Function at 0x421000
Capabilities:
Delete file
Delete registry value
Delete service
Get common file path
Stop service

Disassembly:
sub esp, 0x234
mov eax, dword [0x48e050]
xor eax, esp
mov dword [esp + 0x22c], eax
push ebx
push ebp
xor eax, eax
push esi
push edi
push str.Unload_firewall_driver
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
call fcn.00404c20
add esp, 4
push str.fEnableFwDrv
push str.SoftwareBkav
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
je 0x4210f3
push 0xf01ff
push str.BkavFwDrv
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebp, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
test esi, esi
je 0x4210da
lea eax, [esp + 0x14]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4210b7
call ebx
push eax
push str.ControlService_error:__d
call fcn.00404c20
add esp, 8
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x4210d2
call ebx
push eax
push str.DeleteService_error:__d
call fcn.00404c20
add esp, 8
push esi
call ebp
push edi
call ebp
jmp 0x421107
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenService_error:__d
call fcn.00404c20
add esp, 8
push edi
call ebp
jmp 0x421107
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenSCManager_error:__d
call fcn.00404c20
add esp, 8
call fcn.00420be0
test eax, eax
je 0x4211ee
mov eax, dword [0x496710]
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 0x10], 0
test eax, eax
je 0x421138
lea ecx, [esp + 0x10]
push ecx
jmp 0x421161
push str.kernel32.dll
call edi
test eax, eax
je 0x42123b
push str.Wow64DisableWow64FsRedirection
push eax
call ebx
mov dword [0x496710], eax
test eax, eax
je 0x42123b
lea edx, [esp + 0x10]
push edx
call eax
test eax, eax
je 0x42123b
push 0x103
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x4211b8
push str.drivers_
lea ecx, [esp + 0x34]
push 0x104
push ecx
call fcn.0043f083
add esp, 0xc
push str.BkavFwDrv.sys
lea edx, [esp + 0x34]
push 0x104
push edx
call fcn.0043f083
add esp, 0xc
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [0x496714]
mov eax, dword [esp + 0x10]
mov esi, eax
test ecx, ecx
je 0x4211cd
push eax
call ecx
jmp 0x42123b
push str.kernel32.dll
call edi
test eax, eax
je 0x42123b
push str.Wow64RevertWow64FsRedirection
push eax
call ebx
mov dword [0x496714], eax
test eax, eax
je 0x42123b
push esi
call eax
jmp 0x42123b
push 0x103
lea ecx, [esp + 0x34]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x42123b
push str.drivers_
lea edx, [esp + 0x34]
push 0x104
push edx
call fcn.0043f083
add esp, 0xc
push str.BkavFwDrv.sys
lea eax, [esp + 0x34]
push 0x104
push eax
call fcn.0043f083
add esp, 0xc
lea ecx, [esp + 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0x23c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0043e4c7
add esp, 0x234
ret