Function at 0x10021bbd
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x260
mov eax, 0x100426cd
call fcn.1002b17c
mov eax, dword [ebp + 8]
push 0x47
mov dword [ebp - 0x1dc], eax
pop ecx
lea eax, [ebp - 0x26c]
lea esi, [ebp + 0xc]
lea edi, [ebp - 0x1d4]
rep movsd dword es:[edi], dword [esi]
and dword [ebp - 0x1e0], 0
push eax
mov ebx, edx
call fcn.100229ba
push 0x1004c564
mov ecx, ebx
mov dword [ebp - 4], 1
call fcn.100029e3
mov eax, dword [ebp - 0x1c4]
sub eax, 0
je 0x10022249
dec eax
je 0x10022181
dec eax
jne 0x10022268
lea eax, [ebp - 0x264]
push 0x1004c568
push eax
call fcn.1002437a
pop ecx
pop ecx
push 5
pop esi
push 6
pop edi
cmp dword [ebp - 0x1d0], edi
jne 0x10021d89
cmp dword [ebp - 0x1cc], 0
jne 0x10021c9f
cmp byte [ebp - 0xba], 3
mov eax, str.Server_2008
je 0x10021c69
mov eax, str.Vista
push eax
lea eax, [ebp - 0x264]
push eax
call fcn.1002437a
cmp byte [ebp - 0xba], 3
pop ecx
pop ecx
mov eax, str.srv2008
je 0x10021c8b
mov eax, str.vista
push eax
mov ecx, ebx
call fcn.100029e3
cmp dword [ebp - 0x1d0], edi
jne 0x10021d89
cmp dword [ebp - 0x1cc], 1
jne 0x10021cf1
cmp byte [ebp - 0xba], 3
mov eax, str.Server_2008_R2
je 0x10021cbb
mov eax, 0x1004c5e4
push eax
lea eax, [ebp - 0x264]
push eax
call fcn.1002437a
cmp byte [ebp - 0xba], 3
pop ecx
pop ecx
mov eax, str.srv2008r2
je 0x10021cdd
mov eax, str.win7
push eax
mov ecx, ebx
call fcn.100029e3
cmp dword [ebp - 0x1d0], edi
jne 0x10021d89
cmp dword [ebp - 0x1cc], 2
jne 0x10021d3f
cmp byte [ebp - 0xba], 3
mov eax, str.Server_2012
je 0x10021d0d
mov eax, 0x1004c614
push eax
lea eax, [ebp - 0x264]
push eax
call fcn.1002437a
cmp byte [ebp - 0xba], 3
pop ecx
pop ecx
mov eax, str.srv2012
je 0x10021d2f
mov eax, str.win8
push eax
mov ecx, ebx
call fcn.100029e3
cmp dword [ebp - 0x1d0], edi
jne 0x10021d89
cmp dword [ebp - 0x1cc], 3
jne 0x10021e63
cmp byte [ebp - 0xba], 3
mov eax, str.Server_2012_R2
je 0x10021d5f
mov eax, 0x1004c648
push eax
lea eax, [ebp - 0x264]
push eax
call fcn.1002437a
cmp byte [ebp - 0xba], 3
pop ecx
pop ecx
mov eax, str.srv2012r2
je 0x10021d81
mov eax, str.win81
push eax
mov ecx, ebx
call fcn.100029e3
cmp dword [ebp - 0x1d0], esi
jne 0x10021e3b
cmp dword [ebp - 0x1cc], 2
jne 0x10021de3
cmp byte [ebp - 0xba], 1
mov eax, str.XP_x64
je 0x10021db1
mov eax, str.Server_2003_family
push eax
lea eax, [ebp - 0x264]
push eax
call fcn.1002437a
cmp byte [ebp - 0xba], 1
pop ecx
pop ecx
mov eax, str.winxp64
je 0x10021dd3
mov eax, str.srv2003
push eax
mov ecx, ebx
call fcn.100029e3
cmp dword [ebp - 0x1d0], esi
jne 0x10021e3b
cmp dword [ebp - 0x1cc], 1
jne 0x10021e13
lea eax, [ebp - 0x264]
push 0x1004c6ac
push eax
call fcn.1002437a
pop ecx
pop ecx
push str.winxp
mov ecx, ebx
call fcn.100029e3
cmp dword [ebp - 0x1d0], esi
jne 0x10021e3b
cmp dword [ebp - 0x1cc], 0
jne 0x10021e63
lea eax, [ebp - 0x264]
push str.2000
push eax
call fcn.1002437a
pop ecx
pop ecx
push str.win2k
mov ecx, ebx
call fcn.100029e3
cmp dword [ebp - 0x1d0], 4
ja 0x10021e63
lea eax, [ebp - 0x264]
push 0x1004c6d0
push eax
call fcn.1002437a
pop ecx
pop ecx
push str.windy
mov ecx, ebx
call fcn.100029e3
cmp dword [ebp + 0x128], 0
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, reloc.OLEAUT32.dll_SysReAllocString
je 0x10021f85
cmp byte [ebp - 0xba], 1
jne 0x10021ebd
cmp dword [ebp - 0x1d0], 4
lea eax, [ebp - 0x264]
jne 0x10021e9d
push str._Workstation_4.0
jmp 0x10021f78
test dword [ebp - 0xbc], 0x200
je 0x10021eb3
push str._Home_Edition
jmp 0x10021f78
push str._Professional
jmp 0x10021f78
cmp byte [ebp - 0xba], 3
jne 0x100220cb
cmp dword [ebp - 0x1d0], esi
jne 0x10021f5d
cmp dword [ebp - 0x1cc], 2
jne 0x10021f27
test byte [ebp - 0xbc], 0x80
je 0x10021eef
push str._Datacenter_Edition
jmp 0x10021efd
test byte [ebp - 0xbc], 2
je 0x10021f05
push str._Enterprise_Edition
lea eax, [ebp - 0x264]
jmp 0x10021f78
mov eax, 0x400
cmp word [ebp - 0xbc], ax
lea eax, [ebp - 0x264]
jne 0x10021f20
push str._Web_Edition
jmp 0x10021f78
push str._Standard_Edition
jmp 0x10021f78
cmp dword [ebp - 0x1cc], 0
jne 0x10021f5d
test byte [ebp - 0xbc], 0x80
lea eax, [ebp - 0x264]
je 0x10021f46
push str._Datacenter_Server
jmp 0x10021f78
test byte [ebp - 0xbc], 2
je 0x10021f56
push str._Advanced_Server
jmp 0x10021f78
push str._Server
jmp 0x10021f78
test byte [ebp - 0xbc], 2
lea eax, [ebp - 0x264]
je 0x10021f73
push str._Server_4.0__Enterprise_Edition
jmp 0x10021f78
push str._Server_4.0
push eax
call fcn.1002437a
pop ecx
pop ecx
jmp 0x100220cb
push 0x50
pop esi
lea eax, [ebp - 0x1d8]
push eax
push 1
push 0
push str.SYSTEMCurrentControlSetControlProductOptions
push ebx
mov dword [ebp - 0x1e4], esi
call edi
test eax, eax
je 0x10021fd5
mov esi, dword [ebp - 0x1dc]
push 0x100498ac
call fcn.10002136
lea eax, [ebp - 0x26c]
mov dword [ebp - 0x1e0], 1
mov byte [ebp - 4], 0
call fcn.100222a0
mov eax, esi
jmp 0x10022298
lea eax, [ebp - 0x1e4]
push eax
lea eax, [ebp - 0xb4]
push eax
push 0
push 0
push str.ProductType
push dword [ebp - 0x1d8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1002216c
cmp dword [ebp - 0x1e4], esi
ja 0x1002216c
push dword [ebp - 0x1d8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
lea eax, [ebp - 0xb4]
push eax
push str.WINNT
call esi
test eax, eax
jne 0x10022043
lea eax, [ebp - 0x264]
push str._Workstation
push eax
call fcn.1002437a
pop ecx
pop ecx
lea eax, [ebp - 0xb4]
push eax
push str.LANMANNT
call esi
test eax, eax
jne 0x10022068
lea eax, [ebp - 0x264]
push str._Server
push eax
call fcn.1002437a
pop ecx
pop ecx
lea eax, [ebp - 0xb4]
push eax
push str.SERVERNT
call esi
test eax, eax
jne 0x1002208d
lea eax, [ebp - 0x264]
push str._Advanced_Server
push eax
call fcn.1002437a
pop ecx
pop ecx
push dword [ebp - 0x1cc]
lea eax, [ebp - 0x264]
push ecx
push 0x1004c2f8
push ecx
push dword [ebp - 0x1d0]
push ecx
push 0x1004b92c
push eax
call fcn.1002437a
add esp, 0xc
push eax
call fcn.100226da
pop ecx
push eax
call fcn.1002437a
add esp, 0xc
push eax
call fcn.100226da
cmp dword [ebp - 0x1d0], 4
jne 0x10022143
push str.Service_Pack_6
lea eax, [ebp - 0x1c0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x10022143
lea eax, [ebp - 0x1d8]
push eax
push 1
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionHotfixQ246009
push ebx
call edi
test eax, eax
jne 0x1002210e
push str._Service_Pack_6a
lea eax, [ebp - 0x264]
jmp 0x1002212a
lea eax, [ebp - 0x1c0]
push eax
push ecx
lea eax, [ebp - 0x264]
push 0x1004b92c
push eax
call fcn.1002437a
add esp, 0xc
push eax
call fcn.1002437a
pop ecx
pop ecx
push dword [ebp - 0x1d8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10022268
lea eax, [ebp - 0x1c0]
push eax
push ecx
lea eax, [ebp - 0x264]
push 0x1004b92c
push eax
call fcn.1002437a
add esp, 0xc
push eax
call fcn.1002437a
pop ecx
pop ecx
jmp 0x10022268
mov esi, dword [ebp - 0x1dc]
push 0x100498ac
call fcn.10002136
jmp 0x10021fb5
cmp dword [ebp - 0x1d0], 4
jne 0x10022268
cmp dword [ebp - 0x1cc], 0
jne 0x100221d8
lea eax, [ebp - 0x264]
push str.Microsoft_Windows_95
push eax
call fcn.1002437a
cmp word [ebp - 0x1be], 0x43
pop ecx
pop ecx
je 0x100221be
cmp word [ebp - 0x1be], 0x42
jne 0x100221d1
lea eax, [ebp - 0x264]
push str._OSR2
push eax
call fcn.1002437a
pop ecx
pop ecx
push str.win95
jmp 0x10022216
cmp dword [ebp - 0x1cc], 0xa
jne 0x10022226
lea eax, [ebp - 0x264]
push str.Microsoft_Windows_98
push eax
call fcn.100244d1
cmp word [ebp - 0x1be], 0x41
pop ecx
pop ecx
jne 0x10022211
lea eax, [ebp - 0x264]
push 0x1004ca5c
push eax
call fcn.100244d1
pop ecx
pop ecx
push str.win98
mov ecx, ebx
call fcn.100029e3
cmp dword [ebp - 0x1d0], 4
jne 0x10022268
cmp dword [ebp - 0x1cc], 0x5a
jne 0x10022268
lea eax, [ebp - 0x264]
push str.Microsoft_Windows_Millennium_Edition
push eax
call fcn.1002437a
pop ecx
pop ecx
push str.winme
jmp 0x10022261
lea eax, [ebp - 0x264]
push str.Microsoft_Win32s
push eax
call fcn.1002437a
pop ecx
pop ecx
push str.win32s
mov ecx, ebx
call fcn.100029e3
push dword [ebp - 0x1dc]
lea ecx, [ebp - 0x26c]
call fcn.10022a79
lea eax, [ebp - 0x26c]
mov dword [ebp - 0x1e0], 1
mov byte [ebp - 4], 0
call fcn.100222a0
mov eax, dword [ebp - 0x1dc]
call fcn.1002b1ff
ret 0x124