Function at 0x72ce80
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbe8
push ebx
push esi
push edi
xor esi, esi
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
push ebx
call fcn.00724c48
pop ecx
add eax, 0x23
cmp eax, 0x104
jbe 0x72ceb4
push 0x54f
call sub.kernel32.dll_SetLastError
jmp 0x72d0b3
push str.SYSTEMCurrentControlSetServices_
lea eax, [ebp - 0x210]
push eax
call fcn.00724fcc
add esp, 8
push ebx
lea edx, [ebp - 0x210]
push edx
call fcn.00725138
add esp, 8
lea ecx, [ebp - 4]
push ecx
push 0x20019
push 0
lea eax, [ebp - 0x210]
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW_1
mov ebx, eax
test ebx, ebx
je 0x72cf05
push ebx
call sub.kernel32.dll_SetLastError
jmp 0x72d0b3
mov dword [ebp - 8], 0x208
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0x210]
push edx
push 0
push 0
push str.ImagePath
mov ecx, dword [ebp - 4]
push ecx
call sub.advapi32.dll_RegQueryValueExW_1
mov ebx, eax
test ebx, ebx
je 0x72cf3a
push ebx
call sub.kernel32.dll_SetLastError
jmp 0x72d0b3
mov ecx, 2
mov eax, dword [ebp - 8]
xor edx, edx
div ecx
mov dword [ebp - 8], eax
push 0x5c
lea eax, [ebp - 0x210]
push eax
call fcn.00725178
add esp, 8
mov word [eax], 0
lea edx, [ebp - 0x210]
push edx
call fcn.00724c48
pop ecx
inc eax
mov dword [ebp - 8], eax
push 4
push str.___
lea ecx, [ebp - 0x210]
push ecx
call fcn.00724d70
add esp, 0xc
test eax, eax
jne 0x72cfaa
sub dword [ebp - 8], 4
mov eax, dword [ebp - 8]
lea edx, [ebp - 0x208]
add eax, eax
lea ecx, [ebp - 0x210]
push eax
push edx
push ecx
call fcn.00724bfc
add esp, 0xc
push 0x104
lea eax, [ebp - 0x418]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
cmp dword [ebp - 8], 0
mov ebx, eax
je 0x72d0b3
inc ebx
push 0x14
push str.SystemRoot_system32
lea eax, [ebp - 0x210]
push eax
call fcn.00725214
add esp, 0xc
test eax, eax
je 0x72d016
push 0x15
push str._SystemRoot_System32
lea edx, [ebp - 0x210]
push edx
call fcn.00725214
add esp, 0xc
test eax, eax
je 0x72d016
push 8
push str.system32
lea ecx, [ebp - 0x210]
push ecx
call fcn.00725214
add esp, 0xc
test eax, eax
jne 0x72d04b
cmp ebx, 0x104
jbe 0x72d02d
push 0x54f
call sub.kernel32.dll_SetLastError
jmp 0x72d0b3
mov eax, ebx
lea edx, [ebp - 0x418]
add eax, eax
lea ecx, [ebp - 0x210]
push eax
push edx
push ecx
call fcn.00724bdc
add esp, 0xc
mov dword [ebp - 8], ebx
cmp ebx, dword [ebp - 8]
jae 0x72d07b
mov eax, ebx
lea edx, [ebp - 0x418]
dec eax
lea ecx, [ebp - 0x210]
push eax
push edx
push ecx
call fcn.00725214
add esp, 0xc
test eax, eax
jne 0x72d07b
mov word [ebp + ebx*2 - 0x212], 0
mov dword [ebp - 8], ebx
mov eax, dword [edi]
cmp eax, dword [ebp - 8]
jae 0x72d090
mov edx, dword [ebp - 8]
mov dword [edi], edx
push 0x7a
call sub.kernel32.dll_SetLastError
jmp 0x72d0b3
mov ecx, dword [ebp - 8]
lea edx, [ebp - 0x210]
mov dword [edi], ecx
mov eax, dword [ebp - 8]
add eax, eax
push eax
push edx
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00724bdc
add esp, 0xc
mov esi, 1
call sub.kernel32.dll_GetLastError_2
cmp dword [ebp - 4], 0
mov ebx, eax
je 0x72d0c9
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
push ebx
call sub.kernel32.dll_SetLastError
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc