Function at 0x638c4de0
Capabilities:
Get process heap flags
Query or enumerate registry value

Disassembly:
push ebp
mov ecx, 0x1b
push edi
push esi
mov esi, str.CLSID00000000_0000_0000_0000_000000000000Instance
push ebx
sub esp, 0x12c
lea ebp, [esp + 0xb4]
mov edx, dword [esp + 0x140]
mov dword [esp + 0x4c], 0x4e
mov edi, ebp
mov ebx, dword [esp + 0x144]
rep movsd dword es:[edi], dword [esi]
test byte [0x638c7028], 8
jne 0x638c5148
mov dword [esp + 8], 0x27
lea eax, [esp + 0xc0]
mov dword [esp], edx
mov dword [esp + 4], eax
call dword [0x638e81ec]
sub esp, 0xc
test eax, eax
je 0x638c5459
mov eax, 0x5c
mov esi, dword [sym.imp.advapi32.dll_RegOpenKeyExW]
mov dword [esp + 4], ebp
mov word [esp + 0x10c], ax
lea eax, [esp + 0x40]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], 0
mov dword [esp], 0x80000000
call esi
sub esp, 0x14
test eax, eax
jne 0x638c5459
lea eax, [esp + 0x4c]
mov dword [esp + 8], 0
mov dword [esp + 0x14], eax
lea eax, [esp + 0x48]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x40]
lea edi, [esp + 0x66]
mov dword [esp + 0x10], edi
mov dword [esp + 4], str.CLSID
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
sub esp, 0x18
test eax, eax
jne 0x638c5440
lea eax, [esp + 0x54]
mov dword [esp], edi
mov dword [esp + 4], eax
call dword [0x638e81e4]
sub esp, 8
test eax, eax
js 0x638c5440
lea eax, [esp + 0x44]
mov dword [esp + 0xc], 0x20019
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 8], 0
mov dword [esp + 4], str.InitPropertyBag
mov dword [esp], eax
call esi
sub esp, 0x14
mov esi, eax
mov eax, dword [esp + 0x40]
mov dword [esp], eax
mov eax, dword [sym.imp.advapi32.dll_RegCloseKey]
mov dword [esp + 0x3c], eax
call eax
sub esp, 4
test esi, esi
jne 0x638c5468
mov esi, dword [esp + 0x44]
test byte [0x638c7028], 8
jne 0x638c52a0
mov dword [esp + 8], 0xc
mov edi, dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call edi
sub esp, 0xc
mov ebp, eax
test eax, eax
je 0x638c536c
mov dword [eax + 8], esi
mov dword [eax], 0x638c9ac0
mov dword [eax + 4], 0
mov dword [esp], eax
call fcn.638c4390
mov eax, dword [ebp]
sub esp, 4
lea ecx, [esp + 0x50]
mov dword [esp + 4], 0x638cfc68
mov dword [esp + 8], ecx
mov dword [esp], ebp
call dword [eax]
mov esi, eax
mov eax, dword [ebp]
sub esp, 0xc
mov dword [esp], ebp
call dword [eax + 8]
sub esp, 4
test esi, esi
js 0x638c5371
mov esi, dword [esp + 0x50]
test byte [0x638c7028], 8
jne 0x638c5090
mov dword [esp + 8], 0x1c
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call edi
sub esp, 0xc
mov edi, eax
test eax, eax
je 0x638c54d4
mov dword [eax], 0x638c9aac
mov dword [eax + 4], 0
mov eax, dword [esp + 0x54]
mov dword [edi + 0x18], esi
mov dword [edi + 8], eax
mov eax, dword [esp + 0x58]
mov dword [edi + 0xc], eax
mov eax, dword [esp + 0x5c]
mov dword [edi + 0x10], eax
mov eax, dword [esp + 0x60]
mov dword [edi + 0x14], eax
mov eax, dword [esi]
mov dword [esp], esi
call dword [eax + 4]
mov eax, dword [edi]
sub esp, 4
mov dword [esp], edi
call dword [eax + 4]
mov eax, dword [edi]
sub esp, 4
mov ecx, dword [esp + 0x148]
mov dword [esp + 4], ebx
mov dword [esp], edi
mov dword [esp + 8], ecx
call dword [eax]
mov esi, eax
mov eax, dword [edi]
sub esp, 0xc
mov dword [esp], edi
call dword [eax + 8]
sub esp, 4
mov eax, dword [esp + 0x50]
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
sub esp, 4
add esp, 0x12c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
test ebx, ebx
je 0x638c5430
mov eax, ebx
shr eax, 0x10
test eax, eax
je 0x638c53f8
movzx eax, byte [ebx + 0xf]
mov dword [esp + 0x2c], eax
movzx eax, byte [ebx + 0xe]
mov dword [esp + 0x28], eax
movzx eax, byte [ebx + 0xd]
mov dword [esp + 0x24], eax
movzx eax, byte [ebx + 0xc]
mov dword [esp + 0x20], eax
movzx eax, byte [ebx + 0xb]
mov dword [esp + 0x1c], eax
movzx eax, byte [ebx + 0xa]
mov dword [esp + 0x18], eax
movzx eax, byte [ebx + 9]
mov dword [esp + 0x14], eax
movzx eax, byte [ebx + 8]
mov dword [esp + 0x10], eax
movzx eax, word [ebx + 6]
mov dword [esp + 0xc], eax
movzx eax, word [ebx + 4]
mov dword [esp + 8], eax
mov eax, dword [ebx]
mov dword [esp], str._08x__04x__04x__02x_02x__02x_02x_02x_02x_02x_02x
mov dword [esp + 4], eax
call fcn.638c3ec0
mov ecx, dword [esp + 0x148]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], str._RegistryPropertyBag_p__riid_s__ppvObject_p__n
mov dword [esp + 8], str.InstanceObjectFactory_Constructor
mov dword [esp + 0x18], ecx
mov dword [esp + 4], 0x638c7028
mov dword [esp], 3
call fcn.638c41c0
jmp 0x638c4fd5
test ebx, ebx
je 0x638c5410
mov eax, ebx
shr eax, 0x10
test eax, eax
je 0x638c53b0
movzx eax, byte [ebx + 0xf]
mov dword [esp + 0x140], edx
mov dword [esp + 0x2c], eax
movzx eax, byte [ebx + 0xe]
mov dword [esp + 0x28], eax
movzx eax, byte [ebx + 0xd]
mov dword [esp + 0x24], eax
movzx eax, byte [ebx + 0xc]
mov dword [esp + 0x20], eax
movzx eax, byte [ebx + 0xb]
mov dword [esp + 0x1c], eax
movzx eax, byte [ebx + 0xa]
mov dword [esp + 0x18], eax
movzx eax, byte [ebx + 9]
mov dword [esp + 0x14], eax
movzx eax, byte [ebx + 8]
mov dword [esp + 0x10], eax
movzx eax, word [ebx + 6]
mov dword [esp + 0xc], eax
movzx eax, word [ebx + 4]
mov dword [esp + 8], eax
mov eax, dword [ebx]
mov dword [esp], str._08x__04x__04x__02x_02x__02x_02x_02x_02x_02x_02x
mov dword [esp + 4], eax
call fcn.638c3ec0
mov edx, dword [esp + 0x140]
mov esi, eax
test edx, edx
je 0x638c5420
mov eax, edx
shr eax, 0x10
test eax, eax
je 0x638c53d0
movzx eax, byte [edx + 0xf]
mov dword [esp + 0x140], edx
mov dword [esp + 0x2c], eax
movzx eax, byte [edx + 0xe]
mov dword [esp + 0x28], eax
movzx eax, byte [edx + 0xd]
mov dword [esp + 0x24], eax
movzx eax, byte [edx + 0xc]
mov dword [esp + 0x20], eax
movzx eax, byte [edx + 0xb]
mov dword [esp + 0x1c], eax
movzx eax, byte [edx + 0xa]
mov dword [esp + 0x18], eax
movzx eax, byte [edx + 9]
mov dword [esp + 0x14], eax
movzx eax, byte [edx + 8]
mov dword [esp + 0x10], eax
movzx eax, word [edx + 6]
mov dword [esp + 0xc], eax
movzx eax, word [edx + 4]
mov dword [esp + 8], eax
mov eax, dword [edx]
mov dword [esp], str._08x__04x__04x__02x_02x__02x_02x_02x_02x_02x_02x
mov dword [esp + 4], eax
call fcn.638c3ec0
mov edx, dword [esp + 0x140]
mov ecx, dword [esp + 0x148]
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str._rclsid_s__riid_s__ppvClassObject_p__n
mov dword [esp + 8], str.SHDOCVW_GetShellInstanceObjectClassObject
mov dword [esp + 0x18], ecx
mov dword [esp + 4], 0x638c7028
mov dword [esp], 3
mov dword [esp + 0x140], edx
call fcn.638c41c0
mov edx, dword [esp + 0x140]
jmp 0x638c4e22
mov eax, 0x638cfc68
shr eax, 0x10
test eax, eax
je 0x638c5390
movzx eax, byte [0x638cfc77]
mov dword [esp], str._08x__04x__04x__02x_02x__02x_02x_02x_02x_02x_02x
mov dword [esp + 0x2c], eax
movzx eax, byte [0x638cfc76]
mov dword [esp + 0x28], eax
movzx eax, byte [0x638cfc75]
mov dword [esp + 0x24], eax
movzx eax, byte [0x638cfc74]
mov dword [esp + 0x20], eax
movzx eax, byte [0x638cfc73]
mov dword [esp + 0x1c], eax
movzx eax, byte [0x638cfc72]
mov dword [esp + 0x18], eax
movzx eax, byte [0x638cfc71]
mov dword [esp + 0x14], eax
movzx eax, byte [0x638cfc70]
mov dword [esp + 0x10], eax
movzx eax, word [0x638cfc6e]
mov dword [esp + 0xc], eax
movzx eax, word [0x638cfc6c]
mov dword [esp + 8], eax
mov eax, dword [0x638cfc68]
mov dword [esp + 4], eax
call fcn.638c3ec0
lea edx, [esp + 0x50]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], edx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], str._hInitPropertyBagKey_p__riid_s__ppvObject_p__n
mov dword [esp + 8], str.RegistryPropertyBag_Constructor
mov dword [esp + 4], 0x638c7028
mov dword [esp], 3
call fcn.638c41c0
jmp 0x638c4f44
mov esi, 0x80004005
mov eax, dword [esp + 0x44]
mov dword [esp], eax
mov eax, dword [esp + 0x3c]
call eax
mov eax, esi
sub esp, 4
add esp, 0x12c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], 0x638cfc68
mov dword [esp], str._guid_0x_04hx_
call fcn.638c3ec0
jmp 0x638c5333
mov dword [esp + 4], ebx
mov dword [esp], str._guid_0x_04hx_
call fcn.638c3ec0
mov edx, dword [esp + 0x140]
mov esi, eax
jmp 0x638c51cf
mov dword [esp + 4], edx
mov dword [esp], str._guid_0x_04hx_
mov dword [esp + 0x140], edx
call fcn.638c3ec0
mov edx, dword [esp + 0x140]
jmp 0x638c5254
mov dword [esp + 4], ebx
mov dword [esp], str._guid_0x_04hx_
call fcn.638c3ec0
jmp 0x638c5107
mov esi, str._null_
jmp 0x638c51cf
mov eax, str._null_
jmp 0x638c5254
mov eax, str._null_
jmp 0x638c5107
test byte [0x638c7028], 1
jne 0x638c54a0
mov eax, dword [esp + 0x40]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
mov esi, 0x80040111
jmp 0x638c507a
test byte [0x638c7028], 8
je 0x638c5459
mov dword [esp + 0xc], str.No_InitPropertyBag_key_found__n
mov dword [esp + 8], str.SHDOCVW_GetShellInstanceObjectClassObject
mov dword [esp + 4], 0x638c7028
mov dword [esp], 3
call fcn.638c41c0
jmp 0x638c5459
mov eax, edi
call fcn.638c3f20
mov dword [esp + 0xc], str.Failed_to_infer_instance_CLSID___s_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.SHDOCVW_GetShellInstanceObjectClassObject
mov dword [esp + 4], 0x638c7028
mov dword [esp], 0
call fcn.638c41c0
jmp 0x638c5449
mov esi, 0x80004005
jmp 0x638c506b