Function at 0x422f58
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf4
push 0x482324
lea ecx, [ebp - 0x20]
call fcn.0041eb84
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x20]
dec eax
push eax
call fcn.0041f608
cmp al, 0x5c
je 0x422f89
push 0x5c
lea ecx, [ebp - 0x20]
call fcn.0041ed24
push ebx
push esi
xor esi, esi
push edi
push esi
push str.Microsoft.NETFramework_
lea ecx, [ebp - 0x20]
call fcn.0041ed73
and byte [ebp - 0xc], 0
and byte [ebp - 0xd], 0
and byte [ebp - 0xa], 0
and byte [ebp - 9], 0
and byte [ebp - 0xb], 0
lea eax, [ebp - 8]
mov edi, 0x20019
push eax
push edi
push esi
mov ebx, 0x80000002
mov dword [ebp - 8], esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.SOFTWAREMicrosoft.NETFrameworkPolicy_v1.0
push ebx
call esi
test eax, eax
jne 0x423023
and byte [ebp - 0xf4], al
push 0x31
pop ecx
lea edi, [ebp - 0xf3]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 4]
mov dword [ebp - 4], 0xc8
push eax
lea eax, [ebp - 0xf4]
push eax
push 0
push 0
push str.3705
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x423015
mov byte [ebp - 0xb], 1
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, 0x20019
lea eax, [ebp - 8]
push eax
push edi
push 0
push str.SOFTWAREMicrosoftNET_Framework_SetupNDP_v1.1.4322
push ebx
call esi
test eax, eax
jne 0x42306e
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], eax
push ecx
lea ecx, [ebp - 4]
push ecx
push eax
push eax
push str.Install
push dword [ebp - 8]
mov dword [ebp - 0x14], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x423065
cmp dword [ebp - 4], eax
je 0x423065
mov byte [ebp - 9], 1
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 8]
push eax
push edi
push 0
push str.SOFTWAREMicrosoftNET_Framework_SetupNDP_v2.0.50727
push ebx
call esi
test eax, eax
jne 0x4230b9
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], eax
push ecx
lea ecx, [ebp - 4]
push ecx
push eax
push eax
push str.Install
push dword [ebp - 8]
mov dword [ebp - 0x14], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4230b0
cmp dword [ebp - 4], eax
je 0x4230b0
mov byte [ebp - 0xa], 1
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 8]
push eax
push edi
push 0
push str.SOFTWAREMicrosoftNET_Framework_SetupNDP_v3.0Setup
push ebx
call esi
test eax, eax
jne 0x423104
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], eax
push ecx
lea ecx, [ebp - 4]
push ecx
push eax
push eax
push str.InstallSuccess
push dword [ebp - 8]
mov dword [ebp - 0x14], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4230fb
cmp dword [ebp - 4], eax
je 0x4230fb
mov byte [ebp - 0xd], 1
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 8]
push eax
push edi
xor edi, edi
push edi
push str.SOFTWAREMicrosoftNET_Framework_SetupNDP_v3.5
push ebx
call esi
test eax, eax
jne 0x423150
lea eax, [ebp - 0x14]
mov dword [ebp - 4], edi
push eax
lea eax, [ebp - 4]
push eax
push edi
push edi
push str.Install
push dword [ebp - 8]
mov dword [ebp - 0x14], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x423147
cmp dword [ebp - 4], edi
je 0x423147
mov byte [ebp - 0xc], 1
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x2c]
call fcn.0041eab0
or dword [ebp - 4], 0xffffffff
cmp byte [ebp - 0xb], 0
mov ebx, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
je 0x423190
push str.v1.0.3705
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], edi
call fcn.0041ebfd
push eax
lea ecx, [ebp - 0x2c]
call fcn.0041ecc1
cmp esi, edi
je 0x423190
cmp ebx, edi
je 0x423190
cmp dword [esi], edi
jne 0x423190
mov byte [ebx], 1
cmp byte [ebp - 9], 0
je 0x4231c3
push str.v1.1.4322
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 1
call fcn.0041ebfd
push eax
lea ecx, [ebp - 0x2c]
call fcn.0041ecc1
cmp esi, edi
je 0x4231c3
cmp ebx, edi
je 0x4231c3
cmp dword [esi], 1
jne 0x4231c3
mov byte [ebx], 1
cmp byte [ebp - 0xa], 0
je 0x4231f6
push str.v2.0.50727
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 2
call fcn.0041ebfd
push eax
lea ecx, [ebp - 0x2c]
call fcn.0041ecc1
cmp esi, edi
je 0x4231f6
cmp ebx, edi
je 0x4231f6
cmp dword [esi], 2
jne 0x4231f6
mov byte [ebx], 1
cmp byte [ebp - 0xd], 0
je 0x423229
push str.v3.0
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 3
call fcn.0041ebfd
push eax
lea ecx, [ebp - 0x2c]
call fcn.0041ecc1
cmp esi, edi
je 0x423229
cmp ebx, edi
je 0x423229
cmp dword [esi], 3
jne 0x423229
mov byte [ebx], 1
cmp byte [ebp - 0xc], 0
je 0x42325c
push str.v3.5
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 4
call fcn.0041ebfd
push eax
lea ecx, [ebp - 0x2c]
call fcn.0041ecc1
cmp esi, edi
je 0x42325c
cmp ebx, edi
je 0x42325c
cmp dword [esi], 4
jne 0x42325c
mov byte [ebx], 1
mov ecx, dword [ebp + 8]
cmp ecx, edi
pop edi
pop esi
pop ebx
je 0x42326f
lea eax, [ebp - 0x2c]
push eax
call fcn.0041ecc1
lea ecx, [ebp - 0x2c]
call fcn.0041ebe6
lea ecx, [ebp - 0x20]
call fcn.0041ebe6
mov eax, dword [ebp - 4]
leave
ret