Function at 0x401a60
Capabilities:
Check mutex on windows
Delete file

Disassembly:
sub esp, 0xd10
mov eax, dword [0x410040]
xor eax, esp
mov dword [esp + 0xd0c], eax
push esi
push str._CKPPUpdater.exe__WinMain___Start_Updating...
call fcn.00402010
add esp, 4
push str.CKPhishingPro_Updater_is_Running_
xor esi, esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x401ac5
push str._CKPPUpdater.exe__WinMain___Updater_is_Running...
call fcn.00402010
add esp, 4
xor eax, eax
pop esi
mov ecx, dword [esp + 0xd0c]
xor ecx, esp
call fcn.00402aa5
add esp, 0xd10
ret 0x10
push ebx
push ebp
push edi
push 0x1ff
lea eax, [esp + 0x121]
push esi
push eax
mov byte [esp + 0x128], 0
call fcn.00402590
push 0x1ff
lea ecx, [esp + 0x32d]
push esi
push ecx
mov byte [esp + 0x334], 0
call fcn.00402590
add esp, 0x18
mov dword [esp + 0x10], esi
call fcn.00401430
mov edx, dword [0x411334]
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
imul edx, edx, 0x3e8
push edx
call ebp
call fcn.00401220
mov ebx, eax
lea eax, [esp + 0x31c]
push eax
lea ecx, [esp + 0x120]
push ecx
call fcn.004018a0
mov edi, eax
add esp, 8
cmp edi, esi
jne 0x401b9f
mov eax, dword [section..data]
cmp eax, esi
jle 0x401b9f
test eax, eax
jle 0x401b9f
lea edx, [esp + 0x31c]
push edx
lea eax, [esp + 0x120]
push eax
call fcn.004018a0
mov edi, eax
add esp, 8
cmp edi, 1
je 0x401b9f
mov ecx, dword [0x410004]
mov edx, dword [section..data]
push ecx
push edx
push esi
push str._CKPPUpdater.exe__WinMain___Sleep_for_Network_Connection__RetryCnt___ld__ld__RetryWaitTime___ld
call fcn.00402010
mov eax, dword [0x410004]
add esp, 0x10
push eax
call ebp
add esi, 1
cmp esi, dword [section..data]
jl 0x401b51
call fcn.004011d0
lea ecx, [esp + 0x11c]
push ecx
xor esi, esi
call fcn.00402d85
add esp, 4
cmp ebx, eax
jge 0x401bbf
mov esi, 1
test edi, edi
je 0x401d8b
test esi, esi
je 0x401d8b
push 0x7ff
lea edx, [esp + 0x521]
push 0
push edx
mov byte [esp + 0x528], 0
call fcn.00402590
push 1
call fcn.00401000
add esp, 0x10
lea edx, [esp + 0x51c]
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx], cl
add eax, 1
add edx, 1
test cl, cl
jne 0x401c00
push 2
call fcn.00401000
add esp, 4
mov edx, eax
lea ebx, [ebx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x401c20
lea edi, [esp + 0x51c]
sub eax, edx
add edi, 0xffffffff
mov cl, byte [edi + 1]
add edi, 1
test cl, cl
jne 0x401c35
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push 1
push 6
rep movsb byte es:[edi], byte [esi]
call fcn.00401000
mov esi, dword [sym.imp.USER32.dll_MessageBoxA]
add esp, 4
push eax
lea eax, [esp + 0x524]
push eax
push 0
call esi
cmp eax, 2
jne 0x401c85
push str._CKPPUpdater.exe__WinMain___IDCANCEL
call fcn.00402010
add esp, 4
jmp 0x401df1
lea ecx, [esp + 0x14]
push 0x105
push ecx
call fcn.00402250
lea eax, [esp + 0x1c]
add esp, 8
add eax, 0xffffffff
mov edi, edi
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x401ca0
mov edx, dword [str.CKPPUpdate.exe]
mov ecx, dword [0x40c784]
mov dword [eax], edx
mov edx, dword [0x40c788]
mov dword [eax + 4], ecx
mov ecx, dword [0x40c78c]
mov dword [eax + 8], edx
lea edx, [esp + 0x14]
mov dword [eax + 0xc], ecx
push edx
lea eax, [esp + 0x320]
push eax
call fcn.004016e0
add esp, 8
test eax, eax
je 0x401dec
lea ecx, [esp + 0x14]
push ecx
call fcn.00401320
add esp, 4
test eax, eax
je 0x401d70
push str.IsUserAnAdmin
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x401d1c
call eax
mov esi, eax
jmp 0x401d20
mov esi, dword [esp + 0x10]
call fcn.004021f0
test eax, eax
je 0x401d3d
test esi, esi
je 0x401d3d
push 1
push str.runas
push 0
lea edx, [esp + 0x20]
push edx
jmp 0x401d48
push 1
push 0
push 0
lea eax, [esp + 0x20]
push eax
call fcn.00402490
add esp, 0x10
lea ecx, [esp + 0x14]
push ecx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor eax, eax
cmp esi, 4
setne al
sub eax, 1
and eax, 4
jmp 0x401df3
cmp dword [0x411330], 0
jne 0x401dec
push 0
push str.PhishingPro_Updater
push str.Executable_is_not_signed
push 0
call esi
jmp 0x401dec
push 0x7ff
lea edx, [esp + 0x521]
push 0
push edx
mov byte [esp + 0x528], 0
call fcn.00402590
push 4
call fcn.00401000
add esp, 0x10
lea edx, [esp + 0x51c]
mov cl, byte [eax]
mov byte [edx], cl
add eax, 1
add edx, 1
test cl, cl
jne 0x401db8
cmp dword [0x411330], 0
jne 0x401dec
push 0
push 5
call fcn.00401000
add esp, 4
push eax
lea eax, [esp + 0x524]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
call fcn.004011d0
xor eax, eax
mov ecx, dword [esp + 0xd1c]
pop edi
pop ebp
pop ebx
pop esi
xor ecx, esp
call fcn.00402aa5
add esp, 0xd10
ret 0x10