Function at 0x4128b0
Capabilities:
Check if file exists
Get common file path
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
mov eax, 0x1504
call fcn.0044e2b0
mov eax, dword [0x48e050]
xor eax, esp
mov dword [esp + 0x1500], eax
push ebx
push ebp
push esi
push edi
push 0x21a
xor ebx, ebx
lea ecx, [esp + 0x42]
xor eax, eax
push ebx
push ecx
mov word [esp + 0x48], ax
call fcn.004416b0
add esp, 0xc
push 0x21a
lea eax, [esp + 0x482]
xor edx, edx
push ebx
push eax
mov word [esp + 0x488], dx
call fcn.004416b0
add esp, 0xc
push 0x21a
lea edx, [esp + 0x262]
xor ecx, ecx
push ebx
push edx
mov word [esp + 0x268], cx
call fcn.004416b0
add esp, 0xc
push 0x208
lea ecx, [esp + 0xee2]
xor eax, eax
push ebx
push ecx
mov word [esp + 0xee8], ax
call fcn.004416b0
add esp, 0xc
push 0x208
lea eax, [esp + 0x10f2]
xor edx, edx
push ebx
push eax
mov word [esp + 0x10f8], dx
call fcn.004416b0
add esp, 0xc
push 0x208
lea edx, [esp + 0xcd2]
xor ecx, ecx
push ebx
push edx
mov word [esp + 0xcd8], cx
call fcn.004416b0
add esp, 0xc
push 0x104
lea eax, [esp + 0x10f0]
mov ebp, 0x21c
mov esi, str.BkavSystemService
push eax
mov dword [esp + 0x1c], 2
mov dword [esp + 0x18], ebp
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], str.BkavSystemService64
mov dword [esp + 0x30], str.BkavService
mov dword [esp + 0x34], str.BkavWQService
mov dword [esp + 0x38], str.EnterpriseUpdateService
mov dword [esp + 0x3c], str.BluProService
mov dword [esp + 0x40], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x104
lea ecx, [esp + 0xcd0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.SysWOW64
lea edx, [esp + 0xcd0]
push 0x104
push edx
call fcn.0043f083
mov edi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
add esp, 0xc
push ebp
lea eax, [esp + 0x40]
push 0
push eax
call fcn.004416b0
add esp, 0xc
push esi
push str.SYSTEMCurrentControlSetServices
push 0x47903c
lea ecx, [esp + 0x488]
push 0x104
push ecx
mov dword [esp + 0x24], ebp
call fcn.0043ed50
add esp, 0x14
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x1c]
push ecx
push str.ImagePath
lea edx, [esp + 0x48c]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
je 0x412a87
mov ecx, dword [esp + 0x10]
push ecx
push eax
push str.SHGetValue_fail__d_dwSize___d_n
call fcn.00404c20
add esp, 0xc
jmp 0x412b7b
cmp word [esp + 0x3c], 0x22
je 0x412b7b
lea edx, [esp + 0x3c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x412b7b
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0xee0]
push 0x105
push ecx
call fcn.0043efc3
add esp, 0xc
lea edx, [esp + 0xedc]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [esp + 0x10ec]
push eax
lea ecx, [esp + 0xee0]
push ecx
call fcn.0043ec25
add esp, 8
test eax, eax
je 0x412b7b
lea edx, [esp + 0xccc]
push edx
lea eax, [esp + 0xee0]
push eax
call fcn.0043ec25
add esp, 8
test eax, eax
je 0x412b7b
lea ecx, [esp + 0x3c]
push ecx
push str.__s_
lea edx, [esp + 0x264]
push 0x104
push edx
call fcn.0043ed50
lea eax, [esp + 0x26c]
push eax
push str.szNewImagePath___ws_n
call fcn.00404c20
lea eax, [esp + 0x274]
add esp, 0x18
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x412b45
sub eax, edx
sar eax, 1
lea ecx, [eax + eax + 2]
push ecx
lea edx, [esp + 0x260]
push edx
push 2
push str.ImagePath
lea eax, [esp + 0x48c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov esi, dword [esp + ebx*4 + 0x24]
inc ebx
test esi, esi
jne 0x412a14
call fcn.00405460
test eax, eax
je 0x412f8a
xor ecx, ecx
push 0x208
push ecx
lea edx, [esp + 0x1306]
push edx
mov word [esp + 0x1308], cx
call fcn.004416b0
add esp, 0xc
xor eax, eax
push 0x208
push eax
lea ecx, [esp + 0xac6]
push ecx
mov word [esp + 0xac8], ax
call fcn.004416b0
add esp, 0xc
xor edx, edx
push 0x208
push edx
lea eax, [esp + 0x8b6]
push eax
mov word [esp + 0x8b8], dx
call fcn.004416b0
add esp, 0xc
xor ecx, ecx
push 0x208
push ecx
lea edx, [esp + 0x6a6]
push edx
mov word [esp + 0x6a8], cx
call fcn.004416b0
add esp, 0xc
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x1300]
push ecx
lea edx, [esp + 0x20]
push edx
push str.szBkavDir
push str.SOFTWAREBkav
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x30], 1
mov dword [esp + 0x34], 0x208
call edi
push str.BkavService.exe
lea eax, [esp + 0x1300]
push eax
push 0x47903c
lea ecx, [esp + 0x6a8]
push 0x104
push ecx
call fcn.0043ed50
add esp, 0x14
push str.BkavService.exe
lea edx, [esp + 0x10f0]
push edx
push 0x47903c
lea eax, [esp + 0xac8]
push 0x104
push eax
call fcn.0043ed50
add esp, 0x14
push str.BkavService.exe
lea ecx, [esp + 0xcd0]
push ecx
push 0x47903c
lea edx, [esp + 0x8b8]
push 0x104
push edx
call fcn.0043ed50
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0x14
lea eax, [esp + 0xabc]
push eax
call esi
test eax, eax
jne 0x412ce3
lea ecx, [esp + 0x8ac]
push ecx
call esi
test eax, eax
je 0x412dec
lea edx, [esp + 0x69c]
push edx
call esi
test eax, eax
je 0x412dec
push ebp
lea eax, [esp + 0x40]
push 0
push eax
call fcn.004416b0
add esp, 0xc
push str.BkavService
push str.SYSTEMCurrentControlSetServices
push 0x47903c
lea ecx, [esp + 0x488]
push 0x104
push ecx
mov dword [esp + 0x24], ebp
call fcn.0043ed50
add esp, 0x14
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x1c]
push ecx
push str.ImagePath
lea edx, [esp + 0x48c]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
jne 0x412dec
lea eax, [esp + 0xabc]
push eax
lea ecx, [esp + 0x40]
push ecx
call fcn.0043ec25
add esp, 8
test eax, eax
je 0x412d8a
lea edx, [esp + 0x8ac]
push edx
lea eax, [esp + 0x40]
push eax
call fcn.0043ec25
add esp, 8
test eax, eax
jne 0x412dec
lea ecx, [esp + 0x69c]
push ecx
push str.__s_
lea edx, [esp + 0x264]
push 0x104
push edx
call fcn.0043ed50
lea eax, [esp + 0x26c]
add esp, 0x10
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x412db6
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea ecx, [esp + 0x260]
push ecx
push 2
push str.ImagePath
lea edx, [esp + 0x48c]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push str.EnterpriseUpdateService.exe
lea eax, [esp + 0x1300]
push eax
push 0x47903c
lea ecx, [esp + 0x6a8]
push 0x104
push ecx
call fcn.0043ed50
add esp, 0x14
push str.EnterpriseUpdateService.exe
lea edx, [esp + 0x10f0]
push edx
push 0x47903c
lea eax, [esp + 0xac8]
push 0x104
push eax
call fcn.0043ed50
add esp, 0x14
push str.EnterpriseUpdateService.exe
lea ecx, [esp + 0xcd0]
push ecx
push 0x47903c
lea edx, [esp + 0x8b8]
push 0x104
push edx
call fcn.0043ed50
add esp, 0x14
lea eax, [esp + 0xabc]
push eax
call esi
test eax, eax
jne 0x412e81
lea ecx, [esp + 0x8ac]
push ecx
call esi
test eax, eax
je 0x412f8a
lea edx, [esp + 0x69c]
push edx
call esi
test eax, eax
je 0x412f8a
push ebp
lea eax, [esp + 0x40]
push 0
push eax
call fcn.004416b0
add esp, 0xc
push str.EnterpriseUpdateService
push str.SYSTEMCurrentControlSetServices
push 0x47903c
lea ecx, [esp + 0x488]
push 0x104
push ecx
mov dword [esp + 0x24], ebp
call fcn.0043ed50
add esp, 0x14
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x1c]
push ecx
push str.ImagePath
lea edx, [esp + 0x48c]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
jne 0x412f8a
lea eax, [esp + 0xabc]
push eax
lea ecx, [esp + 0x40]
push ecx
call fcn.0043ec25
add esp, 8
test eax, eax
je 0x412f28
lea edx, [esp + 0x8ac]
push edx
lea eax, [esp + 0x40]
push eax
call fcn.0043ec25
add esp, 8
test eax, eax
jne 0x412f8a
lea ecx, [esp + 0x69c]
push ecx
push str.__s_
lea edx, [esp + 0x264]
push 0x104
push edx
call fcn.0043ed50
lea eax, [esp + 0x26c]
add esp, 0x10
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x412f54
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea ecx, [esp + 0x260]
push ecx
push 2
push str.ImagePath
lea edx, [esp + 0x48c]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ecx, dword [esp + 0x1510]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov eax, 1
call fcn.0043e4c7
add esp, 0x1504
ret