Function at 0x4206f9
Capabilities:
Create thread
Delete registry key

Disassembly:
push 0x49c
mov eax, 0x446ca8
call fcn.0042c1aa
push 2
pop eax
push 0x459b48
mov dword [ebp - 0x424], eax
mov dword [0x45ab64], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor edi, edi
push edi
push edi
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x45aa5c], eax
xor eax, eax
push 0x206
mov word [ebp - 0x420], ax
lea eax, [ebp - 0x41e]
push edi
push eax
call fcn.0042d4e0
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
add esp, 0xc
push 0x104
lea eax, [ebp - 0x420]
push eax
push edi
call ebx
push 0x44b9d0
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
sub esp, 0x18
mov dword [ebp - 0x428], esp
mov eax, esp
je 0x420798
mov dword [eax], vtable.std::tr1::_Impl_base1_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t____class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__.0
mov dword [eax], 0x44d48c
mov dword [eax + 4], fcn.0040f0b4
mov dword [eax + 0x10], eax
lea eax, [ebp - 0x460]
push eax
mov edx, 0x44d38c
mov ecx, str.Softwareprojonepodlpdebugplugin_
mov dword [ebp - 4], edi
call fcn.0040cf14
pop ecx
mov byte [ebp - 4], 1
cmp dword [eax + 0x18], 8
jb 0x4207c4
mov eax, dword [eax + 4]
jmp 0x4207c7
add eax, 4
push 0x44d388
push eax
lea eax, [ebp - 0x440]
push eax
call fcn.0040cc25
add esp, 0xc
lea ecx, [ebp - 0x488]
push ecx
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.00404380
pop ecx
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x4a8]
push ecx
mov ecx, eax
mov byte [ebp - 4], 6
call fcn.00421d38
add esp, 0x1c
mov dword [ebp - 0x428], eax
mov esi, 0x45b20c
mov byte [ebp - 4], 7
cmp eax, esi
je 0x420847
mov eax, dword [0x45b224]
mov ecx, dword [0x45b20c]
mov edx, dword [eax]
push eax
push ecx
push edx
push ecx
lea eax, [ebp - 0x468]
push eax
mov eax, esi
call fcn.00403723
mov eax, dword [ebp - 0x428]
mov ecx, esi
call fcn.0040447e
lea eax, [ebp - 0x4a8]
push eax
mov byte [ebp - 4], 6
call fcn.00402f26
lea eax, [ebp - 0x488]
push eax
mov byte [ebp - 4], 5
call fcn.00402f26
lea esi, [ebp - 0x440]
call fcn.00403263
push dword [ebp - 0x440]
call fcn.0042af3e
or dword [ebp - 4], 0xffffffff
pop ecx
push edi
push 1
lea esi, [ebp - 0x460]
call fcn.0040189d
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push edi
push eax
call fcn.0042d4e0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x218]
push eax
push edi
call ebx
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea esi, [ebp - 0x444]
call fcn.0040160a
mov eax, esi
push eax
lea eax, [ebp - 0x460]
push eax
mov dword [ebp - 4], 8
call fcn.00405b47
cmp dword [eax + 0x18], 0x10
pop ecx
pop ecx
jb 0x4208f9
mov eax, dword [eax + 4]
jmp 0x4208fc
add eax, 4
push eax
mov ebx, 0x45aa60
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
push 1
lea ecx, [ebp - 0x460]
call fcn.004017a5
or dword [ebp - 4], 0xffffffff
push edi
push 1
lea esi, [ebp - 0x444]
call fcn.0040189d
lea ecx, [ebp - 0x218]
call fcn.0041f840
push ebx
push str.Softwareprojonepodlpdebugplugin_
push str._s_hs
mov esi, 0x45ab68
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push esi
push reloc.WS2_32.dll_bind
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push edi
push edi
lea eax, [ebp - 0x424]
push eax
push 0x41fc1e
push edi
lea eax, [ebp - 0x420]
push eax
call fcn.0040b2d6
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push edi
push edi
push dword [ebp - 0x424]
push 0x4201be
push 0x20000
push edi
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call ebx
cmp dword [ebp - 0x424], 1
mov ecx, str.service
je 0x4209ac
mov ecx, str.agent
push str.PLUG_LOADED
call fcn.0041fd58
push dword [0x45aa5c]
call dword [sym.imp.KERNEL32.dll_SetEvent]
cmp dword [ebp - 0x424], 1
mov ecx, str.service
je 0x4209d5
mov ecx, str.agent
push str.PLUG_INITED
call fcn.0041fd58
call fcn.0040d1ed
test al, al
je 0x4209fb
push edi
push edi
push edi
push 0x4206e5
push 0x10000
push edi
call esi
push eax
call ebx
call fcn.0042c22d
ret