Function at 0x4eca00
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x58]
cmp r12, qword [r14 + 0x10]
jbe 0x4ed019
push rbp
mov rbp, rsp
sub rsp, 0xd0
mov qword [rsp + 0x118], rbx
mov qword [rsp + 0x130], rsi
cmp qword [rax + 0x118], r8
jne 0x4ed005
mov rdx, qword [rax + 0x120]
nop
cmp rdx, 0xc
jl 0x4ecff0
mov r10, qword [rsp + 0xe8]
cmp r10, rdx
jl 0x4ecef8
movabs r11, 0xfffffffe0
add r11, rdx
cmp r10, r11
ja 0x4eceda
mov r11, r10
sub r10, rdx
nop word [rax + rax]
cmp r11, r10
jb 0x4ecfe5
mov qword [rsp + 0x110], rax
mov qword [rsp + 0x90], r10
mov qword [rsp + 0x128], rdi
mov qword [rsp + 0x120], rcx
mov qword [rsp + 0x118], rbx
movups xmmword [rsp + 0x80], xmm15
movups xmmword [rsp + 0x60], xmm15
mov rdx, qword [rsp + 0xf0]
mov r12, r10
sub r10, rdx
sar r10, 0x3f
and r10, r12
sub r11, r12
mov qword [rsp + 0xa0], r11
mov r13, qword [rsp + 0xe0]
add r10, r13
mov qword [rsp + 0xb8], r10
cmp r8, 0xc
jne 0x4ecb28
lea r8, [rsp + 0x80]
cmp rsi, r8
je 0x4ecb1b
mov r8, qword [rsi]
mov esi, dword [rsi + 8]
mov qword [rsp + 0x80], r8
mov dword [rsp + 0x88], esi
mov byte [rsp + 0x8f], 1
jmp 0x4ecc0f
mov qword [rsp + 0x138], r8
lea rcx, [rax + 0x18]
mov qword [rsp + 0xc8], rcx
mov qword [rsp], rcx
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], r8
mov qword [rsp + 0x18], r9
lea rdx, [rsp + 0x80]
mov qword [rsp + 0x20], rdx
nop dword [rax]
call sym.crypto_aes.gcmAesData.abi0
xorps xmm15, xmm15
mov r14, qword [0x009686c8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0xc8]
mov qword [rsp], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 8], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x138]
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], 0
call sym.crypto_aes.gcmAesFinish.abi0
xorps xmm15, xmm15
mov r14, qword [0x009686c8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x110]
mov rcx, qword [rsp + 0x120]
mov rdx, qword [rsp + 0xf0]
mov rbx, qword [rsp + 0x118]
mov rdi, qword [rsp + 0x128]
mov r10, qword [rsp + 0xb8]
mov r11, qword [rsp + 0xa0]
mov r12, qword [rsp + 0x90]
mov r13, qword [rsp + 0xe0]
mov rsi, qword [rax + 8]
test rsi, rsi
jbe 0x4ecfd8
mov rcx, qword [rax]
shr rsi, 2
lea rdx, [rsi - 1]
mov qword [rsp], rdx
mov qword [rsp + 8], rcx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x10], rcx
lea rcx, [rsp + 0x80]
mov qword [rsp + 0x18], rcx
call sym.crypto_aes.encryptBlockAsm.abi0
xorps xmm15, xmm15
mov r14, qword [0x009686c8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
movups xmmword [rsp + 0x70], xmm15
mov rax, qword [rsp + 0x110]
lea rcx, [rax + 0x18]
mov qword [rsp + 0xc8], rcx
mov qword [rsp], rcx
mov rdx, qword [rsp + 0xf8]
mov qword [rsp + 8], rdx
mov rdx, qword [rsp + 0x100]
mov qword [rsp + 0x10], rdx
mov rbx, qword [rsp + 0x108]
mov qword [rsp + 0x18], rbx
lea rbx, [rsp + 0x70]
mov qword [rsp + 0x20], rbx
call sym.crypto_aes.gcmAesData.abi0
xorps xmm15, xmm15
mov r14, qword [0x009686c8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x120]
lea rbx, [rcx + rax]
mov qword [rsp + 0x98], rbx
nop
mov rdx, qword [rsp + 0x128]
cmp rdx, rbx
jl 0x4eccfe
jb 0x4ecfd0
mov rsi, qword [rsp + 0x118]
jmp 0x4ecd30
lea rax, [0x00667ea0]
mov rdi, qword [rsp + 0x118]
call sym.runtime.makeslicecopy
mov rcx, qword [rsp + 0x120]
mov rbx, qword [rsp + 0x98]
mov rdx, rbx
mov rsi, rax
mov rax, qword [rsp + 0x90]
cmp rcx, rbx
ja 0x4ecfc5
mov rdi, rdx
sub rdx, rcx
mov r8, rdx
neg rdx
sar rdx, 0x3f
and rcx, rdx
add rcx, rsi
test rax, rax
jne 0x4ecd5e
mov rdx, qword [rsp + 0xe0]
jmp 0x4ecdaa
mov rdx, qword [rsp + 0xe0]
cmp rdx, rcx
jne 0x4ecd70
test rax, rax
jmp 0x4ecdaa
mov r9, rcx
lea r10, [rdx + rax]
lea r10, [r10 - 1]
nop
nop dword [rax]
cmp r10, rcx
jb 0x4ecda4
mov rcx, rdx
lea r10, [r9 + rax]
lea r10, [r10 - 1]
cmp r10, rdx
jae 0x4ecfaf
test rax, rax
mov rdx, rcx
mov rcx, r9
jmp 0x4ecdaa
test rax, rax
mov rcx, r9
mov qword [rsp + 0xa8], rdi
mov qword [rsp + 0xc0], rsi
mov qword [rsp + 0xb0], rcx
je 0x4ece52
mov rbx, qword [rsp + 0x110]
mov rsi, qword [rbx]
mov rdi, qword [rbx + 8]
mov r9, qword [rbx + 0x10]
mov r10, qword [rsp + 0xc8]
mov qword [rsp], r10
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rax
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rax
mov rdx, qword [rsp + 0xf0]
mov qword [rsp + 0x30], rdx
lea rdx, [rsp + 0x80]
mov qword [rsp + 0x38], rdx
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], r9
call sym.crypto_aes.gcmAesDec.abi0
xorps xmm15, xmm15
mov r14, qword [0x009686c8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x90]
mov rcx, qword [rsp + 0xc8]
mov qword [rsp], rcx
lea rcx, [rsp + 0x60]
mov qword [rsp + 8], rcx
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rax
mov rcx, qword [rsp + 0x100]
mov qword [rsp + 0x20], rcx
call sym.crypto_aes.gcmAesFinish.abi0
xorps xmm15, xmm15
mov r14, qword [0x009686c8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x110]
mov rcx, qword [rax + 0x120]
cmp rcx, 0x10
ja 0x4ecfa5
mov rdx, qword [rsp + 0xa0]
nop dword [rax]
cmp rcx, rdx
jne 0x4eced6
mov rdx, qword [rsp + 0xb8]
xor eax, eax
xor ebx, ebx
jmp 0x4ecf8d
xor eax, eax
jmp 0x4ecf16
mov rdi, qword [0x008d5540]
mov rsi, qword [0x008d5548]
xor eax, eax
xor ebx, ebx
mov rcx, rbx
add rsp, 0xd0
pop rbp
ret
mov rdi, qword [0x008d5540]
mov rsi, qword [0x008d5548]
xor eax, eax
xor ebx, ebx
mov rcx, rbx
add rsp, 0xd0
pop rbp
ret
cmp rax, 1
je 0x4ecf54
mov rbx, qword [rsp + 0x90]
test rbx, rbx
je 0x4ecf36
mov rax, qword [rsp + 0xb0]
call sym.runtime.memclrNoHeapPointers
mov rdi, qword [0x008d5540]
mov rsi, qword [0x008d5548]
xor eax, eax
xor ebx, ebx
mov rcx, rbx
add rsp, 0xd0
pop rbp
ret
mov rax, qword [rsp + 0xc0]
mov rbx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0xa8]
xor edi, edi
xor esi, esi
add rsp, 0xd0
pop rbp
ret
movzx r8d, byte [rsp + rax + 0x70]
movzx r9d, byte [rdx + rax]
xor r8d, r9d
inc rax
or ebx, r8d
cmp rax, rcx
jl 0x4ecf79
movzx eax, bl
dec eax
nop
shr eax, 0x1f
nop dword [rax + rax]
jmp 0x4ecf16
mov edx, 0x10
call sym.runtime.panicSliceAlen
lea rax, [0x00667e20]
lea rbx, [0x0073a190]
nop dword [rax]
call sym.runtime.gopanic
mov rax, rcx
mov rcx, rbx
call sym.runtime.panicSliceB
mov rcx, rbx
call sym.runtime.panicSliceAcap
xor eax, eax
mov rcx, rax
nop dword [rax]
call sym.runtime.panicIndex
mov rax, r10
mov rcx, r11
call sym.runtime.panicSliceB
lea rax, [0x00667e20]
lea rbx, [0x0073a1a0]
nop
call sym.runtime.gopanic
lea rax, [0x00667e20]
lea rbx, [0x0073a170]
call sym.runtime.gopanic
nop
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
nop dword [rax]
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov r8, qword [rsp + 0x60]
mov r9, qword [rsp + 0x68]
jmp sym.crypto_aes._gcmAsm_.Open