Function at 0x429bf0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47f6c6
mov eax, dword fs:[0]
push eax
sub esp, 0x100
mov eax, dword [0x4ac084]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str.PCKeeper.exe
push str.29650533_2E1B_4517_9D0C_B7243F12DF94
push str.299FFF17_0FDF_47F4_A894_1DADF0D98007
mov ecx, 0x4b062c
call fcn.00448b60
push str.PCKAV.exe
push str.6D62ECA7_CC77_47AF_AA5C_FE6B72350139
push str.FE88A67B_BBC2_49A8_B12F_3504144E1044
mov ecx, 0x4b0634
call fcn.00448b60
push str.AccountService.exe
push str.88359144_2AD6_4DD8_A3C5_680BD50AD321
push str.FDDE8CC8_A372_459C_8C41_4263EDDA260E
mov ecx, 0x4b063c
call fcn.00448b60
cmp word [0x4b062c], 0
jne 0x429c9b
cmp word [0x4b062e], 0
jne 0x429c9b
cmp word [0x4b0630], 0
jne 0x429c9b
cmp word [0x4b0632], 0
mov dword [ebp - 0xac], 1
je 0x429ca5
mov dword [ebp - 0xac], 0
mov di, word [0x4b0634]
mov cx, word [0x4b063a]
mov dx, word [0x4b0638]
mov si, word [0x4b0636]
test di, di
jne 0x429cdc
test si, si
jne 0x429cdc
test dx, dx
jne 0x429cdc
test cx, cx
jne 0x429cdc
mov eax, 1
jmp 0x429cde
xor eax, eax
xor ebx, ebx
test eax, eax
sete bl
xor eax, eax
cmp dword [ebp - 0xac], eax
sete al
add ebx, eax
mov eax, dword [0x4b04c4]
test al, 2
je 0x429de0
cmp word [0x4b062c], 0
jne 0x429d93
cmp word [0x4b062e], 0
jne 0x429d93
cmp word [0x4b0630], 0
jne 0x429d93
cmp word [0x4b0632], 0
jne 0x429d93
cmp word [0x4b063c], 0
jne 0x429d89
cmp word [0x4b063e], 0
jne 0x429d89
cmp word [0x4b0640], 0
jne 0x429d89
cmp word [0x4b0642], 0
jne 0x429d89
push str.UninstallMode:_PCK_and_AccSvc_not_installed
push 3
push 3
push 0x98
lea ecx, [ebp - 0xc4]
push str.UninstallMode
push str.Installer.cpp
call fcn.00457220
push eax
call fcn.004573f0
add esp, 0x10
mov eax, 1
jmp 0x42a061
and eax, 0xfffffffd
mov dword [0x4b04c4], eax
jmp 0x429de0
push str.UninstallMode:_PCK_will_be_uninstalled
push 1
push 3
push 0x9f
push str.UninstallMode
push str.Installer.cpp
lea ecx, [ebp - 0xd0]
call fcn.00457220
push eax
call fcn.004573f0
mov cx, word [0x4b063a]
add esp, 0x10
mov dx, word [0x4b0638]
mov si, word [0x4b0636]
mov di, word [0x4b0634]
mov eax, dword [0x4b04c4]
test al, 4
je 0x429e74
test di, di
jne 0x429e43
test si, si
jne 0x429e43
test dx, dx
jne 0x429e43
test cx, cx
jne 0x429e43
cmp word [0x4b063c], cx
jne 0x429e39
cmp word [0x4b063e], cx
jne 0x429e39
cmp word [0x4b0640], cx
jne 0x429e39
cmp word [0x4b0642], cx
jne 0x429e39
push str.UninstallMode:_AV_and_AccSvc_not_installed
push 3
push 3
push 0xa8
lea ecx, [ebp - 0xdc]
jmp 0x429d67
and eax, 0xfffffffb
mov dword [0x4b04c4], eax
jmp 0x429e74
push str.UninstallMode:_AV_will_be_uninstalled
push 1
push 3
push 0xaf
push str.UninstallMode
push str.Installer.cpp
lea ecx, [ebp - 0xe8]
call fcn.00457220
push eax
call fcn.004573f0
mov eax, dword [0x4b04c4]
add esp, 0x10
test al, 2
je 0x429e79
dec ebx
test al, 4
je 0x429e7e
dec ebx
cmp word [0x4b063c], 0
jne 0x429ea6
cmp word [0x4b063e], 0
jne 0x429ea6
cmp word [0x4b0640], 0
jne 0x429ea6
cmp word [0x4b0642], 0
je 0x429ee3
test ebx, ebx
jne 0x429ee3
push str.UninstallMode:_AccSvc_will_be_uninstalled
push 1
push 3
push 0xbc
push str.UninstallMode
or eax, 1
lea ecx, [ebp - 0xf4]
push str.Installer.cpp
mov dword [0x4b04c4], eax
call fcn.00457220
push eax
call fcn.004573f0
mov eax, dword [0x4b04c4]
add esp, 0x10
test eax, eax
jne 0x429f00
push str.UninstallMode:_nothing_to_uninstall
push 3
push 3
push 0xc1
lea ecx, [ebp - 0x100]
jmp 0x429d67
push 1
call fcn.0040d940
mov ecx, eax
call fcn.0040d990
lea ecx, [ebp - 0xa8]
call fcn.0042afc0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x44]
cmp dword [0x4b04c4], 0
je 0x429f33
call fcn.00433a60
jmp 0x429f58
call fcn.00433d80
cmp dword [ebp - 0x3c], 0
jne 0x429f58
push 0
push 0
lea eax, [ebp - 0x44]
push eax
push 0x4338b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x48], 0
lea ecx, [ebp - 0xa8]
mov dword [ebp - 0x14], 0
call fcn.0042cdf0
mov esi, eax
lea ecx, [ebp - 0x10c]
push esi
push str.UninstallMode_finished__res___d
push 1
push 3
push 0xc9
push str.UninstallMode
push str.Installer.cpp
call fcn.00457220
push eax
call fcn.004573f0
add esp, 0x14
test esi, esi
je 0x429fad
cmp esi, 1
jne 0x42a054
mov ecx, dword [0x4b04c4]
mov edx, ecx
push 0
push 0
and edx, 4
and ecx, 2
call fcn.0040f160
add esp, 8
mov dword [ebp - 0xb8], 0
mov dword [ebp - 0xb4], 0
mov dword [ebp - 0xb0], 0
push 0x2001f
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 1
call fcn.00402f70
mov eax, dword [0x4b04c4]
test al, 2
je 0x42a021
push str.E44BBEE3_3F83_4670_9E2E_EE0556442287
lea ecx, [ebp - 0xb8]
call fcn.00418720
mov eax, dword [0x4b04c4]
test al, 4
je 0x42a03a
push str.E7E7B26A_88AA_48B0_A47C_173C062FD904
lea ecx, [ebp - 0xb8]
call fcn.00418720
mov eax, dword [0x4b04c4]
test al, 1
je 0x42a043
call fcn.0042aca0
mov eax, dword [ebp - 0xb8]
test eax, eax
je 0x42a054
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0xa8]
call fcn.0042b130
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00458d41
mov esp, ebp
pop ebp
ret