Function at 0x407c3d
Capabilities:
Enumerate processes
Read file via mapping

Disassembly:
push 0x268
mov eax, 0x423b88
call fcn.004151b6
mov eax, dword [ebp + 8]
mov dword [ebp - 0x260], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x248], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24c], eax
mov eax, dword [ebp + 0x14]
xor edi, edi
mov dword [ebp - 0x244], eax
cmp dword [0x43c20c], edi
jne 0x407ee9
lea eax, [ebp - 0x258]
push eax
mov dword [0x43c20c], 1
mov dword [ebp - 0x258], edi
call fcn.004066e6
push eax
call fcn.00407beb
push edi
push 0xf
mov dword [ebp - 0x25c], eax
mov dword [ebp - 0x250], edi
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov esi, eax
lea eax, [ebp - 0x240]
push eax
push esi
mov dword [ebp - 0x240], 0x22c
call sub.KERNEL32.DLL_Process32FirstW
test eax, eax
je 0x407d0f
jmp 0x407ce9
push str.winlogon.exe
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x407cfc
lea eax, [ebp - 0x240]
push eax
push esi
call sub.KERNEL32.DLL_Process32NextW
test eax, eax
jne 0x407cd3
jmp 0x407d08
mov eax, dword [ebp - 0x238]
mov dword [ebp - 0x250], eax
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp dword [ebp - 0x25c], edi
je 0x407ee9
cmp dword [ebp - 0x258], edi
jbe 0x407ee9
cmp dword [ebp - 0x250], 4
jbe 0x407ee9
mov eax, dword [0x43b30c]
mov ecx, 0x43b30c
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x254], eax
push 0x14
push 0x64
lea esi, [ebp - 0x254]
mov dword [ebp - 4], edi
call fcn.004012ff
mov ebx, eax
call fcn.00412b00
pop ecx
call fcn.00402923
mov esi, dword [ebp + 0x18]
mov ebx, dword [ebp - 0x254]
push ebx
add esi, 4
push esi
push edi
push 4
push edi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.DLL_CreateFileMappingW]
cmp eax, edi
je 0x407db9
push esi
push edi
push edi
push 6
push eax
call dword [sym.imp.KERNEL32.DLL_MapViewOfFile]
mov esi, eax
cmp esi, edi
je 0x407db9
mov eax, dword [ebp + 0x18]
push eax
push dword [ebp - 0x244]
mov dword [esi], eax
push eax
lea eax, [esi + 4]
push eax
call fcn.00413565
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.DLL_UnmapViewOfFile]
mov eax, dword [0x43b30c]
mov ecx, 0x43b30c
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x244], eax
push edi
mov edx, ebx
lea ecx, [ebp - 0x268]
mov byte [ebp - 4], 1
call fcn.004109c0
pop ecx
mov esi, eax
mov edx, dword [ebp - 0x24c]
push edi
lea ecx, [ebp - 0x264]
mov byte [ebp - 4], 2
call fcn.004109c0
pop ecx
mov dword [ebp - 0x24c], eax
mov edx, dword [ebp - 0x248]
push edi
lea ecx, [ebp - 0x26c]
mov byte [ebp - 4], 3
call fcn.004109c0
pop ecx
mov dword [ebp - 0x248], eax
mov edx, dword [ebp - 0x260]
push edi
lea ecx, [ebp - 0x270]
mov byte [ebp - 4], 4
call fcn.004109c0
pop ecx
mov ecx, dword [ebp - 0x24c]
mov byte [ebp - 4], 5
push dword [esi]
push dword [ecx]
mov ecx, dword [ebp - 0x248]
push dword [ecx]
push dword [eax]
lea eax, [ebp - 0x244]
push str.__u__s__a__s__cmd__s__fmn__s
call fcn.00401552
mov eax, dword [ebp - 0x270]
add esp, 0x14
add eax, 0xfffffff0
call fcn.0040159d
mov eax, dword [ebp - 0x26c]
add eax, 0xfffffff0
call fcn.0040159d
mov eax, dword [ebp - 0x264]
add eax, 0xfffffff0
call fcn.0040159d
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x268]
add eax, 0xfffffff0
call fcn.0040159d
lea esi, [ebp - 0x244]
call fcn.0040290c
push eax
push 0x431490
push edi
push dword [ebp - 0x258]
push dword [ebp - 0x25c]
push dword [ebp - 0x250]
call fcn.0040a860
add esp, 0x18
push 0x7d0
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov eax, dword [ebp - 0x244]
add eax, 0xfffffff0
call fcn.0040159d
lea eax, [ebx - 0x10]
call fcn.0040159d
call fcn.00415239
ret