Function at 0x728712
Capabilities:
Link many functions at runtime

Disassembly:
push 0x454
mov eax, 0x7b0cd0
call fcn.00772fd1
mov ebx, ecx
push 0x49
pop ecx
mov esi, str.I4vS7KAIOi9zP8SdEMT9UeSQa8QpTUf9tilZn41MmEWIEOs8Y6qfArXKlhXoPbfbaVlFTcMI8wFnRtx232Tw3tKQtWvzv1UUoVYRh4PtqTgMpUbWNTcPNcKh2v3WecZ5BDKHB4hWQtmBggkv9UqUQFFaNn0fTHophGmzwcUT7qfx4bPhT5WOk98JqgYinrH5wJ7LOHmLdrRvxmofTZJaWPInFiXr9mGcwjEI5BZ74l13N6k8OjyRN4alESu23p1MiiBWT399sbX6h1jToMDeCI8gpoVBWFV4mV6uWm
lea edi, [ebp - 0x138]
rep movsd dword es:[edi], dword [esi]
push 0x4d
pop ecx
xor eax, eax
movsw word es:[edi], word [esi]
mov dword [ebp - 0x460], eax
mov dword [ebp - 0x45c], eax
mov dword [ebp - 0x458], eax
movsb byte es:[edi], byte [esi]
mov esi, str.oyql9Yk8uyshVriuxZmaviQIfGDripu3lsRpLyIcMRK1jrpizia58YnwhBGEXWIdq3MXXuoIUXX2VWxassKXF07eFVyQsHxqS0d8xAV1HH1wTjHuibJeWmx5sitBmVnoFYKg8h7y5ftdA8ATzqHIEmCtVev9iQyptRmj39yndkXCv6FyXH18zYS6mNRViUerI3FW0xUkeZR6ZqIA4CskdX6a6IUbLfHmCmOFqJYQ2aVHR9axaIKO0bbzmTPVs3vJthQzlbqQ9Bj4jxiEaHSSkS4J9SdLIVuW8aRyl0DJTk3M40UhSynip
lea edi, [ebp - 0x270]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x438]
lea eax, [ebp - 0x138]
push eax
call fcn.00405a50
lea eax, [ebp - 0x438]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x460]
call fcn.004082f0
xor esi, esi
mov byte [ebp - 4], 0
push 0
inc esi
lea ecx, [ebp - 0x438]
push esi
call fcn.004096c0
lea eax, [ebp - 0x270]
push eax
lea ecx, [ebp - 0x438]
call fcn.00405a50
lea eax, [ebp - 0x438]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x460]
call fcn.004082f0
push 0
push esi
lea ecx, [ebp - 0x438]
mov byte [ebp - 4], 0
call fcn.004096c0
call fcn.00402330
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.kernel32.dll
call edi
mov dword [ebx], eax
test eax, eax
je 0x7288e2
call fcn.006f08f7
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x883460
push dword [ebx]
call esi
push str.IsWow64Process
push dword [ebx]
mov dword [ebx + 8], eax
call esi
push str.Wow64DisableWow64FsRedirection
push dword [ebx]
mov dword [ebx + 0xc], eax
call esi
mov dword [ebx + 0x18], eax
call fcn.00402330
push str.Wow64RevertWow64FsRedirection
push dword [ebx]
call esi
push str.GetSystemWow64DirectoryW
push dword [ebx]
mov dword [ebx + 0x14], eax
call esi
mov dword [ebx + 0x10], eax
call fcn.00402330
push str.advapi32.dll
call edi
mov dword [ebx + 4], eax
test eax, eax
je 0x7288e2
push str.Wow64RevertWow64FsRedirection
push eax
call esi
mov dword [ebx + 0x20], eax
xor eax, eax
mov dword [ebp - 0x42c], eax
mov dword [ebp - 0x428], eax
mov dword [ebp - 0x424], eax
push 0x6b
pop ecx
mov esi, str.oeMD3QQzjrKE4bMwpLo1nYNBB3W6PuiuaMVs5JQhcMrxh9Ksh5n6joATLSqzY1V8kviJpi07TUBId6AWIsBTVa0gRAe7NGy5kIPiIStqgYecet6C9SRsyp81b4KGJZq7WP01iy4pFMa7fy6mnRlbF2UaJyaeM7C5z9KWTxp1kxnCHdr202NeJi085JLQe382gT0TbG2YOosBtvRPNpnn5Sd5EdJ1GqWIpdg6XCZp9wtCFIcZBfx2qQeTaMOLAgzYBiyeuBxvvfuyJhsmcJYOcDNh7vcFSiNye1aSwUpVdOSajETjSfwnVUgMM7ZozV2edlDQjPT0vq1HTUaWicxwEf7hTlYU0htgO5IHklj0DLjqwe7dCtkpyt9yCNKYrYOrjDWCBuAmnpSBYFaOcY5d8jV1jNwyV0NWEdVU4Jirl5StXU
mov byte [ebp - 4], 3
lea edi, [ebp - 0x420]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x450]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
call fcn.00405a50
lea eax, [ebp - 0x450]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x42c]
call fcn.004082f0
xor esi, esi
lea ecx, [ebp - 0x450]
push 0
inc esi
push esi
call fcn.004096c0
push str.Wow64RevertWow64FsRedirection
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0x42c]
mov dword [ebx + 0x1c], eax
call fcn.006ec102
jmp 0x7288ef
and dword [ebp - 0x454], 0
mov esi, dword [ebp - 0x454]
lea ecx, [ebp - 0x460]
call fcn.006ec102
mov eax, esi
call fcn.00772f7b
ret