Function at 0x40cc20
Capabilities:
Check if file exists
Copy file
Create directory
Create process on windows
Query or enumerate registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x288c
call fcn.0044e2b0
mov eax, dword [0x48e050]
xor eax, esp
mov dword [esp + 0x2888], eax
push ebx
push esi
push edi
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x27c]
push ecx
lea edx, [esp + 0x18]
push edx
push str.szBkavDir
push str.SOFTWAREBkav
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x28], 1
mov dword [esp + 0x2c], 0x208
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x40cfb2
lea eax, [esp + 0x278]
push eax
push str._sSystemAFA
lea ecx, [esp + 0x78]
push 0x104
push ecx
call fcn.0043ed50
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
add esp, 0x10
push 0
lea edx, [esp + 0x74]
push edx
call esi
lea eax, [esp + 0x278]
push eax
push str._sSystemAntiAdware
lea ecx, [esp + 0x78]
push 0x104
push ecx
call fcn.0043ed50
add esp, 0x10
push 0
lea edx, [esp + 0x74]
push edx
call esi
lea eax, [esp + 0x278]
push eax
push str._sSystemAntiPhishingMail
lea ecx, [esp + 0x78]
push 0x104
push ecx
call fcn.0043ed50
add esp, 0x10
push 0
lea edx, [esp + 0x74]
push edx
call esi
lea eax, [esp + 0x278]
push eax
push str._sSystemAntiLeak
lea ecx, [esp + 0x78]
push 0x104
push ecx
call fcn.0043ed50
add esp, 0x10
push 0
lea edx, [esp + 0x74]
push edx
call esi
lea eax, [esp + 0x278]
push eax
push str._sSystemFirewall
lea ecx, [esp + 0x78]
push 0x104
push ecx
call fcn.0043ed50
add esp, 0x10
push 0
lea edx, [esp + 0x74]
push edx
call esi
lea eax, [esp + 0x278]
push eax
push str._sSystemSafeRun
lea ecx, [esp + 0x78]
push 0x104
push ecx
call fcn.0043ed50
add esp, 0x10
push 0
lea edx, [esp + 0x74]
push edx
call esi
lea eax, [esp + 0x278]
push eax
push str._sSystemAK
lea ecx, [esp + 0x78]
push 0x104
push ecx
call fcn.0043ed50
add esp, 0x10
push 0
lea edx, [esp + 0x74]
push edx
call esi
lea eax, [esp + 0x278]
push eax
push str._sSystemUtil
lea ecx, [esp + 0x78]
push 0x104
push ecx
call fcn.0043ed50
add esp, 0x10
push 0
lea edx, [esp + 0x74]
push edx
call esi
lea eax, [esp + 0x278]
push eax
push str._sSystemSystemWatcher
lea ecx, [esp + 0x78]
push 0x104
push ecx
call fcn.0043ed50
add esp, 0x10
push 0
lea edx, [esp + 0x74]
push edx
call esi
lea eax, [esp + 0x278]
push eax
push str._sSystemAR
lea ecx, [esp + 0x78]
push 0x104
push ecx
call fcn.0043ed50
add esp, 0x10
push 0
lea edx, [esp + 0x74]
push edx
call esi
lea eax, [esp + 0x278]
push eax
push str._sSystemAdvancedScan
lea ecx, [esp + 0x78]
push 0x104
push ecx
call fcn.0043ed50
add esp, 0x10
push 0
lea edx, [esp + 0x74]
push edx
call esi
lea eax, [esp + 0x278]
push eax
push str._sSystemWorkQueue
lea ecx, [esp + 0x78]
push 0x104
push ecx
call fcn.0043ed50
add esp, 0x10
push 0
lea edx, [esp + 0x74]
push edx
call esi
lea eax, [esp + 0x278]
push eax
push str._sSystemPC
lea ecx, [esp + 0x78]
push 0x104
push ecx
call fcn.0043ed50
add esp, 0x10
push 0
lea edx, [esp + 0x74]
push edx
call esi
lea eax, [esp + 0x278]
push eax
push str._sSystemLogReportEx
push 0x104
lea ecx, [esp + 0x7c]
push ecx
call fcn.0043ed50
add esp, 0x10
push 0
lea edx, [esp + 0x74]
push edx
call esi
call fcn.0040d5b0
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ebx, eax
mov esi, 0x458cf0
jmp 0x40ced0
push esi
lea eax, [esp + 0x27c]
push eax
push 0x47903c
lea ecx, [esp + 0x48c]
push 0x104
push ecx
call fcn.0043ed50
add esp, 0x14
lea edx, [esp + 0x480]
push edx
call edi
test eax, eax
je 0x40cfa0
lea eax, [esi + 0x208]
push eax
lea ecx, [esp + 0x27c]
push ecx
push 0x47903c
lea edx, [esp + 0x694]
push 0x104
push edx
call fcn.0043ed50
add esp, 0x14
lea eax, [esp + 0x688]
push eax
call edi
test eax, eax
jne 0x40cf55
push eax
lea ecx, [esp + 0x68c]
push ecx
lea edx, [esp + 0x488]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
jmp 0x40cfa0
push 0x457934
push esi
call fcn.0043ec25
add esp, 8
test eax, eax
je 0x40cfc7
cmp dword [esi + 0x410], 1
push ebx
jne 0x40cf88
lea eax, [esp + 0x68c]
push eax
lea ecx, [esp + 0x488]
push ecx
call fcn.0040d310
jmp 0x40cf9d
lea edx, [esp + 0x68c]
push edx
lea eax, [esp + 0x488]
push eax
call fcn.0040d460
add esp, 0xc
add esi, 0x414
cmp esi, str.BkisHookKey.dll
jl 0x40ced0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2888]
xor ecx, esp
call fcn.0043e4c7
mov esp, ebp
pop ebp
ret
xor eax, eax
push 0x44
push eax
lea ecx, [esp + 0x30]
push ecx
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
call fcn.004416b0
add esp, 0xc
lea edx, [esp + 0x480]
push edx
push str.__s__uSysSrv
lea eax, [esp + 0x898]
push 0x1000
push eax
mov dword [esp + 0x38], 0x44
call fcn.0043ed50
lea ecx, [esp + 0x8a0]
push ecx
push str.szCmdLine:__s
call fcn.00404c20
add esp, 0x18
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x2c]
push eax
push 0
push 0
push 0x8000000
push 0
push 0
push 0
lea ecx, [esp + 0x8b0]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x40d07b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Start_new_process_error:__d
call fcn.00404c20
mov ecx, dword [esp + 0x289c]
add esp, 8
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0043e4c7
mov esp, ebp
pop ebp
ret
mov edx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [esp + 0x1c]
push eax
call esi
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]