Function at 0x40ee90
Capabilities:
Create process on windows
Create thread
Delete registry value
Get common file path
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x48b7e8
push 0x441f50
mov eax, dword fs:[0]
push eax
sub esp, 0xc60
mov eax, dword [0x48e050]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
xor esi, esi
mov dword [ebp - 0xc4c], esi
mov dword [ebp - 0xc48], esi
xor eax, eax
mov word [ebp - 0x440], ax
push 0x208
push esi
lea ecx, [ebp - 0x43e]
push ecx
call fcn.004416b0
add esp, 0xc
xor edx, edx
mov word [ebp - 0x230], dx
push 0x208
push esi
lea eax, [ebp - 0x22e]
push eax
call fcn.004416b0
add esp, 0xc
mov edi, 1
mov dword [ebp - 0xc44], edi
mov dword [ebp - 0xc5c], 0x208
lea ecx, [ebp - 0xc5c]
push ecx
lea edx, [ebp - 0x440]
push edx
lea eax, [ebp - 0xc44]
push eax
push str.szBkavDir
push str.SOFTWAREBkav
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x40efb1
lea ecx, [ebp - 0x440]
push ecx
push str._sSystemSafeRun
push 0x104
lea edx, [ebp - 0x230]
push edx
call fcn.0043ed50
add esp, 0x10
lea eax, [ebp - 0x230]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x40ef80
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea ecx, [ebp - 0x230]
push ecx
push edi
push str.szSaferunDir
push str.SoftwareBkav
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push str.SvcInitSafeRun
call fcn.00404c20
add esp, 4
mov dword [ebp - 0xc50], edi
mov dword [ebp - 0xc58], 0xc
lea edx, [ebp - 0xc70]
mov dword [ebp - 0xc54], edx
push edi
mov eax, edx
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push esi
push esi
push edi
lea ecx, [ebp - 0xc70]
push ecx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
lea edx, [ebp - 0xc70]
push edx
call fcn.004147a0
add esp, 4
mov dword [ebp - 4], esi
push 0x14
push 0x40
mov ebx, dword [sym.imp.KERNEL32.dll_LocalAlloc]
call ebx
mov edi, eax
mov dword [ebp - 0xc4c], edi
test edi, edi
je 0x40f080
push 0x400
push 0x40
call ebx
mov esi, eax
mov dword [ebp - 0xc48], esi
test esi, esi
je 0x40f080
lea ebx, [ebp - 0xc58]
call fcn.00401060
push str.GlobalBkavSafeRunNotify
push 0
push 1
mov eax, ebx
push eax
mov ebx, dword [sym.imp.KERNEL32.dll_CreateEventW]
call ebx
mov dword [0x496730], eax
test eax, eax
je 0x40f076
push str.GlobalBkavSafeRunPrepareEnvironment
push 0
push 1
lea ecx, [ebp - 0xc58]
push ecx
call ebx
mov dword [0x496734], eax
test eax, eax
jne 0x40f080
mov eax, 1
call fcn.00410ef0
mov dword [ebp - 4], 0xfffffffe
call fcn.0040f0f3
lea edx, [ebp - 0xc40]
push edx
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x40f10a
push str.Co_loi_lay_thu_muc_temp_r_n
call fcn.00404c20
add esp, 4
mov ecx, 1
mov dword [0x4937d0], ecx
xor eax, eax
mov dword [0x4937d8], eax
mov dword [0x4937e4], eax
mov dword [0x4937d4], ecx
mov dword [0x4937e0], eax
push 0x4937cc
mov eax, dword [0x4935ac]
push eax
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
jmp 0x40f269
lea ecx, [ebp - 0xc40]
push ecx
push str.___sSaferun
push 0x494288
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0
push 0
push 0
push 0x40b1f0
push 0
push 0
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
call edi
push str.Init_SafeRun_Filter
call fcn.00404c20
add esp, 4
call fcn.00405e80
cmp eax, 1
je 0x40f221
cmp eax, 2
je 0x40f221
cmp eax, 4
je 0x40f221
call fcn.00409230
test eax, eax
je 0x40f236
call fcn.0042f510
test al, al
je 0x40f212
call fcn.0042f990
test eax, eax
jne 0x40f1cb
call fcn.0042f9d0
test al, al
je 0x40f1cb
push 0
push str.fltmc_load_BkavSRCore
call dword [sym.imp.KERNEL32.dll_WinExec]
mov dword [ebp - 0xc44], 1
push 4
lea edx, [ebp - 0xc44]
push edx
push 4
push str.fEnableSafeRunFlt
push str.SoftwareBkav
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push 4
push 0x3000
push 8
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
je 0x40f236
mov dword [esi], 0x4ad0c0
mov dword [esi + 4], 0
push 0
push 0
push esi
push 0x430180
push 0
push 0
call edi
test eax, eax
jne 0x40f236
push 0x8000
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x40f236
push str.SafeRunFilter:_Init_function_failed
call fcn.00404c20
add esp, 4
jmp 0x40f236
push str.fEnableSafeRunFlt
push str.SoftwareBkav
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
call fcn.004010f0
test eax, eax
je 0x40f246
push str.Load_BkavSafeRunUtil_successful
jmp 0x40f24b
push str.Load_BkavSafeRunUtil_failed
call fcn.00404c20
add esp, 4
call fcn.00402ad0
push 0
push 0
push 0
push 0x411f20
push 0
push 0
call edi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0043e4c7
mov esp, ebp
pop ebp
ret