Function at 0x1400b5500
Capabilities:
Check for sandbox and av modules
Link many functions at runtime

Disassembly:
push r12
push r13
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r12, rax
test rax, rax
je 0x1400268d7
lea rdx, [rsp + 0x68]
mov rcx, rax
call sym.ProcessHacker.exe_PhGetDllFileName
mov r13, rax
test rax, rax
je 0x1400268e7
mov eax, dword [rsp + 0x68]
mov qword [rsp + 0x40], rbp
or ebp, 0xffffffff
test eax, eax
je 0x1400268af
mov qword [rsp + 0x60], rbx
mov rbx, qword [0x14015f258]
mov qword [rsp + 0x38], rsi
mov rcx, rbx
mov rsi, qword [r13 + 8]
mov qword [rsp + 0x30], rdi
mov rdi, qword [0x1401540a0]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
mov r15d, eax
add r15, r15
add rdi, r15
lea rdx, [rdi + 0x12]
call fcn.1400ae4a0
mov r14, rax
lock inc dword [rbx + 4]
mov dword [rax + 8], 1
mov r8, r15
movzx ecx, byte [rbx + 2]
mov rdx, rsi
mov word [rax], cx
lea rcx, [rax + 0x20]
mov qword [rax + 0x18], rcx
mov qword [rax + 0x10], rdi
xor eax, eax
mov word [rcx + rdi], ax
mov rcx, qword [r14 + 0x18]
call fcn.1400e31d0
mov rcx, qword [r14 + 0x18]
mov r8, qword [0x1401540a0]
add rcx, r15
mov rdx, qword [str._symsrv.dll]
call fcn.1400e31d0
mov rcx, qword [r14 + 0x18]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, r14
mov eax, ebp
lock xadd dword [r14 + 8], eax
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x60]
cmp eax, 1
jne 0x1400268af
call fcn.1400ae580
lea rcx, [r13 - 0x10]
lock xadd dword [rcx + 8], ebp
cmp ebp, 1
mov rbp, qword [rsp + 0x40]
jne 0x1400268e7
call fcn.1400ae580
mov rcx, r12
add rsp, 0x48
pop r13
pop r12
jmp 0x1400b5500
lea rcx, str.dbghelp.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r12, rax
mov rcx, r12
add rsp, 0x48
pop r13
pop r12
jmp 0x1400b5500
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x1400b5522
lea rcx, str.dbghelp.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
lea rcx, str.symsrv.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.SymInitialize
mov rcx, rbx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SymCleanup
mov rcx, rbx
mov qword [0x14015f220], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SymEnumSymbolsW
mov rcx, rbx
mov qword [0x14015f208], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14015f238], rax
test rax, rax
jne 0x1400b558c
lea rdx, str.SymEnumSymbols
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SymFromAddrW
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14015f1b8], rax
test rax, rax
jne 0x1400b55bf
lea rdx, str.SymFromAddr
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14015f1e0], rax
lea rdx, str.SymFromNameW
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14015f1f8], rax
test rax, rax
jne 0x1400b55f2
lea rdx, str.SymFromName
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14015f1c0], rax
lea rdx, str.SymGetLineFromAddrW64
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14015f200], rax
test rax, rax
jne 0x1400b5625
lea rdx, str.SymGetLineFromAddr64
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14015f218], rax
lea rdx, str.SymLoadModuleExW
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14015f1f0], rax
test rax, rax
jne 0x1400b5658
lea rdx, str.SymLoadModule64
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14015f228], rax
lea rdx, str.SymGetOptions
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SymSetOptions
mov rcx, rbx
mov qword [0x14015f1a0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SymGetSearchPathW
mov rcx, rbx
mov qword [0x14015f1d8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14015f230], rax
test rax, rax
jne 0x1400b56b2
lea rdx, str.SymGetSearchPath
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SymSetSearchPathW
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14015f198], rax
test rax, rax
jne 0x1400b56e5
lea rdx, str.SymSetSearchPath
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14015f1b0], rax
lea rdx, str.SymUnloadModule64
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SymFunctionTableAccess64
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SymGetModuleBase64
mov rcx, rbx
mov qword [0x14015f1a8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SymRegisterCallbackW64
mov rcx, rbx
mov qword [0x14015f210], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.StackWalk64
mov rcx, rbx
mov qword [0x14015f1e8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MiniDumpWriteDump
mov rcx, rbx
mov qword [0x14015f1d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SymbolServerGetOptions
mov rcx, rdi
mov qword [0x14015f1c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SymbolServerSetOptions
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rax, qword [0x14015f1a0]
test rax, rax
je 0x1400b57ad
cmp qword [0x14015f1d8], 0
je 0x1400b57ad
call rax
or eax, 0x800004
mov ecx, eax
call qword [0x14015f1d8]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret