Function at 0x438870
Capabilities:
Create thread
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x224
mov eax, dword [0x48e050]
xor eax, esp
mov dword [esp + 0x220], eax
mov eax, dword [0x496764]
push esi
push edi
xor edi, edi
push 0x206
lea edx, [esp + 0x26]
xor ecx, ecx
push edi
push edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x14], edi
mov word [esp + 0x2c], cx
call fcn.004416b0
add esp, 0xc
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0xc]
push ecx
push edi
push 0xf003f
push edi
push edi
push edi
push str.SOFTWAREBkavRP
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x40], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x30], 1
mov dword [esp + 0x34], edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov eax, dword [esp + 8]
cmp eax, edi
je 0x438b1f
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea edx, [esp + 0x14]
push edx
push edi
lea ecx, [esp + 0x18]
push ecx
push edi
push str.szFoundVirusName
push eax
mov dword [esp + 0x28], 1
call ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, 2
jne 0x43894f
lea eax, [esp + 0x24]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x438927
mov ecx, dword [esp + 0xc]
sub eax, edx
sar eax, 1
lea edx, [eax + eax + 2]
push edx
lea eax, [esp + 0x28]
push eax
push 1
push edi
push str.szFoundVirusName
push ecx
call esi
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x14]
push edx
push edi
lea eax, [esp + 0x18]
push eax
push edi
push str.szFoundFileName
push ecx
call ebx
cmp eax, 2
jne 0x43899b
lea eax, [esp + 0x24]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x438973
mov ecx, dword [esp + 0xc]
sub eax, edx
sar eax, 1
lea edx, [eax + eax + 2]
push edx
lea eax, [esp + 0x28]
push eax
push 1
push edi
push str.szFoundFileName
push ecx
call esi
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x14]
push edx
push edi
lea eax, [esp + 0x18]
push eax
push edi
push str.szFoundResult
push ecx
call ebx
cmp eax, 2
jne 0x4389e8
lea eax, [esp + 0x24]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x4389c0
mov ecx, dword [esp + 0xc]
sub eax, edx
sar eax, 1
lea edx, [eax + eax + 2]
push edx
lea eax, [esp + 0x28]
push eax
push 1
push edi
push str.szFoundResult
push ecx
call esi
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x14]
push edx
push edi
lea eax, [esp + 0x18]
push eax
push edi
push str.szFoundMd5
push ecx
call ebx
cmp eax, 2
jne 0x438a38
lea eax, [esp + 0x24]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x438a10
mov ecx, dword [esp + 0xc]
sub eax, edx
sar eax, 1
lea edx, [eax + eax + 2]
push edx
lea eax, [esp + 0x28]
push eax
push 1
push edi
push str.szFoundMd5
push ecx
call esi
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x14]
push edx
push edi
lea eax, [esp + 0x18]
push eax
push edi
push str.szFoundSha1
push ecx
call ebx
cmp eax, 2
jne 0x438a88
lea eax, [esp + 0x24]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x438a60
mov ecx, dword [esp + 0xc]
sub eax, edx
sar eax, 1
lea edx, [eax + eax + 2]
push edx
lea eax, [esp + 0x28]
push eax
push 1
push edi
push str.szFoundSha1
push ecx
call esi
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x14]
push edx
push edi
lea eax, [esp + 0x18]
push eax
push edi
push str.szFoundNumVirus
push ecx
call ebx
cmp eax, 2
jne 0x438ad8
lea eax, [esp + 0x24]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x438ab0
mov ecx, dword [esp + 0xc]
sub eax, edx
sar eax, 1
lea edx, [eax + eax + 2]
push edx
lea eax, [esp + 0x28]
push eax
push 1
push edi
push str.szFoundNumVirus
push ecx
call esi
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x14]
push edx
push edi
lea eax, [esp + 0x18]
push eax
push edi
push str.fNotifyLog
push ecx
mov dword [esp + 0x28], 1
call ebx
pop ebx
cmp eax, 2
jne 0x438b14
mov eax, dword [esp + 8]
push 4
lea edx, [esp + 0x20]
push edx
push 4
push edi
push str.fNotifyLog
push eax
call esi
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push edi
push edi
push edx
push 0x4386b0
push edi
push edi
call esi
push edi
push edi
push edi
push 0x439160
push edi
push edi
call esi
mov ecx, dword [esp + 0x228]
pop edi
pop esi
xor ecx, esp
mov eax, 1
call fcn.0043e4c7
add esp, 0x224
ret