Function at 0x14002d160
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x40
mov rbp, rdx
mov r12, rcx
xor edx, edx
mov r8d, edx
mov esi, edx
lea rax, [rbp - 1]
cmp rax, 0x3e
jbe 0x14002d1ae
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14002d7eb
test rbp, rbp
je 0x14002d1c7
movsxd rax, dword [rcx + 0x3c]
add rax, 0x108
cmp rbp, rax
jae 0x14002d1c7
mov ecx, ntohs
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add rsp, 0x40
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
movsxd r13, dword [rcx + 0x3c]
add r13, r12
mov qword [rsp + 0x88], r13
cmp dword [r13], 0x4550
jne 0x14002d7eb
mov eax, 0x8664
cmp word [r13 + 4], ax
jne 0x14002d7eb
mov eax, dword [r13 + 0x38]
test al, 1
jne 0x14002d7eb
movzx ecx, word [r13 + 0x14]
mov r10d, eax
movzx eax, word [r13 + 6]
add rcx, 0x24
cmp dx, ax
jae 0x14002d245
add rcx, r13
movzx r9d, ax
nop dword [rax]
mov eax, dword [rcx + 4]
mov edx, dword [rcx]
test eax, eax
jne 0x14002d22f
lea rax, [r10 + rdx]
jmp 0x14002d231
add eax, edx
cmp rax, r8
cmovbe rax, r8
add rcx, 0x28
mov r8, rax
sub r9, 1
jne 0x14002d220
mov edi, dword [r13 + 0x50]
lea rcx, [r10 - 1]
dec rdi
lea rax, [r10 - 1]
add rdi, r10
not rcx
add rax, r8
and rdi, rcx
and rax, rcx
cmp rdi, rax
jne 0x14002d7eb
mov rcx, qword [r13 + 0x30]
mov r9d, 4
mov r8d, 0x3000
mov qword [rsp + 0x30], r15
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
test rax, rax
jne 0x14002d2cb
lea r9d, [rax + 4]
mov r8d, 0x3000
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
test rax, rax
jne 0x14002d2cb
lea ecx, [rax + 0xe]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r15, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x40
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov qword [rsp + 0x78], rbx
lea rcx, [r15 + rdi]
mov qword [rsp + 0x38], r14
mov rax, r15
movabs r14, 0xffffffff00000000
and rcx, r14
and rax, r14
cmp rax, rcx
jae 0x14002d33f
mov ecx, reloc.WSOCK32.dll_recv
call fcn.1400dc214
mov rbx, rax
test rax, rax
je 0x14002d35f
mov qword [rax], rsi
mov r9d, 4
mov r8d, 0x3000
mov qword [rax + 8], r15
mov rdx, rdi
xor ecx, ecx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
test rax, rax
je 0x14002d3af
lea rcx, [rax + rdi]
and rax, r14
and rcx, r14
cmp rax, rcx
jb 0x14002d2f1
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 0x78]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r14, rax
test rax, rax
jne 0x14002d3b4
xor edx, edx
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, rsi
mov r8, qword [rsp + 0xa8]
lea rdx, [0x14002d0e0]
call fcn.14002c9e0
mov ecx, ntohs
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov r14, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x78]
mov r15, qword [rsp + 0x30]
add rsp, 0x40
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rcx, rbx
jmp 0x14002d373
mov edx, 8
xor r8d, r8d
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_HeapCreate]
mov qword [r14 + 0x18], rax
mov qword [r14], r15
movzx eax, word [r13 + 0x16]
shr eax, 0xd
and eax, 1
mov dword [r14 + 0x28], eax
lea rax, [0x14002d0d0]
mov qword [r14 + 0x30], rax
lea rax, [0x14002d0e0]
mov qword [r14 + 0x38], rax
mov rax, qword [rsp + 0x90]
mov qword [r14 + 0x40], rax
mov rax, qword [rsp + 0x98]
mov qword [r14 + 0x48], rax
mov rax, qword [rsp + 0xa0]
mov qword [r14 + 0x50], rax
mov rax, qword [rsp + 0xa8]
mov qword [r14 + 0x60], rax
mov eax, dword [r13 + 0x38]
mov dword [r14 + 0x70], eax
mov qword [r14 + 0x78], rsi
test rbp, rbp
je 0x14002d452
mov eax, dword [r13 + 0x54]
cmp rbp, rax
jae 0x14002d452
mov ecx, ntohs
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, r14
call fcn.14002d9b0
jmp 0x14002d392
mov edx, dword [r13 + 0x54]
mov r9d, 4
mov r8d, 0x1000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [r13 + 0x54]
mov rdx, r12
mov rcx, rax
mov rbx, rax
call fcn.1400d8380
movsxd rax, dword [r12 + 0x3c]
add rax, rbx
mov qword [r14 + 8], rax
mov qword [rax + 0x30], r15
xor eax, eax
mov rcx, qword [r14 + 8]
mov r12d, eax
mov rsi, qword [r14]
movzx edi, word [rcx + 0x14]
add rdi, 0x24
cmp ax, word [rcx + 6]
jae 0x14002d577
add rdi, rcx
nop
mov ecx, dword [rdi + 4]
test ecx, ecx
jne 0x14002d504
movsxd rax, dword [r13 + 0x38]
test eax, eax
jle 0x14002d55d
mov ecx, dword [rdi]
mov rbx, rax
mov rax, qword [r14 + 0x60]
add rcx, rsi
mov rdx, rbx
mov qword [rsp + 0x20], rax
mov r9d, 4
mov r8d, 0x1000
call qword [r14 + gethostbyaddr]
test rax, rax
je 0x14002d445
mov ecx, dword [rdi]
mov r8, rbx
add rcx, rsi
xor edx, edx
mov dword [rdi - 4], ecx
call fcn.1400d8190
jmp 0x14002d55d
test rbp, rbp
je 0x14002d517
mov eax, dword [rdi + 8]
add eax, ecx
cmp rbp, rax
jb 0x14002d43a
mov rax, qword [r14 + 0x60]
mov rdx, rcx
mov ecx, dword [rdi]
mov r9d, 4
add rcx, rsi
mov qword [rsp + 0x20], rax
mov r8d, 0x1000
call qword [r14 + gethostbyaddr]
test rax, rax
je 0x14002d445
mov ebx, dword [rdi]
mov edx, dword [rdi + 8]
add rbx, rsi
mov r8d, dword [rdi + 4]
mov rcx, rbx
add rdx, qword [rsp + 0x70]
call fcn.1400d8380
mov dword [rdi - 4], ebx
mov rcx, qword [r14 + 8]
inc r12d
add rdi, 0x28
movzx eax, word [rcx + 6]
cmp r12d, eax
jl 0x14002d4b0
xor eax, eax
mov rbp, qword [rcx + 0x30]
sub rbp, qword [r13 + 0x30]
je 0x14002d637
cmp dword [rcx + 0xb4], 0
je 0x14002d63c
mov r12, qword [r14]
mov esi, dword [rcx + 0xb0]
add rsi, r12
mov eax, dword [rsi]
test eax, eax
je 0x14002d637
xor r13d, r13d
nop dword [rax + rax]
mov edi, eax
lea rdx, [rsi + 8]
mov eax, dword [rsi + 4]
add rdi, r12
sub rax, 8
mov r8d, r13d
test rax, 0xfffffffffffffffe
jbe 0x14002d60a
nop dword [rax + rax]
movzx eax, word [rdx]
mov ecx, eax
shr eax, 0xc
and ecx, 0xfff
cmp eax, 3
je 0x14002d5ee
cmp eax, 0xa
jne 0x14002d5f1
add qword [rcx + rdi], rbp
jmp 0x14002d5f1
add dword [rcx + rdi], ebp
mov ecx, dword [rsi + 4]
inc r8d
sub rcx, 8
mov eax, r8d
shr rcx, 1
add rdx, 2
cmp rax, rcx
jb 0x14002d5d0
mov ebx, dword [r14 + 0x70]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8d, ebx
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov eax, dword [rsi + 4]
add rsi, rax
mov eax, dword [rsi]
test eax, eax
jne 0x14002d5b0
mov r13, qword [rsp + 0x88]
mov eax, 1
mov rcx, r14
mov dword [r14 + 0x2c], eax
call fcn.14002cd30
test eax, eax
je 0x14002d445
mov rax, qword [r14 + 8]
mov r8, qword [r14]
mov ecx, dword [rax + 0xa0]
mov edx, dword [rax + 0xa4]
add rcx, r8
movabs rax, 0xaaaaaaaaaaaaaaab
mul rdx
shr rdx, 3
call qword [sym.imp.KERNEL32.dll_RtlAddFunctionTable]
test al, al
je 0x14002d445
mov rcx, r14
call fcn.14002cb20
test eax, eax
je 0x14002d445
mov rax, qword [0x140142818]
cmp qword [r13 + 0x30], rax
je 0x14002d6e9
mov rax, qword [r14 + 8]
mov ecx, dword [rax + 0xd0]
test ecx, ecx
je 0x14002d6e9
mov rdi, qword [r14]
mov rbx, qword [rcx + rdi + 0x18]
test rbx, rbx
je 0x14002d6e9
mov rax, qword [rbx]
test rax, rax
je 0x14002d6e9
nop word [rax + rax]
xor r8d, r8d
mov rcx, rdi
lea edx, [r8 + 1]
call rax
mov rax, qword [rbx + 8]
lea rbx, [rbx + 8]
test rax, rax
jne 0x14002d6d0
mov rdx, qword [r14 + 8]
mov ebx, dword [rdx + 0x28]
test ebx, ebx
je 0x14002d7db
cmp dword [r14 + 0x28], 0
je 0x14002d7cb
cmp byte [rsp + 0xb0], 0
je 0x14002d7bb
mov rax, qword gs:[0x60]
mov rcx, qword [r14]
mov qword [0x1401437d0], rcx
mov rdi, qword [rax + 0x110]
mov eax, dword [rdx + 0x50]
add rax, rcx
mov rcx, rdi
mov qword [0x1401437c8], rax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [0x1401036a8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [0x14011aef8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor r8d, r8d
lea rdx, [0x14002c980]
mov rcx, rax
call sym.AutoHotkey.exe_MinHookEnable
mov qword [0x1401437c0], rax
mov r8, r14
lea rax, [r15 + rbx]
mov edx, 1
mov rcx, r15
call rax
mov rcx, qword [0x1401437c0]
mov ebx, eax
call sym.AutoHotkey.exe_MinHookDisable
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test ebx, ebx
jne 0x14002d7bb
mov ecx, 0x45a
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, r14
call fcn.14002d9b0
jmp 0x14002d392
mov dword [r14 + 0x24], 1
mov rax, r14
jmp 0x14002d394
lea rax, [r15 + rbx]
mov qword [r14 + 0x68], rax
mov rax, r14
jmp 0x14002d394
mov qword [r14 + 0x68], 0
mov rax, r14
jmp 0x14002d394
mov ecx, 0xc1
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add rsp, 0x40
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret