Function at 0x43be00
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x32c
push ebx
push ebp
mov edx, dword [esp + 0x338]
push esi
lea eax, [esp + 0x14]
push edi
lea ecx, [esp + 0x10]
xor ebp, ebp
push eax
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push ecx
push ebp
push 0x20006
push ebp
push ebp
push ebp
push edx
push SysReAllocString
mov dword [esp + 0x34], ebp
mov dword [esp + 0x40], ebp
mov dword [esp + 0x48], ebp
mov dword [esp + 0x3c], ebp
call ebx
mov esi, eax
cmp esi, ebp
jne 0x43c0ab
mov edi, dword [esp + 0x344]
lea eax, [esp + 0x14]
push eax
push edi
call fcn.0043bdd0
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
add esp, 8
push ecx
push edi
push 1
push ebp
push ebp
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
cmp esi, ebp
jne 0x43c0ab
cmp dword [esp + 0x358], ebp
jne 0x43c0ab
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x18]
lea edx, [esp + 0x10]
push ecx
push edx
push ebp
push 0x20006
push ebp
push ebp
push ebp
push edi
push SysReAllocString
call ebx
mov esi, eax
cmp esi, ebp
jne 0x43c0ab
mov esi, dword [esp + 0x348]
lea eax, [esp + 0x14]
push eax
push esi
call fcn.0043bdd0
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
add esp, 8
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push ecx
push esi
push 1
push ebp
push ebp
push edx
call edi
mov esi, eax
cmp esi, ebp
jne 0x43c0ab
lea eax, [esp + 0x18]
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x1c]
push eax
push ecx
push ebp
push 0x20006
push ebp
push ebp
push ebp
push str.ShellOpenCommand
push edx
call ebx
mov esi, eax
cmp esi, ebp
jne 0x43c0ab
mov esi, dword [esp + 0x34c]
lea eax, [esp + 0x14]
push eax
push esi
call fcn.0043bdd0
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x24]
add esp, 8
push ecx
push esi
push 2
push ebp
push ebp
push edx
call edi
mov esi, eax
cmp esi, ebp
jne 0x43c0ab
cmp dword [esp + 0x350], ebp
je 0x43c0ab
lea eax, [esp + 0x18]
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x24]
push eax
push ecx
push ebp
push 0x20006
push ebp
push ebp
push ebp
push str.DefaultIcon
push edx
call ebx
mov esi, eax
cmp esi, ebp
jne 0x43c0ab
lea eax, [esp + 0x20]
mov dword [esp + 0x28], 0x104
push eax
push 0x20019
push ebp
push str.Imaging.DocumentDefaultIcon
push SysReAllocString
mov dword [esp + 0x34], ebp
mov dword [esp + 0x40], 1
xor ebx, ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x43bfeb
lea ecx, [esp + 0x28]
lea edx, [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x30]
push edx
push eax
push ebp
push 0x45db8c
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [esp + 0x30]
push 0x5c
push edx
call dword [sym.imp.MSVCRT.dll__mbsrchr]
add esp, 8
mov ebx, eax
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, ebp
je 0x43c05e
mov edi, str.Kodakimg.exe
or ecx, 0xffffffff
xor eax, eax
push 0x22
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea eax, [esp + 0x34]
mov edx, ecx
mov esi, edi
mov edi, ebx
push eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.MSVCRT.dll__mbschr]
add esp, 8
test eax, eax
je 0x43c05e
mov edi, 0x45cfe4
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x30]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x30]
push 1
push eax
lea ecx, [esp + 0x13c]
push str._s__d
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
lea edx, [esp + 0x24]
lea eax, [esp + 0x144]
push edx
push eax
call fcn.0043bdd0
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x3c]
add esp, 0x18
lea edx, [esp + 0x134]
push ecx
push edx
push 2
push ebp
push ebp
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
mov ecx, dword [esp + 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
call edi
mov edx, dword [esp + 0x1c]
push edx
call edi
mov eax, dword [esp + 0x24]
push eax
call edi
xor eax, eax
cmp esi, ebp
pop edi
pop esi
pop ebp
pop ebx
sete al
add esp, 0x32c
ret