Function at 0x62254890
Capabilities:
Query or enumerate registry value

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x468
mov eax, dword [ecx + 0xc]
mov ebx, dword [ecx]
mov esi, dword [ecx + 4]
mov edi, dword [ecx + 8]
mov dword [ebp - 0x43c], eax
test byte [0x62258194], 8
jne 0x62254a70
test ebx, ebx
je 0x62254b3e
mov edx, dword [ebp - 0x43c]
test edx, edx
je 0x62254b3e
lea eax, [ebp - 0x220]
mov dword [esp + 0xc], 0x20019
lea edi, [ebp - 0x428]
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWAREMicrosoft.NETFramework_
mov dword [esp], 0x80000002
call dword [sym.imp.advapi32.dll_RegOpenKeyExW]
sub esp, 0x14
test eax, eax
je 0x62254978
test byte [0x62258194], 2
jne 0x62254ac0
xor eax, eax
mov edx, edi
mov word [ebp - 0x428], ax
xor eax, eax
lea esi, [esi]
movzx ecx, word [ebx + eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x62254938
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_LoadLibraryW]
mov esi, dword [ebp - 0x43c]
sub esp, 4
cmp eax, 1
mov dword [esi], eax
sbb eax, eax
and eax, 0x80070006
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
lea eax, [ebp - 0x42c]
lea edi, [ebp - 0x428]
mov dword [ebp - 0x42c], 0x208
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x220]
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.InstallRoot
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
sub esp, 0x18
test eax, eax
mov eax, dword [ebp - 0x220]
mov dword [esp], eax
jne 0x62254af8
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
test esi, esi
je 0x62254b06
cmp word [ebp - 0x428], 0
mov edx, edi
je 0x622549f9
nop
add edx, 2
cmp word [edx], 0
jne 0x622549f0
xor eax, eax
lea esi, [esi]
nop
movzx ecx, word [esi + eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x62254a00
cmp word [ebp - 0x428], 0
mov edx, edi
je 0x62254a29
lea esi, [esi]
add edx, 2
cmp word [edx], 0
jne 0x62254a20
xor eax, eax
lea esi, [esi]
nop
movzx ecx, word [eax + 0x6225e384]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x62254a30
cmp word [ebp - 0x428], 0
mov edx, edi
je 0x6225492f
lea esi, [esi]
nop
add edx, 2
cmp word [edx], 0
jne 0x62254a58
jmp 0x6225492f
mov eax, ebx
call fcn.62252550
mov ecx, dword [ebp - 0x43c]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x20], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.__p__s___p___p___p__n
mov dword [esp + 8], str.LoadLibraryShim
mov dword [esp + 4], 0x62258194
mov dword [esp], 3
call fcn.62252a40
jmp 0x622548c5
mov dword [esp + 0xc], str.error_reading_registry_key_for_installroot_n
mov dword [esp + 8], str.LoadLibraryShim
mov dword [esp + 4], 0x62258194
mov dword [esp], 1
call fcn.62252a40
xor eax, eax
mov edx, edi
mov word [ebp - 0x428], ax
jmp 0x6225492f
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
jmp 0x62254917
lea eax, [ebp - 0x42c]
mov dword [esp + 4], 0x104
mov esi, 0x6225e388
mov dword [esp + 8], eax
lea eax, [ebp - 0x220]
mov dword [esp], eax
call sym.mscoree.dll_GetCORVersion
sub esp, 0xc
test eax, eax
lea eax, [ebp - 0x220]
cmovns esi, eax
jmp 0x622549e2
mov eax, 0x80004003
jmp 0x62254966