Function at 0x1800dc0d0
Capabilities:
Link many functions at runtime

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x38
cmp qword [0x180239388], 0
je 0x1800dc0ec
mov eax, 1
jmp 0x1800dca55
cmp dword [0x180239380], 0
je 0x1800dc106
cmp dword [rsp + 0x40], 0
jne 0x1800dc106
mov eax, 1
jmp 0x1800dca55
mov dword [0x180239380], 1
lea rax, [0x180239390]
mov qword [rsp + 0x20], rax
lea rcx, [0x180239390]
call fcn.1800f9114
test rax, rax
jne 0x1800dc139
lea rax, str.TSandbox64.dll
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x180239388], rax
cmp qword [0x180239388], 0
je 0x1800dca35
lea rdx, str.LoadTsdLogDrv
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1802390e0], rax
lea rdx, str.UnloadTsdLogDrv
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1802390e8], rax
lea rdx, str.LoadDriver
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1802390f0], rax
lea rdx, str.UnloadDriver
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1802390f8], rax
lea rdx, str.RegisterSandboxClass
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180239100], rax
lea rdx, str.UnregisterSandboxClass
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180239108], rax
lea rdx, str.EnumSandboxClassName
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180239110], rax
lea rdx, str.QuerySandboxClassInformation
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180239118], rax
lea rdx, str.CreateSandboxInstance
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180239120], rax
lea rdx, str.CreateSandboxInstanceEx
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180239128], rax
lea rdx, str.DestroySandboxInstance
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180239130], rax
lea rdx, str.EnumSandboxInstanceName
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180239138], rax
lea rdx, str.QuerySandboxInstanceInformation
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180239140], rax
lea rdx, str.DeleteSandboxData
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180239148], rax
lea rdx, str.GetSandboxPolicyLib
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180239150], rax
lea rdx, str.SetSandboxPolicyLib
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180239158], rax
lea rdx, str.SetSandboxPolicyLibFile
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180239160], rax
lea rdx, str.UpdateSystemPolicyLib
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180239168], rax
lea rdx, str.SetSystemPolicyLibPath
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180239170], rax
lea rdx, str.GetSystemPolicyLibPath
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180239178], rax
lea rdx, str.SetSandboxProcessCommonPolicy
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180239180], rax
lea rdx, str.SetSandboxProcessCommonPolicyEx
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180239188], rax
lea rdx, str.GetSandboxProcessCommonPolicy
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180239190], rax
lea rdx, str.SetSandboxProcessPolicy
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180239198], rax
lea rdx, str.SetProcessFilePolicy
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1802391a0], rax
lea rdx, str.SetProcessObjectPolicy
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1802391a8], rax
lea rdx, str.SetProcessRegPolicy
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1802391b0], rax
lea rdx, str.SetProcessWindowPolicy
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1802391b8], rax
lea rdx, str.SetProcessAccessPolicy
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1802391c0], rax
lea rdx, str.AddSandboxProcess
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1802391c8], rax
lea rdx, str.DelSandboxProcess
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1802391d0], rax
lea rdx, str.GetSandboxProcessFlags
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1802391d8], rax
lea rdx, str.SetSandboxProcessFlags
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1802391e0], rax
lea rdx, str.GetSandboxProcessState
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1802391e8], rax
lea rdx, str.SetSandboxProcessState
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1802391f0], rax
lea rdx, str.RegisterCallback
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1802391f8], rax
lea rdx, str.RegisterTSafeDocCallback
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180239200], rax
lea rdx, str.EnumSandboxRunningProcess
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180239208], rax
lea rdx, str.UpdateSandboxRunningProcess
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180239210], rax
lea rdx, str.UpdateDriveData
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180239218], rax
lea rdx, str.GetSandboxFilePath
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180239220], rax
lea rdx, str.GetSandboxProcessFilePath
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180239228], rax
lea rdx, str.GenerateSandboxFilePath
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180239230], rax
lea rdx, str.ParseSandboxFilePath
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180239238], rax
lea rdx, str.GenerateSandboxRegPath
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180239240], rax
lea rdx, str.ParseSandboxRegPath
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180239248], rax
lea rdx, str.ParseSandboxPolicyLib
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180239250], rax
lea rdx, str.GenerateSandboxPolicyLib
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180239258], rax
lea rdx, str.FreeBuffer
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180239260], rax
lea rdx, str.AddFileControlPolicy
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180239268], rax
lea rdx, str.AddFileControlPolicyByProcessID
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180239270], rax
lea rdx, str.AddFileControlPolicyByProcessSandbox
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180239278], rax
lea rdx, str.DelFileControlPolicyByFile
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180239280], rax
lea rdx, str.DelFileControlPolicyByProcess
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180239288], rax
lea rdx, str.DelFileControlPolicyByProcessID
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180239290], rax
lea rdx, str.DelFileControlPolicyByProcessSandbox
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180239298], rax
lea rdx, str.EnumFileControlPolicy
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1802392a0], rax
lea rdx, str.SetCreateProcessEvent
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1802392a8], rax
lea rdx, str.GetCreateProcessNotifyData
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1802392b0], rax
lea rdx, str.GetCreateProcessNotifyDataEx
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1802392b8], rax
lea rdx, str.GetProcessEventNotifyData
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1802392c0], rax
lea rdx, str.SetProcessEventNotifyResult
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1802392c8], rax
lea rdx, str.AddPassthru
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1802392d0], rax
lea rdx, str.DelPassthru
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1802392d8], rax
lea rdx, str.GetActualFilePath
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1802392e0], rax
lea rdx, str.GetProcessActualFullPath
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1802392e8], rax
lea rdx, str.GenerateSandboxPolicyEntry
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1802392f0], rax
lea rdx, str.GenerateSandboxFilePolicy
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1802392f8], rax
lea rdx, str.SetProcessFilePolicyEx
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180239300], rax
lea rdx, str.GetDebugConfig
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180239308], rax
lea rdx, str.SetDebugConfig
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180239310], rax
lea rdx, str.SandboxFileOperate
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180239318], rax
lea rdx, str.StartSandboxDrvTimer
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180239320], rax
lea rdx, str.StopSandboxDrvTimer
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180239328], rax
lea rdx, str.AddDynamicSandboxPolicy
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180239330], rax
lea rdx, str.AddDynamicSandboxPolicy2
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180239338], rax
lea rdx, str.DelDynamicSandboxPolicy
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180239340], rax
lea rdx, str.EnableFileInfoCache
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180239348], rax
lea rdx, str.DisableFileInfoCache
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180239350], rax
lea rdx, str.ResetFileInfoCache
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180239358], rax
lea rdx, str.ResetFileInfoCacheOfFile
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180239360], rax
lea rdx, str.GetSecObjChanged
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180239368], rax
lea rdx, str.FLogPEEnable
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180239370], rax
lea rdx, str.FLogPESetPath
mov rcx, qword [0x180239388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180239378], rax
cmp qword [0x180239100], 0
je 0x1800dca49
mov dword [rsp + 0x28], 1
jmp 0x1800dca51
mov dword [rsp + 0x28], 0
mov eax, dword [rsp + 0x28]
add rsp, 0x38
ret