Function at 0x7d229360
Capabilities:
Link many functions at runtime
Query environment variable
Query or enumerate registry value

Disassembly:
sub esp, 0x1c
cmp dword [0x7d2b6fc8], 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push esi
jne 0x7d2293ad
cmp dword [0x7d2b735c], 0x20d0
mov eax, dword [0x7d2b6100]
cmovae eax, dword [0x7d2b60f4]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
push str.CoGetPSClsid
push esi
call ebx
push str.StringFromGUID2
push esi
mov dword [0x7d2b6fc8], eax
call ebx
mov dword [0x7d2b6fcc], eax
mov eax, dword [0x7d2b6f1c]
test eax, eax
jne 0x7d2293e8
push dword [0x7d2b60f0]
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
push 0x7d298034
push esi
call ebx
push 0x7d298068
push esi
mov dword [0x7d2b6f1c], eax
call ebx
mov ecx, eax
mov eax, dword [0x7d2b6f1c]
mov dword [0x7d2b6f20], ecx
jmp 0x7d2293ee
mov ecx, dword [0x7d2b6f20]
cmp dword [0x7d2b6fc8], 0
je 0x7d229679
cmp dword [0x7d2b6fcc], 0
je 0x7d229679
test eax, eax
je 0x7d229679
test ecx, ecx
je 0x7d229679
mov eax, dword [esp + 0x2c]
mov edx, 0x7d2a8aa8
mov ebx, dword [esp + 0x34]
mov esi, 0xc
push edi
mov edi, dword [esp + 0x2c]
mov ecx, edi
mov dword [eax], 0
mov eax, dword [esp + 0x34]
mov dword [ebx], 0
push ebp
mov dword [eax], 0
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x7d229469
add ecx, 4
add edx, 4
sub esi, 4
jae 0x7d229448
movups xmm0, xmmword [0x7d298c68]
xor ebp, ebp
movups xmmword [esp + 0x1c], xmm0
jmp 0x7d22947f
lea eax, [esp + 0x1c]
push eax
push edi
call dword [0x7d2b6fc8]
mov ebp, eax
test ebp, ebp
js 0x7d22966d
lea ecx, [esp + 0x1c]
mov edx, 0x7d298c58
mov esi, 0xc
nop dword [eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x7d2294b2
add ecx, 4
add edx, 4
sub esi, 4
jae 0x7d229490
push ebx
push edi
call fcn.7d229770
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1c
ret 0x10
push 0x144
call fcn.7d2286c0
mov ebx, eax
test ebx, ebx
jne 0x7d2294d1
pop ebp
pop edi
pop esi
mov eax, 0x8007000e
pop ebx
add esp, 0x1c
ret 0x10
movq xmm0, qword [str.CLSID_]
mov ecx, ebx
movq qword [ebx], xmm0
mov eax, dword [0x7d29909c]
mov dword [ebx + 8], eax
mov ax, word [0x7d2990a0]
lea edx, [ecx + 2]
mov word [ebx + 0xc], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x7d2294f4
sub ecx, edx
sar ecx, 1
push 0x30
lea eax, [ebx + ecx*2]
push eax
lea eax, [esp + 0x24]
push eax
call dword [0x7d2b6fcc]
lea edi, [ebx - 2]
nop word [eax + eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x7d229520
lea eax, [esp + 0x10]
mov ecx, 8
push eax
push 0x20019
push 0
push ebx
mov esi, str.InProcServer32
rep movsd dword es:[edi], dword [esi]
push 0x80000000
call dword [0x7d2b6f1c]
test eax, eax
jne 0x7d229658
push 0x7d2990cc
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea eax, [esp + 0x3c]
push eax
push 0x13c
push ebx
push 2
lea eax, [esp + 0x24]
push eax
push dword [esp + 0x24]
call dword [sym.imp.ntdll.dll_NtQueryValueKey]
test eax, eax
jne 0x7d22964e
mov eax, dword [ebx + 8]
shr eax, 1
mov dword [esp + 0x3c], eax
lea esi, [eax + eax]
push esi
lea eax, [ebx + 0xc]
push eax
push ebx
call sub.ntdll.dll_memmove
add esp, 0xc
xor eax, eax
mov word [esi + ebx], ax
push dword [esp + 0x10]
call dword [0x7d2b6f20]
push 0x410
call fcn.7d221505
push 0x410
mov esi, eax
push 0
push esi
call sub.ntdll.dll_memset
add esp, 0xc
push 0x200
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, dword [esp + 0x38]
test eax, eax
mov ecx, 0x800401f8
push esi
cmove ebp, ecx
mov dword [edi], eax
call fcn.7d221537
push ebx
call fcn.7d229cc0
test ebp, ebp
js 0x7d22966d
push str.DllGetClassObject
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x7d22961e
mov esi, 0x800401f9
jmp 0x7d229634
push dword [esp + 0x34]
lea ecx, [esp + 0x20]
push 0x7d2a8c9c
push ecx
call eax
mov esi, eax
test esi, esi
jns 0x7d229642
push dword [edi]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [edi], 0
pop ebp
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x1c
ret 0x10
push dword [esp + 0x10]
call dword [0x7d2b6f20]
mov eax, dword [esp + 0x38]
mov ebp, 0x80040154
push ebx
mov dword [eax], 0
call fcn.7d229cc0
mov eax, ebp
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1c
ret 0x10
push str.CreateProxyStubFactoryBuffer
push 0x89d
call sym.SbieDll.dll_SbieApi_Log
add esp, 8
mov eax, 0x80004005
pop esi
pop ebx
add esp, 0x1c
ret 0x10