0040857B . 8D45 FC LEA EAX,DWORD PTR SS:[EBP-4] 0040857E . 50 PUSH EAX ; /pHandle 0040857F . 68 19000200 PUSH 20019 ; |Access = KEY_READ 00408584 . 6A 00 PUSH 0 ; |Reserved = 0 00408586 . 68 00864000 PUSH HTSNoteP.00408600 ; |Subkey = "SOFTWARE\Microsoft\Windows\CurrentVersion" 0040858B . 68 02000080 PUSH 80000002 ; |hKey = HKEY_LOCAL_MACHINE 00408590 . E8 6BC0FFFF CALL ; \RegOpenKeyExA 00408595 . 8D45 F8 LEA EAX,DWORD PTR SS:[EBP-8] 00408598 . 50 PUSH EAX ; /pBufSize 00408599 . 53 PUSH EBX ; |Buffer 0040859A . 6A 00 PUSH 0 ; |pValueType = NULL 0040859C . 6A 00 PUSH 0 ; |Reserved = NULL 0040859E . 68 2C864000 PUSH HTSNoteP.0040862C ; |ValueName = "ProgramFilesDir" 004085A3 . 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4] ; | 004085A6 . 50 PUSH EAX ; |hKey 004085A7 . E8 5CC0FFFF CALL ; \RegQueryValueExA 004085AC . 8D45 F4 LEA EAX,DWORD PTR SS:[EBP-C] 004085AF . 8BD3 MOV EDX,EBX 004085B1 . E8 62B2FFFF CALL HTSNoteP.00403818 004085B6 . 8B55 F4 MOV EDX,DWORD PTR SS:[EBP-C] 004085B9 . 8BC6 MOV EAX,ESI 004085BB . B9 44864000 MOV ECX,HTSNoteP.00408644 004085C0 . E8 37B3FFFF CALL HTSNoteP.004038FC 004085C5 . 33C0 XOR EAX,EAX 004085C7 . 5A POP EDX 004085C8 . 59 POP ECX 004085C9 . 59 POP ECX 004085CA . 64:8910 MOV DWORD PTR FS:[EAX],EDX 004085CD . EB 0A JMP SHORT HTSNoteP.004085D9 004085CF .^E9 64A9FFFF JMP HTSNoteP.00402F38 004085D4 . E8 3FABFFFF CALL HTSNoteP.00403118 004085D9 > 33C0 XOR EAX,EAX 004085DB . 5A POP EDX 004085DC . 59 POP ECX 004085DD . 59 POP ECX 004085DE . 64:8910 MOV DWORD PTR FS:[EAX],EDX 004085E1 . 68 F6854000 PUSH HTSNoteP.004085F6 004085E6 > 8D45 F4 LEA EAX,DWORD PTR SS:[EBP-C] 004085E9 . E8 4EB0FFFF CALL HTSNoteP.0040363C 004085EE . C3 RETN 004085EF .^E9 70AAFFFF JMP HTSNoteP.00403064 004085F4 .^EB F0 JMP SHORT HTSNoteP.004085E6 004085F6 . 5F POP EDI 004085F7 . 5E POP ESI 004085F8 . 5B POP EBX 004085F9 . 8BE5 MOV ESP,EBP 004085FB . 5D POP EBP 004085FC . C3 RETN 004085FD 00 DB 00 004085FE 00 DB 00 004085FF 00 DB 00 00408600 . 53 4F 46 54 57>ASCII "SOFTWARE\Microso" 00408610 . 66 74 5C 57 69>ASCII "ft\Windows\Curre" 00408620 . 6E 74 56 65 72>ASCII "ntVersion",0 0040862A 00 DB 00 0040862B 00 DB 00 0040862C . 50 72 6F 67 72>ASCII "ProgramFilesDir",0 0040863C . FFFFFFFF DD FFFFFFFF 00408640 . 01000000 DD 00000001 00408644 . 5C 00 ASCII "\",0 00408646 00 DB 00 00408647 00 DB 00 00408648 $ 55 PUSH EBP 00408649 . 8BEC MOV EBP,ESP 0040864B . 83C4 EC ADD ESP,-14 0040864E . 53 PUSH EBX 0040864F . 56 PUSH ESI 00408650 . 8955 F8 MOV DWORD PTR SS:[EBP-8],EDX 00408653 . 8945 FC MOV DWORD PTR SS:[EBP-4],EAX 00408656 . 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4] 00408659 . E8 9EB3FFFF CALL HTSNoteP.004039FC 0040865E . 8B45 F8 MOV EAX,DWORD PTR SS:[EBP-8] 00408661 . E8 96B3FFFF CALL HTSNoteP.004039FC 00408666 . 33C0 XOR EAX,EAX 00408668 . 55 PUSH EBP 00408669 . 68 45874000 PUSH HTSNoteP.00408745 0040866E . 64:FF30 PUSH DWORD PTR FS:[EAX] 00408671 . 64:8920 MOV DWORD PTR FS:[EAX],ESP 00408674 . C645 F7 00 MOV BYTE PTR SS:[EBP-9],0 00408678 . 68 58874000 PUSH HTSNoteP.00408758 ; ASCII "TMP" 0040867D . 8D45 FC LEA EAX,DWORD PTR SS:[EBP-4] 00408680 . E8 D7B3FFFF CALL HTSNoteP.00403A5C 00408685 . 50 PUSH EAX ; |ResourceName 00408686 . A1 60A64000 MOV EAX,DWORD PTR DS:[40A660] ; | 0040868B . 50 PUSH EAX ; |hModule => NULL 0040868C . E8 AFBFFFFF CALL ; \FindResourceA 00408691 . 8BD8 MOV EBX,EAX 00408693 . 53 PUSH EBX ; /hResource 00408694 . A1 60A64000 MOV EAX,DWORD PTR DS:[40A660] ; | 00408699 . 50 PUSH EAX ; |hModule => NULL 0040869A . E8 19C0FFFF CALL ; \LoadResource 0040869F . 8BF0 MOV ESI,EAX 004086A1 . 53 PUSH EBX ; /hResource 004086A2 . A1 60A64000 MOV EAX,DWORD PTR DS:[40A660] ; | 004086A7 . 50 PUSH EAX ; |hModule => NULL 004086A8 . E8 33C0FFFF CALL ; \SizeofResource 004086AD . 8BD8 MOV EBX,EAX 004086AF . 6A 00 PUSH 0 004086B1 . 6A 20 PUSH 20 004086B3 . 6A 02 PUSH 2 004086B5 . 6A 00 PUSH 0 004086B7 . 6A 03 PUSH 3 004086B9 . 68 000000C0 PUSH C0000000 004086BE . 8D45 F8 LEA EAX,DWORD PTR SS:[EBP-8] 004086C1 . E8 96B3FFFF CALL HTSNoteP.00403A5C 004086C6 . 50 PUSH EAX ; |FileName 004086C7 . E8 54BFFFFF CALL ; \CreateFileA 004086CC . 8945 EC MOV DWORD PTR SS:[EBP-14],EAX 004086CF . 837D EC FF CMP DWORD PTR SS:[EBP-14],-1 004086D3 . 74 55 JE SHORT HTSNoteP.0040872A 004086D5 . 33C0 XOR EAX,EAX 004086D7 . 55 PUSH EBP 004086D8 . 68 23874000 PUSH HTSNoteP.00408723 004086DD . 64:FF30 PUSH DWORD PTR FS:[EAX] 004086E0 . 64:8920 MOV DWORD PTR FS:[EAX],ESP 004086E3 . 6A 00 PUSH 0 ; /pOverlapped = NULL 004086E5 . 8D45 F0 LEA EAX,DWORD PTR SS:[EBP-10] ; | 004086E8 . 50 PUSH EAX ; |pBytesWritten 004086E9 . 53 PUSH EBX ; |nBytesToWrite 004086EA . 56 PUSH ESI ; |/hResource 004086EB . E8 D8BFFFFF CALL ; |\LockResource 004086F0 . 50 PUSH EAX ; |Buffer 004086F1 . 8B45 EC MOV EAX,DWORD PTR SS:[EBP-14] ; | 004086F4 . 50 PUSH EAX ; |hFile 004086F5 . E8 06C0FFFF CALL ; \WriteFile 004086FA . 85C0 TEST EAX,EAX