Function at 0x407c5c
Capabilities:
Enumerate processes
Read file via mapping

Disassembly:
push 0x268
mov eax, 0x4347d5
call fcn.0041f1c6
mov eax, dword [ebp + 8]
mov dword [ebp - 0x270], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x264], eax
mov eax, dword [ebp + 0x14]
xor edi, edi
mov dword [ebp - 0x244], eax
cmp dword [0x450c7c], edi
jne 0x407f0b
lea eax, [ebp - 0x254]
push eax
mov dword [0x450c7c], 1
mov dword [ebp - 0x254], edi
call fcn.0040d7db
push eax
call fcn.00407c0a
push edi
push 0xf
mov dword [ebp - 0x258], eax
mov dword [ebp - 0x250], edi
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
lea eax, [ebp - 0x240]
push eax
push esi
mov dword [ebp - 0x240], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x407d2e
jmp 0x407d08
push str.winlogon.exe
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x407d1b
lea eax, [ebp - 0x240]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x407cf2
jmp 0x407d27
mov eax, dword [ebp - 0x238]
mov dword [ebp - 0x250], eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x258], edi
je 0x407f0b
cmp dword [ebp - 0x254], edi
jbe 0x407f0b
cmp dword [ebp - 0x250], 4
jbe 0x407f0b
mov eax, dword [0x44f98c]
mov ebx, 0x44f98c
mov ecx, ebx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x248], eax
push 0x64
lea esi, [ebp - 0x248]
mov dword [ebp - 4], edi
call fcn.00401380
push eax
push 5
pop ecx
push 0x14
xor eax, eax
pop edx
call fcn.00419460
pop ecx
call fcn.0040299c
push dword [ebp - 0x248]
mov esi, dword [ebp + 0x18]
add esi, 4
push esi
push edi
push 4
push edi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
cmp eax, edi
je 0x407dde
push esi
push edi
push edi
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
cmp esi, edi
je 0x407dde
mov eax, dword [ebp + 0x18]
push eax
push dword [ebp - 0x244]
mov dword [esi], eax
push eax
lea eax, [esi + 4]
push eax
call fcn.0041cf5f
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [0x44f98c]
mov ecx, ebx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x244], eax
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x248]
push edi
lea ecx, [ebp - 0x268]
call fcn.00417320
pop ecx
mov esi, eax
mov edx, dword [ebp - 0x264]
push edi
lea ecx, [ebp - 0x260]
mov byte [ebp - 4], 2
call fcn.00417320
pop ecx
mov ebx, eax
mov edx, dword [ebp - 0x24c]
push edi
lea ecx, [ebp - 0x26c]
mov byte [ebp - 4], 3
call fcn.00417320
pop ecx
mov dword [ebp - 0x24c], eax
mov edx, dword [ebp - 0x270]
push edi
lea ecx, [ebp - 0x25c]
mov byte [ebp - 4], 4
call fcn.00417320
pop ecx
mov ecx, dword [ebp - 0x24c]
mov byte [ebp - 4], 5
push dword [esi]
push dword [ebx]
push dword [ecx]
push dword [eax]
lea eax, [ebp - 0x244]
push str.__u__s__a__s__cmd__s__fmn__s
call fcn.004015de
mov eax, dword [ebp - 0x25c]
add esp, 0x14
add eax, 0xfffffff0
call fcn.00401629
mov eax, dword [ebp - 0x26c]
add eax, 0xfffffff0
call fcn.00401629
mov eax, dword [ebp - 0x260]
add eax, 0xfffffff0
call fcn.00401629
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x268]
add eax, 0xfffffff0
call fcn.00401629
lea esi, [ebp - 0x244]
call fcn.00402985
push eax
push 0x443108
push edi
push dword [ebp - 0x254]
push dword [ebp - 0x258]
push dword [ebp - 0x250]
call fcn.004107f0
add esp, 0x18
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x244]
add eax, 0xfffffff0
call fcn.00401629
mov eax, dword [ebp - 0x248]
add eax, 0xfffffff0
call fcn.00401629
call fcn.0041f249
ret