Function at 0x1000b410
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1dc
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
test byte [0x10015080], 8
jne 0x1000b5c8
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0x18]
test eax, eax
sete cl
test edx, edx
sete al
or cl, al
jne 0x1000b6f8
test esi, esi
je 0x1000b6f8
lea ebx, [ebp - 0x1aa]
mov dword [esp + 8], 0x27
movzx edi, di
mov dword [esp + 4], ebx
mov dword [esp], esi
call dword [sym.imp.ole32.dll_StringFromGUID2]
sub esp, 0xc
mov dword [esp + 0x14], edi
lea edi, [ebp - 0x15c]
mov dword [esp], edi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x10], str.Assemblies
mov dword [esp + 0xc], str.SOFTWAREMicrosoftCTF
mov dword [esp + 8], str._s_s0x_08x_s
mov dword [esp + 4], 0xa8
call sym._swprintf_1
lea eax, [ebp - 0x1b4]
mov dword [esp + 4], edi
mov edi, 1
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x2001f
mov dword [esp + 8], 0
mov dword [esp], 0x80000001
call dword [sym.imp.advapi32.dll_RegOpenKeyExW]
sub esp, 0x14
test eax, eax
je 0x1000b4f0
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret 0x14
lea eax, [ebp - 0x1b0]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x1b4]
mov dword [ebp - 0x1b0], 0x4e
mov dword [esp], eax
mov eax, dword [sym.imp.advapi32.dll_RegQueryValueExW]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.Default
mov dword [ebp - 0x1b8], eax
call eax
sub esp, 0x18
mov edi, eax
test eax, eax
jne 0x1000b6a8
mov eax, dword [ebp + 0x14]
mov esi, dword [sym.imp.ole32.dll_CLSIDFromString]
mov dword [esp], ebx
mov dword [esp + 4], eax
call esi
lea eax, [ebp - 0x1b0]
mov dword [ebp - 0x1b0], 0x4e
sub esp, 8
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x1b4]
mov dword [esp + 0x10], ebx
mov dword [esp], eax
mov eax, dword [ebp - 0x1b8]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.Profile
call eax
sub esp, 0x18
test eax, eax
je 0x1000b6d0
mov eax, dword [ebp - 0x1b4]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, edi
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0x14
test esi, esi
je 0x1000b6e8
mov eax, esi
shr eax, 0x10
je 0x1000b690
movzx eax, byte [esi + 0xf]
mov dword [esp + 0x2c], eax
movzx eax, byte [esi + 0xe]
mov dword [esp + 0x28], eax
movzx eax, byte [esi + 0xd]
mov dword [esp + 0x24], eax
movzx eax, byte [esi + 0xc]
mov dword [esp + 0x20], eax
movzx eax, byte [esi + 0xb]
mov dword [esp + 0x1c], eax
movzx eax, byte [esi + 0xa]
mov dword [esp + 0x18], eax
movzx eax, byte [esi + 9]
mov dword [esp + 0x14], eax
movzx eax, byte [esi + 8]
mov dword [esp + 0x10], eax
movzx eax, word [esi + 6]
mov dword [esp + 0xc], eax
movzx eax, word [esi + 4]
mov dword [esp + 8], eax
mov eax, dword [esi]
mov dword [esp], 0x10018788
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_5
mov edx, dword [ebp + 0x18]
mov dword [esp + 0x18], eax
movzx eax, di
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x20], edx
mov edx, dword [ebp + 0x14]
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], edx
mov dword [esp + 0xc], str._p___x__s__p__p_n
mov dword [esp + 8], str.InputProcessorProfiles_GetDefaultLanguageProfile
mov dword [esp + 4], 0x10015080
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_5
jmp 0x1000b42f
movzx eax, si
mov dword [esp], 0x10018777
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_5
jmp 0x1000b63d
mov eax, dword [ebp - 0x1b4]
mov edi, 1
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, edi
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0x14
mov eax, dword [ebp + 0x18]
mov dword [esp], ebx
mov dword [esp + 4], eax
call esi
sub esp, 8
jmp 0x1000b5a4
mov eax, 0x10018760
jmp 0x1000b63d
mov edi, 0x80070057
jmp 0x1000b4dd