Function at 0x3409223d
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x341a48e4], 0
je 0x34092254
mov eax, 1
jmp 0x34092a45
cmp dword [0x341a48e0], 0
je 0x3409226d
cmp dword [ebp + 8], 0
jne 0x3409226d
mov eax, 1
jmp 0x34092a45
mov dword [0x341a48e0], 1
mov dword [ebp - 4], 0x341a48e8
push 0x341a48e8
call fcn.340bd4b7
add esp, 4
test eax, eax
jne 0x34092296
mov dword [ebp - 4], 0x3418cd1c
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x341a48e4], eax
cmp dword [0x341a48e4], 0
je 0x34092a39
push str.LoadTsdLogDrv
mov ecx, dword [0x341a48e4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a478c], eax
push str.UnloadTsdLogDrv
mov edx, dword [0x341a48e4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a4790], eax
push str.LoadDriver
mov eax, dword [0x341a48e4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a4794], eax
push str.UnloadDriver
mov ecx, dword [0x341a48e4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a4798], eax
push str.RegisterSandboxClass
mov edx, dword [0x341a48e4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a479c], eax
push str.UnregisterSandboxClass
mov eax, dword [0x341a48e4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a47a0], eax
push str.EnumSandboxClassName
mov ecx, dword [0x341a48e4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a47a4], eax
push str.QuerySandboxClassInformation
mov edx, dword [0x341a48e4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a47a8], eax
push str.CreateSandboxInstance
mov eax, dword [0x341a48e4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a47ac], eax
push str.CreateSandboxInstanceEx
mov ecx, dword [0x341a48e4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a47b0], eax
push str.DestroySandboxInstance
mov edx, dword [0x341a48e4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a47b4], eax
push str.EnumSandboxInstanceName
mov eax, dword [0x341a48e4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a47b8], eax
push str.QuerySandboxInstanceInformation
mov ecx, dword [0x341a48e4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a47bc], eax
push str.DeleteSandboxData
mov edx, dword [0x341a48e4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a47c0], eax
push str.GetSandboxPolicyLib
mov eax, dword [0x341a48e4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a47c4], eax
push str.SetSandboxPolicyLib
mov ecx, dword [0x341a48e4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a47c8], eax
push str.SetSandboxPolicyLibFile
mov edx, dword [0x341a48e4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a47cc], eax
push str.UpdateSystemPolicyLib
mov eax, dword [0x341a48e4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a47d0], eax
push str.SetSystemPolicyLibPath
mov ecx, dword [0x341a48e4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a47d4], eax
push str.GetSystemPolicyLibPath
mov edx, dword [0x341a48e4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a47d8], eax
push str.SetSandboxProcessCommonPolicy
mov eax, dword [0x341a48e4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a47dc], eax
push str.SetSandboxProcessCommonPolicyEx
mov ecx, dword [0x341a48e4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a47e0], eax
push str.GetSandboxProcessCommonPolicy
mov edx, dword [0x341a48e4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a47e4], eax
push str.SetSandboxProcessPolicy
mov eax, dword [0x341a48e4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a47e8], eax
push str.SetProcessFilePolicy
mov ecx, dword [0x341a48e4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a47ec], eax
push str.SetProcessObjectPolicy
mov edx, dword [0x341a48e4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a47f0], eax
push str.SetProcessRegPolicy
mov eax, dword [0x341a48e4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a47f4], eax
push str.SetProcessWindowPolicy
mov ecx, dword [0x341a48e4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a47f8], eax
push str.SetProcessAccessPolicy
mov edx, dword [0x341a48e4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a47fc], eax
push str.AddSandboxProcess
mov eax, dword [0x341a48e4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a4800], eax
push str.DelSandboxProcess
mov ecx, dword [0x341a48e4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a4804], eax
push str.GetSandboxProcessFlags
mov edx, dword [0x341a48e4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a4808], eax
push str.SetSandboxProcessFlags
mov eax, dword [0x341a48e4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a480c], eax
push str.GetSandboxProcessState
mov ecx, dword [0x341a48e4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a4810], eax
push str.SetSandboxProcessState
mov edx, dword [0x341a48e4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a4814], eax
push str.RegisterCallback
mov eax, dword [0x341a48e4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a4818], eax
push str.RegisterTSafeDocCallback
mov ecx, dword [0x341a48e4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a481c], eax
push str.EnumSandboxRunningProcess
mov edx, dword [0x341a48e4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a4820], eax
push str.UpdateSandboxRunningProcess
mov eax, dword [0x341a48e4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a4824], eax
push str.UpdateDriveData
mov ecx, dword [0x341a48e4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a4828], eax
push str.GetSandboxFilePath
mov edx, dword [0x341a48e4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a482c], eax
push str.GetSandboxProcessFilePath
mov eax, dword [0x341a48e4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a4830], eax
push str.GenerateSandboxFilePath
mov ecx, dword [0x341a48e4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a4834], eax
push str.ParseSandboxFilePath
mov edx, dword [0x341a48e4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a4838], eax
push str.GenerateSandboxRegPath
mov eax, dword [0x341a48e4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a483c], eax
push str.ParseSandboxRegPath
mov ecx, dword [0x341a48e4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a4840], eax
push str.ParseSandboxPolicyLib
mov edx, dword [0x341a48e4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a4844], eax
push str.GenerateSandboxPolicyLib
mov eax, dword [0x341a48e4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a4848], eax
push str.FreeBuffer
mov ecx, dword [0x341a48e4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a484c], eax
push str.AddFileControlPolicy
mov edx, dword [0x341a48e4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a4850], eax
push str.AddFileControlPolicyByProcessID
mov eax, dword [0x341a48e4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a4854], eax
push str.AddFileControlPolicyByProcessSandbox
mov ecx, dword [0x341a48e4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a4858], eax
push str.DelFileControlPolicyByFile
mov edx, dword [0x341a48e4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a485c], eax
push str.DelFileControlPolicyByProcess
mov eax, dword [0x341a48e4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a4860], eax
push str.DelFileControlPolicyByProcessID
mov ecx, dword [0x341a48e4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a4864], eax
push str.DelFileControlPolicyByProcessSandbox
mov edx, dword [0x341a48e4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a4868], eax
push str.EnumFileControlPolicy
mov eax, dword [0x341a48e4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a486c], eax
push str.SetCreateProcessEvent
mov ecx, dword [0x341a48e4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a4870], eax
push str.GetCreateProcessNotifyData
mov edx, dword [0x341a48e4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a4874], eax
push str.GetCreateProcessNotifyDataEx
mov eax, dword [0x341a48e4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a4878], eax
push str.GetProcessEventNotifyData
mov ecx, dword [0x341a48e4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a487c], eax
push str.SetProcessEventNotifyResult
mov edx, dword [0x341a48e4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a4880], eax
push 0x3418d338
mov eax, dword [0x341a48e4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a4884], eax
push 0x3418d344
mov ecx, dword [0x341a48e4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a4888], eax
push str.GetActualFilePath
mov edx, dword [0x341a48e4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a488c], eax
push str.GetProcessActualFullPath
mov eax, dword [0x341a48e4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a4890], eax
push str.GenerateSandboxPolicyEntry
mov ecx, dword [0x341a48e4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a4894], eax
push str.GenerateSandboxFilePolicy
mov edx, dword [0x341a48e4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a4898], eax
push str.SetProcessFilePolicyEx
mov eax, dword [0x341a48e4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a489c], eax
push str.GetDebugConfig
mov ecx, dword [0x341a48e4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a48a0], eax
push str.SetDebugConfig
mov edx, dword [0x341a48e4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a48a4], eax
push str.SandboxFileOperate
mov eax, dword [0x341a48e4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a48a8], eax
push str.StartSandboxDrvTimer
mov ecx, dword [0x341a48e4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a48ac], eax
push str.StopSandboxDrvTimer
mov edx, dword [0x341a48e4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a48b0], eax
push str.AddDynamicSandboxPolicy
mov eax, dword [0x341a48e4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a48b4], eax
push str.AddDynamicSandboxPolicy2
mov ecx, dword [0x341a48e4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a48b8], eax
push str.DelDynamicSandboxPolicy
mov edx, dword [0x341a48e4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a48bc], eax
push str.EnableFileInfoCache
mov eax, dword [0x341a48e4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a48c0], eax
push str.DisableFileInfoCache
mov ecx, dword [0x341a48e4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a48c4], eax
push str.ResetFileInfoCache
mov edx, dword [0x341a48e4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a48c8], eax
push str.ResetFileInfoCacheOfFile
mov eax, dword [0x341a48e4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a48cc], eax
push str.GetSecObjChanged
mov ecx, dword [0x341a48e4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a48d0], eax
push str.FLogPEEnable
mov edx, dword [0x341a48e4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a48d4], eax
push str.FLogPESetPath
mov eax, dword [0x341a48e4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a48d8], eax
push str.CheckDetoursDelay
mov ecx, dword [0x341a48e4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x341a48dc], eax
xor eax, eax
cmp dword [0x341a479c], 0
setne al
mov esp, ebp
pop ebp
ret