Function at 0x435e70
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4adf7c
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x4e52d0]
xor eax, esp
mov dword [esp + 0x220], eax
push ebx
push esi
push edi
mov eax, dword [0x4e52d0]
xor eax, esp
push eax
lea eax, [esp + 0x238]
mov dword fs:[0], eax
mov ebx, ecx
push str.ShowWelcomeWindow
mov esi, str.SoftwareBaofengPhoneAssistantUserConfig
mov edi, SysReAllocStringLen
mov dword [esp + 0x1c], ebx
call fcn.00404940
add esp, 4
lea esi, [ebx + 0xa0]
lea eax, [esp + 0x14]
push esi
push eax
mov ebx, str.PhoneAssistant_
call fcn.00404520
add esp, 8
mov dword [esp + 0x240], 0
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
setne al
test al, al
jne 0x435f64
mov edx, dword [esp + 0x18]
cmp byte [edx + 0xb4], al
jne 0x435f80
mov ecx, dword [0x4eb380]
mov dword [esp + 0x240], 0xffffffff
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
cmp byte [ecx + 0x99], 0
jne 0x435f41
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x435f9f
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x435f5a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 0x3ea
jmp 0x4362aa
mov ecx, dword [esp + 0x18]
cmp byte [ecx + 0xb4], 0
je 0x435fb4
mov edx, dword [esp + 0x14]
push 0
push edx
call fcn.00403e90
add esp, 8
mov dword [esp + 0x240], 0xffffffff
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4362a5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x4362a5
mov ecx, dword [0x4eb380]
cmp byte [ecx + 0x99], 0
je 0x435f71
mov ecx, str.DriverInstallerX64.exe
call fcn.00401940
mov ecx, str.DriverInstallerX86.exe
call fcn.00401940
mov ecx, str.PhoneAppCenter.exe
call fcn.00401940
mov ecx, str.PhoneLauncher.exe
call fcn.00401940
mov ecx, str.PhoneMediaCenter.exe
call fcn.00401940
mov ecx, str.PhonePlatform.exe
call fcn.00401940
mov ecx, str.wandoujia_daemon.exe
call fcn.00401940
mov ecx, str.wdjconx64.exe
call fcn.00401940
mov ecx, str.wdjconx86.exe
call fcn.00401940
mov ecx, str.WDJDriverInstaller.exe
call fcn.00401940
mov ecx, str.BFVThumbHost.exe
call fcn.00401940
mov ecx, str.PhoneAssistantUpdate.exe
call fcn.00401940
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x2e]
push edx
mov word [esp + 0x30], cx
call fcn.004950a0
add esp, 0xc
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x24]
push edx
push str.InstallPath
push str.SoftwareBaofengPhoneAssistant
mov ebx, 1
push SysReAllocStringLen
mov dword [esp + 0x30], 0x102
mov dword [esp + 0x34], ebx
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x4360a6
push eax
call fcn.004017d0
add esp, 4
lea eax, [esp + 0x24]
push 0
push eax
call fcn.00403e90
add esp, 8
mov eax, dword [esi]
sub eax, 0x10
call fcn.004046f0
add eax, 0x10
mov dword [esp + 0x18], eax
mov byte [esp + 0x240], bl
mov eax, 0x5c
lea ebx, [esp + 0x18]
call fcn.0043d500
mov esi, dword [esp + 0x18]
push 0x5c
push esi
call fcn.00492744
add esp, 8
test eax, eax
je 0x4360e5
sub eax, esi
sar eax, 1
jns 0x43613e
lea eax, [esi - 0x10]
mov byte [esp + 0x240], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x436109
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x240], 0xffffffff
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x436134
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 0x3eb
jmp 0x4362aa
inc eax
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x18]
call fcn.00405040
lea edi, [esp + 0x18]
mov byte [esp + 0x240], 2
call fcn.00404600
mov bl, 1
mov byte [esp + 0x240], bl
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x436186
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, str.PhoneAssistant_
lea eax, [esp + 0x18]
call fcn.0040a4e0
mov esi, dword [esp + 0x18]
cmp dword [esi - 0xc], 0
lea eax, [esi - 0x10]
jne 0x4361f7
mov byte [esp + 0x240], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4361c2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x240], 0xffffffff
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4361ed
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 0x3ec
jmp 0x4362aa
push ecx
mov dword [esp + 0x20], esp
mov edi, esp
call fcn.004046f0
add eax, 0x10
mov dword [edi], eax
mov byte [esp + 0x244], 3
mov eax, dword [esp + 0x18]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x28], esp
mov edi, esp
call fcn.004046f0
add eax, 0x10
mov dword [edi], eax
mov byte [esp + 0x248], bl
call fcn.004040a0
mov ecx, dword [esp + 0x1c]
push 0
push ecx
mov edi, eax
call fcn.00403e90
add esp, 0x10
test edi, edi
jne 0x436262
lea ecx, [esp + 0x18]
call fcn.00401d40
lea ecx, [esp + 0x14]
call fcn.00401d40
mov eax, 0x3ed
jmp 0x4362aa
push esi
push str.InstallPath
mov edi, str.SoftwareBaofengPhoneAssistant
mov ebx, SysReAllocStringLen
call fcn.004048b0
add esp, 8
lea ecx, [esp + 0x18]
test al, al
jne 0x436297
call fcn.00401d40
lea ecx, [esp + 0x14]
call fcn.00401d40
mov eax, 0x3ee
jmp 0x4362aa
call fcn.00401d40
lea ecx, [esp + 0x14]
call fcn.00401d40
mov eax, 1
mov ecx, dword [esp + 0x238]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x220]
xor ecx, esp
call fcn.004912db
mov esp, ebp
pop ebp
ret