Function at 0x43c9d4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov ebx, eax
mov eax, dword [0x4df4b4]
mov edi, 0x4df4b4
mov ecx, edi
call dword [eax + 0xc]
add eax, 0x10
mov ecx, edi
lea esi, [ebp - 0x4c]
mov dword [ebp - 0x50], eax
call fcn.004016a0
mov ecx, edi
lea esi, [ebp - 0x48]
call fcn.004016a0
mov eax, dword [0x4df4b4]
xor esi, esi
mov ecx, edi
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
call dword [eax + 0xc]
push esi
push 1
push 0x46d
push dword [ebx + 0xe0]
add eax, 0x10
mov dword [ebp - 0x14], eax
call dword [sym.imp.USER32.dll_PostMessageW]
push esi
call dword [sym.imp.ole32.dll_CoInitialize]
call fcn.0042333b
cmp eax, esi
jne 0x43ca8a
mov edi, dword [sym.imp.KERNEL32.DLL_GetLastError]
call edi
push eax
push esi
push str.GetDebugPrivilege_return:_d_GetLassError_return:_d
call fcn.00424a53
add esp, 0xc
call edi
push eax
push esi
push str.GetDebugPrivilege_return:_d_GetLassError_return:_d
mov esi, 0x4e096c
call fcn.0044ae36
add esp, 0xc
push str.kxescore
call fcn.00424c43
push eax
push dword [ebx + 0xc]
push str.cover:_d__kxescore:_d
call fcn.00424a53
add esp, 0x10
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
push dword [ebx + 0x1c]
lea edi, [ebp - 0x50]
mov dword [ebp - 0x10], eax
call fcn.0041e1e6
test eax, eax
je 0x43ce8a
xor esi, esi
mov eax, ebx
mov dword [ebx + 0x10], esi
call fcn.0043dd37
cmp dword [ebx + 0xc], esi
mov dword [ebp - 0xc], eax
je 0x43cb5c
mov eax, dword [ebx + 0x88]
cmp eax, esi
je 0x43caf7
cmp dword [ebp - 0xc], esi
jne 0x43caf7
push dword [ebx + 0x5c]
push 0x4c2710
push esi
push esi
call eax
add esp, 0x10
push str.StopAllProgress...
mov esi, 0x4e096c
call fcn.0044ae36
pop ecx
lea edi, [ebp - 0x50]
call fcn.0041e499
push eax
push str.StopAllProgress_return:_d
mov dword [ebp - 8], eax
mov edi, esi
call fcn.0044ae36
cmp dword [ebp - 8], 0
pop ecx
pop ecx
jne 0x43cb51
mov eax, dword [ebx + 0x88]
test eax, eax
je 0x43cb42
push dword [ebx + 0x5c]
push 0x4c2750
push 1
push 0
call eax
add esp, 0x10
mov eax, 0xe0000003
call fcn.00424a44
jmp 0x43ce8f
mov dword [ebp - 4], 0x14
xor esi, esi
jmp 0x43cb66
call fcn.00424283
mov edi, 0x4e096c
mov eax, dword [0x4dbcb8]
cmp eax, esi
je 0x43cb76
push eax
call dword [sym.imp.KERNEL32.DLL_SetEvent]
push str.ClearWebShield...
mov esi, edi
call fcn.0044ae36
pop ecx
xor esi, esi
call fcn.0043adda
test eax, eax
je 0x43cba2
call fcn.0043af36
test eax, eax
je 0x43cba2
call fcn.0043ae57
call fcn.0043aedb
inc esi
push esi
push str.ClearWebShield_return:_d
mov esi, edi
call fcn.0044ae36
push str.ClearFiles...
call fcn.0044ae36
add esp, 0xc
lea eax, [ebp - 0x50]
call fcn.0041e7a5
push str.ClearFiles_end
call fcn.0044ae36
pop ecx
push ebx
call fcn.0043e30c
mov eax, dword [ebp - 4]
call fcn.0043adb9
push dword [ebx + 0x1c]
call fcn.00422c88
mov eax, dword [0x4df4b4]
pop ecx
mov ecx, 0x4df4b4
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push dword [ebx + 0x1c]
call fcn.0043b7e4
mov eax, dword [ebp - 8]
cmp dword [eax - 0xc], 0
pop ecx
pop ecx
je 0x43cc20
push eax
push 0x4c27b0
call fcn.0044ae36
mov eax, dword [ebp - 8]
pop ecx
pop ecx
add eax, 0xfffffff0
call fcn.0040151c
mov eax, dword [ebx + 0x88]
xor esi, esi
cmp eax, esi
je 0x43cc4a
cmp dword [ebp - 0xc], esi
jne 0x43cc4a
push dword [ebx + 0x5c]
push 0x4c27b4
push esi
push dword [ebp - 4]
call eax
add esp, 0x10
cmp dword [ebx + 0xc], esi
jne 0x43cc5a
lea esi, [ebx + 0xcc]
call fcn.0041f0de
push 0
push 2
push 0x46d
push dword [ebx + 0xe0]
call dword [sym.imp.USER32.dll_PostMessageW]
push str.install_begin...
mov esi, edi
call fcn.0044ae36
xor esi, esi
push esi
call fcn.004243e2
mov eax, dword [ebx + 0x1c]
cmp dword [eax - 0xc], esi
pop ecx
pop ecx
je 0x43cca2
push eax
lea eax, [ebx + 0x60]
call fcn.004400d4
test eax, eax
je 0x43cca2
mov eax, ebx
call fcn.0043c431
inc esi
push 1
call fcn.004243e2
test esi, esi
pop ecx
jne 0x43ccf6
mov eax, dword [ebx + 0x88]
test eax, eax
je 0x43ce8f
cmp dword [ebx + 0x7c], esi
push dword [ebx + 0x5c]
je 0x43ccdd
push 0x4c27dc
push 7
push dword [ebp - 4]
call eax
add esp, 0x10
mov eax, 0xe000000d
jmp 0x43cb47
push 0x4c27ec
push 2
push dword [ebp - 4]
call eax
add esp, 0x10
mov eax, 0xe0000002
jmp 0x43cb47
push 0
push 3
push 0x46d
push dword [ebx + 0xe0]
call dword [sym.imp.USER32.dll_PostMessageW]
push dword [ebx + 0x1c]
call fcn.00438b52
push eax
call fcn.00438c47
test eax, eax
jne 0x43cd27
mov eax, 0xe0000029
jmp 0x43cb47
push ebx
call fcn.0043de0c
test eax, eax
push ebx
je 0x43cd41
call fcn.0043debe
mov eax, 0xe0000004
jmp 0x43cb47
call fcn.0043dfe5
test eax, eax
je 0x43cd62
call fcn.00438b52
call fcn.00439164
test eax, eax
jne 0x43cd62
mov eax, 0xe0000005
jmp 0x43cb47
lea esi, [ebx + 0x60]
call fcn.0044006f
mov eax, dword [ebx + 0xc]
neg eax
sbb eax, eax
and eax, 0xa
add eax, 0xa
add dword [ebp - 4], eax
xor esi, esi
cmp dword [ebx + 0x9c], esi
je 0x43cd89
call fcn.00425167
mov eax, dword [ebp - 4]
call fcn.0043adb9
mov eax, dword [ebx + 0x88]
cmp eax, esi
je 0x43cdb1
cmp dword [ebp - 0xc], esi
jne 0x43cdb1
push dword [ebx + 0x5c]
push str.ck_W
push esi
push dword [ebp - 4]
call eax
add esp, 0x10
mov edi, ebx
call fcn.0043e44a
mov eax, ebx
call fcn.0043e490
push ebx
call fcn.0043c4f1
test eax, eax
jne 0x43cdf4
mov eax, dword [ebx + 0x88]
test eax, eax
je 0x43cde5
push dword [ebx + 0x5c]
push 0x4c2810
push 3
push dword [ebp - 4]
call eax
add esp, 0x10
mov eax, 0xe0000007
call fcn.00424a44
jmp 0x43ce8a
push 0
push 4
push 0x46d
push dword [ebx + 0xe0]
call dword [sym.imp.USER32.dll_PostMessageW]
cmp dword [ebx + 0xc], esi
jne 0x43ce1d
push 0xa
lea eax, [ebx + 0xd0]
push eax
call dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
call fcn.0043db95
test eax, eax
jne 0x43ce36
push str.install_ksafe_fail
mov esi, 0x4e096c
call fcn.0044ae36
pop ecx
mov eax, ebx
call fcn.0043dc97
test eax, eax
jne 0x43ce51
push str.install_pcmgr_fail
mov esi, 0x4e096c
call fcn.0044ae36
pop ecx
xor eax, eax
cmp dword [ebx + 0xc], eax
je 0x43ce77
push eax
lea ecx, [ebp - 0xc]
push ecx
push eax
push 0xf003f
push 1
push eax
push eax
push str.SOFTWAREkingsoftAntivirusKNeedReboot
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov eax, ebx
call fcn.0043e0b0
mov dword [ebx + 0x10], 1
call fcn.0043e658
mov edi, 0x4e096c
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
sub eax, dword [ebp - 0x10]
xor esi, esi
cmp dword [ebx + 0x10], esi
mov dword [ebx + 0x84], eax
je 0x43ceaf
push 0x64
pop eax
call fcn.0043adb9
jmp 0x43cebb
push 9
mov eax, 0x4e08ac
call fcn.0040279d
cmp dword [ebx + 0x80], esi
je 0x43cee3
cmp dword [ebx + 0x10], esi
je 0x43cee3
push str.wait_kismain
mov esi, edi
call fcn.0044ae36
mov dword [esp], str.wait_kismain_end
call fcn.0044ae36
pop ecx
xor esi, esi
mov eax, dword [ebx + 0x88]
cmp eax, esi
je 0x43cf02
cmp dword [ebx + 0x10], esi
je 0x43cf02
push dword [ebx + 0x5c]
push 0x4c286c
push esi
push 0x64
call eax
add esp, 0x10
push esi
push 5
push 0x46d
push dword [ebx + 0xe0]
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, 0x4dbca8
call fcn.0041e087
test eax, eax
je 0x43cf36
mov eax, dword [0x4dbca8]
cmp eax, esi
je 0x43cf36
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov eax, dword [0x4dbcac]
mov dword [0x4e0878], eax
mov eax, dword [0x4dbcb0]
add eax, 0xfffffff0
call fcn.00401648
mov esi, eax
add esi, 0x10
push esi
push 0x4e0880
call fcn.00401ac9
lea eax, [esi - 0x10]
call fcn.0040151c
cmp dword [ebx + 0x120], 0
je 0x43cf8e
mov eax, dword [ebx + 0x100]
push ecx
sub eax, 0x10
mov esi, esp
call fcn.00401648
add eax, 0x10
mov dword [esi], eax
push dword [ebx + 0x10]
call fcn.004247e2
pop ecx
pop ecx
push dword [ebx + 0x84]
mov esi, edi
push dword [ebx + 0x10]
push str.install_end__return:_d__install_cost_time:_dms
call fcn.0044ae36
push dword [ebx + 0x10]
push str.install_thread_end:_d
call fcn.00424a53
add esp, 0x14
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.0040151c
lea esi, [ebp - 0x24]
call fcn.00405caf
lea esi, [ebp - 0x34]
call fcn.00405caf
lea esi, [ebp - 0x44]
call fcn.00405caf
mov eax, dword [ebp - 0x48]
add eax, 0xfffffff0
call fcn.0040151c
mov eax, dword [ebp - 0x4c]
add eax, 0xfffffff0
call fcn.0040151c
mov eax, dword [ebp - 0x50]
add eax, 0xfffffff0
call fcn.0040151c
pop edi
pop esi
pop ebx
leave
ret