Function at 0x72a66010
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x278]
mov esi, str.SYSTEMCurrentControlSetControlPrintMonitors_
push ebx
lea ebx, [ebp - 0x218]
sub esp, 0x2bc
mov eax, dword [str.SYSTEMCurrentControlSetControlPrintMonitors_]
mov dword [ebp - 0x27a], eax
mov eax, dword [0x72a785ae]
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x27a]
sub eax, edi
sub esi, eax
add eax, 0x62
shr eax, 2
mov ecx, eax
rep movsd dword es:[edi], dword [esi]
mov edi, ebx
mov dword [ebp - 0x298], 0
mov eax, ecx
mov ecx, 0x82
rep stosd dword es:[edi], eax
test byte [0x72a76664], 1
jne 0x72a662d0
mov ecx, ebx
lea eax, [ebp - 0x27a]
lea edi, [ebp - 0x72]
mov edx, 0x53
jmp 0x72a6609a
movzx edx, word [eax]
mov ecx, esi
test dx, dx
je 0x72a660a8
lea esi, [ecx + 2]
add eax, 2
mov word [esi - 2], dx
cmp eax, edi
jne 0x72a66090
xor edi, edi
mov eax, 0x104
mov edx, ebx
mov word [ecx], di
cmp word [edx], 0
je 0x72a66130
add edx, 2
lea esi, [ebp - 0x10]
sub eax, 1
cmp edx, esi
jne 0x72a660b4
lea eax, [ebp - 0x298]
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
mov dword [esp], 0x80000002
call sym._RegOpenKeyW_12
sub esp, 0xc
mov dword [ebp - 0x29c], eax
test eax, eax
je 0x72a66163
xor esi, esi
test byte [0x72a76664], 2
jne 0x72a66320
mov eax, dword [ebp - 0x298]
test eax, eax
je 0x72a66112
mov dword [esp], eax
call sym._RegCloseKey_4
sub esp, 4
mov eax, dword [ebp - 0x29c]
mov dword [esp], eax
call sym._SetLastError_4
mov eax, esi
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, 0x104
sub edx, eax
lea ecx, [ebx + edx*2]
mov edx, dword [ebp + 8]
jmp 0x72a66142
mov ecx, edi
movzx esi, word [edx]
test si, si
je 0x72a66159
lea edi, [ecx + 2]
add edx, 2
mov word [edi - 2], si
sub eax, 1
jne 0x72a66140
xor esi, esi
mov word [ecx], si
jmp 0x72a660c7
mov dword [esp], 0x24
call sym._DllAllocSplMem_4
sub esp, 4
mov ebx, eax
test eax, eax
je 0x72a663c3
lea edi, [eax + 4]
mov ecx, eax
mov dword [eax], 0
and edi, 0xfffffffc
mov dword [eax + 0x20], 0
mov eax, dword [ebp - 0x29c]
sub ecx, edi
add ecx, 0x24
shr ecx, 2
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._AllocSplStr_4
sub esp, 4
mov dword [ebx + 0xc], eax
test eax, eax
je 0x72a66420
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll_wcslen]
mov edx, dword [ebp + 0xc]
mov esi, eax
test edx, edx
je 0x72a66361
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._AllocSplStr_4
mov dword [ebx + 0x10], eax
sub esp, 4
mov edx, eax
mov dword [esp], edx
call sym._LoadLibraryW_4
sub esp, 4
mov edi, eax
test eax, eax
je 0x72a66470
mov dword [ebx + 0x14], eax
mov dword [esp + 4], str.InitializePrintMonitor2
mov dword [esp], eax
call sym._GetProcAddress_8
sub esp, 8
test eax, eax
je 0x72a665a0
mov dword [ebp - 0x294], 0x18
mov edx, dword [ebp - 0x298]
mov dword [ebp - 0x284], 1
mov dword [ebp - 0x28c], edx
lea edx, [ebx + 0x20]
mov dword [esp + 4], edx
lea edx, [ebp - 0x294]
mov dword [ebp - 0x288], 0x72a76620
mov dword [esp], edx
call eax
sub esp, 8
mov dword [ebx + 0x1c], eax
test eax, eax
je 0x72a666a0
mov eax, dword [0x72a7c524]
mov dword [ebx + 0x18], 1
mov dword [ebx], 0x72a7c520
mov dword [ebx + 4], eax
mov dword [eax], ebx
mov dword [0x72a7c524], ebx
test byte [0x72a76664], 1
je 0x72a662c1
mov eax, dword [ebx + 0x20]
mov dword [esp + 0x14], str.AddPrintMonitorList_Handle__p_n
mov dword [esp + 0x10], 0x25b
mov dword [esp + 0x18], eax
mov dword [esp + 0xc], str.AddPrintMonitorList
mov dword [esp + 8], 0x72a781a1
mov dword [esp + 4], 0x72a76664
mov dword [esp], 0
call sym._ros_dbg_log
add dword [ebx + 8], 1
mov esi, 1
jmp 0x72a660fd
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x14], str.AddPrintMonitorList___S___S__n
mov dword [esp + 0x10], 0x1da
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], str.AddPrintMonitorList
mov dword [esp + 0x18], eax
mov dword [esp + 8], 0x72a781a1
mov dword [esp + 4], 0x72a76664
mov dword [esp], 0
call sym._ros_dbg_log
jmp 0x72a66079
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], str.RegOpenKeyExW__S_failed_with_status__lu__n
mov dword [esp + 0x10], 0x1e3
mov dword [esp + 0xc], str.AddPrintMonitorList
mov dword [esp + 8], 0x72a781a1
mov dword [esp + 4], 0x72a76664
mov dword [esp], 1
call sym._ros_dbg_log
jmp 0x72a660fd
mov eax, dword [ebp - 0x298]
lea edi, [ebp - 0x294]
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], edi
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x72a782ec
mov dword [esp], eax
call sym._RegQueryValueExW_24
sub esp, 0x18
mov edx, eax
test eax, eax
je 0x72a664a0
test byte [0x72a76664], 2
jne 0x72a666c0
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x29c], edx
xor esi, esi
jmp 0x72a66495
mov dword [ebp - 0x29c], 8
xor esi, esi
test byte [0x72a76664], 2
je 0x72a660fd
mov dword [esp + 0x14], 0x72a78256
mov esi, ebx
mov dword [esp + 0x10], 0x1ec
mov dword [esp + 0xc], str.AddPrintMonitorList
mov dword [esp + 8], 0x72a781a1
mov dword [esp + 4], 0x72a76664
mov dword [esp], 1
call sym._ros_dbg_log
jmp 0x72a660fd
test byte [0x72a76664], 2
jne 0x72a66550
mov dword [ebp - 0x29c], 8
mov eax, dword [ebx + 0x10]
xor esi, esi
test eax, eax
je 0x72a6645d
mov dword [esp], eax
call sym._DllFreeSplMem_4
sub esp, 4
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x72a6645d
mov dword [esp], eax
call sym._DllFreeSplMem_4
sub esp, 4
mov dword [esp], ebx
call sym._DllFreeSplMem_4
sub esp, 4
jmp 0x72a660fd
test byte [0x72a76664], 2
jne 0x72a66500
call sym._GetLastError_0
test eax, eax
mov dword [ebp - 0x29c], eax
sete al
movzx eax, al
mov esi, eax
mov eax, dword [ebx + 0x10]
test eax, eax
jne 0x72a66440
jmp 0x72a6644b
mov eax, dword [ebp - 0x294]
mov dword [esp], eax
call sym._DllAllocSplMem_4
sub esp, 4
mov dword [ebp - 0x2a0], eax
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x298]
mov dword [esp + 0x14], edi
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x72a782ec
mov dword [esp], eax
call sym._RegQueryValueExW_24
mov edx, dword [ebp - 0x2a0]
sub esp, 0x18
mov dword [ebx + 0x10], edx
jmp 0x72a661e3
call sym._GetLastError_0
mov dword [esp + 0x1c], eax
mov eax, dword [ebx + 0x10]
mov dword [esp + 0x14], 0x72a782fc
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], 0x21a
mov dword [esp + 0xc], str.AddPrintMonitorList
mov dword [esp + 8], 0x72a781a1
mov dword [esp + 4], 0x72a76664
mov dword [esp], 1
call sym._ros_dbg_log
jmp 0x72a6647d
mov dword [esp + 0x14], 0x72a78256
mov dword [esp + 0x10], 0x1f7
mov dword [esp + 0xc], str.AddPrintMonitorList
mov dword [esp + 8], 0x72a781a1
mov dword [esp + 4], 0x72a76664
mov dword [esp], 1
call sym._ros_dbg_log
mov dword [ebp - 0x29c], 8
mov eax, dword [ebx + 0x10]
xor esi, esi
jmp 0x72a66495
mov dword [esp + 4], str.InitializePrintMonitor
mov dword [esp], edi
call sym._GetProcAddress_8
sub esp, 8
mov dword [ebp - 0x2a0], eax
test eax, eax
je 0x72a66705
lea eax, [esi + esi + 0x64]
mov dword [esp], eax
mov dword [ebp - 0x2a4], eax
call sym._DllAllocSplMem_4
sub esp, 4
mov edx, eax
test eax, eax
je 0x72a667b2
mov eax, dword [ebp - 0x27a]
lea edi, [edx + 4]
lea esi, [ebp - 0x27a]
and edi, 0xfffffffc
mov dword [edx], eax
mov eax, dword [ebp - 0x21e]
mov dword [edx + 0x5c], eax
mov eax, edx
sub eax, edi
lea ecx, [eax + 0x60]
sub esi, eax
mov eax, 0x5c
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov word [edx + 0x60], ax
mov eax, dword [ebp - 0x2a4]
mov dword [ebp - 0x2a4], edx
sub eax, 0x62
mov dword [esp + 8], eax
mov eax, dword [ebx + 0xc]
mov dword [esp + 4], eax
lea eax, [edx + 0x62]
mov dword [esp], eax
call sym._memmove
mov edx, dword [ebp - 0x2a4]
mov eax, dword [ebp - 0x2a0]
mov dword [esp], edx
call eax
mov edx, dword [ebp - 0x2a4]
sub esp, 4
test eax, eax
mov dword [ebx + 0x1c], eax
je 0x72a667d4
mov eax, dword [0x72a7c524]
mov dword [ebx], 0x72a7c520
mov dword [ebx + 4], eax
mov dword [eax], ebx
mov dword [0x72a7c524], ebx
test byte [0x72a76664], 1
jne 0x72a6683f
add dword [ebx + 8], 1
mov dword [esp], edx
mov esi, 1
call sym._DllFreeSplMem_4
sub esp, 4
jmp 0x72a660fd
test byte [0x72a76664], 2
jne 0x72a66761
lea esi, [esi]
mov eax, dword [ebx + 0x10]
mov esi, 1
jmp 0x72a66495
mov dword [esp + 0x14], str.DllName_not_found_n
mov dword [esp + 0x10], 0x20d
mov dword [esp + 0xc], str.AddPrintMonitorList
mov dword [esp + 8], 0x72a781a1
mov dword [esp + 4], 0x72a76664
mov dword [esp], 1
mov dword [ebp - 0x29c], eax
call sym._ros_dbg_log
mov edx, dword [ebp - 0x29c]
jmp 0x72a663b3
mov dword [ebp - 0x29c], 0x7f
mov eax, dword [ebx + 0x10]
xor esi, esi
test byte [0x72a76664], 2
je 0x72a66495
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], str.No_initialization_routine_found_for___S___n
mov dword [esp + 0x10], 0x254
mov dword [esp + 0xc], str.AddPrintMonitorList
mov dword [esp + 8], 0x72a781a1
mov dword [esp + 4], 0x72a76664
mov dword [esp], 1
call sym._ros_dbg_log
mov eax, dword [ebx + 0x10]
jmp 0x72a66495
call sym._GetLastError_0
mov esi, 1
mov dword [esp + 0x1c], eax
mov eax, dword [ebx + 0x10]
mov dword [esp + 0x14], str.InitializePrintMonitor2_failed_for___S__with_error__lu__n
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], 0x231
mov dword [esp + 0xc], str.AddPrintMonitorList
mov dword [esp + 8], 0x72a781a1
mov dword [esp + 4], 0x72a76664
mov dword [esp], 1
call sym._ros_dbg_log
mov eax, dword [ebx + 0x10]
jmp 0x72a66495
test byte [0x72a76664], 2
je 0x72a66584
mov dword [esp + 0x14], 0x72a78256
mov dword [esp + 0x10], 0x242
jmp 0x72a66560
test byte [0x72a76664], 2
jne 0x72a667ed
mov dword [esp], edx
call sym._DllFreeSplMem_4
sub esp, 4
jmp 0x72a666b0
mov dword [ebp - 0x2a0], edx
call sym._GetLastError_0
mov dword [esp + 0x1c], eax
mov eax, dword [ebx + 0x10]
mov dword [esp + 0x14], str.InitializePrintMonitor_failed_for___S__with_error__lu__n
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], 0x24e
mov dword [esp + 0xc], str.AddPrintMonitorList
mov dword [esp + 8], 0x72a781a1
mov dword [esp + 4], 0x72a76664
mov dword [esp], 1
call sym._ros_dbg_log
mov edx, dword [ebp - 0x2a0]
jmp 0x72a667dd
mov eax, dword [ebx + 0x20]
mov dword [esp + 0x14], str.AddPrintMonitorList_Handle__p_n
mov dword [esp + 0x10], 0x25b
mov dword [esp + 0x18], eax
mov dword [esp + 0xc], str.AddPrintMonitorList
mov dword [esp + 8], 0x72a781a1
mov dword [esp + 4], 0x72a76664
mov dword [esp], 0
mov dword [ebp - 0x2a0], edx
call sym._ros_dbg_log
add dword [ebx + 8], 1
mov edx, dword [ebp - 0x2a0]
jmp 0x72a66685