Function at 0x10003180
Capabilities:
Delete file
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10005480
push 0x10004400
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x610
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov byte [ebp - 0x620], 0
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x61f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push str.plugins
push str.SOFTWAREMicrosoftWindowsCurrentVersionModList
push reloc.WS2_32.dll_bind
call fcn.10001000
add esp, 0xc
test eax, eax
je 0x1000321a
push str.plugins
push str.SOFTWAREMicrosoftWindowsCurrentVersionModList
push reloc.WS2_32.dll_bind
call fcn.10001070
add esp, 0xc
push eax
lea eax, [ebp - 0x620]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [ebp - 0x620]
push ecx
mov ebx, dword [ebp + 8]
push ebx
call fcn.10001380
add esp, 8
cmp eax, 0xffffffff
jne 0x1000322f
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea edx, [ebp - 0x620]
push edx
push ebx
call fcn.10001380
push eax
push 0
lea eax, [ebp - 0x620]
push eax
call fcn.10001490
add esp, 0x14
mov dword [ebp - 0x20], eax
lea esi, [ebp - 0x620]
lea ecx, [esi + 1]
lea ebx, [ebx]
mov al, byte [esi]
inc esi
test al, al
jne 0x10003260
sub esi, ecx
mov eax, ebx
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10003270
sub eax, edx
mov dword [ebp - 0x1c], eax
mov eax, ebx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10003281
sub eax, edi
mov edi, eax
lea ecx, [ebp - 0x620]
push ecx
push ebx
call fcn.10001380
add esp, 8
sub esi, dword [ebp - 0x1c]
sub esi, eax
dec esi
push esi
lea edx, [ebp - 0x620]
push edx
push ebx
call fcn.10001380
add esp, 8
lea eax, [eax + edi + 1]
push eax
lea ecx, [ebp - 0x620]
push ecx
call fcn.10001490
add esp, 0xc
mov esi, eax
mov edi, dword [ebp - 0x20]
push edi
lea edx, [ebp - 0x620]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
lea eax, [ebp - 0x620]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [ebp - 0x620]
push ecx
push str.plugins
push str.SOFTWAREMicrosoftWindowsCurrentVersionModList
push reloc.WS2_32.dll_bind
call fcn.10001180
add esp, 0x10
test edi, edi
je 0x10003311
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
test esi, esi
je 0x1000331c
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [ebp - 4], 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 4], 0xffffffff
jmp 0x1000334a
mov byte [ebp - 0x120], 0
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0x11f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x220], 0
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0x21f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push ebx
push str.__temp___s
lea edx, [ebp - 0x120]
push edx
call sub.MSVCRT.dll_sprintf
add esp, 0xc
push 0x100
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x120]
push ecx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea edx, [ebp - 0x220]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4