Function at 0x409521
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xa24
mov eax, dword [0x45800c]
xor eax, esp
mov dword [esp + 0xa1c], eax
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x10]
xor edi, edi
push eax
push 0x20119
push edi
push str.SYSTEMCurrentControlSetControlProductOptions
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
js 0x409797
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x1c], 0x208
push eax
push edi
push edi
push str.ProductType
push dword [esp + 0x24]
call esi
xor ebp, ebp
inc ebp
push 2
pop ebx
test eax, eax
jne 0x4095dd
mov edx, str.WinNT
lea ecx, [esp + 0x20]
call fcn.00409b35
test eax, eax
jne 0x4095b2
mov word [0x459af8], bp
mov eax, edi
jmp 0x4095d8
mov edx, str.ServerNT
lea ecx, [esp + 0x20]
call fcn.00409b35
test eax, eax
jne 0x4095cf
push 3
pop eax
mov word [0x459af8], ax
jmp 0x4095d6
mov word [0x459af8], bx
mov eax, ebp
mov byte [0x459afc], al
mov eax, 0x800
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x22c]
push eax
push edi
push edi
push str.ProductSuite
push dword [esp + 0x24]
call esi
test eax, eax
jne 0x409797
lea edi, [esp + 0x228]
mov ecx, edi
call fcn.00405a9a
mov ebx, eax
test ebx, ebx
je 0x409797
mov si, word [0x459afa]
mov edx, str.Small_Business
mov ecx, edi
call fcn.00409b35
test eax, eax
jne 0x40963f
or si, bp
jmp 0x409779
mov edx, str.Enterprise
mov ecx, edi
call fcn.00409b35
test eax, eax
jne 0x409657
push 2
pop eax
jmp 0x409776
mov edx, str.BackOffice
mov ecx, edi
call fcn.00409b35
test eax, eax
jne 0x409670
or si, 4
jmp 0x409779
mov edx, str.CommunicationServer
mov ecx, edi
call fcn.00409b35
test eax, eax
jne 0x409689
or si, 8
jmp 0x409779
mov edx, str.Terminal_Server
mov ecx, edi
call fcn.00409b35
test eax, eax
jne 0x4096a2
or si, 0x10
jmp 0x409779
mov edx, str.Small_Business_Restricted_
mov ecx, edi
call fcn.00409b35
test eax, eax
jne 0x4096bb
or si, 0x20
jmp 0x409779
mov edx, str.EmbeddedNT
mov ecx, edi
call fcn.00409b35
test eax, eax
jne 0x4096d4
or si, 0x40
jmp 0x409779
mov edx, str.DataCenter
mov ecx, edi
call fcn.00409b35
test eax, eax
jne 0x4096ee
mov eax, 0x80
jmp 0x409776
mov edx, str.Personal
mov ecx, edi
call fcn.00409b35
test eax, eax
jne 0x409705
mov eax, 0x200
jmp 0x409776
mov edx, str.Blade
mov ecx, edi
call fcn.00409b35
test eax, eax
jne 0x40971c
mov eax, 0x400
jmp 0x409776
mov edx, str.Embedded_Restricted_
mov ecx, edi
call fcn.00409b35
test eax, eax
jne 0x409733
mov eax, 0x800
jmp 0x409776
mov edx, str.Security_Appliance
mov ecx, edi
call fcn.00409b35
test eax, eax
jne 0x40974a
mov eax, 0x1000
jmp 0x409776
mov edx, str.Storage_Server
mov ecx, edi
call fcn.00409b35
test eax, eax
jne 0x409761
mov eax, 0x2000
jmp 0x409776
mov edx, str.Compute_Server
mov ecx, edi
call fcn.00409b35
test eax, eax
jne 0x409780
mov eax, 0x4000
or si, ax
mov word [0x459afa], si
lea edi, [edi + ebx*2]
add edi, 2
mov ecx, edi
call fcn.00405a9a
mov ebx, eax
test ebx, ebx
jne 0x409627
cmp dword [esp + 0x10], 0
je 0x4097a8
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0xa2c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0042e8fb
add esp, 0xa24
ret