Function at 0x416680
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4168a6
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00434a00
xorps xmm15, xmm15
mov r14, qword [0x006a29b8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x4166f3
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x416702
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x416725
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x416735
cmp rbx, 0x1000
jae 0x4166f9
nop
jmp 0x4167b8
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x41674d
xor esi, esi
jmp 0x4167aa
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00434a00
xorps xmm15, xmm15
mov r14, qword [0x006a29b8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x41672b
jmp 0x416716
call fcn.00468200
xorps xmm15, xmm15
mov r14, qword [0x006a29b8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x416840
nop dword [rax + rax]
call fcn.00438c00
lea rax, [0x0053784e]
mov ebx, 0x19
call fcn.00439480
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call fcn.004391c0
lea rax, [0x00537835]
mov ebx, 0x19
call fcn.00439480
mov eax, dword [rsp + 0x34]
call fcn.004391c0
nop
call fcn.00438e40
call fcn.00438c60
lea rax, [0x005345ef]
mov ebx, 0xd
call fcn.00437160
nop dword [rax + rax]
cmp eax, 0x5af
je 0x4167e0
call fcn.00438c00
lea rax, [0x0053784e]
mov ebx, 0x19
call fcn.00439480
mov rax, qword [rsp + 0x38]
call fcn.004391c0
lea rax, [0x00537835]
mov ebx, 0x19
call fcn.00439480
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.004391c0
call fcn.00438e40
call fcn.00438c60
lea rax, str.runtime:_failed_to_commit_pages_memory_classes_heap_free:bytes_memory_classes_os_stacks:bytespacer:_sweep_done_at_heap_size_non_in_use_span_in_unswept_listcasgstatus:_bad_incoming_valuesresetspinning:_not_a_spinning_mentersyscallblock_inconsistent_runtime:_split_stack_overflow:_...additional_frames_elided..._nunsafe.String:_len_out_of_range11368683772161602973937988281255684341886080801486968994140625fmt:_unknown_base__cant_happenreflect:_Len_of_non_array_type_reflect.MakeSlice:_negative_lenreflect.MakeSlice:_negative_capresource_temporarily_unavailablesoftware_caused_connection_abortnumerical_argument_out_of_domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice_bounds_out_of_range__::_x_slice_bounds_out_of_range__:_x:_slice_bounds_out_of_range___x::___types_from_different_packages_end_outside_usable_address_spaceGCProg_for_type_that_isnt_largeruntime:_failed_to_release_pagesruntime:_fixalloc_size_too_largeinvalid_limiter_event_type_foundscanstack:_goroutine_not_stoppedscavenger_state_is_already_wiredsweep_increased_allocation_countremovespecial_on_invalid_pointerruntime:_root_level_max_pages__WSAGetOverlappedResult_not_found_cgo_pthread_key_created_missingruntime:_sudog_with_non_nil_elemruntime:_sudog_with_non_nil_nextruntime:_sudog_with_non_nil_prevruntime:_mcall_function_returnedruntime:_newstack_called_from_gruntime:_stack_split_at_bad_timepanic_while_printing_panic_valueruntime:_setevent_failed__errnoruntime.semasleep_wait_abandoned28421709430404007434844970703125__not_supported_for_cpu_option__total_sampling_factors_too_largeMapIter.Value_called_before_Nextbufio:_invalid_use_of_UnreadRunebufio:_tried_to_fill_full_bufferuse_of_closed_network_connectiontoo_many_levels_of_symbolic_linksInitializeProcThreadAttributeListslice_bounds_out_of_range___x:_y_base_outside_usable_address_spaceruntime:_memory_allocated_by_OS__misrounded_allocation_in_sysAllocconcurrent_map_read_and_map_writeruntime:_failed_to_decommit_pages_cpu_classes_gc_pause:cpu_seconds_cpu_classes_gc_total:cpu_seconds_gc_limiter_last_enabled:gc_cycle_memory_classes_heap_stacks:bytes_memory_classes_heap_unused:bytes_sched_pauses_stopping_gc:seconds_sched_pauses_total_other:secondsmin_must_be_a_non_zero_power_of_2runtime:_failed_mSpanList.insert_runtime:_castogscanstatus_oldvalstoplockedm:_inconsistent_lockingfindrunnable:_negative_nmspinningfreeing_stack_not_in_a_stack_spanstackalloc_not_on_scheduler_stackruntime:_goroutine_stack_exceeds_runtime:_text_offset_out_of_rangetimer_period_must_be_non_negativeruntime:_name_offset_out_of_rangeruntime:_type_offset_out_of_range142108547152020037174224853515625710542735760100185871124267578125GODEBUG:_no_value_specified_for__reflect:_slice_index_out_of_range_of_method_on_nil_interface_valuereflect:_Field_index_out_of_rangereflect:_array_index_out_of_rangeGetVolumeNameForVolumeMountPointWwaiting_for_unsupported_file_typeleafCounts_maxBits__maxBits____ncrypto_rc4:_invalid_buffer_overlaptoo_many_references:_cannot_spliceSetFileCompletionNotificationModesslice_bounds_out_of_range__:_x:_y_slice_bounds_out_of_range___x:_y:_out_of_memory_allocating_allArenas_memory_classes_heap_objects:bytesruntime.SetFinalizer:_cannot_pass_too_many_pages_allocated_in_chunk_mspan.ensureSwept:_m_is_not_lockedVirtualQuery_for_stack_base_failedforEachP:_sched.safePointWait___0schedule:_spinning_with_local_workruntime:_g_is_running_but_p_is_notdoaddtimer:_P_already_set_in_timerillegal_base64_data_at_input_byte_3552713678800500929355621337890625Huffman_table_has_excessive_lengthreflect:_Field_of_non_struct_type_reflect:_Field_index_out_of_boundsreflect:_string_index_out_of_rangeunexpected_runtime.netpoll_error:_encoding_hex:_odd_length_hex_stringnetwork_dropped_connection_on_resettransport_endpoint_is_not_connectedpersistentalloc:_align_is_too_large_memory_classes_heap_released:bytesgreyobject:_obj_not_pointer_alignedmismatched_begin_end_of_activeSweepmheap.freeSpanLocked___invalid_freeattempt_to_clear_non_empty_span_setruntime:_close_polldesc_w_o_unblockfindrunnable:_netpoll_with_spinningpidleput:_P_has_non_empty_run
mov ebx, 0x1f
nop dword [rax + rax]
call fcn.00437160
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00464a80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00416680