Function at 0x14002d2d0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x40
mov rbp, rdx
mov r12, rcx
xor edx, edx
mov r8d, edx
mov esi, edx
lea rax, [rbp - 1]
cmp rax, 0x3e
jbe 0x14002d31e
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14002d95b
test rbp, rbp
je 0x14002d337
movsxd rax, dword [rcx + 0x3c]
add rax, 0x108
cmp rbp, rax
jae 0x14002d337
mov ecx, ntohs
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add rsp, 0x40
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
movsxd r13, dword [rcx + 0x3c]
add r13, r12
mov qword [rsp + 0x88], r13
cmp dword [r13], 0x4550
jne 0x14002d95b
mov eax, 0x8664
cmp word [r13 + 4], ax
jne 0x14002d95b
mov eax, dword [r13 + 0x38]
test al, 1
jne 0x14002d95b
movzx ecx, word [r13 + 0x14]
mov r10d, eax
movzx eax, word [r13 + 6]
add rcx, 0x24
cmp dx, ax
jae 0x14002d3b5
add rcx, r13
movzx r9d, ax
nop dword [rax]
mov eax, dword [rcx + 4]
mov edx, dword [rcx]
test eax, eax
jne 0x14002d39f
lea rax, [r10 + rdx]
jmp 0x14002d3a1
add eax, edx
cmp rax, r8
cmovbe rax, r8
add rcx, 0x28
mov r8, rax
sub r9, 1
jne 0x14002d390
mov edi, dword [r13 + 0x50]
lea rcx, [r10 - 1]
dec rdi
lea rax, [r10 - 1]
add rdi, r10
not rcx
add rax, r8
and rdi, rcx
and rax, rcx
cmp rdi, rax
jne 0x14002d95b
mov rcx, qword [r13 + 0x30]
mov r9d, 4
mov r8d, 0x3000
mov qword [rsp + 0x30], r15
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
test rax, rax
jne 0x14002d43b
lea r9d, [rax + 4]
mov r8d, 0x3000
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
test rax, rax
jne 0x14002d43b
lea ecx, [rax + 0xe]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r15, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x40
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov qword [rsp + 0x78], rbx
lea rcx, [r15 + rdi]
mov qword [rsp + 0x38], r14
mov rax, r15
movabs r14, 0xffffffff00000000
and rcx, r14
and rax, r14
cmp rax, rcx
jae 0x14002d4b0
mov ecx, reloc.WSOCK32.dll_recv
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
je 0x14002d4d0
mov qword [rax], rsi
mov r9d, 4
mov r8d, 0x3000
mov qword [rax + 8], r15
mov rdx, rdi
xor ecx, ecx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
test rax, rax
je 0x14002d520
lea rcx, [rax + rdi]
and rax, r14
and rcx, r14
cmp rax, rcx
jb 0x14002d461
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 0x78]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r14, rax
test rax, rax
jne 0x14002d525
xor edx, edx
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, rsi
mov r8, qword [rsp + 0xa8]
lea rdx, [0x14002d250]
call fcn.14002cb50
mov ecx, SafeArrayGetUBound
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov r14, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x78]
mov r15, qword [rsp + 0x30]
add rsp, 0x40
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rcx, rbx
jmp 0x14002d4e4
mov edx, 8
xor r8d, r8d
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_HeapCreate]
mov qword [r14 + 0x18], rax
mov qword [r14], r15
movzx eax, word [r13 + 0x16]
shr eax, 0xd
and eax, 1
mov dword [r14 + 0x28], eax
lea rax, [0x14002d240]
mov qword [r14 + 0x30], rax
lea rax, [0x14002d250]
mov qword [r14 + 0x38], rax
mov rax, qword [rsp + 0x90]
mov qword [r14 + 0x40], rax
mov rax, qword [rsp + 0x98]
mov qword [r14 + 0x48], rax
mov rax, qword [rsp + 0xa0]
mov qword [r14 + 0x50], rax
mov rax, qword [rsp + 0xa8]
mov qword [r14 + 0x60], rax
mov eax, dword [r13 + 0x38]
mov dword [r14 + 0x70], eax
mov qword [r14 + 0x78], rsi
test rbp, rbp
je 0x14002d5c3
mov eax, dword [r13 + 0x54]
cmp rbp, rax
jae 0x14002d5c3
mov ecx, ntohs
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, r14
call fcn.14002db20
jmp 0x14002d503
mov edx, dword [r13 + 0x54]
mov r9d, 4
mov r8d, 0x1000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [r13 + 0x54]
mov rdx, r12
mov rcx, rax
mov rbx, rax
call sub.VCRUNTIME140.dll_memcpy
movsxd rax, dword [r12 + 0x3c]
add rax, rbx
mov qword [r14 + 8], rax
mov qword [rax + 0x30], r15
xor eax, eax
mov rcx, qword [r14 + 8]
mov r12d, eax
mov rsi, qword [r14]
movzx edi, word [rcx + 0x14]
add rdi, 0x24
cmp ax, word [rcx + 6]
jae 0x14002d6e7
add rdi, rcx
nop
mov ecx, dword [rdi + 4]
test ecx, ecx
jne 0x14002d674
movsxd rax, dword [r13 + 0x38]
test eax, eax
jle 0x14002d6cd
mov ecx, dword [rdi]
mov rbx, rax
mov rax, qword [r14 + 0x60]
add rcx, rsi
mov rdx, rbx
mov qword [rsp + 0x20], rax
mov r9d, 4
mov r8d, 0x1000
call qword [r14 + gethostbyaddr]
test rax, rax
je 0x14002d5b6
mov ecx, dword [rdi]
mov r8, rbx
add rcx, rsi
xor edx, edx
mov dword [rdi - 4], ecx
call sub.VCRUNTIME140.dll_memset
jmp 0x14002d6cd
test rbp, rbp
je 0x14002d687
mov eax, dword [rdi + 8]
add eax, ecx
cmp rbp, rax
jb 0x14002d5ab
mov rax, qword [r14 + 0x60]
mov rdx, rcx
mov ecx, dword [rdi]
mov r9d, 4
add rcx, rsi
mov qword [rsp + 0x20], rax
mov r8d, 0x1000
call qword [r14 + gethostbyaddr]
test rax, rax
je 0x14002d5b6
mov ebx, dword [rdi]
mov edx, dword [rdi + 8]
add rbx, rsi
mov r8d, dword [rdi + 4]
mov rcx, rbx
add rdx, qword [rsp + 0x70]
call sub.VCRUNTIME140.dll_memcpy
mov dword [rdi - 4], ebx
mov rcx, qword [r14 + 8]
inc r12d
add rdi, 0x28
movzx eax, word [rcx + 6]
cmp r12d, eax
jl 0x14002d620
xor eax, eax
mov rbp, qword [rcx + 0x30]
sub rbp, qword [r13 + 0x30]
je 0x14002d7a7
cmp dword [rcx + 0xb4], 0
je 0x14002d7ac
mov r12, qword [r14]
mov esi, dword [rcx + 0xb0]
add rsi, r12
mov eax, dword [rsi]
test eax, eax
je 0x14002d7a7
xor r13d, r13d
nop dword [rax + rax]
mov edi, eax
lea rdx, [rsi + 8]
mov eax, dword [rsi + 4]
add rdi, r12
sub rax, 8
mov r8d, r13d
test rax, 0xfffffffffffffffe
jbe 0x14002d77a
nop dword [rax + rax]
movzx eax, word [rdx]
mov ecx, eax
shr eax, 0xc
and ecx, 0xfff
cmp eax, 3
je 0x14002d75e
cmp eax, 0xa
jne 0x14002d761
add qword [rcx + rdi], rbp
jmp 0x14002d761
add dword [rcx + rdi], ebp
mov ecx, dword [rsi + 4]
inc r8d
sub rcx, 8
mov eax, r8d
shr rcx, 1
add rdx, 2
cmp rax, rcx
jb 0x14002d740
mov ebx, dword [r14 + 0x70]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8d, ebx
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov eax, dword [rsi + 4]
add rsi, rax
mov eax, dword [rsi]
test eax, eax
jne 0x14002d720
mov r13, qword [rsp + 0x88]
mov eax, 1
mov rcx, r14
mov dword [r14 + 0x2c], eax
call fcn.14002cea0
test eax, eax
je 0x14002d5b6
mov rax, qword [r14 + 8]
mov r8, qword [r14]
mov ecx, dword [rax + 0xa0]
mov edx, dword [rax + 0xa4]
add rcx, r8
movabs rax, 0xaaaaaaaaaaaaaaab
mul rdx
shr rdx, 3
call qword [sym.imp.KERNEL32.dll_RtlAddFunctionTable]
test al, al
je 0x14002d5b6
mov rcx, r14
call fcn.14002cc90
test eax, eax
je 0x14002d5b6
mov rax, qword [0x140113af8]
cmp qword [r13 + 0x30], rax
je 0x14002d859
mov rax, qword [r14 + 8]
mov ecx, dword [rax + 0xd0]
test ecx, ecx
je 0x14002d859
mov rdi, qword [r14]
mov rbx, qword [rcx + rdi + 0x18]
test rbx, rbx
je 0x14002d859
mov rax, qword [rbx]
test rax, rax
je 0x14002d859
nop word [rax + rax]
xor r8d, r8d
mov rcx, rdi
lea edx, [r8 + 1]
call rax
mov rax, qword [rbx + 8]
lea rbx, [rbx + 8]
test rax, rax
jne 0x14002d840
mov rdx, qword [r14 + 8]
mov ebx, dword [rdx + 0x28]
test ebx, ebx
je 0x14002d94b
cmp dword [r14 + 0x28], 0
je 0x14002d93b
cmp byte [rsp + 0xb0], 0
je 0x14002d92b
mov rax, qword gs:[0x60]
mov rcx, qword [r14]
mov qword [0x140114ab0], rcx
mov rdi, qword [rax + 0x110]
mov eax, dword [rdx + 0x50]
add rax, rcx
mov rcx, rdi
mov qword [0x140114aa8], rax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [0x1400da8d8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.RtlPcToFileHeader
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor r8d, r8d
lea rdx, [0x14002caf0]
mov rcx, rax
call sym.AutoHotkey.exe_MinHookEnable
mov qword [0x140114aa0], rax
mov r8, r14
lea rax, [r15 + rbx]
mov edx, 1
mov rcx, r15
call rax
mov rcx, qword [0x140114aa0]
mov ebx, eax
call sym.AutoHotkey.exe_MinHookDisable
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test ebx, ebx
jne 0x14002d92b
mov ecx, 0x45a
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, r14
call fcn.14002db20
jmp 0x14002d503
mov dword [r14 + 0x24], 1
mov rax, r14
jmp 0x14002d505
lea rax, [r15 + rbx]
mov qword [r14 + 0x68], rax
mov rax, r14
jmp 0x14002d505
mov qword [r14 + 0x68], 0
mov rax, r14
jmp 0x14002d505
mov ecx, 0xc1
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add rsp, 0x40
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret