Function at 0x14000b850
Capabilities:
Link many functions at runtime

Disassembly:
push r13
push r15
sub rsp, 0x38
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r15, rax
test rax, rax
je 0x14000b967
lea rdx, [rsp + 0x58]
mov rcx, rax
call sym.ProcessHacker.exe_PhGetDllFileName
mov r13, rax
test rax, rax
je 0x14000b977
mov eax, dword [rsp + 0x58]
mov qword [rsp + 0x68], rbp
or ebp, 0xffffffff
test eax, eax
je 0x14000b93f
mov rdx, qword [0x140196800]
mov qword [rsp + 0x50], rbx
mov rbx, qword [0x14018abc0]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rdi
mov rdi, qword [r13 + 8]
mov qword [rsp + 0x20], r14
mov r14d, eax
add r14, r14
add rbx, r14
lea rcx, [rbx + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov rsi, rax
mov r8, r14
mov rdx, rdi
lea rcx, [rax + 0x10]
mov qword [rax], rbx
mov qword [rax + 8], rcx
xor eax, eax
mov word [rcx + rbx], ax
mov rcx, qword [rsi + 8]
call fcn.14010e700
mov rcx, qword [rsi + 8]
mov r8, qword [0x14018abc0]
add rcx, r14
mov rdx, qword [str._symsrv.dll]
call fcn.14010e700
mov rcx, qword [rsi + 8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rcx, [rsi - 0x10]
mov eax, ebp
lock xadd dword [rcx + 8], eax
mov r14, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x50]
cmp eax, 1
jne 0x14000b93f
call fcn.1400c8bc0
lea rcx, [r13 - 0x10]
lock xadd dword [rcx + 8], ebp
cmp ebp, 1
mov rbp, qword [rsp + 0x68]
jne 0x14000b977
call fcn.1400c8bc0
mov rcx, r15
add rsp, 0x38
pop r15
pop r13
jmp 0x1400d06f0
lea rcx, str.dbghelp.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r15, rax
mov rcx, r15
add rsp, 0x38
pop r15
pop r13
jmp 0x1400d06f0
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
xor r14d, r14d
mov rbx, rcx
test rcx, rcx
jne 0x1400d073e
lea rax, str.dbghelp.dll
mov dword [rbp - 0x30], 0x180016
lea r9, [rbp + 0x40]
mov qword [rbp - 0x28], rax
lea r8, [rbp - 0x30]
xor edx, edx
call qword [sym.imp.ntdll.dll_LdrGetDllHandle]
test eax, eax
mov ebx, r14d
cmovns rbx, qword [rbp + 0x40]
lea rax, str.symsrv.dll
mov dword [rbp - 0x20], 0x160014
lea r9, [rbp + 0x48]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ntdll.dll_LdrGetDllHandle]
mov rdi, r14
mov dword [rbp - 0x10], 0xe000d
test eax, eax
lea r9, [rbp + 0x50]
lea rax, str.SymInitialize
mov rcx, rbx
cmovns rdi, qword [rbp + 0x48]
lea rdx, [rbp - 0x10]
xor r8d, r8d
mov qword [rbp - 8], rax
call qword [sym.imp.ntdll.dll_LdrGetProcedureAddress]
mov rcx, qword [rbp + 0x50]
lea r9, [rbp + 0x50]
test eax, eax
mov dword [rbp - 0x10], 0xb000a
lea rax, str.SymCleanup
cmovs rcx, r14
mov qword [rbp - 8], rax
mov qword [0x140196638], rcx
lea rdx, [rbp - 0x10]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.ntdll.dll_LdrGetProcedureAddress]
mov rcx, qword [rbp + 0x50]
lea r9, [rbp + 0x50]
test eax, eax
mov dword [rbp - 0x10], 0x10000f
lea rax, str.SymEnumSymbolsW
cmovs rcx, r14
mov qword [rbp - 8], rax
mov qword [0x140196620], rcx
lea rdx, [rbp - 0x10]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.ntdll.dll_LdrGetProcedureAddress]
test eax, eax
jns 0x1400d080d
mov qword [0x140196650], r14
jmp 0x1400d081d
mov rax, qword [rbp + 0x50]
mov qword [0x140196650], rax
test rax, rax
jne 0x1400d0843
lea rax, str.SymEnumSymbols
mov dword [rbp - 0x10], 0xf000e
lea r9, [rbp + 0x50]
mov qword [rbp - 8], rax
xor r8d, r8d
lea rdx, [rbp - 0x10]
mov rcx, rbx
call qword [sym.imp.ntdll.dll_LdrGetProcedureAddress]
lea rax, str.SymFromAddrW
mov dword [rbp - 0x10], 0xd000c
lea r9, [rbp + 0x50]
mov qword [rbp - 8], rax
xor r8d, r8d
lea rdx, [rbp - 0x10]
mov rcx, rbx
call qword [sym.imp.ntdll.dll_LdrGetProcedureAddress]
test eax, eax
jns 0x1400d0876
mov qword [0x1401965d0], r14
jmp 0x1400d0886
mov rax, qword [rbp + 0x50]
mov qword [0x1401965d0], rax
test rax, rax
jne 0x1400d08bd
lea rax, str.SymFromAddr
mov dword [rbp - 0x10], 0xc000b
lea r9, [rbp + 0x50]
mov qword [rbp - 8], rax
xor r8d, r8d
lea rdx, [rbp - 0x10]
mov rcx, rbx
call qword [sym.imp.ntdll.dll_LdrGetProcedureAddress]
mov rcx, qword [rbp + 0x50]
test eax, eax
cmovs rcx, r14
mov qword [0x1401965f8], rcx
lea rax, str.SymFromNameW
mov dword [rbp - 0x10], 0xd000c
lea r9, [rbp + 0x50]
mov qword [rbp - 8], rax
xor r8d, r8d
lea rdx, [rbp - 0x10]
mov rcx, rbx
call qword [sym.imp.ntdll.dll_LdrGetProcedureAddress]
test eax, eax
jns 0x1400d08f0
mov qword [0x140196610], r14
jmp 0x1400d0900
mov rax, qword [rbp + 0x50]
mov qword [0x140196610], rax
test rax, rax
jne 0x1400d0937
lea rax, str.SymFromName
mov dword [rbp - 0x10], 0xc000b
lea r9, [rbp + 0x50]
mov qword [rbp - 8], rax
xor r8d, r8d
lea rdx, [rbp - 0x10]
mov rcx, rbx
call qword [sym.imp.ntdll.dll_LdrGetProcedureAddress]
mov rcx, qword [rbp + 0x50]
test eax, eax
cmovs rcx, r14
mov qword [0x1401965d8], rcx
lea rax, str.SymGetLineFromAddrW64
mov dword [rbp - 0x10], 0x160015
lea r9, [rbp + 0x50]
mov qword [rbp - 8], rax
xor r8d, r8d
lea rdx, [rbp - 0x10]
mov rcx, rbx
call qword [sym.imp.ntdll.dll_LdrGetProcedureAddress]
test eax, eax
jns 0x1400d096a
mov qword [0x140196618], r14
jmp 0x1400d097a
mov rax, qword [rbp + 0x50]
mov qword [0x140196618], rax
test rax, rax
jne 0x1400d09b1
lea rax, str.SymGetLineFromAddr64
mov dword [rbp - 0x10], 0x150014
lea r9, [rbp + 0x50]
mov qword [rbp - 8], rax
xor r8d, r8d
lea rdx, [rbp - 0x10]
mov rcx, rbx
call qword [sym.imp.ntdll.dll_LdrGetProcedureAddress]
mov rcx, qword [rbp + 0x50]
test eax, eax
cmovs rcx, r14
mov qword [0x140196630], rcx
lea rax, str.SymLoadModuleExW
mov dword [rbp - 0x10], 0x110010
lea r9, [rbp + 0x50]
mov qword [rbp - 8], rax
xor r8d, r8d
lea rdx, [rbp - 0x10]
mov rcx, rbx
call qword [sym.imp.ntdll.dll_LdrGetProcedureAddress]
test eax, eax
jns 0x1400d09e4
mov qword [0x140196608], r14
jmp 0x1400d09f4
mov rax, qword [rbp + 0x50]
mov qword [0x140196608], rax
test rax, rax
jne 0x1400d0a2b
lea rax, str.SymLoadModule64
mov dword [rbp - 0x10], 0x10000f
lea r9, [rbp + 0x50]
mov qword [rbp - 8], rax
xor r8d, r8d
lea rdx, [rbp - 0x10]
mov rcx, rbx
call qword [sym.imp.ntdll.dll_LdrGetProcedureAddress]
mov rcx, qword [rbp + 0x50]
test eax, eax
cmovs rcx, r14
mov qword [0x140196640], rcx
lea rax, str.SymGetOptions
mov dword [rbp - 0x10], 0xe000d
lea r9, [rbp + 0x50]
mov qword [rbp - 8], rax
xor r8d, r8d
lea rdx, [rbp - 0x10]
mov rcx, rbx
call qword [sym.imp.ntdll.dll_LdrGetProcedureAddress]
mov rcx, qword [rbp + 0x50]
lea r9, [rbp + 0x50]
test eax, eax
mov dword [rbp - 0x10], 0xe000d
lea rax, str.SymSetOptions
cmovs rcx, r14
mov qword [rbp - 8], rax
mov qword [0x1401965b8], rcx
lea rdx, [rbp - 0x10]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.ntdll.dll_LdrGetProcedureAddress]
mov rcx, qword [rbp + 0x50]
lea r9, [rbp + 0x50]
test eax, eax
mov dword [rbp - 0x10], 0x120011
lea rax, str.SymGetSearchPathW
cmovs rcx, r14
mov qword [rbp - 8], rax
mov qword [0x1401965f0], rcx
lea rdx, [rbp - 0x10]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.ntdll.dll_LdrGetProcedureAddress]
test eax, eax
jns 0x1400d0acc
mov qword [0x140196648], r14
jmp 0x1400d0adc
mov rax, qword [rbp + 0x50]
mov qword [0x140196648], rax
test rax, rax
jne 0x1400d0b02
lea rax, str.SymGetSearchPath
mov dword [rbp - 0x10], 0x110010
lea r9, [rbp + 0x50]
mov qword [rbp - 8], rax
xor r8d, r8d
lea rdx, [rbp - 0x10]
mov rcx, rbx
call qword [sym.imp.ntdll.dll_LdrGetProcedureAddress]
lea rax, str.SymSetSearchPathW
mov dword [rbp - 0x10], 0x120011
lea r9, [rbp + 0x50]
mov qword [rbp - 8], rax
xor r8d, r8d
lea rdx, [rbp - 0x10]
mov rcx, rbx
call qword [sym.imp.ntdll.dll_LdrGetProcedureAddress]
test eax, eax
jns 0x1400d0b35
mov qword [0x1401965b0], r14
jmp 0x1400d0b45
mov rax, qword [rbp + 0x50]
mov qword [0x1401965b0], rax
test rax, rax
jne 0x1400d0b7c
lea rax, str.SymSetSearchPath
mov dword [rbp - 0x10], 0x110010
lea r9, [rbp + 0x50]
mov qword [rbp - 8], rax
xor r8d, r8d
lea rdx, [rbp - 0x10]
mov rcx, rbx
call qword [sym.imp.ntdll.dll_LdrGetProcedureAddress]
mov rcx, qword [rbp + 0x50]
test eax, eax
cmovs rcx, r14
mov qword [0x1401965c8], rcx
lea rax, str.SymUnloadModule64
mov dword [rbp - 0x10], 0x120011
lea r9, [rbp + 0x50]
mov qword [rbp - 8], rax
xor r8d, r8d
lea rdx, [rbp - 0x10]
mov rcx, rbx
call qword [sym.imp.ntdll.dll_LdrGetProcedureAddress]
lea rax, str.SymFunctionTableAccess64
mov dword [rbp - 0x10], 0x190018
lea r9, [rbp + 0x50]
mov qword [rbp - 8], rax
xor r8d, r8d
lea rdx, [rbp - 0x10]
mov rcx, rbx
call qword [sym.imp.ntdll.dll_LdrGetProcedureAddress]
mov rcx, qword [rbp + 0x50]
lea r9, [rbp + 0x50]
test eax, eax
mov dword [rbp - 0x10], 0x130012
lea rax, str.SymGetModuleBase64
cmovs rcx, r14
mov qword [rbp - 8], rax
mov qword [0x1401965c0], rcx
lea rdx, [rbp - 0x10]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.ntdll.dll_LdrGetProcedureAddress]
mov rcx, qword [rbp + 0x50]
lea r9, [rbp + 0x50]
test eax, eax
mov dword [rbp - 0x10], 0x170016
lea rax, str.SymRegisterCallbackW64
cmovs rcx, r14
mov qword [rbp - 8], rax
mov qword [0x140196628], rcx
lea rdx, [rbp - 0x10]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.ntdll.dll_LdrGetProcedureAddress]
mov rcx, qword [rbp + 0x50]
lea r9, [rbp + 0x50]
test eax, eax
mov dword [rbp - 0x10], 0xc000b
lea rax, str.StackWalk64
cmovs rcx, r14
mov qword [rbp - 8], rax
mov qword [0x140196600], rcx
lea rdx, [rbp - 0x10]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.ntdll.dll_LdrGetProcedureAddress]
mov rcx, qword [rbp + 0x50]
lea r9, [rbp + 0x50]
test eax, eax
mov dword [rbp - 0x10], 0x120011
lea rax, str.MiniDumpWriteDump
cmovs rcx, r14
mov qword [rbp - 8], rax
mov qword [0x1401965e8], rcx
lea rdx, [rbp - 0x10]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.ntdll.dll_LdrGetProcedureAddress]
mov rcx, qword [rbp + 0x50]
lea r9, [rbp + 0x50]
test eax, eax
mov dword [rbp - 0x10], 0x170016
lea rax, str.SymbolServerGetOptions
cmovs rcx, r14
mov qword [rbp - 8], rax
mov qword [0x1401965e0], rcx
lea rdx, [rbp - 0x10]
mov rcx, rdi
xor r8d, r8d
call qword [sym.imp.ntdll.dll_LdrGetProcedureAddress]
lea rax, str.SymbolServerSetOptions
mov dword [rbp - 0x10], 0x170016
mov qword [rbp - 8], rax
lea r9, [rbp + 0x50]
xor r8d, r8d
lea rdx, [rbp - 0x10]
mov rcx, rdi
call qword [sym.imp.ntdll.dll_LdrGetProcedureAddress]
lea rax, str.UnDecorateSymbolName
mov dword [rbp - 0x10], 0x150014
lea r9, [rbp + 0x48]
mov qword [rbp - 8], rax
xor r8d, r8d
lea rdx, [rbp - 0x10]
mov rcx, rbx
call qword [sym.imp.ntdll.dll_LdrGetProcedureAddress]
lea rax, str.UnDecorateSymbolNameW
mov dword [rbp - 0x10], 0x160015
lea r9, [rbp + 0x48]
mov qword [rbp - 8], rax
xor r8d, r8d
lea rdx, [rbp - 0x10]
mov rcx, rbx
call qword [sym.imp.ntdll.dll_LdrGetProcedureAddress]
mov rax, qword [0x1401965b8]
test rax, rax
je 0x1400d0d71
cmp qword [0x1401965f0], r14
je 0x1400d0d71
call rax
or eax, 0x12237
mov ecx, eax
call qword [0x1401965f0]
mov rbx, qword [rsp + 0xa8]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret