Function at 0x100033d0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x610
push ebx
push ebp
push esi
push edi
push 0xe000
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [0x100060a8], eax
xor eax, eax
jmp 0x10003400
mov ecx, dword [0x100060a8]
mov dword [eax + ecx + 0x34], edi
mov edx, dword [0x100060a8]
mov byte [eax + edx], 0
add eax, 0x38
cmp eax, 0xe000
jl 0x10003400
push 0x10002fa0
push 0x10005494
call fcn.10002e00
push fcn.10003180
push str.unload
call fcn.10002e00
add esp, 0x10
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x18]
push ecx
push edi
push 0xf003f
push edi
push edi
push edi
push str.SOFTWAREMicrosoftWindowsCurrentVersionModList
push reloc.WS2_32.dll_bind
mov dword [esp + 0x38], edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x18]
push edx
push edi
push edi
push edi
push str.plugins
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0x14]
mov esi, eax
neg esi
sbb esi, esi
push ecx
inc esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, edi
je 0x10003602
mov byte [esp + 0x220], 0
xor eax, eax
mov ecx, 0xff
lea edi, [esp + 0x221]
rep stosd dword es:[edi], eax
push str.plugins
stosw word es:[edi], ax
push str.SOFTWAREMicrosoftWindowsCurrentVersionModList
push reloc.WS2_32.dll_bind
stosb byte es:[edi], al
call fcn.10001070
add esp, 0xc
push eax
lea edx, [esp + 0x224]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ebp, [esp + 0x220]
mov eax, ebp
push eax
push 0x10005470
call fcn.10001380
mov esi, eax
add esp, 8
cmp esi, 0xffffffff
je 0x10003602
jmp 0x10003500
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x10003532
mov ecx, esi
mov edx, ecx
shr ecx, 2
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
push esi
mov ecx, edx
and ecx, 3
push ebp
push ebx
rep stosb byte es:[edi], al
call sub.MSVCRT.dll_strncpy
add esp, 0xc
mov byte [ebx + esi], 0
xor eax, eax
mov byte [esp + 0x20], 0
mov ecx, 0x3f
lea edi, [esp + 0x21]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x120], 0
mov ecx, 0x3f
lea edi, [esp + 0x121]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push ebx
stosb byte es:[edi], al
lea eax, [esp + 0x24]
push str.__temp___s
push eax
call sub.MSVCRT.dll_sprintf
add esp, 0xc
push 0x100
lea ecx, [esp + 0x124]
push ecx
lea edx, [esp + 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea eax, [esp + 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x100035b1
push str.InitDll
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
jne 0x100035c4
push ebx
call fcn.10003180
test ebx, ebx
je 0x100035e5
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x100035e5
test ebx, ebx
je 0x100035cf
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0x10002e80
push fcn.10002d40
push fcn.10002da0
push fcn.10002e00
call edi
lea ebp, [esi + ebp + 1]
push ebp
push 0x10005470
call fcn.10001380
mov esi, eax
add esp, 8
cmp esi, 0xffffffff
jne 0x10003500
pop edi
mov eax, 1
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret