Function at 0x43e375
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x214
and byte [esp + 0xc], 0
push ebx
push ebp
push esi
push edi
push 0x40
pop ecx
xor eax, eax
lea edi, [esp + 0x1d]
and byte [esp + 0x120], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x40
xor eax, eax
pop ecx
lea edi, [esp + 0x121]
rep stosd dword es:[edi], eax
cmp dword [esp + 0x22c], 0
mov dword [esp + 0x14], 1
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, 0x104
mov ebx, SysReAllocStringLen
mov dword [esp + 0x10], edi
je 0x43e499
push 0x40e57c
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
mov esi, 0x45fc38
mov ebp, 0x40e558
push esi
push ebp
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueA]
push 0xc
push 0x40e548
push 1
push esi
push ebp
mov ebp, dword [sym.imp.SHLWAPI.dll_SHSetValueA]
push reloc.OLEAUT32.dll_SysReAllocString
call ebp
cmp dword [0x4755d0], 0
je 0x43e521
call fcn.0043e05a
test eax, eax
jne 0x43e521
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x1c]
push eax
push esi
push 0x40b050
push ebx
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x43e46e
lea edi, [esp + 0x1c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x1c]
push ecx
push eax
push 1
push 0x40b08c
push 0x40b050
push ebx
call ebp
mov edi, 0x104
lea eax, [esp + 0x120]
push edi
push eax
push dword [0x534a50]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x1c]
push edi
push eax
lea eax, [esp + 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
jmp 0x43e502
lea eax, [esp + 0x1c]
push edi
push eax
call fcn.0043e1cb
pop ecx
mov esi, 0x45fc38
pop ecx
mov ebp, 0x40e558
push esi
push ebp
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueA]
push 0xc
push 0x40e538
push 1
push esi
push ebp
mov ebp, dword [sym.imp.SHLWAPI.dll_SHSetValueA]
push reloc.OLEAUT32.dll_SysReAllocString
call ebp
call fcn.0043e05a
test eax, eax
je 0x43e521
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x1c]
push eax
push 0x40b08c
push 0x40b050
push ebx
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x43e521
lea edi, [esp + 0x1c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x1c]
push ecx
push eax
push 1
push esi
push 0x40b050
push ebx
call ebp
mov edi, 0x40e52c
push 8
push edi
push 1
push esi
push 0x40e524
push ebx
call ebp
push 8
push edi
push 1
push esi
push 0x40a7bc
push ebx
call ebp
push 8
push edi
push 1
push esi
push 0x40e51c
push ebx
call ebp
push 8
push edi
push 1
push esi
push 0x40e514
push ebx
call ebp
push 4
push 0x40a7e0
push 1
push esi
push 0x40e504
push ebx
call ebp
push dword [esp + 0x230]
mov edi, dword [esp + 0x230]
push edi
push 0x40e504
call fcn.0043e20f
add esp, 0xc
push 0x10
push 0x40aa54
push 1
push esi
push 0x40e4fc
push ebx
call ebp
push dword [esp + 0x230]
push edi
push 0x40e4e4
call fcn.0043e20f
add esp, 0xc
push 9
push 0x40e4d8
push 1
push esi
push 0x40e4d0
push ebx
call ebp
push 9
push 0x40e4d8
push 1
push esi
push 0x40e4c8
push ebx
call ebp
mov esi, dword [esp + 0x230]
push esi
push edi
push 0x40e4b8
call fcn.0043e20f
push esi
push edi
push 0x40e4ac
call fcn.0043e20f
push esi
push edi
push 0x40e4a0
call fcn.0043e20f
push esi
push edi
push 0x40e494
call fcn.0043e20f
add esp, 0x30
lea eax, [esp + 0x18]
xor esi, esi
push eax
push 0xa
push 2
push 0x40e470
push esi
push 0x1a
push 0xffff
call dword [sym.imp.USER32.dll_SendMessageTimeoutA]
cmp edi, esi
je 0x43e63f
cmp dword [0x4755d0], esi
je 0x43e646
push 1
jmp 0x43e640
push esi
call fcn.0043f801
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x214
ret