Function at 0x5349c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59cee8
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x608554]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push ecx
push str.COsVersionInfo::CheckCoreEdition
lea ecx, [ebp - 0x48]
call fcn.0040a480
mov dword [ebp - 4], 0
mov ecx, dword [0x608f30]
cmp ecx, 0x608f30
je 0x534a47
test byte [ecx + 0x1c], 1
je 0x534a47
cmp dword [0x608f68], 8
mov eax, 0x608f54
mov edx, 0x5e0380
cmovae eax, dword [0x608f54]
push eax
push dword [ecx + 0x14]
push dword [ecx + 0x10]
mov ecx, 0xc
call fcn.00401840
mov ecx, dword [0x608f30]
add esp, 0xc
mov eax, dword [esi + 8]
xor edi, edi
cmp eax, 6
jbe 0x534a5d
cmp byte [esi + 0x11e], 1
jne 0x534a7a
cmp eax, 6
jne 0x534b86
cmp dword [esi + 0xc], 2
jb 0x534b86
cmp byte [esi + 0x11e], 1
je 0x534b86
cmp ecx, 0x608f30
je 0x534ab4
test byte [ecx + 0x1c], 4
je 0x534ab4
cmp dword [0x608f68], 8
mov eax, 0x608f54
mov edx, 0x5e0380
cmovae eax, dword [0x608f54]
push eax
push dword [ecx + 0x14]
push dword [ecx + 0x10]
mov ecx, 0xd
call fcn.00401840
add esp, 0xc
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x4c], edi
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindows_NTCurrentVersionServerServerLevels
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne case.0x534c32.15
mov esi, dword [ebp - 0x4c]
push eax
push eax
push eax
push eax
push str.ServerCoreExtended
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 2
jne 0x534af3
lea edi, [eax - 1]
jmp 0x534b11
push 0
push 0
push 0
push 0
push str.NanoServer
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
mov ecx, 1
cmove edi, ecx
test esi, esi
je case.0x534c32.15
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [0x608f30]
mov byte [ebp - 0x44], 1
cmp ecx, 0x608f30
je 0x534b61
test byte [ecx + 0x1c], 1
je 0x534b61
cmp dword [0x608f68], 8
mov eax, 0x608f54
push edi
cmovae eax, dword [0x608f54]
mov edx, 0x5e0380
push eax
push dword [ecx + 0x14]
push dword [ecx + 0x10]
mov ecx, 0x10
call fcn.004018a0
add esp, 0x10
lea ecx, [ebp - 0x48]
call fcn.0040a570
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0056d977
mov esp, ebp
pop ebp
ret
cmp eax, 6
jb 0x534b22
cmp byte [esi + 0x11e], 1
je 0x534b22
cmp ecx, 0x608f30
je 0x534bce
test byte [ecx + 0x1c], 4
je 0x534bce
cmp dword [0x608f68], 8
mov eax, 0x608f54
mov edx, 0x5e0380
cmovae eax, dword [0x608f54]
push eax
push dword [ecx + 0x14]
push dword [ecx + 0x10]
mov ecx, 0xe
call fcn.00401840
add esp, 0xc
push 0x5ca15c
mov dword [ebp - 0x4c], edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je case.0x534c32.15
push str.GetProductInfo
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je case.0x534c32.15
lea ecx, [ebp - 0x4c]
push ecx
movzx ecx, word [esi + 0x11a]
push ecx
movzx ecx, word [esi + 0x118]
push ecx
push dword [esi + 0xc]
push dword [esi + 8]
call eax
test eax, eax
je case.0x534c32.15
mov eax, dword [ebp - 0x4c]
add eax, 0xfffffff4
cmp eax, 0x1d
ja case.0x534c32.15
movzx eax, byte [eax + 0x534c94]
jmp dword [eax*4 + 0x534c8c]
mov ecx, dword [0x608f30]
cmp ecx, 0x608f30
je 0x534c7f
test byte [ecx + 0x1c], 4
je 0x534c7f
cmp dword [0x608f68], 8
mov eax, 0x608f54
mov edx, 0x5e0380
cmovae eax, dword [0x608f54]
push eax
push dword [ecx + 0x14]
push dword [ecx + 0x10]
mov ecx, 0xf
call fcn.00401840
mov ecx, dword [0x608f30]
add esp, 0xc
mov edi, 1
jmp 0x534b22