Function at 0x6b6cd2d0
Capabilities:
Enumerate pe sections
Set registry value

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, ecx
push ecx
sub esp, 0x388
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
mov dword [ebp - 0x330], 0
mov dword [ebp - 0x33c], eax
mov eax, dword [ecx + 8]
mov dword [ebp - 0x348], eax
mov eax, dword [ecx + 0xc]
mov dword [ebp - 0x340], eax
mov eax, dword [ecx + 0x10]
mov dword [ebp - 0x34c], eax
mov eax, dword [ecx + 0x14]
mov dword [ebp - 0x354], eax
mov eax, dword [ecx + 0x18]
mov dword [ebp - 0x350], eax
mov eax, dword [ecx + 0x1c]
mov dword [ebp - 0x358], eax
test byte [0x6b6d7080], 8
jne 0x6b6cd4a0
mov eax, dword [ebp - 0x33c]
lea edi, [ebp - 0x31a]
mov dword [esp + 8], 0x27
lea esi, [ebp - 0x230]
mov dword [esp + 4], edi
mov dword [esp], eax
mov eax, dword [sym.imp.ole32.dll_StringFromGUID2]
mov dword [ebp - 0x344], eax
call eax
sub esp, 0xc
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], str.SOFTWAREMicrosoftCTFTIP
mov dword [esp + 8], str._s_s
mov dword [esp + 4], 0x64
mov dword [esp], esi
call sym._swprintf_1
lea eax, [ebp - 0x338]
mov dword [esp + 4], esi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x2001f
mov dword [esp + 8], 0
mov dword [esp], 0x80000002
call dword [sym.imp.advapi32.dll_RegOpenKeyExW]
sub esp, 0x14
test eax, eax
jne 0x6b6cd491
mov edx, dword [ebp - 0x340]
mov eax, dword [ebp - 0x344]
mov dword [esp + 4], edi
mov dword [esp + 8], 0x27
mov dword [esp], edx
call eax
movzx eax, word [ebp - 0x348]
sub esp, 0xc
mov dword [esp + 0x14], edi
mov dword [esp], esi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.LanguageProfile
mov dword [esp + 8], str._s0x_08x_s
mov dword [esp + 4], 0x64
mov dword [ebp - 0x348], eax
call sym._swprintf_1
lea eax, [ebp - 0x330]
mov dword [esp + 4], esi
mov edi, dword [sym.imp.advapi32.dll_RegCreateKeyExW]
mov dword [esp + 0x20], eax
lea eax, [ebp - 0x334]
mov dword [esp + 0x1c], eax
mov eax, dword [ebp - 0x338]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x2001f
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp], eax
call edi
sub esp, 0x24
mov esi, eax
test eax, eax
je 0x6b6cd6d0
mov eax, dword [ebp - 0x338]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
mov esi, 0x80004005
jmp 0x6b6cd8ed
mov eax, dword [ecx + 0x20]
mov dword [ebp - 0x360], eax
mov eax, dword [ebp - 0x350]
test eax, eax
je 0x6b6cda28
shr eax, 0x10
je 0x6b6cd900
mov edi, dword [ebp - 0x358]
mov eax, dword [ebp - 0x350]
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov dword [ebp - 0x35c], 0x6b6da92a
sub esp, 8
test eax, eax
jne 0x6b6cd4fd
mov eax, dword [ebp - 0x350]
mov edx, edi
call sym._wine_dbgstr_wn.part.0
mov dword [ebp - 0x35c], eax
mov eax, dword [ebp - 0x34c]
test eax, eax
je 0x6b6cda40
shr eax, 0x10
je 0x6b6cd958
mov edi, dword [ebp - 0x354]
mov eax, dword [ebp - 0x34c]
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov dword [ebp - 0x344], 0x6b6da92a
sub esp, 8
test eax, eax
jne 0x6b6cd551
mov eax, dword [ebp - 0x34c]
mov edx, edi
call sym._wine_dbgstr_wn.part.0
mov dword [ebp - 0x344], eax
mov eax, dword [ebp - 0x340]
test eax, eax
je 0x6b6cda18
shr eax, 0x10
je 0x6b6cd9b0
mov edx, dword [ebp - 0x340]
movzx eax, byte [edx + 0xf]
mov dword [esp + 0x2c], eax
movzx eax, byte [edx + 0xe]
mov dword [esp + 0x28], eax
movzx eax, byte [edx + 0xd]
mov dword [esp + 0x24], eax
movzx eax, byte [edx + 0xc]
mov dword [esp + 0x20], eax
movzx eax, byte [edx + 0xb]
mov dword [esp + 0x1c], eax
movzx eax, byte [edx + 0xa]
mov dword [esp + 0x18], eax
movzx eax, byte [edx + 9]
mov dword [esp + 0x14], eax
movzx eax, byte [edx + 8]
mov dword [esp + 0x10], eax
movzx eax, word [edx + 6]
mov dword [esp + 0xc], eax
movzx eax, word [edx + 4]
mov dword [esp + 8], eax
mov eax, dword [edx]
mov dword [esp], 0x6b6da770
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_5
mov edx, eax
mov eax, dword [ebp - 0x33c]
movzx ecx, word [ebp - 0x348]
test eax, eax
je 0x6b6cda50
shr eax, 0x10
mov dword [ebp - 0x368], edx
mov dword [ebp - 0x364], ecx
je 0x6b6cd980
mov ecx, dword [ebp - 0x33c]
movzx eax, byte [ecx + 0xf]
mov dword [esp + 0x2c], eax
movzx eax, byte [ecx + 0xe]
mov dword [esp + 0x28], eax
movzx eax, byte [ecx + 0xd]
mov dword [esp + 0x24], eax
movzx eax, byte [ecx + 0xc]
mov dword [esp + 0x20], eax
movzx eax, byte [ecx + 0xb]
mov dword [esp + 0x1c], eax
movzx eax, byte [ecx + 0xa]
mov dword [esp + 0x18], eax
movzx eax, byte [ecx + 9]
mov dword [esp + 0x14], eax
movzx eax, byte [ecx + 8]
mov dword [esp + 0x10], eax
movzx eax, word [ecx + 6]
mov dword [esp + 0xc], eax
movzx eax, word [ecx + 4]
mov dword [esp + 8], eax
mov eax, dword [ecx]
mov dword [esp], 0x6b6da770
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_5
mov ecx, dword [ebp - 0x364]
mov edx, dword [ebp - 0x368]
mov edi, dword [ebp - 0x360]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x28], edi
mov edi, dword [ebp - 0x35c]
mov dword [esp + 0x14], eax
mov dword [esp + 0x24], edi
mov edi, dword [ebp - 0x344]
mov dword [esp + 0x10], esi
mov dword [esp + 0x20], edi
mov dword [esp + 0xc], str.__p___s__x__s__s__s__li_n
mov dword [esp + 8], str.InputProcessorProfiles_AddLanguageProfile
mov dword [esp + 4], 0x6b6d7080
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_5
jmp 0x6b6cd341
mov eax, dword [ebp - 0x354]
mov dword [esp + 0xc], 1
add ebx, 0x20
mov dword [ebp - 0x32c], 0
add eax, eax
mov dword [esp + 8], 0
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x34c]
mov dword [esp + 4], str.Description
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x334]
mov dword [esp], eax
mov eax, dword [sym.imp.advapi32.dll_RegSetValueExW]
mov dword [ebp - 0x34c], eax
call eax
mov ecx, dword [ebp - 0x358]
mov edx, dword [ebp - 0x350]
mov eax, dword [ebp - 0x334]
sub esp, 0x18
add ecx, ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ecx
mov dword [esp], eax
mov eax, dword [ebp - 0x34c]
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.IconFile
call eax
mov eax, dword [ebp - 0x334]
sub esp, 0x18
mov dword [esp], eax
mov eax, dword [ebp - 0x34c]
mov dword [esp + 0x14], 4
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], str.IconIndex
call eax
sub esp, 0x18
cmp dword [ebp - 0x330], 1
je 0x6b6cd9d0
mov eax, dword [ebp - 0x334]
mov ebx, dword [sym.imp.advapi32.dll_RegCloseKey]
mov dword [esp], eax
call ebx
mov dword [ebp - 0x324], 0
sub esp, 4
test byte [0x6b6d7080], 8
jne 0x6b6cd928
mov eax, dword [ebp - 0x33c]
lea edx, [ebp - 0x2cc]
mov dword [esp + 8], 0x27
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [ebp - 0x344]
call eax
lea ecx, [ebp - 0x27e]
mov eax, dword [ebp - 0x344]
sub esp, 0xc
mov dword [esp + 4], ecx
mov ecx, dword [ebp - 0x340]
mov dword [esp + 8], 0x27
mov dword [esp], ecx
call eax
mov eax, dword [ebp - 0x348]
lea edx, [ebp - 0x2cc]
lea ecx, [ebp - 0x27e]
sub esp, 0xc
mov dword [esp + 0x10], edx
lea edx, [ebp - 0x168]
mov dword [esp], edx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], str.LanguageProfile
mov dword [esp + 0xc], str.SOFTWAREMicrosoftCTFTIP
mov dword [esp + 8], str._s_s_s0x_08x_s
mov dword [esp + 4], 0xa8
call sym._swprintf_1
lea eax, [ebp - 0x324]
lea edx, [ebp - 0x168]
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
lea eax, [ebp - 0x328]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], 0x2001f
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], edx
mov dword [esp], 0x80000001
call edi
sub esp, 0x24
test eax, eax
jne 0x6b6cd8df
cmp dword [ebp - 0x324], 1
je 0x6b6cda60
mov eax, dword [ebp - 0x328]
mov dword [esp], eax
call ebx
sub esp, 4
mov eax, dword [ebp - 0x338]
mov dword [esp], eax
call ebx
sub esp, 4
lea esp, [ebp - 0x10]
mov eax, esi
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x24
movzx eax, word [ebp - 0x350]
mov dword [esp], 0x6b6da934
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_5
mov dword [ebp - 0x35c], eax
jmp 0x6b6cd4fd
mov dword [esp + 0xc], 0x6b6da9ef
mov dword [esp + 8], str.add_userkey
mov dword [esp + 4], 0x6b6d7080
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_5
jmp 0x6b6cd7d6
movzx eax, word [ebp - 0x34c]
mov dword [esp], 0x6b6da934
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_5
mov dword [ebp - 0x344], eax
jmp 0x6b6cd551
movzx eax, word [ebp - 0x33c]
mov dword [esp], 0x6b6da760
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_5
mov ecx, dword [ebp - 0x364]
mov edx, dword [ebp - 0x368]
jmp 0x6b6cd670
movzx eax, word [ebp - 0x340]
mov dword [esp], 0x6b6da760
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_5
mov edx, eax
jmp 0x6b6cd5d2
lea eax, [ebp - 0x32c]
mov dword [esp + 0x14], 4
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x334]
mov dword [esp + 0xc], 4
mov dword [esp], eax
mov eax, dword [ebp - 0x34c]
mov dword [esp + 8], 0
mov dword [esp + 4], str.Enable
call eax
sub esp, 0x18
jmp 0x6b6cd7ab
mov edx, 0x6b6da87a
jmp 0x6b6cd5d2
mov dword [ebp - 0x35c], 0x6b6da87a
jmp 0x6b6cd4fd
mov dword [ebp - 0x344], 0x6b6da87a
jmp 0x6b6cd551
mov eax, 0x6b6da87a
jmp 0x6b6cd670
lea eax, [ebp - 0x320]
mov dword [esp + 0x14], 4
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x328]
mov dword [ebp - 0x320], 0
mov dword [esp], eax
mov eax, dword [ebp - 0x34c]
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], str.Enable
call eax
sub esp, 0x18
jmp 0x6b6cd8d1