Function at 0x43a460
Capabilities:
Create thread
Set registry value

Disassembly:
sub esp, 0x21c
mov eax, dword [0x4c4004]
xor eax, esp
mov dword [esp + 0x214], eax
mov edx, 0x4b10dc
mov ecx, 0x4ae480
call fcn.004773a0
push eax
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [esp + 8]
mov edx, 0x4b10e4
push 0x24
push eax
mov ecx, 0x4ae480
call fcn.004773a0
push eax
push dword [0x4def88]
call dword [sym.imp.user32.dll_MessageBoxW]
cmp eax, 6
je 0x43a4ce
xor eax, eax
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.0048d815
add esp, 0x21c
ret
call fcn.00475f50
mov eax, dword [0x4d2c80]
cmp eax, 0x2999
jg 0x43a59b
je 0x43a591
sub eax, 0x2828
cmp eax, 0x27
ja case.0x43a5b0.10703
movzx eax, byte [eax + 0x43a774]
jmp dword [eax*4 + 0x43a734]
call fcn.00440160
jmp case.0x43a5b0.10703
call fcn.00440520
jmp case.0x43a5b0.10703
call fcn.00440a80
jmp case.0x43a5b0.10703
call fcn.00440fd0
jmp case.0x43a5b0.10703
call fcn.00441470
jmp case.0x43a5b0.10703
call fcn.00441800
jmp case.0x43a5b0.10703
call fcn.00441ac0
jmp case.0x43a5b0.10703
call fcn.00441e50
jmp case.0x43a5b0.10703
call fcn.00442600
jmp case.0x43a5b0.10703
call fcn.00442980
jmp case.0x43a5b0.10703
call fcn.00442d20
jmp case.0x43a5b0.10703
call fcn.004430a0
jmp case.0x43a5b0.10703
call fcn.00443310
jmp case.0x43a5b0.10703
call fcn.0043a830
jmp case.0x43a5b0.10703
call fcn.004397b0
jmp case.0x43a5b0.10703
sub eax, 0x29ce
cmp eax, 0x66
ja case.0x43a5b0.10703
movzx eax, byte [eax + 0x43a7bc]
jmp dword [eax*4 + 0x43a79c]
call fcn.00479af0
jmp case.0x43a5b0.10703
call fcn.00443ec0
jmp case.0x43a5b0.10703
lea eax, [esp + 4]
push eax
push 0
push 0
push 0x444210
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
jmp case.0x43a5b0.10703
push 0
lea eax, [esp + 4]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push 0x4b32c0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x43a656
push eax
push eax
push 0xf0
push 0x2a05
push dword [0x4def88]
call dword [sym.imp.user32.dll_GetDlgItem]
push eax
call dword [sym.imp.user32.dll_SendMessageW]
push 4
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
push 4
push 0
push 0x4b331c
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
lea eax, [esp + 4]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push 0x4b3348
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne case.0x43a5b0.10703
push eax
push eax
push 0xf0
push 0x2a06
push dword [0x4def88]
call dword [sym.imp.user32.dll_GetDlgItem]
push eax
call dword [sym.imp.user32.dll_SendMessageW]
push 4
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
push 4
push 0
push 0x4b33a4
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp case.0x43a5b0.10703
call fcn.00442220
jmp case.0x43a5b0.10703
call fcn.00447f60
jmp case.0x43a5b0.10703
call fcn.004485f0
mov edx, 0x4b10ec
mov ecx, 0x4ae480
call fcn.004773a0
push eax
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [esp + 8]
mov edx, 0x4b10f4
push 0x30
push eax
mov ecx, 0x4ae480
call fcn.004773a0
push eax
push dword [0x4def88]
call dword [sym.imp.user32.dll_MessageBoxW]
mov ecx, dword [esp + 0x214]
mov eax, 1
xor ecx, esp
call fcn.0048d815
add esp, 0x21c
ret