Function at 0x43abdd
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov ebx, eax
mov eax, dword [0x4db494]
mov edi, 0x4db494
mov ecx, edi
call dword [eax + 0xc]
add eax, 0x10
mov ecx, edi
lea esi, [ebp - 0x4c]
mov dword [ebp - 0x50], eax
call fcn.004016a0
mov ecx, edi
lea esi, [ebp - 0x48]
call fcn.004016a0
mov eax, dword [0x4db494]
xor esi, esi
mov ecx, edi
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
call dword [eax + 0xc]
add eax, 0x10
push esi
mov dword [ebp - 0x14], eax
call dword [sym.imp.ole32.dll_CoInitialize]
call fcn.004481a8
cmp eax, esi
jne 0x43ac7f
mov edi, dword [sym.imp.KERNEL32.DLL_GetLastError]
call edi
push eax
push esi
push str.GetDebugPrivilege_return:_d_GetLassError_return:_d
call fcn.004245c2
add esp, 0xc
call edi
push eax
push esi
push str.GetDebugPrivilege_return:_d_GetLassError_return:_d
mov esi, 0x4dc90c
call fcn.0044866c
add esp, 0xc
push str.kxescore
call fcn.004247b2
push eax
push dword [ebx + 0xc]
push str.cover:_d__kxescore:_d
call fcn.004245c2
add esp, 0x10
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
push dword [ebx + 0x1c]
lea edi, [ebp - 0x50]
mov dword [ebp - 0x10], eax
call fcn.0041de83
test eax, eax
je 0x43b00e
xor esi, esi
mov eax, ebx
mov dword [ebx + 0x10], esi
call fcn.0043be86
cmp dword [ebx + 0xc], esi
mov dword [ebp - 0xc], eax
je 0x43ad51
mov eax, dword [ebx + 0x88]
cmp eax, esi
je 0x43acec
cmp dword [ebp - 0xc], esi
jne 0x43acec
push dword [ebx + 0x5c]
push 0x4bdf84
push esi
push esi
call eax
add esp, 0x10
push str.StopAllProgress...
mov esi, 0x4dc90c
call fcn.0044866c
pop ecx
lea edi, [ebp - 0x50]
call fcn.0041e136
push eax
push str.StopAllProgress_return:_d
mov dword [ebp - 8], eax
mov edi, esi
call fcn.0044866c
cmp dword [ebp - 8], 0
pop ecx
pop ecx
jne 0x43ad46
mov eax, dword [ebx + 0x88]
test eax, eax
je 0x43ad37
push dword [ebx + 0x5c]
push 0x4bdfc4
push 1
push 0
call eax
add esp, 0x10
mov eax, 0xe0000003
call fcn.004245b3
jmp 0x43b013
mov dword [ebp - 4], 0x14
xor esi, esi
jmp 0x43ad5b
call fcn.00423df2
mov edi, 0x4dc90c
mov eax, dword [0x4d7cd8]
cmp eax, esi
je 0x43ad6b
push eax
call dword [sym.imp.KERNEL32.DLL_SetEvent]
push str.ClearWebShield...
mov esi, edi
call fcn.0044866c
pop ecx
xor esi, esi
call fcn.00439985
test eax, eax
je 0x43ad97
call fcn.00439ae1
test eax, eax
je 0x43ad97
call fcn.00439a02
call fcn.00439a86
inc esi
push esi
push str.ClearWebShield_return:_d
mov esi, edi
call fcn.0044866c
push str.ClearFiles...
call fcn.0044866c
add esp, 0xc
lea eax, [ebp - 0x50]
call fcn.0041e442
push str.ClearFiles_end
call fcn.0044866c
pop ecx
push ebx
call fcn.0043c45b
mov eax, dword [ebp - 4]
call fcn.00439964
push dword [ebx + 0x1c]
call fcn.0042291d
mov eax, dword [0x4db494]
pop ecx
mov ecx, 0x4db494
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push dword [ebx + 0x1c]
call fcn.00439c24
mov eax, dword [ebp - 8]
cmp dword [eax - 0xc], 0
pop ecx
pop ecx
je 0x43ae15
push eax
push 0x4be024
call fcn.0044866c
mov eax, dword [ebp - 8]
pop ecx
pop ecx
add eax, 0xfffffff0
call fcn.0040151c
mov eax, dword [ebx + 0x88]
xor esi, esi
cmp eax, esi
je 0x43ae3f
cmp dword [ebp - 0xc], esi
jne 0x43ae3f
push dword [ebx + 0x5c]
push 0x4be028
push esi
push dword [ebp - 4]
call eax
add esp, 0x10
cmp dword [ebx + 0xc], esi
jne 0x43ae4f
lea esi, [ebx + 0xcc]
call fcn.0041ed16
push str.install_begin...
mov esi, edi
call fcn.0044866c
xor esi, esi
push esi
call fcn.00423f51
mov eax, dword [ebx + 0x1c]
cmp dword [eax - 0xc], esi
pop ecx
pop ecx
je 0x43ae82
push eax
lea eax, [ebx + 0x60]
call fcn.0043deac
test eax, eax
je 0x43ae82
mov eax, ebx
call fcn.0043a64b
inc esi
push 1
call fcn.00423f51
test esi, esi
pop ecx
jne 0x43aed6
mov eax, dword [ebx + 0x88]
test eax, eax
je 0x43b013
cmp dword [ebx + 0x7c], esi
push dword [ebx + 0x5c]
je 0x43aebd
push 0x4be050
push 7
push dword [ebp - 4]
call eax
add esp, 0x10
mov eax, 0xe000000d
jmp 0x43ad3c
push 0x4be060
push 2
push dword [ebp - 4]
call eax
add esp, 0x10
mov eax, 0xe0000002
jmp 0x43ad3c
push ebx
call fcn.0043bf5b
test eax, eax
push ebx
je 0x43aef0
call fcn.0043c00d
mov eax, 0xe0000004
jmp 0x43ad3c
call fcn.0043c134
test eax, eax
je 0x43af03
mov eax, 0xe0000005
jmp 0x43ad3c
lea esi, [ebx + 0x60]
call fcn.0043de47
mov eax, dword [ebx + 0xc]
neg eax
sbb eax, eax
and eax, 0xa
add eax, 0xa
add dword [ebp - 4], eax
xor esi, esi
cmp dword [ebx + 0x9c], esi
je 0x43af2a
call fcn.00424cd6
mov eax, dword [ebp - 4]
call fcn.00439964
mov eax, dword [ebx + 0x88]
cmp eax, esi
je 0x43af52
cmp dword [ebp - 0xc], esi
jne 0x43af52
push dword [ebx + 0x5c]
push str.ck_W
push esi
push dword [ebp - 4]
call eax
add esp, 0x10
mov edi, ebx
call fcn.0043c599
mov eax, ebx
call fcn.0043c5df
push ebx
call fcn.0043a70b
test eax, eax
jne 0x43af92
mov eax, dword [ebx + 0x88]
test eax, eax
je 0x43af86
push dword [ebx + 0x5c]
push 0x4be084
push 3
push dword [ebp - 4]
call eax
add esp, 0x10
mov eax, 0xe0000007
call fcn.004245b3
jmp 0x43b00e
cmp dword [ebx + 0xc], esi
jne 0x43afa6
push 0xa
lea eax, [ebx + 0xd0]
push eax
call dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
call fcn.0043bce4
test eax, eax
jne 0x43afbf
push str.install_ksafe_fail
mov esi, 0x4dc90c
call fcn.0044866c
pop ecx
mov eax, ebx
call fcn.0043bde6
test eax, eax
jne 0x43afda
push str.install_pcmgr_fail
mov esi, 0x4dc90c
call fcn.0044866c
pop ecx
xor eax, eax
cmp dword [ebx + 0xc], eax
je 0x43b000
push eax
lea ecx, [ebp - 0xc]
push ecx
push eax
push 0xf003f
push 1
push eax
push eax
push str.SOFTWAREkingsoftAntivirusKNeedReboot
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov eax, ebx
call fcn.0043c1ff
mov dword [ebx + 0x10], 1
mov edi, 0x4dc90c
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
sub eax, dword [ebp - 0x10]
xor esi, esi
cmp dword [ebx + 0x10], esi
mov dword [ebx + 0x84], eax
je 0x43b033
push 0x64
pop eax
call fcn.00439964
jmp 0x43b03f
push 9
mov eax, 0x4dc87c
call fcn.00402760
cmp dword [ebx + 0x80], esi
je 0x43b067
cmp dword [ebx + 0x10], esi
je 0x43b067
push str.wait_kismain
mov esi, edi
call fcn.0044866c
mov dword [esp], str.wait_kismain_end
call fcn.0044866c
pop ecx
xor esi, esi
mov eax, dword [ebx + 0x88]
cmp eax, esi
je 0x43b086
cmp dword [ebx + 0x10], esi
je 0x43b086
push dword [ebx + 0x5c]
push 0x4be0e0
push esi
push 0x64
call eax
add esp, 0x10
mov eax, 0x4d7cc8
call fcn.0041dd24
test eax, eax
je 0x43b0a6
mov eax, dword [0x4d7cc8]
cmp eax, esi
je 0x43b0a6
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov eax, dword [0x4d7ccc]
mov dword [0x4dc848], eax
mov eax, dword [0x4d7cd0]
add eax, 0xfffffff0
call fcn.00401648
mov esi, eax
add esi, 0x10
push esi
push 0x4dc850
call fcn.00401aed
lea eax, [esi - 0x10]
call fcn.0040151c
cmp dword [ebx + 0x11c], 0
je 0x43b0fe
mov eax, dword [ebx + 0xfc]
push ecx
sub eax, 0x10
mov esi, esp
call fcn.00401648
add eax, 0x10
mov dword [esi], eax
push dword [ebx + 0x10]
call fcn.00424351
pop ecx
pop ecx
push dword [ebx + 0x84]
mov esi, edi
push dword [ebx + 0x10]
push str.install_end__return:_d__install_cost_time:_dms
call fcn.0044866c
push dword [ebx + 0x10]
push str.install_thread_end:_d
call fcn.004245c2
add esp, 0x14
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.0040151c
lea esi, [ebp - 0x24]
call fcn.00405b92
lea esi, [ebp - 0x34]
call fcn.00405b92
lea esi, [ebp - 0x44]
call fcn.00405b92
mov eax, dword [ebp - 0x48]
add eax, 0xfffffff0
call fcn.0040151c
mov eax, dword [ebp - 0x4c]
add eax, 0xfffffff0
call fcn.0040151c
mov eax, dword [ebp - 0x50]
add eax, 0xfffffff0
call fcn.0040151c
pop edi
pop esi
pop ebx
leave
ret