Function at 0x4031d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
mov eax, dword [0x44f040]
xor eax, ebp
mov dword [ebp - 4], eax
push str.GetNativeSystemInfo
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x403228
lea ecx, [ebp - 0x138]
push ecx
call eax
mov ax, word [ebp - 0x138]
cmp ax, 9
je 0x40321a
cmp ax, 6
jne 0x403228
lea eax, [ebp - 0x10c]
push eax
push 0x20119
jmp 0x403234
lea eax, [ebp - 0x10c]
push eax
push 0x20219
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion_
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x110]
mov dword [ebp - 0x114], 1
push eax
lea eax, [ebp - 0x108]
mov dword [ebp - 0x110], 0x104
push eax
lea eax, [ebp - 0x114]
push eax
push 0
push str.EditionID
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40363a
mov ecx, str.Professional
lea eax, [ebp - 0x108]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4032b5
test dl, dl
je 0x4032b1
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4032b5
add eax, 2
add ecx, 2
test dl, dl
jne 0x403295
xor eax, eax
jmp 0x4032ba
sbb eax, eax
or eax, 1
test eax, eax
je 0x403627
mov ecx, str.IoTEnterprise
lea eax, [ebp - 0x108]
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4032f0
test dl, dl
je 0x4032ec
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4032f0
add eax, 2
add ecx, 2
test dl, dl
jne 0x4032d0
xor eax, eax
jmp 0x4032f5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40330c
mov eax, str.IoT
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00419df9
mov esp, ebp
pop ebp
ret
mov ecx, str.Enterprise
lea eax, [ebp - 0x108]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x403337
test dl, dl
je 0x403333
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x403337
add eax, 2
add ecx, 2
test dl, dl
jne 0x403317
xor eax, eax
jmp 0x40333c
sbb eax, eax
or eax, 1
test eax, eax
je 0x403614
mov ecx, str.ProfessionalEducation
lea eax, [ebp - 0x108]
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x403370
test dl, dl
je 0x40336c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x403370
add eax, 2
add ecx, 2
test dl, dl
jne 0x403350
xor eax, eax
jmp 0x403375
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40338c
mov eax, 0x4493bc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00419df9
mov esp, ebp
pop ebp
ret
mov ecx, str.Education
lea eax, [ebp - 0x108]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4033b7
test dl, dl
je 0x4033b3
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4033b7
add eax, 2
add ecx, 2
test dl, dl
jne 0x403397
xor eax, eax
jmp 0x4033bc
sbb eax, eax
or eax, 1
test eax, eax
je 0x403601
mov ecx, str.ProfessionalSingleLanguage
lea eax, [ebp - 0x108]
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4033f0
test dl, dl
je 0x4033ec
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4033f0
add eax, 2
add ecx, 2
test dl, dl
jne 0x4033d0
xor eax, eax
jmp 0x4033f5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40340c
mov eax, 0x4493f8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00419df9
mov esp, ebp
pop ebp
ret
mov ecx, str.ProfessionalWorkstation
lea eax, [ebp - 0x108]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x403437
test dl, dl
je 0x403433
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x403437
add eax, 2
add ecx, 2
test dl, dl
jne 0x403417
xor eax, eax
jmp 0x40343c
sbb eax, eax
or eax, 1
test eax, eax
jne 0x403453
mov eax, 0x449420
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00419df9
mov esp, ebp
pop ebp
ret
mov ecx, str.ServerRdsh
lea eax, [ebp - 0x108]
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x403480
test dl, dl
je 0x40347c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x403480
add eax, 2
add ecx, 2
test dl, dl
jne 0x403460
xor eax, eax
jmp 0x403485
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40349c
mov eax, 0x44943c
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00419df9
mov esp, ebp
pop ebp
ret
mov ecx, str.EnterpriseG
lea eax, [ebp - 0x108]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4034c7
test dl, dl
je 0x4034c3
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4034c7
add eax, 2
add ecx, 2
test dl, dl
jne 0x4034a7
xor eax, eax
jmp 0x4034cc
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4034e3
mov eax, 0x449460
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00419df9
mov esp, ebp
pop ebp
ret
mov ecx, str.CoreCountrySpecific
lea eax, [ebp - 0x108]
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x403510
test dl, dl
je 0x40350c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x403510
add eax, 2
add ecx, 2
test dl, dl
jne 0x4034f0
xor eax, eax
jmp 0x403515
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40352c
mov eax, 0x44947c
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00419df9
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x108]
push str.Ultimate
push eax
call fcn.0041c040
add esp, 8
test eax, eax
je 0x403557
mov eax, 0x449494
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00419df9
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x108]
push str.Professional
push eax
call fcn.0041c040
add esp, 8
test eax, eax
jne 0x403627
lea eax, [ebp - 0x108]
push str.Home
push eax
call fcn.0041c040
add esp, 8
test eax, eax
je 0x40359e
mov eax, 0x4494a4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00419df9
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x108]
push str.Education
push eax
call fcn.0041c040
add esp, 8
test eax, eax
jne 0x403601
lea eax, [ebp - 0x108]
push str.Enterprise
push eax
call fcn.0041c040
add esp, 8
test eax, eax
jne 0x403614
lea eax, [ebp - 0x108]
push str.Starter
push eax
call fcn.0041c040
add esp, 8
mov ecx, 0x4494b4
test eax, eax
mov edx, 0x4494bc
cmove ecx, edx
mov eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00419df9
mov esp, ebp
pop ebp
ret
mov eax, 0x4493d4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00419df9
mov esp, ebp
pop ebp
ret
mov eax, 0x44939c
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00419df9
mov esp, ebp
pop ebp
ret
mov eax, 0x44936c
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00419df9
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00419df9
mov esp, ebp
pop ebp
ret