Function at 0x4c87c0
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x4c8a23
sub rsp, 0xb0
mov qword [rsp + 0xa8], rbp
lea rbp, [rsp + 0xa8]
test rax, rax
je 0x4c8a07
mov qword [rsp + 0xb8], rax
mov rbx, qword [rax + 8]
mov rdx, qword [rax]
mov rcx, qword [rax + 0x10]
test rbx, rbx
jne 0x4c880d
xor ebx, ebx
xor ecx, ecx
jmp 0x4c8820
mov rax, rdx
call fcn.004b9ec0
mov rcx, rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x48], rbx
cmp qword [rax + 0x28], 0
je 0x4c893b
mov rcx, qword [rax + 0x18]
mov rax, rcx
nop
call fcn.0045fb00
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x58], rbx
mov rcx, qword [rsp + 0xb8]
mov r8, qword [rcx + 0x20]
mov r9, qword [rcx + 0x28]
mov rcx, qword [rsp + 0x48]
lea rdi, str.____._05:__CLMPSZ__t_hms______0s2553:_::__CcCfCoCsLlLmLoLtLuMcMeMnNdNlNoPcPdPePfPiPoPsScSkSmSoYiZlZpZs__n___:idipmsnsus0001030405060708091011121314_01_02_03_04_05_06_08_09_11_12...125625:_d::1___ADTASTBSTCATCDTCETCSTDltEATEDTEETEOFESTGMTHDTHSTHanIDTISTJSTKSTLaoMDTMSKMSTMayMroNDTNSTNULNaNNkoPDTPKTPSTStdTTLUTCVaiWAT_adxaesavxcgodirdnsfinfmaftpintip4ip6mapobjptrsetsshtcpudpss__r_t_n_is__on____Inf_Inf3125::_0ACDTACSTAEDTAESTAKDTAKSTAWSTAhomCESTChamDashEESTGOGCJulyJuneLEAFLisuMiaoModiNZDTNZSTNameNewaSASTStatThaiTypeallgallpavx2basebindbitsbmi1bmi2boolcallcas1cas2cas3cas4cas5cas6chandialermsfileftpsfunchttpicmpigmpint8itabkindopenpipepop3readrootsmtpsse3tcp4tcp6trueudp4uintunix033004300530054506300845103012451345_09301562578125::_96_nil_AdlamAprilBamumBatakBuhidClassDograErrorGreekKhmerLatinLimbuLocalMarchNushuOghamOriyaOsageRunicSTermTakriTamilTypeAarrayclosedeferfalsefaultfilesgFreegcinggscanhchanhostshttpsimap2imap3imapsint16int32int64mheapntohspanicpop3sschedsleepslicesse41sse42ssse3sudogsweeptraceuint8usagewrite_Value__not___val_.local.onion390625__chanAnswerArabicAugustBrahmiCarianChakmaCommonCopticFormatFridayGetACPGothicHangulHatranHebrewHyphenKaithiKhojkiLengthLepchaLycianLydianMondayRejangStringSundaySyriacTai_LeTangutTeluguThaanaTypeMXTypeNSUTC12UTC13UTC_02UTC_08UTC_09UTC_11WanchoYezidi__byteacceptchan__domaingopherheaderinternipnetlistennetdnsobjectpopcntrdtscpreturnselectsocketstringstructsysmontelnettimersuint16uint32uint64_Value_0.0.0.019531259765625::1_128AvestanBengaliBrailleChanDirCopySidCypriotDeseretElbasanElymaicGODEBUGGranthaHanunooIO_waitJanuaryKannadaMUI_DltMUI_StdMakasarMandaicMarchenMultaniMyanmarOctoberOsmanyaRadicalSharadaShavianSiddhamSinhalaSogdianSoyomboTagalogTibetanTirhutaTuesdayTypeALLTypeOPTTypePTRTypeSOATypeSRVTypeTXTTypeWKSUNKNOWNWSARecvWSASendanswersconnectconsolecpuproffloat32float64forcegcgatewayinvalidlookup_nil_keyuintptrunknownwindowswsarecvwsasend_is_not__pointer__Month_48828125AcceptExArmenianBalineseBopomofoBugineseCancelIoCherokeeClassANYCyrillicDecemberDuployanEthiopicExtenderFebruaryFullPathGeorgianGoStringGujaratiGurmukhiHiraganaJavaneseKatakanaKayah_LiLinear_ALinear_BMahajaniNovemberOl_ChikiPhags_PaQuestionReadFileSaturdayTagbanwaTai_ThamTai_VietThursdayTifinaghTypeAAAATypeAXFRUgariticWSAIoctl_::1_:53acceptexaddress_continuedeadlockfc00::_7invalid_no_anodepollDescreadfromrwmutexRrwmutexWscavengeshutdowntraceBufunixgramwsaioctl2001::_322002::_162441406253ffe::_16AuthorityBassa_VahBhaiksukiClassINETCuneiformDiacriticFindCloseHex_DigitInheritedInterfaceKhudawadiLocalFreeMalayalamMongolianMoveFileWNabataeanPalmyreneSamaritanSeptemberSundaneseTypeCNAMETypeHINFOTypeMINFOWSASendToWednesdayWriteFileatomicor8bad_indirbad_prunechan_sendcomplex64connectexctxt___0debugLockdns_filesfec0::_10files_dnsfuncargs_hchanLeafinterfaceinvalid_nipv6_icmplocalhostmSpanDeadmSpanFreentdll.dllpanicwaitpclmulqdqpreemptedprofBlockpsapi.dllquestionsreflect:_rwxrwxrwxstackpooltracebackwbufSpanswsasendto__netGo____Weekday_.localhost_dev_stdin_etc_hosts12207031256103515625AdditionalBad_varintCancelIoExChorasmianClassCHAOSClassCSNETCreateFileCreatePipeDeprecatedDevanagariDnsQuery_WGOMAXPROCSGOMEMLIMITGetIfEntryGetVersionGlagoliticKharoshthiLockFileExManichaeanOld_ItalicOld_PermicOld_TurkicOther_MathPhoenicianSaurashtraWSACleanupWSASocketWWSAStartupatomicand8complex128debug_calldnsapi.dllexitThreadfloat32nanfloat64nangetsockoptmSpanInUsenotifyListowner_diedprofInsertsemacquiresetsockoptskipping:_stackLarget.Kind__ticks.lockunixpacketunknown_pcws2_32.dll.WithCancel_dev_stderr_dev_stdout30517578125ClassHESIODCloseHandleCreateFileWDeleteFileWDives_AkuruExitProcessFreeLibraryGetFileTypeIdeographicMedefaidrinMoveFileExWNandinagariNetShareAddNetShareDelNew_Tai_LueOld_PersianOld_SogdianOpenProcessPau_Cin_HauRegCloseKeySetFileTimeSignWritingSoft_DottedUDP_timeoutVirtualLockWSARecvFromWarang_CitiWhite_SpaceadditionalsassistQueueauthoritiesbad_addressbad_argSizebad_m_valuebad_messagebad_timedivbroken_pipecgocall_nilclosesocketconnect:__scrypt32.dllfile_existsfinal_tokenfloat32
mov esi, 1
lea rax, [rsp + 0x68]
mov rbx, qword [rsp + 0x88]
call fcn.004450a0
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call fcn.00402680
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
nop
jl 0x4c88fe
xor eax, eax
lea rbx, [0x00500489]
mov ecx, 1
mov rdi, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0x60]
lea r8, [0x005004e4]
mov r9d, 2
mov r10, qword [rsp + 0x98]
mov r11, qword [rsp + 0x58]
call fcn.00445180
jmp 0x4c892b
xor eax, eax
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x60]
lea rdi, [0x00500480]
mov esi, 1
mov r8, qword [rsp + 0x98]
mov r9, qword [rsp + 0x58]
call fcn.004450a0
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov rax, qword [rax + 0x18]
nop
call fcn.0045fb00
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x50], rbx
mov rcx, qword [rsp + 0x88]
mov qword [rsp], rcx
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 8], rdx
mov byte [rsp + 0x10], 0x3a
call fcn.00402680
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x4c89ca
xor eax, eax
lea rbx, [0x00500489]
mov ecx, 1
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x48]
lea r8, [0x005004e4]
mov r9d, 2
mov r10, qword [rsp + 0x90]
mov r11, qword [rsp + 0x50]
call fcn.00445180
jmp 0x4c89f7
xor eax, eax
mov rbx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x00500480]
mov esi, 1
mov r8, qword [rsp + 0x90]
mov r9, qword [rsp + 0x50]
call fcn.004450a0
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
lea rax, [0x00500775]
mov ebx, 5
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov qword [rsp + 8], rax
call fcn.00454b20
mov rax, qword [rsp + 8]
jmp fcn.004c87c0