Function at 0x100056e0
Capabilities:
Set registry value
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x1001b8f7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
push ebx
push ebp
push esi
push edi
mov esi, ecx
mov dword [esp + 0x30], 0
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x4c], 1
mov edi, str.ok668ok_E11E4F4B38DACC9566C010F0192779DAD5C926FFE24A0BAA2DE61E9E3C382E52E6FE7D6D17940668
mov dl, byte [eax]
mov bl, byte [edi]
mov cl, dl
cmp dl, bl
jne 0x1000573f
test cl, cl
je 0x1000573b
mov dl, byte [eax + 1]
mov bl, byte [edi + 1]
mov cl, dl
cmp dl, bl
jne 0x1000573f
add eax, 2
add edi, 2
test cl, cl
jne 0x10005717
xor eax, eax
jmp 0x10005744
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1000574f
push 0
call fcn.1000a70c
mov eax, dword [0x1002512c]
mov dword [esp + 0x14], eax
push str.Shiyan
lea ecx, [esp + 0x14]
mov byte [esp + 0x50], 2
call fcn.10012996
lea ecx, [esp + 0x10]
lea edx, [esp + 0x2c]
push ecx
push str.SoftwareMicrosoftCaiTong_
push edx
mov byte [esp + 0x58], 3
call fcn.10012bf0
push str.UserInfo_
push eax
lea eax, [esp + 0x30]
mov byte [esp + 0x54], 4
push eax
call fcn.10012b7c
mov edi, dword [eax]
lea ecx, [esp + 0x28]
call fcn.10012928
lea ecx, [esp + 0x2c]
mov byte [esp + 0x4c], 3
call fcn.10012928
lea ecx, [esp + 0x18]
push ecx
push edi
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x100057d8
lea edx, [esp + 0x18]
push edx
push edi
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
push 0x33
call fcn.10012669
mov edi, eax
mov ecx, 0xc
xor eax, eax
add esp, 4
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esi + 0xec]
lea ecx, [esp + 0x10]
push eax
call fcn.10012a61
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx - 8]
lea ecx, [esp + 0x10]
inc eax
push eax
call fcn.10012d17
mov edx, dword [esp + 0x10]
mov edi, eax
mov ebp, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [edx - 8]
inc eax
push eax
mov eax, dword [esp + 0x1c]
push edi
push 1
push 0
push str.DefName
push eax
call ebp
mov ecx, 0xc
xor eax, eax
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ebx, [esi + 0x470]
lea ecx, [esp + 0x10]
push ebx
stosb byte es:[edi], al
call fcn.10012a61
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx - 8]
lea ecx, [esp + 0x10]
inc eax
push eax
call fcn.10012d17
mov edx, dword [esp + 0x10]
mov edi, eax
mov eax, dword [edx - 8]
inc eax
push eax
mov eax, dword [esp + 0x1c]
push edi
push 1
push 0
push str.Path
push eax
call ebp
mov ecx, 0xc
xor eax, eax
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push str.20131109
lea ecx, [esp + 0x14]
stosb byte es:[edi], al
call fcn.10012ab1
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx - 8]
lea ecx, [esp + 0x10]
inc eax
push eax
call fcn.10012d17
mov edx, dword [esp + 0x10]
mov edi, eax
mov eax, dword [edx - 8]
inc eax
push eax
push edi
push 1
push 0
mov eax, dword [esp + 0x28]
push str.FirstDate
push eax
call ebp
mov ecx, 0xc
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x5c]
stosw word es:[edi], ax
stosb byte es:[edi], al
push ecx
push ecx
lea edi, [esi + 0x158]
mov ecx, esp
mov dword [esp + 0x34], esp
push edi
call fcn.10012996
mov ecx, esi
call fcn.10004be0
test al, al
mov eax, 0x100245b4
jne 0x100058ff
mov eax, 0x100245b0
push eax
lea ecx, [esp + 0x14]
call fcn.10012ab1
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x10]
mov eax, dword [edx - 8]
inc eax
push eax
call fcn.10012d17
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x2c], eax
mov ecx, dword [ecx - 8]
inc ecx
push ecx
push eax
push 1
push 0
push str.DemoVer
push edx
call ebp
mov eax, dword [esp + 0x2c]
push eax
call fcn.10012692
mov ecx, dword [esp + 0x1c]
add esp, 4
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
lea ecx, [esp + 0x18]
call fcn.10012a61
push str.Shiyan
lea ecx, [esp + 0x18]
call fcn.10012cc3
push 0x100245a0
lea ecx, [esp + 0x18]
call fcn.10012cc3
mov edx, dword [esp + 0x5c]
push edx
push ecx
mov ecx, esp
mov dword [esp + 0x64], esp
push edi
call fcn.10012996
mov ecx, esi
call fcn.10004be0
test al, al
mov eax, 0x100245b4
jne 0x1000599e
mov eax, 0x100245b0
push eax
lea ecx, [esp + 0x14]
call fcn.10012ab1
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push eax
push ecx
push str.DemoVer
push str.Options
call esi
mov edx, dword [esp + 0x14]
push edx
push 0x10026420
push str.Information
push str.Options
call esi
mov eax, dword [esp + 0x14]
push eax
push 0x10026420
push str.Iconame
push str.Options
call esi
mov ecx, dword [esp + 0x14]
push ecx
push 0x10026420
push str.Filename
push str.Options
call esi
mov edx, dword [esp + 0x14]
mov ebx, dword [ebx]
push edx
push ebx
push str.Path
push str.Options
call esi
mov eax, dword [esp + 0x14]
push eax
push 0x10026420
push str.DefName
push str.Default
call esi
mov ecx, dword [esp + 0x14]
push ecx
push 0x10026420
push str.DefCompany
push str.Default
call esi
mov edx, dword [esp + 0x14]
push edx
push 0x10026420
push str.password
push str.Default
call esi
mov eax, dword [esp + 0x14]
push eax
push str.Chinese_Simplified_
push str.Languages
push str.Running
call esi
mov ecx, dword [esp + 0x14]
push ecx
push str.20131109
push str.FirstDate
push str.Running
call esi
xor edx, edx
lea eax, [esp + 0x34]
mov dword [esp + 0x36], edx
push eax
mov dword [esp + 0x3e], edx
mov word [esp + 0x38], 0
mov dword [esp + 0x42], edx
mov word [esp + 0x46], dx
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
mov eax, dword [0x1002512c]
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x34]
lea edx, [esp + 0x24]
and ecx, 0xffff
mov bl, 7
push ecx
push 0x1002430c
push edx
mov byte [esp + 0x58], bl
call fcn.100120bc
mov eax, dword [esp + 0x42]
lea ecx, [esp + 0x2c]
and eax, 0xffff
push eax
push str._.2d
push ecx
call fcn.100120bc
mov edx, dword [esp + 0x52]
lea eax, [esp + 0x34]
and edx, 0xffff
push edx
push str._.2d
push eax
call fcn.100120bc
add esp, 0x24
lea ecx, [esp + 0x20]
lea edx, [esp + 0x24]
lea eax, [esp + 0x2c]
push ecx
push edx
push eax
call fcn.10012b16
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x5c]
push ecx
push eax
push edx
mov byte [esp + 0x58], 8
call fcn.10012b16
mov ecx, dword [esp + 0x14]
mov eax, dword [eax]
push ecx
push eax
push str.CursorDate
push str.Running
call esi
lea ecx, [esp + 0x5c]
call fcn.10012928
lea ecx, [esp + 0x2c]
mov byte [esp + 0x4c], bl
call fcn.10012928
mov esi, dword [esp + 0x54]
lea edx, [esp + 0x14]
push edx
mov ecx, esi
call fcn.1001269d
mov dword [esp + 0x30], 1
lea ecx, [esp + 0x1c]
mov byte [esp + 0x4c], 6
call fcn.10012928
lea ecx, [esp + 0x20]
mov byte [esp + 0x4c], 5
call fcn.10012928
lea ecx, [esp + 0x24]
mov byte [esp + 0x4c], 3
call fcn.10012928
lea ecx, [esp + 0x10]
mov byte [esp + 0x4c], 2
call fcn.10012928
lea ecx, [esp + 0x14]
mov byte [esp + 0x4c], 1
call fcn.10012928
lea ecx, [esp + 0x58]
mov byte [esp + 0x4c], 0
call fcn.10012928
mov ecx, dword [esp + 0x44]
mov eax, esi
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret 0xc