Function at 0x729ef6
Capabilities:
Link many functions at runtime

Disassembly:
push 0x6b0
mov eax, 0x7b251f
call fcn.00774621
mov dword [ebp - 0x6b0], ecx
push 0x53
pop ecx
mov esi, str.wE8hxyHPLK0FVSEbdAXcldqFOPGF4a8BnMzNXeTmrBeL6YmutK2GDSVU88Td5tU7Ob6Rson7xPQ6ciBrnUK8JxF4fkmsn1zv4nf18PFSu8n0wyEqUMOZMu90p39OHnJLeMhJf95GPTDGQxD5FNxF8Ng5Zv6anhNgEkNU20SNUutMDuNjt2iRY9ByAEO0qZ7JxZS2oPiPqXIA4caB33d6Z0yOVwK8XQpl4C1rdeygBv0z1Np0PfXKes69JLJQDjTucUZTg92QpMu0xeQe6Rb1HhBIOMzspMhtAMwGe9JoWEFkFndaTPTQZSLlTb5vBpSwzzhZk4ss01pTa
lea edi, [ebp - 0x160]
rep movsd dword es:[edi], dword [esi]
push 0x6e
pop ecx
xor ebx, ebx
movsw word es:[edi], word [esi]
mov esi, str.SdxOHd3hOuF6B964Nv1PheKKW1RvJqJuh9DF78k2VLuK9zyuTZGnuafBIDOJc68x3DNnpAyTPrunBTHa1otT5FQJssWJ7lofQsbXtRCmHCryaMJg82dfjUrvR8FTtCswYumXsReQFUfCV5r8Q4Lvpkh1I7wwkHcMUZk0qC2TqCcRRCwvYDsni0vZKIo9R7VUkYARkQc9nSB4Td7LxBpfcOMPnBUOHMi4eZAz7mvpEagD5yAKPjQcgAt3IWW7jwiUzEce3o4bpMvSYOUELw4Wx4zEoDlg6nMns2TqXEQplUjLvcwiSWeBx8cpLBQMKRejhrm3M15q2y0lGO8c8jAxnGeQmuqeWTp0t56l6x6Hut0oIkpIupZLel7OeKsvvdcokGMy4aGOqghnWUzpXWI9VtDGoVqztNP3POGWtgPMhpZW1kMOUZk7CIve
mov dword [ebp - 0x6bc], ebx
lea edi, [ebp - 0x480]
mov dword [ebp - 0x6b8], ebx
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x6b4], ebx
movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x160]
mov dword [ebp - 4], ebx
push eax
lea ecx, [ebp - 0x67c]
call fcn.00405a00
lea eax, [ebp - 0x67c]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x6bc]
call fcn.00407ea0
push ebx
push 1
lea ecx, [ebp - 0x67c]
mov byte [ebp - 4], bl
call fcn.006eb1be
lea eax, [ebp - 0x480]
push eax
lea ecx, [ebp - 0x67c]
call fcn.00405a00
lea eax, [ebp - 0x67c]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x6bc]
call fcn.00407ea0
push ebx
push 1
lea ecx, [ebp - 0x67c]
mov byte [ebp - 4], bl
call fcn.006eb1be
call fcn.00402330
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, dword [ebp - 0x6b0]
mov dword [esi], eax
test eax, eax
je 0x72a13e
call fcn.00402330
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x8890bc
push dword [esi]
call edi
push str.IsWow64Process
push dword [esi]
mov dword [esi + 8], eax
call edi
push str.Wow64DisableWow64FsRedirection
push dword [esi]
mov dword [esi + 0xc], eax
call edi
mov dword [esi + 0x18], eax
mov dword [ebp - 0x670], ebx
mov dword [ebp - 0x66c], ebx
mov dword [ebp - 0x668], ebx
push 0x78
pop ecx
mov esi, str.LuFZIqZcwpqhQKttotFiLS3fSohA4pEPvaIDmLiTcKn4QoDKSUC5yRQ9scwaCrSepZkPuPjmLmqDiRj5A32h4X0AYh5r2O5cukixhYRKN3iePTASIezwsqXuirNBZOaT7nSb3wHembmtK8r56fwWodJlHkX4bmWrHQCagIAwHFcUsF9t4S5an6qJ6YWWy83vxzH4fMhe2iE1P2Paob0UIvUQdCGJmCiTOtHNiAGNDw5HcxWim94CkK9l2GSmm48XOxhVme3N0BLWgAcUTrcdoRo27ETnKqkQXWyRyTagl58mAz1oXMS1UJFLMcpQZFkKUIxFRRz00LfxiPDkJixEP8bPrNlEsXNhL8iTpenOAYZEZTFucuKzqElCdR4DDOgp2UVtCeKGYUObWDtGa4PDTOrgi6fntfbhB1dhhVPaeN9zPYkh2NFE1BIR9FsoHQnXUp1ovcHdymlAZYlrPTyhPEtD2wskhy9n
mov byte [ebp - 4], 3
lea edi, [ebp - 0x664]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x664]
push eax
lea ecx, [ebp - 0x694]
movsb byte es:[edi], byte [esi]
call fcn.00405a00
lea eax, [ebp - 0x694]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x670]
call fcn.00407ea0
push ebx
push 1
lea ecx, [ebp - 0x694]
mov byte [ebp - 4], 3
call fcn.006eb1be
mov esi, dword [ebp - 0x6b0]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.Wow64RevertWow64FsRedirection
push dword [esi]
call edi
push str.GetSystemWow64DirectoryW
push dword [esi]
mov dword [esi + 0x14], eax
call edi
mov dword [esi + 0x10], eax
call fcn.006f37e2
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi + 4], eax
test eax, eax
je 0x72a133
push str.Wow64RevertWow64FsRedirection
push eax
call edi
mov dword [esi + 0x20], eax
mov dword [ebp - 0x688], ebx
mov dword [ebp - 0x684], ebx
mov dword [ebp - 0x680], ebx
push 0x58
pop ecx
mov esi, str.61Djtk5wd1FwFOD0qGpWAJImmDowYyLh5ZPwh9ykmNrUdE1CR3dcOzw5h4F2oXMgjRwQEhxp3lexYHToGymDanOoKN5YLZaa6vG5eh3mE6QUJ74Tj14KGAE5P8pgHQPDSUlLKmdkafJgYfv0iK2QJeAnNC7nAxmvhrOjYyVcHyQknrciCaKbhhwVj4XEP1Rze7H7UYuI9870vyxohz65MphUzFR7qCaptCMPKS81UJR72DQe9F0NwxGpRiy55PrHAj2egzZetX8w6vrl6xFrMm6McLhjIVzKNyTWniQ00hjfN0s2afXRQHpWzhgqhWMBUypT7yPpJnFngk2Ci0aKMdcUGZFZ97ZFGU
mov byte [ebp - 4], 5
lea edi, [ebp - 0x2c4]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x2c4]
push eax
lea ecx, [ebp - 0x6ac]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
call fcn.00405a00
lea eax, [ebp - 0x6ac]
mov byte [ebp - 4], 6
push eax
lea ecx, [ebp - 0x688]
call fcn.00407ea0
push ebx
push 1
lea ecx, [ebp - 0x6ac]
call fcn.006eb1be
mov esi, dword [ebp - 0x6b0]
push str.Wow64RevertWow64FsRedirection
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0x688]
mov dword [esi + 0x1c], eax
inc ebx
call fcn.006eb210
lea ecx, [ebp - 0x670]
call fcn.006eb210
lea ecx, [ebp - 0x6bc]
call fcn.006eb210
mov eax, ebx
call fcn.007745cb
ret