Function at 0x1400bd240
Capabilities:
Allocate or change rwx memory
Get common file path

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3b0]
sub rsp, 0x4b0
mov qword [rbp - 0x78], 0xfffffffffffffffe
mov qword [rsp + 0x4f8], rbx
mov r12, rdx
mov rdi, rcx
movzx eax, word [rdi]
cmp ax, 0x20
je 0x1400bd280
cmp ax, 9
jne 0x1400bd286
add rdi, 2
jmp 0x1400bd271
mov r15d, 0x2c
mov edx, r15d
call qword [sym.imp.VCRUNTIME140.dll_wcschr]
mov rbx, rax
test rax, rax
je 0x1400bdd7f
cmp word [rax], 0
je 0x1400bdd7f
add rbx, 2
mov edx, r15d
mov rcx, rdi
call qword [sym.imp.VCRUNTIME140.dll_wcschr]
xor r13d, r13d
test rax, rax
je 0x1400bd2d3
mov edx, r15d
mov rcx, rdi
call qword [sym.imp.VCRUNTIME140.dll_wcschr]
mov word [rax], r13w
movzx eax, word [rbx]
test ax, ax
je 0x1400bd32b
mov rdx, rbx
nop
cmp ax, 0x20
je 0x1400bd2ec
cmp ax, 9
jne 0x1400bd2f5
add rdx, 2
movzx eax, word [rdx]
jmp 0x1400bd2e0
mov rax, rdx
sub rax, rbx
cmp rax, 2
jb 0x1400bd32b
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
lea r8, [r8 + 1]
cmp word [rdx + r8*2], r13w
jne 0x1400bd310
lea r8, [r8*2 + 2]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, 0xffffffffffffffff
inc r8
cmp word [rdi + r8*2], r13w
jne 0x1400bd332
lea r9, [rbp + 0x3f0]
mov rdx, rdi
lea rcx, [0x140116fb0]
call fcn.1400463f0
test rax, rax
je 0x1400bd366
mov r8, rdi
lea rdx, str.Duplicate_function_definition.
jmp 0x1400bdd89
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rdi + r8*2], r13w
jne 0x1400bd370
mov qword [rsp + 0x28], r13
mov eax, dword [rbp + 0x3f0]
mov dword [rsp + 0x20], eax
xor r9d, r9d
mov rdx, rdi
lea rcx, [0x140116fb0]
call fcn.140047d50
mov qword [rsp + 0x70], rax
test rax, rax
je 0x1400bdd95
lea rcx, [0x140074b90]
mov qword [rax + 0x10], rcx
mov byte [rax + 0x79], 1
mov dword [rax + 0x24], r13d
mov rax, rbx
sub rax, r12
sar rax, 1
mov esi, 0x4001
sub rsi, rax
lea rdx, str._A_ScriptDir_
mov rcx, rbx
call fcn.1400ba7d0
mov r14d, 1
mov dword [rbp + 0x400], r14d
test rax, rax
je 0x1400bd43d
mov rcx, qword [0x140117b68]
lea rdi, [rbp + 0x1a0]
sub rdi, rcx
nop
movzx eax, word [rcx]
mov word [rdi + rcx], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x1400bd400
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], r14d
xor r9d, r9d
lea r8, [rbp + 0x1a0]
lea rdx, str._A_ScriptDir_
mov rcx, rbx
call fcn.1400bac20
lea rdx, str._A_AppData_
mov rcx, rbx
call fcn.1400ba7d0
test rax, rax
je 0x1400bd4d3
mov edx, 2
lea ecx, [rdx + 0x3f]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__isctype]
lea rax, [rbp - 0x70]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x1a]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x1400bd487
mov word [rbp - 0x70], r13w
mov rcx, r13
nop word [rax + rax]
movzx eax, word [rbp + rcx - 0x70]
mov word [rbp + rcx + 0x1a0], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x1400bd490
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], r14d
xor r9d, r9d
lea r8, [rbp + 0x1a0]
lea rdx, str._A_AppData_
mov rcx, rbx
call fcn.1400bac20
lea rdx, str._A_AppDataCommon_
mov rcx, rbx
call fcn.1400ba7d0
test rax, rax
je 0x1400bd563
mov edx, 2
lea ecx, [rdx + 0x3f]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__isctype]
lea rax, [rbp - 0x70]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x23]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x1400bd519
mov word [rbp - 0x70], r13w
mov rcx, r13
nop dword [rax]
movzx eax, word [rbp + rcx - 0x70]
mov word [rbp + rcx + 0x1a0], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x1400bd520
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], r14d
xor r9d, r9d
lea r8, [rbp + 0x1a0]
lea rdx, str._A_AppDataCommon_
mov rcx, rbx
call fcn.1400bac20
lea rdx, str._A_AhkPath_
mov rcx, rbx
call fcn.1400ba7d0
test rax, rax
je 0x1400bd5d3
mov r8d, 0x104
lea rdx, [rbp - 0x70]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rcx, r13
nop dword [rax]
movzx eax, word [rbp + rcx - 0x70]
mov word [rbp + rcx + 0x1a0], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x1400bd590
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], r14d
xor r9d, r9d
lea r8, [rbp + 0x1a0]
lea rdx, str._A_AhkPath_
mov rcx, rbx
call fcn.1400bac20
lea rdx, str._A_AhkDir_
mov rcx, rbx
call fcn.1400ba7d0
mov edi, 0x5c
test rax, rax
je 0x1400bd666
mov r8d, 0x104
lea rdx, [rbp - 0x70]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edx, edi
lea rcx, [rbp - 0x70]
call qword [sym.imp.VCRUNTIME140.dll_wcsrchr]
mov rdi, rax
lea rax, [rbp - 0x70]
sub rdi, rax
sar rdi, 1
mov r8, rdi
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0x1a0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov word [rbp + rdi*2 + 0x1a0], r13w
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], r14d
xor r9d, r9d
lea r8, [rbp + 0x1a0]
lea rdx, str._A_AhkDir_
mov rcx, rbx
call fcn.1400bac20
mov edi, 0x5c
lea rdx, str._A_DllDir_
mov rcx, rbx
call fcn.1400ba7d0
test rax, rax
je 0x1400bd70e
mov r8d, 0x104
lea rdx, [rbp - 0x70]
mov rcx, qword [0x140113af8]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x1400bd6ab
mov r8d, 0x104
lea rdx, [rbp - 0x70]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edx, edi
lea rcx, [rbp - 0x70]
call qword [sym.imp.VCRUNTIME140.dll_wcsrchr]
mov rdi, rax
lea rax, [rbp - 0x70]
sub rdi, rax
sar rdi, 1
mov r8, rdi
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0x1a0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov word [rbp + rdi*2 + 0x1a0], r13w
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], r14d
xor r9d, r9d
lea r8, [rbp + 0x1a0]
lea rdx, str._A_DllDir_
mov rcx, rbx
call fcn.1400bac20
lea rdx, str._A_DllPath_
mov rcx, rbx
call fcn.1400ba7d0
test rax, rax
je 0x1400bd7a3
mov r8d, 0x104
lea rdx, [rbp - 0x70]
mov rcx, qword [0x140113af8]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, eax
test rax, rax
jne 0x1400bd756
mov r8d, 0x104
lea rdx, [rbp - 0x70]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rcx, r13
nop dword [rax]
movzx eax, word [rbp + rcx - 0x70]
mov word [rbp + rcx + 0x1a0], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x1400bd760
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], r14d
xor r9d, r9d
lea r8, [rbp + 0x1a0]
lea rdx, str._A_DllPath_
mov rcx, rbx
call fcn.1400bac20
mov edx, 0x25
mov rcx, rbx
call qword [sym.imp.VCRUNTIME140.dll_wcschr]
test rax, rax
je 0x1400bd7c5
mov r8, rbx
lea rdx, str.Reference_not_allowed_here__use__where_possible._Only__A_AhkPath___A_AhkDir___A_DllPath___A_DllDir___A_ScriptDir___A_AppData_Common___can_be_used_here.
jmp 0x1400bdd89
mov edx, r15d
mov rcx, rbx
call qword [sym.imp.VCRUNTIME140.dll_wcschr]
test rax, rax
je 0x1400bd7e6
mov edx, r15d
mov rcx, rbx
call qword [sym.imp.VCRUNTIME140.dll_wcschr]
mov word [rax], r13w
lea rdx, str._s_A_Fa_f0_9__:_A_Fa_f0_9____s_
mov rcx, rbx
call fcn.1400782e0
mov rcx, rbx
test rax, rax
je 0x1400bd925
mov qword [rbp + 0x408], 0x780030
mov edx, 0x3a
call qword [sym.imp.VCRUNTIME140.dll_wcschr]
test rax, rax
je 0x1400bd82e
mov edx, 0x3a
mov rcx, rbx
call qword [sym.imp.VCRUNTIME140.dll_wcschr]
lea rbx, [rax + 2]
mov edx, 0x3a
mov rcx, rbx
call qword [sym.imp.VCRUNTIME140.dll_wcschr]
test rax, rax
je 0x1400bd85a
mov edx, 0x3a
mov rcx, rbx
call qword [sym.imp.VCRUNTIME140.dll_wcschr]
mov rsi, rax
sub rsi, rbx
sar rsi, 1
jmp 0x1400bd86d
mov rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], r13w
jne 0x1400bd861
mov esi, eax
mov eax, esi
cdq
sub eax, edx
sar eax, 1
movsxd rdi, eax
mov rcx, rdi
call fcn.1400b7310
mov r15, rax
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x1400bd89b
mov r8, rbx
lea rdx, str.Out_of_memory.
jmp 0x1400bdd89
mov r9d, 0x40
mov r8d, 0x1000
mov rdx, rdi
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
jne 0x1400bd8c7
mov r8, rbx
lea rdx, str.Could_not_commit_memory_for_DllImport.
jmp 0x1400bdd89
mov edi, r13d
test esi, esi
jle 0x1400bd932
mov r14, rbx
nop dword [rax]
nop word [rax + rax]
mov r8d, 2
mov rdx, r14
lea rcx, [rbp + 0x40c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
xor edx, edx
lea r8d, [rdx + 0x10]
lea rcx, [rbp + 0x408]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstol]
mov ecx, edi
shr rcx, 1
mov byte [rcx + r15], al
add edi, 2
add r14, 4
cmp edi, esi
jl 0x1400bd8e0
mov r14d, 1
jmp 0x1400bd932
call fcn.140005710
mov r15, rax
mov qword [rsp + 0x40], rax
test r15, r15
jne 0x1400bd990
mov esi, 0x5c
mov edx, esi
mov rcx, rbx
call qword [sym.imp.VCRUNTIME140.dll_wcsrchr]
mov rdi, rax
test rax, rax
je 0x1400bd96d
mov word [rax], r13w
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jne 0x1400bd96a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov word [rdi], si
xor edx, edx
mov rcx, rbx
call fcn.1400730c0
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x1400bd990
mov r8, rbx
lea rdx, str.Call_to_nonexistent_function.
jmp 0x1400bdd89
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rbx + rax*2], r13w
jne 0x1400bd9a0
inc rax
lea rdi, [rbx + rax*2]
mov rdx, 0xffffffffffffffff
mov rcx, rdi
call fcn.1400b7260
mov rsi, rax
mov byte [rbp + 0x3f0], r13b
cmp word [rax], r13w
je 0x1400bd9df
mov rcx, rax
call fcn.14001c140
test eax, eax
mov r15d, r14d
je 0x1400bd9e2
mov r15d, r13d
cmp word [rsi], r13w
je 0x1400bda42
mov ebx, 0x2c
mov edx, ebx
mov rcx, rdi
call qword [sym.imp.VCRUNTIME140.dll_wcschr]
test rax, rax
je 0x1400bda2a
nop dword [rax]
mov edx, ebx
mov rcx, rdi
call qword [sym.imp.VCRUNTIME140.dll_wcschr]
mov rdi, rax
test rax, rax
je 0x1400bda17
add rdi, 2
inc r15d
mov edx, ebx
mov rcx, rdi
call qword [sym.imp.VCRUNTIME140.dll_wcschr]
test rax, rax
jne 0x1400bda00
cmp word [rsi], r13w
je 0x1400bda42
cmp r15d, 1
jge 0x1400bda42
lea rdx, str.Parameter_3_required
jmp 0x1400bdd86
mov ecx, reloc.WSOCK32.dll_recv
call fcn.1400b7310
mov r14, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x1400bdb40
mov qword [rax], r13
mov qword [rax + 8], r13
test r15b, 1
jne 0x1400bda76
mov dword [rax + 8], 2
jmp 0x1400bdb03
movzx eax, word [rdi]
cmp ax, 0x20
je 0x1400bda85
cmp ax, 9
jne 0x1400bda8b
add rdi, 2
jmp 0x1400bda76
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], r13
mov r8d, 5
lea rdx, str.CDecl
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne 0x1400bdadc
add rdi, 0xa
movzx eax, word [rdi]
cmp ax, 0x20
je 0x1400bdac2
cmp ax, 9
jne 0x1400bdac8
add rdi, 2
jmp 0x1400bdab3
mov qword [rsp + 0x50], rdi
test ax, ax
jne 0x1400bdadc
mov dword [r14 + 8], 2
jmp 0x1400bdb00
mov rdx, r14
lea rcx, [rsp + 0x50]
call fcn.140072970
cmp dword [r14 + 8], r13d
jne 0x1400bdaf9
mov eax, 4
jmp 0x1400bdd95
mov byte [rbp + 0x3f0], 1
dec r15d
mov eax, r15d
cdq
sub eax, edx
sar eax, 1
movsxd rbx, eax
je 0x1400bdb53
mov rdi, rbx
shl rdi, 4
mov rcx, rdi
call fcn.1400b7310
mov r12, rax
mov qword [rbp + 0x408], rax
mov rcx, rdi
call fcn.1400b7310
mov qword [rsp + 0x48], rax
test r12, r12
je 0x1400bdb40
test rax, rax
jne 0x1400bdb5f
lea r8, [0x1400da7a4]
lea rdx, str.Out_of_memory.
jmp 0x1400bdd89
mov qword [rbp + 0x408], r13
mov qword [rsp + 0x48], r13
lea edi, [rbx*8]
movsxd rbx, edi
mov rcx, rbx
call fcn.1400b7310
mov rdx, rax
mov qword [rsp + 0x68], rax
test edi, edi
je 0x1400bdb90
test rax, rax
je 0x1400bdb40
test edi, edi
je 0x1400bdb90
mov rdi, rax
xor eax, eax
mov rcx, rbx
rep stosb byte [rdi], al
cmp r15d, 1
jle 0x1400bdd30
xor r14d, r14d
mov qword [rbp - 0x80], r14
mov r12, rdx
mov rbx, qword [rbp + 0x408]
nop dword [rax + rax]
mov edx, 0x2c
mov rcx, rsi
call qword [sym.imp.VCRUNTIME140.dll_wcschr]
mov word [rax], r14w
lea rdi, [rax + 2]
mov qword [rsp + 0x78], rsi
mov rdx, rbx
lea rcx, [rsp + 0x78]
call fcn.140072970
mov eax, dword [rbx + 8]
test eax, eax
je 0x1400bdaef
cmp eax, 1
je 0x1400bdc6c
cmp eax, 5
jle 0x1400bdc37
cmp eax, 7
jle 0x1400bdc14
cmp eax, 8
jne 0x1400bdc37
mov rcx, rdi
call fcn.140005710
test rax, rax
jne 0x1400bdaef
mov qword [rbx], rdi
jmp 0x1400bdce3
mov rcx, rdi
call fcn.14002f9b0
movsd qword [rbx], xmm0
cmp dword [rbx + 8], 6
jne 0x1400bdce3
cvtsd2ss xmm0, xmm0
movss dword [rbx], xmm0
jmp 0x1400bdce3
cmp byte [rbx + 0xd], 0
je 0x1400bdc5f
cmp eax, 5
jne 0x1400bdc5f
mov rcx, rdi
call fcn.140005710
test rax, rax
jne 0x1400bdc5f
mov rcx, rdi
call fcn.140059440
mov qword [rbx], rax
jmp 0x1400bdce3
mov rcx, rdi
call fcn.140005710
mov qword [rbx], rax
jmp 0x1400bdce3
mov rcx, rdi
call fcn.140005710
test rax, rax
jne 0x1400bdaef
lea edx, [rax + 0x2c]
mov rcx, rdi
call qword [sym.imp.VCRUNTIME140.dll_wcschr]
mov r14, rax
test rax, rax
je 0x1400bdc97
xor eax, eax
mov word [r14], ax
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.1400d6cc4
mov qword [rsp + 0x50], rax
mov rdx, rdi
mov rcx, rax
call fcn.1400852e0
mov rsi, rax
mov qword [r12], rax
test r14, r14
je 0x1400bdcca
mov eax, 0x2c
mov word [r14], ax
mov rsi, qword [r12]
mov rcx, rsi
call fcn.14000e470
mov byte [rsi + 0x10], 1
mov rax, qword [rsi + 8]
mov rcx, qword [rax]
mov qword [rbx], rcx
xor r14d, r14d
mov edx, 0x2c
mov rcx, rdi
call qword [sym.imp.VCRUNTIME140.dll_wcschr]
mov rsi, rax
test rax, rax
je 0x1400bdd01
mov word [rax], r14w
add rsi, 2
inc r13d
add rbx, 0x10
add r12, 8
mov eax, dword [rbp + 0x400]
add eax, 2
mov dword [rbp + 0x400], eax
cmp eax, r15d
jl 0x1400bdbb0
mov r14, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x68]
jmp 0x1400bdd37
mov rdi, qword [rbp + 0x3f0]
cmp byte [rbp + 0x3f0], 0
je 0x1400bdd4a
test r15d, r15d
je 0x1400bdd4a
xor eax, eax
mov word [rdi], ax
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x70]
mov qword [rcx + 0x28], rax
mov dword [rcx + 0x20], r13d
mov qword [rcx + 0x38], r14
mov qword [rcx + 0x48], rdx
mov rax, qword [rbp + 0x408]
mov qword [rcx + 0x40], rax
mov rax, qword [rsp + 0x48]
mov qword [rcx + 0x18], rax
mov eax, 3
jmp 0x1400bdd95
lea rdx, str.Parameter_2_required
mov r8, r12
lea rcx, [0x140116fb0]
call fcn.140057630
mov rbx, qword [rsp + 0x4f8]
add rsp, 0x4b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret