Function at 0x10003820
Capabilities:
Create thread
Enumerate processes
Terminate process

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10005f75
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x258
mov eax, dword [0x1000b040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0xb
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
push str.sandbox.exe
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 0
movups xmmword [ebp - 0x2c], xmm0
call fcn.10003e40
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0
call fcn.100036b0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x18]
mov byte [ebp - 0x261], al
cmp ecx, 7
jbe 0x100038e1
mov edx, dword [ebp - 0x2c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x100038d1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10003a7e
push ecx
push edx
call fcn.10004d98
mov al, byte [ebp - 0x261]
add esp, 8
test al, al
je 0x1000390d
push 0
push 0
push 0
push 0x10003070
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0xb
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
push str.sbiesvc.exe
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 0
movups xmmword [ebp - 0x2c], xmm0
call fcn.10003e40
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 1
call fcn.100036b0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x18]
mov byte [ebp - 0x261], al
cmp ecx, 7
jbe 0x1000398d
mov edx, dword [ebp - 0x2c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1000397d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10003a7e
push ecx
push edx
call fcn.10004d98
mov al, byte [ebp - 0x261]
add esp, 8
test al, al
jne 0x100038e5
push 0x12
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
push str.SandboxieRpcSs.exe
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 0
movups xmmword [ebp - 0x2c], xmm0
call fcn.10003e40
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 2
call fcn.100036b0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x18]
mov byte [ebp - 0x261], al
cmp ecx, 7
jbe 0x10003a11
mov edx, dword [ebp - 0x2c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x10003a01
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10003a7e
push ecx
push edx
call fcn.10004d98
mov al, byte [ebp - 0x261]
add esp, 8
test al, al
jne 0x100038e5
push 0x17
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
push str.SandboxieDcomLaunch.exe
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 0
movups xmmword [ebp - 0x2c], xmm0
call fcn.10003e40
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 3
call fcn.100036b0
mov ecx, dword [ebp - 0x18]
mov byte [ebp - 0x261], al
cmp ecx, 7
jbe 0x10003a94
mov edx, dword [ebp - 0x2c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x10003a84
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10003a84
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.10004d98
mov al, byte [ebp - 0x261]
add esp, 8
push 0
test al, al
jne 0x100038e7
push 2
xor esi, esi
mov dword [ebp - 0x260], 0x22c
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
lea eax, [ebp - 0x260]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x10003b27
nop word [eax + eax]
mov ecx, str.rohanclient.exe
lea eax, [ebp - 0x23c]
nop dword [eax + eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10003b06
test dx, dx
je 0x10003b02
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10003b06
add eax, 4
add ecx, 4
test dx, dx
jne 0x10003ae0
xor ecx, ecx
jmp 0x10003b0b
sbb ecx, ecx
or ecx, 1
test ecx, ecx
lea eax, [esi + 1]
cmovne eax, esi
mov esi, eax
lea eax, [ebp - 0x260]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x10003ad0
cmp edi, 0xffffffff
je 0x10003b33
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 0x63
jle 0x10003b48
push 0
push 0
push 0
push 0x10003050
jmp 0x100038f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10004d37
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret