Function at 0x4105f8
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xa1c
mov eax, 0x456c80
call fcn.0043ccad
xor ebx, ebx
mov dword [ebp - 0xa20], 0x467a1c
mov dword [ebp - 0xa1c], ebx
lea ecx, [ebp - 0xa20]
mov dword [ebp - 4], ebx
call fcn.0040423b
lea eax, [ebp - 0xa1c]
push eax
push 0x20119
push ebx
push str.SYSTEMCurrentControlSetControlProductOptions
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
js 0x410889
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0xa24]
push eax
lea eax, [ebp - 0x218]
mov dword [ebp - 0xa24], 0x208
push eax
push ebx
push ebx
push str.ProductType
push dword [ebp - 0xa1c]
call esi
push 2
pop edi
test eax, eax
jne 0x4106cd
mov edx, str.WinNT
lea ecx, [ebp - 0x218]
call fcn.00411356
test eax, eax
jne 0x41069f
inc eax
mov word [0x47a150], ax
mov al, bl
jmp 0x4106c8
mov edx, str.ServerNT
lea ecx, [ebp - 0x218]
call fcn.00411356
test eax, eax
jne 0x4106be
push 3
pop eax
mov word [0x47a150], ax
jmp 0x4106c5
mov word [0x47a150], di
xor eax, eax
inc eax
mov byte [0x47a154], al
mov eax, 0x800
mov dword [ebp - 0xa28], eax
lea eax, [ebp - 0xa28]
push eax
lea eax, [ebp - 0xa18]
push eax
push ebx
push ebx
push str.ProductSuite
push dword [ebp - 0xa1c]
call esi
test eax, eax
jne 0x410889
lea edi, [ebp - 0xa18]
mov ecx, edi
call fcn.00406043
mov ebx, eax
test ebx, ebx
je 0x410889
mov si, word [0x47a152]
mov edx, str.Small_Business
mov ecx, edi
call fcn.00411356
test eax, eax
jne 0x410731
inc eax
jmp 0x410868
mov edx, str.Enterprise
mov ecx, edi
call fcn.00411356
test eax, eax
jne 0x410749
push 2
pop eax
jmp 0x410868
mov edx, str.BackOffice
mov ecx, edi
call fcn.00411356
test eax, eax
jne 0x410762
or si, 4
jmp 0x41086b
mov edx, str.CommunicationServer
mov ecx, edi
call fcn.00411356
test eax, eax
jne 0x41077b
or si, 8
jmp 0x41086b
mov edx, str.Terminal_Server
mov ecx, edi
call fcn.00411356
test eax, eax
jne 0x410794
or si, 0x10
jmp 0x41086b
mov edx, str.Small_Business_Restricted_
mov ecx, edi
call fcn.00411356
test eax, eax
jne 0x4107ad
or si, 0x20
jmp 0x41086b
mov edx, str.EmbeddedNT
mov ecx, edi
call fcn.00411356
test eax, eax
jne 0x4107c6
or si, 0x40
jmp 0x41086b
mov edx, str.DataCenter
mov ecx, edi
call fcn.00411356
test eax, eax
jne 0x4107e0
mov eax, 0x80
jmp 0x410868
mov edx, str.Personal
mov ecx, edi
call fcn.00411356
test eax, eax
jne 0x4107f7
mov eax, 0x200
jmp 0x410868
mov edx, str.Blade
mov ecx, edi
call fcn.00411356
test eax, eax
jne 0x41080e
mov eax, 0x400
jmp 0x410868
mov edx, str.Embedded_Restricted_
mov ecx, edi
call fcn.00411356
test eax, eax
jne 0x410825
mov eax, 0x800
jmp 0x410868
mov edx, str.Security_Appliance
mov ecx, edi
call fcn.00411356
test eax, eax
jne 0x41083c
mov eax, 0x1000
jmp 0x410868
mov edx, str.Storage_Server
mov ecx, edi
call fcn.00411356
test eax, eax
jne 0x410853
mov eax, 0x2000
jmp 0x410868
mov edx, str.Compute_Server
mov ecx, edi
call fcn.00411356
test eax, eax
jne 0x410872
mov eax, 0x4000
or si, ax
mov word [0x47a152], si
lea edi, [edi + ebx*2]
add edi, 2
mov ecx, edi
call fcn.00406043
mov ebx, eax
test ebx, ebx
jne 0x41071b
lea ecx, [ebp - 0xa20]
mov dword [ebp - 0xa20], 0x467a1c
call fcn.0040423b
call fcn.0043cc57
ret