Function at 0x4030b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
mov eax, dword [0x446040]
xor eax, ebp
mov dword [ebp - 4], eax
push str.GetNativeSystemInfo
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x403108
lea ecx, [ebp - 0x138]
push ecx
call eax
mov ax, word [ebp - 0x138]
cmp ax, 9
je 0x4030fa
cmp ax, 6
jne 0x403108
lea eax, [ebp - 0x10c]
push eax
push 0x20119
jmp 0x403114
lea eax, [ebp - 0x10c]
push eax
push 0x20219
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion_
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x110]
mov dword [ebp - 0x114], 1
push eax
lea eax, [ebp - 0x108]
mov dword [ebp - 0x110], 0x104
push eax
lea eax, [ebp - 0x114]
push eax
push 0
push str.EditionID
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40351a
mov ecx, str.Professional
lea eax, [ebp - 0x108]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x403195
test dl, dl
je 0x403191
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x403195
add eax, 2
add ecx, 2
test dl, dl
jne 0x403175
xor eax, eax
jmp 0x40319a
sbb eax, eax
or eax, 1
test eax, eax
je 0x403507
mov ecx, str.IoTEnterprise
lea eax, [ebp - 0x108]
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4031d0
test dl, dl
je 0x4031cc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4031d0
add eax, 2
add ecx, 2
test dl, dl
jne 0x4031b0
xor eax, eax
jmp 0x4031d5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4031ec
mov eax, str.IoT
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004137fd
mov esp, ebp
pop ebp
ret
mov ecx, str.Enterprise
lea eax, [ebp - 0x108]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x403217
test dl, dl
je 0x403213
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x403217
add eax, 2
add ecx, 2
test dl, dl
jne 0x4031f7
xor eax, eax
jmp 0x40321c
sbb eax, eax
or eax, 1
test eax, eax
je 0x4034f4
mov ecx, str.ProfessionalEducation
lea eax, [ebp - 0x108]
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x403250
test dl, dl
je 0x40324c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x403250
add eax, 2
add ecx, 2
test dl, dl
jne 0x403230
xor eax, eax
jmp 0x403255
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40326c
mov eax, 0x43fa1c
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004137fd
mov esp, ebp
pop ebp
ret
mov ecx, str.Education
lea eax, [ebp - 0x108]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x403297
test dl, dl
je 0x403293
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x403297
add eax, 2
add ecx, 2
test dl, dl
jne 0x403277
xor eax, eax
jmp 0x40329c
sbb eax, eax
or eax, 1
test eax, eax
je 0x4034e1
mov ecx, str.ProfessionalSingleLanguage
lea eax, [ebp - 0x108]
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4032d0
test dl, dl
je 0x4032cc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4032d0
add eax, 2
add ecx, 2
test dl, dl
jne 0x4032b0
xor eax, eax
jmp 0x4032d5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4032ec
mov eax, 0x43fa58
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004137fd
mov esp, ebp
pop ebp
ret
mov ecx, str.ProfessionalWorkstation
lea eax, [ebp - 0x108]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x403317
test dl, dl
je 0x403313
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x403317
add eax, 2
add ecx, 2
test dl, dl
jne 0x4032f7
xor eax, eax
jmp 0x40331c
sbb eax, eax
or eax, 1
test eax, eax
jne 0x403333
mov eax, 0x43fa80
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004137fd
mov esp, ebp
pop ebp
ret
mov ecx, str.ServerRdsh
lea eax, [ebp - 0x108]
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x403360
test dl, dl
je 0x40335c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x403360
add eax, 2
add ecx, 2
test dl, dl
jne 0x403340
xor eax, eax
jmp 0x403365
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40337c
mov eax, 0x43fa9c
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004137fd
mov esp, ebp
pop ebp
ret
mov ecx, str.EnterpriseG
lea eax, [ebp - 0x108]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4033a7
test dl, dl
je 0x4033a3
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4033a7
add eax, 2
add ecx, 2
test dl, dl
jne 0x403387
xor eax, eax
jmp 0x4033ac
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4033c3
mov eax, 0x43fac0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004137fd
mov esp, ebp
pop ebp
ret
mov ecx, str.CoreCountrySpecific
lea eax, [ebp - 0x108]
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4033f0
test dl, dl
je 0x4033ec
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4033f0
add eax, 2
add ecx, 2
test dl, dl
jne 0x4033d0
xor eax, eax
jmp 0x4033f5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40340c
mov eax, 0x43fadc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004137fd
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x108]
push str.Ultimate
push eax
call fcn.00415a40
add esp, 8
test eax, eax
je 0x403437
mov eax, 0x43faf4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004137fd
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x108]
push str.Professional
push eax
call fcn.00415a40
add esp, 8
test eax, eax
jne 0x403507
lea eax, [ebp - 0x108]
push str.Home
push eax
call fcn.00415a40
add esp, 8
test eax, eax
je 0x40347e
mov eax, 0x43fb04
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004137fd
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x108]
push str.Education
push eax
call fcn.00415a40
add esp, 8
test eax, eax
jne 0x4034e1
lea eax, [ebp - 0x108]
push str.Enterprise
push eax
call fcn.00415a40
add esp, 8
test eax, eax
jne 0x4034f4
lea eax, [ebp - 0x108]
push str.Starter
push eax
call fcn.00415a40
add esp, 8
mov ecx, 0x43fb14
test eax, eax
mov edx, 0x43fb1c
cmove ecx, edx
mov eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004137fd
mov esp, ebp
pop ebp
ret
mov eax, 0x43fa34
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004137fd
mov esp, ebp
pop ebp
ret
mov eax, 0x43f9fc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004137fd
mov esp, ebp
pop ebp
ret
mov eax, 0x43f9cc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004137fd
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004137fd
mov esp, ebp
pop ebp
ret