

Source: https://github.com/kasperskylab/hrtng/blob/master/bin/plugins/literal.txt

Functions for opening encrypted files, events, and regular files with various sharing and access modes.

```APIDOC
## OpenEncryptedFileRaw

### Description
Opens an encrypted file for raw access with options for import, directory creation, or overwriting hidden files.

### Method
Not specified (typically a function call, not an HTTP method)

### Endpoint
Not applicable

### Parameters
#### Enum Parameters
- **CREATE_FOR_IMPORT** (enum) - Value: 0x1
- **CREATE_FOR_DIR** (enum) - Value: 0x2
- **OVERWRITE_HIDDEN** (enum) - Value: 0x4

### Request Example
```
// Example usage (conceptual)
HANDLE hFile = OpenEncryptedFileRaw(lpFileName, ulFlags, pSkipArray);
```

### Response
#### Success Response
Returns a handle to the opened encrypted file.

#### Response Example
```
// Conceptual response
HANDLE hFile = ...;
```

## OpenEvent

### Description
Opens an existing named event object with specified access rights.

### Method
Not specified (typically a function call, not an HTTP method)

### Endpoint
Not applicable

### Parameters
#### Enum Parameters
- **EVENT_ALL_ACCESS** (enum) - Value: 0x1f0003
- **EVENT_MODIFY_STATE** (enum) - Value: 0x2
- **SYNCHRONIZE** (enum) - Value: 0x100000

### Request Example
```
// Example usage (conceptual)
HANDLE hEvent = OpenEvent(EVENT_ALL_ACCESS, FALSE, TEXT("MyEvent"));
```

### Response
#### Success Response
Returns a handle to the opened event object.

#### Response Example
```
// Conceptual response
HANDLE hEvent = ...;
```

## OpenFile

### Description
Opens a file with specified sharing and access modes, including options for creation and parsing.

### Method
Not specified (typically a function call, not an HTTP method)

### Endpoint
Not applicable

### Parameters
#### Bit Flags
- **OF_SHARE_DENY_READ** (bits) - Value: 0x30
- **OF_WRITE** (bits) - Value: 0x1
- **OF_READWRITE** (bits) - Value: 0x2
- **OF_SHARE_EXCLUSIVE** (bits) - Value: 0x10
- **OF_SHARE_DENY_WRITE** (bits) - Value: 0x20
- **OF_SHARE_DENY_NONE** (bits) - Value: 0x40
- **OF_PARSE** (bits) - Value: 0x100
- **OF_DELETE** (bits) - Value: 0x200
- **OF_CANCEL** (bits) - Value: 0x800
- **OF_CREATE** (bits) - Value: 0x1000
- **OF_PROMPT** (bits) - Value: 0x2000
- **OF_EXIST** (bits) - Value: 0x4000
- **OF_REOPEN** (bits) - Value: 0x8000
- **OF_READ** (bits) - Value: 0x0

### Request Example
```
// Example usage (conceptual)
OFSTRUCT ofStruct;
HFILE hFile = OpenFile(lpFileName, &ofStruct, OF_READWRITE | OF_CREATE);
```

### Response
#### Success Response
Returns a file handle and populates the OFSTRUCT structure.

#### Response Example
```
// Conceptual response
HFILE hFile = ...;
OFSTRUCT ofStruct = { ... };
```
```

--------------------------------

### HeapCompact Flags

Source: https://github.com/kasperskylab/hrtng/blob/master/bin/plugins/literal.txt

Flags for heap compaction.

```APIDOC
## HeapCompact Flags

### Description
Flags that affect heap compaction operations.

### Flags
- **HEAP_NO_SERIALIZE** (0x1)
```

--------------------------------

### Customizing API List for Hash Scan

Source: https://github.com/kasperskylab/hrtng/blob/master/doc/api-hashes.md

Modify the 'apilist.txt' file to include new API names for the hash scan plugin. The file format requires empty lines to separate DLL entries and lists API names under each DLL.

```plaintext

ADVAPI32.dll
RegCreateKeyA
RegCreateKeyExA
RegCreateKeyExW
RegCreateKeyW
RegDeleteKeyA

KERNEL32.dll
CreateFileA
CreateFileMappingA
CreateFileW

wininit.exe

```