Function at 0x46a820
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50593b
mov eax, dword fs:[0]
push eax
sub esp, 0xa24
mov eax, dword [0x5651c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xa20], 0
mov dword [ebp - 0xa1c], 0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0xa20]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x46a886
push eax
call ebx
mov dword [ebp - 0xa20], 0
lea eax, [ebp - 0xa20]
push eax
push 0x20119
push 0
push str.SYSTEMCurrentControlSetControlProductOptions
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
js 0x46ab52
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0xa28]
push eax
lea eax, [ebp - 0x218]
mov dword [ebp - 0xa28], 0x208
push eax
push 0
push 0
push str.ProductType
push dword [ebp - 0xa20]
call esi
test eax, eax
jne 0x46a933
mov edx, str.WinNT
lea ecx, [ebp - 0x218]
call fcn.00475f00
test eax, eax
jne 0x46a902
mov eax, 1
mov word [0x56bd50], ax
xor eax, eax
jmp 0x46a92e
mov edx, str.ServerNT
lea ecx, [ebp - 0x218]
call fcn.00475f00
test eax, eax
mov edx, 3
mov ecx, 2
mov eax, 1
cmove cx, dx
mov word [0x56bd50], cx
mov byte [0x56bd54], al
lea eax, [ebp - 0xa2c]
mov dword [ebp - 0xa2c], 0x800
push eax
lea eax, [ebp - 0xa18]
push eax
push 0
push 0
push str.ProductSuite
push dword [ebp - 0xa20]
call esi
test eax, eax
jne 0x46ab52
mov ax, word [ebp - 0xa18]
lea ebx, [ebp - 0xa18]
test ax, ax
je 0x46ab4c
mov si, word [0x56bd52]
mov ecx, str.Small_Business
sub ecx, 2
movzx eax, ax
mov dword [ebp - 0xa30], ecx
mov dword [ebp - 0xa24], eax
nop dword [eax + eax]
mov edi, ebx
mov edx, ecx
sub edi, str.Small_Business
nop word [eax + eax]
movzx eax, word [edi + edx + 2]
lea edx, [edx + 2]
movzx ecx, word [edx]
cmp ax, cx
jb 0x46a9d5
ja 0x46a9d5
test ax, ax
je 0x46a9cc
test cx, cx
jne 0x46a9b0
or si, 1
jmp 0x46ab10
mov edx, str.Enterprise
mov ecx, ebx
call fcn.00475f00
test eax, eax
jne 0x46a9ee
or si, 2
jmp 0x46ab10
mov edx, str.BackOffice
mov ecx, ebx
call fcn.00475f00
test eax, eax
jne 0x46aa07
or si, 4
jmp 0x46ab10
mov edx, str.CommunicationServer
mov ecx, ebx
call fcn.00475f00
test eax, eax
jne 0x46aa20
or si, 8
jmp 0x46ab10
mov edx, str.Terminal_Server
mov ecx, ebx
call fcn.00475f00
test eax, eax
jne 0x46aa39
or si, 0x10
jmp 0x46ab10
mov edx, str.Small_Business_Restricted_
mov ecx, ebx
call fcn.00475f00
test eax, eax
jne 0x46aa52
or si, 0x20
jmp 0x46ab10
mov edx, str.EmbeddedNT
mov ecx, ebx
call fcn.00475f00
test eax, eax
jne 0x46aa6b
or si, 0x40
jmp 0x46ab10
mov edx, str.DataCenter
mov ecx, ebx
call fcn.00475f00
test eax, eax
jne 0x46aa85
mov eax, 0x80
jmp 0x46ab0d
mov edx, str.Personal
mov ecx, ebx
call fcn.00475f00
test eax, eax
jne 0x46aa9c
mov eax, 0x200
jmp 0x46ab0d
mov edx, str.Blade
mov ecx, ebx
call fcn.00475f00
test eax, eax
jne 0x46aab3
mov eax, 0x400
jmp 0x46ab0d
mov edx, str.Embedded_Restricted_
mov ecx, ebx
call fcn.00475f00
test eax, eax
jne 0x46aaca
mov eax, 0x800
jmp 0x46ab0d
mov edx, str.Security_Appliance
mov ecx, ebx
call fcn.00475f00
test eax, eax
jne 0x46aae1
mov eax, 0x1000
jmp 0x46ab0d
mov edx, str.Storage_Server
mov ecx, ebx
call fcn.00475f00
test eax, eax
jne 0x46aaf8
mov eax, 0x2000
jmp 0x46ab0d
mov edx, str.Compute_Server
mov ecx, ebx
call fcn.00475f00
test eax, eax
jne 0x46ab17
mov eax, 0x4000
or si, ax
mov word [0x56bd52], si
xor ecx, ecx
mov eax, ebx
cmp word [ebp - 0xa24], cx
je 0x46ab2e
lea eax, [eax + 2]
inc ecx
cmp word [eax], 0
jne 0x46ab24
lea ebx, [ebx + ecx*2]
mov ecx, dword [ebp - 0xa30]
add ebx, 2
movzx eax, word [ebx]
mov dword [ebp - 0xa24], eax
test ax, ax
jne 0x46a9a0
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0xa20]
test eax, eax
je 0x46ab70
push eax
call ebx
mov dword [ebp - 0xa20], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d207d
mov esp, ebp
pop ebp
ret