Function at 0x4bcc60
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x4bcea9
push rbp
mov rbp, rsp
sub rsp, 0xa8
nop word [rax + rax]
test rax, rax
je 0x4bce94
mov qword [rsp + 0xb8], rax
mov rbx, qword [rax + 8]
test rbx, rbx
jne 0x4bcca2
xor ebx, ebx
xor ecx, ecx
nop
jmp 0x4bccbc
mov rdx, qword [rax]
mov rcx, qword [rax + 0x10]
mov rax, rdx
call fcn.004afa40
mov rcx, rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x48], rbx
cmp qword [rax + 0x28], 0
je 0x4bcdd1
mov rcx, qword [rax + 0x18]
mov rax, rcx
nop dword [rax + rax]
call fcn.0047a400
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x58], rbx
mov rcx, qword [rsp + 0xb8]
mov r8, qword [rcx + 0x20]
mov r9, qword [rcx + 0x28]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x00540db0]
mov esi, 1
lea rax, [rsp + 0x68]
mov rbx, qword [rsp + 0x88]
call fcn.0044df40
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call fcn.00403100
xorps xmm15, xmm15
mov r14, qword [0x0064a700]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x4bcd9b
xor eax, eax
lea rbx, str.______My1L_:__ip53__:_i_____tvrRuUeEaAlLsS01bBoOxX_nNiIfFpP0s__________n__s__Pn___n__n___n__t____id25__nLlLtLuMntcp135udpdns::1setcgoftpsshnil01_MayUTC_mStdDltEET0001CATWATEATGMTHSTHDT_03_04_05ESTCSTCDTMSTMDT_02EDTASTADTPSTPDTNSTNDT06030407IST0908IDT12PKT11KST05JST10_01_11_12_08_0913CETBSTMSK_0614ip4ip6_:__finptrobjgc__:_gp___in__n___n___NaN__P__MPC___end___..._:_n___pc__GTTLEOF125625nanintmapadxaesshaavxfmanet3090___dialbindfile__r_t_nread_on_pipeunixicmpigmpftpshttppop3smtptrueeEpPJuneJulyEESTSASTAKSTAKDTACSTACDTAESTAEDTAWSTCESTNZSTNZDTopenStatallgallprootitabsbrkidledead_is_LEAFbase_of___GOGC____pcInf_Inf:_pcas1cas2cas3cas4cas5cas6_at__n_tm_sp_sp:_lr:_fp__mbitsNameType3125Atoiboolint8uintchanfunccallkindermssse3avx2bmi1bmi2ip4:1hostsroute_nil_writeclosefileshttpsimap2imap3imapspop3sfalseErrorsvqxXMarchAprilLocal053004300545063003300845103012451345_0930__at_defersweepschedhchansudoggscanmheaptracepanicsleep_cntgcing_MB___got_..._n_maxscav__ptr_____usageinit__ms__fault_and__tab_top_...___fp:ntohsClass1562578125int16int32int64uint8arrayslicesse41sse42ssse3Greekfailednetdns.localreturnlisten.onionipnetsocketdomaingophertelnetStringFormat__byte_for_stringSundayMondayFridayAugustUTC_11UTC_02UTC_08UTC_09UTC12UTC13sysmontimersefenceselect__not_object_next_jobs_goid_sweep__B______util_alloc_free__span_prev_list__i___code_addr_m__p_p__mSCHED__curg_ctxt:_min__max__...__n_base___val_LengthheaderAnswerGetACP390625uint16uint32uint64structchan____chan_Valuerdtscppopcntcmd_goCommonsendtosuccesswindowsrunningwsarecvwsasendconnectlookup_booleanbdoUxXvintegercomplexfloat32float64TuesdayJanuaryOctoberMUI_StdMUI_Dlt::ffff::eventsconsoleforcegccpuprofunknowngctraceIO_waitsyscallwaitingUNKNOWN__goid_snil_n__scan__MB_in_pacer:___CPU___zombie__j0__head__panic:__nmsys_locks_dying_allocsGODEBUG_m__g0_pad1__pad2__text_minpc__tvalue__scan__ttypes_:_type_CopySidWSARecvWSASendnil_keyanswers19531259765625invaliduintptrChanDir_Value_internos_execruntimeFreeSidSleepEx_::1_:53continue_gatewayshutdownfilenetaddress_wsaioctlunixgramGoString01234567beEfFgGvThursdaySaturdayFebruaryNovemberDecember__Month_FullPathscavengepollDescrwmutexWrwmutexRtraceBufdeadlockraceFinipanicnilcgocheckrunnablerax_____rbx_____rcx_____rdi_____rsi_____rbp_____rsp_____r8______r9______r10_____r11_____r12_____r13_____r14_____r15_____rip_____rflags__cs______fs______gs_______is_not__pointer_packedBAD_RANK_status_unknown_trigger_npages_nalloc_nfreed_signal__newval_mcount_bytes___stack__minLC__maxpc__tstack__minutes_etypes_no_anodeCancelIoReadFileAcceptExWSAIoctlClassANYQuestion48828125infinitystrconv.parsing_ParseIntnet_httpgo_buildx509sha1EqualSidSetEventIsWindowrecvfrom_outboundlocalhostconnectexfiles_dnsdns_filesipv6_icmp01234567_WednesdaySeptemberrwxrwxrwxprofBlockstackpoolhchanLeafwbufSpansmSpanDeadscavtraceinittracepanicwaitchan_sendpreemptedcopystackinterface____node_ms_cpu____forced__wbuf1.n_wbuf2.n_s.limit_s.state_B_work___B_exp.___marked___unmarked_in_use__n__size__bad_prune__tail__recover:__not_in__ctxt___0__oldval__newval_threads:_status_blocked_lockedgatomicor8_runtime_m__curg_unknown_traceback_stack__lockedmFindCloseLocalFreeMoveFileWWriteFileWSASendTontdll.dllquestionsClassINETAuthoritypsapi.dll244140625ParseUintcomplex64invalid_nfuncargs_bad_indirreflect:_InterfaceBigEndianpclmulqdqmath_randInheritedole32.dllwinmm.dllgoogle.com_etc_hosts.localhostsetsockoptunixpacket__netGo__0123456789__Weekday_ParseAddr_invalid_IPCreateFile_dev_stdinnotifyListprofInsertstackLargemSpanInUseGOMAXPROCSstop_traceinvalidptrschedtracesemacquiredebug_call_flushGen__MB_goal__s.state___s.base___heapGoalGOMEMLIMIT_KiB_now___pages_at__sweepgen_sweepgen___bound____limit__tracefree_tracegc___nexitThreadBad_varintGC_forced_n_runqueue_stopwait_runqsize_gfreecnt_throwing_spinningatomicand8float64nanfloat32nanException__ptrSize__targetpc_until_pcunknown_pcruntime:_ggoroutine_owner_diedDnsQuery_WGetIfEntryCancelIoExCreatePipeGetVersionWSACleanupWSAStartupgetsockoptdnsap
mov ecx, 1
mov rdi, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0x60]
lea r8, [0x00513e85]
mov r9d, 2
mov r10, qword [rsp + 0x98]
mov r11, qword [rsp + 0x58]
call fcn.0044e000
jmp 0x4bcdc8
xor eax, eax
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x60]
lea rdi, [0x00540d20]
mov esi, 1
mov r8, qword [rsp + 0x98]
mov r9, qword [rsp + 0x58]
call fcn.0044df40
add rsp, 0xa8
pop rbp
ret
mov rax, qword [rax + 0x18]
call fcn.0047a400
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x50], rbx
mov rcx, qword [rsp + 0x88]
mov qword [rsp], rcx
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 8], rdx
mov byte [rsp + 0x10], 0x3a
call fcn.00403100
xorps xmm15, xmm15
mov r14, qword [0x0064a700]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
nop
jl 0x4bce5e
xor eax, eax
lea rbx, str.______My1L_:__ip53__:_i_____tvrRuUeEaAlLsS01bBoOxX_nNiIfFpP0s__________n__s__Pn___n__n___n__t____id25__nLlLtLuMntcp135udpdns::1setcgoftpsshnil01_MayUTC_mStdDltEET0001CATWATEATGMTHSTHDT_03_04_05ESTCSTCDTMSTMDT_02EDTASTADTPSTPDTNSTNDT06030407IST0908IDT12PKT11KST05JST10_01_11_12_08_0913CETBSTMSK_0614ip4ip6_:__finptrobjgc__:_gp___in__n___n___NaN__P__MPC___end___..._:_n___pc__GTTLEOF125625nanintmapadxaesshaavxfmanet3090___dialbindfile__r_t_nread_on_pipeunixicmpigmpftpshttppop3smtptrueeEpPJuneJulyEESTSASTAKSTAKDTACSTACDTAESTAEDTAWSTCESTNZSTNZDTopenStatallgallprootitabsbrkidledead_is_LEAFbase_of___GOGC____pcInf_Inf:_pcas1cas2cas3cas4cas5cas6_at__n_tm_sp_sp:_lr:_fp__mbitsNameType3125Atoiboolint8uintchanfunccallkindermssse3avx2bmi1bmi2ip4:1hostsroute_nil_writeclosefileshttpsimap2imap3imapspop3sfalseErrorsvqxXMarchAprilLocal053004300545063003300845103012451345_0930__at_defersweepschedhchansudoggscanmheaptracepanicsleep_cntgcing_MB___got_..._n_maxscav__ptr_____usageinit__ms__fault_and__tab_top_...___fp:ntohsClass1562578125int16int32int64uint8arrayslicesse41sse42ssse3Greekfailednetdns.localreturnlisten.onionipnetsocketdomaingophertelnetStringFormat__byte_for_stringSundayMondayFridayAugustUTC_11UTC_02UTC_08UTC_09UTC12UTC13sysmontimersefenceselect__not_object_next_jobs_goid_sweep__B______util_alloc_free__span_prev_list__i___code_addr_m__p_p__mSCHED__curg_ctxt:_min__max__...__n_base___val_LengthheaderAnswerGetACP390625uint16uint32uint64structchan____chan_Valuerdtscppopcntcmd_goCommonsendtosuccesswindowsrunningwsarecvwsasendconnectlookup_booleanbdoUxXvintegercomplexfloat32float64TuesdayJanuaryOctoberMUI_StdMUI_Dlt::ffff::eventsconsoleforcegccpuprofunknowngctraceIO_waitsyscallwaitingUNKNOWN__goid_snil_n__scan__MB_in_pacer:___CPU___zombie__j0__head__panic:__nmsys_locks_dying_allocsGODEBUG_m__g0_pad1__pad2__text_minpc__tvalue__scan__ttypes_:_type_CopySidWSARecvWSASendnil_keyanswers19531259765625invaliduintptrChanDir_Value_internos_execruntimeFreeSidSleepEx_::1_:53continue_gatewayshutdownfilenetaddress_wsaioctlunixgramGoString01234567beEfFgGvThursdaySaturdayFebruaryNovemberDecember__Month_FullPathscavengepollDescrwmutexWrwmutexRtraceBufdeadlockraceFinipanicnilcgocheckrunnablerax_____rbx_____rcx_____rdi_____rsi_____rbp_____rsp_____r8______r9______r10_____r11_____r12_____r13_____r14_____r15_____rip_____rflags__cs______fs______gs_______is_not__pointer_packedBAD_RANK_status_unknown_trigger_npages_nalloc_nfreed_signal__newval_mcount_bytes___stack__minLC__maxpc__tstack__minutes_etypes_no_anodeCancelIoReadFileAcceptExWSAIoctlClassANYQuestion48828125infinitystrconv.parsing_ParseIntnet_httpgo_buildx509sha1EqualSidSetEventIsWindowrecvfrom_outboundlocalhostconnectexfiles_dnsdns_filesipv6_icmp01234567_WednesdaySeptemberrwxrwxrwxprofBlockstackpoolhchanLeafwbufSpansmSpanDeadscavtraceinittracepanicwaitchan_sendpreemptedcopystackinterface____node_ms_cpu____forced__wbuf1.n_wbuf2.n_s.limit_s.state_B_work___B_exp.___marked___unmarked_in_use__n__size__bad_prune__tail__recover:__not_in__ctxt___0__oldval__newval_threads:_status_blocked_lockedgatomicor8_runtime_m__curg_unknown_traceback_stack__lockedmFindCloseLocalFreeMoveFileWWriteFileWSASendTontdll.dllquestionsClassINETAuthoritypsapi.dll244140625ParseUintcomplex64invalid_nfuncargs_bad_indirreflect:_InterfaceBigEndianpclmulqdqmath_randInheritedole32.dllwinmm.dllgoogle.com_etc_hosts.localhostsetsockoptunixpacket__netGo__0123456789__Weekday_ParseAddr_invalid_IPCreateFile_dev_stdinnotifyListprofInsertstackLargemSpanInUseGOMAXPROCSstop_traceinvalidptrschedtracesemacquiredebug_call_flushGen__MB_goal__s.state___s.base___heapGoalGOMEMLIMIT_KiB_now___pages_at__sweepgen_sweepgen___bound____limit__tracefree_tracegc___nexitThreadBad_varintGC_forced_n_runqueue_stopwait_runqsize_gfreecnt_throwing_spinningatomicand8float64nanfloat32nanException__ptrSize__targetpc_until_pcunknown_pcruntime:_ggoroutine_owner_diedDnsQuery_WGetIfEntryCancelIoExCreatePipeGetVersionWSACleanupWSAStartupgetsockoptdnsap
mov ecx, 1
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x48]
lea r8, [0x00513e85]
mov r9d, 2
mov r10, qword [rsp + 0x90]
mov r11, qword [rsp + 0x50]
call fcn.0044e000
jmp 0x4bce8b
xor eax, eax
mov rbx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x00540d20]
mov esi, 1
mov r8, qword [rsp + 0x90]
mov r9, qword [rsp + 0x50]
call fcn.0044df40
add rsp, 0xa8
pop rbp
ret
lea rax, [0x00514181]
mov ebx, 5
add rsp, 0xa8
pop rbp
ret
mov qword [rsp + 8], rax
call fcn.00461e00
mov rax, qword [rsp + 8]
jmp fcn.004bcc60