Function at 0x1000ccc0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0xa0c]
sub esp, 0xa0c
push 0xffffffffffffffff
push 0x100421bd
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x10067024]
xor eax, ebp
mov dword [ebp + 0xa08], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], 0x100562c8
mov dword [ebp - 0x18], 0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
call dword [eax + 4]
lea eax, [ebp - 0x18]
push eax
push 0x20119
push 0
push str.SYSTEMCurrentControlSetControlProductOptions
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
js 0x1000d1ae
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp + 0x800]
mov dword [ebp - 0x20], 0x208
push eax
push 0
push 0
push str.ProductType
push dword [ebp - 0x18]
call esi
test eax, eax
jne 0x1000cdec
mov eax, 0xfffffffe
nop dword [eax]
lea eax, [eax + 2]
movzx ecx, word [eax + str.WinNT]
movzx edx, word [ebp + eax + 0x800]
cmp dx, cx
jb 0x1000cda2
ja 0x1000cda2
test dx, dx
je 0x1000cd93
test cx, cx
jne 0x1000cd70
mov eax, 1
mov word [0x100690a8], ax
xor al, al
jmp 0x1000cde7
mov eax, 0xfffffffe
nop word [eax + eax]
lea eax, [eax + 2]
movzx ecx, word [eax + str.ServerNT]
movzx edx, word [ebp + eax + 0x800]
cmp dx, cx
jb 0x1000cdda
ja 0x1000cdda
test dx, dx
je 0x1000cdd3
test cx, cx
jne 0x1000cdb0
mov eax, 3
jmp 0x1000cddf
mov eax, 2
mov word [0x100690a8], ax
mov al, 1
mov byte [0x100690ac], al
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0x800
push eax
lea eax, [ebp]
push eax
push 0
push 0
push str.ProductSuite
push dword [ebp - 0x18]
call esi
test eax, eax
jne 0x1000d1ae
xor ecx, ecx
lea edi, [ebp]
mov eax, edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], ecx
cmp word [ebp], cx
je 0x1000ce31
lea eax, [eax + 2]
inc ecx
cmp word [eax], 0
jne 0x1000ce24
mov dword [ebp - 0x14], ecx
test ecx, ecx
je 0x1000d1ae
mov bx, word [0x100690aa]
mov eax, str.Small_Business
sub eax, 2
mov dword [ebp - 0x28], eax
nop dword [eax + eax]
mov esi, edi
mov edx, eax
sub esi, str.Small_Business
nop word [eax + eax]
movzx eax, word [esi + edx + 2]
lea edx, [edx + 2]
movzx ecx, word [edx]
cmp ax, cx
jb 0x1000ce8c
ja 0x1000ce8c
test ax, ax
je 0x1000ce7c
test cx, cx
jne 0x1000ce60
or bx, 1
mov word [0x100690aa], bx
jmp 0x1000d17e
mov edx, str.Enterprise
mov esi, edi
sub edx, 2
sub esi, str.Enterprise
nop dword [eax]
movzx eax, word [esi + edx + 2]
lea edx, [edx + 2]
movzx ecx, word [edx]
cmp ax, cx
jb 0x1000cecc
ja 0x1000cecc
test ax, ax
je 0x1000cebc
test cx, cx
jne 0x1000cea0
or bx, 2
mov word [0x100690aa], bx
jmp 0x1000d17e
mov edx, str.BackOffice
mov esi, edi
sub edx, 2
sub esi, str.BackOffice
nop dword [eax]
movzx eax, word [esi + edx + 2]
lea edx, [edx + 2]
movzx ecx, word [edx]
cmp ax, cx
jb 0x1000cf0c
ja 0x1000cf0c
test ax, ax
je 0x1000cefc
test cx, cx
jne 0x1000cee0
or bx, 4
mov word [0x100690aa], bx
jmp 0x1000d17e
mov edx, str.CommunicationServer
mov esi, edi
sub edx, 2
sub esi, str.CommunicationServer
nop dword [eax]
movzx eax, word [esi + edx + 2]
lea edx, [edx + 2]
movzx ecx, word [edx]
cmp ax, cx
jb 0x1000cf4c
ja 0x1000cf4c
test ax, ax
je 0x1000cf3c
test cx, cx
jne 0x1000cf20
or bx, 8
mov word [0x100690aa], bx
jmp 0x1000d17e
mov edx, str.Terminal_Server
mov esi, edi
sub edx, 2
sub esi, str.Terminal_Server
nop dword [eax]
movzx eax, word [esi + edx + 2]
lea edx, [edx + 2]
movzx ecx, word [edx]
cmp ax, cx
jb 0x1000cf8c
ja 0x1000cf8c
test ax, ax
je 0x1000cf7c
test cx, cx
jne 0x1000cf60
or bx, 0x10
mov word [0x100690aa], bx
jmp 0x1000d17e
mov edx, str.Small_Business_Restricted_
mov esi, edi
sub edx, 2
sub esi, str.Small_Business_Restricted_
nop dword [eax]
movzx eax, word [esi + edx + 2]
lea edx, [edx + 2]
movzx ecx, word [edx]
cmp ax, cx
jb 0x1000cfcc
ja 0x1000cfcc
test ax, ax
je 0x1000cfbc
test cx, cx
jne 0x1000cfa0
or bx, 0x20
mov word [0x100690aa], bx
jmp 0x1000d17e
mov edx, str.EmbeddedNT
mov esi, edi
sub edx, 2
sub esi, str.EmbeddedNT
nop dword [eax]
movzx eax, word [esi + edx + 2]
lea edx, [edx + 2]
movzx ecx, word [edx]
cmp ax, cx
jb 0x1000d00c
ja 0x1000d00c
test ax, ax
je 0x1000cffc
test cx, cx
jne 0x1000cfe0
or bx, 0x40
mov word [0x100690aa], bx
jmp 0x1000d17e
mov edx, str.DataCenter
mov esi, edi
sub edx, 2
sub esi, str.DataCenter
nop dword [eax]
movzx eax, word [esi + edx + 2]
lea edx, [edx + 2]
movzx ecx, word [edx]
cmp ax, cx
jb 0x1000d050
ja 0x1000d050
test ax, ax
je 0x1000d03c
test cx, cx
jne 0x1000d020
mov eax, 0x80
or bx, ax
mov word [0x100690aa], bx
jmp 0x1000d17e
add edi, 0xfffffffe
mov esi, str.Personal
sub esi, dword [ebp - 0x10]
mov edx, edi
nop dword [eax]
movzx ecx, word [esi + edx + 2]
lea edx, [edx + 2]
movzx eax, word [edx]
cmp ax, cx
jb 0x1000d086
ja 0x1000d086
test ax, ax
je 0x1000d07c
test cx, cx
jne 0x1000d060
mov eax, 0x200
jmp 0x1000d171
mov esi, str.Blade
mov edx, edi
sub esi, dword [ebp - 0x10]
movzx ecx, word [esi + edx + 2]
lea edx, [edx + 2]
movzx eax, word [edx]
cmp ax, cx
jb 0x1000d0b6
ja 0x1000d0b6
test ax, ax
je 0x1000d0ac
test cx, cx
jne 0x1000d090
mov eax, 0x400
jmp 0x1000d171
mov esi, str.Embedded_Restricted_
mov edx, edi
sub esi, dword [ebp - 0x10]
movzx ecx, word [esi + edx + 2]
lea edx, [edx + 2]
movzx eax, word [edx]
cmp ax, cx
jb 0x1000d0e6
ja 0x1000d0e6
test ax, ax
je 0x1000d0dc
test cx, cx
jne 0x1000d0c0
mov eax, 0x800
jmp 0x1000d171
mov esi, str.Security_Appliance
mov edx, edi
sub esi, dword [ebp - 0x10]
movzx ecx, word [esi + edx + 2]
lea edx, [edx + 2]
movzx eax, word [edx]
cmp ax, cx
jb 0x1000d113
ja 0x1000d113
test ax, ax
je 0x1000d10c
test cx, cx
jne 0x1000d0f0
mov eax, 0x1000
jmp 0x1000d171
mov esi, str.Storage_Server
mov edx, edi
sub esi, dword [ebp - 0x10]
nop dword [eax]
movzx ecx, word [esi + edx + 2]
lea edx, [edx + 2]
movzx eax, word [edx]
cmp ax, cx
jb 0x1000d143
ja 0x1000d143
test ax, ax
je 0x1000d13c
test cx, cx
jne 0x1000d120
mov eax, 0x2000
jmp 0x1000d171
mov edx, str.Compute_Server
sub edx, dword [ebp - 0x10]
nop dword [eax + eax]
movzx ecx, word [edx + edi + 2]
lea edi, [edi + 2]
movzx eax, word [edi]
cmp ax, cx
jb 0x1000d17b
ja 0x1000d17b
test ax, ax
je 0x1000d16c
test cx, cx
jne 0x1000d150
mov eax, 0x4000
or bx, ax
mov word [0x100690aa], bx
mov edi, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
xor ecx, ecx
mov dword [ebp - 0x14], ecx
lea edi, [edi + eax*2]
add edi, 2
mov dword [ebp - 0x10], edi
mov eax, edi
cmp word [edi], cx
je 0x1000d1a3
lea eax, [eax + 2]
inc ecx
cmp word [eax], 0
jne 0x1000d196
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x28]
test ecx, ecx
jne 0x1000ce50
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], 0x100562c8
test eax, eax
je 0x1000d1d1
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x18], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xa08]
xor ecx, ebp
call fcn.1002c803
lea esp, [ebp + 0xa0c]
pop ebp
ret