Function at 0x4343b0
Capabilities:
Create process on windows
Delete file
Delete registry key
Delete registry value
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4534d0
mov eax, dword fs:[0]
push eax
sub esp, 0x9d4
mov eax, dword [0x466eb0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 0x10]
xor ebx, ebx
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_DefWindowProcW]
mov dword [ebp - 0x9e0], 8
mov dword [ebp - 0x9dc], 4
lea eax, [ebp - 0x9e0]
push eax
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov dword [0x469278], ebx
mov esi, dword [0x469460]
cmp esi, dword [0x469464]
jae 0x434448
lea esp, [esp]
mov eax, dword [esi]
cmp eax, ebx
je 0x43443d
push 1
mov ecx, dword [eax + 0x20]
call ecx
add esi, 4
cmp esi, dword [0x469464]
jb 0x434430
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x46927c], eax
mov dword [0x469280], ebx
push 0xc
call fcn.00401710
add esp, 4
cmp eax, ebx
je 0x4345d8
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [0x469280], eax
mov dword [0x469284], ebx
push 0x104
lea edx, [ebp - 0x62c]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str._Uninstall
push edi
call fcn.00438ec4
add esp, 8
cmp eax, edi
jne 0x4345e3
push str.shendu_adb.exe
call fcn.0040e600
push str.adb.exe
call fcn.0040e600
push 0x20
push edi
call fcn.00438e9d
add esp, 0x10
cmp eax, ebx
je 0x43455f
lea esi, [eax + 2]
push esi
push str._s.lnk
push 0x104
lea eax, [ebp - 0x424]
push eax
call fcn.00409380
add esp, 0x10
lea ecx, [ebp - 0x87c]
push ecx
lea edx, [ebp - 0x424]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x43455f
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea esp, [esp]
cmp word [ebp - 0x850], 0x2e
je 0x434544
lea eax, [ebp - 0x850]
push eax
push esi
push str._s_s
push 0x104
lea ecx, [ebp - 0x21c]
push ecx
call fcn.00409380
add esp, 0x14
lea edx, [ebp - 0x21c]
push edx
call ebx
lea eax, [ebp - 0x87c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x434510
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor ebx, ebx
lea ecx, [ebp - 0x9dc]
push ecx
push 0x20006
push ebx
push str.SoftwareShendu
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4346e7
push str.ChannelNo
mov edx, dword [ebp - 0x9dc]
push edx
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
call esi
push str.InstallTime
mov eax, dword [ebp - 0x9dc]
push eax
call esi
push str.LastFlashTime
mov ecx, dword [ebp - 0x9dc]
push ecx
call esi
push 0x457908
mov edx, dword [ebp - 0x9dc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov eax, dword [ebp - 0x9dc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4346e7
mov dword [0x469280], ebx
jmp 0x43447e
push 0x457900
push edi
call fcn.00438ec4
add esp, 8
cmp eax, edi
jne 0x43460f
push 5
push ebx
push edi
push str.msiexec
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x4346e7
xor esi, esi
push str._rom
push edi
call fcn.00438ec4
add esp, 8
cmp eax, edi
jne 0x434646
mov esi, 1
push 0x34
call fcn.004211c0
push 0xfffffffffffffff4
push 0x4574bc
call fcn.00421620
push 0x36
call fcn.00433850
push 0x37
jmp 0x434697
push 0x4578d4
push edi
call fcn.00438ec4
add esp, 8
cmp eax, edi
jne 0x43467b
mov esi, 2
push 0x3c
call fcn.004211c0
push 0xfffffffffffffff4
push 0x4574bc
call fcn.00421620
push 0x3a
call fcn.00433850
push 0x3b
jmp 0x434697
push 0x34
call fcn.004211c0
push 0xfffffffffffffff4
push 0x4574bc
call fcn.00421620
push 0x32
call fcn.00433850
push 0x33
call fcn.004338e0
add esp, 0x14
mov dword [ebp - 4], ebx
push edi
push esi
lea ecx, [ebp - 0x9d8]
call fcn.00433970
push ebx
push ebx
lea ecx, [ebp - 0x9d8]
call fcn.00431a00
lea ecx, [ebp - 0x9d8]
call fcn.00431980
mov dword [ebp - 4], 0xffffffff
jmp 0x4346e7
mov ecx, 0x46924c
call fcn.0041d1b0
mov esi, dword [0x469280]
cmp esi, ebx
je 0x43472b
mov eax, dword [esi]
cmp eax, ebx
je 0x43470c
push eax
call fcn.00439225
add esp, 4
mov dword [esi], ebx
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x43471f
push eax
call fcn.00439225
add esp, 4
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
push esi
call fcn.00438e41
add esp, 4
mov ecx, 0x46924c
call fcn.00418f50
call dword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00438fc8
mov esp, ebp
pop ebp
ret 0x10