Function at 0x14002f890
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x40
mov rbp, rdx
mov r12, rcx
xor edx, edx
mov r8d, edx
mov esi, edx
lea rax, [rbp - 1]
cmp rax, 0x3e
jbe 0x14002f8de
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14002ff1b
test rbp, rbp
je 0x14002f8f7
movsxd rax, dword [rcx + 0x3c]
add rax, 0x108
cmp rbp, rax
jae 0x14002f8f7
mov ecx, ntohs
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add rsp, 0x40
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
movsxd r13, dword [rcx + 0x3c]
add r13, r12
mov qword [rsp + 0x88], r13
cmp dword [r13], 0x4550
jne 0x14002ff1b
mov eax, 0x8664
cmp word [r13 + 4], ax
jne 0x14002ff1b
mov eax, dword [r13 + 0x38]
test al, 1
jne 0x14002ff1b
movzx ecx, word [r13 + 0x14]
mov r10d, eax
movzx eax, word [r13 + 6]
add rcx, 0x24
cmp dx, ax
jae 0x14002f975
add rcx, r13
mov r9d, eax
nop dword [rax]
mov eax, dword [rcx + 4]
mov edx, dword [rcx]
test eax, eax
jne 0x14002f95f
lea rax, [r10 + rdx]
jmp 0x14002f961
add eax, edx
cmp rax, r8
cmovbe rax, r8
add rcx, 0x28
mov r8, rax
sub r9, 1
jne 0x14002f950
mov edi, dword [r13 + 0x50]
lea rcx, [r10 - 1]
dec rdi
lea rax, [r10 - 1]
add rdi, r10
not rcx
add rax, r8
and rdi, rcx
and rax, rcx
cmp rdi, rax
jne 0x14002ff1b
mov rcx, qword [r13 + 0x30]
mov r9d, 4
mov r8d, 0x3000
mov qword [rsp + 0x30], r15
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
test rax, rax
jne 0x14002f9fb
lea r9d, [rax + 4]
mov r8d, 0x3000
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
test rax, rax
jne 0x14002f9fb
lea ecx, [rax + 0xe]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r15, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x40
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov qword [rsp + 0x78], rbx
lea rcx, [r15 + rdi]
mov qword [rsp + 0x38], r14
mov rax, r15
movabs r14, 0xffffffff00000000
and rcx, r14
and rax, r14
cmp rax, rcx
jae 0x14002fa70
mov ecx, reloc.WSOCK32.dll_recv
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
je 0x14002fa90
mov qword [rax], rsi
mov r9d, 4
mov r8d, 0x3000
mov qword [rax + 8], r15
mov rdx, rdi
xor ecx, ecx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
test rax, rax
je 0x14002fae0
lea rcx, [rax + rdi]
and rax, r14
and rcx, r14
cmp rax, rcx
jb 0x14002fa21
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 0x78]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r14, rax
test rax, rax
jne 0x14002fae5
xor edx, edx
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, rsi
mov r8, qword [rsp + 0xa8]
lea rdx, [0x14002f850]
call fcn.14002f1b0
mov ecx, ntohs
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov r14, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x78]
mov r15, qword [rsp + 0x30]
add rsp, 0x40
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rcx, rbx
jmp 0x14002faa4
mov edx, 8
xor r8d, r8d
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_HeapCreate]
mov qword [r14 + 0x18], rax
mov qword [r14], r15
movzx eax, word [r13 + 0x16]
shr eax, 0xd
and eax, 1
mov dword [r14 + 0x28], eax
lea rax, [0x14002f840]
mov qword [r14 + 0x30], rax
lea rax, [0x14002f850]
mov qword [r14 + 0x38], rax
mov rax, qword [rsp + 0x90]
mov qword [r14 + 0x40], rax
mov rax, qword [rsp + 0x98]
mov qword [r14 + 0x48], rax
mov rax, qword [rsp + 0xa0]
mov qword [r14 + 0x50], rax
mov rax, qword [rsp + 0xa8]
mov qword [r14 + 0x60], rax
mov eax, dword [r13 + 0x38]
mov dword [r14 + 0x70], eax
mov qword [r14 + 0x78], rsi
test rbp, rbp
je 0x14002fb83
mov eax, dword [r13 + 0x54]
cmp rbp, rax
jae 0x14002fb83
mov ecx, ntohs
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, r14
call fcn.1400300e0
jmp 0x14002fac3
mov edx, dword [r13 + 0x54]
mov r9d, 4
mov r8d, 0x1000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [r13 + 0x54]
mov rdx, r12
mov rcx, rax
mov rbx, rax
call sub.VCRUNTIME140.dll_memcpy
movsxd rax, dword [r12 + 0x3c]
add rax, rbx
mov qword [r14 + 8], rax
mov qword [rax + 0x30], r15
xor eax, eax
mov rcx, qword [r14 + 8]
mov r12d, eax
mov rsi, qword [r14]
movzx edi, word [rcx + 0x14]
add rdi, 0x24
cmp ax, word [rcx + 6]
jae 0x14002fca7
add rdi, rcx
nop
mov ecx, dword [rdi + 4]
test ecx, ecx
jne 0x14002fc34
movsxd rax, dword [r13 + 0x38]
test eax, eax
jle 0x14002fc8d
mov ecx, dword [rdi]
mov rbx, rax
mov rax, qword [r14 + 0x60]
add rcx, rsi
mov rdx, rbx
mov qword [rsp + 0x20], rax
mov r9d, 4
mov r8d, 0x1000
call qword [r14 + gethostbyaddr]
test rax, rax
je 0x14002fb76
mov ecx, dword [rdi]
mov r8, rbx
add rcx, rsi
xor edx, edx
mov dword [rdi - 4], ecx
call sub.VCRUNTIME140.dll_memset
jmp 0x14002fc8d
test rbp, rbp
je 0x14002fc47
mov eax, dword [rdi + 8]
add eax, ecx
cmp rbp, rax
jb 0x14002fb6b
mov rax, qword [r14 + 0x60]
mov rdx, rcx
mov ecx, dword [rdi]
mov r9d, 4
add rcx, rsi
mov qword [rsp + 0x20], rax
mov r8d, 0x1000
call qword [r14 + gethostbyaddr]
test rax, rax
je 0x14002fb76
mov ebx, dword [rdi]
mov edx, dword [rdi + 8]
add rbx, rsi
mov r8d, dword [rdi + 4]
mov rcx, rbx
add rdx, qword [rsp + 0x70]
call sub.VCRUNTIME140.dll_memcpy
mov dword [rdi - 4], ebx
mov rcx, qword [r14 + 8]
inc r12d
add rdi, 0x28
movzx eax, word [rcx + 6]
cmp r12d, eax
jl 0x14002fbe0
xor eax, eax
mov rbp, qword [rcx + 0x30]
sub rbp, qword [r13 + 0x30]
je 0x14002fd67
cmp dword [rcx + 0xb4], 0
je 0x14002fd6c
mov r12, qword [r14]
mov esi, dword [rcx + 0xb0]
add rsi, r12
mov eax, dword [rsi]
test eax, eax
je 0x14002fd67
xor r13d, r13d
nop dword [rax + rax]
mov edi, eax
lea rdx, [rsi + 8]
mov eax, dword [rsi + 4]
add rdi, r12
sub rax, 8
mov r8d, r13d
test rax, 0xfffffffffffffffe
jbe 0x14002fd3a
nop dword [rax + rax]
movzx eax, word [rdx]
mov ecx, eax
shr eax, 0xc
and ecx, 0xfff
cmp eax, 3
je 0x14002fd1e
cmp eax, 0xa
jne 0x14002fd21
add qword [rcx + rdi], rbp
jmp 0x14002fd21
add dword [rcx + rdi], ebp
mov ecx, dword [rsi + 4]
inc r8d
sub rcx, 8
mov eax, r8d
shr rcx, 1
add rdx, 2
cmp rax, rcx
jb 0x14002fd00
mov ebx, dword [r14 + 0x70]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8d, ebx
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov eax, dword [rsi + 4]
add rsi, rax
mov eax, dword [rsi]
test eax, eax
jne 0x14002fce0
mov r13, qword [rsp + 0x88]
mov eax, 1
mov rcx, r14
mov dword [r14 + 0x2c], eax
call fcn.14002f4a0
test eax, eax
je 0x14002fb76
mov rax, qword [r14 + 8]
mov r8, qword [r14]
mov ecx, dword [rax + 0xa0]
mov edx, dword [rax + 0xa4]
add rcx, r8
movabs rax, 0xaaaaaaaaaaaaaaab
mul rdx
shr rdx, 3
call qword [sym.imp.KERNEL32.dll_RtlAddFunctionTable]
test al, al
je 0x14002fb76
mov rcx, r14
call fcn.14002f220
test eax, eax
je 0x14002fb76
mov rax, qword [0x140127b08]
cmp qword [r13 + 0x30], rax
je 0x14002fe19
mov rax, qword [r14 + 8]
mov ecx, dword [rax + 0xd0]
test ecx, ecx
je 0x14002fe19
mov rdi, qword [r14]
mov rbx, qword [rcx + rdi + 0x18]
test rbx, rbx
je 0x14002fe19
mov rax, qword [rbx]
test rax, rax
je 0x14002fe19
nop word [rax + rax]
xor r8d, r8d
mov rcx, rdi
lea edx, [r8 + 1]
call rax
mov rax, qword [rbx + 8]
lea rbx, [rbx + 8]
test rax, rax
jne 0x14002fe00
mov rdx, qword [r14 + 8]
mov ebx, dword [rdx + 0x28]
test ebx, ebx
je 0x14002ff0b
cmp dword [r14 + 0x28], 0
je 0x14002fefb
cmp byte [rsp + 0xb0], 0
je 0x14002feeb
mov rax, qword gs:[0x60]
mov rcx, qword [r14]
mov qword [0x140128ac0], rcx
mov rdi, qword [rax + 0x110]
mov eax, dword [rdx + 0x50]
add rax, rcx
mov rcx, rdi
mov qword [0x140128ab8], rax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [0x1400ef908]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.RtlPcToFileHeader
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor r8d, r8d
lea rdx, [0x14002f150]
mov rcx, rax
call sym.AutoHotkey.exe_MinHookEnable
mov qword [0x140128ab0], rax
mov r8, r14
lea rax, [r15 + rbx]
mov edx, 1
mov rcx, r15
call rax
mov rcx, qword [0x140128ab0]
mov ebx, eax
call sym.AutoHotkey.exe_MinHookDisable
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test ebx, ebx
jne 0x14002feeb
mov ecx, 0x45a
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, r14
call fcn.1400300e0
jmp 0x14002fac3
mov dword [r14 + 0x24], 1
mov rax, r14
jmp 0x14002fac5
lea rax, [r15 + rbx]
mov qword [r14 + 0x68], rax
mov rax, r14
jmp 0x14002fac5
mov qword [r14 + 0x68], 0
mov rax, r14
jmp 0x14002fac5
mov ecx, 0xc1
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add rsp, 0x40
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret