Function at 0x41dad8
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xa1c
mov eax, 0x4388be
call fcn.004226b6
xor ebx, ebx
mov dword [ebp - 0xa20], 0x446df8
mov dword [ebp - 0xa1c], ebx
lea ecx, [ebp - 0xa20]
mov dword [ebp - 4], ebx
call fcn.00414fcc
lea eax, [ebp - 0xa1c]
push eax
push 0x20119
push ebx
push str.SYSTEMCurrentControlSetControlProductOptions
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
js 0x41dd8e
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0xa24]
push eax
lea eax, [ebp - 0x218]
mov dword [ebp - 0xa24], 0x208
push eax
push ebx
push ebx
push str.ProductType
push dword [ebp - 0xa1c]
call esi
push 2
pop edi
test eax, eax
jne 0x41dbad
mov edx, str.WinNT
lea ecx, [ebp - 0x218]
call fcn.0040286e
test eax, eax
jne 0x41db7f
inc eax
mov word [0x44fe90], ax
mov al, bl
jmp 0x41dba8
mov edx, str.ServerNT
lea ecx, [ebp - 0x218]
call fcn.0040286e
test eax, eax
jne 0x41db9e
push 3
pop eax
mov word [0x44fe90], ax
jmp 0x41dba5
mov word [0x44fe90], di
xor eax, eax
inc eax
mov byte [0x44fe94], al
mov eax, 0x800
mov dword [ebp - 0xa28], eax
lea eax, [ebp - 0xa28]
push eax
lea eax, [ebp - 0xa18]
push eax
push ebx
push ebx
push str.ProductSuite
push dword [ebp - 0xa1c]
call esi
test eax, eax
jne 0x41dd8e
cmp word [ebp - 0xa18], 0
lea edi, [ebp - 0xa18]
mov eax, edi
je 0x41dbfa
xor ecx, ecx
lea eax, [eax + 2]
inc ebx
cmp word [eax], cx
jne 0x41dbf1
test ebx, ebx
je 0x41dd8e
mov si, word [0x44fe92]
mov edx, str.Small_Business
mov ecx, edi
call fcn.0040286e
test eax, eax
jne 0x41dc1f
inc eax
jmp 0x41dd60
mov edx, str.Enterprise
mov ecx, edi
call fcn.0040286e
test eax, eax
jne 0x41dc41
push 2
pop edx
or si, dx
mov word [0x44fe92], si
jmp 0x41dd6d
mov edx, str.BackOffice
mov ecx, edi
call fcn.0040286e
test eax, eax
jne 0x41dc5a
or si, 4
jmp 0x41dd63
mov edx, str.CommunicationServer
mov ecx, edi
call fcn.0040286e
test eax, eax
jne 0x41dc73
or si, 8
jmp 0x41dd63
mov edx, str.Terminal_Server
mov ecx, edi
call fcn.0040286e
test eax, eax
jne 0x41dc8c
or si, 0x10
jmp 0x41dd63
mov edx, str.Small_Business_Restricted_
mov ecx, edi
call fcn.0040286e
test eax, eax
jne 0x41dca5
or si, 0x20
jmp 0x41dd63
mov edx, str.EmbeddedNT
mov ecx, edi
call fcn.0040286e
test eax, eax
jne 0x41dcbe
or si, 0x40
jmp 0x41dd63
mov edx, str.DataCenter
mov ecx, edi
call fcn.0040286e
test eax, eax
jne 0x41dcd8
mov eax, 0x80
jmp 0x41dd60
mov edx, str.Personal
mov ecx, edi
call fcn.0040286e
test eax, eax
jne 0x41dcef
mov eax, 0x200
jmp 0x41dd60
mov edx, str.Blade
mov ecx, edi
call fcn.0040286e
test eax, eax
jne 0x41dd06
mov eax, 0x400
jmp 0x41dd60
mov edx, str.Embedded_Restricted_
mov ecx, edi
call fcn.0040286e
test eax, eax
jne 0x41dd1d
mov eax, 0x800
jmp 0x41dd60
mov edx, str.Security_Appliance
mov ecx, edi
call fcn.0040286e
test eax, eax
jne 0x41dd34
mov eax, 0x1000
jmp 0x41dd60
mov edx, str.Storage_Server
mov ecx, edi
call fcn.0040286e
test eax, eax
jne 0x41dd4b
mov eax, 0x2000
jmp 0x41dd60
mov edx, str.Compute_Server
mov ecx, edi
call fcn.0040286e
test eax, eax
jne 0x41dd6a
mov eax, 0x4000
or si, ax
mov word [0x44fe92], si
push 2
pop edx
lea edi, [edi + ebx*2]
xor ecx, ecx
add edi, 2
mov ebx, ecx
mov eax, edi
cmp word [edi], cx
je 0x41dd86
add eax, edx
inc ebx
cmp word [eax], cx
jne 0x41dd7e
test ebx, ebx
jne 0x41dc09
cmp dword [ebp - 0xa1c], 0
mov dword [ebp - 0xa20], 0x446df8
je 0x41ddad
push dword [ebp - 0xa1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00422671
ret