0040857E   . 50             PUSH EAX                                 ; /pHandle
0040857F   . 68 19000200    PUSH 20019                               ; |Access = KEY_READ
00408584   . 6A 00          PUSH 0                                   ; |Reserved = 0
00408586   . 68 00864000    PUSH HTSNoteP.00408600                   ; |Subkey = "SOFTWARE\Microsoft\Windows\CurrentVersion"
0040858B   . 68 02000080    PUSH 80000002                            ; |hKey = HKEY_LOCAL_MACHINE
00408590   . E8 6BC0FFFF    CALL <JMP.&advapi32.RegOpenKeyExA>       ; \RegOpenKeyExA
00408595   . 8D45 F8        LEA EAX,DWORD PTR SS:[EBP-8]
00408598   . 50             PUSH EAX                                 ; /pBufSize
00408599   . 53             PUSH EBX                                 ; |Buffer
0040859A   . 6A 00          PUSH 0                                   ; |pValueType = NULL
0040859C   . 6A 00          PUSH 0                                   ; |Reserved = NULL
0040859E   . 68 2C864000    PUSH HTSNoteP.0040862C                   ; |ValueName = "ProgramFilesDir"
004085A3   . 8B45 FC        MOV EAX,DWORD PTR SS:[EBP-4]             ; |
004085A6   . 50             PUSH EAX                                 ; |hKey
004085A7   . E8 5CC0FFFF    CALL <JMP.&advapi32.RegQueryValueExA>    ; \RegQueryValueExA