So I tested this payload on Windows XP, and it's not working for me.  I inspected the crash, and then I noticed it's crashing out at this particular instruction.  Here's my log of the crash:

	0:000> u . L10
	00350104 58              pop     eax
	00350105 5a              pop     edx
	00350106 52              push    edx
	00350107 50              push    eax
	00350108 52              push    edx
	00350109 6a00            push    0
	0035010b 6a00            push    0
	0035010d 8b00            mov     eax,dword ptr [eax]
	0035010f 50              push    eax
	00350110 89da            mov     edx,ebx
	00350112 81c286550000    add     edx,5586h
	00350118 ffd2            call    edx
	0035011a bf00817e5e      mov     edi,5E7E8100h
	0035011f 58              pop     eax
	00350120 5a              pop     edx
	00350121 59              pop     ecx
	0:000> bp 00350118
	0:000> g
	Breakpoint 3 hit
	eax=00332704 ebx=5e0c0000 ecx=5e0c557a edx=5e0c5586 esi=00406005 edi=02420000
	eip=00350118 esp=0012ff80 ebp=00350006 iopl=0         nv up ei pl nz na po nc
	cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000202
	00350118 ffd2            call    edx {pstorec!PStoreEnumProviders+0x4 (5e0c5586)}
	0:000> t
	eax=00332704 ebx=5e0c0000 ecx=5e0c557a edx=5e0c5586 esi=00406005 edi=02420000
	eip=5e0c5586 esp=0012ff7c ebp=00350006 iopl=0         nv up ei pl nz na po nc
	cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000202
	pstorec!PStoreEnumProviders+0x4:
	5e0c5586 180c5e          sbb     byte ptr [esi+ebx*2],cl    ds:0023:bc586005=??

As you can see, the CALL EDX instruction is jumping to some location that doesn't look like EnumTypes(). However, the base address is still correct (EBX).  It appears that the offset calculation is incorrect for some reason:

	add edx, 0x00005586

I notice the payload is also crashing on mubix's test box.  Not sure if the issue is related to this.