Function at 0x1400e14d0
Capabilities:
Check for sandbox and av modules
Link many functions at runtime

Disassembly:
push r13
push r15
sub rsp, 0x38
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r15, rax
test rax, rax
je 0x140033ea9
lea rdx, [rsp + 0x58]
mov rcx, rax
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhGetDllFileName
mov r13, rax
test rax, rax
je 0x140033eb9
mov eax, dword [rsp + 0x58]
mov qword [rsp + 0x60], rbp
mov ebp, 0xffffffff
test eax, eax
je 0x140033e81
mov rdx, qword [0x140191180]
mov qword [rsp + 0x50], rbx
mov rbx, qword [0x140188450]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rdi
mov rdi, qword [r13 + 8]
mov qword [rsp + 0x20], r14
mov r14d, eax
add r14, r14
add rbx, r14
lea rcx, [rbx + 0x12]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhCreateObject
mov rsi, rax
mov r8, r14
mov rdx, rdi
lea rcx, [rax + 0x10]
mov qword [rax], rbx
mov qword [rax + 8], rcx
xor eax, eax
mov word [rcx + rbx], ax
mov rcx, qword [rsi + 8]
call fcn.1401317c0
mov rcx, qword [rsi + 8]
mov r8, qword [0x140188450]
add rcx, r14
mov rdx, qword [str._symsrv.dll]
call fcn.1401317c0
mov rcx, qword [rsi + 8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rcx, [rsi - 0x10]
mov eax, ebp
lock xadd dword [rcx + 8], eax
mov r14, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x50]
cmp eax, 1
jne 0x140033e81
call fcn.1400d9400
lea rcx, [r13 - 0x10]
lock xadd dword [rcx + 8], ebp
cmp ebp, 1
mov rbp, qword [rsp + 0x60]
jne 0x140033eb9
call fcn.1400d9400
mov rcx, r15
add rsp, 0x38
pop r15
pop r13
jmp 0x1400e14d0
lea rcx, str.dbghelp.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r15, rax
mov rcx, r15
add rsp, 0x38
pop r15
pop r13
jmp 0x1400e14d0
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x1400e14f2
lea rcx, str.dbghelp.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
lea rcx, str.symsrv.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.SymInitialize
mov rcx, rbx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SymCleanup
mov rcx, rbx
mov qword [0x140191150], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SymEnumSymbolsW
mov rcx, rbx
mov qword [0x140191138], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140191168], rax
test rax, rax
jne 0x1400e155c
lea rdx, str.SymEnumSymbols
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SymFromAddrW
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401910e8], rax
test rax, rax
jne 0x1400e158f
lea rdx, str.SymFromAddr
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140191110], rax
lea rdx, str.SymFromNameW
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140191130], rax
test rax, rax
jne 0x1400e15c2
lea rdx, str.SymFromName
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401910f0], rax
lea rdx, str.SymGetLineFromAddrW64
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140191128], rax
test rax, rax
jne 0x1400e15f5
lea rdx, str.SymGetLineFromAddr64
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140191148], rax
lea rdx, str.SymLoadModuleExW
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140191120], rax
test rax, rax
jne 0x1400e1628
lea rdx, str.SymLoadModule64
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140191160], rax
lea rdx, str.SymGetOptions
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SymSetOptions
mov rcx, rbx
mov qword [0x1401910d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SymGetSearchPathW
mov rcx, rbx
mov qword [0x140191100], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140191158], rax
test rax, rax
jne 0x1400e1682
lea rdx, str.SymGetSearchPath
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SymSetSearchPathW
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401910c8], rax
test rax, rax
jne 0x1400e16b5
lea rdx, str.SymSetSearchPath
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401910e0], rax
lea rdx, str.SymUnloadModule64
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SymFunctionTableAccess64
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SymGetModuleBase64
mov rcx, rbx
mov qword [0x1401910d8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SymRegisterCallbackW64
mov rcx, rbx
mov qword [0x140191140], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.StackWalk64
mov rcx, rbx
mov qword [0x140191118], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MiniDumpWriteDump
mov rcx, rbx
mov qword [0x140191108], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SymbolServerGetOptions
mov rcx, rdi
mov qword [0x1401910f8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SymbolServerSetOptions
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rax, qword [0x1401910d0]
test rax, rax
je 0x1400e177d
cmp qword [0x140191100], 0
je 0x1400e177d
call rax
or eax, 0x800004
mov ecx, eax
call qword [0x140191100]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret