
L1: 55 ?? push ebp
 8b ec ?? mov ebp, esp
 81 ec 1c 02 00 00 ?? sub esp, 0x0000021c<540>
 a1 24 90 40 00 ?? mov eax, dword ds:[0x00409024]
 33 c5 ?? xor eax, ebp
 89 45 fc ?? mov dword ss:[ebp + 0xfc<252,-4>], eax
 57 ?? push edi
 68 00 08 00 00 ?? push 0x00000800<2048>
 6a 00 ?? push 0
 68 98 73 40 00 ?? push 0x00407398<"api-ms-win-core-registry-"+10 more>
 e8 b7 10 00 00 ?? call function 0x00404bbc

L2: 8b f8 ?? mov edi, eax
 83 c4 0c ?? add esp, 12
 85 ff ?? test edi, edi
 75 4a ?? jne basic block L11

L3: 68 00 08 00 00 ?? push 0x00000800<2048>
 50 ?? push eax
 68 f0 73 40 00 ?? push 0x004073f0<"advapi32.dll">
 e8 9e 10 00 00 ?? call function 0x00404bbc

L4: 8b f8 ?? mov edi, eax
 83 c4 0c ?? add esp, 12
 85 ff ?? test edi, edi
 75 31 ?? jne basic block L11

L5: ff 15 38 a0 40 00 ?? call dword ds:[0x0040a038]

L6: 83 f8 57 ?? cmp eax, 0x57<87>
 75 15 ?? jne basic block L9

L7: 57 ?? push edi
 57 ?? push edi
 68 f0 73 40 00 ?? push 0x004073f0<"advapi32.dll">
 e8 7e 10 00 00 ?? call function 0x00404bbc

L8: 8b f8 ?? mov edi, eax
 83 c4 0c ?? add esp, 12
 85 ff ?? test edi, edi
 75 11 ?? jne basic block L11

L9: 33 c0 ?? xor eax, eax
 5f ?? pop edi
 8b 4d fc ?? mov ecx, dword ss:[ebp + 0xfc<252,-4>]
 33 cd ?? xor ecx, ebp
 e8 6e d6 ff ff ?? call function 0x004011c2

L10: 8b e5 ?? mov esp, ebp
 5d ?? pop ebp
 c3 ?? ret

L11: 56 ?? push esi
 68 10 74 40 00 ?? push 0x00407410<"RegOpenKeyExW">
 57 ?? push edi
 ff 15 20 a0 40 00 ?? call dword ds:[0x0040a020]

L12: 8b f0 ?? mov esi, eax
 85 f6 ?? test esi, esi
 75 10 ?? jne basic block L15

L13: 5e ?? pop esi
 5f ?? pop edi
 8b 4d fc ?? mov ecx, dword ss:[ebp + 0xfc<252,-4>]
 33 cd ?? xor ecx, ebp
 e8 4b d6 ff ff ?? call function 0x004011c2

L14: 8b e5 ?? mov esp, ebp
 5d ?? pop ebp
 c3 ?? ret

L15: 53 ?? push ebx
 68 20 74 40 00 ?? push 0x00407420<"RegQueryValueExW">
 57 ?? push edi
 ff 15 20 a0 40 00 ?? call dword ds:[0x0040a020]

L16: 8b d8 ?? mov ebx, eax
 85 db ?? test ebx, ebx
 74 3f ?? je basic block L23

L17: 68 34 74 40 00 ?? push 0x00407434<"RegCloseKey">
 57 ?? push edi
 ff 15 20 a0 40 00 ?? call dword ds:[0x0040a020]

L18: 89 85 e8 fd ff ff ?? mov dword ss:[ebp + 0xfffffde8<4294966760,-536>], eax
 85 c0 ?? test eax, eax
 74 29 ?? je basic block L23

L19: 8d 85 f0 fd ff ff ?? lea eax, ss:[ebp + 0xfffffdf0<4294966768,-528>]
 8b ce ?? mov ecx, esi
 50 ?? push eax
 6a 01 ?? push 1
 6a 00 ?? push 0
 68 48 74 40 00 ?? push 0x00407448<"SOFTWARE\\Wow6432Node\\Micr"+32 more>
 68 02 00 00 80 ?? push 0x80000002
 e8 43 d6 ff ff ?? call function 0x00401203

L20: ff d6 ?? call esi

L21: 85 c0 ?? test eax, eax
 74 1a ?? je basic block L25

L22: 57 ?? push edi
 ff 15 24 a0 40 00 ?? call dword ds:[0x0040a024]

L23: 5b ?? pop ebx
 5e ?? pop esi
 33 c0 ?? xor eax, eax
 5f ?? pop edi
 8b 4d fc ?? mov ecx, dword ss:[ebp + 0xfc<252,-4>]
 33 cd ?? xor ecx, ebp
 e8 e6 d5 ff ff ?? call function 0x004011c2

L24: 8b e5 ?? mov esp, ebp
 5d ?? pop ebp
 c3 ?? ret

L25: 8d 85 ec fd ff ff ?? lea eax, ss:[ebp + 0xfffffdec<4294966764,-532>]
 c7 85 ec fd ff ff 08 02 ?? mov dword ss:[ebp + 0xfffffdec<4294966764,-532>], 0x00000208<520>
 00 00
 50 ?? push eax
 8d 85 f4 fd ff ff ?? lea eax, ss:[ebp + 0xfffffdf4<4294966772,-524>]
 8b cb ?? mov ecx, ebx
 50 ?? push eax
 8d 85 e4 fd ff ff ?? lea eax, ss:[ebp + 0xfffffde4<4294966756,-540>]
 50 ?? push eax
 6a 00 ?? push 0
 68 d4 74 40 00 ?? push 0x004074d4<"ProductDir">
 ff b5 f0 fd ff ff ?? push dword ss:[ebp + 0xfffffdf0<4294966768,-528>]
 e8 f0 d5 ff ff ?? call function 0x00401203

L26: ff d3 ?? call ebx

L27: ff b5 f0 fd ff ff ?? push dword ss:[ebp + 0xfffffdf0<4294966768,-528>]
 8b 9d e8 fd ff ff ?? mov ebx, dword ss:[ebp + 0xfffffde8<4294966760,-536>]
 8b f0 ?? mov esi, eax
 8b cb ?? mov ecx, ebx
 e8 d9 d5 ff ff ?? call function 0x00401203

L28: ff d3 ?? call ebx

L29: 57 ?? push edi
 ff 15 24 a0 40 00 ?? call dword ds:[0x0040a024]

L30: 85 f6 ?? test esi, esi
 75 96 ?? jne basic block L23

L31: 83 bd e4 fd ff ff 01 ?? cmp dword ss:[ebp + 0xfffffde4<4294966756,-540>], 1
 75 8d ?? jne basic block L23

L32: 8b 8d ec fd ff ff ?? mov ecx, dword ss:[ebp + 0xfffffdec<4294966764,-532>]
 f6 c1 01 ?? test cl, 1
 75 82 ?? jne basic block L23

L33: d1 e9 ?? shr ecx, 1
 8b d1 ?? mov edx, ecx
 83 f9 02 ?? cmp ecx, 2
 0f 82 75 ff ff ff ?? jb basic block L23

L34: 49 ?? dec ecx
 8d 85 f4 fd ff ff ?? lea eax, ss:[ebp + 0xfffffdf4<4294966772,-524>]
 66 39 34 48 ?? cmp word ds:[eax + ecx * 2], si
 8d 04 48 ?? lea eax, ds:[eax + ecx * 2]
 0f 85 61 ff ff ff ?? jne basic block L23

L35: 66 83 78 fe 5c ?? cmp word ds:[eax + 0xfe<254,-2>], 0x5c<92>
 74 0a ?? je basic block L37

L36: b9 5c 00 00 00 ?? mov ecx, 0x0000005c<92>
 66 89 08 ?? mov word ds:[eax], cx
 8b ca ?? mov ecx, edx

L37: 8b c1 ?? mov eax, ecx
 f7 d0 ?? not eax
 83 f8 12 ?? cmp eax, 0x12<18>
 0f 82 43 ff ff ff ?? jb basic block L23

L38: 8d 41 11 ?? lea eax, ds:[ecx + 0x11<17>]
 3d 04 01 00 00 ?? cmp eax, 0x00000104<260>
 0f 87 35 ff ff ff ?? ja basic block L23

L39: a1 40 73 40 00 ?? mov eax, dword ds:[0x00407340<"bin\\MSPDB140.DLL">]
 89 84 4d f4 fd ff ff ?? mov dword ss:[ebp + 0xfffffdf4<4294966772,-524> + ecx * 2], eax
 a1 44 73 40 00 ?? mov eax, dword ds:[0x00407344<"n\\MSPDB140.DLL">]
 89 84 4d f8 fd ff ff ?? mov dword ss:[ebp + 0xfffffdf8<4294966776,-520> + ecx * 2], eax
 a1 48 73 40 00 ?? mov eax, dword ds:[0x00407348<"MSPDB140.DLL">]
 89 84 4d fc fd ff ff ?? mov dword ss:[ebp + 0xfffffdfc<4294966780,-516> + ecx * 2], eax
 a1 4c 73 40 00 ?? mov eax, dword ds:[0x0040734c<"PDB140.DLL">]
 89 84 4d 00 fe ff ff ?? mov dword ss:[ebp + 0xfffffe00<4294966784,-512> + ecx * 2], eax
 a1 50 73 40 00 ?? mov eax, dword ds:[0x00407350<"B140.DLL">]
 89 84 4d 04 fe ff ff ?? mov dword ss:[ebp + 0xfffffe04<4294966788,-508> + ecx * 2], eax
 a1 54 73 40 00 ?? mov eax, dword ds:[0x00407354<"40.DLL">]
 89 84 4d 08 fe ff ff ?? mov dword ss:[ebp + 0xfffffe08<4294966792,-504> + ecx * 2], eax
 a1 58 73 40 00 ?? mov eax, dword ds:[0x00407358<".DLL">]
 89 84 4d 0c fe ff ff ?? mov dword ss:[ebp + 0xfffffe0c<4294966796,-500> + ecx * 2], eax
 a1 5c 73 40 00 ?? mov eax, dword ds:[0x0040735c<"LL">]
 89 84 4d 10 fe ff ff ?? mov dword ss:[ebp + 0xfffffe10<4294966800,-496> + ecx * 2], eax
 66 a1 60 73 40 00 ?? mov ax, word ds:[0x00407360]
 68 00 09 00 00 ?? push 0x00000900<2304>
 66 89 84 4d 14 fe ff ff ?? mov word ss:[ebp + 0xfffffe14<4294966804,-492> + ecx * 2], ax
 8d 85 f4 fd ff ff ?? lea eax, ss:[ebp + 0xfffffdf4<4294966772,-524>]
 6a 00 ?? push 0
 50 ?? push eax
 e8 a3 0e 00 00 ?? call function 0x00404bbc

L40: 8b f0 ?? mov esi, eax
 83 c4 0c ?? add esp, 12
 85 f6 ?? test esi, esi
 75 1f ?? jne basic block L45

L41: ff 15 38 a0 40 00 ?? call dword ds:[0x0040a038]

L42: 83 f8 57 ?? cmp eax, 0x57<87>
 75 14 ?? jne basic block L45

L43: 6a 08 ?? push 8
 8d 85 f4 fd ff ff ?? lea eax, ss:[ebp + 0xfffffdf4<4294966772,-524>]
 56 ?? push esi
 50 ?? push eax
 e8 80 0e 00 00 ?? call function 0x00404bbc

L44: 83 c4 0c ?? add esp, 12
 8b f0 ?? mov esi, eax

L45: 8b 4d fc ?? mov ecx, dword ss:[ebp + 0xfc<252,-4>]
 8b c6 ?? mov eax, esi
 5b ?? pop ebx
 5e ?? pop esi
 33 cd ?? xor ecx, ebp
 5f ?? pop edi
 e8 72 d4 ff ff ?? call function 0x004011c2

L46: 8b e5 ?? mov esp, ebp
 5d ?? pop ebp
 c3 ?? ret

