Function at 0x729a9f4a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov ax, word [0x72a4f0f4]
push ebx
push esi
push edi
push dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
push 1
push ebx
push eax
push dword [ebp + 8]
call fcn.729a99ac
cmp eax, ebx
je 0x729a9f8b
mov ecx, dword [ebp + 0x10]
mov dx, word [0x72a4f0f4]
mov word [ecx], dx
lea esp, [ebp - 0x30]
pop edi
pop esi
pop ebx
leave
ret 0xc
push dword [ebp + 0xc]
mov ax, word [0x72a4f0f0]
push 1
push ebx
push eax
push dword [ebp + 8]
call fcn.729a99ac
cmp eax, ebx
mov dword [ebp - 0xc], eax
je 0x729aa19f
mov ecx, dword [ebp + 0x10]
mov dx, word [0x72a4f0f0]
push eax
mov word [ecx], dx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, eax
push ebx
mov dword [ebp - 0x14], ebx
call edi
lea esi, [eax + ebx + 1]
push esi
mov dword [ebp + 0x10], esi
call edi
mov ebx, eax
lea esi, [ebx + esi + 1]
push esi
mov dword [ebp - 0x10], esi
call edi
mov esi, dword [ebp - 8]
mov dword [ebp + 0xc], eax
lea eax, [ebp - 8]
push eax
push 0
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x729aa009
test eax, eax
mov dword [ebp - 8], esi
jne 0x729aa14b
mov edx, dword [ebp + 0xc]
mov eax, dword [0x72a4e7d0]
mov ecx, dword [eax]
lea edx, [edx + ebx + 0x204]
push edx
push eax
call dword [ecx + 0xc]
mov esi, eax
test esi, esi
mov dword [ebp - 4], esi
je 0x729aa14b
lea eax, [esi + 0x101]
mov dword [ebp + 8], 0x100
mov dword [ebp + 0xc], eax
lea eax, [ebp + 8]
push eax
push esi
push 0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x729aa14b
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp + 0xc]
call esi
push dword [ebp - 4]
call edi
mov ecx, dword [ebp + 0xc]
push dword [ebp + 0x10]
add eax, ecx
lea edi, [eax + 1]
mov byte [eax], 0x20
push edi
call esi
push dword [ebp - 0x10]
lea eax, [ebx + edi]
mov byte [eax], 0x20
inc eax
push eax
call esi
mov esi, dword [ebp - 0x14]
mov eax, esi
shr eax, 0x10
test ax, ax
je 0x729aa18d
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ecx + ecx + 2]
add eax, 3
and al, 0xfc
call fcn.7295b2e8
mov eax, esp
push esi
push eax
call fcn.72945cbc
lea ecx, [ebp - 0x24]
push ecx
push eax
call fcn.729b0184
mov esi, dword [ebp + 0xc]
mov eax, esi
shr eax, 0x10
test ax, ax
je 0x729aa194
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ecx + ecx + 2]
add eax, 3
and al, 0xfc
call fcn.7295b2e8
mov eax, esp
push esi
push eax
call fcn.72945cbc
mov ebx, eax
mov esi, dword [ebp - 4]
mov eax, esi
shr eax, 0x10
test ax, ax
je 0x729aa19b
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ecx + ecx + 2]
add eax, 3
and al, 0xfc
call fcn.7295b2e8
mov eax, esp
push esi
push eax
call fcn.72945cbc
push ebx
push eax
xor eax, eax
push 0
push eax
push eax
push eax
push eax
push 1
sub esp, 0x10
lea esi, [ebp - 0x24]
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.729a9b14
mov dword [ebp + 0xc], eax
xor esi, esi
cmp dword [ebp - 4], esi
je 0x729aa160
mov eax, dword [0x72a4e7d0]
push dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
cmp dword [ebp - 0xc], esi
je 0x729aa177
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [ebp - 8], esi
je 0x729aa185
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 0xc]
jmp 0x729a9f81
mov eax, esi
jmp 0x729aa0b7
mov ebx, esi
jmp 0x729aa0f7
mov eax, esi
jmp 0x729aa12b
push dword [ebp + 0xc]
mov ax, word [0x72a4f0f8]
push 1
push ebx
push eax
push dword [ebp + 8]
call fcn.729a99ac
cmp eax, ebx
mov dword [ebp - 0xc], eax
je 0x729aa14b
mov ecx, dword [ebp + 0x10]
mov dx, word [0x72a4f0f8]
push eax
mov word [ecx], dx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
mov dword [ebp + 0xc], esi
mov dword [ebp + 8], esi
shr dword [ebp + 0xc], 0x10
cmp word [ebp + 0xc], bx
je 0x729aa2b2
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ecx + ecx + 2]
add eax, 3
and al, 0xfc
call fcn.7295b2e8
mov eax, esp
push esi
push eax
call fcn.72945cbc
lea ecx, [ebp - 0x24]
push ecx
push eax
call dword [sym.imp.ole32.dll_GetClassFile]
cmp eax, ebx
je 0x729aa225
lea eax, [ebp - 0x24]
push eax
push 0x72969704
call fcn.729b0184
mov eax, dword [0x72a4e7d0]
mov esi, 0x100
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov ebx, eax
test ebx, ebx
mov dword [ebp - 4], ebx
je 0x729aa14b
push 0
push esi
lea eax, [ebp - 0x24]
push ebx
push eax
call fcn.729aa3d8
cmp word [ebp + 0xc], 0
je 0x729aa2b9
mov edi, dword [ebp + 8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ecx + ecx + 2]
add eax, 3
and al, 0xfc
call fcn.7295b2e8
mov eax, esp
push dword [ebp + 8]
push eax
call fcn.72945cbc
mov esi, eax
mov eax, ebx
shr eax, 0x10
test ax, ax
je 0x729aa2be
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ecx + ecx + 2]
add eax, 3
and al, 0xfc
call fcn.7295b2e8
mov eax, esp
push ebx
push eax
call fcn.72945cbc
push esi
jmp 0x729aa12c
mov eax, esi
jmp 0x729aa208
mov esi, dword [ebp + 8]
jmp 0x729aa27f
mov eax, ebx
jmp 0x729aa2ac