Function at 0x638c5b10
Capabilities:
Get process heap flags
Query or enumerate registry value

Disassembly:
push ebp
xor eax, eax
push edi
push esi
push ebx
sub esp, 0x25c
mov ebx, dword [esp + 0x270]
mov esi, dword [esp + 0x274]
mov edx, dword [eax + str.CLSID00000000_0000_0000_0000_000000000000Instance]
mov dword [esp + eax + 0xb8], edx
add eax, 4
cmp eax, 0x6c
jb 0x638c5b2a
test byte [0x638c8028], 8
mov eax, 0x4e
mov dword [esp + 0x54], eax
jne 0x638c5dd8
lea esi, [esi]
lea esi, [esi]
mov dword [esp], ebx
lea eax, [esp + 0xc4]
mov ecx, 0x27
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
call dword [0x638e91ec]
sub esp, 0xc
test eax, eax
je 0x638c6160
mov eax, 0x5c
xor edx, edx
mov edi, dword [sym.imp.advapi32.dll_RegOpenKeyExW]
mov word [esp + 0x110], ax
lea eax, [esp + 0x48]
mov dword [esp + 0x10], eax
mov eax, 0x20019
mov dword [esp + 0xc], eax
lea eax, [esp + 0xb8]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], 0x80000000
call edi
sub esp, 0x14
test eax, eax
jne 0x638c6160
lea eax, [esp + 0x54]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x50]
mov dword [esp + 0xc], eax
lea ebx, [esp + 0x6a]
xor eax, eax
mov dword [esp + 8], eax
mov eax, str.CLSID
mov dword [esp + 4], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x10], ebx
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
sub esp, 0x18
test eax, eax
jne 0x638c61a0
mov dword [esp], ebx
lea eax, [esp + 0x58]
mov dword [esp + 4], eax
call dword [0x638e91e4]
sub esp, 8
test eax, eax
js 0x638c61a0
lea eax, [esp + 0x4c]
xor ecx, ecx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x48]
mov edx, 0x20019
mov dword [esp + 0xc], edx
mov ebx, str.InitPropertyBag
mov dword [esp + 8], ecx
mov dword [esp + 4], ebx
mov dword [esp], eax
call edi
sub esp, 0x14
mov ebx, eax
mov eax, dword [esp + 0x48]
mov dword [esp], eax
mov eax, dword [sym.imp.advapi32.dll_RegCloseKey]
mov dword [esp + 0x3c], eax
call eax
sub esp, 4
test ebx, ebx
jne 0x638c6130
test byte [0x638c8028], 8
mov ebx, dword [esp + 0x4c]
jne 0x638c5f08
xor edi, edi
mov ecx, 0xc
mov dword [esp + 4], edi
mov edi, dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [esp + 8], ecx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call edi
sub esp, 0xc
test eax, eax
mov ebp, eax
je 0x638c5fda
mov dword [eax + 8], ebx
mov dword [eax], sym._RegistryPropertyBag_IPropertyBag_QueryInterface_12
mov dword [eax + 4], 0
mov dword [esp], eax
call sym._RegistryPropertyBag_IPropertyBag_AddRef_4
mov eax, dword [ebp]
mov edx, 0x638d0c48
sub esp, 4
mov dword [esp + 4], edx
lea ecx, [esp + 0x124]
mov dword [esp + 8], ecx
mov dword [esp], ebp
call dword [eax]
mov ebx, eax
mov eax, dword [ebp]
sub esp, 0xc
mov dword [esp], ebp
call dword [eax + 8]
sub esp, 4
test ebx, ebx
js 0x638c5fdf
test byte [0x638c8028], 8
mov ebx, dword [esp + 0x124]
jne 0x638c6000
xor ecx, ecx
mov edx, 0x1c
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call edi
sub esp, 0xc
test eax, eax
mov edi, eax
je 0x638c63ac
mov dword [eax], sym._InstanceObjectFactory_IClassFactory_QueryInterface_12
mov dword [eax + 4], 0
mov eax, dword [esp + 0x58]
mov dword [edi + 0x18], ebx
mov dword [edi + 8], eax
mov eax, dword [esp + 0x5c]
mov dword [edi + 0xc], eax
mov eax, dword [esp + 0x60]
mov dword [edi + 0x10], eax
mov eax, dword [esp + 0x64]
mov dword [edi + 0x14], eax
mov eax, dword [ebx]
mov dword [esp], ebx
call dword [eax + 4]
mov eax, dword [edi]
sub esp, 4
mov dword [esp], edi
call dword [eax + 4]
mov eax, dword [edi]
sub esp, 4
mov dword [esp + 4], esi
mov ecx, dword [esp + 0x278]
mov dword [esp], edi
mov dword [esp + 8], ecx
call dword [eax]
mov ebx, eax
mov eax, dword [edi]
sub esp, 0xc
mov dword [esp], edi
call dword [eax + 8]
sub esp, 4
mov eax, dword [esp + 0x124]
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
sub esp, 4
add esp, 0x25c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
test esi, esi
je 0x638c6180
mov eax, esi
shr eax, 0x10
je 0x638c60f0
movzx eax, byte [esi + 0xf]
mov dword [esp + 0x2c], eax
movzx eax, byte [esi + 0xe]
mov dword [esp + 0x28], eax
movzx eax, byte [esi + 0xd]
mov dword [esp + 0x24], eax
movzx eax, byte [esi + 0xc]
mov dword [esp + 0x20], eax
movzx eax, byte [esi + 0xb]
mov dword [esp + 0x1c], eax
movzx eax, byte [esi + 0xa]
mov dword [esp + 0x18], eax
movzx eax, byte [esi + 9]
mov dword [esp + 0x14], eax
movzx eax, byte [esi + 8]
mov dword [esp + 0x10], eax
movzx eax, word [esi + 6]
mov dword [esp + 0xc], eax
movzx eax, word [esi + 4]
mov dword [esp + 8], eax
mov eax, dword [esi]
mov dword [esp], str._08x__04x__04x__02x_02x__02x_02x_02x_02x_02x_02x
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_1
mov edi, eax
test ebx, ebx
je 0x638c6170
mov eax, ebx
shr eax, 0x10
je 0x638c60d0
movzx eax, byte [ebx + 0xf]
mov dword [esp + 0x2c], eax
movzx eax, byte [ebx + 0xe]
mov dword [esp + 0x28], eax
movzx eax, byte [ebx + 0xd]
mov dword [esp + 0x24], eax
movzx eax, byte [ebx + 0xc]
mov dword [esp + 0x20], eax
movzx eax, byte [ebx + 0xb]
mov dword [esp + 0x1c], eax
movzx eax, byte [ebx + 0xa]
mov dword [esp + 0x18], eax
movzx eax, byte [ebx + 9]
mov dword [esp + 0x14], eax
movzx eax, byte [ebx + 8]
mov dword [esp + 0x10], eax
movzx eax, word [ebx + 6]
mov dword [esp + 0xc], eax
movzx eax, word [ebx + 4]
mov dword [esp + 8], eax
mov eax, dword [ebx]
mov dword [esp], str._08x__04x__04x__02x_02x__02x_02x_02x_02x_02x_02x
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_1
mov dword [esp + 0x14], edi
mov ecx, dword [esp + 0x278]
mov edi, str._rclsid_s__riid_s__ppvClassObject_p__n
mov dword [esp + 0x10], eax
mov ebp, str.SHDOCVW_GetShellInstanceObjectClassObject
mov eax, 0x638c8028
mov dword [esp + 0xc], edi
mov dword [esp + 8], ebp
mov dword [esp + 0x18], ecx
mov dword [esp + 4], eax
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
jmp 0x638c5b60
mov eax, 0x638d0c48
mov ecx, eax
shr ecx, 0x10
je 0x638c60b8
mov dword [esp], str._08x__04x__04x__02x_02x__02x_02x_02x_02x_02x_02x
movzx eax, byte [0x638d0c57]
mov dword [esp + 0x2c], eax
movzx eax, byte [0x638d0c56]
mov dword [esp + 0x28], eax
movzx eax, byte [0x638d0c55]
mov dword [esp + 0x24], eax
movzx eax, byte [0x638d0c54]
mov dword [esp + 0x20], eax
movzx eax, byte [0x638d0c53]
mov dword [esp + 0x1c], eax
movzx eax, byte [0x638d0c52]
mov dword [esp + 0x18], eax
movzx eax, byte [0x638d0c51]
mov dword [esp + 0x14], eax
movzx eax, byte [0x638d0c50]
mov dword [esp + 0x10], eax
movzx eax, word [0x638d0c4e]
mov dword [esp + 0xc], eax
movzx eax, word [0x638d0c4c]
mov dword [esp + 8], eax
mov eax, dword [0x638d0c48]
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_1
mov dword [esp + 0x14], eax
mov eax, str.RegistryPropertyBag_Constructor
mov ebp, str._hInitPropertyBagKey_p__riid_s__ppvObject_p__n
mov dword [esp + 8], eax
lea edx, [esp + 0x124]
mov eax, 0x638c8028
mov dword [esp + 0x18], edx
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
jmp 0x638c5c88
mov ebx, 0x80004005
mov eax, dword [esp + 0x4c]
mov dword [esp], eax
mov eax, dword [esp + 0x3c]
call eax
mov eax, ebx
sub esp, 4
add esp, 0x25c
pop ebx
pop esi
pop edi
pop ebp
ret
test esi, esi
je 0x638c6190
mov eax, esi
shr eax, 0x10
je 0x638c6110
movzx eax, byte [esi + 0xf]
mov dword [esp + 0x2c], eax
movzx eax, byte [esi + 0xe]
mov dword [esp + 0x28], eax
movzx eax, byte [esi + 0xd]
mov dword [esp + 0x24], eax
movzx eax, byte [esi + 0xc]
mov dword [esp + 0x20], eax
movzx eax, byte [esi + 0xb]
mov dword [esp + 0x1c], eax
movzx eax, byte [esi + 0xa]
mov dword [esp + 0x18], eax
movzx eax, byte [esi + 9]
mov dword [esp + 0x14], eax
movzx eax, byte [esi + 8]
mov dword [esp + 0x10], eax
movzx eax, word [esi + 6]
mov dword [esp + 0xc], eax
movzx eax, word [esi + 4]
mov dword [esp + 8], eax
mov eax, dword [esi]
mov dword [esp], str._08x__04x__04x__02x_02x__02x_02x_02x_02x_02x_02x
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_1
mov dword [esp + 0x14], eax
mov edx, dword [esp + 0x278]
mov eax, str.InstanceObjectFactory_Constructor
mov dword [esp + 8], eax
mov ebp, str._RegistryPropertyBag_p__riid_s__ppvObject_p__n
mov eax, 0x638c8028
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], ebp
mov dword [esp + 0x18], edx
mov dword [esp + 4], eax
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
jmp 0x638c5d1f
mov dword [esp], str._guid_0x_04hx_
movzx eax, ax
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_1
jmp 0x638c5f9b
mov dword [esp], str._guid_0x_04hx_
movzx eax, bx
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_1
jmp 0x638c5ec4
mov dword [esp], str._guid_0x_04hx_
movzx eax, si
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_1
mov edi, eax
jmp 0x638c5e4f
mov dword [esp], str._guid_0x_04hx_
movzx eax, si
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_1
jmp 0x638c6075
test byte [0x638c8028], 8
je 0x638c6160
mov dword [esp], 3
mov eax, str.No_InitPropertyBag_key_found__n
mov dword [esp + 0xc], eax
mov eax, str.SHDOCVW_GetShellInstanceObjectClassObject
mov dword [esp + 8], eax
mov eax, 0x638c8028
mov dword [esp + 4], eax
call sym._wine_dbg_log.constprop.0_1
mov ebx, 0x80040111
jmp 0x638c5dc6
mov eax, str._null_
jmp 0x638c5ec4
mov edi, str._null_
jmp 0x638c5e4f
mov eax, str._null_
jmp 0x638c6075
test byte [0x638c8028], 1
jne 0x638c61c8
mov eax, dword [esp + 0x48]
mov ebx, 0x80040111
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
jmp 0x638c5dc6
mov eax, ebx
shr eax, 0x10
je 0x638c6367
mov dword [esp], ebx
mov eax, 0xffffffff
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
sub esp, 8
test eax, eax
jne 0x638c6384
cmp word [esp + 0x6a], 0
je 0x638c638b
lea esi, [esi]
mov edx, eax
cmp word [ebx + edx*2 + 2], 0
lea eax, [eax + 1]
jne 0x638c6200
mov eax, 0x224c
mov ebp, ebx
mov word [esp + 0x124], ax
lea ecx, [esp + 0x126]
lea esi, [esp + 0x246]
jmp 0x638c6265
cmp eax, 9
je 0x638c6300
cmp eax, 0xa
jne 0x638c62a3
mov word [ecx], 0x6e5c
add ecx, 2
lea esi, [esi]
lea esi, [esi]
lea eax, [edx - 1]
test edx, edx
jle 0x638c630d
cmp ecx, esi
ja 0x638c630d
mov edx, eax
movzx eax, word [ebp]
add ebp, 2
cmp eax, 0xd
je 0x638c628c
jbe 0x638c6230
cmp eax, 0x22
je 0x638c62f0
cmp eax, 0x5c
lea esi, [esi]
nop
jne 0x638c6296
mov word [ecx], 0x5c5c
add ecx, 2
jmp 0x638c6250
mov word [ecx], 0x725c
add ecx, 2
jmp 0x638c6250
lea edi, [eax - 0x20]
cmp di, 0x5e
jbe 0x638c637c
mov byte [ecx], 0x5c
mov edi, eax
add ecx, 5
shr edi, 0xc
movzx ebx, byte [edi + str.0123456789abcdef]
mov edi, eax
shr edi, 8
and edi, 0xf
mov byte [ecx - 4], bl
movzx ebx, byte [edi + str.0123456789abcdef]
mov edi, eax
shr edi, 4
and eax, 0xf
and edi, 0xf
movzx eax, byte [eax + str.0123456789abcdef]
mov byte [ecx - 3], bl
movzx ebx, byte [edi + str.0123456789abcdef]
mov byte [ecx - 1], al
mov byte [ecx - 2], bl
jmp 0x638c6250
mov word [ecx], 0x225c
add ecx, 2
jmp 0x638c6250
mov word [ecx], 0x745c
add ecx, 2
jmp 0x638c6250
mov byte [ecx], 0x22
test eax, eax
jle 0x638c63a4
mov word [ecx + 1], 0x2e2e
lea eax, [ecx + 4]
mov byte [ecx + 3], 0x2e
mov byte [eax], 0
lea eax, [esp + 0x124]
mov dword [esp], eax
call sym.___wine_dbg_strdup
mov esi, str.Failed_to_infer_instance_CLSID___s_n
mov edi, str.SHDOCVW_GetShellInstanceObjectClassObject
mov dword [esp + 0x10], eax
mov ebp, 0x638c8028
mov dword [esp + 0xc], esi
mov dword [esp + 8], edi
mov dword [esp + 4], ebp
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0_1
jmp 0x638c61a9
mov dword [esp], str._04x
movzx ebx, bx
mov dword [esp + 4], ebx
call sym._wine_dbg_sprintf_1
jmp 0x638c6337
mov byte [ecx], al
inc ecx
jmp 0x638c6250
mov eax, str._invalid_
jmp 0x638c6337
mov word [esp + 0x124], 0x224c
lea ecx, [esp + 0x126]
mov byte [esp + 0x126], 0x22
lea eax, [ecx + 1]
jmp 0x638c6325
mov ebx, 0x80004005
jmp 0x638c5db4