Function at 0x43e5a0
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push ecx
mov ebx, edx
mov dword [ebp - 0xc], ecx
push 0
push 0x49156c
mov ecx, ebx
mov dword [ebp - 0x18], ebx
call fcn.0043b6e0
push ecx
push 0
push str.NewKey
mov ecx, ebx
mov esi, eax
call fcn.0043b6e0
mov dword [ebp - 0x14], eax
test esi, esi
je 0x43e7e1
test eax, eax
je 0x43e7e1
mov ecx, dword [esi + 4]
test ecx, ecx
jne 0x43e5f0
mov ecx, 0x4934ec
push 0x5c
push ecx
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov edi, eax
test edi, edi
je 0x43e7e1
mov edx, dword [ebp - 0xc]
mov eax, 0x20019
mov dword [ebp - 0x10], eax
cmp dword [edx + 0x10], 0
je 0x43e652
push ecx
push 5
push str.Wow64
mov ecx, ebx
call fcn.0043b6e0
test eax, eax
je 0x43e64d
mov eax, dword [eax + 4]
test eax, eax
jne 0x43e633
mov eax, 0x4934ec
push 0x491870
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
jne 0x43e64d
mov eax, 0x20219
mov dword [ebp - 0x10], eax
jmp 0x43e652
mov eax, 0x20019
and dword [ebp - 4], 0
mov ecx, dword [esi + 4]
test ecx, ecx
jne 0x43e662
mov ecx, 0x4934ec
lea esi, [ebp - 4]
or eax, 0x10000
push esi
mov edx, ecx
push eax
lea eax, [edi + 2]
sub edi, edx
sar edi, 1
push eax
mov edx, edi
call fcn.0041f598
push eax
push dword [ebp - 0xc]
call sym.Dismx86.exe_DismRegOpenKeyEx
mov edi, eax
test edi, edi
jne 0x43e7d5
mov esi, dword [ebp - 0x14]
mov eax, dword [esi + 4]
test eax, eax
jne 0x43e69f
mov eax, 0x4934ec
push 0x5c
push eax
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov edi, eax
test edi, edi
jne 0x43e6b8
mov edi, 0x80004005
jmp 0x43e7d5
and dword [ebp - 8], 0
mov ecx, dword [esi + 4]
test ecx, ecx
jne 0x43e6c8
mov ecx, 0x4934ec
mov eax, ecx
mov edx, edi
sub edx, eax
sar edx, 1
call fcn.0041f598
mov edx, dword [ebp - 0xc]
lea ecx, [ebp - 8]
push 0
push ecx
mov ecx, dword [ebp - 0x10]
mov edx, dword [edx + 0x48]
or ecx, 0x20006
push ecx
lea ecx, [edi + 2]
push ecx
mov esi, dword [edx]
push eax
push edx
call dword [esi + 0x10]
mov edi, eax
test edi, edi
jne 0x43e7cd
push ecx
push eax
push str.Value
mov ecx, ebx
call fcn.0043b6e0
mov ebx, eax
test ebx, ebx
je 0x43e7b2
push ecx
mov ecx, dword [ebp - 0x18]
push edi
push str.NewValue
call fcn.0043b6e0
mov dword [ebp - 0x18], eax
call fcn.0043d5bb
push eax
lea ecx, [ebp - 0x10]
call fcn.0043bbe8
mov edx, dword [ebx + 4]
test edx, edx
jne 0x43e744
mov edx, 0x4934ec
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0044df6e
mov esi, dword [ebp - 0x10]
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x43e7a8
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x43e76b
mov eax, dword [eax + 4]
jmp 0x43e76e
mov eax, dword [ebx + 4]
test eax, eax
jne 0x43e777
mov eax, 0x4934ec
push dword [esi - 0xc]
push esi
push dword [ebp - 0x14]
push 0
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
test edi, edi
jne 0x43e7a8
mov eax, dword [ebx + 4]
test eax, eax
jne 0x43e79c
mov eax, 0x4934ec
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edi, eax
lea ecx, [esi - 0x10]
call fcn.0043d912
jmp 0x43e7cd
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 4]
call fcn.0044e14c
mov edi, eax
test edi, edi
jne 0x43e7cd
mov ecx, dword [ebp - 4]
call fcn.0044e128
mov edi, eax
lea ecx, [ebp - 8]
call fcn.0043b8cb
lea ecx, [ebp - 4]
call fcn.0043b8cb
mov eax, edi
jmp 0x43e7e6
mov eax, 0x80004005
pop edi
pop esi
pop ebx
leave
ret