Function at 0x1001d530
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0xa0c]
sub esp, 0xa0c
push 0xffffffffffffffff
push 0x1007250d
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x100c0040]
xor eax, ebp
mov dword [ebp + 0xa08], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], 0x100a6a14
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x14]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x1007d584]
lea ecx, [ebp - 0x14]
call esi
lea eax, [ebp - 0x10]
push eax
push 0x20119
push 0
push str.SYSTEMCurrentControlSetControlProductOptions
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
js 0x1001d802
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0x208
push eax
lea eax, [ebp + 0x800]
push eax
push 0
push 0
push str.ProductType
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1001d62a
mov edx, str.WinNT
lea ecx, [ebp + 0x800]
call fcn.10023380
test eax, eax
jne 0x1001d5ff
mov eax, 1
mov word [0x100c21f8], ax
xor al, al
jmp 0x1001d625
mov edx, str.ServerNT
lea ecx, [ebp + 0x800]
call fcn.10023380
test eax, eax
mov eax, 3
je 0x1001d61d
mov eax, 2
mov word [0x100c21f8], ax
mov al, 1
mov byte [0x100c21fc], al
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x800
push eax
lea eax, [ebp]
push eax
push 0
push 0
push str.ProductSuite
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1001d802
xor edi, edi
lea ebx, [ebp]
mov eax, ebx
cmp word [ebp], di
je 0x1001d66a
lea eax, [eax + 2]
inc edi
cmp word [eax], 0
jne 0x1001d660
test edi, edi
je 0x1001d802
mov si, word [0x100c21fa]
nop dword [eax]
mov edx, str.Small_Business
mov ecx, ebx
call fcn.10023380
test eax, eax
jne 0x1001d699
or si, 1
jmp 0x1001d7d4
mov edx, str.Enterprise
mov ecx, ebx
call fcn.10023380
test eax, eax
jne 0x1001d6b2
or si, 2
jmp 0x1001d7d4
mov edx, str.BackOffice
mov ecx, ebx
call fcn.10023380
test eax, eax
jne 0x1001d6cb
or si, 4
jmp 0x1001d7d4
mov edx, str.CommunicationServer
mov ecx, ebx
call fcn.10023380
test eax, eax
jne 0x1001d6e4
or si, 8
jmp 0x1001d7d4
mov edx, str.Terminal_Server
mov ecx, ebx
call fcn.10023380
test eax, eax
jne 0x1001d6fd
or si, 0x10
jmp 0x1001d7d4
mov edx, str.Small_Business_Restricted_
mov ecx, ebx
call fcn.10023380
test eax, eax
jne 0x1001d716
or si, 0x20
jmp 0x1001d7d4
mov edx, str.EmbeddedNT
mov ecx, ebx
call fcn.10023380
test eax, eax
jne 0x1001d72f
or si, 0x40
jmp 0x1001d7d4
mov edx, str.DataCenter
mov ecx, ebx
call fcn.10023380
test eax, eax
jne 0x1001d749
mov eax, 0x80
jmp 0x1001d7d1
mov edx, str.Personal
mov ecx, ebx
call fcn.10023380
test eax, eax
jne 0x1001d760
mov eax, 0x200
jmp 0x1001d7d1
mov edx, str.Blade
mov ecx, ebx
call fcn.10023380
test eax, eax
jne 0x1001d777
mov eax, 0x400
jmp 0x1001d7d1
mov edx, str.Embedded_Restricted_
mov ecx, ebx
call fcn.10023380
test eax, eax
jne 0x1001d78e
mov eax, 0x800
jmp 0x1001d7d1
mov edx, str.Security_Appliance
mov ecx, ebx
call fcn.10023380
test eax, eax
jne 0x1001d7a5
mov eax, 0x1000
jmp 0x1001d7d1
mov edx, str.Storage_Server
mov ecx, ebx
call fcn.10023380
test eax, eax
jne 0x1001d7bc
mov eax, 0x2000
jmp 0x1001d7d1
mov edx, str.Compute_Server
mov ecx, ebx
call fcn.10023380
test eax, eax
jne 0x1001d7db
mov eax, 0x4000
or si, ax
mov word [0x100c21fa], si
lea ebx, [ebx + edi*2]
xor edi, edi
add ebx, 2
mov eax, ebx
cmp word [ebx], di
je 0x1001d7fa
nop word [eax + eax]
lea eax, [eax + 2]
inc edi
cmp word [eax], 0
jne 0x1001d7f0
test edi, edi
jne 0x1001d680
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], 0x100a6a14
test eax, eax
je 0x1001d825
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xa08]
xor ecx, ebp
call fcn.10053e7d
lea esp, [ebp + 0xa0c]
pop ebp
ret