
L1: 55 ?? push ebp
 8b ec ?? mov ebp, esp
 81 ec 1c 02 00 00 ?? sub esp, 0x0000021c<540>
 a1 04 70 40 00 ?? mov eax, dword ds:[0x00407004]
 33 c5 ?? xor eax, ebp
 89 45 fc ?? mov dword ss:[ebp + 0xfc<252,-4>], eax
 53 ?? push ebx
 56 ?? push esi
 57 ?? push edi
 68 00 08 00 00 ?? push 0x00000800<2048>
 6a 00 ?? push 0
 68 88 58 40 00 ?? push 0x00405888<"api-ms-win-core-registry-"+10 more>
 e8 fc 06 00 00 ?? call function 0x00404023

L2: 8b f8 ?? mov edi, eax
 83 c4 0c ?? add esp, 12
 85 ff ?? test edi, edi
 75 39 ?? jne basic block L9

L3: 68 00 08 00 00 ?? push 0x00000800<2048>
 50 ?? push eax
 68 d0 58 40 00 ?? push 0x004058d0<"advapi32.dll">
 e8 e3 06 00 00 ?? call function 0x00404023

L4: 8b f8 ?? mov edi, eax
 83 c4 0c ?? add esp, 12
 85 ff ?? test edi, edi
 75 20 ?? jne basic block L9

L5: ff 15 30 50 40 00 ?? call dword ds:[0x00405030]

L6: 83 f8 57 ?? cmp eax, 0x57<87>
 75 79 ?? jne basic block L19

L7: 57 ?? push edi
 57 ?? push edi
 68 d0 58 40 00 ?? push 0x004058d0<"advapi32.dll">
 e8 c3 06 00 00 ?? call function 0x00404023

L8: 8b f8 ?? mov edi, eax
 83 c4 0c ?? add esp, 12
 85 ff ?? test edi, edi
 74 64 ?? je basic block L19

L9: 68 ec 58 40 00 ?? push 0x004058ec<"RegOpenKeyExW">
 57 ?? push edi
 ff 15 00 50 40 00 ?? call dword ds:[0x00405000<"6g@">]

L10: 8b f0 ?? mov esi, eax
 85 f6 ?? test esi, esi
 74 52 ?? je basic block L19

L11: 68 fc 58 40 00 ?? push 0x004058fc<"RegQueryValueExW">
 57 ?? push edi
 ff 15 00 50 40 00 ?? call dword ds:[0x00405000<"6g@">]

L12: 8b d8 ?? mov ebx, eax
 85 db ?? test ebx, ebx
 74 40 ?? je basic block L19

L13: 68 10 59 40 00 ?? push 0x00405910<"RegCloseKey">
 57 ?? push edi
 ff 15 00 50 40 00 ?? call dword ds:[0x00405000<"6g@">]

L14: 89 85 e8 fd ff ff ?? mov dword ss:[ebp + 0xfffffde8<4294966760,-536>], eax
 85 c0 ?? test eax, eax
 74 2a ?? je basic block L19

L15: 8d 85 f0 fd ff ff ?? lea eax, ss:[ebp + 0xfffffdf0<4294966768,-528>]
 8b ce ?? mov ecx, esi
 50 ?? push eax
 6a 01 ?? push 1
 6a 00 ?? push 0
 68 20 59 40 00 ?? push 0x00405920<"SOFTWARE\\Wow6432Node\\Micr"+32 more>
 68 02 00 00 80 ?? push 0x80000002
 ff 15 24 51 40 00 ?? call dword ds:[0x00405124<"p(@">]

L16: ff d6 ?? call esi

L17: 85 c0 ?? test eax, eax
 74 1a ?? je basic block L21

L18: 57 ?? push edi
 ff 15 1c 50 40 00 ?? call dword ds:[0x0040501c<"(g@">]

L19: 5f ?? pop edi
 5e ?? pop esi
 33 c0 ?? xor eax, eax
 5b ?? pop ebx
 8b 4d fc ?? mov ecx, dword ss:[ebp + 0xfc<252,-4>]
 33 cd ?? xor ecx, ebp
 e8 34 d7 ff ff ?? call function 0x00401110

L20: 8b e5 ?? mov esp, ebp
 5d ?? pop ebp
 c3 ?? ret

L21: 8d 85 ec fd ff ff ?? lea eax, ss:[ebp + 0xfffffdec<4294966764,-532>]
 c7 85 ec fd ff ff 08 02 ?? mov dword ss:[ebp + 0xfffffdec<4294966764,-532>], 0x00000208<520>
 00 00
 50 ?? push eax
 8d 85 f4 fd ff ff ?? lea eax, ss:[ebp + 0xfffffdf4<4294966772,-524>]
 8b cb ?? mov ecx, ebx
 50 ?? push eax
 8d 85 e4 fd ff ff ?? lea eax, ss:[ebp + 0xfffffde4<4294966756,-540>]
 50 ?? push eax
 6a 00 ?? push 0
 68 94 59 40 00 ?? push 0x00405994<"ProductDir">
 ff b5 f0 fd ff ff ?? push dword ss:[ebp + 0xfffffdf0<4294966768,-528>]
 ff 15 24 51 40 00 ?? call dword ds:[0x00405124<"p(@">]

L22: ff d3 ?? call ebx

L23: ff b5 f0 fd ff ff ?? push dword ss:[ebp + 0xfffffdf0<4294966768,-528>]
 8b 9d e8 fd ff ff ?? mov ebx, dword ss:[ebp + 0xfffffde8<4294966760,-536>]
 8b f0 ?? mov esi, eax
 8b cb ?? mov ecx, ebx
 ff 15 24 51 40 00 ?? call dword ds:[0x00405124<"p(@">]

L24: ff d3 ?? call ebx

L25: 57 ?? push edi
 ff 15 1c 50 40 00 ?? call dword ds:[0x0040501c<"(g@">]

L26: 85 f6 ?? test esi, esi
 75 94 ?? jne basic block L19

L27: 83 bd e4 fd ff ff 01 ?? cmp dword ss:[ebp + 0xfffffde4<4294966756,-540>], 1
 75 8b ?? jne basic block L19

L28: 8b 8d ec fd ff ff ?? mov ecx, dword ss:[ebp + 0xfffffdec<4294966764,-532>]
 f6 c1 01 ?? test cl, 1
 75 80 ?? jne basic block L19

L29: d1 e9 ?? shr ecx, 1
 8b d1 ?? mov edx, ecx
 83 f9 02 ?? cmp ecx, 2
 0f 82 73 ff ff ff ?? jb basic block L19

L30: 49 ?? dec ecx
 8d 85 f4 fd ff ff ?? lea eax, ss:[ebp + 0xfffffdf4<4294966772,-524>]
 66 39 34 48 ?? cmp word ds:[eax + ecx * 2], si
 8d 04 48 ?? lea eax, ds:[eax + ecx * 2]
 0f 85 5f ff ff ff ?? jne basic block L19

L31: 66 83 78 fe 5c ?? cmp word ds:[eax + 0xfe<254,-2>], 0x5c<92>
 74 0a ?? je basic block L33

L32: b9 5c 00 00 00 ?? mov ecx, 0x0000005c<92>
 66 89 08 ?? mov word ds:[eax], cx
 8b ca ?? mov ecx, edx

L33: 8b c1 ?? mov eax, ecx
 f7 d0 ?? not eax
 83 f8 12 ?? cmp eax, 0x12<18>
 0f 82 41 ff ff ff ?? jb basic block L19

L34: 8d 41 11 ?? lea eax, ds:[ecx + 0x11<17>]
 3d 04 01 00 00 ?? cmp eax, 0x00000104<260>
 0f 87 33 ff ff ff ?? ja basic block L19

L35: a1 40 58 40 00 ?? mov eax, dword ds:[0x00405840<"bin\\MSPDB140.DLL">]
 89 84 4d f4 fd ff ff ?? mov dword ss:[ebp + 0xfffffdf4<4294966772,-524> + ecx * 2], eax
 a1 44 58 40 00 ?? mov eax, dword ds:[0x00405844<"n\\MSPDB140.DLL">]
 89 84 4d f8 fd ff ff ?? mov dword ss:[ebp + 0xfffffdf8<4294966776,-520> + ecx * 2], eax
 a1 48 58 40 00 ?? mov eax, dword ds:[0x00405848<"MSPDB140.DLL">]
 89 84 4d fc fd ff ff ?? mov dword ss:[ebp + 0xfffffdfc<4294966780,-516> + ecx * 2], eax
 a1 4c 58 40 00 ?? mov eax, dword ds:[0x0040584c<"PDB140.DLL">]
 89 84 4d 00 fe ff ff ?? mov dword ss:[ebp + 0xfffffe00<4294966784,-512> + ecx * 2], eax
 a1 50 58 40 00 ?? mov eax, dword ds:[0x00405850<"B140.DLL">]
 89 84 4d 04 fe ff ff ?? mov dword ss:[ebp + 0xfffffe04<4294966788,-508> + ecx * 2], eax
 a1 54 58 40 00 ?? mov eax, dword ds:[0x00405854<"40.DLL">]
 89 84 4d 08 fe ff ff ?? mov dword ss:[ebp + 0xfffffe08<4294966792,-504> + ecx * 2], eax
 a1 58 58 40 00 ?? mov eax, dword ds:[0x00405858<".DLL">]
 89 84 4d 0c fe ff ff ?? mov dword ss:[ebp + 0xfffffe0c<4294966796,-500> + ecx * 2], eax
 a1 5c 58 40 00 ?? mov eax, dword ds:[0x0040585c<"LL">]
 89 84 4d 10 fe ff ff ?? mov dword ss:[ebp + 0xfffffe10<4294966800,-496> + ecx * 2], eax
 66 a1 60 58 40 00 ?? mov ax, word ds:[0x00405860]
 68 00 09 00 00 ?? push 0x00000900<2304>
 66 89 84 4d 14 fe ff ff ?? mov word ss:[ebp + 0xfffffe14<4294966804,-492> + ecx * 2], ax
 8d 85 f4 fd ff ff ?? lea eax, ss:[ebp + 0xfffffdf4<4294966772,-524>]
 6a 00 ?? push 0
 50 ?? push eax
 e8 08 05 00 00 ?? call function 0x00404023

L36: 8b f0 ?? mov esi, eax
 83 c4 0c ?? add esp, 12
 85 f6 ?? test esi, esi
 75 1f ?? jne basic block L41

L37: ff 15 30 50 40 00 ?? call dword ds:[0x00405030]

L38: 83 f8 57 ?? cmp eax, 0x57<87>
 75 14 ?? jne basic block L41

L39: 6a 08 ?? push 8
 8d 85 f4 fd ff ff ?? lea eax, ss:[ebp + 0xfffffdf4<4294966772,-524>]
 56 ?? push esi
 50 ?? push eax
 e8 e5 04 00 00 ?? call function 0x00404023

L40: 83 c4 0c ?? add esp, 12
 8b f0 ?? mov esi, eax

L41: 8b 4d fc ?? mov ecx, dword ss:[ebp + 0xfc<252,-4>]
 8b c6 ?? mov eax, esi
 5f ?? pop edi
 5e ?? pop esi
 33 cd ?? xor ecx, ebp
 5b ?? pop ebx
 e8 be d5 ff ff ?? call function 0x00401110

L42: 8b e5 ?? mov esp, ebp
 5d ?? pop ebp
 c3 ?? ret

