Function at 0x6fd43580
Capabilities:
Enumerate pe sections
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6fd4388e
sub esp, 0x14
mov eax, dword [esp + 0x20]
cmp eax, 0x20
je 0x6fd435dd
lea eax, [0x6fe587c0]
mov dword [esp], eax
call fcn.6fc0ba30
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x2e
lea ecx, [0x6fe8a9f1]
mov dword [eax], ecx
mov dword [esp + 0x28], 0
lea ecx, [0x6fededfc]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], eax
add esp, 0x14
ret
nop
mov eax, dword [esp + 0x1c]
movzx ecx, byte [eax + 6]
shl ecx, 0x10
movzx edx, byte [eax + 5]
shl edx, 8
movzx ebx, byte [eax + 4]
movzx ebp, byte [eax + 3]
mov dword [esp + 0x10], ebp
shr ebp, 8
movzx edi, byte [eax + 2]
mov dword [esp + 0xc], edi
shr edi, 0x10
movzx esi, byte [eax + 1]
mov dword [esp + 8], esi
shr esi, 0x18
or esi, edi
or esi, ebp
or ebx, esi
or ebx, edx
or ebx, ecx
movzx ecx, byte [eax + 7]
shl ecx, 0x18
or ebx, ecx
movzx ecx, byte [eax]
mov edx, dword [esp + 0x18]
mov dword [edx + 4], ebx
mov ebp, dword [esp + 0x10]
shl ebp, 0x18
mov esi, dword [esp + 0xc]
shl esi, 0x10
mov edi, dword [esp + 8]
shl edi, 8
or ecx, edi
or ecx, esi
or ecx, ebp
mov dword [edx], ecx
and ebx, 0x7ffff
mov dword [edx + 4], ebx
movzx ecx, byte [eax + 0xc]
shl ecx, 0x10
movzx ebx, byte [eax + 0xb]
shl ebx, 8
movzx ebp, byte [eax + 0xa]
movzx esi, byte [eax + 9]
mov dword [esp + 0x10], esi
shr esi, 8
movzx edi, byte [eax + 8]
mov dword [esp + 0xc], edi
shr edi, 0x10
movzx edx, byte [eax + 7]
mov dword [esp + 8], edx
shr edx, 0x18
or edx, edi
or edx, esi
or ebp, edx
or ebp, ebx
or ebp, ecx
movzx ecx, byte [eax + 0xd]
shl ecx, 0x18
or ebp, ecx
mov ecx, ebp
shr ebp, 3
movzx edx, byte [eax + 6]
mov ebx, dword [esp + 0x18]
mov dword [ebx + 0xc], ebp
mov esi, dword [esp + 0x10]
shl esi, 0x18
mov edi, dword [esp + 0xc]
shl edi, 0x10
mov eax, dword [esp + 8]
shl eax, 8
or edx, eax
or edx, edi
or edx, esi
shr edx, 3
shl ecx, 0x1d
or ecx, edx
mov dword [ebx + 8], ecx
and ebp, 0x7ffff
mov dword [ebx + 0xc], ebp
mov eax, dword [esp + 0x1c]
movzx ecx, byte [eax + 0x12]
shl ecx, 0x10
movzx edx, byte [eax + 0x11]
shl edx, 8
movzx ebp, byte [eax + 0x10]
movzx esi, byte [eax + 0xf]
mov dword [esp + 0x10], esi
shr esi, 8
movzx edi, byte [eax + 0xe]
mov dword [esp + 0xc], edi
shr edi, 0x10
movzx ebx, byte [eax + 0xd]
mov dword [esp + 8], ebx
shr ebx, 0x18
or edi, ebx
or edi, esi
or ebp, edi
or ebp, edx
or ebp, ecx
movzx ecx, byte [eax + 0x13]
shl ecx, 0x18
or ebp, ecx
mov ecx, ebp
shr ebp, 6
movzx edx, byte [eax + 0xc]
mov ebx, dword [esp + 0x18]
mov dword [ebx + 0x14], ebp
mov esi, dword [esp + 0x10]
shl esi, 0x18
mov edi, dword [esp + 0xc]
shl edi, 0x10
mov eax, dword [esp + 8]
shl eax, 8
or edx, eax
or edx, edi
or esi, edx
shr esi, 6
shl ecx, 0x1a
or ecx, esi
mov dword [ebx + 0x10], ecx
and ebp, 0x7ffff
mov dword [ebx + 0x14], ebp
mov eax, dword [esp + 0x1c]
movzx ecx, byte [eax + 0x19]
shl ecx, 0x10
movzx edx, byte [eax + 0x18]
shl edx, 8
movzx ebp, byte [eax + 0x17]
movzx esi, byte [eax + 0x16]
mov dword [esp + 0x10], esi
shr esi, 8
movzx edi, byte [eax + 0x15]
mov dword [esp + 0xc], edi
shr edi, 0x10
movzx ebx, byte [eax + 0x14]
mov dword [esp + 8], ebx
shr ebx, 0x18
or edi, ebx
or edi, esi
or ebp, edi
or ebp, edx
or ebp, ecx
movzx ecx, byte [eax + 0x1a]
shl ecx, 0x18
or ebp, ecx
mov ecx, ebp
shr ebp, 1
movzx edx, byte [eax + 0x13]
mov ebx, dword [esp + 0x18]
mov dword [ebx + 0x1c], ebp
mov esi, dword [esp + 0x10]
shl esi, 0x18
mov edi, dword [esp + 0xc]
shl edi, 0x10
mov eax, dword [esp + 8]
shl eax, 8
or edx, eax
or edx, edi
or esi, edx
shr esi, 1
shl ecx, 0x1f
or ecx, esi
mov dword [ebx + 0x18], ecx
and ebp, 0x7ffff
mov dword [ebx + 0x1c], ebp
mov eax, dword [esp + 0x1c]
movzx ecx, byte [eax + 0x1e]
shl ecx, 0x10
movzx edx, byte [eax + 0x1d]
shl edx, 8
movzx ebp, byte [eax + 0x1c]
movzx esi, byte [eax + 0x1b]
mov dword [esp + 0x10], esi
shr esi, 8
movzx edi, byte [eax + 0x1a]
mov dword [esp + 0xc], edi
shr edi, 0x10
movzx ebx, byte [eax + 0x19]
mov dword [esp + 8], ebx
shr ebx, 0x18
or edi, ebx
or edi, esi
or ebp, edi
or ebp, edx
or ebp, ecx
movzx ecx, byte [eax + 0x1f]
shl ecx, 0x18
or ebp, ecx
mov ecx, ebp
shr ebp, 0xc
movzx eax, byte [eax + 0x18]
mov edx, dword [esp + 0x18]
mov dword [edx + 0x24], ebp
mov ebx, dword [esp + 0x10]
shl ebx, 0x18
mov esi, dword [esp + 0xc]
shl esi, 0x10
mov edi, dword [esp + 8]
shl edi, 8
or eax, edi
or eax, esi
or ebx, eax
shr ebx, 0xc
shl ecx, 0x14
or ecx, ebx
mov dword [edx + 0x20], ecx
and ebp, 0x7ffff
mov dword [edx + 0x24], ebp
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
add esp, 0x14
ret
call fcn.6fc60ad0
jmp fcn.6fd43580