Function at 0x1003ae70
Capabilities:
Enumerate processes
Get graphical window text
Terminate process

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004c112
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x2e0
mov eax, dword [0x1005d040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
push 2
mov dword [ebp - 0x2bc], 0
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [ebp - 0x2b4]
push 0x124
push 0
push eax
mov dword [ebp - 0x2c0], esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x2b8], 0x128
lea eax, [ebp - 0x2b8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x1003b447
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
nop dword [eax]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_FindWindowExA]
mov edi, eax
test edi, edi
je 0x1003b426
nop dword [eax + eax]
push 0x100
lea eax, [ebp - 0x118]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0
push 0
push 0xffffffffffffffff
lea eax, [ebp - 0x118]
push eax
push 0
push 0
call esi
mov esi, eax
mov dword [ebp - 0x120], 0
push esi
xorps xmm0, xmm0
mov dword [ebp - 0x11c], 0
push ecx
lea ecx, [ebp - 0x130]
movups xmmword [ebp - 0x130], xmm0
call fcn.10045b30
or dword [ebp - 0x2bc], 1
lea eax, [ebp - 0x130]
cmp dword [ebp - 0x11c], 7
push esi
cmova eax, dword [ebp - 0x130]
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x118]
push eax
push 0
push 0
call esi
push 0
push str.Crossfire
lea ecx, [ebp - 0x130]
mov dword [ebp - 4], 0
call fcn.10044980
cmp eax, 0xffffffff
jne 0x1003b472
push 0
push str.Select_a_process_to_open
lea ecx, [ebp - 0x130]
call fcn.10044980
cmp eax, 0xffffffff
jne 0x1003b472
push 0
push str.This_list_shows_all_the_found_addresses_that_matched_your_last_scan
lea ecx, [ebp - 0x130]
call fcn.10044980
cmp eax, 0xffffffff
jne 0x1003b472
push 0
push str.Delete_all_addresses_from_the_list
lea ecx, [ebp - 0x130]
call fcn.10044980
cmp eax, 0xffffffff
jne 0x1003b472
push 0
push str.Copy_all_selected_items_to_the_address_list
lea ecx, [ebp - 0x130]
call fcn.10044980
cmp eax, 0xffffffff
jne 0x1003b472
push 0
push str.Codelist_and_pause
lea ecx, [ebp - 0x130]
call fcn.10044980
cmp eax, 0xffffffff
jne 0x1003b472
push 0
push str.Type_the_name_of_the_process_you_want_to_automatically_open._Note:_Only_works_when_NO_process_has_been_opened_yet
lea ecx, [ebp - 0x130]
call fcn.10044980
cmp eax, 0xffffffff
jne 0x1003b472
push 0
push str.B___V_0.0.1
lea ecx, [ebp - 0x130]
call fcn.10044980
cmp eax, 0xffffffff
jne 0x1003b472
push 0
push str.N____1.1
lea ecx, [ebp - 0x130]
call fcn.10044980
cmp eax, 0xffffffff
jne 0x1003b472
push 0
push str._.exe
lea ecx, [ebp - 0x130]
call fcn.10044980
cmp eax, 0xffffffff
jne 0x1003b472
push 0
push str._______________
lea ecx, [ebp - 0x130]
call fcn.10044980
cmp eax, 0xffffffff
jne 0x1003b472
push 0
push str.Memory_View
lea ecx, [ebp - 0x130]
call fcn.10044980
cmp eax, 0xffffffff
jne 0x1003b472
push 0
push 0x10054a14
lea ecx, [ebp - 0x130]
call fcn.10044980
cmp eax, 0xffffffff
jne 0x1003b472
push 0
push str.Console_Engine_detected
lea ecx, [ebp - 0x130]
call fcn.10044980
cmp eax, 0xffffffff
jne 0x1003b472
push 0
push str.Crossfire
lea ecx, [ebp - 0x130]
call fcn.10044980
cmp eax, 0xffffffff
jne 0x1003b472
push 0
push str.Auto_Suspender_v0.1_beta
lea ecx, [ebp - 0x130]
call fcn.10044980
cmp eax, 0xffffffff
jne 0x1003b472
push 0
push str.Mellow_Suspender
lea ecx, [ebp - 0x130]
call fcn.10044980
cmp eax, 0xffffffff
jne 0x1003b472
push 0
push str.olaf_007
lea ecx, [ebp - 0x130]
call fcn.10044980
cmp eax, 0xffffffff
jne 0x1003b472
push 0
push str.ZACK_ENGINE_6.7
lea ecx, [ebp - 0x130]
call fcn.10044980
cmp eax, 0xffffffff
jne 0x1003b472
push 0
push str.Address
lea ecx, [ebp - 0x130]
call fcn.10044980
cmp eax, 0xffffffff
jne 0x1003b472
push 0
push str.Memory_View
lea ecx, [ebp - 0x130]
call fcn.10044980
cmp eax, 0xffffffff
jne 0x1003b472
push 0
push str.Copy_to_clipboard
lea ecx, [ebp - 0x130]
call fcn.10044980
cmp eax, 0xffffffff
jne 0x1003b472
push 0
push str.Goto_Address
lea ecx, [ebp - 0x130]
call fcn.10044980
cmp eax, 0xffffffff
jne 0x1003b472
push 0
push str.Enable_Disable_speedhack.__No_hotkey_
lea ecx, [ebp - 0x130]
call fcn.10044980
cmp eax, 0xffffffff
jne 0x1003b472
push 0
push str.Open_a_cheat_table_or_unprotected_cetrainer
lea ecx, [ebp - 0x130]
call fcn.10044980
cmp eax, 0xffffffff
jne 0x1003b472
push 0
push str.Save_your_current_data
lea ecx, [ebp - 0x130]
call fcn.10044980
cmp eax, 0xffffffff
jne 0x1003b472
push 0
push str.address
lea ecx, [ebp - 0x130]
call fcn.10044980
cmp eax, 0xffffffff
jne 0x1003b472
push 0
push str.cheatengine_x86_64.exe
lea ecx, [ebp - 0x130]
call fcn.10044980
cmp eax, 0xffffffff
jne 0x1003b472
push 0
push str.Attach_debugger_to_process
lea ecx, [ebp - 0x130]
call fcn.10044980
cmp eax, 0xffffffff
jne 0x1003b472
push 0
push str.auto_attaching_first_time
lea ecx, [ebp - 0x130]
call fcn.10044980
cmp eax, 0xffffffff
jne 0x1003b472
push 0
push str.attached_to_process
lea ecx, [ebp - 0x130]
call fcn.10044980
cmp eax, 0xffffffff
jne 0x1003b472
push 0
push str.not_attached_to_process
lea ecx, [ebp - 0x130]
call fcn.10044980
cmp eax, 0xffffffff
jne 0x1003b472
push 0
push str.You_will_need_to_run_the_dissect_code_routine_first_before_this_window_is_usable._Run_it_now_
lea ecx, [ebp - 0x130]
call fcn.10044980
cmp eax, 0xffffffff
jne 0x1003b472
push 0
push str.suspicious_dll_name.dll
lea ecx, [ebp - 0x130]
call fcn.10044980
cmp eax, 0xffffffff
jne 0x1003b472
push 0
push str.ollydbg.exe
lea ecx, [ebp - 0x130]
call fcn.10044980
cmp eax, 0xffffffff
jne 0x1003b472
push 0
push str.ida.exe
lea ecx, [ebp - 0x130]
call fcn.10044980
cmp eax, 0xffffffff
jne 0x1003b472
push 0
push str.memoryscanner.exe
lea ecx, [ebp - 0x130]
call fcn.10044980
cmp eax, 0xffffffff
jne 0x1003b472
push 0
push str.bossb_engine
lea ecx, [ebp - 0x130]
call fcn.10044980
cmp eax, 0xffffffff
jne 0x1003b472
push 0
push 0x1003ad70
push edi
call dword [sym.imp.USER32.dll_EnumChildWindows]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x11c]
cmp edx, 7
jbe 0x1003b40f
mov eax, dword [ebp - 0x130]
lea edx, [edx*2 + 2]
mov ecx, eax
cmp edx, 0x1000
jb 0x1003b405
mov eax, dword [ecx - 4]
add edx, 0x23
sub ecx, eax
add ecx, 0xfffffffc
cmp ecx, 0x1f
ja 0x1003b46c
push edx
push eax
call fcn.10049f8a
add esp, 8
push 0
push 0
push edi
push 0
call dword [sym.imp.USER32.dll_FindWindowExA]
mov edi, eax
test edi, edi
jne 0x1003af30
lea eax, [ebp - 0x2b8]
push eax
push dword [ebp - 0x2c0]
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x1003af10
mov esi, dword [ebp - 0x2c0]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10049b4d
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push str.Debugger_Detected_
lea ecx, [ebp - 0x148]
call fcn.10030d60
mov byte [ebp - 4], 1
lea edx, [ebp - 0x148]
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.10045560
push 0x10045320
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
lea ecx, [ebp - 0x160]
call fcn.100383b0
push str.C:UsersPublicPictures_server.png
lea ecx, [ebp - 0x2d8]
mov byte [ebp - 4], 2
call fcn.10030d60
lea ecx, [ebp - 0x2d8]
mov byte [ebp - 4], 3
call fcn.1003a1c0
lea ecx, [ebp - 0x2d8]
mov byte [ebp - 4], 2
call fcn.10030c90
lea ecx, [ebp - 0x178]
call fcn.1003a740
push str.C:UsersPublicPictures_server.png
lea ecx, [ebp - 0x2f0]
mov byte [ebp - 4], 4
call fcn.10030d60
push str._api_webhooks_1275677286427000853_b4tmHrm5wzeJ5AQm1Mu8mdCItJQVPmhF0r4KPf_KIU8Z835F9G_VGVbu6IL_PkjJbTug
lea ecx, [ebp - 0x2d8]
mov byte [ebp - 4], 5
call fcn.10030d60
lea eax, [ebp - 0x2f0]
mov byte [ebp - 4], 6
push eax
lea eax, [ebp - 0x160]
push eax
lea edx, [ebp - 0x2d8]
lea ecx, [ebp - 0x190]
call fcn.10038c50
add esp, 8
lea ecx, [ebp - 0x2d8]
call fcn.10030c90
lea ecx, [ebp - 0x2f0]
call fcn.10030c90
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3