Function at 0x41d48e
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xa24
mov eax, dword [0x448010]
xor eax, esp
mov dword [esp + 0xa1c], eax
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x10]
xor edi, edi
push eax
push 0x20119
push edi
push str.SYSTEMCurrentControlSetControlProductOptions
push 0x80000002
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
js 0x41d704
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x1c], 0x208
push eax
push edi
push edi
push str.ProductType
push dword [esp + 0x24]
call esi
xor ebp, ebp
inc ebp
push 2
pop ebx
test eax, eax
jne 0x41d54a
mov edx, str.WinNT
lea ecx, [esp + 0x20]
call fcn.0040150e
test eax, eax
jne 0x41d51f
mov word [0x449cb8], bp
mov eax, edi
jmp 0x41d545
mov edx, str.ServerNT
lea ecx, [esp + 0x20]
call fcn.0040150e
test eax, eax
jne 0x41d53c
push 3
pop eax
mov word [0x449cb8], ax
jmp 0x41d543
mov word [0x449cb8], bx
mov eax, ebp
mov byte [0x449cbc], al
mov eax, 0x800
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x22c]
push eax
push edi
push edi
push str.ProductSuite
push dword [esp + 0x24]
call esi
test eax, eax
jne 0x41d704
lea edi, [esp + 0x228]
mov ecx, edi
call fcn.0040153f
mov ebx, eax
test ebx, ebx
je 0x41d704
mov si, word [0x449cba]
mov edx, str.Small_Business
mov ecx, edi
call fcn.0040150e
test eax, eax
jne 0x41d5ac
or si, bp
jmp 0x41d6e6
mov edx, str.Enterprise
mov ecx, edi
call fcn.0040150e
test eax, eax
jne 0x41d5c4
push 2
pop eax
jmp 0x41d6e3
mov edx, str.BackOffice
mov ecx, edi
call fcn.0040150e
test eax, eax
jne 0x41d5dd
or si, 4
jmp 0x41d6e6
mov edx, str.CommunicationServer
mov ecx, edi
call fcn.0040150e
test eax, eax
jne 0x41d5f6
or si, 8
jmp 0x41d6e6
mov edx, str.Terminal_Server
mov ecx, edi
call fcn.0040150e
test eax, eax
jne 0x41d60f
or si, 0x10
jmp 0x41d6e6
mov edx, str.Small_Business_Restricted_
mov ecx, edi
call fcn.0040150e
test eax, eax
jne 0x41d628
or si, 0x20
jmp 0x41d6e6
mov edx, str.EmbeddedNT
mov ecx, edi
call fcn.0040150e
test eax, eax
jne 0x41d641
or si, 0x40
jmp 0x41d6e6
mov edx, str.DataCenter
mov ecx, edi
call fcn.0040150e
test eax, eax
jne 0x41d65b
mov eax, 0x80
jmp 0x41d6e3
mov edx, str.Personal
mov ecx, edi
call fcn.0040150e
test eax, eax
jne 0x41d672
mov eax, 0x200
jmp 0x41d6e3
mov edx, str.Blade
mov ecx, edi
call fcn.0040150e
test eax, eax
jne 0x41d689
mov eax, 0x400
jmp 0x41d6e3
mov edx, str.Embedded_Restricted_
mov ecx, edi
call fcn.0040150e
test eax, eax
jne 0x41d6a0
mov eax, 0x800
jmp 0x41d6e3
mov edx, str.Security_Appliance
mov ecx, edi
call fcn.0040150e
test eax, eax
jne 0x41d6b7
mov eax, 0x1000
jmp 0x41d6e3
mov edx, str.Storage_Server
mov ecx, edi
call fcn.0040150e
test eax, eax
jne 0x41d6ce
mov eax, 0x2000
jmp 0x41d6e3
mov edx, str.Compute_Server
mov ecx, edi
call fcn.0040150e
test eax, eax
jne 0x41d6ed
mov eax, 0x4000
or si, ax
mov word [0x449cba], si
lea edi, [edi + ebx*2]
add edi, 2
mov ecx, edi
call fcn.0040153f
mov ebx, eax
test ebx, ebx
jne 0x41d594
cmp dword [esp + 0x10], 0
je 0x41d715
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0xa2c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004246ea
add esp, 0xa24
ret