Function at 0x1000b9e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x228
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x14]
test byte [0x10015080], 8
jne 0x1000bbf8
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x1000bdb2
mov ecx, dword [sym.imp.ole32.dll_StringFromGUID2]
mov dword [esp], edx
movzx esi, si
lea edi, [ebp - 0x1f8]
mov dword [esp + 4], edi
mov dword [ebp - 0x204], ecx
mov dword [esp + 8], 0x27
call ecx
lea edx, [ebp - 0x1aa]
mov ecx, dword [ebp - 0x204]
sub esp, 0xc
mov dword [esp + 4], edx
mov dword [esp], ebx
lea ebx, [ebp - 0x15c]
mov dword [esp + 8], 0x27
call ecx
lea edx, [ebp - 0x1aa]
sub esp, 0xc
mov dword [esp + 0x18], esi
lea esi, [ebp - 0x200]
mov dword [esp + 0x10], edi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x14], str.LanguageProfile
mov dword [esp + 0xc], str.SOFTWAREMicrosoftCTFTIP
mov dword [esp + 8], str._s_s_s0x_08x_s
mov dword [esp + 4], 0xa8
mov dword [esp], ebx
call sym._swprintf_1
mov dword [esp + 0x10], esi
mov edi, dword [sym.imp.advapi32.dll_RegOpenKeyExW]
mov dword [esp + 0xc], 0x2001f
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
mov dword [esp], 0x80000001
call edi
sub esp, 0x14
test eax, eax
je 0x1000bb10
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0x2001f
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
mov dword [esp], 0x80000002
call edi
sub esp, 0x14
test eax, eax
je 0x1000bb90
lea esp, [ebp - 0xc]
mov eax, 0x80004005
pop ebx
pop esi
pop edi
pop ebp
ret 0x14
lea eax, [ebp - 0x1fc]
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1fc], 4
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x200]
mov dword [esp + 8], 0
mov dword [esp + 4], str.Enable
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
mov dword [ebp - 0x204], eax
mov eax, dword [ebp - 0x200]
sub esp, 0x18
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov edx, dword [ebp - 0x204]
sub esp, 4
test edx, edx
jne 0x1000bace
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0x14
lea eax, [ebp - 0x1fc]
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1fc], 4
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x200]
mov dword [esp + 8], 0
mov dword [esp + 4], str.Enable
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
mov ebx, eax
mov eax, dword [ebp - 0x200]
sub esp, 0x18
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
test ebx, ebx
je 0x1000bb7b
jmp 0x1000bafa
test ebx, ebx
je 0x1000bda8
mov eax, ebx
shr eax, 0x10
je 0x1000bd50
movzx eax, byte [ebx + 0xf]
mov dword [ebp + 0xc], edx
mov dword [esp + 0x2c], eax
movzx eax, byte [ebx + 0xe]
mov dword [esp + 0x28], eax
movzx eax, byte [ebx + 0xd]
mov dword [esp + 0x24], eax
movzx eax, byte [ebx + 0xc]
mov dword [esp + 0x20], eax
movzx eax, byte [ebx + 0xb]
mov dword [esp + 0x1c], eax
movzx eax, byte [ebx + 0xa]
mov dword [esp + 0x18], eax
movzx eax, byte [ebx + 9]
mov dword [esp + 0x14], eax
movzx eax, byte [ebx + 8]
mov dword [esp + 0x10], eax
movzx eax, word [ebx + 6]
mov dword [esp + 0xc], eax
movzx eax, word [ebx + 4]
mov dword [esp + 8], eax
mov eax, dword [ebx]
mov dword [esp], 0x10018788
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_5
mov edx, dword [ebp + 0xc]
mov ecx, eax
movzx edi, si
test edx, edx
je 0x1000bd98
mov eax, edx
mov dword [ebp - 0x204], ecx
shr eax, 0x10
je 0x1000bd70
movzx eax, byte [edx + 0xf]
mov dword [ebp + 0xc], edx
mov dword [esp + 0x2c], eax
movzx eax, byte [edx + 0xe]
mov dword [esp + 0x28], eax
movzx eax, byte [edx + 0xd]
mov dword [esp + 0x24], eax
movzx eax, byte [edx + 0xc]
mov dword [esp + 0x20], eax
movzx eax, byte [edx + 0xb]
mov dword [esp + 0x1c], eax
movzx eax, byte [edx + 0xa]
mov dword [esp + 0x18], eax
movzx eax, byte [edx + 9]
mov dword [esp + 0x14], eax
movzx eax, byte [edx + 8]
mov dword [esp + 0x10], eax
movzx eax, word [edx + 6]
mov dword [esp + 0xc], eax
movzx eax, word [edx + 4]
mov dword [esp + 8], eax
mov eax, dword [edx]
mov dword [esp], 0x10018788
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_5
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x204]
mov dword [ebp + 0xc], edx
mov edx, dword [ebp + 0x18]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x20], edx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], edi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.__p___s___i___s___p_n
mov dword [esp + 8], str.InputProcessorProfiles_IsEnabledLanguageProfile
mov dword [esp + 4], 0x10015080
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_5
mov edx, dword [ebp + 0xc]
jmp 0x1000ba02
movzx eax, bx
mov dword [esp], 0x10018777
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_5
mov edx, dword [ebp + 0xc]
mov ecx, eax
jmp 0x1000bc75
movzx eax, dx
mov dword [esp], 0x10018777
mov dword [esp + 4], eax
mov dword [ebp + 0xc], edx
call sym._wine_dbg_sprintf_5
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x204]
jmp 0x1000bcff
mov eax, 0x10018760
jmp 0x1000bcff
mov ecx, 0x10018760
jmp 0x1000bc75
mov eax, 0x80070057
jmp 0x1000bb7d