Function at 0x407ad7
Capabilities:
Enumerate processes
Read file via mapping

Disassembly:
push 0x268
mov eax, 0x434775
call fcn.0041f156
mov eax, dword [ebp + 8]
mov dword [ebp - 0x270], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x264], eax
mov eax, dword [ebp + 0x14]
xor edi, edi
mov dword [ebp - 0x244], eax
cmp dword [0x450c7c], edi
jne 0x407d86
lea eax, [ebp - 0x254]
push eax
mov dword [0x450c7c], 1
mov dword [ebp - 0x254], edi
call fcn.0040d709
push eax
call fcn.00407a85
push edi
push 0xf
mov dword [ebp - 0x258], eax
mov dword [ebp - 0x250], edi
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
lea eax, [ebp - 0x240]
push eax
push esi
mov dword [ebp - 0x240], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x407ba9
jmp 0x407b83
push str.winlogon.exe
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x407b96
lea eax, [ebp - 0x240]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x407b6d
jmp 0x407ba2
mov eax, dword [ebp - 0x238]
mov dword [ebp - 0x250], eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x258], edi
je 0x407d86
cmp dword [ebp - 0x254], edi
jbe 0x407d86
cmp dword [ebp - 0x250], 4
jbe 0x407d86
mov eax, dword [0x44f98c]
mov ebx, 0x44f98c
mov ecx, ebx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x248], eax
push 0x64
lea esi, [ebp - 0x248]
mov dword [ebp - 4], edi
call fcn.00401365
push eax
push 5
pop ecx
push 0x14
xor eax, eax
pop edx
call fcn.004193f0
pop ecx
call fcn.0040277f
push dword [ebp - 0x248]
mov esi, dword [ebp + 0x18]
add esi, 4
push esi
push edi
push 4
push edi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
cmp eax, edi
je 0x407c59
push esi
push edi
push edi
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
cmp esi, edi
je 0x407c59
mov eax, dword [ebp + 0x18]
push eax
push dword [ebp - 0x244]
mov dword [esi], eax
push eax
lea eax, [esi + 4]
push eax
call fcn.0041ceec
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [0x44f98c]
mov ecx, ebx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x244], eax
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x248]
push edi
lea ecx, [ebp - 0x268]
call fcn.004172b0
pop ecx
mov esi, eax
mov edx, dword [ebp - 0x264]
push edi
lea ecx, [ebp - 0x260]
mov byte [ebp - 4], 2
call fcn.004172b0
pop ecx
mov ebx, eax
mov edx, dword [ebp - 0x24c]
push edi
lea ecx, [ebp - 0x26c]
mov byte [ebp - 4], 3
call fcn.004172b0
pop ecx
mov dword [ebp - 0x24c], eax
mov edx, dword [ebp - 0x270]
push edi
lea ecx, [ebp - 0x25c]
mov byte [ebp - 4], 4
call fcn.004172b0
pop ecx
mov ecx, dword [ebp - 0x24c]
mov byte [ebp - 4], 5
push dword [esi]
push dword [ebx]
push dword [ecx]
push dword [eax]
lea eax, [ebp - 0x244]
push str.__u__s__a__s__cmd__s__fmn__s
call fcn.004015b8
mov eax, dword [ebp - 0x25c]
add esp, 0x14
add eax, 0xfffffff0
call fcn.00401603
mov eax, dword [ebp - 0x26c]
add eax, 0xfffffff0
call fcn.00401603
mov eax, dword [ebp - 0x260]
add eax, 0xfffffff0
call fcn.00401603
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x268]
add eax, 0xfffffff0
call fcn.00401603
lea esi, [ebp - 0x244]
call fcn.00402768
push eax
push 0x4431a8
push edi
push dword [ebp - 0x254]
push dword [ebp - 0x258]
push dword [ebp - 0x250]
call fcn.00410780
add esp, 0x18
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x244]
add eax, 0xfffffff0
call fcn.00401603
mov eax, dword [ebp - 0x248]
add eax, 0xfffffff0
call fcn.00401603
call fcn.0041f1d9
ret