Function at 0x7d225270
Capabilities:
Link many functions at runtime
Query environment variable
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rdi
push r14
push r15
sub rsp, 0x60
cmp qword [0x7d2abc90], 0
mov r15, r9
mov r14, r8
mov rbp, rdx
mov rdi, rcx
jne 0x7d2252e9
cmp dword [0x7d2abfb4], 0x20d0
mov rcx, qword [0x7d2aa180]
cmovae rcx, qword [0x7d2aa168]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.CoGetPSClsid
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.StringFromGUID2
mov rcx, rbx
mov qword [0x7d2abc90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x7d2abc98], rax
mov rax, qword [0x7d2abb88]
test rax, rax
jne 0x7d22533f
mov rcx, qword [0x7d2aa160]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
lea rdx, [0x7d28e060]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x7d28e098]
mov rcx, rbx
mov qword [0x7d2abb88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
mov qword [0x7d2abb90], rax
mov rax, qword [0x7d2abb88]
jmp 0x7d225346
mov rcx, qword [0x7d2abb90]
cmp qword [0x7d2abc90], 0
je 0x7d225608
cmp qword [0x7d2abc98], 0
je 0x7d225608
test rax, rax
je 0x7d225608
test rcx, rcx
je 0x7d225608
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x88], r12
xor r12d, r12d
mov qword [rbp], r12
mov qword [r15], r12
mov qword [r14], r12
mov rax, qword [rdi]
cmp rax, qword [0x7d29aeb8]
jne 0x7d2253bb
mov rax, qword [rdi + 8]
cmp rax, qword [0x7d29aec0]
jne 0x7d2253bb
movups xmm0, xmmword [0x7d28e9d0]
mov esi, r12d
movups xmmword [rsp + 0x40], xmm0
jmp 0x7d2253cf
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [0x7d2abc90]
mov esi, eax
test eax, eax
js 0x7d2253f6
mov rax, qword [rsp + 0x40]
cmp rax, qword [0x7d28e9c0]
jne 0x7d22541c
mov rax, qword [rsp + 0x48]
cmp rax, qword [0x7d28e9c8]
jne 0x7d22541c
mov rdx, r15
mov rcx, rdi
call fcn.7d225710
mov rsi, qword [rsp + 0x80]
mov r12, qword [rsp + 0x88]
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
mov ecx, 0x144
call fcn.7d2244c0
mov rdi, rax
test rax, rax
jne 0x7d225435
mov eax, 0x8007000e
jmp 0x7d2253f6
movsd xmm0, qword [str.CLSID_]
movsd qword [rax], xmm0
mov eax, dword [0x7d28ece8]
mov dword [rdi + 8], eax
movzx eax, word [0x7d28ecec]
mov word [rdi + 0xc], ax
or rax, 0xffffffffffffffff
nop dword [rax]
cmp word [rdi + rax*2 + 2], r12w
lea rax, [rax + 1]
jne 0x7d225460
lea rdx, [rdi + rax*2]
mov r8d, 0x30
lea rcx, [rsp + 0x40]
call qword [0x7d2abc98]
lea rax, [rdi - 2]
cmp word [rax + 2], r12w
lea rax, [rax + 2]
jne 0x7d225485
movups xmm0, xmmword [str.InProcServer32]
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rdi
mov rcx, 0xffffffff80000000
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x7d28ed00]
movups xmmword [rax + 0x10], xmm1
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
call qword [0x7d2abb88]
test eax, eax
jne 0x7d225596
lea rdx, [0x7d28ed18]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x50]
mov r9, rdi
mov dword [rsp + 0x20], 0x13c
mov r8d, 2
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
mov ebx, eax
test eax, eax
jne 0x7d225537
mov ecx, dword [rdi + 8]
lea rdx, [rdi + 0xc]
shr ecx, 1
mov r8d, ecx
mov dword [rsp + 0x30], ecx
add r8, r8
mov rcx, rdi
call sub.ntdll.dll_memmove
mov ecx, dword [rsp + 0x30]
mov word [rdi + rcx*2], r12w
mov rcx, qword [rsp + 0x38]
call qword [0x7d2abb90]
test ebx, ebx
jne 0x7d225596
mov ecx, 0x410
call fcn.7d2212da
xor edx, edx
mov r8d, 0x410
mov rcx, rax
mov rbx, rax
call sub.ntdll.dll_memset
mov r8d, 0x200
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
mov qword [r14], rax
mov ecx, 0x800401f8
cmove esi, ecx
mov rcx, rbx
call fcn.7d221938
jmp 0x7d22559e
mov qword [r14], r12
mov esi, 0x80040154
mov rcx, rdi
call fcn.7d225c90
test esi, esi
jns 0x7d2255b1
mov eax, esi
jmp 0x7d2253f6
mov rcx, qword [r14]
lea rdx, str.DllGetClassObject
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x7d2255de
mov rcx, qword [r14]
mov ebx, 0x800401f9
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov qword [r14], r12
jmp 0x7d2253f6
mov r8, rbp
lea rdx, [0x7d29b308]
lea rcx, [rsp + 0x40]
call rax
mov ebx, eax
test eax, eax
jns 0x7d225601
mov rcx, qword [r14]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [r14], r12
mov eax, ebx
jmp 0x7d2253f6
lea rdx, str.CreateProxyStubFactoryBuffer
mov ecx, 0x89d
call sym.imfsbDll.dll_SbieApi_Log
mov eax, 0x80004005
jmp 0x7d225406