Function at 0x1003b5e0
Capabilities:
Enumerate processes
Get graphical window text
Terminate process

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004c3c7
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x2c8
mov eax, dword [0x1005d040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
push 2
mov dword [ebp - 0x2a4], 0
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [ebp - 0x29c]
push 0x124
push 0
push eax
mov dword [ebp - 0x2a8], esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x2a0], 0x128
lea eax, [ebp - 0x2a0]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x1003bbbb
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
nop dword [eax]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_FindWindowExA]
mov edi, eax
test edi, edi
je 0x1003bb9a
nop dword [eax + eax]
push 0x100
lea eax, [ebp - 0x118]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0
push 0
push 0xffffffffffffffff
lea eax, [ebp - 0x118]
push eax
push 0
push 0
call esi
mov esi, eax
mov dword [ebp - 0x120], 0
push esi
xorps xmm0, xmm0
mov dword [ebp - 0x11c], 0
push ecx
lea ecx, [ebp - 0x130]
movups xmmword [ebp - 0x130], xmm0
call fcn.10045de0
or dword [ebp - 0x2a4], 1
lea eax, [ebp - 0x130]
cmp dword [ebp - 0x11c], 7
push esi
cmova eax, dword [ebp - 0x130]
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x118]
push eax
push 0
push 0
call esi
push 0
push str.Crossfire
lea ecx, [ebp - 0x130]
mov dword [ebp - 4], 0
call fcn.10044d20
cmp eax, 0xffffffff
jne 0x1003bbe0
push 0
push str.Select_a_process_to_open
lea ecx, [ebp - 0x130]
call fcn.10044d20
cmp eax, 0xffffffff
jne 0x1003bbe0
push 0
push str.This_list_shows_all_the_found_addresses_that_matched_your_last_scan
lea ecx, [ebp - 0x130]
call fcn.10044d20
cmp eax, 0xffffffff
jne 0x1003bbe0
push 0
push str.Delete_all_addresses_from_the_list
lea ecx, [ebp - 0x130]
call fcn.10044d20
cmp eax, 0xffffffff
jne 0x1003bbe0
push 0
push str.Copy_all_selected_items_to_the_address_list
lea ecx, [ebp - 0x130]
call fcn.10044d20
cmp eax, 0xffffffff
jne 0x1003bbe0
push 0
push str.Codelist_and_pause
lea ecx, [ebp - 0x130]
call fcn.10044d20
cmp eax, 0xffffffff
jne 0x1003bbe0
push 0
push str.Type_the_name_of_the_process_you_want_to_automatically_open._Note:_Only_works_when_NO_process_has_been_opened_yet
lea ecx, [ebp - 0x130]
call fcn.10044d20
cmp eax, 0xffffffff
jne 0x1003bbe0
push 0
push str.B___V_0.0.1
lea ecx, [ebp - 0x130]
call fcn.10044d20
cmp eax, 0xffffffff
jne 0x1003bbe0
push 0
push str.N____1.1
lea ecx, [ebp - 0x130]
call fcn.10044d20
cmp eax, 0xffffffff
jne 0x1003bbe0
push 0
push str._.exe
lea ecx, [ebp - 0x130]
call fcn.10044d20
cmp eax, 0xffffffff
jne 0x1003bbe0
push 0
push str._______________
lea ecx, [ebp - 0x130]
call fcn.10044d20
cmp eax, 0xffffffff
jne 0x1003bbe0
push 0
push str.Memory_View
lea ecx, [ebp - 0x130]
call fcn.10044d20
cmp eax, 0xffffffff
jne 0x1003bbe0
push 0
push 0x10054ac4
lea ecx, [ebp - 0x130]
call fcn.10044d20
cmp eax, 0xffffffff
jne 0x1003bbe0
push 0
push str.Console_Engine_detected
lea ecx, [ebp - 0x130]
call fcn.10044d20
cmp eax, 0xffffffff
jne 0x1003bbe0
push 0
push str.Crossfire
lea ecx, [ebp - 0x130]
call fcn.10044d20
cmp eax, 0xffffffff
jne 0x1003bbe0
push 0
push str.Auto_Suspender_v0.1_beta
lea ecx, [ebp - 0x130]
call fcn.10044d20
cmp eax, 0xffffffff
jne 0x1003bbe0
push 0
push str.Mellow_Suspender
lea ecx, [ebp - 0x130]
call fcn.10044d20
cmp eax, 0xffffffff
jne 0x1003bbe0
push 0
push str.olaf_007
lea ecx, [ebp - 0x130]
call fcn.10044d20
cmp eax, 0xffffffff
jne 0x1003bbe0
push 0
push str.ZACK_ENGINE_6.7
lea ecx, [ebp - 0x130]
call fcn.10044d20
cmp eax, 0xffffffff
jne 0x1003bbe0
push 0
push str.Address
lea ecx, [ebp - 0x130]
call fcn.10044d20
cmp eax, 0xffffffff
jne 0x1003bbe0
push 0
push str.Memory_View
lea ecx, [ebp - 0x130]
call fcn.10044d20
cmp eax, 0xffffffff
jne 0x1003bbe0
push 0
push str.Copy_to_clipboard
lea ecx, [ebp - 0x130]
call fcn.10044d20
cmp eax, 0xffffffff
jne 0x1003bbe0
push 0
push str.Goto_Address
lea ecx, [ebp - 0x130]
call fcn.10044d20
cmp eax, 0xffffffff
jne 0x1003bbe0
push 0
push str.Enable_Disable_speedhack.__No_hotkey_
lea ecx, [ebp - 0x130]
call fcn.10044d20
cmp eax, 0xffffffff
jne 0x1003bbe0
push 0
push str.Open_a_cheat_table_or_unprotected_cetrainer
lea ecx, [ebp - 0x130]
call fcn.10044d20
cmp eax, 0xffffffff
jne 0x1003bbe0
push 0
push str.Save_your_current_data
lea ecx, [ebp - 0x130]
call fcn.10044d20
cmp eax, 0xffffffff
jne 0x1003bbe0
push 0
push str.address
lea ecx, [ebp - 0x130]
call fcn.10044d20
cmp eax, 0xffffffff
jne 0x1003bbe0
push 0
push str.cheatengine_x86_64.exe
lea ecx, [ebp - 0x130]
call fcn.10044d20
cmp eax, 0xffffffff
jne 0x1003bbe0
push 0
push str.Attach_debugger_to_process
lea ecx, [ebp - 0x130]
call fcn.10044d20
cmp eax, 0xffffffff
jne 0x1003bbe0
push 0
push str.auto_attaching_first_time
lea ecx, [ebp - 0x130]
call fcn.10044d20
cmp eax, 0xffffffff
jne 0x1003bbe0
push 0
push str.attached_to_process
lea ecx, [ebp - 0x130]
call fcn.10044d20
cmp eax, 0xffffffff
jne 0x1003bbe0
push 0
push str.not_attached_to_process
lea ecx, [ebp - 0x130]
call fcn.10044d20
cmp eax, 0xffffffff
jne 0x1003bbe0
push 0
push str.You_will_need_to_run_the_dissect_code_routine_first_before_this_window_is_usable._Run_it_now_
lea ecx, [ebp - 0x130]
call fcn.10044d20
cmp eax, 0xffffffff
jne 0x1003bbe0
push 0
push str.suspicious_dll_name.dll
lea ecx, [ebp - 0x130]
call fcn.10044d20
cmp eax, 0xffffffff
jne 0x1003bbe0
push 0
push str.ollydbg.exe
lea ecx, [ebp - 0x130]
call fcn.10044d20
cmp eax, 0xffffffff
jne 0x1003bbe0
push 0
push str.ida.exe
lea ecx, [ebp - 0x130]
call fcn.10044d20
cmp eax, 0xffffffff
jne 0x1003bbe0
push 0
push str.memoryscanner.exe
lea ecx, [ebp - 0x130]
call fcn.10044d20
cmp eax, 0xffffffff
jne 0x1003bbe0
push 0
push str.bossb_engine
lea ecx, [ebp - 0x130]
call fcn.10044d20
cmp eax, 0xffffffff
jne 0x1003bbe0
push 0
push 0x1003b340
push edi
call dword [sym.imp.USER32.dll_EnumChildWindows]
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x11c]
cmp ecx, 7
jbe 0x1003bb83
mov edx, dword [ebp - 0x130]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1003bb79
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003bc5e
push ecx
push edx
call fcn.1004a23a
add esp, 8
push 0
push 0
push edi
push 0
call dword [sym.imp.USER32.dll_FindWindowExA]
mov edi, eax
test edi, edi
jne 0x1003b6a0
lea eax, [ebp - 0x2a0]
push eax
push dword [ebp - 0x2a8]
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x1003b680
mov esi, dword [ebp - 0x2a8]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10049dfd
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
lea ecx, [ebp - 0x160]
call fcn.10038370
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c0]
push 0x13
xorps xmm0, xmm0
mov dword [ebp - 0x2b0], 0
push str.datagui_server.png
movups xmmword [ebp - 0x2c0], xmm0
mov dword [ebp - 0x2ac], 0
call fcn.100315a0
lea ecx, [ebp - 0x2c0]
mov byte [ebp - 4], 2
call fcn.1003a740
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x2ac]
cmp ecx, 0xf
jbe 0x1003bc6e
mov edx, dword [ebp - 0x2c0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1003bc64
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1003bc64
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.1004a23a
add esp, 8
lea ecx, [ebp - 0x148]
call fcn.1003acc0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2d8]
push 0x13
xorps xmm0, xmm0
mov dword [ebp - 0x2c8], 0
push str.datagui_server.png
movups xmmword [ebp - 0x2d8], xmm0
mov dword [ebp - 0x2c4], 0
call fcn.100315a0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2c0]
push 0x66
xorps xmm0, xmm0
mov dword [ebp - 0x2b0], 0
push str._api_webhooks_1275677286427000853_b4tmHrm5wzeJ5AQm1Mu8mdCItJQVPmhF0r4KPf_KIU8Z835F9G_VGVbu6IL_PkjJbTug
movups xmmword [ebp - 0x2c0], xmm0
mov dword [ebp - 0x2ac], 0
call fcn.100315a0
lea eax, [ebp - 0x2d8]
mov byte [ebp - 4], 5
push eax
lea eax, [ebp - 0x160]
push eax
lea edx, [ebp - 0x2c0]
lea ecx, [ebp - 0x178]
call fcn.100391d0
mov ecx, dword [ebp - 0x2ac]
add esp, 8
cmp ecx, 0xf
jbe 0x1003bd3d
mov edx, dword [ebp - 0x2c0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1003bd33
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003bd84
push ecx
push edx
call fcn.1004a23a
add esp, 8
mov ecx, dword [ebp - 0x2c4]
mov dword [ebp - 0x2b0], 0
mov dword [ebp - 0x2ac], 0xf
mov byte [ebp - 0x2c0], 0
cmp ecx, 0xf
jbe 0x1003bd94
mov edx, dword [ebp - 0x2d8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1003bd8a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1003bd8a
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.1004a23a
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 0x164]
cmp ecx, 0xf
jbe 0x1003bddd
mov edx, dword [ebp - 0x178]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1003bdd3
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003be9e
push ecx
push edx
call fcn.1004a23a
add esp, 8
mov ecx, dword [ebp - 0x134]
cmp ecx, 0xf
jbe 0x1003be17
mov edx, dword [ebp - 0x148]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1003be0d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003be9e
push ecx
push edx
call fcn.1004a23a
add esp, 8
mov ecx, dword [ebp - 0x14c]
mov dword [ebp - 0x138], 0
mov dword [ebp - 0x134], 0xf
mov byte [ebp - 0x148], 0
cmp ecx, 0xf
jbe 0x1003be68
mov edx, dword [ebp - 0x160]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1003be5e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003be9e
push ecx
push edx
call fcn.1004a23a
add esp, 8
mov ecx, dword [ebp - 0x11c]
cmp ecx, 7
jbe 0x1003bbc2
mov edx, dword [ebp - 0x130]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1003bea4
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1003bea4
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.1004a23a
add esp, 8
jmp 0x1003bbc2