Function at 0x140026980
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x40
mov rbp, rdx
mov r12, rcx
xor edx, edx
mov r8d, edx
mov esi, edx
lea rax, [rbp - 1]
cmp rax, 0x3e
jbe 0x1400269ce
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14002700b
test rbp, rbp
je 0x1400269e7
movsxd rax, dword [rcx + 0x3c]
add rax, 0x108
cmp rbp, rax
jae 0x1400269e7
mov ecx, SafeArrayDestroy
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add rsp, 0x40
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
movsxd r13, dword [rcx + 0x3c]
add r13, r12
mov qword [rsp + 0x88], r13
cmp dword [r13], 0x4550
jne 0x14002700b
mov eax, 0x8664
cmp word [r13 + 4], ax
jne 0x14002700b
mov eax, dword [r13 + 0x38]
test al, 1
jne 0x14002700b
movzx ecx, word [r13 + 0x14]
mov r10d, eax
movzx eax, word [r13 + 6]
add rcx, 0x24
cmp dx, ax
jae 0x140026a65
add rcx, r13
mov r9d, eax
nop dword [rax]
mov eax, dword [rcx + 4]
mov edx, dword [rcx]
test eax, eax
jne 0x140026a4f
lea rax, [r10 + rdx]
jmp 0x140026a51
add eax, edx
cmp rax, r8
cmovbe rax, r8
add rcx, 0x28
mov r8, rax
sub r9, 1
jne 0x140026a40
mov edi, dword [r13 + 0x50]
lea rcx, [r10 - 1]
dec rdi
lea rax, [r10 - 1]
add rdi, r10
not rcx
add rax, r8
and rdi, rcx
and rax, rcx
cmp rdi, rax
jne 0x14002700b
mov rcx, qword [r13 + 0x30]
mov r9d, 4
mov r8d, 0x3000
mov qword [rsp + 0x30], r15
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
test rax, rax
jne 0x140026aeb
lea r9d, [rax + 4]
mov r8d, 0x3000
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
test rax, rax
jne 0x140026aeb
lea ecx, [rax + 0xe]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r15, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x40
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov qword [rsp + 0x78], rbx
lea rcx, [r15 + rdi]
mov qword [rsp + 0x38], r14
mov rax, r15
movabs r14, 0xffffffff00000000
and rcx, r14
and rax, r14
cmp rax, rcx
jae 0x140026b60
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
je 0x140026b80
mov qword [rax], rsi
mov r9d, 4
mov r8d, 0x3000
mov qword [rax + 8], r15
mov rdx, rdi
xor ecx, ecx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
test rax, rax
je 0x140026bd0
lea rcx, [rax + rdi]
and rax, r14
and rcx, r14
cmp rax, rcx
jb 0x140026b11
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 0x78]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r14, rax
test rax, rax
jne 0x140026bd5
xor edx, edx
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, rsi
mov r8, qword [rsp + 0xa8]
lea rdx, [0x140026940]
call fcn.1400262a0
mov ecx, SafeArrayDestroy
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov r14, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x78]
mov r15, qword [rsp + 0x30]
add rsp, 0x40
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rcx, rbx
jmp 0x140026b94
mov edx, 8
xor r8d, r8d
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_HeapCreate]
mov qword [r14 + 0x18], rax
mov qword [r14], r15
movzx eax, word [r13 + 0x16]
shr eax, 0xd
and eax, 1
mov dword [r14 + 0x28], eax
lea rax, [0x140026930]
mov qword [r14 + 0x30], rax
lea rax, [0x140026940]
mov qword [r14 + 0x38], rax
mov rax, qword [rsp + 0x90]
mov qword [r14 + 0x40], rax
mov rax, qword [rsp + 0x98]
mov qword [r14 + 0x48], rax
mov rax, qword [rsp + 0xa0]
mov qword [r14 + 0x50], rax
mov rax, qword [rsp + 0xa8]
mov qword [r14 + 0x60], rax
mov eax, dword [r13 + 0x38]
mov dword [r14 + 0x70], eax
mov qword [r14 + 0x78], rsi
test rbp, rbp
je 0x140026c73
mov eax, dword [r13 + 0x54]
cmp rbp, rax
jae 0x140026c73
mov ecx, SafeArrayDestroy
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, r14
call fcn.1400271d0
jmp 0x140026bb3
mov edx, dword [r13 + 0x54]
mov r9d, 4
mov r8d, 0x1000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [r13 + 0x54]
mov rdx, r12
mov rcx, rax
mov rbx, rax
call sub.VCRUNTIME140.dll_memcpy
movsxd rax, dword [r12 + 0x3c]
add rax, rbx
mov qword [r14 + 8], rax
mov qword [rax + 0x30], r15
xor eax, eax
mov rcx, qword [r14 + 8]
mov r12d, eax
mov rsi, qword [r14]
movzx edi, word [rcx + 0x14]
add rdi, 0x24
cmp ax, word [rcx + 6]
jae 0x140026d97
add rdi, rcx
nop
mov ecx, dword [rdi + 4]
test ecx, ecx
jne 0x140026d24
movsxd rax, dword [r13 + 0x38]
test eax, eax
jle 0x140026d7d
mov ecx, dword [rdi]
mov rbx, rax
mov rax, qword [r14 + 0x60]
add rcx, rsi
mov rdx, rbx
mov qword [rsp + 0x20], rax
mov r9d, 4
mov r8d, 0x1000
call qword [r14 + 0x30]
test rax, rax
je 0x140026c66
mov ecx, dword [rdi]
mov r8, rbx
add rcx, rsi
xor edx, edx
mov dword [rdi - 4], ecx
call sub.VCRUNTIME140.dll_memset
jmp 0x140026d7d
test rbp, rbp
je 0x140026d37
mov eax, dword [rdi + 8]
add eax, ecx
cmp rbp, rax
jb 0x140026c5b
mov rax, qword [r14 + 0x60]
mov rdx, rcx
mov ecx, dword [rdi]
mov r9d, 4
add rcx, rsi
mov qword [rsp + 0x20], rax
mov r8d, 0x1000
call qword [r14 + 0x30]
test rax, rax
je 0x140026c66
mov ebx, dword [rdi]
mov edx, dword [rdi + 8]
add rbx, rsi
mov r8d, dword [rdi + 4]
mov rcx, rbx
add rdx, qword [rsp + 0x70]
call sub.VCRUNTIME140.dll_memcpy
mov dword [rdi - 4], ebx
mov rcx, qword [r14 + 8]
inc r12d
add rdi, 0x28
movzx eax, word [rcx + 6]
cmp r12d, eax
jl 0x140026cd0
xor eax, eax
mov rbp, qword [rcx + 0x30]
sub rbp, qword [r13 + 0x30]
je 0x140026e57
cmp dword [rcx + 0xb4], 0
je 0x140026e5c
mov r12, qword [r14]
mov esi, dword [rcx + 0xb0]
add rsi, r12
mov eax, dword [rsi]
test eax, eax
je 0x140026e57
xor r13d, r13d
nop dword [rax + rax]
mov edi, eax
lea rdx, [rsi + 8]
mov eax, dword [rsi + 4]
add rdi, r12
sub rax, 8
mov r8d, r13d
test rax, 0xfffffffffffffffe
jbe 0x140026e2a
nop dword [rax + rax]
movzx eax, word [rdx]
mov ecx, eax
shr eax, 0xc
and ecx, 0xfff
cmp eax, 3
je 0x140026e0e
cmp eax, 0xa
jne 0x140026e11
add qword [rcx + rdi], rbp
jmp 0x140026e11
add dword [rcx + rdi], ebp
mov ecx, dword [rsi + 4]
inc r8d
sub rcx, 8
mov eax, r8d
shr rcx, 1
add rdx, 2
cmp rax, rcx
jb 0x140026df0
mov ebx, dword [r14 + 0x70]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8d, ebx
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov eax, dword [rsi + 4]
add rsi, rax
mov eax, dword [rsi]
test eax, eax
jne 0x140026dd0
mov r13, qword [rsp + 0x88]
mov eax, 1
mov rcx, r14
mov dword [r14 + 0x2c], eax
call fcn.140026590
test eax, eax
je 0x140026c66
mov rax, qword [r14 + 8]
mov r8, qword [r14]
mov ecx, dword [rax + 0xa0]
mov edx, dword [rax + 0xa4]
add rcx, r8
movabs rax, 0xaaaaaaaaaaaaaaab
mul rdx
shr rdx, 3
call qword [sym.imp.KERNEL32.dll_RtlAddFunctionTable]
test al, al
je 0x140026c66
mov rcx, r14
call fcn.140026310
test eax, eax
je 0x140026c66
mov rax, qword [0x140115790]
cmp qword [r13 + 0x30], rax
je 0x140026f09
mov rax, qword [r14 + 8]
mov ecx, dword [rax + 0xd0]
test ecx, ecx
je 0x140026f09
mov rdi, qword [r14]
mov rbx, qword [rcx + rdi + 0x18]
test rbx, rbx
je 0x140026f09
mov rax, qword [rbx]
test rax, rax
je 0x140026f09
nop word [rax + rax]
xor r8d, r8d
mov rcx, rdi
lea edx, [r8 + 1]
call rax
mov rax, qword [rbx + 8]
lea rbx, [rbx + 8]
test rax, rax
jne 0x140026ef0
mov rdx, qword [r14 + 8]
mov ebx, dword [rdx + 0x28]
test ebx, ebx
je 0x140026ffb
cmp dword [r14 + 0x28], 0
je 0x140026feb
cmp byte [rsp + 0xb0], 0
je 0x140026fdb
mov rax, qword gs:[0x60]
mov rcx, qword [r14]
mov qword [0x140116700], rcx
mov rdi, qword [rax + 0x110]
mov eax, dword [rdx + 0x50]
add rax, rcx
mov rcx, rdi
mov qword [0x1401166f8], rax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [0x1400e0708]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.RtlPcToFileHeader
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor r8d, r8d
lea rdx, [0x140026240]
mov rcx, rax
call sym.AutoHotkeySC.bin_MinHookEnable
mov qword [0x1401166f0], rax
mov r8, r14
lea rax, [r15 + rbx]
mov edx, 1
mov rcx, r15
call rax
mov rcx, qword [0x1401166f0]
mov ebx, eax
call sym.AutoHotkeySC.bin_MinHookDisable
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test ebx, ebx
jne 0x140026fdb
mov ecx, 0x45a
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, r14
call fcn.1400271d0
jmp 0x140026bb3
mov dword [r14 + 0x24], 1
mov rax, r14
jmp 0x140026bb5
lea rax, [r15 + rbx]
mov qword [r14 + 0x68], rax
mov rax, r14
jmp 0x140026bb5
mov qword [r14 + 0x68], 0
mov rax, r14
jmp 0x140026bb5
mov ecx, 0xc1
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add rsp, 0x40
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret