Function at 0x10006200
Capabilities:
Enumerate processes
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
mov eax, dword [0x10029128]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x21e
mov dword [ebp - 0x238], eax
call fcn.10010127
push 0x21e
mov esi, eax
push 0
push esi
call fcn.100119a0
add esp, 0x10
lea ecx, [ebp - 0x244]
mov byte [esi], 0
push ecx
mov dword [ebp - 0x244], 8
call dword [sym.imp.USER32.dll_GetLastInputInfo]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
sub edi, dword [ebp - 0x240]
cmp edi, 0x2bf20
jle 0x10006278
push 0x100256dc
push 0xa
lea edx, [esi + 2]
push edx
jmp 0x10006283
push 0x100256d8
push 0xa
lea eax, [esi + 2]
push eax
call fcn.100103e9
mov eax, 0x10624dd3
imul edi
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x88888889
imul ecx
add edx, ecx
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add esp, 0xc
add ecx, edx
push ecx
lea edx, [esi + 0x16]
push 0x100261fc
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
mov ebx, dword [sym.imp.USER32.dll_GetForegroundWindow]
add esp, 0xc
lea eax, [esi + 0x2a]
push eax
push 0x1f4
push 0xd
call ebx
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 0x238]
mov ecx, dword [ecx + 4]
mov edx, dword [ecx]
mov eax, dword [edx + 8]
push 0x21e
push esi
call eax
push esi
call fcn.1000fccd
push 0x7532
call fcn.10010127
push 0x7532
mov edi, eax
push 0
push edi
call fcn.100119a0
add esp, 0x14
push 0
push 2
mov byte [edi], 2
mov dword [ebp - 0x23c], 0
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x234], eax
cmp eax, 0xffffffff
jne 0x10006351
push str._vz
lea esi, [edi + 2]
push 0x3a98
push esi
call fcn.100101a7
add esp, 0xc
jmp 0x10006479
call ebx
test eax, eax
je 0x10006367
push 0x104
lea ecx, [edi + 2]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea esi, [edi + 2]
mov ecx, 0x10025a8c
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10006397
test dx, dx
je 0x10006393
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10006397
add eax, 4
add ecx, 4
test dx, dx
jne 0x10006371
xor eax, eax
jmp 0x1000639c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x100063b3
push 0x10025750
push 0x3a98
push esi
call fcn.100101a7
add esp, 0xc
push esi
push 0x10026224
push 0x3a98
push esi
call fcn.100101a7
push 0x228
lea edx, [ebp - 0x22c]
push 0
push edx
call fcn.100119a0
mov ecx, dword [ebp - 0x234]
add esp, 0x1c
lea eax, [ebp - 0x230]
push eax
push ecx
mov dword [ebp - 0x230], 0x22c
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x10006479
mov ebx, dword [ebp - 0x23c]
inc ebx
push esi
mov dword [ebp - 0x23c], ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x36b0
jg 0x10006479
mov eax, 0x66666667
imul ebx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
lea edx, [eax + eax*4]
sub ebx, edx
jne 0x10006446
push esi
push 0x10026234
push 0x3a98
push esi
call fcn.100101a7
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
push esi
push str._s___s
push 0x3a98
push esi
call fcn.100101a7
mov edx, dword [ebp - 0x234]
add esp, 0x14
lea ecx, [ebp - 0x230]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x10006400
mov eax, dword [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x238]
mov ecx, dword [ecx + 4]
mov edx, dword [ecx]
mov eax, dword [edx + 8]
push 0x7532
push edi
call eax
push edi
call fcn.1000fccd
mov ecx, dword [ebp - 4]
add esp, 4
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000fb9f
mov esp, ebp
pop ebp
ret 4