Function at 0x4327fd
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5068c9
mov eax, dword fs:[0]
push eax
sub esp, 0x1c8
mov eax, dword [0x543f30]
xor eax, esp
mov dword [esp + 0x1c0], eax
push ebx
push esi
push edi
mov eax, dword [0x543f30]
xor eax, esp
push eax
lea eax, [esp + 0x1d8]
mov dword fs:[0], eax
lea eax, [esp + 0xc4]
push eax
call fcn.00405986
lea eax, [esp + 0xc4]
push str.create_installation_started_registry_key
xor ebx, ebx
push eax
mov dword [esp + 0x1e8], ebx
call fcn.0040dc1c
pop ecx
pop ecx
push 0x44
mov esi, str.AdAwareWebInstaller::Installer::CreateInstallationStartedRegistryKey
push esi
lea ecx, [esp + 0x168]
mov dword [esp + 0x17c], 0xf
mov dword [esp + 0x178], ebx
mov byte [esp + 0x168], bl
call fcn.00401570
lea ecx, [esp + 0x198]
lea eax, [esp + 0xc4]
mov byte [esp + 0x1e0], 1
call fcn.00405a2d
mov edi, eax
mov byte [esp + 0x1e0], 2
call fcn.0041f5f7
mov ecx, dword [eax + 4]
push edi
push 0x332
mov edi, 0x7d0
lea edx, [esp + 0x168]
call fcn.00404574
xor edi, edi
push ebx
inc edi
push edi
lea ecx, [esp + 0x1a0]
call fcn.00401512
push ebx
push edi
lea ecx, [esp + 0x168]
call fcn.0040136b
or dword [esp + 0x1e0], 0xffffffff
lea eax, [esp + 0xc4]
call fcn.0040380f
lea eax, [esp + 0x160]
push eax
call fcn.0042a76b
pop ecx
mov dword [esp + 0x14], eax
lea eax, [esp + 0x198]
push eax
mov dword [esp + 0x1e4], 3
call fcn.0042a751
cmp dword [eax + 0x14], 8
pop ecx
jb 0x43293e
mov eax, dword [eax]
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x1c]
push ecx
push ebx
push 0x20006
push ebx
push ebx
push ebx
push eax
push reloc.WS2_32.dll_bind
mov dword [esp + 0x3c], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebx
jne 0x432ac8
mov eax, dword [esp + 0x14]
cmp dword [eax + 0x14], 8
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x20], ecx
jb 0x43297d
mov eax, dword [eax]
push 4
lea edx, [esp + 0x18]
push edx
push 4
push ebx
push eax
push ecx
mov dword [esp + 0x2c], edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb al, al
inc al
mov byte [esp + 0x13], al
cmp dword [esp + 0x20], ebx
je 0x4329b1
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [esp + 0x13]
push ebx
cmp al, bl
push edi
lea ecx, [esp + 0x1a0]
sete byte [esp + 0x1b]
call fcn.00401512
or dword [esp + 0x1e0], 0xffffffff
push ebx
push edi
lea ecx, [esp + 0x168]
call fcn.00401512
cmp byte [esp + 0x13], bl
je 0x432aa4
lea eax, [esp + 0x2c]
push eax
call fcn.00405986
lea eax, [esp + 0x2c]
push str.couldnt_save_installation_started_registry_key
push eax
mov dword [esp + 0x1e8], 4
call fcn.0040dc1c
pop ecx
pop ecx
push 0x44
push esi
lea ecx, [esp + 0x184]
mov dword [esp + 0x198], 0xf
mov dword [esp + 0x194], ebx
mov byte [esp + 0x184], bl
call fcn.00401570
lea ecx, [esp + 0x1b4]
lea eax, [esp + 0x2c]
mov byte [esp + 0x1e0], 5
call fcn.00405a2d
mov esi, eax
mov byte [esp + 0x1e0], 6
call fcn.0041f5f7
mov ecx, dword [eax + 4]
push esi
push 0x336
mov edi, 0xfa0
lea edx, [esp + 0x184]
call fcn.00404574
push ebx
push 1
lea ecx, [esp + 0x1bc]
call fcn.00401512
push ebx
push 1
lea ecx, [esp + 0x184]
call fcn.0040136b
or dword [esp + 0x1e0], 0xffffffff
lea eax, [esp + 0x2c]
call fcn.0040380f
mov ecx, dword [esp + 0x1d8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1c0]
xor ecx, esp
call fcn.0049d196
mov esp, ebp
pop ebp
ret
xor al, al
jmp 0x4329b1