Function at 0x4069e0
Capabilities:
Check if file exists
Create process on windows
Get file attributes
Persist via run registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x67c
mov eax, dword [0x4270e8]
push ebp
xor ebp, ebp
push esi
cmp eax, ebp
push edi
mov dword [esp + 0x28], ecx
je 0x406c4d
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 0xc]
push ebx
push eax
push 0x20019
push ebp
push str.SOFTWAREkingsoftkswsvc
push 0x80000002
xor bl, bl
mov dword [esp + 0x24], ebp
call esi
test eax, eax
jne 0x406a79
mov ecx, 0x81
lea edi, [esp + 0x76]
mov word [esp + 0x74], bp
lea edx, [esp + 0x74]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x18], 1
stosw word es:[edi], ax
push ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push edx
push eax
push ebp
push str.Installpath
push ecx
mov dword [esp + 0x2c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea edx, [esp + 0x74]
push edx
call fcn.00417a8e
add esp, 4
test eax, eax
jbe 0x406a79
mov bl, 1
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x10]
push ecx
push 0x20019
push ebp
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
push 0x80000002
call esi
test eax, eax
jne 0x406af4
mov ecx, 0x81
lea edi, [esp + 0x76]
mov word [esp + 0x74], bp
lea edx, [esp + 0x18]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x74]
push edx
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push eax
push ecx
push ebp
push str.kwsuninstalldel
push edx
mov dword [esp + 0x2c], 1
mov dword [esp + 0x30], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [esp + 0x74]
push eax
call fcn.00417a8e
add esp, 4
test eax, eax
jbe 0x406af4
mov bl, 1
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
pop ebx
jne 0x406c4d
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x72]
mov word [esp + 0x70], bp
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [0x42c4b4]
cmp eax, ebp
jne 0x406b2a
mov eax, 0x422470
push eax
lea edx, [esp + 0x74]
push str._sModulesMxKWSkwsinst.exe
push edx
call fcn.00417eed
add esp, 0xc
lea eax, [esp + 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x406c4d
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x27a]
mov word [esp + 0x278], bp
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [0x42c44c]
cmp eax, ebp
jne 0x406b79
mov eax, 0x422470
push eax
lea ecx, [esp + 0x27c]
push str._sModulesMxKWS
push ecx
call fcn.00417eed
push 1
push ebp
lea edx, [esp + 0x28c]
push 0x403de0
push edx
call fcn.00413db0
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x48]
mov word [esp + 0x49c], bp
rep stosd dword es:[edi], eax
mov dword [esp + 0x34], eax
mov ecx, 0x81
mov dword [esp + 0x38], eax
lea edi, [esp + 0x49e]
mov dword [esp + 0x3c], eax
add esp, 0x1c
mov dword [esp + 0x24], eax
lea edx, [esp + 0x480]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x70]
mov dword [esp + 0x2c], 0x44
push ecx
push str._s__s__i__vt_6__mchnl_6__schnl_0
push edx
stosw word es:[edi], ax
call fcn.00417eed
add esp, 0xc
lea eax, [esp + 0x18]
lea ecx, [esp + 0x2c]
lea edx, [esp + 0x480]
push eax
push ecx
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x406c4d
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x18]
push 0x2710
push ecx
mov byte [eax + 0x5fc], 1
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [esp + 0x1c]
push eax
call esi
pop edi
pop esi
pop ebp
add esp, 0x67c
ret