I would suggest to use procmon.exe, all file and registry accesses could have been monitored without any disassembly and the problem could probably have be resolved much easier.
Sorry my bad it is the very last tool used, which does in fact lead to success, I guess documenting all this other stuff might help somebody somewhere, or at least persuade people to skip the superfluous efforts and just go right to procmon
