rendered paste body0040857B . 8D45 FC LEA EAX,DWORD PTR SS:[EBP-4]
0040857E . 50 PUSH EAX ; /pHandle
0040857F . 68 19000200 PUSH 20019 ; |Access = KEY_READ
00408584 . 6A 00 PUSH 0 ; |Reserved = 0
00408586 . 68 00864000 PUSH HTSNoteP.00408600 ; |Subkey = "SOFTWARE\Microsoft\Windows\CurrentVersion"
0040858B . 68 02000080 PUSH 80000002 ; |hKey = HKEY_LOCAL_MACHINE
00408590 . E8 6BC0FFFF CALL <JMP.&advapi32.RegOpenKeyExA> ; \RegOpenKeyExA
00408595 . 8D45 F8 LEA EAX,DWORD PTR SS:[EBP-8]
00408598 . 50 PUSH EAX ; /pBufSize
00408599 . 53 PUSH EBX ; |Buffer
0040859A . 6A 00 PUSH 0 ; |pValueType = NULL
0040859C . 6A 00 PUSH 0 ; |Reserved = NULL
0040859E . 68 2C864000 PUSH HTSNoteP.0040862C ; |ValueName = "ProgramFilesDir"
004085A3 . 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4] ; |
004085A6 . 50 PUSH EAX ; |hKey
004085A7 . E8 5CC0FFFF CALL <JMP.&advapi32.RegQueryValueExA> ; \RegQueryValueExA
004085AC . 8D45 F4 LEA EAX,DWORD PTR SS:[EBP-C]
004085AF . 8BD3 MOV EDX,EBX
004085B1 . E8 62B2FFFF CALL HTSNoteP.00403818
004085B6 . 8B55 F4 MOV EDX,DWORD PTR SS:[EBP-C]
004085B9 . 8BC6 MOV EAX,ESI
004085BB . B9 44864000 MOV ECX,HTSNoteP.00408644
004085C0 . E8 37B3FFFF CALL HTSNoteP.004038FC
004085C5 . 33C0 XOR EAX,EAX
004085C7 . 5A POP EDX
004085C8 . 59 POP ECX
004085C9 . 59 POP ECX
004085CA . 64:8910 MOV DWORD PTR FS:[EAX],EDX
004085CD . EB 0A JMP SHORT HTSNoteP.004085D9
004085CF .^E9 64A9FFFF JMP HTSNoteP.00402F38
004085D4 . E8 3FABFFFF CALL HTSNoteP.00403118
004085D9 > 33C0 XOR EAX,EAX
004085DB . 5A POP EDX
004085DC . 59 POP ECX
004085DD . 59 POP ECX
004085DE . 64:8910 MOV DWORD PTR FS:[EAX],EDX
004085E1 . 68 F6854000 PUSH HTSNoteP.004085F6
004085E6 > 8D45 F4 LEA EAX,DWORD PTR SS:[EBP-C]
004085E9 . E8 4EB0FFFF CALL HTSNoteP.0040363C
004085EE . C3 RETN
004085EF .^E9 70AAFFFF JMP HTSNoteP.00403064
004085F4 .^EB F0 JMP SHORT HTSNoteP.004085E6
004085F6 . 5F POP EDI
004085F7 . 5E POP ESI
004085F8 . 5B POP EBX
004085F9 . 8BE5 MOV ESP,EBP
004085FB . 5D POP EBP
004085FC . C3 RETN
004085FD 00 DB 00
004085FE 00 DB 00
004085FF 00 DB 00
00408600 . 53 4F 46 54 57>ASCII "SOFTWARE\Microso"
00408610 . 66 74 5C 57 69>ASCII "ft\Windows\Curre"
00408620 . 6E 74 56 65 72>ASCII "ntVersion",0
0040862A 00 DB 00
0040862B 00 DB 00
0040862C . 50 72 6F 67 72>ASCII "ProgramFilesDir",0
0040863C . FFFFFFFF DD FFFFFFFF
00408640 . 01000000 DD 00000001
00408644 . 5C 00 ASCII "\",0
00408646 00 DB 00
00408647 00 DB 00
00408648 $ 55 PUSH EBP
00408649 . 8BEC MOV EBP,ESP
0040864B . 83C4 EC ADD ESP,-14
0040864E . 53 PUSH EBX
0040864F . 56 PUSH ESI
00408650 . 8955 F8 MOV DWORD PTR SS:[EBP-8],EDX
00408653 . 8945 FC MOV DWORD PTR SS:[EBP-4],EAX
00408656 . 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
00408659 . E8 9EB3FFFF CALL HTSNoteP.004039FC
0040865E . 8B45 F8 MOV EAX,DWORD PTR SS:[EBP-8]
00408661 . E8 96B3FFFF CALL HTSNoteP.004039FC
00408666 . 33C0 XOR EAX,EAX
00408668 . 55 PUSH EBP
00408669 . 68 45874000 PUSH HTSNoteP.00408745
0040866E . 64:FF30 PUSH DWORD PTR FS:[EAX]
00408671 . 64:8920 MOV DWORD PTR FS:[EAX],ESP
00408674 . C645 F7 00 MOV BYTE PTR SS:[EBP-9],0
00408678 . 68 58874000 PUSH HTSNoteP.00408758 ; ASCII "TMP"
0040867D . 8D45 FC LEA EAX,DWORD PTR SS:[EBP-4]
00408680 . E8 D7B3FFFF CALL HTSNoteP.00403A5C
00408685 . 50 PUSH EAX ; |ResourceName
00408686 . A1 60A64000 MOV EAX,DWORD PTR DS:[40A660] ; |
0040868B . 50 PUSH EAX ; |hModule => NULL
0040868C . E8 AFBFFFFF CALL <JMP.&kernel32.FindResourceA> ; \FindResourceA
00408691 . 8BD8 MOV EBX,EAX
00408693 . 53 PUSH EBX ; /hResource
00408694 . A1 60A64000 MOV EAX,DWORD PTR DS:[40A660] ; |
00408699 . 50 PUSH EAX ; |hModule => NULL
0040869A . E8 19C0FFFF CALL <JMP.&kernel32.LoadResource> ; \LoadResource
0040869F . 8BF0 MOV ESI,EAX
004086A1 . 53 PUSH EBX ; /hResource
004086A2 . A1 60A64000 MOV EAX,DWORD PTR DS:[40A660] ; |
004086A7 . 50 PUSH EAX ; |hModule => NULL
004086A8 . E8 33C0FFFF CALL <JMP.&kernel32.SizeofResource> ; \SizeofResource
004086AD . 8BD8 MOV EBX,EAX
004086AF . 6A 00 PUSH 0
004086B1 . 6A 20 PUSH 20
004086B3 . 6A 02 PUSH 2
004086B5 . 6A 00 PUSH 0
004086B7 . 6A 03 PUSH 3
004086B9 . 68 000000C0 PUSH C0000000
004086BE . 8D45 F8 LEA EAX,DWORD PTR SS:[EBP-8]
004086C1 . E8 96B3FFFF CALL HTSNoteP.00403A5C
004086C6 . 50 PUSH EAX ; |FileName
004086C7 . E8 54BFFFFF CALL <JMP.&kernel32.CreateFileA> ; \CreateFileA
004086CC . 8945 EC MOV DWORD PTR SS:[EBP-14],EAX
004086CF . 837D EC FF CMP DWORD PTR SS:[EBP-14],-1
004086D3 . 74 55 JE SHORT HTSNoteP.0040872A
004086D5 . 33C0 XOR EAX,EAX
004086D7 . 55 PUSH EBP
004086D8 . 68 23874000 PUSH HTSNoteP.00408723
004086DD . 64:FF30 PUSH DWORD PTR FS:[EAX]
004086E0 . 64:8920 MOV DWORD PTR FS:[EAX],ESP
004086E3 . 6A 00 PUSH 0 ; /pOverlapped = NULL
004086E5 . 8D45 F0 LEA EAX,DWORD PTR SS:[EBP-10] ; |
004086E8 . 50 PUSH EAX ; |pBytesWritten
004086E9 . 53 PUSH EBX ; |nBytesToWrite
004086EA . 56 PUSH ESI ; |/hResource
004086EB . E8 D8BFFFFF CALL <JMP.&kernel32.LockResource> ; |\LockResource
004086F0 . 50 PUSH EAX ; |Buffer
004086F1 . 8B45 EC MOV EAX,DWORD PTR SS:[EBP-14] ; |
004086F4 . 50 PUSH EAX ; |hFile
004086F5 . E8 06C0FFFF CALL <JMP.&kernel32.WriteFile> ; \WriteFile
004086FA . 85C0 TEST EAX,EAX