Function at 0x405825
Capabilities:
Enumerate processes

Disassembly:
push ebp
lea ebp, [esp - 0x4d0]
sub esp, 0x54c
mov eax, dword [0x411100]
xor eax, ebp
mov dword [ebp + 0x4cc], eax
push ebx
push esi
push edi
xor ebx, ebx
mov esi, 0x103
push esi
lea eax, [ebp + 0x2c5]
push ebx
push eax
mov dword [ebp - 0x78], ebx
mov byte [ebp - 0x71], bl
mov byte [ebp + 0x2c4], bl
call sub.MSVCR100.dll_memset
push esi
lea eax, [ebp + 0x3c9]
push ebx
push eax
mov byte [ebp + 0x3c8], bl
call sub.MSVCR100.dll_memset
push esi
lea eax, [ebp + 0x1c1]
push ebx
push eax
mov byte [ebp + 0x1c0], bl
call sub.MSVCR100.dll_memset
add esp, 0x24
push ebx
push 2
mov byte [ebp - 0x72], bl
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x405a7b
lea eax, [ebp - 0x6c]
push eax
push edi
mov dword [ebp - 0x6c], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x4058c6
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x405a7b
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x70]
cmp dword [ebp - 0x64], eax
je 0x4058e7
lea eax, [ebp - 0x6c]
push eax
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x4058cf
jmp 0x4058f1
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x78], eax
mov byte [ebp - 0x71], 1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp - 0x71], bl
je 0x405a7b
mov edi, 0x104
push edi
lea eax, [ebp + 0x2c4]
push eax
push dword [ebp - 0x70]
call fcn.0040567b
add esp, 0xc
test al, al
je 0x405a7b
push edi
lea eax, [ebp + 0x3c8]
push eax
push dword [ebp - 0x78]
call fcn.0040567b
add esp, 0xc
test al, al
je 0x405a7b
mov edi, dword [sym.imp.MSVCR100.dll__mbsrchr]
lea eax, [ebp + 0x2c4]
push 0x5c
push eax
call edi
pop ecx
pop ecx
cmp eax, ebx
je 0x405a7b
mov byte [eax], bl
lea eax, [ebp + 0x3c8]
push 0x5c
push eax
call edi
mov edi, eax
pop ecx
pop ecx
cmp edi, ebx
je 0x405a7b
lea ecx, [edi + 1]
mov eax, ecx
lea edx, [eax + 1]
mov dword [ebp - 0x70], edx
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x40597b
sub eax, dword [ebp - 0x70]
push eax
push ecx
lea eax, [ebp + 0x1c0]
push 0x104
push eax
call dword [sym.imp.MSVCR100.dll__mbsnbcpy_s]
lea eax, [ebp + 0x2c4]
mov byte [edi], bl
add esp, 0x10
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4059a7
sub eax, edi
mov dword [ebp - 0x70], eax
lea eax, [ebp + 0x3c8]
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4059bc
sub eax, edi
cmp dword [ebp - 0x70], 2
jbe 0x405a7b
cmp dword [ebp - 0x70], eax
jne 0x405a7b
push 1
lea eax, [ebp + 0x3c8]
push eax
lea eax, [ebp + 0x2c4]
push eax
call dword [sym.imp.MSVCR100.dll__mbsnbicmp]
add esp, 0xc
test eax, eax
jne 0x405a7b
mov eax, dword [ebp - 0x70]
dec eax
push eax
lea eax, [ebp + 0x3c9]
push eax
lea eax, [ebp + 0x2c5]
push eax
call dword [sym.imp.MSVCR100.dll__mbsnbcmp]
add esp, 0xc
test eax, eax
jne 0x405a7b
mov dword [ebp - 0x70], 0x410be8
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
mov dword [ebp - 0x7c], eax
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x405a2b
sub eax, edi
mov edx, eax
lea eax, [ebp + 0x1c0]
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x405a3f
sub eax, edi
cmp edx, ebx
jbe 0x405a68
cmp edx, eax
jne 0x405a68
push edx
lea eax, [ebp + 0x1c0]
push eax
push dword [ebp - 0x7c]
call dword [sym.imp.MSVCR100.dll__mbsnbcmp]
add esp, 0xc
test eax, eax
je 0x405a77
add dword [ebp - 0x70], 4
cmp dword [ebp - 0x70], 0x410bf0
jl 0x405a20
jmp 0x405a7b
mov byte [ebp - 0x72], 1
push esi
lea eax, [ebp + 0xbd]
push ebx
push eax
mov byte [ebp + 0xbc], bl
call sub.MSVCR100.dll_memset
push dword [ebp - 0x78]
lea eax, [ebp + 0xbc]
push str.JP2LReadyEvent__d
push 0x104
push eax
call dword [sym.imp.MSVCR100.dll__snprintf]
add esp, 0x1c
lea eax, [ebp + 0xbc]
push eax
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
cmp esi, ebx
je 0x405ad1
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0x4cc]
mov al, byte [ebp - 0x72]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00409df2
add ebp, 0x4d0
leave
ret