Function at 0x410920
Capabilities:
Create thread
Query or enumerate registry value
Terminate process

Disassembly:
sub esp, 0xa9c
mov eax, dword [0x48e050]
xor eax, esp
mov dword [esp + 0xa94], eax
push ebx
push ebp
push esi
push edi
mov ebp, 0x21c
push str.Init_Report_Crash
mov dword [esp + 0x18], 1
mov dword [esp + 0x14], ebp
call fcn.00404c20
add esp, 4
call fcn.0040f350
mov esi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x224]
push ecx
lea edx, [esp + 0x1c]
push edx
push str.szBkavDir
push str.SoftwareBkav
push reloc.OLEAUT32.dll_SysReAllocString
call esi
xor ebx, ebx
test eax, eax
jne 0x410a64
lea eax, [esp + 0x220]
push eax
push str._sSystem
lea ecx, [esp + 0x668]
push 0x104
push ecx
call fcn.0043ed50
lea edi, [esp + 0x670]
call fcn.00414910
lea edx, [esp + 0x230]
push edx
push str._sAppLog
lea eax, [esp + 0x898]
push 0x104
push eax
call fcn.0043ed50
lea edi, [esp + 0x8a0]
call fcn.00414910
push 0x206
lea edx, [esp + 0x3e]
xor ecx, ecx
push ebx
push edx
mov word [esp + 0x44], cx
call fcn.004416b0
add esp, 0x2c
lea eax, [esp + 0x220]
push eax
push str._sSystemWorkQueueBkavWQService.exe
lea ecx, [esp + 0x20]
push 0x104
push ecx
call fcn.0043ed50
lea edi, [esp + 0x28]
call fcn.00414a10
lea edx, [esp + 0x230]
push edx
push str._sSystemBkavSystemService.exe
mov eax, edi
push 0x104
push eax
call fcn.0043ed50
call fcn.00414a10
lea ecx, [esp + 0x240]
push ecx
push str._sSystemBkavSystemService64.exe
mov edx, edi
push 0x104
push edx
call fcn.0043ed50
add esp, 0x30
call fcn.00414a10
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x444]
push ecx
lea edx, [esp + 0x1c]
push edx
push str.szAppdataPath
push str.SoftwareBkav
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x28], ebp
call esi
test eax, eax
jne 0x410ab5
push str.Bkav
lea eax, [esp + 0x444]
push 0x10e
push eax
call fcn.0043f083
add esp, 0xc
lea edi, [esp + 0x440]
call fcn.00414910
push str.Install_sdfilter
call fcn.00404c20
add esp, 4
call fcn.0042f0e0
call fcn.0042f2e0
xor eax, eax
call fcn.004012d0
test eax, eax
je 0x410ae9
xor eax, eax
call fcn.00401370
test eax, eax
je 0x410ae9
xor eax, eax
call fcn.00401260
mov ecx, str.BkavSDFlt
call fcn.004082f0
test eax, eax
je 0x410b06
push str.Service_BkavSDFlt_exist_n
call fcn.00404c20
add esp, 4
jmp 0x410b18
push str.Service_BkavSDFlt_not_exist_n
call fcn.00404c20
add esp, 4
call fcn.0042f220
push str.Install_Bkav_Drivers
call fcn.00404c20
add esp, 4
call fcn.0040fa40
push str.Init_Firewall
call fcn.00404c20
add esp, 4
call fcn.00420de0
push str.Init_selfDefense
call fcn.00404c20
add esp, 4
call fcn.004101c0
push str.Init_DeviceControl
call fcn.00404c20
add esp, 4
call fcn.00410300
push str.Init_LogReportEx
call fcn.00404c20
add esp, 4
call fcn.00410860
push str.Init_support_Routine
call fcn.00404c20
add esp, 4
push 0x1c
call fcn.0043ef53
add esp, 4
cmp eax, ebx
je 0x410b95
mov dword [eax], vtable.CSupportRoutine.0
jmp 0x410b97
xor eax, eax
mov dword [0x49316c], eax
call fcn.0043aa60
push str.Init_Safe_run
call fcn.00404c20
add esp, 4
call fcn.0040ee90
push str.Init_log_protected
call fcn.00404c20
add esp, 4
call fcn.00415470
push str.Init_BehaviorProtection
call fcn.00404c20
add esp, 4
call fcn.004170c0
push str.Init_System_Watcher
mov dword [0x49338c], eax
call fcn.00404c20
add esp, 4
call fcn.00410010
push str.Init_AntiRansomware
call fcn.00404c20
add esp, 4
call fcn.0043b9c0
call fcn.0043be00
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push ebx
push ebx
push ebx
push 0x43bec0
push ebx
push ebx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, ebx
je 0x410c24
push eax
call edi
push str.Init_AntiAdware
call fcn.00404c20
add esp, 4
call fcn.0040f290
push str.Init_AntiLeak
call fcn.00404c20
add esp, 4
call fcn.0040f410
push str.Init_SideLoading
call fcn.00404c20
add esp, 4
call fcn.0040f520
push str.Init_AntiFakeAV
call fcn.00404c20
add esp, 4
push ebx
push ebx
push 0x497560
push 0x41fba0
push ebx
push ebx
call esi
push str.Init_AdvancedScan
call fcn.00404c20
add esp, 4
call fcn.0040f620
push str.Init_WorkQueue
call fcn.00404c20
add esp, 4
call fcn.0040f720
push str.Init_BSPC
call fcn.00404c20
add esp, 4
call fcn.0040f820
push str.Repair_Services
call fcn.00404c20
add esp, 4
call fcn.004128b0
push str.Restore_Bit_4_IdKey
call fcn.00404c20
add esp, 4
call fcn.00409290
call fcn.0040e8b0
push ebx
push ebx
push ebx
push 0x40fec0
push ebx
push ebx
call esi
push eax
call edi
push ebx
push ebx
push ebx
push 0x412220
push ebx
push ebx
call esi
push eax
call edi
push ebx
push ebx
push ebx
push 0x412600
push ebx
push ebx
call esi
push eax
call edi
push str.Install_Bkav_Services
call fcn.00404c20
add esp, 4
call fcn.00411f70
push str.Install_Bkav_System_Services_64
call fcn.00404c20
add esp, 4
lea ecx, [esp + 0x220]
call fcn.0040f920
push str.Enable_SD
call fcn.00404c20
add esp, 4
call fcn.0042f340
mov ebp, 1
mov eax, ebp
call fcn.004012d0
test eax, eax
je 0x410d62
mov eax, ebp
call fcn.00401370
test eax, eax
je 0x410d62
mov eax, ebp
call fcn.00401260
push ebx
push ebx
push ebx
push 0x4100d0
push ebx
push ebx
call esi
push eax
call edi
push ebx
push ebx
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x496728], eax
cmp eax, ebx
jne 0x410db9
mov ecx, dword [0x4935ac]
push 0x4937cc
push ecx
mov dword [0x4937d0], ebp
mov dword [0x4937d8], ebx
mov dword [0x4937e4], ebx
mov dword [0x4937d4], ebp
mov dword [0x4937e0], ebx
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
jmp 0x410ed1
push str.Done
call fcn.00404c20
mov edx, dword [0x4935ac]
add esp, 4
push 0x4937cc
push edx
mov dword [0x4937d0], 4
mov dword [0x4937d8], ebx
mov dword [0x4937e4], ebx
mov dword [0x4937d4], ebp
mov dword [0x4937e0], ebx
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
mov eax, dword [0x496728]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebp, dword [0x49671c]
cmp ebp, ebx
je 0x410e55
mov eax, dword [ebp]
cmp eax, ebx
je 0x410e36
mov eax, dword [eax]
push eax
push ebx
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, ebx
je 0x410e36
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call edi
mov esi, dword [ebp + 8]
cmp esi, ebx
je 0x410e55
lea ecx, [ecx]
push 0x40c900
push esi
call fcn.00413130
mov esi, dword [esi + 0xc]
add esp, 8
cmp esi, ebx
jne 0x410e40
mov ecx, dword [0x49671c]
push ecx
call fcn.004130e0
add esp, 4
mov dword [0x49671c], ebx
cmp dword [0x496718], ebx
je 0x410e78
mov dword [0x496718], ebx
mov edx, dword [0x496730]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, 1
mov dword [0x4937d0], eax
mov dword [0x4937d4], eax
mov eax, dword [0x4935ac]
push 0x4937cc
push eax
mov dword [0x4937d8], ebx
mov dword [0x4937e4], ebx
mov dword [0x4937e0], ebx
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
mov ecx, dword [0x496728]
push ecx
call edi
mov edx, dword [0x496730]
push edx
call edi
mov eax, dword [0x496734]
push eax
call edi
mov ecx, dword [esp + 0xaa4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0043e4c7
add esp, 0xa9c
ret