Function at 0x503900
Capabilities:
Enumerate gui resources
Enumerate processes
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x634
mov eax, dword [0x6a0290]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, 0x5fb314
call fcn.0050b8a0
sub eax, dword [0x6d53e0]
mov dword [0x6d53dc], eax
cmp eax, 0x36ee80
jae 0x50393f
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0058de24
mov esp, ebp
pop ebp
ret
push edi
mov ecx, 0x5fb314
call fcn.0050b8a0
push 0
push 2
mov dword [0x6d53e0], eax
mov dword [ebp - 0x62c], pe_nt_image_headers32
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
jne 0x50397a
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0058de24
mov esp, ebp
pop ebp
ret
push ebx
push esi
lea eax, [ebp - 0x62c]
mov esi, 1
push eax
push edi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x503afe
mov ebx, dword [sym.imp.USER32.dll_EnumWindows]
lea esp, [esp]
cmp esi, 0x400
jg 0x503afe
lea eax, [ebp - 0x608]
push eax
lea eax, [ebp - 0x504]
push eax
call fcn.0058f38c
lea eax, [ebp - 0x608]
push eax
push dword [ebp - 0x624]
push esi
push str.__d_pid_d__s__n
call fcn.005908fc
add esp, 0x18
lea eax, [ebp - 0x504]
mov ecx, str.cheatengine_i386.exe
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x503a05
test dl, dl
je 0x503a01
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x503a05
add eax, 2
add ecx, 2
test dl, dl
jne 0x5039e5
xor eax, eax
jmp 0x503a0a
sbb eax, eax
or eax, 1
test eax, eax
je 0x503b3e
mov ecx, str.cheatengine_x86_64.exe
lea eax, [ebp - 0x504]
lea ecx, [ecx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x503a40
test dl, dl
je 0x503a3c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x503a40
add eax, 2
add ecx, 2
test dl, dl
jne 0x503a20
xor eax, eax
jmp 0x503a45
sbb eax, eax
or eax, 1
test eax, eax
je 0x503b3e
mov ecx, str.cheatengine_x86_64_SSE4_AVX2.exe
lea eax, [ebp - 0x504]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x503a78
test dl, dl
je 0x503a74
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x503a78
add eax, 2
add ecx, 2
test dl, dl
jne 0x503a58
xor eax, eax
jmp 0x503a7d
sbb eax, eax
or eax, 1
test eax, eax
je 0x503b3e
mov eax, dword [ebp - 0x624]
mov dword [ebp - 0x630], 0
mov dword [ebp - 0x630], eax
lea eax, [ebp - 0x634]
push eax
push 0x503b70
mov dword [ebp - 0x634], 0
call ebx
mov eax, dword [ebp - 0x634]
test eax, eax
je 0x503ae8
push 0x100
lea ecx, [ebp - 0x104]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [ebp - 0x104]
push str.Cheat
push eax
call fcn.00590470
add esp, 8
test eax, eax
jne 0x503b18
lea eax, [ebp - 0x62c]
inc esi
push eax
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x5039a0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebx
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0058de24
mov esp, ebp
pop ebp
ret
push 0x190
push 0x20b
call dword [sym.imp.KERNEL32.dll_Beep]
pop esi
pop ebx
mov eax, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0058de24
mov esp, ebp
pop ebp
ret
push 0x190
push 0x337
call dword [sym.imp.KERNEL32.dll_Beep]
mov ecx, dword [ebp - 4]
mov eax, 1
pop esi
pop ebx
xor ecx, ebp
pop edi
call fcn.0058de24
mov esp, ebp
pop ebp
ret