Function at 0x1400b5880
Capabilities:
Check for sandbox and av modules
Link many functions at runtime

Disassembly:
push r12
push r13
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r12, rax
test rax, rax
je 0x140027127
lea rdx, [rsp + 0x68]
mov rcx, rax
call sym.ProcessJacker.exe_PhGetDllFileName
mov r13, rax
test rax, rax
je 0x140027137
mov eax, dword [rsp + 0x68]
mov qword [rsp + 0x40], rbp
or ebp, 0xffffffff
test eax, eax
je 0x1400270ff
mov qword [rsp + 0x60], rbx
mov rbx, qword [0x14015e0c8]
mov qword [rsp + 0x38], rsi
mov rcx, rbx
mov rsi, qword [r13 + 8]
mov qword [rsp + 0x30], rdi
mov rdi, qword [0x1401530b0]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
mov r15d, eax
add r15, r15
add rdi, r15
lea rdx, [rdi + 0x12]
call fcn.1400ae820
mov r14, rax
lock inc dword [rbx + 4]
mov dword [rax + 8], 1
mov r8, r15
movzx ecx, byte [rbx + 2]
mov rdx, rsi
mov word [rax], cx
lea rcx, [rax + 0x20]
mov qword [rax + 0x18], rcx
mov qword [rax + 0x10], rdi
xor eax, eax
mov word [rcx + rdi], ax
mov rcx, qword [r14 + 0x18]
call fcn.1400e3970
mov rcx, qword [r14 + 0x18]
mov r8, qword [0x1401530b0]
add rcx, r15
mov rdx, qword [str._symsrv.dll]
call fcn.1400e3970
mov rcx, qword [r14 + 0x18]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, r14
mov eax, ebp
lock xadd dword [r14 + 8], eax
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x60]
cmp eax, 1
jne 0x1400270ff
call fcn.1400ae900
lea rcx, [r13 - 0x10]
lock xadd dword [rcx + 8], ebp
cmp ebp, 1
mov rbp, qword [rsp + 0x40]
jne 0x140027137
call fcn.1400ae900
mov rcx, r12
add rsp, 0x48
pop r13
pop r12
jmp 0x1400b5880
lea rcx, str.dbghelp.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r12, rax
mov rcx, r12
add rsp, 0x48
pop r13
pop r12
jmp 0x1400b5880
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x1400b58a2
lea rcx, str.dbghelp.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
lea rcx, str.symsrv.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.SymInitialize
mov rcx, rbx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SymCleanup
mov rcx, rbx
mov qword [0x14015e090], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SymEnumSymbolsW
mov rcx, rbx
mov qword [0x14015e078], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14015e0a8], rax
test rax, rax
jne 0x1400b590c
lea rdx, str.SymEnumSymbols
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SymFromAddrW
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14015e028], rax
test rax, rax
jne 0x1400b593f
lea rdx, str.SymFromAddr
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14015e050], rax
lea rdx, str.SymFromNameW
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14015e068], rax
test rax, rax
jne 0x1400b5972
lea rdx, str.SymFromName
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14015e030], rax
lea rdx, str.SymGetLineFromAddrW64
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14015e070], rax
test rax, rax
jne 0x1400b59a5
lea rdx, str.SymGetLineFromAddr64
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14015e088], rax
lea rdx, str.SymLoadModuleExW
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14015e060], rax
test rax, rax
jne 0x1400b59d8
lea rdx, str.SymLoadModule64
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14015e098], rax
lea rdx, str.SymGetOptions
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SymSetOptions
mov rcx, rbx
mov qword [0x14015e010], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SymGetSearchPathW
mov rcx, rbx
mov qword [0x14015e048], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14015e0a0], rax
test rax, rax
jne 0x1400b5a32
lea rdx, str.SymGetSearchPath
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SymSetSearchPathW
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14015e008], rax
test rax, rax
jne 0x1400b5a65
lea rdx, str.SymSetSearchPath
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14015e020], rax
lea rdx, str.SymUnloadModule64
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SymFunctionTableAccess64
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SymGetModuleBase64
mov rcx, rbx
mov qword [0x14015e018], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SymRegisterCallbackW64
mov rcx, rbx
mov qword [0x14015e080], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.StackWalk64
mov rcx, rbx
mov qword [0x14015e058], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MiniDumpWriteDump
mov rcx, rbx
mov qword [0x14015e040], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SymbolServerGetOptions
mov rcx, rdi
mov qword [0x14015e038], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SymbolServerSetOptions
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rax, qword [0x14015e010]
test rax, rax
je 0x1400b5b2d
cmp qword [0x14015e048], 0
je 0x1400b5b2d
call rax
or eax, 0x800004
mov ecx, eax
call qword [0x14015e048]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret