Function at 0x409e90
Capabilities:
Create process on windows
Enumerate gui resources
Enumerate processes

Disassembly:
push 0xffffffffffffffff
push 0x4edd7b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3b8
push ebx
push ebp
push esi
mov esi, ecx
push edi
push 0x536268
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::CString_3
push ecx
lea eax, [esp + 0x14]
xor ebp, ebp
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
mov dword [esp + 0x3d8], ebp
call sub.MFC42.DLL_CString::CString_3
mov ecx, esi
call fcn.00409e20
cmp eax, ebp
jne 0x409eff
lea ecx, [esp + 0x10]
mov dword [esp + 0x3d0], 0xffffffff
call sub.MFC42.DLL_CString::CString
xor eax, eax
jmp 0x40a139
push ebp
push 2
mov dword [esp + 0x84], 0x128
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x18], esi
jne 0x409f34
lea ecx, [esp + 0x10]
mov dword [esp + 0x3d0], eax
call sub.MFC42.DLL_CString::CString
xor eax, eax
jmp 0x40a139
lea ecx, [esp + 0x7c]
push ecx
push esi
call sub.KERNEL32.dll_Process32First
mov ebx, eax
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x3c]
mov dword [esp + 0x38], 0x44
mov dword [esp + 0x14], ebp
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x64], 1
mov word [esp + 0x68], bp
call sub.MFC42.DLL_CString::MakeLower
cmp ebx, ebp
je 0x40a07d
mov ebp, dword [sym.imp.MSVCRT.dll__strlwr]
lea edx, [esp + 0xa0]
push edx
call ebp
lea edi, [esp + 0xa4]
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x1c]
push ecx
push eax
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::Right
mov eax, dword [eax]
lea ecx, [esp + 0xa0]
push ecx
push eax
call dword [sym.imp.MSVCRT.dll__mbscmp]
add esp, 8
lea ecx, [esp + 0x1c]
test eax, eax
sete bl
call sub.MFC42.DLL_CString::CString
test bl, bl
je 0x40a04d
mov edx, dword [esp + 0x84]
push edx
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x40a0c7
mov ecx, 0x88
xor eax, eax
lea edi, [esp + 0x1a8]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x1a4]
mov dword [esp + 0x1a4], 0x224
push eax
push esi
call sub.KERNEL32.dll_Module32First
test eax, eax
je 0x40a0c7
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call edi
lea ecx, [esp + 0x2c4]
push ecx
call ebp
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x2c8]
push edx
push eax
call dword [sym.imp.MSVCRT.dll__mbscmp]
add esp, 0xc
test eax, eax
je 0x40a06a
mov esi, dword [esp + 0x18]
lea ecx, [esp + 0x7c]
push ecx
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x409f7e
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebp, ebp
jmp 0x40a083
mov edx, dword [esp + 0x84]
mov esi, dword [esp + 0x18]
mov dword [esp + 0x14], edx
xor ebp, ebp
jmp 0x40a083
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call edi
cmp dword [esp + 0x14], ebp
jne 0x40a0df
lea eax, [esp + 0x28]
lea ecx, [esp + 0x38]
mov edx, dword [esp + 0x10]
push eax
push ecx
push ebp
push ebp
push 0x10
push ebp
push ebp
push ebp
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp eax, ebp
je 0x40a0c7
mov eax, dword [esp + 0x2c]
mov esi, dword [esp + 0x30]
push eax
mov dword [esp + 0x18], esi
call edi
mov ecx, dword [esp + 0x28]
push ecx
call edi
cmp esi, ebp
jne 0x40a0df
lea ecx, [esp + 0x10]
mov dword [esp + 0x3d0], 0xffffffff
call sub.MFC42.DLL_CString::CString
xor eax, eax
jmp 0x40a139
mov edx, dword [esp + 0x14]
mov edi, dword [sym.imp.USER32.dll_FindWindowA]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [esp + 0x24], ebp
mov dword [esp + 0x20], edx
xor esi, esi
push str.DecodeDemo
push ebp
call edi
cmp eax, ebp
jne 0x40a10f
push 0x64
call ebx
inc esi
cmp esi, 0x32
jl 0x40a0f9
lea eax, [esp + 0x20]
push eax
push 0x40a160
call dword [sym.imp.USER32.dll_EnumWindows]
mov esi, dword [esp + 0x24]
lea ecx, [esp + 0x10]
mov dword [esp + 0x3d0], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov eax, esi
mov ecx, dword [esp + 0x3c8]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x3c4
ret