Function at 0x46e280
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x503f1b
mov eax, dword fs:[0]
push eax
sub esp, 0xa1c
mov eax, dword [0x569078]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xa20], 0
mov dword [ebp - 0xa1c], 0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0xa20]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x46e2e6
push eax
call ebx
mov dword [ebp - 0xa20], 0
lea eax, [ebp - 0xa20]
push eax
push 0x20119
push 0
push 0x52d370
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
js 0x46e578
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0xa24]
push eax
lea eax, [ebp - 0x218]
mov dword [ebp - 0xa24], 0x208
push eax
push 0
push 0
push str.ProductType
push dword [ebp - 0xa20]
call esi
test eax, eax
jne 0x46e393
mov edx, str.WinNT
lea ecx, [ebp - 0x218]
call fcn.0047b1c0
test eax, eax
jne 0x46e362
mov eax, 1
mov word [0x56fb80], ax
xor eax, eax
jmp 0x46e38e
mov edx, str.ServerNT
lea ecx, [ebp - 0x218]
call fcn.0047b1c0
test eax, eax
mov edx, 3
mov ecx, 2
mov eax, 1
cmove cx, dx
mov word [0x56fb80], cx
mov byte [0x56fb84], al
lea eax, [ebp - 0xa28]
mov dword [ebp - 0xa28], 0x800
push eax
lea eax, [ebp - 0xa18]
push eax
push 0
push 0
push str.ProductSuite
push dword [ebp - 0xa20]
call esi
test eax, eax
jne 0x46e578
xor edi, edi
lea ebx, [ebp - 0xa18]
mov eax, ebx
cmp word [ebp - 0xa18], di
je 0x46e3e1
lea eax, [eax + 2]
inc edi
cmp word [eax], 0
jne 0x46e3d7
test edi, edi
je 0x46e572
mov si, word [0x56fb82]
mov edx, str.Small_Business
mov ecx, ebx
call fcn.0047b1c0
test eax, eax
jne 0x46e409
or si, 1
jmp 0x46e544
mov edx, str.Enterprise
mov ecx, ebx
call fcn.0047b1c0
test eax, eax
jne 0x46e422
or si, 2
jmp 0x46e544
mov edx, str.BackOffice
mov ecx, ebx
call fcn.0047b1c0
test eax, eax
jne 0x46e43b
or si, 4
jmp 0x46e544
mov edx, str.CommunicationServer
mov ecx, ebx
call fcn.0047b1c0
test eax, eax
jne 0x46e454
or si, 8
jmp 0x46e544
mov edx, str.Terminal_Server
mov ecx, ebx
call fcn.0047b1c0
test eax, eax
jne 0x46e46d
or si, 0x10
jmp 0x46e544
mov edx, str.Small_Business_Restricted_
mov ecx, ebx
call fcn.0047b1c0
test eax, eax
jne 0x46e486
or si, 0x20
jmp 0x46e544
mov edx, str.EmbeddedNT
mov ecx, ebx
call fcn.0047b1c0
test eax, eax
jne 0x46e49f
or si, 0x40
jmp 0x46e544
mov edx, str.DataCenter
mov ecx, ebx
call fcn.0047b1c0
test eax, eax
jne 0x46e4b9
mov eax, 0x80
jmp 0x46e541
mov edx, str.Personal
mov ecx, ebx
call fcn.0047b1c0
test eax, eax
jne 0x46e4d0
mov eax, 0x200
jmp 0x46e541
mov edx, str.Blade
mov ecx, ebx
call fcn.0047b1c0
test eax, eax
jne 0x46e4e7
mov eax, 0x400
jmp 0x46e541
mov edx, str.Embedded_Restricted_
mov ecx, ebx
call fcn.0047b1c0
test eax, eax
jne 0x46e4fe
mov eax, 0x800
jmp 0x46e541
mov edx, str.Security_Appliance
mov ecx, ebx
call fcn.0047b1c0
test eax, eax
jne 0x46e515
mov eax, 0x1000
jmp 0x46e541
mov edx, str.Storage_Server
mov ecx, ebx
call fcn.0047b1c0
test eax, eax
jne 0x46e52c
mov eax, 0x2000
jmp 0x46e541
mov edx, str.Compute_Server
mov ecx, ebx
call fcn.0047b1c0
test eax, eax
jne 0x46e54b
mov eax, 0x4000
or si, ax
mov word [0x56fb82], si
lea ebx, [ebx + edi*2]
xor edi, edi
add ebx, 2
mov eax, ebx
cmp word [ebx], di
je 0x46e56a
nop word [eax + eax]
lea eax, [eax + 2]
inc edi
cmp word [eax], 0
jne 0x46e560
test edi, edi
jne 0x46e3f0
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0xa20]
test eax, eax
je 0x46e596
push eax
call ebx
mov dword [ebp - 0xa20], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004cb6da
mov esp, ebp
pop ebp
ret