Function at 0x43fe80
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
mov eax, dword [0x5c24ac]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x244], ecx
mov dword [ebp - 0x230], str.ZipNew.data
xor eax, eax
mov word [ebp - 0x20c], ax
push 0x206
push 0
lea ecx, [ebp - 0x20a]
push ecx
call fcn.00485370
add esp, 0xc
call fcn.00419670
mov ecx, eax
call fcn.0046cb19
push eax
lea edx, [ebp - 0x20c]
push edx
call fcn.0048dcd9
add esp, 8
lea eax, [ebp - 0x20c]
push eax
call fcn.00488e51
add esp, 4
mov dword [ebp - 0x238], eax
mov ecx, dword [ebp - 0x238]
movzx edx, word [ebp + ecx*2 - 0x20e]
cmp edx, 0x5c
je 0x43ff19
mov eax, 0x5c
mov ecx, dword [ebp - 0x238]
mov word [ebp + ecx*2 - 0x20c], ax
push str..zip
mov edx, dword [ebp + 0xc]
push edx
call fcn.0048efc8
add esp, 8
test eax, eax
jne 0x43ff3a
mov dword [ebp - 0x230], 0x563e0c
jmp 0x43ff59
push 0x563e24
mov eax, dword [ebp + 0xc]
push eax
call fcn.0048efc8
add esp, 8
test eax, eax
jne 0x43ff59
mov dword [ebp - 0x230], str.7zNew.data
mov ecx, dword [ebp - 0x230]
push ecx
lea edx, [ebp - 0x20c]
push edx
call fcn.0048ee96
add esp, 8
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x228], 1
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x210], 0
mov dword [ebp - 0x234], str.ShellNew
lea eax, [ebp - 0x22c]
push eax
push 0xf003f
push 0
mov ecx, dword [ebp + 0xc]
push ecx
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
je 0x43ffec
mov eax, dword [ebp - 0x220]
jmp 0x4403c8
movzx edx, byte [ebp + 8]
test edx, edx
je 0x44023a
lea eax, [ebp - 0x210]
push eax
push 0xf003f
push 0
mov ecx, dword [ebp - 0x234]
push ecx
mov edx, dword [ebp - 0x22c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
jne 0x4401a3
mov dword [ebp - 0x214], 0
lea eax, [ebp - 0x21c]
push eax
push 0
lea ecx, [ebp - 0x228]
push ecx
push 0x563e58
push 0x563e6c
mov edx, dword [ebp - 0x210]
push edx
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 0
jne 0x4400d0
mov eax, dword [ebp - 0x21c]
push eax
call fcn.0048dd00
add esp, 4
mov dword [ebp - 0x214], eax
mov ecx, dword [ebp - 0x21c]
push ecx
push 0
mov edx, dword [ebp - 0x214]
push edx
call fcn.00485370
add esp, 0xc
mov dword [ebp - 0x228], 1
lea eax, [ebp - 0x21c]
push eax
mov ecx, dword [ebp - 0x214]
push ecx
lea edx, [ebp - 0x228]
push edx
push 0x563e70
push 0x563e84
mov eax, dword [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp dword [ebp - 0x214], 0
je 0x44013a
mov ecx, dword [ebp - 0x214]
push ecx
call fcn.00488e51
add esp, 4
test eax, eax
jbe 0x44013a
lea edx, [ebp - 0x20c]
push edx
mov eax, dword [ebp - 0x214]
push eax
call fcn.0048efc8
add esp, 8
test eax, eax
je 0x44013a
mov ecx, dword [ebp - 0x214]
push ecx
call fcn.00488e51
add esp, 4
lea edx, [eax + eax + 2]
push edx
mov eax, dword [ebp - 0x214]
push eax
push 1
push 0x563e88
push 0x563ea4
mov ecx, dword [ebp - 0x210]
push ecx
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea edx, [ebp - 0x20c]
push edx
call fcn.00488e51
add esp, 4
lea eax, [eax + eax + 2]
push eax
lea ecx, [ebp - 0x20c]
push ecx
push 1
push 0x563ea8
push 0x563ebc
mov edx, dword [ebp - 0x210]
push edx
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
cmp dword [ebp - 0x214], 0
je 0x44019e
mov eax, dword [ebp - 0x214]
mov dword [ebp - 0x23c], eax
push 2
mov ecx, dword [ebp - 0x23c]
push ecx
call fcn.00464e87
add esp, 8
mov dword [ebp - 0x214], 0
jmp 0x440228
push 0
lea edx, [ebp - 0x210]
push edx
push 0
push 0xf003f
push 0
push 0
push 0
mov eax, dword [ebp - 0x234]
push eax
mov ecx, dword [ebp - 0x22c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 0
je 0x4401f4
mov edx, dword [ebp - 0x22c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x224]
jmp 0x4403c8
lea eax, [ebp - 0x20c]
push eax
call fcn.00488e51
add esp, 4
lea ecx, [eax + eax + 2]
push ecx
lea edx, [ebp - 0x20c]
push edx
push 1
push 0x563ec0
push 0x563ed4
mov eax, dword [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ecx, dword [ebp - 0x210]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4403b9
lea edx, [ebp - 0x210]
push edx
push 0xf003f
push 0
mov eax, dword [ebp - 0x234]
push eax
mov ecx, dword [ebp - 0x22c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
jne 0x4403b9
mov dword [ebp - 0x218], 0
lea edx, [ebp - 0x21c]
push edx
push 0
lea eax, [ebp - 0x228]
push eax
push 0x563ed8
push 0x563ef4
mov ecx, dword [ebp - 0x210]
push ecx
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 0
jne 0x440312
mov edx, dword [ebp - 0x21c]
push edx
call fcn.0048dd00
add esp, 4
mov dword [ebp - 0x218], eax
mov eax, dword [ebp - 0x21c]
push eax
push 0
mov ecx, dword [ebp - 0x218]
push ecx
call fcn.00485370
add esp, 0xc
mov dword [ebp - 0x228], 1
lea edx, [ebp - 0x21c]
push edx
mov eax, dword [ebp - 0x218]
push eax
lea ecx, [ebp - 0x228]
push ecx
push str.FileName.old
push 0x563f14
mov edx, dword [ebp - 0x210]
push edx
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp dword [ebp - 0x218], 0
je 0x44037c
mov eax, dword [ebp - 0x218]
push eax
call fcn.00488e51
add esp, 4
test eax, eax
jbe 0x44037c
lea ecx, [ebp - 0x20c]
push ecx
mov edx, dword [ebp - 0x218]
push edx
call fcn.0048efc8
add esp, 8
test eax, eax
je 0x44037c
mov eax, dword [ebp - 0x218]
push eax
call fcn.00488e51
add esp, 4
lea ecx, [eax + eax + 2]
push ecx
mov edx, dword [ebp - 0x218]
push edx
push 1
push str.FileName
push 0x563f2c
mov eax, dword [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ecx, dword [ebp - 0x210]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x218], 0
je 0x4403b9
mov edx, dword [ebp - 0x218]
mov dword [ebp - 0x240], edx
push 2
mov eax, dword [ebp - 0x240]
push eax
call fcn.00464e87
add esp, 8
mov dword [ebp - 0x218], 0
mov ecx, dword [ebp - 0x22c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00464e95
mov esp, ebp
pop ebp
ret 8