Function at 0x6f252ae0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, eax
push edi
push esi
mov esi, edx
push ebx
sub esp, 0x15c
test byte [0x6f2661e0], 8
jne 0x6f252db0
mov edi, dword [sym.imp.kernel32.dll_GetProfileStringW]
mov dword [esp + 0x10], pe_nt_image_headers32
lea ebx, [esp + 0x50]
mov dword [esp + 8], 0x6f26bad6
mov dword [esp + 0xc], ebx
mov dword [esp + 4], esi
mov dword [esp], str.Sounds
call edi
sub esp, 0x14
movzx edx, word [esp + 0x50]
test dx, dx
jne 0x6f252d06
test ebp, 2
je 0x6f252cd0
lea eax, [esp + 0x38]
mov edi, dword [sym.imp.advapi32.dll_RegOpenKeyW]
mov dword [esp + 4], str.AppEventsSchemesApps
mov dword [esp + 8], eax
mov dword [esp], 0x80000001
call edi
sub esp, 0xc
test eax, eax
jne 0x6f252d98
and ebp, 0x80
jne 0x6f252d60
lea eax, [esp + 0x3c]
mov dword [esp + 4], str..Default
mov dword [esp + 8], eax
mov eax, dword [esp + 0x38]
mov dword [esp], eax
call edi
mov ebp, dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 0xc
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x38]
mov dword [esp], eax
call ebp
sub esp, 4
mov edx, dword [esp + 0x2c]
test edx, edx
jne 0x6f252d98
lea eax, [esp + 0x40]
mov dword [esp + 4], esi
mov dword [esp + 8], eax
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call edi
sub esp, 0xc
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call ebp
sub esp, 4
mov eax, dword [esp + 0x2c]
test eax, eax
jne 0x6f252d98
mov eax, dword [esp + 0x40]
lea edx, [esp + 0x44]
mov dword [esp + 4], str..Default
mov dword [esp + 8], edx
mov dword [esp], eax
call edi
sub esp, 0xc
test eax, eax
lea edx, [esp + 0x44]
je 0x6f252c3d
mov eax, dword [esp + 0x40]
mov dword [esp + 8], edx
mov dword [esp + 4], str..Current
mov dword [esp], eax
call edi
sub esp, 0xc
mov edi, eax
mov eax, dword [esp + 0x40]
mov dword [esp], eax
call ebp
sub esp, 4
test edi, edi
jne 0x6f252d98
lea eax, [esp + 0x4c]
mov dword [esp + 0x4c], 0x100
mov dword [esp + 0x14], eax
lea eax, [esp + 0x48]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x10], ebx
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
sub esp, 0x18
mov edi, eax
mov eax, dword [esp + 0x44]
mov dword [esp], eax
call ebp
sub esp, 4
test edi, edi
jne 0x6f252d98
cmp word [esp + 0x50], 0
je 0x6f252d98
mov dword [esp + 8], 0x10020
mov dword [esp + 4], 0
mov dword [esp], ebx
call sym.winmm.dll_mmioOpenW
sub esp, 0xc
test eax, eax
je 0x6f252d98
add esp, 0x15c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x10], pe_nt_image_headers32
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x6f26bad6
mov dword [esp + 4], str.Default
mov dword [esp], str.Sounds
call edi
sub esp, 0x14
movzx edx, word [esp + 0x50]
test dx, dx
je 0x6f252b43
mov eax, ebx
cmp dx, 0x2c
je 0x6f252d27
nop
movzx edx, word [eax + 2]
add eax, 2
test dx, dx
je 0x6f252d2c
cmp dx, 0x2c
jne 0x6f252d10
test dx, dx
je 0x6f252d2c
xor edi, edi
mov word [eax], di
mov dword [esp + 8], 0x10020
mov dword [esp + 4], 0
mov dword [esp], ebx
call sym.winmm.dll_mmioOpenW
sub esp, 0xc
test eax, eax
je 0x6f252b43
add esp, 0x15c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], pe_nt_image_headers32
mov dword [esp + 4], ebx
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleFileNameW]
sub eax, 1
sub esp, 0xc
cmp eax, 0x7e
jbe 0x6f252e20
mov eax, dword [esp + 0x38]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
test byte [0x6f2661e0], 4
jne 0x6f252de8
xor eax, eax
add esp, 0x15c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, edx
call fcn.6f2527f0
mov dword [esp + 0xc], str.searching_in_SystemSound_list_for__s_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0x6f26be24
mov dword [esp + 4], 0x6f2661e0
mov dword [esp], 3
call fcn.6f252a90
jmp 0x6f252afb
mov eax, esi
call fcn.6f2527f0
mov dword [esp + 0xc], str.cant_find_SystemSound_s___n
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0x6f26be24
mov dword [esp + 4], 0x6f2661e0
mov dword [esp], 2
call fcn.6f252a90
xor eax, eax
jmp 0x6f252da3
cmp word [esp + 0x50], 0
mov eax, ebx
je 0x6f252d88
nop
add eax, 2
cmp word [eax], 0
jne 0x6f252e30
sub eax, 2
cmp eax, ebx
jae 0x6f252e59
jmp 0x6f252d88
cmp dx, 0x5c
je 0x6f252e70
sub eax, 2
cmp eax, ebx
jb 0x6f252d88
movzx edx, word [eax]
cmp dx, 0x2e
jne 0x6f252e48
xor ecx, ecx
mov word [eax], cx
jmp 0x6f252e4e
lea edx, [esp + 0x3c]
add eax, 2
mov dword [esp + 8], edx
mov dword [esp + 4], eax
jmp 0x6f252b89