Function at 0x7d229770
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov eax, dword [0x7d2b6fd0]
sub esp, 0x54
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x7d22979c
push str.oleaut32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.LoadTypeLibEx
push eax
call edi
mov dword [0x7d2b6fd0], eax
mov ecx, dword [0x7d2b6fd4]
test ecx, ecx
jne 0x7d2297dd
push 0x7d299118
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
push str.CreateProxyFromTypeInfo
push esi
call edi
push str.CreateStubFromTypeInfo
push esi
mov dword [0x7d2b6fd4], eax
call edi
mov ecx, dword [0x7d2b6fd4]
mov edx, eax
mov eax, dword [0x7d2b6fd0]
mov dword [0x7d2b6fd8], edx
jmp 0x7d2297e3
mov edx, dword [0x7d2b6fd8]
test eax, eax
je 0x7d229b90
test ecx, ecx
je 0x7d229b90
test edx, edx
je 0x7d229b90
push ebx
push 0x144
call fcn.7d2286c0
mov ebx, eax
test ebx, ebx
jne 0x7d22981a
pop ebx
pop edi
mov eax, 0x8007000e
pop esi
add esp, 0x54
ret 8
movups xmm0, xmmword [str.Interface_]
mov ecx, ebx
movups xmmword [ebx], xmm0
mov eax, dword [0x7d2991a0]
mov dword [ebx + 0x10], eax
lea edx, [ecx + 2]
mov ax, word [0x7d2991a4]
mov word [ebx + 0x14], ax
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x7d229840
sub ecx, edx
sar ecx, 1
push 0x30
lea eax, [ebx + ecx*2]
push eax
push dword [esp + 0x6c]
call dword [0x7d2b6fcc]
lea edi, [ebx - 2]
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x7d229862
mov eax, dword [0x7d2991ac]
mov edx, dword [str.TypeLib]
mov esi, edx
mov dword [edi], eax
nop dword [eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x7d229880
sub edx, esi
lea edi, [ebx - 2]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x7d229890
mov ecx, edx
lea eax, [esp + 0xc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push ebp
push eax
push 0x20019
push 0
mov ecx, edx
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
push 0x80000000
call dword [0x7d2b6f1c]
cmp eax, 2
jne 0x7d2298ed
call fcn.7d221262
test al, al
je 0x7d229b79
lea eax, [esp + 0x10]
push eax
push 0x20119
push 0
push ebx
push 0x80000000
call dword [0x7d2b6f1c]
test eax, eax
jne 0x7d229b79
mov ebp, dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea eax, [esp + 0x1c]
push 0x7d2990cc
push eax
call ebp
lea eax, [esp + 0x14]
push eax
push 0x13c
push ebx
push 2
lea eax, [esp + 0x2c]
push eax
push dword [esp + 0x24]
call dword [sym.imp.ntdll.dll_NtQueryValueKey]
test eax, eax
jne 0x7d229b6f
mov esi, dword [str.TypeLib]
mov ecx, esi
mov edx, dword [ebx + 8]
shr edx, 1
mov dword [esp + 0x14], edx
lea edi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x7d229940
sub ecx, edi
lea eax, [edx + edx]
sar ecx, 1
inc ecx
push eax
lea eax, [ebx + 0xc]
push eax
lea edi, [ebx + ecx*2]
push edi
call sub.ntdll.dll_memmove
mov ecx, ebx
add esp, 0xc
sub ecx, esi
nop dword [eax + eax]
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx + esi - 2], ax
test ax, ax
jne 0x7d229970
mov eax, 0x5c
mov word [edi - 2], ax
mov word [edi + 0x4c], ax
add edi, 0x4e
push 0x7d2991b0
lea eax, [esp + 0x20]
push eax
call ebp
mov esi, dword [sym.imp.ntdll.dll_NtQueryValueKey]
lea eax, [esp + 0x14]
push eax
push 0x40
lea eax, [esp + 0x2c]
push eax
push 2
lea eax, [esp + 0x2c]
push eax
push dword [esp + 0x24]
call esi
test eax, eax
jne 0x7d229b6f
mov eax, dword [esp + 0x2c]
shr eax, 1
mov dword [esp + 0x14], eax
add eax, eax
push eax
lea eax, [esp + 0x34]
push eax
push edi
call sub.ntdll.dll_memcpy
mov ecx, dword [esp + 0x20]
add esp, 0xc
test ecx, ecx
je 0x7d2299f7
cmp word [edi + ecx*2 - 2], 0
jne 0x7d2299f7
sub ecx, 1
mov dword [esp + 0x14], ecx
jne 0x7d2299e6
movups xmm0, xmmword [str.0win32]
movups xmmword [edi + ecx*2], xmm0
mov ax, word [0x7d2991d4]
mov word [edi + ecx*2 + 0x10], ax
push dword [esp + 0x10]
call dword [0x7d2b6f20]
lea eax, [esp + 0x10]
push eax
push 0x20019
push 0
push ebx
push 0x80000000
call dword [0x7d2b6f1c]
cmp eax, 2
jne 0x7d229a97
call fcn.7d221262
test al, al
je 0x7d229b79
lea eax, [esp + 0x10]
push eax
push 0x20119
push 0
push ebx
push 0x80000000
call dword [0x7d2b6f1c]
cmp eax, 2
jne 0x7d229a97
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x7d229a63
sub ecx, edx
sar ecx, 1
cmp ecx, 3
jbe 0x7d229a7f
mov dword [ebx + ecx*2 - 4], 0x340036
lea eax, [esp + 0x10]
push eax
push 0x20119
push 0
push ebx
push 0x80000000
call dword [0x7d2b6f1c]
test eax, eax
jne 0x7d229b79
push 0x7d2990cc
lea eax, [esp + 0x20]
push eax
call ebp
lea eax, [esp + 0x14]
push eax
push 0x13c
push ebx
push 2
lea eax, [esp + 0x2c]
push eax
push dword [esp + 0x24]
call esi
test eax, eax
jne 0x7d229b6f
mov eax, dword [ebx + 8]
shr eax, 1
mov dword [esp + 0x14], eax
add eax, eax
push eax
lea eax, [ebx + 0xc]
push eax
push ebx
call sub.ntdll.dll_memmove
mov eax, dword [esp + 0x20]
add esp, 0xc
xor ecx, ecx
mov word [ebx + eax*2], cx
push dword [esp + 0x10]
call dword [0x7d2b6f20]
push 0x410
call fcn.7d221505
push 0x410
mov esi, eax
push 0
push esi
call sub.ntdll.dll_memset
add esp, 0xc
push 0x200
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [esp + 0x18]
push eax
push 2
push esi
call dword [0x7d2b6fd0]
push esi
mov edi, eax
call fcn.7d221537
test edi, edi
js 0x7d229b7e
mov eax, dword [esp + 0x18]
push dword [esp + 0x6c]
push dword [esp + 0x6c]
mov ecx, dword [eax]
push eax
mov eax, dword [ecx + 0x18]
call eax
mov edi, eax
mov eax, dword [esp + 0x18]
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 8]
call eax
push ebx
call fcn.7d229cc0
pop ebp
pop ebx
mov eax, edi
pop edi
pop esi
add esp, 0x54
ret 8
push dword [esp + 0x10]
call dword [0x7d2b6f20]
mov edi, 0x8011041e
push ebx
call fcn.7d229cc0
pop ebp
pop ebx
mov eax, edi
pop edi
pop esi
add esp, 0x54
ret 8
push str.CreateTypeInfo
push 0x89d
call sym.SbieDll.dll_SbieApi_Log
add esp, 8
mov eax, 0x80004005
pop edi
pop esi
add esp, 0x54
ret 8