Function at 0x41fdfd
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edi
lea eax, [edi + 0x150]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionComponent_Based_Servicing
push 0x80000002
push dword [edi + 0x148]
call sym.Dismx86.exe_DismRegOpenKey
lea ebx, [edi + 0x14c]
push ebx
push dword [edi + 0x148]
call sym.Dismx86.exe_DismGetSystemInfoBySession
test eax, eax
jne 0x420190
mov ebx, dword [ebx]
push 2
mov dword [ebp - 0x128], 0x11c
movzx eax, word [ebx + 0x16]
mov dword [ebp - 0x124], eax
movzx eax, word [ebx + 0x14]
mov dword [ebp - 0x120], eax
movzx eax, word [ebx + 0x12]
mov dword [ebp - 0x11c], eax
pop eax
mov dword [ebp - 0x118], eax
xor eax, eax
push 0x108
push eax
lea eax, [ebp - 0x114]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea esi, [ebp - 0x128]
add edi, 0x28
lea edx, [ebp - 8]
push 0x47
pop ecx
rep movsd dword es:[edi], dword [esi]
mov al, byte [ebx + 0xc]
mov esi, 0x80000002
mov ebx, dword [ebp - 4]
push edx
push 0x2000000
push str.SYSTEMCurrentControlSetControlWindows
mov byte [ebx + 0x142], al
mov eax, dword [ebx + 0x148]
push esi
mov eax, dword [eax + 0x48]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
push 4
pop edi
test eax, eax
jne 0x41ff15
lea eax, [ebp - 4]
mov dword [ebp - 4], edi
push eax
lea eax, [ebp - 0xc]
push eax
xor eax, eax
push eax
push eax
push str.CSDVersion
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41ff0c
mov ecx, dword [ebp - 0xc]
mov eax, ecx
shr eax, 8
mov word [ebx + 0x13c], ax
movzx eax, cl
mov word [ebx + 0x13e], ax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebx + 0x148]
lea edx, [ebp - 8]
push edx
push 0x2000000
push str.SYSTEMCurrentControlSetControlProductOptions
mov eax, dword [eax + 0x48]
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
test eax, eax
jne 0x42012e
call fcn.0043c5cd
push eax
lea ecx, [ebp - 4]
call fcn.0043ac50
mov ecx, dword [ebp - 8]
lea eax, [ebp - 4]
push eax
mov edx, str.ProductSuite
call fcn.0044cd14
pop ecx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 4]
xor eax, eax
inc eax
cmp dword [esi - 4], eax
jle 0x41ff7d
push dword [esi - 0xc]
lea ecx, [ebp - 4]
call fcn.0043c727
mov esi, dword [ebp - 4]
xor eax, eax
mov edi, esi
cmp word [esi], ax
je 0x42011e
xor esi, esi
push str.Small_Business
push edi
call dword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
jne 0x41ffa2
inc eax
jmp 0x4200fe
push str.Enterprise
push edi
call dword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
jne 0x41ffba
push 2
pop eax
jmp 0x4200fe
push str.BackOffice
push edi
call dword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
jne 0x41ffce
push 4
jmp 0x41ffb4
push str.CommunicationServer
push edi
call dword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
jne 0x41ffeb
or word [ebx + 0x140], 8
jmp 0x420105
push str.Terminal_Server
push edi
call dword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
jne 0x420008
or word [ebx + 0x140], 0x10
jmp 0x420105
push str.Small_Business_Restricted_
push edi
call dword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
jne 0x420025
or word [ebx + 0x140], 0x20
jmp 0x420105
push str.EmbeddedNT
push edi
call dword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
jne 0x420042
or word [ebx + 0x140], 0x40
jmp 0x420105
push str.DataCenter
push edi
call dword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
jne 0x42005c
mov eax, 0x80
jmp 0x4200fe
push str.Personal
push edi
call dword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
jne 0x420076
mov eax, 0x200
jmp 0x4200fe
push str.Blade
push edi
call dword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
jne 0x42008d
mov eax, 0x400
jmp 0x4200fe
push str.Embedded_Restricted_
push edi
call dword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
jne 0x4200a4
mov eax, 0x800
jmp 0x4200fe
push str.Security_Appliance
push edi
call dword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
jne 0x4200bb
mov eax, 0x1000
jmp 0x4200fe
push str.Storage_Server
push edi
call dword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
jne 0x4200d2
mov eax, 0x2000
jmp 0x4200fe
push str.Compute_Server
push edi
call dword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
jne 0x4200e9
mov eax, 0x4000
jmp 0x4200fe
push str.WH_Server
push edi
call dword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
jne 0x420105
mov eax, 0x8000
or word [ebx + 0x140], ax
mov ecx, edi
call fcn.0044bc8f
lea edi, [edi + eax*2]
add edi, 2
cmp word [edi], si
jne 0x41ff8c
mov esi, dword [ebp - 4]
lea ecx, [esi - 0x10]
call fcn.0043c924
push 4
mov esi, 0x80000002
pop edi
mov eax, dword [ebx + 0x148]
lea edx, [ebp - 8]
push edx
push 0x2000000
push str.SystemCurrentControlSetControlTerminal_Server
mov eax, dword [eax + 0x48]
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
test eax, eax
jne 0x42018e
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], edi
push eax
xor ecx, ecx
lea eax, [ebp - 4]
push eax
push ecx
push ecx
push str.TSAppCompat
push dword [ebp - 8]
mov dword [ebp - 4], ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x420185
cmp dword [ebp - 4], eax
je 0x420185
mov eax, 0x100
or word [ebx + 0x140], ax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret