Function at 0x100064c0
Capabilities:
Get installed programs
Read .ini file
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x1001aed0
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10023050]
xor eax, esp
push eax
lea eax, [esp + 0x3c]
mov dword fs:[0], eax
mov eax, dword [0x10023afc]
mov edx, dword [eax + 0xc]
mov ecx, 0x10023afc
call edx
add eax, 0x10
mov dword [esp + 0x18], eax
mov esi, dword [esp + 0x4c]
xor ebp, ebp
mov dword [esp + 0x44], ebp
mov eax, dword [esi + 8]
add esi, 8
push 0x1001c77c
push eax
call dword [sym.imp.MSVCR90.dll__mbsicmp]
add esp, 8
cmp eax, ebp
jne 0x10006568
push 0x1001c77c
push ecx
call fcn.10005760
add esp, 4
push eax
call fcn.10005410
push 0x1001c77c
call fcn.10005300
add esp, 4
mov edx, eax
cmp eax, ebp
jne 0x1000654c
mov edx, 0x1001c77c
mov eax, edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10006551
sub eax, esi
mov edi, eax
push edx
lea eax, [esp + 0x1c]
call fcn.10004760
jmp 0x10006575
mov eax, esi
lea ebx, [esp + 0x18]
call fcn.1000c020
xor ebp, ebp
mov eax, dword [0x10023afc]
mov edx, dword [eax + 0xc]
mov ecx, 0x10023afc
call edx
add eax, 0x10
mov dword [esp + 0x24], eax
mov byte [esp + 0x44], 1
mov ebx, dword [esp + 0x18]
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_s
lea edi, [esp + 0x2c]
call fcn.10002a40
add esp, 8
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], ebp
lea eax, [esp + 0x20]
push eax
push 0x2001f
mov byte [esp + 0x4c], 2
mov edi, dword [esp + 0x2c]
push ebp
push edi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x34], ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebp
jne 0x100065f5
push edi
push str.Open_Key_Sucess__s
push ebp
push 0x80
mov esi, 0x10023490
call fcn.10003ad0
mov eax, dword [esp + 0x30]
jmp 0x10006a0e
mov edx, edi
lea esi, [esp + 0x30]
call fcn.1000c950
test eax, eax
jne 0x100069ee
push edi
push str.CreateKey_Sucess__s
push ebp
push 0x80
mov esi, 0x10023490
call fcn.10003ad0
mov edx, dword [0x10023afc]
mov eax, dword [edx + 0xc]
add esp, 0x10
mov ecx, 0x10023afc
call eax
add eax, 0x10
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x4c]
mov byte [esp + 0x44], 3
mov edx, dword [ecx + 0xc]
push edx
push str._s_setup.exe
lea edi, [esp + 0x28]
call fcn.10002a40
mov esi, dword [esp + 0x28]
xor eax, eax
add esp, 8
cmp esi, ebp
setne al
cmp eax, ebp
mov ebp, dword [esp + 0x30]
je 0x10006683
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push esi
push 1
push 0
push str.DisplayIcon
push ebp
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [0x10023afc]
mov edx, dword [eax + 0xc]
mov ecx, 0x10023afc
call edx
add eax, 0x10
mov dword [esp + 0x14], eax
mov esi, dword [esp + 0x4c]
mov byte [esp + 0x44], 4
mov eax, dword [esi + 8]
mov edi, dword [sym.imp.MSVCR90.dll__mbsicmp]
add esi, 8
push 0x1001c77c
push eax
call edi
add esp, 8
test eax, eax
jne 0x100066c4
mov edx, 0x1001d16c
jmp 0x100066f0
mov eax, dword [esi]
push 0x1001cd00
push eax
call edi
add esp, 8
test eax, eax
jne 0x100066dc
mov edx, 0x1001d17c
jmp 0x100066f0
push esi
mov ecx, 0x1001cd04
call fcn.10004590
test eax, eax
jne 0x100066f9
mov edx, 0x1001d190
lea ebx, [esp + 0x14]
call fcn.10004550
mov esi, dword [esp + 0x14]
xor eax, eax
test esi, esi
setne al
test eax, eax
je 0x10006722
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push esi
push 1
push 0
push str.DisplayName
push ebp
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [0x10023afc]
mov edx, dword [eax + 0xc]
mov ecx, 0x10023afc
call edx
lea esi, [eax + 0x10]
mov dword [esp + 0x28], esi
mov byte [esp + 0x44], 5
mov eax, dword [0x10023afc]
mov edx, dword [eax + 0xc]
mov ecx, 0x10023afc
call edx
add eax, 0x10
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x4c]
mov byte [esp + 0x44], 6
mov ecx, dword [eax + 0x10]
push ecx
push str._sCompsVer.inf
lea edi, [esp + 0x24]
call fcn.10002a40
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
mov edi, 0x104
sub eax, edi
add esp, 8
or eax, ecx
jge 0x10006796
mov ecx, edi
lea eax, [esp + 0x28]
call fcn.10002ae0
mov esi, dword [esp + 0x28]
cmp dword [esi - 8], edi
jge 0x100067a5
push 0x80070057
call fcn.10002bf0
mov edx, dword [esp + 0x1c]
push edx
push edi
push esi
push str.24.00.00.00
push str.Version
mov dword [esi - 0xc], edi
push str.UPDATE
mov byte [esi + 0x104], 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, dword [esi - 8]
push eax
push esi
call dword [sym.imp.MSVCR90.dll_strnlen]
add esp, 8
test eax, eax
jl 0x1000679b
cmp eax, dword [esi - 8]
jg 0x1000679b
mov dword [esi - 0xc], eax
push esi
mov byte [eax + esi], 0
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
inc eax
push eax
push esi
push 1
push 0
push str.DisplayVersion
push ebp
call ebx
mov eax, dword [esp + 0x4c]
mov edi, dword [eax + 0x10]
xor eax, eax
test edi, edi
setne al
test eax, eax
je 0x1000682d
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push edi
push 1
push 0
push str.InstallLocation
push ebp
call ebx
push str.Beijing_Rising_Information_Technology__Inc.
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push str.Beijing_Rising_Information_Technology__Inc.
push 1
push 0
push str.Publisher
push ebp
call ebx
mov edx, dword [0x10023afc]
mov eax, dword [edx + 0xc]
mov ecx, 0x10023afc
call eax
add eax, 0x10
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x4c]
mov byte [esp + 0x44], 7
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
push ecx
push edx
push str.__s_setup.exe___UNINSTALL__PRODUCT_s
lea edi, [esp + 0x38]
call fcn.10002a40
mov edi, dword [esp + 0x38]
xor eax, eax
add esp, 0xc
test edi, edi
setne al
test eax, eax
je 0x100068a9
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push edi
push 1
push 0
push str.UninstallString
push ebp
call ebx
push str.http:__help.ikaka.com_
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push str.http:__help.ikaka.com_
push 1
push 0
push str.URLInfoAbout
push ebp
call ebx
push str.Restore
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push str.Restore
push 1
push 0
push str.From
push ebp
call ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebp, ebp
je 0x100068f8
push ebp
call ebx
xor ebp, ebp
mov dword [esp + 0x30], ebp
add edi, 0xfffffff0
mov dword [esp + 0x34], 0
mov byte [esp + 0x44], 6
lea eax, [edi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x10006921
mov ecx, dword [edi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push edi
call eax
mov byte [esp + 0x44], 5
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10006946
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
add esi, 0xfffffff0
mov byte [esp + 0x44], 4
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10006967
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
mov byte [esp + 0x44], 3
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000698c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x44], 2
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x100069b1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test ebp, ebp
je 0x100069b8
push ebp
call ebx
mov byte [esp + 0x44], 0
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x100069dd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x44], 0xffffffff
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
jmp 0x10006a48
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Create_Reg_Failed_Err_d
push ebp
push 0x80
mov esi, 0x10023490
call fcn.10003ad0
mov eax, dword [esp + 0x40]
add esp, 0x10
cmp eax, ebp
je 0x10006a1c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [edi - 0x10]
or edx, 0xffffffff
lea ecx, [eax + 0xc]
mov byte [esp + 0x44], 0
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10006a3d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [ebx - 0x10]
mov dword [esp + 0x44], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10006a61
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34
ret 4