Function at 0x140062440
Capabilities:
Check for sandbox and av modules
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x14002fc52
lea rcx, str.dbghelp.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
lea rcx, str.symsrv.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.SymInitialize
mov rcx, rbx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SymCleanup
mov rcx, rbx
mov qword [0x14015e980], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SymEnumSymbolsW
mov rcx, rbx
mov qword [0x14015e968], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14015e9a0], rax
test rax, rax
jne 0x14002fcbc
lea rdx, str.SymEnumSymbols
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SymFromAddrW
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14015e918], rax
test rax, rax
jne 0x14002fcef
lea rdx, str.SymFromAddr
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14015e940], rax
lea rdx, str.SymFromNameW
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14015e958], rax
test rax, rax
jne 0x14002fd22
lea rdx, str.SymFromName
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14015e920], rax
lea rdx, str.SymGetLineFromAddrW64
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14015e960], rax
test rax, rax
jne 0x14002fd55
lea rdx, str.SymGetLineFromAddr64
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14015e978], rax
lea rdx, str.SymLoadModuleExW
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14015e950], rax
test rax, rax
jne 0x14002fd88
lea rdx, str.SymLoadModule64
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14015e990], rax
lea rdx, str.SymGetOptions
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SymSetOptions
mov rcx, rbx
mov qword [0x14015e900], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SymGetSearchPathW
mov rcx, rbx
mov qword [0x14015e938], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14015e998], rax
test rax, rax
jne 0x14002fde2
lea rdx, str.SymGetSearchPath
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SymSetSearchPathW
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14015e8f8], rax
test rax, rax
jne 0x14002fe15
lea rdx, str.SymSetSearchPath
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14015e910], rax
lea rdx, str.SymUnloadModule64
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SymFunctionTableAccess64
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SymGetModuleBase64
mov rcx, rbx
mov qword [0x14015e908], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SymRegisterCallbackW64
mov rcx, rbx
mov qword [0x14015e970], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.StackWalk64
mov rcx, rbx
mov qword [0x14015e948], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MiniDumpWriteDump
mov rcx, rbx
mov qword [0x14015e930], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SymbolServerGetOptions
mov rcx, rdi
mov qword [0x14015e928], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SymbolServerSetOptions
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rax, qword [0x14015e900]
test rax, rax
je 0x14002fedd
cmp qword [0x14015e938], 0
je 0x14002fedd
call rax
or eax, 0x800004
mov ecx, eax
call qword [0x14015e938]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
push r12
push r13
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r12, rax
test rax, rax
je 0x140062577
lea rdx, [rsp + 0x68]
mov rcx, rax
call sym.ProcessHacker.exe_PhGetDllFileName
mov r13, rax
test rax, rax
je 0x140062587
mov eax, dword [rsp + 0x68]
mov qword [rsp + 0x40], rbp
or ebp, 0xffffffff
test eax, eax
je 0x14006254f
mov qword [rsp + 0x60], rbx
mov rbx, qword [0x14015f3f8]
mov qword [rsp + 0x38], rsi
mov rcx, rbx
mov rsi, qword [r13 + 8]
mov qword [rsp + 0x30], rdi
mov rdi, qword [0x140155d90]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
mov r15d, eax
add r15, r15
add rdi, r15
lea rdx, [rdi + 0x12]
call fcn.1400257d0
mov r14, rax
lock inc dword [rbx + 4]
mov dword [rax + 8], 1
mov r8, r15
movzx ecx, byte [rbx + 2]
mov rdx, rsi
mov word [rax], cx
lea rcx, [rax + 0x20]
mov qword [rax + 0x18], rcx
mov qword [rax + 0x10], rdi
xor eax, eax
mov word [rcx + rdi], ax
mov rcx, qword [r14 + 0x18]
call fcn.1400e19b0
mov rcx, qword [r14 + 0x18]
mov r8, qword [0x140155d90]
add rcx, r15
mov rdx, qword [str._symsrv.dll]
call fcn.1400e19b0
mov rcx, qword [r14 + 0x18]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, r14
mov eax, ebp
lock xadd dword [r14 + 8], eax
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x60]
cmp eax, 1
jne 0x14006254f
call fcn.1400258b0
lea rcx, [r13 - 0x10]
lock xadd dword [rcx + 8], ebp
cmp ebp, 1
mov rbp, qword [rsp + 0x40]
jne 0x140062587
call fcn.1400258b0
mov rcx, r12
add rsp, 0x48
pop r13
pop r12
jmp 0x14002fc30
lea rcx, str.dbghelp.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r12, rax
mov rcx, r12
add rsp, 0x48
pop r13
pop r12
jmp 0x14002fc30