Function at 0x41cdf0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x476138
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push edi
mov eax, dword [0x48b2b0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov eax, dword [0x48eacc]
mov edx, dword [eax + 0xc]
mov ecx, 0x48eacc
call edx
add eax, 0x10
mov dword [esp + 0xc], eax
xor ebx, ebx
mov dword [esp + 0x20], ebx
mov eax, dword [esi + 0x40]
cmp eax, ebx
je 0x41ce55
mov ecx, dword [esi + 0x18]
mov edx, dword [0x48d210]
push ecx
push 0x47c960
push ebx
push ebx
push edx
call eax
add esp, 0x14
call fcn.0040cd10
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [esi + 0xc]
lea ecx, [esp + 0xc]
mov dword [esp + 0x10], eax
call fcn.0040c6d0
cmp eax, ebx
je 0x41cfb1
push str.uninstall_begin...
mov ecx, 0x48fcd8
mov dword [esi + 4], ebx
call fcn.00427400
mov eax, dword [esi + 0x40]
mov edi, dword [str.cccd]
add esp, 4
cmp eax, ebx
je 0x41ceac
mov ecx, dword [esi + 0x18]
push ecx
push str.ck_WgbL
push ebx
push 1
push edi
call eax
add esp, 0x14
push esi
call fcn.0041c250
cmp eax, ebx
jne 0x41ced0
mov eax, dword [esi + 0x40]
cmp eax, ebx
je 0x41ced0
mov edx, dword [esi + 0x18]
push edx
push 0x47c99c
push 2
push 1
push edi
call eax
add esp, 0x14
mov eax, dword [esi + 0x40]
cmp eax, ebx
je 0x41ceef
mov ecx, dword [esi + 0x18]
mov edx, dword [0x48d218]
push ecx
push str.ck_W_Rd
push ebx
push 2
push edx
call eax
add esp, 0x14
mov eax, dword [0x48f9a4]
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp eax, ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
jne 0x41cf27
push str.Kernel32.dll
call edi
test eax, eax
je 0x41cf1e
push str.Wow64EnableWow64FsRedirection
push eax
call ebx
mov dword [0x48f9a4], eax
jmp 0x41cf23
mov eax, dword [0x48f9a4]
test eax, eax
je 0x41cf2b
push 0
call eax
push esi
call fcn.0041c5e0
mov eax, dword [0x48f9a4]
test eax, eax
jne 0x41cf5d
push str.Kernel32.dll
call edi
test eax, eax
je 0x41cf54
push str.Wow64EnableWow64FsRedirection
push eax
call ebx
mov dword [0x48f9a4], eax
jmp 0x41cf59
mov eax, dword [0x48f9a4]
test eax, eax
je 0x41cf61
push 1
call eax
xor edi, edi
cmp dword [esi + 0x1c], edi
je 0x41cf80
mov eax, dword [esi + 0x20]
cmp eax, edi
je 0x41cf76
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [esi + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x20], edi
mov dword [esi + 0x1c], edi
mov eax, dword [esi + 0x40]
cmp eax, edi
je 0x41cfa5
mov ecx, dword [esi + 0x18]
mov edx, dword [0x48d21c]
push ecx
push str.ck_W
push edi
push 3
push edx
call eax
add esp, 0x14
call fcn.0041c920
mov dword [esi + 4], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esp + 0x10]
mov dword [esi + 0x3c], eax
mov eax, dword [esi + 0x40]
test eax, eax
je 0x41cfe4
cmp dword [esi + 4], 0
je 0x41cfe4
mov ecx, dword [esi + 0x18]
mov edx, dword [0x48d220]
push ecx
push 0x47c9d4
push 0
push 4
push edx
call eax
add esp, 0x14
cmp dword [esi + 0x38], 0
je 0x41d01a
push str.wait_wpsmain
mov ecx, 0x48fcd8
call fcn.00427400
mov eax, dword [esi + 0x38]
add esp, 4
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push str.wait_wpsmain_end
mov ecx, 0x48fcd8
call fcn.00427400
add esp, 4
mov ecx, dword [esi + 0x3c]
mov edx, dword [esi + 4]
push ecx
push edx
push str.uninstall_end__return:_d__install_cost_time:_dms
mov ecx, 0x48fcd8
call fcn.00427400
mov dword [esp + 0x2c], 0xffffffff
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
add esp, 0xc
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41d05c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret