Function at 0x7d286600
Capabilities:
Link many functions at runtime

Disassembly:
jmp 0x7d286600
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x310
cmp dword [0x7d2abfb4], 0x20d0
lea rdx, str.CreateActCtxW
mov rbx, qword [0x7d2abf40]
cmovae rbx, qword [0x7d2abf48]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x7d28672f
mov rcx, qword [0x7d2abf38]
lea rdx, str.RtlCreateActivationContext
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7d2abf40]
lea rdx, str.GetUserDefaultUILanguage
mov qword [0x7d2ad788], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp dword [0x7d2abfb4], 0x1770
mov qword [0x7d2ad7a8], rax
jb 0x7d2866d5
mov rcx, qword [0x7d2abf38]
lea rdx, str.RtlGetThreadPreferredUILanguages
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7d2abf38]
lea rdx, str.RtlSetThreadPreferredUILanguages
mov qword [0x7d2ad790], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7d2abf40]
lea rdx, str.SetThreadUILanguage
mov qword [0x7d2ad798], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x7d2ad7a0], rax
cmp dword [0x7d2abfb0], 1
je 0x7d2866f3
xor r8d, r8d
lea rdx, str.DisableBoxedWinSxS
xor ecx, ecx
call sym.imfsbDll.dll_SbieApi_QueryConfBool
test al, al
je 0x7d2866fa
mov byte [0x7d2ad7b0], 1
lea r8, [fcn.7d221294]
mov rdx, rdi
lea rcx, str.CreateActCtxW
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2ad740], rax
test rax, rax
jne 0x7d28672f
xor al, al
mov rbx, qword [rsp + 0x338]
add rsp, 0x310
pop rdi
ret
test byte [0x7d2abfa0], 2
je 0x7d28676f
lea rdx, str.QueryActCtxW
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x7d28676f
lea r8, [0x7d286e60]
mov rdx, rax
lea rcx, str.QueryActCtxW
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2ad748], rax
test rax, rax
je 0x7d28671c
mov rcx, qword [0x7d2abf38]
lea rdx, str.NtSetInformationThread
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x7d2867ae
lea r8, [0x7d286e50]
mov rdx, rax
lea rcx, str.NtSetInformationThread
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2ad750], rax
test rax, rax
je 0x7d28671c
cmp dword [0x7d2abfb0], 7
je 0x7d2867ca
mov al, 1
mov rbx, qword [rsp + 0x338]
add rsp, 0x310
pop rdi
ret
mov rbx, qword [0x7d2abf38]
lea rdx, str.NtCreateTransaction
mov qword [rsp + 0x320], rbp
mov rcx, rbx
mov qword [rsp + 0x328], rsi
mov qword [rsp + 0x330], r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtOpenTransaction
mov rcx, rbx
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtCommitTransaction
mov rcx, rbx
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtRollbackTransaction
mov rcx, rbx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RtlRaiseException
mov rcx, rbx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test r14, r14
je 0x7d286873
lea r8, [0x7d286e20]
mov rdx, r14
lea rcx, str.NtCreateTransaction
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2ad758], rax
test rax, rax
je 0x7d286a64
test rbp, rbp
je 0x7d28689e
lea r8, [0x7d286e30]
mov rdx, rbp
lea rcx, str.NtOpenTransaction
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2ad760], rax
test rax, rax
je 0x7d286a64
test rsi, rsi
je 0x7d2868c9
lea r8, [0x7d286e10]
mov rdx, rsi
lea rcx, str.NtCommitTransaction
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2ad768], rax
test rax, rax
je 0x7d286a64
test rdi, rdi
je 0x7d2868f4
lea r8, [0x7d286e40]
mov rdx, rdi
lea rcx, str.NtRollbackTransaction
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2ad770], rax
test rax, rax
je 0x7d286a64
test rbx, rbx
je 0x7d28691f
lea r8, [0x7d2871c0]
mov rdx, rbx
lea rcx, str.RtlRaiseException
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2ad778], rax
test rax, rax
je 0x7d286a64
mov eax, dword [0x7d2abfb4]
cmp eax, 0x1db0
jb 0x7d286a2e
mov edx, 0x104
lea rcx, [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
mov rax, qword [0x7d2aa4b8]
movsd xmm0, qword [rax]
lea rax, [rsp + 0xa0]
sub rax, 2
movsd qword [rsp + 0xa0], xmm0
cmp word [rax + 2], 0
lea rax, [rax + 2]
jne 0x7d286963
movups xmm0, xmmword [str.System32configCOMPONENTS]
lea rdx, [rsp + 0xa0]
movups xmm1, xmmword [0x7d29a240]
lea rcx, [rsp + 0x20]
movups xmmword [rax], xmm0
movups xmm0, xmmword [0x7d29a250]
movups xmmword [rax + 0x10], xmm1
movsd xmm1, qword [0x7d29a260]
movups xmmword [rax + 0x20], xmm0
movsd qword [rax + 0x30], xmm1
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rdx, str.REGISTRYMACHINECOMPONENTS
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
xor ecx, ecx
mov dword [rsp + 0x40], 0x30
xorps xmm0, xmm0
mov qword [rsp + 0x48], rcx
lea rax, [rsp + 0x20]
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x40]
lea rax, [rsp + 0x30]
mov dword [rsp + 0x58], 0x40
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x80], rax
movdqu xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x70], 0x30
mov dword [rsp + 0x88], 0x40
movdqu xmmword [rsp + 0x90], xmm0
call qword [sym.imp.ntdll.dll_NtLoadKey]
mov eax, dword [0x7d2abfb4]
cmp eax, 0x20d0
jb 0x7d286a68
mov rcx, qword [0x7d2abf48]
lea rdx, [0x7d294b50]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, rax
lea r8, [0x7d285150]
lea rcx, [0x7d294b50]
call sym.imfsbDll.dll_SbieDll_Hook
test rax, rax
jne 0x7d286a68
xor al, al
jmp 0x7d286a6a
mov al, 1
mov rsi, qword [rsp + 0x328]
mov rbp, qword [rsp + 0x320]
mov r14, qword [rsp + 0x330]
mov rbx, qword [rsp + 0x338]
add rsp, 0x310
pop rdi
ret