Function at 0x1800dd380
Capabilities:
Link many functions at runtime

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x38
cmp qword [0x18023e4e0], 0
je 0x1800dd39c
mov eax, 1
jmp 0x1800ddd20
cmp dword [0x18023e4d8], 0
je 0x1800dd3b6
cmp dword [rsp + 0x40], 0
jne 0x1800dd3b6
mov eax, 1
jmp 0x1800ddd20
mov dword [0x18023e4d8], 1
lea rax, [0x18023e4f0]
mov qword [rsp + 0x20], rax
lea rcx, [0x18023e4f0]
call fcn.1800fbc94
test rax, rax
jne 0x1800dd3e9
lea rax, str.TSandbox64.dll
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x18023e4e0], rax
cmp qword [0x18023e4e0], 0
je 0x1800ddd00
lea rdx, str.LoadTsdLogDrv
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e230], rax
lea rdx, str.UnloadTsdLogDrv
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e238], rax
lea rdx, str.LoadDriver
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e240], rax
lea rdx, str.UnloadDriver
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e248], rax
lea rdx, str.RegisterSandboxClass
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e250], rax
lea rdx, str.UnregisterSandboxClass
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e258], rax
lea rdx, str.EnumSandboxClassName
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e260], rax
lea rdx, str.QuerySandboxClassInformation
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e268], rax
lea rdx, str.CreateSandboxInstance
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e270], rax
lea rdx, str.CreateSandboxInstanceEx
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e278], rax
lea rdx, str.DestroySandboxInstance
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e280], rax
lea rdx, str.EnumSandboxInstanceName
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e288], rax
lea rdx, str.QuerySandboxInstanceInformation
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e290], rax
lea rdx, str.DeleteSandboxData
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e298], rax
lea rdx, str.GetSandboxPolicyLib
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e2a0], rax
lea rdx, str.SetSandboxPolicyLib
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e2a8], rax
lea rdx, str.SetSandboxPolicyLibFile
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e2b0], rax
lea rdx, str.UpdateSystemPolicyLib
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e2b8], rax
lea rdx, str.SetSystemPolicyLibPath
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e2c0], rax
lea rdx, str.GetSystemPolicyLibPath
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e2c8], rax
lea rdx, str.SetSandboxProcessCommonPolicy
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e2d0], rax
lea rdx, str.SetSandboxProcessCommonPolicyEx
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e2d8], rax
lea rdx, str.GetSandboxProcessCommonPolicy
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e2e0], rax
lea rdx, str.SetSandboxProcessPolicy
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e2e8], rax
lea rdx, str.SetProcessFilePolicy
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e2f0], rax
lea rdx, str.SetProcessObjectPolicy
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e2f8], rax
lea rdx, str.SetProcessRegPolicy
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e300], rax
lea rdx, str.SetProcessWindowPolicy
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e308], rax
lea rdx, str.SetProcessAccessPolicy
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e310], rax
lea rdx, str.AddSandboxProcess
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e318], rax
lea rdx, str.DelSandboxProcess
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e320], rax
lea rdx, str.GetSandboxProcessFlags
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e328], rax
lea rdx, str.SetSandboxProcessFlags
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e330], rax
lea rdx, str.GetSandboxProcessState
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e338], rax
lea rdx, str.SetSandboxProcessState
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e340], rax
lea rdx, str.RegisterCallback
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e348], rax
lea rdx, str.RegisterTSafeDocCallback
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e350], rax
lea rdx, str.EnumSandboxRunningProcess
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e358], rax
lea rdx, str.UpdateSandboxRunningProcess
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e360], rax
lea rdx, str.UpdateDriveData
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e368], rax
lea rdx, str.GetSandboxFilePath
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e370], rax
lea rdx, str.GetSandboxProcessFilePath
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e378], rax
lea rdx, str.GenerateSandboxFilePath
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e380], rax
lea rdx, str.ParseSandboxFilePath
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e388], rax
lea rdx, str.GenerateSandboxRegPath
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e390], rax
lea rdx, str.ParseSandboxRegPath
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e398], rax
lea rdx, str.ParseSandboxPolicyLib
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e3a0], rax
lea rdx, str.GenerateSandboxPolicyLib
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e3a8], rax
lea rdx, str.FreeBuffer
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e3b0], rax
lea rdx, str.AddFileControlPolicy
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e3b8], rax
lea rdx, str.AddFileControlPolicyByProcessID
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e3c0], rax
lea rdx, str.AddFileControlPolicyByProcessSandbox
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e3c8], rax
lea rdx, str.DelFileControlPolicyByFile
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e3d0], rax
lea rdx, str.DelFileControlPolicyByProcess
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e3d8], rax
lea rdx, str.DelFileControlPolicyByProcessID
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e3e0], rax
lea rdx, str.DelFileControlPolicyByProcessSandbox
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e3e8], rax
lea rdx, str.EnumFileControlPolicy
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e3f0], rax
lea rdx, str.SetCreateProcessEvent
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e3f8], rax
lea rdx, str.GetCreateProcessNotifyData
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e400], rax
lea rdx, str.GetCreateProcessNotifyDataEx
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e408], rax
lea rdx, str.GetProcessEventNotifyData
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e410], rax
lea rdx, str.SetProcessEventNotifyResult
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e418], rax
lea rdx, str.AddPassthru
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e420], rax
lea rdx, str.DelPassthru
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e428], rax
lea rdx, str.GetActualFilePath
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e430], rax
lea rdx, str.GetProcessActualFullPath
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e438], rax
lea rdx, str.GenerateSandboxPolicyEntry
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e440], rax
lea rdx, str.GenerateSandboxFilePolicy
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e448], rax
lea rdx, str.SetProcessFilePolicyEx
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e450], rax
lea rdx, str.GetDebugConfig
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e458], rax
lea rdx, str.SetDebugConfig
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e460], rax
lea rdx, str.SandboxFileOperate
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e468], rax
lea rdx, str.StartSandboxDrvTimer
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e470], rax
lea rdx, str.StopSandboxDrvTimer
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e478], rax
lea rdx, str.AddDynamicSandboxPolicy
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e480], rax
lea rdx, str.AddDynamicSandboxPolicy2
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e488], rax
lea rdx, str.DelDynamicSandboxPolicy
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e490], rax
lea rdx, str.EnableFileInfoCache
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e498], rax
lea rdx, str.DisableFileInfoCache
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e4a0], rax
lea rdx, str.ResetFileInfoCache
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e4a8], rax
lea rdx, str.ResetFileInfoCacheOfFile
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e4b0], rax
lea rdx, str.GetSecObjChanged
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e4b8], rax
lea rdx, str.FLogPEEnable
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e4c0], rax
lea rdx, str.FLogPESetPath
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e4c8], rax
lea rdx, str.CheckDetoursDelay
mov rcx, qword [0x18023e4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023e4d0], rax
cmp qword [0x18023e250], 0
je 0x1800ddd14
mov dword [rsp + 0x28], 1
jmp 0x1800ddd1c
mov dword [rsp + 0x28], 0
mov eax, dword [rsp + 0x28]
add rsp, 0x38
ret