Function at 0x435740
Capabilities:
Create process on windows
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x278
mov eax, dword [0x466eb0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x466c18]
mov edx, dword [eax + 0xc]
push ebx
push esi
mov esi, ecx
push edi
mov ecx, 0x466c18
call edx
add eax, 0x10
mov dword [ebp - 0x23c], eax
lea eax, [ebp - 0x23c]
push eax
push str.InstallVersion
push str.SoftwareShendu_
call fcn.00434e10
push str.ShenduRom.exe
call fcn.0040e600
push str.shendu_adb.exe
call fcn.0040e600
add esp, 0x14
push 0x104
lea ecx, [ebp - 0x22c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [ebp - 0x22c]
push 0x5c
push edx
call fcn.0043ae50
add esp, 8
push str._shendurom.msi
push 0x104
lea edx, [ebp - 0x22c]
xor ecx, ecx
push edx
mov word [eax], cx
call fcn.0040dd90
mov eax, dword [0x466c18]
mov edx, dword [eax + 0xc]
mov ecx, 0x466c18
call edx
add eax, 0x10
mov dword [ebp - 0x238], eax
mov eax, dword [esi + 0x39c]
push eax
lea ecx, [ebp - 0x22c]
push ecx
lea edx, [ebp - 0x238]
push str.__i___s__TARGETDIR__s___quiet
push edx
call fcn.0040f1d0
push 0x38
lea eax, [ebp - 0x274]
push 0
push eax
call fcn.004391a0
mov ecx, dword [ebp - 0x238]
add esp, 0x1c
lea edx, [ebp - 0x278]
push edx
mov dword [ebp - 0x278], 0x3c
mov dword [ebp - 0x274], 0x40
mov dword [ebp - 0x26c], str.open
mov dword [ebp - 0x268], str.msiexec
mov dword [ebp - 0x264], ecx
mov dword [ebp - 0x25c], 5
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov eax, dword [ebp - 0x240]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov edi, dword [esi + 0x39c]
lea ecx, [ebp - 0x234]
push ecx
push str.SoftwareShendu_
push SysReAllocString
call ebx
test eax, eax
jne 0x4358e8
mov eax, edi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4358b0
sub eax, edx
sar eax, 1
lea edx, [eax + eax + 2]
mov eax, dword [ebp - 0x234]
push edx
push edi
push 1
push 0
push str.InstallPath
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 0x234]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x230]
push edx
call fcn.0040ea60
mov edi, dword [eax]
add esp, 4
lea eax, [ebp - 0x234]
push eax
push str.SoftwareShendu_
push SysReAllocString
call ebx
test eax, eax
jne 0x435951
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x435915
sub eax, edx
mov edx, dword [ebp - 0x234]
sar eax, 1
lea ecx, [eax + eax + 2]
push ecx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 1
push 0
push str.InstallVersion
push edx
call edi
mov eax, dword [ebp - 0x234]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x435957
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - 0x230]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x435979
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [0x466c18]
mov eax, dword [edx + 0xc]
mov ecx, 0x466c18
call eax
xor ecx, ecx
add eax, 0x10
cmp dword [esi + 0x3a0], 2
lea edx, [ebp - 0x234]
sete cl
mov dword [ebp - 0x234], eax
push ecx
push edx
call fcn.00434f90
add esp, 8
lea eax, [ebp - 0x230]
push eax
push str.SoftwareShendu
push SysReAllocString
call ebx
mov esi, dword [ebp - 0x234]
test eax, eax
jne 0x435a04
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4359d0
sub eax, edx
mov edx, dword [ebp - 0x230]
sar eax, 1
lea ecx, [eax + eax + 2]
push ecx
push esi
push 1
push 0
push str.ChannelNo
push edx
call edi
mov eax, dword [ebp - 0x230]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x10
lea ecx, [ebp - 0x24]
push ecx
push 0x2d
call fcn.00404bf0
add esp, 0xc
lea edx, [ebp - 0x230]
push edx
push str.SoftwareShendu
push SysReAllocString
call ebx
test eax, eax
jne 0x435a68
lea eax, [ebp - 0x24]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x435a31
sub eax, edx
mov edx, dword [ebp - 0x230]
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea ecx, [ebp - 0x24]
push ecx
push 1
push 0
push str.InstallTime
push edx
call edi
mov eax, dword [ebp - 0x230]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x230]
push ecx
call fcn.0040ea60
mov edx, dword [eax]
push edx
push esi
call fcn.00409450
mov eax, dword [ebp - 0x230]
add eax, 0xfffffff0
add esp, 0xc
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x435aa2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x230]
push ecx
call fcn.0040ea60
mov edx, dword [eax]
mov edi, dword [ebp - 0x23c]
push edx
push edi
push esi
call fcn.00409580
mov eax, dword [ebp - 0x230]
add eax, 0xfffffff0
add esp, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x435ae3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esi - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x435aff
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x238]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x435b21
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [edi - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
pop edi
pop esi
pop ebx
test edx, edx
jg 0x435b40
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00438fc8
mov esp, ebp
pop ebp
ret