Function at 0x41fe5d
Capabilities:
Create thread
Delete registry key

Disassembly:
push 0x49c
mov eax, 0x444d90
call fcn.0042a4aa
push 2
pop eax
push 0x457b48
mov dword [ebp - 0x424], eax
mov dword [0x458b64], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor edi, edi
push edi
push edi
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x458a5c], eax
xor eax, eax
push 0x206
mov word [ebp - 0x420], ax
lea eax, [ebp - 0x41e]
push edi
push eax
call fcn.0042b7e0
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
add esp, 0xc
push 0x104
lea eax, [ebp - 0x420]
push eax
push edi
call ebx
push 0x449978
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
sub esp, 0x18
mov dword [ebp - 0x428], esp
mov eax, esp
je 0x41fefc
mov dword [eax], vtable.std::tr1::_Impl_base1_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t____class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__.0
mov dword [eax], 0x44b3a4
mov dword [eax + 4], fcn.0040ef24
mov dword [eax + 0x10], eax
lea eax, [ebp - 0x460]
push eax
mov edx, 0x44b2a4
mov ecx, str.Softwareprojonepodlpdebugplugin_
mov dword [ebp - 4], edi
call fcn.0040cdb6
pop ecx
mov byte [ebp - 4], 1
cmp dword [eax + 0x18], 8
jb 0x41ff28
mov eax, dword [eax + 4]
jmp 0x41ff2b
add eax, 4
push 0x44b2a0
push eax
lea eax, [ebp - 0x440]
push eax
call fcn.0040caf6
add esp, 0xc
lea ecx, [ebp - 0x488]
push ecx
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.004042b7
pop ecx
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x4a8]
push ecx
mov ecx, eax
mov byte [ebp - 4], 6
call fcn.00421489
add esp, 0x1c
mov dword [ebp - 0x428], eax
mov esi, 0x45920c
mov byte [ebp - 4], 7
cmp eax, esi
je 0x41ffab
mov eax, dword [0x459224]
mov ecx, dword [0x45920c]
mov edx, dword [eax]
push eax
push ecx
push edx
push ecx
lea eax, [ebp - 0x468]
push eax
mov eax, esi
call fcn.0040365c
mov eax, dword [ebp - 0x428]
mov ecx, esi
call fcn.00404372
lea eax, [ebp - 0x4a8]
push eax
mov byte [ebp - 4], 6
call fcn.00402e71
lea eax, [ebp - 0x488]
push eax
mov byte [ebp - 4], 5
call fcn.00402e71
lea esi, [ebp - 0x440]
call fcn.004031a5
push dword [ebp - 0x440]
call fcn.00429220
or dword [ebp - 4], 0xffffffff
pop ecx
push edi
push 1
lea esi, [ebp - 0x460]
call fcn.00401828
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push edi
push eax
call fcn.0042b7e0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x218]
push eax
push edi
call ebx
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea esi, [ebp - 0x444]
call fcn.004015bd
mov eax, esi
push eax
lea eax, [ebp - 0x460]
push eax
mov dword [ebp - 4], 8
call fcn.00405abf
cmp dword [eax + 0x18], 0x10
pop ecx
pop ecx
jb 0x42005d
mov eax, dword [eax + 4]
jmp 0x420060
add eax, 4
push eax
mov ebx, 0x458a60
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
push 1
lea ecx, [ebp - 0x460]
call fcn.00401730
or dword [ebp - 4], 0xffffffff
push edi
push 1
lea esi, [ebp - 0x444]
call fcn.00401828
lea ecx, [ebp - 0x218]
call fcn.0041ef25
push ebx
push str.Softwareprojonepodlpdebugplugin_
push str._s_hs
mov esi, 0x458b68
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push esi
push reloc.WS2_32.dll_bind
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push edi
push edi
lea eax, [ebp - 0x424]
push eax
push 0x41f303
push edi
lea eax, [ebp - 0x420]
push eax
call fcn.0040b1ee
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push edi
push edi
push dword [ebp - 0x424]
push 0x41f922
push 0x20000
push edi
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call ebx
cmp dword [ebp - 0x424], 1
mov ecx, str.service
je 0x420110
mov ecx, str.agent
push str.PLUG_LOADED
call fcn.0041f43d
push dword [0x458a5c]
call dword [sym.imp.KERNEL32.dll_SetEvent]
cmp dword [ebp - 0x424], 1
mov ecx, str.service
je 0x420139
mov ecx, str.agent
push str.PLUG_INITED
call fcn.0041f43d
call fcn.0040d08f
test al, al
je 0x42015f
push edi
push edi
push edi
push 0x41fe49
push 0x10000
push edi
call esi
push eax
call ebx
call fcn.0042a52d
ret