Function at 0x40c1be
Capabilities:
Check mutex on windows
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4a396a
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x1224
call fcn.00483cd0
mov eax, dword [0x4d0620]
xor eax, esp
mov dword [esp + 0x1220], eax
push ebx
push esi
push edi
mov eax, dword [0x4d0620]
xor eax, esp
push eax
lea eax, [esp + 0x1238]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [esp + 0x20], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebx + 0x12c], eax
call fcn.0043466d
lea esi, [ebx + 0x124]
call fcn.00402905
xor esi, esi
push 0x206
lea eax, [esp + 0x102a]
push esi
push eax
mov word [esp + 0x1030], si
call fcn.0047e7d0
add esp, 0xc
push 0x104
lea eax, [esp + 0x1028]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x1024]
push 0x5c
push eax
call fcn.0047ebd0
cmp eax, esi
pop ecx
pop ecx
jne 0x40c294
xor eax, eax
mov ecx, dword [esp + 0x1238]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1220]
xor ecx, esp
call fcn.0047b9fe
mov esp, ebp
pop ebp
ret
mov word [eax + 2], si
lea eax, [esp + 0x1024]
lea edi, [ebx + 0x110]
push eax
mov ecx, edi
call fcn.004014c5
call fcn.0043450b
cmp eax, esi
je 0x40c26e
push edi
lea ecx, [esp + 0x20]
call fcn.0040144c
push 0x4ad698
lea ecx, [esp + 0x20]
mov dword [esp + 0x1244], esi
call fcn.00401250
mov edi, dword [esp + 0x1c]
mov ecx, edi
call fcn.00428c7b
cmp eax, esi
jne 0x40c2ee
lea ecx, [edi - 0x10]
call fcn.00401325
jmp 0x40c26e
call fcn.00428da0
call fcn.00428e69
cmp eax, esi
jl 0x40c2e4
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.0046b2e7
test eax, eax
jne 0x40c356
call fcn.0045db7e
push eax
lea ecx, [esp + 0x14]
call fcn.0040161b
push 0xb4
mov byte [esp + 0x1244], 1
mov eax, dword [0x4ee7f4]
mov ecx, dword [eax]
lea edx, [esp + 0x14]
push edx
push eax
call dword [ecx + 0xc]
push esi
push 0x40
push dword [esp + 0x18]
call fcn.00469444
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff0
call fcn.00401325
jmp 0x40c2e4
push str.Terminate_Update_Process_And_Exit_Now
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push str.EVENT_NAME_Terminate_Update_Process_And_Exit_Now
push esi
push 1
push esi
mov dword [ebx + 0xe8], eax
call edi
mov dword [ebx + 0xec], eax
call fcn.0040edf8
cmp eax, esi
jne 0x40c393
mov ecx, dword [esp + 0x1c]
add ecx, 0xfffffff0
jmp 0x40c2e7
call fcn.004027df
call fcn.00403ba0
push str.Kingsoft_Antivirus_message_communication_between_KavLANSyncupd_and_Update.
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
push str.KAV2000_Update_2.0
push 1
push esi
mov dword [ebx + 0xe0], eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
cmp eax, esi
mov dword [ebx + 0xc8], eax
je 0x40c387
or dword [0x4ede0c], 0xffffffff
push str.Kingsoft_Antivirus_Update_File_Mapping
push 0x18
push esi
push 4
push esi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
cmp eax, esi
mov dword [0x4ede0c], eax
je 0x40c387
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40c5ba
push esi
push esi
push esi
push 0xf001f
push dword [0x4ede0c]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, esi
mov dword [esp + 0x14], eax
je 0x40c4e3
xor eax, eax
mov dword [esp + 0x24], esi
lea edi, [esp + 0x28]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x18
push dword [esp + 0x18]
stosd dword es:[edi], eax
lea eax, [esp + 0x2c]
push eax
call fcn.0047f590
add esp, 0xc
cmp dword [0x4efa9c], esi
je 0x40c455
push dword [ebx + 0xec]
call dword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x40c4d9
cmp dword [esp + 0x28], esi
je 0x40c495
cmp dword [0x4eef64], esi
jne 0x40c4d9
cmp dword [esp + 0x2c], esi
jne 0x40c4b5
cmp dword [esp + 0x24], esi
je 0x40c480
push esi
push esi
push 0x427
push dword [esp + 0x30]
call dword [sym.imp.USER32.dll_PostMessageW]
xor ebx, ebx
mov ecx, dword [esp + 0x1c]
add ecx, 0xfffffff0
call fcn.00401325
mov eax, ebx
jmp 0x40c270
cmp dword [esp + 0x30], esi
je 0x40c4b5
cmp dword [esp + 0x38], esi
je 0x40c4d9
push dword [esp + 0x38]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x40c4d9
push dword [esp + 0x38]
jmp 0x40c4d3
push dword [esp + 0x24]
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x40c4cf
push 9
push dword [esp + 0x28]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esp + 0x24]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebx + 0xc8]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebx + 0xc8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx + 0xc8], esi
cmp dword [0x4ef1d8], esi
je 0x40c5b2
call fcn.0045db7e
push eax
lea ecx, [esp + 0x18]
call fcn.0040161b
mov byte [esp + 0x1240], 2
call fcn.0045db7e
push eax
lea ecx, [esp + 0x14]
call fcn.0040161b
push 0x8044
mov byte [esp + 0x1244], 3
mov eax, dword [0x4ee7f4]
mov ecx, dword [eax]
lea edx, [esp + 0x18]
push edx
push eax
call dword [ecx + 0xc]
mov eax, dword [0x4ee7f4]
mov ecx, dword [eax]
push 0x8055
lea edx, [esp + 0x14]
push edx
push eax
call dword [ecx + 0xc]
mov ebx, dword [esp + 0x14]
mov ecx, str.szStatusTitle
call fcn.00408ce7
mov ebx, dword [esp + 0x10]
mov ecx, str.szStatusDesc
call fcn.00408ce7
mov eax, dword [esp + 0x20]
push 0xffffffffffffffff
push 1
push dword [eax + 0xe0]
push 0xffff
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff0
call fcn.00401325
mov ecx, dword [esp + 0x14]
add ecx, 0xfffffff0
call fcn.00401325
xor ebx, ebx
inc ebx
jmp 0x40c482
xor eax, eax
inc eax
mov dword [ebx + 0xcc], eax
cmp dword [0x4efa9c], esi
je 0x40c5d2
mov ebx, eax
jmp 0x40c482
lea eax, [esp + 0x3c]
push eax
push esi
push dword [ebx + 0xec]
mov dword [esp + 0x48], esi
push 0x40d9f4
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push esi
mov dword [ebx + 0xf0], eax
call fcn.0046bc0c
pop ecx
push ebx
call fcn.0040c7ea
test eax, eax
je 0x40c480
call fcn.0040ce6d
xor ebx, ebx
cmp eax, ebx
je 0x40c482
cmp dword [0x4eef6c], ebx
jne 0x40c5b2
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], vtable.CBeforUpdateActionMgr.0
lea ecx, [esp + 0x14]
mov byte [esp + 0x1240], 4
call fcn.0042b875
lea esi, [esp + 0x14]
call fcn.0042b836
push ebx
push ebx
push 1
push ebx
mov byte [esp + 0x1250], bl
call edi
mov esi, dword [esp + 0x20]
push ebx
push ebx
push 1
push ebx
mov dword [esi + 0xf8], eax
call edi
mov dword [esi + 0xfc], eax
call fcn.0042aa9b
cmp eax, ebx
mov dword [esi + 0xac], eax
je 0x40c482
lea eax, [esp + 0x40]
push eax
push ebx
push ebx
push 0x40ce5c
push ebx
push ebx
mov dword [esp + 0x58], ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x100], eax
call fcn.0040c055
lea eax, [esp + 0x44]
push eax
call fcn.00422edd
mov byte [esp + 0x1240], 5
call fcn.00428e38
mov eax, dword [0x4ee930]
neg eax
sbb eax, eax
and eax, dword [0x4ee938]
push eax
call fcn.0043555c
call fcn.00428e69
cmp dword [0x4eef78], ebx
je 0x40c73e
cmp dword [0x4efdd4], ebx
je 0x40c73e
call fcn.00428e38
cmp dword [0x4efdd4], ebx
je 0x40c700
mov eax, dword [0x4efdd0]
cmp eax, ebx
je 0x40c700
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx + 8]
call fcn.00428e69
call fcn.00435617
mov edi, eax
call fcn.004355fb
mov esi, eax
call fcn.0043536e
test eax, eax
je 0x40c729
cmp esi, ebx
jne 0x40c729
cmp edi, ebx
jne 0x40c729
call fcn.00434b5b
lea ecx, [esp + 0x44]
mov byte [esp + 0x1240], bl
call fcn.00423116
jmp 0x40c5b2
lea edi, [esp + 0x20]
mov dword [esp + 0x20], ebx
call fcn.0040db8b
cmp eax, ebx
je 0x40c76a
cmp dword [esp + 0x20], ebx
jne 0x40c76a
lea ecx, [esp + 0x44]
mov byte [esp + 0x1240], bl
call fcn.00423116
jmp 0x40c482
call fcn.0043536e
test eax, eax
je 0x40c7d7
push 9
call fcn.004353a1
mov edi, eax
cmp edi, ebx
pop ecx
je 0x40c7d7
cmp dword [0x4eef64], ebx
jne 0x40c7d7
call fcn.0045db7e
push eax
lea ecx, [esp + 0x18]
call fcn.0040161b
push ebx
push str.isself
lea eax, [esp + 0x1c]
push str._s_d
push eax
mov byte [esp + 0x1250], 6
call fcn.004063eb
mov eax, dword [edi]
add esp, 0x10
push dword [esp + 0x14]
mov ecx, edi
call dword [eax + 0x10]
mov byte [esp + 0x1240], 5
mov ecx, dword [esp + 0x14]
add ecx, 0xfffffff0
call fcn.00401325
lea eax, [esp + 0x44]
mov ecx, eax
mov dword [esi + 0x20], eax
call fcn.00424825
jmp 0x40c729