Function at 0x7d266e70
Capabilities:
Create thread
Resolve function by parsing pe exports
Resume thread

Disassembly:
sub esp, 0x16c
cmp byte [esp + 0x174], 0x2a
push ebx
push ebp
push esi
push edi
mov byte [esp + 0x13], 1
jne 0x7d266f1f
mov eax, dword [esp + 0x180]
push eax
mov ecx, dword [eax + 8]
mov ebx, dword [eax + 4]
mov edi, dword [eax + 0xc]
mov dword [esp + 0x1c], ecx
call fcn.7d221537
mov ecx, dword [esp + 0x18]
xor eax, eax
mov ebp, dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
test edi, edi
push 0x7530
mov dword [esp + 0x24], ecx
setne al
push 0
lea ecx, [esp + 0x28]
mov dword [esp + 0x2c], edi
inc eax
push ecx
push eax
mov dword [esp + 0x2c], eax
call ebp
mov dword [esp + 0x14], eax
test eax, eax
je 0x7d267227
mov esi, dword [esp + 0x1c]
cmp eax, 1
je 0x7d2671c7
push 0xffffffffffffffff
push ebx
push dword [0x7d2b64d0]
push 0x89c
call sym.SbieDll.dll_SbieApi_Log
add esp, 0x10
lea eax, [esp + 0x20]
push 0x7530
push 0
push eax
push esi
call ebp
mov dword [esp + 0x14], eax
test eax, eax
jne 0x7d266ee4
jmp 0x7d267227
mov eax, dword [0x7d2b7358]
cmp eax, 1
jne 0x7d266f4e
push dword [0x7d2b64cc]
push dword [esp + 0x184]
call sub.ntdll.dll__wcsicmp
add esp, 8
test eax, eax
jne 0x7d26712e
mov ebx, dword [str.DcomLaunch]
jmp 0x7d266f7a
cmp eax, 2
je 0x7d26712e
push dword [0x7d2b64c8]
push dword [esp + 0x184]
call sub.ntdll.dll__wcsicmp
add esp, 8
test eax, eax
jne 0x7d26712e
mov ebx, dword [str.RpcSs]
push ebx
push str.SBIE_BOXED_ServiceInitComplete__s
lea eax, [esp + 0x104]
push 0x40
push eax
call sym.SbieDll.dll_Sbie_snwprintf
add esp, 0x10
lea eax, [esp + 0xfc]
push eax
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ebp, eax
mov dword [esp + 0x18], eax
test ebp, ebp
je 0x7d26714d
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x7d26714d
xorps xmm0, xmm0
mov dword [esp + 0x54], eax
movlpd qword [esp + 0x5c], xmm0
mov edx, ebx
movlpd qword [esp + 0x3c], xmm0
mov esi, edx
movlpd qword [esp + 0x44], xmm0
movlpd qword [esp + 0x4c], xmm0
movlpd qword [esp + 0x68], xmm0
movlpd qword [esp + 0x70], xmm0
movups xmm0, xmmword [0x7d2995cc]
mov dword [esp + 0x78], eax
mov eax, dword [str.sbox5.58.0]
mov dword [esp + 0x5c], eax
mov dword [esp + 0x58], eax
mov eax, dword [0x7d2995dc]
mov dword [esp + 0x38], 0x44
mov dword [esp + 0x64], 0x80
movups xmmword [esp + 0x7c], xmm0
mov dword [esp + 0x8c], eax
nop word [eax + eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x7d267030
lea edi, [esp + 0x7c]
sub edx, esi
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x7d267044
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x7c]
add ecx, 0xfffffffe
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x7d267065
mov eax, dword [str..exe]
mov dword [ecx], eax
mov eax, dword [0x7d29f260]
mov dword [ecx + 4], eax
mov ax, word [0x7d29f264]
mov word [ecx + 8], ax
cmp ebx, dword [str.RpcSs]
jne 0x7d2670e7
push 1
call fcn.7d221825
test eax, eax
jne 0x7d2670a4
mov esi, 0x51d
jmp 0x7d267112
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x3c]
push eax
push 0
push dword [0x7d2b7320]
push str.RPCSS
push 0x7d2990cc
call sym.SbieDll.dll_SbieDll_RunSandboxed
test eax, eax
jne 0x7d2670db
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
push 0
mov esi, eax
call fcn.7d221825
jmp 0x7d26710d
push 0
or esi, 0xffffffff
call fcn.7d221825
jmp 0x7d26710d
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x3c]
push eax
push 0
lea eax, [esp + 0x88]
push eax
call sym.SbieDll.dll_SbieDll_RunFromHome
test al, al
jne 0x7d26713d
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov esi, eax
cmp esi, 0xffffffff
je 0x7d26713d
push esi
push ebx
push dword [0x7d2b64d0]
push 0x89c
call sym.SbieDll.dll_SbieApi_Log
add esp, 0x10
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x16c
ret 8
push dword [esp + 0x2c]
mov edi, dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x7d267157
mov dword [esp + 0x18], ebp
test ebp, ebp
je 0x7d26712e
xor edi, edi
cmp byte [esp + 0x184], 0
je 0x7d266ea7
push 0x10
call fcn.7d221505
mov ecx, dword [esp + 0x180]
mov dword [eax], ecx
lea ecx, [esp + 0x1c]
push ecx
push 4
push eax
push 0x7d267490
push 0
push 0
mov dword [eax + 4], ebx
mov dword [eax + 8], ebp
mov dword [eax + 0xc], edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x7d267331
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [esp + 0x13]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x16c
ret 8
lea eax, [esp + 0x14]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x7d267211
mov eax, dword [esp + 0x14]
test eax, eax
je 0x7d267211
cmp eax, 0x103
je 0x7d267211
cmp eax, 0xc0000259
je 0x7d267227
push eax
push eax
test eax, 0x80000000
mov eax, dword [str._S___d_]
push ebx
cmovne eax, dword [str._S___08X_]
push eax
push 0x89c
call sym.SbieDll.dll_SbieApi_Log
add esp, 0x14
jmp 0x7d267227
push 0xfffffffffffffffd
push ebx
push dword [0x7d2b64d0]
push 0x89c
call sym.SbieDll.dll_SbieApi_Log
add esp, 0x10
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, dword [str.RpcSs]
jne 0x7d267324
call sym.SbieDll.dll_SbieDll_IsOpenCOM
test al, al
jne 0x7d267324
push 0
push dword [0x7d2b64dc]
call fcn.7d221de3
test eax, eax
je 0x7d267324
push eax
xor esi, esi
call dword [sym.imp.ntdll.dll_NtClose]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov ebp, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test esi, esi
jne 0x7d2672d8
push dword [0x7d2b64dc]
lea eax, [esp + 0x100]
push str.SBIE_BOXED_ServiceInitComplete__s
push 0x40
push eax
call sym.SbieDll.dll_Sbie_snwprintf
add esp, 0x10
lea eax, [esp + 0xfc]
push eax
push esi
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov esi, eax
test esi, esi
jne 0x7d2672d8
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x7d2672d2
mov eax, dword [esp + 0x14]
test eax, eax
je 0x7d2672d2
cmp eax, 0x103
jne 0x7d267304
push 0x32
call ebx
jmp 0x7d267274
push 0x7530
push esi
call ebp
test eax, eax
je 0x7d267342
push 0xfffffffffffffffe
push dword [0x7d2b64dc]
push dword [0x7d2b64d0]
push 0x89c
call sym.SbieDll.dll_SbieApi_Log
add esp, 0x10
jmp 0x7d267274
push 0xfffffffffffffffc
push dword [0x7d2b64dc]
push dword [0x7d2b64d0]
push 0x89c
call sym.SbieDll.dll_SbieApi_Log
add esp, 0x10
mov byte [esp + 0x13], 0
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x7d267331
push edi
call ebx
mov al, byte [esp + 0x13]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x16c
ret 8
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call ebx
jmp 0x7d26732a