Function at 0x7d2380d0
Capabilities:
Link many functions at runtime

Disassembly:
jmp 0x7d2380d0
sub rsp, 0x28
lea rcx, [0x7d2ac228]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x7d2ac278]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor eax, eax
mov ecx, 0x400
mov qword [0x7d2ac260], rax
mov qword [0x7d2ac268], rax
mov qword [0x7d2ac270], rax
call fcn.7d221988
xor edx, edx
mov qword [0x7d2ac1a8], rax
mov r8d, 0x400
mov rcx, rax
call sub.ntdll.dll_memset
call fcn.7d239660
or ecx, 0xffffffff
call fcn.7d238940
test al, al
je 0x7d23844f
call fcn.7d239b90
test al, al
je 0x7d23844f
call fcn.7d2397c0
call fcn.7d238880
mov rcx, qword [0x7d2abf38]
lea rdx, str.NtQueryDirectoryFileEx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x7d238191
lea r8, [0x7d23f8f0]
mov rdx, rax
lea rcx, str.NtQueryDirectoryFileEx
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2ac0c8], rax
test rax, rax
je 0x7d23844f
mov rdx, qword [sym.imp.ntdll.dll_NtCreateFile]
lea r8, [0x7d23c8f0]
lea rcx, str.NtCreateFile
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2ac098], rax
test rax, rax
je 0x7d23844f
mov rdx, qword [sym.imp.ntdll.dll_NtOpenFile]
lea r8, [0x7d23f330]
lea rcx, str.NtOpenFile
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2ac090], rax
test rax, rax
je 0x7d23844f
mov rdx, qword [sym.imp.ntdll.dll_NtQueryAttributesFile]
lea r8, [0x7d23f390]
lea rcx, str.NtQueryAttributesFile
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2ac0a0], rax
test rax, rax
je 0x7d23844f
mov rdx, qword [sym.imp.ntdll.dll_NtQueryFullAttributesFile]
lea r8, [0x7d23f970]
lea rcx, str.NtQueryFullAttributesFile
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2ac0a8], rax
test rax, rax
je 0x7d23844f
mov rdx, qword [sym.imp.ntdll.dll_NtQueryInformationFile]
lea r8, [0x7d23fd40]
lea rcx, str.NtQueryInformationFile
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2ac0b0], rax
test rax, rax
je 0x7d23844f
mov rdx, qword [sym.imp.ntdll.dll_NtQueryDirectoryFile]
lea r8, [fcn.7d23f400]
lea rcx, str.NtQueryDirectoryFile
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2ac0c0], rax
test rax, rax
je 0x7d23844f
mov rdx, qword [sym.imp.ntdll.dll_NtSetInformationFile]
lea r8, [0x7d240830]
lea rcx, str.NtSetInformationFile
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2ac0d0], rax
test rax, rax
je 0x7d23844f
mov rdx, qword [sym.imp.ntdll.dll_NtDeleteFile]
lea r8, [0x7d23ed80]
lea rcx, str.NtDeleteFile
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2ac0d8], rax
test rax, rax
je 0x7d23844f
mov rdx, qword [sym.imp.ntdll.dll_NtClose]
lea r8, [0x7d23c700]
lea rcx, str.NtClose
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2ac0e0], rax
test rax, rax
je 0x7d23844f
mov rdx, qword [sym.imp.ntdll.dll_NtCreateNamedPipeFile]
lea r8, [0x7d22188e]
lea rcx, str.NtCreateNamedPipeFile
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2ac0e8], rax
test rax, rax
je 0x7d23844f
mov rdx, qword [sym.imp.ntdll.dll_NtCreateMailslotFile]
lea r8, [0x7d2213e8]
lea rcx, str.NtCreateMailslotFile
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2ac0f0], rax
test rax, rax
je 0x7d23844f
mov rdx, qword [sym.imp.ntdll.dll_NtReadFile]
lea r8, [fcn.7d2406b0]
lea rcx, str.NtReadFile
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2ac0f8], rax
test rax, rax
je 0x7d23844f
mov rdx, qword [sym.imp.ntdll.dll_NtWriteFile]
lea r8, [fcn.7d2409f0]
lea rcx, str.NtWriteFile
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2ac100], rax
test rax, rax
je 0x7d23844f
mov rdx, qword [sym.imp.ntdll.dll_NtFsControlFile]
lea r8, [0x7d23f040]
lea rcx, str.NtFsControlFile
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2ac108], rax
test rax, rax
je 0x7d23844f
mov r8b, 1
lea rdx, str.BlockNetParam
xor ecx, ecx
call sym.imfsbDll.dll_SbieApi_QueryConfBool
test al, al
je 0x7d238414
mov rdx, qword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
lea r8, [0x7d23ee00]
lea rcx, str.NtDeviceIoControlFile
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2ac110], rax
test rax, rax
je 0x7d23844f
mov rcx, qword [0x7d2abf38]
lea rdx, str.RtlGetFullPathName_UEx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x7d238456
lea r8, [0x7d242c10]
mov rdx, rax
lea rcx, str.RtlGetFullPathName_UEx
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2ac130], rax
test rax, rax
jne 0x7d238481
xor al, al
add rsp, 0x28
ret
mov rdx, qword [sym.imp.ntdll.dll_RtlGetFullPathName_U]
lea r8, [fcn.7d242900]
lea rcx, str.RtlGetFullPathName_U
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2ac128], rax
test rax, rax
jne 0x7d238481
add rsp, 0x28
ret
mov rdx, qword [sym.imp.ntdll.dll_RtlGetCurrentDirectory_U]
lea r8, [fcn.7d2425e0]
lea rcx, str.RtlGetCurrentDirectory_U
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2ac118], rax
test rax, rax
je 0x7d23844f
mov rdx, qword [sym.imp.ntdll.dll_RtlSetCurrentDirectory_U]
lea r8, [0x7d242c40]
lea rcx, str.RtlSetCurrentDirectory_U
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2ac120], rax
test rax, rax
je 0x7d23844f
mov rdx, qword [sym.imp.ntdll.dll_NtQueryVolumeInformationFile]
lea r8, [0x7d240390]
lea rcx, str.NtQueryVolumeInformationFile
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2ac138], rax
test rax, rax
je 0x7d23844f
mov rdx, qword [sym.imp.KERNEL32.dll_MoveFileWithProgressW]
lea r8, [0x7d23c2f0]
lea rcx, str.MoveFileWithProgressW
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2ac060], rax
test rax, rax
je 0x7d23844f
mov rdx, qword [sym.imp.KERNEL32.dll_ReplaceFileW]
lea r8, [0x7d241ff0]
lea rcx, str.ReplaceFileW
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2ac068], rax
test rax, rax
je 0x7d23844f
mov rax, qword [0x7d2abf48]
lea rdx, str.DefineDosDeviceW
mov rcx, qword [0x7d2abf40]
test rax, rax
cmovne rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x7d238598
lea r8, [0x7d2334c0]
mov rdx, rax
lea rcx, str.DefineDosDeviceW
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2ac070], rax
test rax, rax
je 0x7d23844f
mov eax, dword [0x7d2abfb4]
cmp eax, 0x1770
jb 0x7d2385f8
mov rax, qword [0x7d2abf48]
lea rdx, str.GetFinalPathNameByHandleW
mov rcx, qword [0x7d2abf40]
test rax, rax
cmovne rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x7d2385f2
lea r8, [0x7d234a80]
mov rdx, rax
lea rcx, str.GetFinalPathNameByHandleW
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2ac0b8], rax
test rax, rax
je 0x7d23844f
mov eax, dword [0x7d2abfb4]
cmp eax, 0x20d0
jb 0x7d238647
cmp byte [0x7d2abfa9], 0
je 0x7d238647
mov rcx, qword [0x7d2abf48]
lea rdx, str.GetTempPathW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x7d238647
lea r8, [0x7d237b80]
mov rdx, rax
lea rcx, str.GetTempPathW
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2ac088], rax
test rax, rax
je 0x7d23844f
cmp byte [0x7d2abfac], 0
je 0x7d238698
mov rax, qword [0x7d2abf48]
lea rdx, str.GetVolumeInformationW
mov rcx, qword [0x7d2abf40]
test rax, rax
cmovne rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, rax
lea r8, [0x7d238030]
lea rcx, str.GetVolumeInformationW
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2ac078], rax
test rax, rax
je 0x7d23844f
cmp dword [0x7d2abfb0], 0xb
jne 0x7d2386e9
mov rax, qword [0x7d2abf48]
lea rdx, str.WriteProcessMemory
mov rcx, qword [0x7d2abf40]
test rax, rax
cmovne rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, rax
lea r8, [0x7d2445f0]
lea rcx, str.WriteProcessMemory
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2ac080], rax
test rax, rax
je 0x7d23844f
mov al, 1
add rsp, 0x28
ret