Function at 0x437f0e
Capabilities:
Create thread
Delete registry key

Disassembly:
push 0x49c
mov eax, 0x4890bb
call fcn.0044465a
xor esi, esi
inc esi
push 0x4b755c
mov dword [ebp - 0x424], esi
mov dword [0x4b8044], esi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor edi, edi
push edi
push edi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x4b7f3c], eax
xor eax, eax
push 0x206
mov word [ebp - 0x420], ax
lea eax, [ebp - 0x41e]
push edi
push eax
call fcn.00444cd0
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
add esp, 0xc
push 0x104
lea eax, [ebp - 0x420]
push eax
push edi
call ebx
push 0x48ea88
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
sub esp, 0x18
mov dword [ebp - 0x428], esp
mov eax, esp
je 0x437fad
mov dword [eax], vtable.std::tr1::_Impl_base1_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t____class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__.0
mov dword [eax], 0x4953e4
mov dword [eax + 4], fcn.0041847f
mov dword [eax + 0x10], eax
lea eax, [ebp - 0x460]
push eax
mov edx, 0x4952ec
mov ecx, str.Softwareprojonepodlpdebugplugin_
mov dword [ebp - 4], edi
call fcn.0041dd22
pop ecx
mov byte [ebp - 4], 1
cmp dword [eax + 0x18], 8
jb 0x437fd9
mov eax, dword [eax + 4]
jmp 0x437fdc
add eax, 4
push 0x4952e8
push eax
lea eax, [ebp - 0x440]
push eax
call fcn.0041d947
add esp, 0xc
lea ecx, [ebp - 0x488]
push ecx
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.0040b0d2
pop ecx
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x4a8]
push ecx
mov ecx, eax
mov byte [ebp - 4], 6
call fcn.004183ca
add esp, 0x1c
mov dword [ebp - 0x428], eax
mov esi, 0x4b8720
mov byte [ebp - 4], 7
cmp eax, esi
je 0x43805c
mov eax, dword [0x4b8738]
mov ecx, dword [0x4b8720]
mov edx, dword [eax]
push eax
push ecx
push edx
push ecx
lea eax, [ebp - 0x468]
push eax
mov eax, esi
call fcn.00409b8d
mov eax, dword [ebp - 0x428]
mov ecx, esi
call fcn.0040b1bd
lea eax, [ebp - 0x4a8]
push eax
mov byte [ebp - 4], 6
call fcn.00408b66
lea eax, [ebp - 0x488]
push eax
mov byte [ebp - 4], 5
call fcn.00408b66
lea esi, [ebp - 0x440]
call fcn.00404199
push dword [ebp - 0x440]
call fcn.004437e4
or dword [ebp - 4], 0xffffffff
pop ecx
push edi
push 1
lea esi, [ebp - 0x460]
call fcn.00403d0d
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push edi
push eax
call fcn.00444cd0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x218]
push eax
push edi
call ebx
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea esi, [ebp - 0x444]
call fcn.004034dc
mov eax, esi
push eax
lea eax, [ebp - 0x460]
push eax
mov dword [ebp - 4], 8
call fcn.0040125c
cmp dword [eax + 0x18], 0x10
pop ecx
pop ecx
jb 0x43810e
mov eax, dword [eax + 4]
jmp 0x438111
add eax, 4
push eax
mov ebx, 0x4b7f40
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
push 1
lea ecx, [ebp - 0x460]
call fcn.00403c15
or dword [ebp - 4], 0xffffffff
push edi
push 1
lea esi, [ebp - 0x444]
call fcn.00403d0d
lea ecx, [ebp - 0x218]
call fcn.00437050
push ebx
push str.Softwareprojonepodlpdebugplugin_
push str._s_hs
mov esi, 0x4b8048
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push esi
push reloc.WS2_32.dll_bind
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push edi
push edi
lea eax, [ebp - 0x424]
push eax
push 0x43742e
push edi
lea eax, [ebp - 0x420]
push eax
call fcn.0041b768
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push edi
push edi
push dword [ebp - 0x424]
push 0x4379d1
push 0x20000
push edi
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call ebx
cmp dword [ebp - 0x424], 1
mov ecx, str.service
je 0x4381c1
mov ecx, 0x494e64
push str.PLUG_LOADED
call fcn.00437568
push dword [0x4b7f3c]
call dword [sym.imp.KERNEL32.dll_SetEvent]
cmp dword [ebp - 0x424], 1
mov ecx, str.service
je 0x4381ea
mov ecx, 0x494e64
push str.PLUG_INITED
call fcn.00437568
push str.3A0419DE
push 0x48fa18
call fcn.0041e054
pop ecx
pop ecx
test al, al
je 0x43821c
push edi
push edi
push edi
push 0x437efa
push 0x10000
push edi
call esi
push eax
call ebx
call fcn.004446dd
ret