both 32 and 64 bit installs use the 32 bit registry

I'm not sure it would make sense for us to explicitly write to the 64-bit view of the registry, at least for our current set of keys. They are either used by the system (e.g. file associations) or by the uninstaller, which is a 32-bit application created by the NSIS installer utility.

The most reliable way to to find the executable type would probably be to read the value of HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths\\wireshark.exe then inspect the actual executable, e.g. using file or dumpbin /headers.

If you want a method based purely on the contents of the registry you could look for "(x86)" in the file path. By default Wireshark is installed in C:\\Program Files\\Wireshark if the executable and system type match and C:\\Program Files (x86) if you're installing the 32-bit version of Wireshark on 64-bit Windows. Note that this isn't 100% reliable since the user can change the installation directory.

Update

Starting with the 1.7.1 HKLM\\…\\Uninstall\\Wireshark\\DisplayName and …\\Comments will include a the system type, e.g. "Wireshark 1.7.1 (64-bit)".