Function at 0x7d22144c
Capabilities:
Link many functions at runtime

Disassembly:
jmp 0x7d25a3e0
sub rsp, 0x28
mov ecx, 0x69
or rdx, 0xffffffffffffffff
call fcn.7d2211ae
mov rdx, qword [sym.imp.ntdll.dll_NtCreatePort]
lea r8, [0x7d25c5d0]
lea rcx, str.NtCreatePort
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2acc10], rax
test rax, rax
jne 0x7d25a41f
xor al, al
add rsp, 0x28
ret
mov rdx, qword [sym.imp.ntdll.dll_NtConnectPort]
lea r8, [0x7d25bea0]
lea rcx, str.NtConnectPort
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2acc18], rax
test rax, rax
je 0x7d25a418
mov rdx, qword [sym.imp.ntdll.dll_NtSecureConnectPort]
lea r8, [0x7d25d8f0]
lea rcx, str.NtSecureConnectPort
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2acc20], rax
test rax, rax
je 0x7d25a418
mov rcx, qword [0x7d2abf38]
lea rdx, str.NtAlpcCreatePort
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x7d25a4aa
lea r8, [0x7d25b8b0]
mov rdx, rax
lea rcx, str.NtAlpcCreatePort
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2acc28], rax
test rax, rax
je 0x7d25a418
mov rcx, qword [0x7d2abf38]
lea rdx, str.NtAlpcConnectPort
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x7d25a4e9
lea r8, [0x7d25adc0]
mov rdx, rax
lea rcx, str.NtAlpcConnectPort
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2acc30], rax
test rax, rax
je 0x7d25a418
mov rcx, qword [0x7d2abf38]
lea rdx, str.NtAlpcConnectPortEx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x7d25a528
lea r8, [0x7d25b2f0]
mov rdx, rax
lea rcx, str.NtAlpcConnectPortEx
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2acc38], rax
test rax, rax
je 0x7d25a418
mov rcx, qword [0x7d2abf38]
lea rdx, str.NtAlpcQueryInformation
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x7d25a567
lea r8, [0x7d25bac0]
mov rdx, rax
lea rcx, str.NtAlpcQueryInformation
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2acc40], rax
test rax, rax
je 0x7d25a418
mov rcx, qword [0x7d2abf38]
lea rdx, str.NtAlpcQueryInformationMessage
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x7d25a5a6
lea r8, [0x7d25baf0]
mov rdx, rax
lea rcx, str.NtAlpcQueryInformationMessage
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2acc48], rax
test rax, rax
je 0x7d25a418
mov rdx, qword [sym.imp.ntdll.dll_NtImpersonateClientOfPort]
lea r8, [0x7d25cd70]
lea rcx, str.NtImpersonateClientOfPort
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2acc50], rax
test rax, rax
je 0x7d25a418
mov rcx, qword [0x7d2abf38]
lea rdx, str.NtAlpcImpersonateClientOfPort
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x7d25a60f
lea r8, [0x7d25ba80]
mov rdx, rax
lea rcx, str.NtAlpcImpersonateClientOfPort
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2acc58], rax
test rax, rax
je 0x7d25a418
mov rdx, qword [sym.imp.ntdll.dll_NtRequestWaitReplyPort]
lea r8, [0x7d25d620]
lea rcx, str.NtRequestWaitReplyPort
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2acc60], rax
test rax, rax
je 0x7d25a418
mov rcx, qword [0x7d2abf38]
lea rdx, str.NtAlpcSendWaitReceivePort
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x7d25a699
lea r8, [0x7d25bb30]
mov rdx, rax
lea rcx, str.NtAlpcSendWaitReceivePort
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2acc68], rax
test rax, rax
je 0x7d25a418
mov ecx, 0x800
call fcn.7d221988
xor edx, edx
mov qword [0x7d2accc0], rax
mov r8d, 0x800
mov rcx, rax
call sub.ntdll.dll_memset
mov rdx, qword [sym.imp.ntdll.dll_NtCreateEvent]
lea r8, [0x7d25c170]
lea rcx, str.NtCreateEvent
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2acc70], rax
test rax, rax
je 0x7d25a418
mov rdx, qword [sym.imp.ntdll.dll_NtOpenEvent]
lea r8, [0x7d25cdd0]
lea rcx, str.NtOpenEvent
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2acc78], rax
test rax, rax
je 0x7d25a418
mov rdx, qword [sym.imp.ntdll.dll_NtCreateMutant]
lea r8, [0x7d25c3c0]
lea rcx, str.NtCreateMutant
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2acc80], rax
test rax, rax
je 0x7d25a418
mov rdx, qword [sym.imp.ntdll.dll_NtOpenMutant]
lea r8, [0x7d25cfa0]
lea rcx, str.NtOpenMutant
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2acc88], rax
test rax, rax
je 0x7d25a418
mov rdx, qword [sym.imp.ntdll.dll_NtCreateSemaphore]
lea r8, [0x7d25cae0]
lea rcx, str.NtCreateSemaphore
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2acc90], rax
test rax, rax
je 0x7d25a418
mov rdx, qword [sym.imp.ntdll.dll_NtOpenSemaphore]
lea r8, [0x7d25d380]
lea rcx, str.NtOpenSemaphore
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2acc98], rax
test rax, rax
je 0x7d25a418
mov rdx, qword [sym.imp.ntdll.dll_NtCreateSection]
lea r8, [0x7d25c800]
lea rcx, str.NtCreateSection
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2acca0], rax
test rax, rax
je 0x7d25a418
mov rdx, qword [sym.imp.ntdll.dll_NtOpenSection]
lea r8, [0x7d25d170]
lea rcx, str.NtOpenSection
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2acca8], rax
test rax, rax
je 0x7d25a418
mov rdx, qword [sym.imp.ntdll.dll_NtImpersonateAnonymousToken]
lea r8, [0x7d25cd20]
lea rcx, str.NtImpersonateAnonymousToken
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2accb0], rax
test rax, rax
je 0x7d25a418
mov rdx, qword [sym.imp.ntdll.dll_NtImpersonateThread]
lea r8, [0x7d25cda0]
lea rcx, str.NtImpersonateThread
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2accb8], rax
test rax, rax
je 0x7d25a418
call fcn.7d259620
cmp dword [0x7d2abfb4], 0x2580
jb 0x7d25a85f
mov ecx, 0xc0
call fcn.7d221988
mov qword [0x7d2ad8e0], rax
mov ecx, 0xc0
call fcn.7d221988
mov ecx, 0xc0
mov qword [0x7d2ad8e8], rax
call fcn.7d221988
mov ecx, 0xc0
mov qword [0x7d2ad8f8], rax
call fcn.7d221988
mov qword [0x7d2ad8f0], rax
mov al, 1
add rsp, 0x28
ret