Function at 0x6fd9a5c0
Capabilities:
Enumerate pe sections
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6fd9a8a0
sub esp, 0x14
mov eax, dword [esp + 0x20]
cmp eax, 0x20
jne 0x6fd9a887
nop
mov eax, dword [esp + 0x1c]
movzx ecx, byte [eax + 6]
shl ecx, 0x10
movzx edx, byte [eax + 5]
shl edx, 8
movzx ebx, byte [eax + 4]
movzx ebp, byte [eax + 3]
mov dword [esp + 0x10], ebp
shr ebp, 8
movzx edi, byte [eax + 2]
mov dword [esp + 0xc], edi
shr edi, 0x10
movzx esi, byte [eax + 1]
mov dword [esp + 8], esi
shr esi, 0x18
or esi, edi
or ebp, esi
or ebx, ebp
or ebx, edx
or ebx, ecx
movzx ecx, byte [eax + 7]
shl ecx, 0x18
or ebx, ecx
movzx ecx, byte [eax]
mov edx, dword [esp + 0x18]
mov dword [edx + 4], ebx
mov ebp, dword [esp + 0x10]
shl ebp, 0x18
mov esi, dword [esp + 0xc]
shl esi, 0x10
mov edi, dword [esp + 8]
shl edi, 8
or ecx, edi
or ecx, esi
or ecx, ebp
mov dword [edx], ecx
and ebx, 0x7ffff
mov dword [edx + 4], ebx
movzx ecx, byte [eax + 0xc]
shl ecx, 0x10
movzx ebx, byte [eax + 0xb]
shl ebx, 8
movzx ebp, byte [eax + 0xa]
movzx esi, byte [eax + 9]
mov dword [esp + 0x10], esi
shr esi, 8
movzx edi, byte [eax + 8]
mov dword [esp + 0xc], edi
shr edi, 0x10
movzx edx, byte [eax + 7]
mov dword [esp + 8], edx
shr edx, 0x18
or edx, edi
or esi, edx
or ebp, esi
or ebx, ebp
or ebx, ecx
movzx ecx, byte [eax + 0xd]
shl ecx, 0x18
or ecx, ebx
mov edx, ecx
shr ecx, 3
movzx ebx, byte [eax + 6]
mov ebp, dword [esp + 0x18]
mov dword [ebp + 0xc], ecx
mov esi, dword [esp + 0x10]
shl esi, 0x18
mov edi, dword [esp + 0xc]
shl edi, 0x10
mov eax, dword [esp + 8]
shl eax, 8
or ebx, eax
or ebx, edi
or ebx, esi
shr ebx, 3
shl edx, 0x1d
or edx, ebx
mov dword [ebp + 8], edx
and ecx, 0x7ffff
mov dword [ebp + 0xc], ecx
mov eax, dword [esp + 0x1c]
movzx ecx, byte [eax + 0x12]
shl ecx, 0x10
movzx edx, byte [eax + 0x11]
shl edx, 8
movzx ebx, byte [eax + 0x10]
movzx esi, byte [eax + 0xf]
mov dword [esp + 0x10], esi
shr esi, 8
movzx edi, byte [eax + 0xe]
mov dword [esp + 0xc], edi
shr edi, 0x10
movzx ebp, byte [eax + 0xd]
mov dword [esp + 8], ebp
shr ebp, 0x18
or edi, ebp
or esi, edi
or ebx, esi
or edx, ebx
or edx, ecx
movzx ecx, byte [eax + 0x13]
shl ecx, 0x18
or edx, ecx
mov ecx, edx
shr edx, 6
movzx ebx, byte [eax + 0xc]
mov ebp, dword [esp + 0x18]
mov dword [ebp + 0x14], edx
mov esi, dword [esp + 0x10]
shl esi, 0x18
mov edi, dword [esp + 0xc]
shl edi, 0x10
mov eax, dword [esp + 8]
shl eax, 8
or ebx, eax
or ebx, edi
or esi, ebx
shr esi, 6
shl ecx, 0x1a
or ecx, esi
mov dword [ebp + 0x10], ecx
and edx, 0x7ffff
mov dword [ebp + 0x14], edx
mov eax, dword [esp + 0x1c]
movzx ecx, byte [eax + 0x19]
shl ecx, 0x10
movzx edx, byte [eax + 0x18]
shl edx, 8
movzx ebx, byte [eax + 0x17]
movzx esi, byte [eax + 0x16]
mov dword [esp + 0x10], esi
shr esi, 8
movzx edi, byte [eax + 0x15]
mov dword [esp + 0xc], edi
shr edi, 0x10
movzx ebp, byte [eax + 0x14]
mov dword [esp + 8], ebp
shr ebp, 0x18
or edi, ebp
or edi, esi
or ebx, edi
or ebx, edx
or ebx, ecx
movzx ecx, byte [eax + 0x1a]
shl ecx, 0x18
or ebx, ecx
mov ecx, ebx
shr ebx, 1
movzx edx, byte [eax + 0x13]
mov ebp, dword [esp + 0x18]
mov dword [ebp + 0x1c], ebx
mov esi, dword [esp + 0x10]
shl esi, 0x18
mov edi, dword [esp + 0xc]
shl edi, 0x10
mov eax, dword [esp + 8]
shl eax, 8
or edx, eax
or edx, edi
or esi, edx
shr esi, 1
shl ecx, 0x1f
or ecx, esi
mov dword [ebp + 0x18], ecx
and ebx, 0x7ffff
mov dword [ebp + 0x1c], ebx
mov eax, dword [esp + 0x1c]
movzx ecx, byte [eax + 0x1e]
shl ecx, 0x10
movzx edx, byte [eax + 0x1d]
shl edx, 8
movzx ebx, byte [eax + 0x1c]
movzx esi, byte [eax + 0x1b]
mov dword [esp + 0x10], esi
shr esi, 8
movzx edi, byte [eax + 0x1a]
mov dword [esp + 0xc], edi
shr edi, 0x10
movzx ebp, byte [eax + 0x19]
mov dword [esp + 8], ebp
shr ebp, 0x18
or edi, ebp
or edi, esi
or ebx, edi
or ebx, edx
or ebx, ecx
movzx ecx, byte [eax + 0x1f]
shl ecx, 0x18
or ebx, ecx
mov ecx, ebx
shr ebx, 0xc
movzx eax, byte [eax + 0x18]
mov edx, dword [esp + 0x18]
mov dword [edx + 0x24], ebx
mov ebp, dword [esp + 0x10]
shl ebp, 0x18
mov esi, dword [esp + 0xc]
shl esi, 0x10
mov edi, dword [esp + 8]
shl edi, 8
or eax, edi
or eax, esi
or ebp, eax
shr ebp, 0xc
shl ecx, 0x14
or ecx, ebp
mov dword [edx + 0x20], ecx
and ebx, 0x7ffff
mov dword [edx + 0x24], ebx
mov dword [esp + 0x28], edx
add esp, 0x14
ret
lea eax, [0x6fe514c0]
mov dword [esp], eax
lea eax, [0x6fede57c]
mov dword [esp + 4], eax
call fcn.6fc36660
nop
call fcn.6fc60ad0
jmp fcn.6fd9a5c0