Function at 0x402f00
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1e4
mov eax, dword [0x405034]
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push edi
push 0x800
push 4
mov dword [ebp - 4], eax
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
call ebx
mov dword [ebp - 0x1d4], eax
xor eax, eax
push 0x800
push 4
mov dword [ebp - 0x1cc], eax
mov dword [ebp - 0x1dc], eax
mov byte [ebp - 0x1cd], al
call esi
push eax
call ebx
push 0xf0
mov edi, eax
lea eax, [ebp - 0x104]
push eax
push 0x20000000
push 0x40197c
push 0
call sub.SbieDll.dll__SbieApi_QueryConf_20
test eax, eax
jne 0x402fbd
jmp 0x402f80
lea ecx, [ebp - 0x104]
push ecx
lea edx, [ebp - 0x1cc]
push edx
push edi
call fcn.00402e90
mov ecx, dword [ebp - 0x1cc]
push 0xf0
lea eax, [ebp - 0x104]
push eax
or ecx, 0x20000000
push ecx
push 0x40197c
push 0
call sub.SbieDll.dll__SbieApi_QueryConf_20
test eax, eax
je 0x402f80
mov edx, dword [0x405018]
push edx
lea eax, [ebp - 0x1cc]
push eax
push edi
call fcn.00402e90
mov ecx, dword [0x40501c]
push ecx
lea edx, [ebp - 0x1cc]
push edx
push edi
call fcn.00402e90
mov eax, dword [0x405020]
push eax
lea ecx, [ebp - 0x1cc]
push ecx
push edi
call fcn.00402e90
mov edx, dword [0x405024]
push edx
lea eax, [ebp - 0x1cc]
push eax
push edi
call fcn.00402e90
mov ecx, dword [0x405028]
push ecx
lea edx, [ebp - 0x1cc]
push edx
push edi
call fcn.00402e90
mov eax, dword [0x40502c]
push eax
lea ecx, [ebp - 0x1cc]
push ecx
push edi
call fcn.00402e90
mov edx, dword [ebp - 0x1d4]
push edx
push 0xffffffffffffffff
push 0
push 0
call sub.SbieDll.dll__SbieApi_EnumProcessEx_16
mov eax, dword [ebp - 0x1d4]
cmp dword [eax], 1
mov dword [ebp - 0x1d8], 1
jb 0x4030e2
mov edi, edi
mov ecx, dword [ebp - 0x1d4]
mov edx, dword [ebp - 0x1d8]
mov ebx, dword [ecx + edx*4]
push 0
push 0
lea eax, [ebp - 0x104]
push eax
push 0
push ebx
call sub.SbieDll.dll__SbieApi_QueryProcess_20
mov eax, dword [ebp - 0x1cc]
xor esi, esi
test eax, eax
jbe 0x4030bd
mov edi, edi
mov edx, dword [edi + esi*4]
lea ecx, [ebp - 0x104]
push ecx
add edx, 8
push edx
call dword [sym.imp.msvcrt.dll__wcsicmp]
add esp, 8
test eax, eax
je 0x4030b8
mov eax, dword [ebp - 0x1cc]
inc esi
cmp esi, eax
jb 0x403090
jmp 0x4030bd
mov eax, dword [edi + esi*4]
mov dword [eax], ebx
mov eax, dword [ebp - 0x1d8]
mov ecx, dword [ebp - 0x1d4]
mov edx, dword [ecx]
inc eax
cmp eax, edx
mov dword [ebp - 0x1d8], eax
jbe 0x403060
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov ebx, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push 0x800
push 4
call esi
push eax
call ebx
push 0xf0
lea edx, [ebp - 0x104]
push edx
push 0x20000000
push 0x401960
mov esi, eax
push 0
mov dword [ebp - 0x1e4], esi
call sub.SbieDll.dll__SbieApi_QueryConf_20
test eax, eax
jne 0x403160
jmp 0x403120
lea eax, [ebp - 0x104]
push eax
lea ecx, [ebp - 0x1dc]
push ecx
push esi
call fcn.00402e90
mov eax, dword [ebp - 0x1dc]
push 0xf0
lea edx, [ebp - 0x104]
push edx
or eax, 0x20000000
push eax
push 0x401960
push 0
call sub.SbieDll.dll__SbieApi_QueryConf_20
test eax, eax
je 0x403120
lea esp, [esp]
mov eax, dword [0x405064]
test eax, eax
je 0x40316d
test al, 2
je 0x403177
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x403160
push 0xf0
lea ecx, [ebp - 0x104]
push ecx
push 0x20000000
push 0x401944
xor esi, esi
push esi
call sub.SbieDll.dll__SbieApi_QueryConf_20
test eax, eax
jne 0x4031d4
lea esp, [esp]
push 1
lea edx, [ebp - 0x104]
push edx
call sub.SbieDll.dll__SbieDll_StartBoxedService_8
push 0xf0
inc esi
lea eax, [ebp - 0x104]
push eax
mov ecx, esi
or ecx, 0x20000000
push ecx
push 0x401944
push 0
call sub.SbieDll.dll__SbieApi_QueryConf_20
test eax, eax
je 0x4031a0
push 0xf0
lea edx, [ebp - 0x104]
push edx
push 0x20000000
push 0x401928
xor esi, esi
push esi
call sub.SbieDll.dll__SbieApi_QueryConf_20
test eax, eax
jne 0x403232
jmp 0x403200
lea eax, [ebp - 0x104]
push eax
call sub.SbieDll.dll__SbieDll_ExpandAndRunProgram_4
push 0xf0
inc esi
lea ecx, [ebp - 0x104]
push ecx
mov edx, esi
or edx, 0x20000000
push edx
push 0x401928
push 0
call sub.SbieDll.dll__SbieApi_QueryConf_20
test eax, eax
je 0x403200
xor al, al
xor bl, bl
test al, al
mov byte [ebp - 0x1cf], bl
mov dword [ebp - 0x1e0], 1
mov byte [ebp - 0x1c5], 1
jne 0x40325c
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [ebp - 0x1d4]
push esi
push 0xffffffffffffffff
push 0
push 0
mov byte [ebp - 0x1d0], 0
call sub.SbieDll.dll__SbieApi_EnumProcessEx_16
cmp dword [esi], 1
mov dword [ebp - 0x1d8], 1
jb 0x4033ff
jmp 0x403290
mov eax, dword [ebp - 0x1d8]
mov ebx, dword [esi + eax*4]
push 1
lea ecx, [ebp - 0x1c4]
push ecx
xor eax, eax
lea edx, [ebp - 0x104]
push edx
push eax
push ebx
mov byte [ebp - 0x1ce], 0
mov word [ebp - 0x104], ax
mov word [ebp - 0x1c4], ax
call sub.SbieDll.dll__SbieApi_QueryProcess_20
cmp eax, 0xc0000121
mov esi, dword [sym.imp.msvcrt.dll__wcsicmp]
jne 0x403306
mov eax, dword [0x40501c]
push eax
lea ecx, [ebp - 0x104]
push ecx
call esi
add esp, 8
test eax, eax
je 0x403306
lea edx, [ebp - 0x1c4]
push 0x401270
push edx
call esi
add esp, 8
test eax, eax
je 0x403306
mov byte [ebp - 0x1ce], 1
mov eax, dword [0x405004]
push eax
lea ecx, [ebp - 0x104]
push ecx
call esi
add esp, 8
test eax, eax
je 0x4033da
mov eax, dword [ebp - 0x1dc]
xor esi, esi
test eax, eax
jbe 0x403365
lea esp, [esp]
mov eax, dword [ebp - 0x1e4]
mov ecx, dword [eax + esi*4]
lea edx, [ebp - 0x104]
push edx
add ecx, 8
push ecx
call dword [sym.imp.msvcrt.dll__wcsicmp]
add esp, 8
test eax, eax
je 0x40335e
mov eax, dword [ebp - 0x1dc]
inc esi
cmp esi, eax
jb 0x403330
jmp 0x403365
mov byte [ebp - 0x1cf], 1
mov eax, dword [ebp - 0x1cc]
xor esi, esi
cmp esi, eax
mov dword [ebp - 0x1e0], esi
jae 0x4033d1
jmp 0x403380
mov eax, dword [edi + esi*4]
lea edx, [ebp - 0x104]
push edx
add eax, 8
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
add esp, 8
test eax, eax
je 0x4033a8
mov eax, dword [ebp - 0x1cc]
inc esi
cmp esi, eax
jb 0x403380
jmp 0x4033cb
mov al, byte [ebp - 0x1ce]
test al, al
mov ecx, dword [edi + esi*4]
mov dword [ecx + 4], ebx
je 0x4033bd
mov edx, dword [edi + esi*4]
mov dword [edx], ebx
mov eax, dword [edi + esi*4]
cmp ebx, dword [eax]
jne 0x4033cb
mov byte [ebp - 0x1c5], 0
cmp esi, dword [ebp - 0x1cc]
jne 0x4033da
mov byte [ebp - 0x1c5], 0
mov eax, dword [ebp - 0x1d8]
mov ecx, dword [ebp - 0x1d4]
mov edx, dword [ecx]
inc eax
cmp eax, edx
mov dword [ebp - 0x1d8], eax
mov esi, ecx
jbe 0x403290
mov bl, byte [ebp - 0x1cf]
mov al, byte [ebp - 0x1cd]
test al, al
je 0x40340d
test bl, bl
je 0x40346f
mov al, byte [ebp - 0x1c5]
test al, al
mov byte [ebp - 0x1cd], bl
je 0x40345a
mov ebx, dword [ebp - 0x1cc]
xor esi, esi
test ebx, ebx
jbe 0x40345a
lea esp, [esp]
mov edx, dword [edi + esi*4]
mov eax, dword [edx + 4]
test eax, eax
je 0x403455
push eax
call sub.SbieDll.dll__SbieDll_KillOne_4
test al, al
je 0x40344e
mov eax, dword [edi + esi*4]
mov dword [eax + 4], 0
mov byte [ebp - 0x1d0], 1
inc esi
cmp esi, ebx
jb 0x403430
mov eax, dword [ebp - 0x1e0]
test eax, eax
jne 0x4034a4
mov al, byte [ebp - 0x1d0]
jmp 0x403234
mov eax, dword [esi]
mov edi, 1
cmp eax, edi
jb 0x4034a4
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
jmp 0x403488
mov esi, dword [ebp - 0x1d4]
mov esi, dword [esi + edi*4]
call ebx
cmp esi, eax
je 0x403497
push esi
call sub.SbieDll.dll__SbieDll_KillOne_4
mov ecx, dword [ebp - 0x1d4]
mov eax, dword [ecx]
inc edi
cmp edi, eax
jbe 0x403482
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]