Function at 0x7d22195b
Capabilities:
Link many functions at runtime

Disassembly:
jmp 0x7d26a930
sub rsp, 0x38
cmp qword [0x7d2acf30], 0
je 0x7d26a945
mov al, 1
add rsp, 0x38
ret
mov rcx, qword [0x7d2abf38]
lea rdx, str.LdrLockLoaderLock
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7d2abf38]
lea rdx, str.LdrUnlockLoaderLock
mov qword [0x7d2acf18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x7d2acf38]
mov qword [0x7d2acf20], rax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov ecx, 0x40
call fcn.7d221988
xor ecx, ecx
mov qword [0x7d2acf30], rax
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], rcx
mov qword [rax + 0x20], rcx
mov qword [rax + 0x28], rcx
mov qword [rax + 0x30], rcx
mov qword [rax + 0x38], rcx
cmp dword [0x7d2abfb4], 0x1770
jb 0x7d26a9db
lea rcx, [0x7d221415]
call sym.imfsbDll.dll_SbieDll_RegisterDllCallback
lea rax, [0x7d269a50]
jmp 0x7d26a9ee
lea rcx, [0x7d221424]
call sym.imfsbDll.dll_SbieDll_RegisterDllCallback
lea rax, [0x7d269ac0]
cmp dword [0x7d2abfb4], 0x2580
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
mov qword [0x7d2acf28], rax
jb 0x7d26acbf
mov rcx, qword [0x7d2abf38]
lea rdx, str.NtAccessCheckByType
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7d2abf38]
lea rdx, str.NtAccessCheck
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7d2abf38]
lea rdx, str.NtQuerySecurityAttributesToken
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7d2abf38]
lea rdx, str.NtQueryInformationToken
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7d2abf38]
lea rdx, str.NtAccessCheckByTypeResultList
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7d2abf38]
lea rdx, str.NtTerminateProcess
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7d2abf38]
lea rdx, str.RtlEqualSid
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7d2abf38]
lea rdx, str.LdrRegisterDllNotification
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7d2abf38]
lea rdx, str.LdrUnregisterDllNotification
mov qword [0x7d2acf08], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, qword [0x7d2acf08]
mov qword [0x7d2acf10], rax
test r10, r10
je 0x7d26ab29
lea r9, [0x7d2acf00]
xor r8d, r8d
lea rdx, [0x7d26b140]
xor ecx, ecx
call r10
test eax, eax
jne 0x7d26ade9
lea r8, [0x7d2215cd]
mov rdx, rdi
lea rcx, str.NtTerminateProcess
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2aceb0], rax
test rax, rax
je 0x7d26ade9
lea r8, [0x7d22166d]
mov rdx, rbp
lea rcx, str.NtQueryInformationToken
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2acea0], rax
test rax, rax
je 0x7d26ade9
lea r8, [0x7d22182a]
mov rdx, r15
lea rcx, str.NtQuerySecurityAttributesToken
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2ace98], rax
test rax, rax
je 0x7d26ade9
lea r8, [0x7d221514]
mov rdx, r14
lea rcx, str.NtAccessCheckByType
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2ace88], rax
test rax, rax
je 0x7d26ade9
lea r8, [0x7d221609]
mov rdx, rsi
lea rcx, str.NtAccessCheck
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2ace90], rax
test rax, rax
je 0x7d26ade9
lea r8, [0x7d2210c3]
mov rdx, rbx
lea rcx, str.NtAccessCheckByTypeResultList
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2acea8], rax
test rax, rax
je 0x7d26ade9
mov rdx, qword [sym.imp.ntdll.dll_LdrLoadDll]
lea r8, [0x7d26c4a0]
lea rcx, str.LdrLoadDll
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2aceb8], rax
test rax, rax
je 0x7d26ade9
mov rdx, qword [sym.imp.ntdll.dll_NtLoadDriver]
lea r8, [0x7d26bfb0]
lea rcx, str.NtLoadDriver
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2acee0], rax
test rax, rax
je 0x7d26ade9
cmp dword [0x7d2abfb0], 0x15
jne 0x7d26ac94
mov rdx, qword [sym.imp.ntdll.dll_NtOpenThreadToken]
lea r8, [0x7d26c050]
lea rcx, str.NtOpenThreadToken
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2acef0], rax
test rax, rax
je 0x7d26ade9
lea r8, [0x7d26c390]
mov rdx, r12
lea rcx, str.RtlEqualSid
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2acef8], rax
test rax, rax
jne 0x7d26aded
jmp 0x7d26ae29
mov rdx, qword [sym.imp.ntdll.dll_LdrLoadDll]
lea r8, [0x7d26b230]
lea rcx, str.LdrLoadDll
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2aceb8], rax
test rax, rax
je 0x7d26ade9
mov rdx, qword [sym.imp.ntdll.dll_LdrUnloadDll]
lea r8, [0x7d26b420]
lea rcx, str.LdrUnloadDll
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2acec0], rax
test rax, rax
je 0x7d26ade9
mov rdx, qword [sym.imp.ntdll.dll_LdrQueryImageFileExecutionOptions]
lea r8, [0x7d26b300]
lea rcx, str.LdrQueryImageFileExecutionOptions
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2aced0], rax
test rax, rax
je 0x7d26ade9
mov rdx, qword [sym.imp.ntdll.dll_NtLoadDriver]
lea r8, [0x7d26bfb0]
lea rcx, str.NtLoadDriver
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2acee0], rax
test rax, rax
je 0x7d26ade9
cmp dword [0x7d2abfb4], 0x20d0
jb 0x7d26ae00
mov rcx, qword [0x7d2abf38]
lea rdx, str.LdrResolveDelayLoadedAPI
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7d2abf38]
lea rdx, [0x7d291c30]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea r8, [0x7d26b3a0]
mov rdx, rbx
lea rcx, str.LdrResolveDelayLoadedAPI
mov rdi, rax
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2acec8], rax
test rax, rax
je 0x7d26ade9
lea r8, [0x7d26bf40]
mov rdx, rdi
lea rcx, [0x7d291c30]
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2aced8], rax
test rax, rax
jne 0x7d26aded
xor al, al
jmp 0x7d26ae29
cmp dword [0x7d2abfb4], 0x20d0
jb 0x7d26ae00
call fcn.7d269490
jmp 0x7d26ae14
mov rax, qword gs:[0x60]
inc rax
cmp byte [rax], 0
jne 0x7d26ae14
mov byte [rax], 0x2a
xor ecx, ecx
call fcn.7d221767
mov rcx, qword [0x7d2acf80]
call fcn.7d221848
mov al, 1
mov r14, qword [rsp + 0x28]
mov r12, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov r15, qword [rsp + 0x20]
add rsp, 0x38
ret