Function at 0x4225ff
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push 0x334
mov eax, 0x49ebac
call fcn.00481105
push 0x2e
pop edi
push 1
lea eax, [ebp - 0x314]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
lea eax, [ebp + 8]
mov byte [ebp - 0x30d], bl
mov dword [ebp - 0x314], edi
call fcn.004187c2
push eax
push ebx
lea eax, [ebp + 8]
push eax
lea esi, [ebp - 0x2f0]
call fcn.00403de2
push 1
lea eax, [ebp - 0x314]
push eax
mov byte [ebp - 4], 1
lea eax, [ebp + 8]
mov dword [ebp - 0x314], edi
call fcn.004187c2
push 0xffffffffffffffff
inc eax
push eax
lea eax, [ebp + 8]
push eax
lea esi, [ebp - 0x2d4]
call fcn.00403de2
push 1
lea eax, [ebp - 0x314]
push eax
mov byte [ebp - 4], 2
lea eax, [ebp + 8]
mov dword [ebp - 0x314], edi
call fcn.004187c2
push eax
mov eax, esi
push ebx
push eax
lea esi, [ebp - 0x280]
call fcn.00403de2
mov esi, eax
lea edi, [ebp - 0x2d4]
mov byte [ebp - 4], 3
call fcn.00401fff
xor edi, edi
push ebx
inc edi
push edi
lea ecx, [ebp - 0x280]
mov byte [ebp - 4], 2
call fcn.00402a5a
cmp dword [ebp - 0x2dc], 8
mov eax, dword [ebp - 0x2f0]
jae 0x4226d7
lea eax, [ebp - 0x2f0]
push eax
call fcn.0047a8f4
cmp dword [ebp - 0x2c0], 8
mov esi, eax
mov eax, dword [ebp - 0x2d4]
pop ecx
mov dword [ebp - 0x334], esi
jae 0x4226fb
lea eax, [ebp - 0x2d4]
push eax
call fcn.0047a8f4
add esi, 0xfffffffe
pop ecx
mov dword [ebp - 0x338], eax
cmp esi, 2
ja 0x422c81
xor eax, eax
push str.SoftwareMicrosoftNET_Framework_SetupNDP
lea ecx, [ebp - 0x2b8]
mov dword [ebp - 0x2a4], 7
mov dword [ebp - 0x2a8], ebx
mov word [ebp - 0x2b8], ax
call fcn.0040299a
mov byte [ebp - 4], 4
cmp dword [ebp - 0x2a4], 8
mov eax, dword [ebp - 0x2b8]
jae 0x422756
lea eax, [ebp - 0x2b8]
lea ecx, [ebp - 0x33c]
push ecx
push 0x20019
push ebx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x422c45
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x340]
push eax
push ebx
push ebx
lea eax, [ebp - 0x328]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x33c]
mov dword [ebp - 0x328], ebx
mov dword [ebp - 0x340], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x422c45
mov dword [ebp - 0x314], 0x100
mov dword [ebp - 0x320], ebx
cmp dword [ebp - 0x328], ebx
jbe 0x422c45
jmp 0x4227cf
xor edi, edi
inc edi
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x314]
push eax
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x320]
push dword [ebp - 0x33c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x422bd7
mov word [ebp - 0x29c], ax
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x29c]
mov dword [ebp - 0x288], 7
mov dword [ebp - 0x28c], ebx
call fcn.0040299a
push edi
lea eax, [ebp - 0x324]
push eax
mov byte [ebp - 4], 5
lea eax, [ebp - 0x29c]
mov dword [ebp - 0x324], 0x2e
call fcn.004187c2
dec eax
push eax
push edi
lea eax, [ebp - 0x29c]
push eax
lea esi, [ebp - 0x248]
call fcn.00403de2
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x238]
push 0x4bd640
mov ecx, esi
call fcn.00404866
test eax, eax
je 0x4228a7
mov eax, dword [ebp - 0x238]
xor edi, edi
push 0x4bf418
inc edi
mov ecx, esi
call fcn.00404866
test eax, eax
je 0x4228a7
mov eax, dword [ebp - 0x238]
push 0x4bf41c
mov ecx, esi
call fcn.00404866
test eax, eax
jne 0x422bb7
lea eax, [ebp - 0x264]
push 0x4bae2c
push eax
lea ebx, [ebp - 0x2b8]
call fcn.0040475c
lea ecx, [ebp - 0x29c]
push ecx
lea ecx, [ebp - 0x280]
push ecx
mov ecx, eax
mov byte [ebp - 4], 7
call fcn.0041141b
add esp, 0x10
xor ebx, ebx
xor edi, edi
push ebx
inc edi
push edi
lea ecx, [ebp - 0x264]
mov byte [ebp - 4], 9
call fcn.00402a5a
mov eax, dword [ebp - 0x238]
push 0x4bf41c
lea ecx, [ebp - 0x248]
call fcn.00404866
test eax, eax
jne 0x422941
lea eax, [ebp - 0x22c]
push 0x4bf420
push eax
lea ebx, [ebp - 0x280]
call fcn.0040475c
pop ecx
pop ecx
mov esi, eax
mov edi, ebx
mov byte [ebp - 4], 0xa
call fcn.00401fff
push 0
push 1
lea ecx, [ebp - 0x22c]
call fcn.00402a5a
xor ebx, ebx
cmp dword [ebp - 0x26c], 8
mov eax, dword [ebp - 0x280]
jae 0x422956
lea eax, [ebp - 0x280]
lea ecx, [ebp - 0x32c]
push ecx
push 0x20019
push ebx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x422ba7
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 4
pop esi
lea eax, [ebp - 0x31c]
push eax
lea eax, [ebp - 0x324]
push eax
lea eax, [ebp - 0x318]
push eax
push ebx
push str.Install
push dword [ebp - 0x32c]
mov dword [ebp - 0x318], ebx
mov dword [ebp - 0x324], ebx
mov dword [ebp - 0x31c], esi
call edi
test eax, eax
jne 0x422ba7
cmp dword [ebp - 0x318], esi
je 0x4229d2
cmp dword [ebp - 0x318], 5
jne 0x422ba7
cmp dword [ebp - 0x324], 1
jne 0x422ba7
xor eax, eax
mov dword [ebp - 0x318], ebx
mov dword [ebp - 0x31c], ebx
mov dword [ebp - 0x218], 7
mov dword [ebp - 0x21c], ebx
mov word [ebp - 0x22c], ax
lea eax, [ebp - 0x31c]
push eax
push ebx
lea eax, [ebp - 0x318]
push eax
push ebx
push str.Version
mov byte [ebp - 4], 0xb
push dword [ebp - 0x32c]
call edi
test eax, eax
jne 0x422b99
mov edi, dword [ebp - 0x31c]
cmp edi, dword [ebp - 0x21c]
ja 0x422a4b
push 0xffffffffffffffff
push edi
lea ecx, [ebp - 0x22c]
call fcn.00402660
jmp 0x422a5d
sub edi, dword [ebp - 0x21c]
push ebx
lea esi, [ebp - 0x22c]
call fcn.00404210
cmp dword [ebp - 0x218], 8
mov eax, dword [ebp - 0x22c]
jae 0x422a72
lea eax, [ebp - 0x22c]
lea ecx, [ebp - 0x31c]
push ecx
push eax
lea eax, [ebp - 0x318]
push eax
push ebx
push str.Version
push dword [ebp - 0x32c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x422b99
push 0x2e
pop edi
push 1
lea eax, [ebp - 0x330]
push eax
lea eax, [ebp - 0x22c]
mov dword [ebp - 0x330], edi
call fcn.004187c2
push 0xffffffffffffffff
inc eax
push eax
lea eax, [ebp - 0x22c]
push eax
lea esi, [ebp - 0x264]
call fcn.00403de2
push 1
lea eax, [ebp - 0x330]
push eax
mov byte [ebp - 4], 0xc
mov eax, esi
mov dword [ebp - 0x330], edi
call fcn.004187c2
push eax
mov eax, esi
push ebx
push eax
lea esi, [ebp - 0x30c]
call fcn.00403de2
mov esi, eax
lea edi, [ebp - 0x264]
mov byte [ebp - 4], 0xd
call fcn.00401fff
xor esi, esi
push ebx
inc esi
push esi
lea ecx, [ebp - 0x30c]
mov byte [ebp - 4], 0xc
call fcn.00402a5a
cmp dword [ebp - 0x234], 8
mov eax, dword [ebp - 0x248]
jae 0x422b32
lea eax, [ebp - 0x248]
push eax
call fcn.0047a8f4
cmp dword [ebp - 0x250], 8
mov edi, eax
mov eax, dword [ebp - 0x264]
pop ecx
jae 0x422b50
lea eax, [ebp - 0x264]
push eax
call fcn.0047a8f4
pop ecx
cmp edi, 4
jge 0x422b79
cmp dword [ebp - 0x334], edi
jl 0x422bfb
jne 0x422b76
cmp dword [ebp - 0x338], eax
jle 0x422bfb
cmp edi, 4
jne 0x422b8c
cmp dword [ebp - 0x334], 4
jne 0x422b8c
cmp dword [ebp - 0x338], eax
jle 0x422bfb
push ebx
push esi
lea ecx, [ebp - 0x264]
call fcn.00402a5a
push ebx
push 1
lea ecx, [ebp - 0x22c]
call fcn.00402a5a
push ebx
push 1
lea ecx, [ebp - 0x280]
call fcn.00402a5a
xor ebx, ebx
push ebx
push 1
lea ecx, [ebp - 0x248]
call fcn.00402a5a
push ebx
push 1
lea ecx, [ebp - 0x29c]
mov byte [ebp - 4], 4
call fcn.00402a5a
inc dword [ebp - 0x320]
mov eax, dword [ebp - 0x320]
mov dword [ebp - 0x314], 0x100
cmp eax, dword [ebp - 0x328]
jb 0x4227cc
jmp 0x422c45
push ebx
push esi
lea ecx, [ebp - 0x264]
mov byte [ebp - 0x30d], 1
call fcn.00402a5a
push ebx
push esi
lea ecx, [ebp - 0x22c]
call fcn.00402a5a
push ebx
push esi
lea ecx, [ebp - 0x280]
call fcn.00402a5a
push ebx
push esi
lea ecx, [ebp - 0x248]
call fcn.00402a5a
push ebx
push esi
lea ecx, [ebp - 0x29c]
call fcn.00402a5a
xor ebx, ebx
xor esi, esi
push ebx
inc esi
push esi
lea ecx, [ebp - 0x2b8]
call fcn.00402a5a
push ebx
push esi
lea ecx, [ebp - 0x2d4]
call fcn.00402a5a
push ebx
push esi
lea ecx, [ebp - 0x2f0]
call fcn.00402a5a
push ebx
push esi
lea ecx, [ebp + 8]
call fcn.00402a5a
mov al, byte [ebp - 0x30d]
jmp 0x422ca7
push ebx
push edi
lea ecx, [ebp - 0x2d4]
call fcn.00402a5a
push ebx
push edi
lea ecx, [ebp - 0x2f0]
call fcn.00402a5a
push ebx
push edi
lea ecx, [ebp + 8]
call fcn.00402a5a
xor al, al
call fcn.00481188
ret