Function at 0x72a68290
Capabilities:
Get domain information
Get hostname
Get session user name
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, edx
push esi
push ebx
mov ebx, eax
sub esp, 0x254
mov dword [ebp - 0x23c], ecx
mov esi, dword [sym.imp.msvcrt.dll__wcsicmp]
mov dword [esp + 4], str.DefaultSpoolDirectory
mov dword [esp], eax
call esi
test eax, eax
je 0x72a682ce
mov dword [esp + 4], str.PortThreadPriority
mov dword [esp], ebx
call esi
test eax, eax
jne 0x72a68310
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x23c]
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], eax
mov eax, dword [0x72a7c508]
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
mov dword [esp], eax
call sym._RegQueryValueExW_24
sub esp, 0x18
mov esi, eax
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], str.SchedulerThreadPriority
mov dword [esp], ebx
call esi
test eax, eax
je 0x72a682ce
mov dword [esp + 4], str.BeepEnabled
mov dword [esp], ebx
call esi
test eax, eax
je 0x72a682ce
mov dword [esp + 4], str.AllowUserManageForms
mov dword [esp], ebx
call esi
test eax, eax
je 0x72a682ce
mov dword [esp + 4], str.PortThreadPriorityDefault
mov dword [esp], ebx
call esi
test eax, eax
jne 0x72a68380
mov eax, dword [ebp + 0xc]
cmp dword [ebp + 8], 3
mov dword [edi], 0
mov dword [eax], 4
jbe 0x72a68440
mov eax, dword [ebp - 0x23c]
xor esi, esi
mov dword [eax], 0
jmp 0x72a68306
mov dword [esp + 4], str.SchedulerThreadPriorityDefault
mov dword [esp], ebx
call esi
test eax, eax
je 0x72a68354
mov dword [esp + 4], str.NetPopup
mov dword [esp], ebx
call esi
test eax, eax
je 0x72a683b7
mov dword [esp + 4], str.RetryPopup
mov dword [esp], ebx
call esi
test eax, eax
jne 0x72a68499
lea eax, [ebp - 0x214]
mov dword [esp + 0xc], 0x20019
mov dword [esp + 0x10], eax
mov eax, dword [0x72a7c50c]
mov dword [esp + 8], 0
mov dword [esp + 4], str.Providers
mov dword [esp], eax
call sym._RegOpenKeyExW_20
sub esp, 0x14
mov esi, eax
test eax, eax
je 0x72a6844a
test byte [0x72a76690], 2
je 0x72a68306
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], str.RegOpenKeyExW_failed_for__Providers__with_error__lu__n
mov dword [esp + 0x10], 0x78
mov dword [esp + 0xc], str._LocalGetPrintServerHandleData
mov dword [esp + 8], 0x72a78c99
mov dword [esp + 4], 0x72a76690
mov dword [esp], 1
call sym._ros_dbg_log
jmp 0x72a68306
mov esi, 0xea
jmp 0x72a68306
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [eax], edx
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x23c]
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x214]
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
mov dword [esp], eax
call sym._RegQueryValueExW_24
mov esi, eax
mov eax, dword [ebp - 0x214]
sub esp, 0x18
mov dword [esp], eax
call sym._RegCloseKey_4
sub esp, 4
jmp 0x72a68306
mov dword [esp + 4], str.NetPopupToComputer
mov dword [esp], ebx
call esi
test eax, eax
je 0x72a683b7
mov dword [esp + 4], str.EventLog
mov dword [esp], ebx
call esi
test eax, eax
je 0x72a683b7
mov dword [esp + 4], str.RestartJobOnPoolError
mov dword [esp], ebx
call esi
test eax, eax
je 0x72a683b7
mov dword [esp + 4], str.RestartJobOnPoolEnabled
mov dword [esp], ebx
call esi
test eax, eax
je 0x72a683b7
mov dword [esp + 4], str.MajorVersion
mov dword [esp], ebx
call esi
test eax, eax
jne 0x72a6852b
mov eax, dword [ebp + 0xc]
cmp dword [ebp + 8], 3
mov dword [edi], 0
mov dword [eax], 4
jbe 0x72a68440
mov eax, dword [0x72a78138]
mov edx, dword [ebp - 0x23c]
xor esi, esi
mov dword [edx], eax
jmp 0x72a68306
mov dword [esp + 4], str.MinorVersion
mov dword [esp], ebx
call esi
test eax, eax
jne 0x72a68569
mov eax, dword [ebp + 0xc]
cmp dword [ebp + 8], 3
mov dword [edi], 0
mov dword [eax], 4
jbe 0x72a68440
mov eax, dword [0x72a78134]
mov edx, dword [ebp - 0x23c]
xor esi, esi
mov dword [edx], eax
jmp 0x72a68306
mov dword [esp + 4], str.Architecture
mov dword [esp], ebx
call esi
test eax, eax
jne 0x72a685b4
mov eax, dword [0x72a7813c]
mov edx, dword [ebp + 0xc]
mov dword [edi], 0
mov dword [edx], eax
cmp eax, dword [ebp + 8]
ja 0x72a68440
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x23c]
xor esi, esi
mov dword [esp + 4], 0x72a78140
mov dword [esp], eax
call sym._memcpy
jmp 0x72a68306
mov dword [esp + 4], str.OSVersion
mov dword [esp], ebx
call esi
test eax, eax
jne 0x72a685fd
mov eax, dword [ebp + 0xc]
cmp dword [ebp + 8], 0x113
mov dword [edi], 0
mov dword [eax], 0x114
jbe 0x72a68440
mov eax, dword [ebp - 0x23c]
mov dword [eax], 0x114
mov dword [esp], eax
call sym._GetVersionExW_4
push esi
xor esi, esi
jmp 0x72a68306
mov dword [esp + 4], str.OSVersionEx
mov dword [esp], ebx
call esi
test eax, eax
jne 0x72a68646
mov eax, dword [ebp + 0xc]
cmp dword [ebp + 8], 0x11b
mov dword [edi], 0
mov dword [eax], 0x11c
jbe 0x72a68440
mov eax, dword [ebp - 0x23c]
xor esi, esi
mov dword [eax], 0x11c
mov dword [esp], eax
call sym._GetVersionExW_4
push ebx
jmp 0x72a68306
mov dword [esp + 4], str.DsPresent
mov dword [esp], ebx
call esi
test eax, eax
jne 0x72a686c6
mov eax, dword [ebp + 0xc]
cmp dword [ebp + 8], 3
mov dword [edi], 4
mov esi, 0xea
mov dword [eax], 4
jbe 0x72a68306
lea eax, [ebp - 0x214]
mov dword [esp + 4], 1
mov dword [esp + 8], eax
mov dword [esp], 0
call sym._DsRoleGetPrimaryDomainInformation_12
sub esp, 0xc
mov esi, eax
test eax, eax
je 0x72a6877d
test byte [0x72a76690], 2
je 0x72a68306
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], str.DsRoleGetPrimaryDomainInformation_failed_with_error__lu__n
mov dword [esp + 0x10], 0xd1
jmp 0x72a68410
mov dword [esp + 4], str.DsPresentForUser
mov dword [esp], ebx
call esi
test eax, eax
jne 0x72a6880c
mov eax, dword [ebp + 0xc]
cmp dword [ebp + 8], 3
mov dword [edi], 4
mov esi, 0xea
mov dword [eax], 4
jbe 0x72a68306
lea ebx, [ebp - 0x238]
lea esi, [ebp - 0x234]
mov dword [ebp - 0x238], 0x10
mov dword [esp + 4], ebx
mov dword [esp], esi
call sym._GetComputerNameW_8
push edx
push edx
test eax, eax
je 0x72a687df
mov dword [esp + 8], ebx
lea ebx, [ebp - 0x214]
mov dword [esp + 4], ebx
mov dword [esp], 2
mov dword [ebp - 0x238], 0x101
call sym._GetUserNameExW_12
sub esp, 0xc
test al, al
jne 0x72a687a7
call sym._GetLastError_0
mov esi, eax
test byte [0x72a76690], 2
je 0x72a68306
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], str.GetUserNameExW_failed_with_error__lu__n
mov dword [esp + 0x10], 0xf8
jmp 0x72a68410
mov edx, dword [ebp - 0x214]
mov edi, dword [ebp - 0x23c]
mov eax, dword [edx]
and eax, 0xfffffffd
sub eax, 1
sete al
movzx eax, al
mov dword [edi], eax
mov dword [esp], edx
call sym._DsRoleFreeMemory_4
push ecx
jmp 0x72a68306
mov dword [esp + 4], 0x5c
mov dword [esp], ebx
call sym._wcschr
mov word [eax], 0
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._wcscmp
mov edx, dword [ebp - 0x23c]
test eax, eax
setne al
xor esi, esi
movzx eax, al
mov dword [edx], eax
jmp 0x72a68306
call sym._GetLastError_0
mov esi, eax
test byte [0x72a76690], 2
je 0x72a68306
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], 0x72a78dbc
mov dword [esp + 0x10], 0xec
jmp 0x72a68410
mov dword [esp + 4], str.RemoteFax
mov dword [esp], ebx
call esi
test eax, eax
jne 0x72a68849
mov eax, dword [ebp + 0xc]
cmp dword [ebp + 8], 3
mov dword [edi], 0
mov dword [eax], 4
jbe 0x72a68440
mov eax, dword [ebp - 0x23c]
xor esi, esi
mov dword [eax], 1
jmp 0x72a68306
mov dword [esp + 4], str.DNSMachineName
mov dword [esp], ebx
call esi
test eax, eax
jne 0x72a688b9
lea ebx, [ebp - 0x214]
mov dword [esp + 4], 0
mov dword [esp + 8], ebx
mov dword [esp], 3
mov dword [ebp - 0x214], 0
call sym._GetComputerNameExW_12
sub esp, 0xc
call sym._GetLastError_0
mov esi, eax
cmp eax, 0xea
je 0x72a688c3
test byte [0x72a76690], 2
je 0x72a68306
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], str.GetComputerNameExW_failed_with_error__lu__n
mov dword [esp + 0x10], 0x11a
jmp 0x72a68410
mov esi, 0x57
jmp 0x72a68306
mov eax, dword [ebp - 0x214]
mov edx, dword [ebp + 0xc]
mov dword [edi], 1
add eax, eax
mov dword [edx], eax
cmp eax, dword [ebp + 8]
ja 0x72a68306
mov eax, dword [ebp - 0x23c]
mov dword [esp + 8], ebx
mov dword [esp], 3
mov dword [esp + 4], eax
call sym._GetComputerNameExW_12
sub esp, 0xc
test eax, eax
jne 0x72a6892d
call sym._GetLastError_0
mov esi, eax
test byte [0x72a76690], 2
je 0x72a68306
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], str.GetComputerNameExW_failed_with_error__lu__n
mov dword [esp + 0x10], 0x128
jmp 0x72a68410
mov eax, dword [ebp - 0x23c]
xor esi, esi
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__wcslwr]
jmp 0x72a68306