Function at 0x14002d9f0
Capabilities:
Get common file path
Write file on windows

Disassembly:
mov r11, rsp
push rsi
push rdi
push r13
push r14
sub rsp, 0x1a8
mov rax, qword [rcx]
mov r13, qword [rcx + 8]
xor esi, esi
mov qword [r11 + 0x10], rsi
mov rdi, rcx
lea r14d, [rsi + 1]
cmp dword [rax + 0x94], esi
je 0x14002ddb3
mov qword [r11 + 0x18], rbx
mov qword [r11 - 0x30], r12
mov r12d, dword [rax + 0x90]
lea rcx, [rax + 0x98]
add r12, r13
mov qword [r11 - 0x38], r15
test rcx, rcx
je 0x14002dc2f
cmp dword [rcx + 4], esi
je 0x14002dc2f
mov ebx, dword [rcx]
lea rdx, [r11 - 0x148]
mov ecx, 0x104
mov qword [rsp + 0x48], rsi
mov dword [rsp + 0x50], esi
mov qword [rsp + 0x58], rsi
add rbx, r13
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x40], reloc.WSOCK32.dll_getservbyport
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
mov ecx, eax
mov rax, qword [str.AutoHotkey.MemoryModule.temp.manifest]
mov qword [rsp + rcx + 0x80], rax
mov rax, qword [0x14011a9d0]
mov qword [rsp + rcx + 0x88], rax
mov rax, qword [0x14011a9d8]
mov qword [rsp + rcx + 0x90], rax
mov rax, qword [0x14011a9e0]
mov qword [rsp + rcx + 0x98], rax
mov eax, dword [0x14011a9e8]
mov dword [rsp + rcx + 0xa0], eax
movzx eax, word [reloc.WSOCK32.dll_WSACleanup]
mov word [rsp + rcx + 0xa4], ax
lea rax, [rsp + 0x80]
mov ecx, esi
cmp qword [0x140143f88], rcx
mov qword [rsp + 0x48], rax
je 0x14002dc2f
movzx edx, word [rbx + 0xe]
movzx eax, word [rbx + 0xc]
add edx, eax
test edx, edx
jle 0x14002dc2f
lea rax, [rbx + 0x10]
nop dword [rax + rax]
test dword [rax + 4], 0x80000000
je 0x14002db2f
cmp word [rax], 0x18
je 0x14002db3e
inc ecx
add rax, 8
cmp ecx, edx
jl 0x14002db20
jmp 0x14002dc2f
mov eax, dword [rax + 4]
xor r15d, r15d
lea rcx, [rsp + 0x80]
btr eax, 0x1f
mov qword [rsp + 0x30], r15
xor r9d, r9d
mov eax, dword [rax + rbx + 0x14]
xor r8d, r8d
mov edx, 0x40000000
btr eax, 0x1f
mov dword [rsp + 0x28], 0x100
mov dword [rsp + 0x20], 2
mov esi, dword [rax + rbx + 0x14]
add rsi, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14002dc2d
mov dword [rsp + 0x1d0], r15d
mov edx, dword [rsi]
mov r8d, dword [rsi + 4]
lea r9, [rsp + 0x1d0]
add rdx, r13
mov rcx, rax
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x1d0], r15d
je 0x14002dc2d
lea rcx, [rsp + 0x40]
call qword [0x140143f88]
xor esi, esi
lea r8d, [r15 + 4]
mov qword [rsp + 0x30], rsi
lea rcx, [rsp + 0x80]
xor r9d, r9d
mov edx, 0x40000000
mov dword [rsp + 0x28], 0x4000100
mov rbx, rax
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp rbx, 0xffffffffffffffff
je 0x14002dc2f
lea rdx, [rsp + 0x1d8]
mov rcx, rbx
call qword [0x140143f98]
jmp 0x14002dc2f
xor esi, esi
mov edx, reloc.OLEAUT32.dll_SafeArrayLock
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x14002dd7d
mov qword [rsp + 0x1a0], rbp
movabs r15, 0x8000000000000000
nop word [rax + rax]
mov eax, dword [r12 + 0xc]
test eax, eax
je 0x14002dd75
mov rdx, qword [rdi + 0x40]
lea rcx, [r13 + rax]
call qword [rdi + 0x28]
mov rbp, rax
test rax, rax
je 0x14002dd67
mov ecx, dword [rdi + 0x18]
inc ecx
movsxd rdx, ecx
mov rcx, qword [rdi + 0x10]
shl rdx, 3
call qword [sym.imp.MSVCR100.dll_realloc]
test rax, rax
je 0x14002dd56
mov qword [rdi + 0x10], rax
cmp dword [rdi + 0x18], r14d
jne 0x14002dcb1
mov qword [rax], rsi
movsxd rcx, dword [rdi + 0x18]
mov rax, qword [rdi + 0x10]
mov qword [rax + rcx*8], rbp
inc dword [rdi + 0x18]
mov eax, dword [r12]
test eax, eax
je 0x14002dcd7
mov esi, dword [r12 + 0x10]
lea rbx, [r13 + rax]
add rsi, r13
jmp 0x14002dce2
mov ebx, dword [r12 + 0x10]
add rbx, r13
mov rsi, rbx
mov rax, qword [rbx]
test rax, rax
je 0x14002dd1d
sub rsi, rbx
nop dword [rax]
mov r8, qword [rdi + 0x40]
mov rcx, rbp
movzx edx, ax
test r15, rax
jne 0x14002dd04
lea rdx, [rax + r13 + 2]
call qword [rdi + 0x30]
mov qword [rsi + rbx], rax
test rax, rax
je 0x14002dd3a
mov rax, qword [rbx + 8]
add rbx, 8
test rax, rax
jne 0x14002dcf0
add r12, 0x14
mov edx, reloc.OLEAUT32.dll_SafeArrayLock
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x14002dd75
xor esi, esi
jmp 0x14002dc60
mov rdx, qword [rdi + 0x40]
xor r15d, r15d
mov rcx, rbp
mov r14d, r15d
call qword [rdi + reloc.WSOCK32.dll_getservbyport]
lea ecx, [r15 + 0x7f]
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14002dd75
mov rdx, qword [rdi + 0x40]
mov rcx, rbp
call qword [rdi + reloc.WSOCK32.dll_getservbyport]
mov ecx, recv
jmp 0x14002dd6c
mov ecx, 0x7e
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r14d, esi
mov rbp, qword [rsp + 0x1a0]
mov r8, qword [0x140143f90]
mov r15, qword [rsp + 0x190]
mov r12, qword [rsp + 0x198]
mov rbx, qword [rsp + 0x1e0]
test r8, r8
je 0x14002ddb3
mov rdx, qword [rsp + 0x1d8]
test rdx, rdx
je 0x14002ddb3
xor ecx, ecx
call r8
mov eax, r14d
add rsp, 0x1a8
pop r14
pop r13
pop rdi
pop rsi
ret