Function at 0x41a2e1
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xa24
mov eax, dword [0x44a078]
xor eax, esp
mov dword [esp + 0xa1c], eax
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x10]
xor edi, edi
push eax
push 0x20119
push edi
push str.SYSTEMCurrentControlSetControlProductOptions
push 0x80000002
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
js 0x41a557
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x1c], 0x208
push eax
push edi
push edi
push str.ProductType
push dword [esp + 0x24]
call esi
xor ebp, ebp
inc ebp
push 2
pop ebx
test eax, eax
jne 0x41a39d
mov edx, str.WinNT
lea ecx, [esp + 0x20]
call fcn.00401c06
test eax, eax
jne 0x41a372
mov word [0x44bfe0], bp
mov eax, edi
jmp 0x41a398
mov edx, str.ServerNT
lea ecx, [esp + 0x20]
call fcn.00401c06
test eax, eax
jne 0x41a38f
push 3
pop eax
mov word [0x44bfe0], ax
jmp 0x41a396
mov word [0x44bfe0], bx
mov eax, ebp
mov byte [0x44bfe4], al
mov eax, 0x800
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x22c]
push eax
push edi
push edi
push str.ProductSuite
push dword [esp + 0x24]
call esi
test eax, eax
jne 0x41a557
lea edi, [esp + 0x228]
mov ecx, edi
call fcn.00401c5c
mov ebx, eax
test ebx, ebx
je 0x41a557
mov si, word [0x44bfe2]
mov edx, str.Small_Business
mov ecx, edi
call fcn.00401c06
test eax, eax
jne 0x41a3ff
or si, bp
jmp 0x41a539
mov edx, str.Enterprise
mov ecx, edi
call fcn.00401c06
test eax, eax
jne 0x41a417
push 2
pop eax
jmp 0x41a536
mov edx, str.BackOffice
mov ecx, edi
call fcn.00401c06
test eax, eax
jne 0x41a430
or si, 4
jmp 0x41a539
mov edx, str.CommunicationServer
mov ecx, edi
call fcn.00401c06
test eax, eax
jne 0x41a449
or si, 8
jmp 0x41a539
mov edx, str.Terminal_Server
mov ecx, edi
call fcn.00401c06
test eax, eax
jne 0x41a462
or si, 0x10
jmp 0x41a539
mov edx, str.Small_Business_Restricted_
mov ecx, edi
call fcn.00401c06
test eax, eax
jne 0x41a47b
or si, 0x20
jmp 0x41a539
mov edx, str.EmbeddedNT
mov ecx, edi
call fcn.00401c06
test eax, eax
jne 0x41a494
or si, 0x40
jmp 0x41a539
mov edx, str.DataCenter
mov ecx, edi
call fcn.00401c06
test eax, eax
jne 0x41a4ae
mov eax, 0x80
jmp 0x41a536
mov edx, str.Personal
mov ecx, edi
call fcn.00401c06
test eax, eax
jne 0x41a4c5
mov eax, 0x200
jmp 0x41a536
mov edx, str.Blade
mov ecx, edi
call fcn.00401c06
test eax, eax
jne 0x41a4dc
mov eax, 0x400
jmp 0x41a536
mov edx, str.Embedded_Restricted_
mov ecx, edi
call fcn.00401c06
test eax, eax
jne 0x41a4f3
mov eax, 0x800
jmp 0x41a536
mov edx, str.Security_Appliance
mov ecx, edi
call fcn.00401c06
test eax, eax
jne 0x41a50a
mov eax, 0x1000
jmp 0x41a536
mov edx, str.Storage_Server
mov ecx, edi
call fcn.00401c06
test eax, eax
jne 0x41a521
mov eax, 0x2000
jmp 0x41a536
mov edx, str.Compute_Server
mov ecx, edi
call fcn.00401c06
test eax, eax
jne 0x41a540
mov eax, 0x4000
or si, ax
mov word [0x44bfe2], si
lea edi, [edi + ebx*2]
add edi, 2
mov ecx, edi
call fcn.00401c5c
mov ebx, eax
test ebx, ebx
jne 0x41a3e7
cmp dword [esp + 0x10], 0
je 0x41a568
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0xa2c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041df7e
add esp, 0xa24
ret