Function at 0x6f2527f0
Capabilities:
Contain obfuscated stackstrings
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, edx
push ebx
sub esp, 0x15c
mov dword [ebp - 0x13c], eax
test byte [0x6f266628], 8
jne 0x6f252a10
lea ebx, [ebp - 0x118]
mov dword [esp + 4], esi
mov edi, dword [sym.imp.kernel32.dll_GetProfileStringW]
mov dword [esp + 0x10], pe_nt_image_headers32
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x6f27473a
mov dword [esp], str.Sounds
call edi
movzx edx, word [ebp - 0x118]
sub esp, 0x14
test dx, dx
jne 0x6f252970
test byte [ebp - 0x13c], 2
je 0x6f252938
lea eax, [ebp - 0x130]
mov dword [esp + 4], str.AppEventsSchemesApps
mov edi, dword [sym.imp.advapi32.dll_RegOpenKeyW]
mov dword [esp + 8], eax
mov dword [esp], 0x80000001
call edi
sub esp, 0xc
test eax, eax
jne 0x6f25291a
test byte [ebp - 0x13c], 0x80
je 0x6f252a48
mov dword [esp + 8], pe_nt_image_headers32
mov dword [esp + 4], ebx
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleFileNameW]
dec eax
sub esp, 0xc
cmp eax, 0x7e
ja 0x6f252908
cmp word [ebp - 0x118], 0
mov eax, ebx
je 0x6f252908
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x6f2528c8
sub eax, 2
cmp eax, ebx
jae 0x6f2528f1
jmp 0x6f252908
cmp dx, 0x5c
je 0x6f252bd5
sub eax, 2
cmp eax, ebx
jb 0x6f252908
movzx edx, word [eax]
cmp dx, 0x2e
jne 0x6f2528e0
xor ecx, ecx
mov word [eax], cx
jmp 0x6f2528ea
mov eax, dword [ebp - 0x130]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
xor edi, edi
test byte [0x6f266628], 4
jne 0x6f2529d0
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x10], pe_nt_image_headers32
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x6f27473a
mov dword [esp + 4], str.Default
mov dword [esp], str.Sounds
call edi
movzx edx, word [ebp - 0x118]
sub esp, 0x14
test dx, dx
je 0x6f25285e
mov eax, ebx
cmp dx, 0x2c
je 0x6f252997
lea esi, [esi]
nop
movzx edx, word [eax + 2]
add eax, 2
test dx, dx
je 0x6f25299c
cmp dx, 0x2c
jne 0x6f252980
test dx, dx
je 0x6f25299c
xor edi, edi
mov word [eax], di
mov dword [esp + 8], 0x10020
mov dword [esp + 4], 0
mov dword [esp], ebx
call sym.winmm.dll_mmioOpenW
sub esp, 0xc
mov edi, eax
test eax, eax
je 0x6f25285e
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, esi
call sym._wine_dbgstr_wn.constprop.0_2
mov dword [esp + 0xc], str.cant_find_SystemSound_s___n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.get_mmioFromProfile
mov dword [esp + 4], 0x6f266628
mov dword [esp], 2
call sym._wine_dbg_log.constprop.0_5
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, edx
call sym._wine_dbgstr_wn.constprop.0_2
mov dword [esp + 0xc], str.searching_in_SystemSound_list_for__s_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.get_mmioFromProfile
mov dword [esp + 4], 0x6f266628
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_5
jmp 0x6f252811
lea eax, [ebp - 0x12c]
mov dword [esp + 4], str..Default
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x130]
mov dword [esp], eax
call edi
mov dword [ebp - 0x140], eax
mov eax, dword [ebp - 0x130]
sub esp, 0xc
mov dword [esp], eax
mov eax, dword [sym.imp.advapi32.dll_RegCloseKey]
mov dword [ebp - 0x13c], eax
call eax
mov edx, dword [ebp - 0x140]
sub esp, 4
test edx, edx
jne 0x6f25291a
lea eax, [ebp - 0x128]
mov dword [esp + 4], esi
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x12c]
mov dword [esp], eax
call edi
mov ecx, dword [ebp - 0x13c]
mov dword [ebp - 0x140], eax
mov eax, dword [ebp - 0x12c]
sub esp, 0xc
mov dword [esp], eax
call ecx
mov eax, dword [ebp - 0x140]
sub esp, 4
test eax, eax
jne 0x6f25291a
mov eax, dword [ebp - 0x128]
lea edx, [ebp - 0x124]
mov dword [esp + 4], str..Default
mov dword [esp + 8], edx
mov dword [esp], eax
call edi
lea edx, [ebp - 0x124]
sub esp, 0xc
test eax, eax
je 0x6f252b3b
mov eax, dword [ebp - 0x128]
mov dword [esp + 8], edx
mov dword [esp + 4], str..Current
mov dword [esp], eax
call edi
mov edi, eax
mov eax, dword [ebp - 0x128]
sub esp, 0xc
mov dword [esp], eax
mov eax, dword [ebp - 0x13c]
call eax
sub esp, 4
test edi, edi
jne 0x6f25291a
lea eax, [ebp - 0x11c]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x120]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x11c], 0x100
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
mov edi, eax
mov eax, dword [ebp - 0x124]
sub esp, 0x18
mov dword [esp], eax
mov eax, dword [ebp - 0x13c]
call eax
sub esp, 4
test edi, edi
jne 0x6f25291a
cmp word [ebp - 0x118], 0
je 0x6f25291a
mov dword [esp + 8], 0x10020
mov dword [esp + 4], 0
mov dword [esp], ebx
call sym.winmm.dll_mmioOpenW
sub esp, 0xc
mov edi, eax
test eax, eax
jne 0x6f252929
jmp 0x6f25291a
lea edx, [ebp - 0x12c]
add eax, 2
mov dword [esp + 8], edx
mov dword [esp + 4], eax
jmp 0x6f252a5a