Function at 0x43d5db
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push ecx
mov ebx, edx
mov dword [ebp - 0xc], ecx
push 0
push 0x48f4a4
mov ecx, ebx
mov dword [ebp - 0x18], ebx
call fcn.0043a719
push ecx
push 0
push str.NewKey
mov ecx, ebx
mov esi, eax
call fcn.0043a719
mov dword [ebp - 0x14], eax
test esi, esi
je 0x43d820
test eax, eax
je 0x43d820
mov ecx, dword [esi + 4]
test ecx, ecx
jne 0x43d62b
mov ecx, 0x491414
push 0x5c
push ecx
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov edi, eax
test edi, edi
je 0x43d820
mov edx, dword [ebp - 0xc]
mov eax, 0x20019
mov dword [ebp - 0x10], eax
cmp dword [edx + 0x10], 0
je 0x43d68d
push ecx
push 5
push str.Wow64
mov ecx, ebx
call fcn.0043a719
test eax, eax
je 0x43d688
mov eax, dword [eax + 4]
test eax, eax
jne 0x43d66e
mov eax, 0x491414
push 0x48f7a0
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
jne 0x43d688
mov eax, 0x20219
mov dword [ebp - 0x10], eax
jmp 0x43d68d
mov eax, 0x20019
and dword [ebp - 4], 0
mov ecx, dword [esi + 4]
mov edx, ecx
test ecx, ecx
jne 0x43d6a1
mov edx, 0x491414
mov ecx, edx
lea esi, [ebp - 4]
or eax, 0x10000
push esi
push eax
lea eax, [edi + 2]
sub edi, edx
sar edi, 1
push eax
mov edx, edi
call fcn.0041f0df
push eax
push dword [ebp - 0xc]
call sym.Dismx86.exe_DismRegOpenKeyEx
mov edi, eax
test edi, edi
jne 0x43d814
mov esi, dword [ebp - 0x14]
mov eax, dword [esi + 4]
test eax, eax
jne 0x43d6dc
mov eax, 0x491414
push 0x5c
push eax
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov edi, eax
test edi, edi
jne 0x43d6f5
mov edi, 0x80004005
jmp 0x43d814
and dword [ebp - 8], 0
mov ecx, dword [esi + 4]
mov eax, ecx
test ecx, ecx
jne 0x43d709
mov eax, 0x491414
mov ecx, eax
mov edx, edi
sub edx, eax
sar edx, 1
call fcn.0041f0df
mov edx, dword [ebp - 0xc]
lea ecx, [ebp - 8]
push 0
push ecx
mov ecx, dword [ebp - 0x10]
mov edx, dword [edx + 0x48]
or ecx, 0x20006
push ecx
lea ecx, [edi + 2]
push ecx
mov esi, dword [edx]
push eax
push edx
call dword [esi + 0x10]
mov edi, eax
test edi, edi
jne 0x43d80c
push ecx
push eax
push str.Value
mov ecx, ebx
call fcn.0043a719
mov ebx, eax
test ebx, ebx
je 0x43d7f1
push ecx
mov ecx, dword [ebp - 0x18]
push edi
push str.NewValue
call fcn.0043a719
mov dword [ebp - 0x18], eax
call fcn.0043c5cd
push eax
lea ecx, [ebp - 0x10]
call fcn.0043ac50
mov edx, dword [ebx + 4]
test edx, edx
jne 0x43d783
mov edx, 0x491414
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0044cf2f
mov esi, dword [ebp - 0x10]
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x43d7e7
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x43d7aa
mov eax, dword [eax + 4]
jmp 0x43d7ad
mov eax, dword [ebx + 4]
test eax, eax
jne 0x43d7b6
mov eax, 0x491414
push dword [esi - 0xc]
push esi
push dword [ebp - 0x14]
push 0
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
test edi, edi
jne 0x43d7e7
mov eax, dword [ebx + 4]
test eax, eax
jne 0x43d7db
mov eax, 0x491414
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edi, eax
lea ecx, [esi - 0x10]
call fcn.0043c924
jmp 0x43d80c
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 4]
call fcn.0044d10d
mov edi, eax
test edi, edi
jne 0x43d80c
mov ecx, dword [ebp - 4]
call fcn.0044d0e9
mov edi, eax
lea ecx, [ebp - 8]
call fcn.0043a910
lea ecx, [ebp - 4]
call fcn.0043a910
mov eax, edi
jmp 0x43d825
mov eax, 0x80004005
pop edi
pop esi
pop ebx
leave
ret