Function at 0x4202a1
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edi
lea eax, [edi + 0x150]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionComponent_Based_Servicing
push 0x80000002
push dword [edi + 0x148]
call sym.Dismx86.exe_DismRegOpenKey
lea ebx, [edi + 0x14c]
push ebx
push dword [edi + 0x148]
call sym.Dismx86.exe_DismGetSystemInfoBySession
test eax, eax
jne 0x420634
mov ebx, dword [ebx]
push 2
mov dword [ebp - 0x128], 0x11c
movzx eax, word [ebx + 0x16]
mov dword [ebp - 0x124], eax
movzx eax, word [ebx + 0x14]
mov dword [ebp - 0x120], eax
movzx eax, word [ebx + 0x12]
mov dword [ebp - 0x11c], eax
pop eax
mov dword [ebp - 0x118], eax
xor eax, eax
push 0x108
push eax
lea eax, [ebp - 0x114]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea esi, [ebp - 0x128]
add edi, 0x28
lea edx, [ebp - 8]
push 0x47
pop ecx
rep movsd dword es:[edi], dword [esi]
mov al, byte [ebx + 0xc]
mov esi, 0x80000002
mov ebx, dword [ebp - 4]
push edx
push 0x2000000
push str.SYSTEMCurrentControlSetControlWindows
mov byte [ebx + 0x142], al
mov eax, dword [ebx + 0x148]
push esi
mov eax, dword [eax + 0x48]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
push 4
pop edi
test eax, eax
jne 0x4203b9
lea eax, [ebp - 4]
mov dword [ebp - 4], edi
push eax
lea eax, [ebp - 0xc]
push eax
xor eax, eax
push eax
push eax
push str.CSDVersion
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4203b0
mov ecx, dword [ebp - 0xc]
mov eax, ecx
shr eax, 8
mov word [ebx + 0x13c], ax
movzx eax, cl
mov word [ebx + 0x13e], ax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebx + 0x148]
lea edx, [ebp - 8]
push edx
push 0x2000000
push str.SYSTEMCurrentControlSetControlProductOptions
mov eax, dword [eax + 0x48]
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
test eax, eax
jne 0x4205d2
call fcn.0043d5bb
push eax
lea ecx, [ebp - 4]
call fcn.0043bbe8
mov ecx, dword [ebp - 8]
lea eax, [ebp - 4]
push eax
mov edx, str.ProductSuite
call fcn.0044dd53
pop ecx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 4]
xor eax, eax
inc eax
cmp dword [esi - 4], eax
jle 0x420421
push dword [esi - 0xc]
lea ecx, [ebp - 4]
call fcn.0043d715
mov esi, dword [ebp - 4]
xor eax, eax
mov edi, esi
cmp word [esi], ax
je 0x4205c2
xor esi, esi
push str.Small_Business
push edi
call dword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
jne 0x420446
inc eax
jmp 0x4205a2
push str.Enterprise
push edi
call dword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
jne 0x42045e
push 2
pop eax
jmp 0x4205a2
push str.BackOffice
push edi
call dword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
jne 0x420472
push 4
jmp 0x420458
push str.CommunicationServer
push edi
call dword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
jne 0x42048f
or word [ebx + 0x140], 8
jmp 0x4205a9
push str.Terminal_Server
push edi
call dword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
jne 0x4204ac
or word [ebx + 0x140], 0x10
jmp 0x4205a9
push str.Small_Business_Restricted_
push edi
call dword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
jne 0x4204c9
or word [ebx + 0x140], 0x20
jmp 0x4205a9
push str.EmbeddedNT
push edi
call dword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
jne 0x4204e6
or word [ebx + 0x140], 0x40
jmp 0x4205a9
push str.DataCenter
push edi
call dword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
jne 0x420500
mov eax, 0x80
jmp 0x4205a2
push str.Personal
push edi
call dword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
jne 0x42051a
mov eax, 0x200
jmp 0x4205a2
push str.Blade
push edi
call dword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
jne 0x420531
mov eax, 0x400
jmp 0x4205a2
push str.Embedded_Restricted_
push edi
call dword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
jne 0x420548
mov eax, 0x800
jmp 0x4205a2
push str.Security_Appliance
push edi
call dword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
jne 0x42055f
mov eax, 0x1000
jmp 0x4205a2
push str.Storage_Server
push edi
call dword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
jne 0x420576
mov eax, 0x2000
jmp 0x4205a2
push str.Compute_Server
push edi
call dword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
jne 0x42058d
mov eax, 0x4000
jmp 0x4205a2
push str.WH_Server
push edi
call dword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
jne 0x4205a9
mov eax, 0x8000
or word [ebx + 0x140], ax
mov ecx, edi
call fcn.0044ccce
lea edi, [edi + eax*2]
add edi, 2
cmp word [edi], si
jne 0x420430
mov esi, dword [ebp - 4]
lea ecx, [esi - 0x10]
call fcn.0043d912
push 4
mov esi, 0x80000002
pop edi
mov eax, dword [ebx + 0x148]
lea edx, [ebp - 8]
push edx
push 0x2000000
push str.SystemCurrentControlSetControlTerminal_Server
mov eax, dword [eax + 0x48]
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
test eax, eax
jne 0x420632
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], edi
push eax
xor ecx, ecx
lea eax, [ebp - 4]
push eax
push ecx
push ecx
push str.TSAppCompat
push dword [ebp - 8]
mov dword [ebp - 4], ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x420629
cmp dword [ebp - 4], eax
je 0x420629
mov eax, 0x100
or word [ebx + 0x140], ax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret