Function at 0x407e70
Capabilities:
Create a process with modified i/o handles and window
Create process on windows
Create process suspended
Enumerate processes
Terminate process
Terminate process by name

Disassembly:
mov eax, 0x11c8
call fcn.00409160
push ebx
push ebp
push esi
push edi
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x24]
xor ebx, ebx
rep stosd dword es:[edi], eax
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x9b4]
mov dword [esp + 0x18], eax
push ecx
mov dword [esp + 0x20], eax
push str.3BBE11C4DC098CA158A5ED86D36938DF1AFCC78428BE84E990B17A5A5A1452D22FA0EACDFE581B7F1AECFCB987BC6D470FB80B554DF02C9229DF
mov dword [esp + 0x2c], 0x44
mov dword [esp + 0x58], 0x101
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
mov word [esp + 0x5c], bx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x28], eax
call fcn.00408390
lea edx, [esp + 0x198]
push 0x104
push edx
push 0x41989c
lea eax, [esp + 0x9c8]
push 0x41989c
push eax
push 0x80000000
call fcn.004085b0
add esp, 0x20
test eax, eax
jne 0x407f0e
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x11c8
ret
mov edi, 0x415e78
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x190]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea edx, [esp + 0x190]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x11dc]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x14]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x28]
lea edx, [esp + 0x194]
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push edx
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
test eax, eax
jne 0x407fa1
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x11c8
ret
push 0x7d0
call dword [sym.imp.KERNEL32.DLL_Sleep]
push ebx
push 0xf
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
lea ecx, [esp + 0x68]
mov dword [esp + 0x10], eax
push ecx
push eax
mov dword [esp + 0x70], 0x128
call sub.KERNEL32.DLL_Process32First
test eax, eax
je 0x40806d
mov edi, dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov ebp, dword [sym.imp.KERNEL32.DLL_TerminateProcess]
lea edx, [esp + 0x190]
push edx
push str.3BCE26982D84CC4C9B8FBBD90A176092134926470683935CF0D4F066
call fcn.00408390
lea eax, [esp + 0x94]
lea esi, [esp + 0x198]
push eax
call fcn.0040f654
add esp, 0xc
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x40802c
cmp cl, bl
je 0x408028
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x40802c
add eax, 2
add esi, 2
cmp cl, bl
jne 0x408008
xor eax, eax
jmp 0x408031
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x408056
mov eax, dword [esp + 0x70]
push eax
push ebx
push 1
call edi
mov ecx, dword [esp + 0x1c]
mov esi, eax
cmp ecx, dword [esp + 0x70]
jne 0x408056
push ebx
push esi
call ebp
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x68]
push edx
push eax
call sub.KERNEL32.DLL_Process32Next
test eax, eax
jne 0x407fdf
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x11c8
ret