Function at 0x401000
Capabilities:
Check mutex on windows
Create process on windows
Create thread
Delete file
Get common file path
Read .ini file

Disassembly:
sub esp, 0x858
push ebp
push esi
push str.cbUpdate_Flag
xor ebp, ebp
push 1
push ebp
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
mov dword [esp + 0x20], esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40103f
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
xor eax, eax
pop ebp
add esp, 0x858
ret 0x10
mov eax, dword [esp + 0x864]
push ebx
push edi
push 0x104
push 0x407a14
mov dword [0x407a00], eax
mov dword [0x4079f0], 0xffffffff
mov dword [esp + 0x18], ebp
call fcn.00401c00
add esp, 8
lea ecx, [esp + 0x14c]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov edi, str.cbupdate.ini
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x14c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x14c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.00401d20
mov ecx, dword [0x407a00]
push ebp
push 0x4018c0
push ebp
push 0x65
push ecx
call dword [sym.imp.USER32.dll_CreateDialogParamA]
push str.start
mov dword [0x4079f8], eax
call fcn.00401de0
mov edx, dword [0x4079f8]
add esp, 4
push 0xfffffffffffffff0
push edx
call dword [sym.imp.USER32.dll_GetWindowLongA]
or eax, 0x80000
push eax
mov eax, dword [0x4079f8]
push 0xfffffffffffffff0
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov ecx, dword [0x407a00]
push 0x65
push ecx
call dword [sym.imp.USER32.dll_LoadIconA]
mov edx, dword [0x4079f8]
push eax
push ebp
push 0x80
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [0x4079f8]
push ebp
push eax
call dword [sym.imp.USER32.dll_GetSystemMenu]
mov edi, dword [sym.imp.USER32.dll_AppendMenuA]
push ebp
mov esi, eax
push ebp
push 0x800
push esi
call edi
push 0x104
lea ecx, [esp + 0x4c]
mov edx, dword [0x407a00]
mov ebx, dword [sym.imp.USER32.dll_LoadStringA]
push ecx
push 0xa
push edx
call ebx
lea eax, [esp + 0x48]
push eax
push 0x20
push ebp
push esi
call edi
mov edx, dword [0x407a00]
lea ecx, [esp + 0x48]
push 0x104
push ecx
push 0xb
push edx
call ebx
lea eax, [esp + 0x48]
push eax
push 0x30
push ebp
push esi
call edi
push ebp
push ebp
push 0x800
push esi
call edi
mov edx, dword [0x407a00]
lea ecx, [esp + 0x48]
push 0x104
push ecx
push 0xc
push edx
call ebx
lea eax, [esp + 0x48]
push eax
push 0x10
push ebp
push esi
call edi
mov edx, dword [0x407a00]
lea ecx, [esp + 0x48]
push 0x104
push ecx
push 1
push edx
call ebx
mov ecx, dword [0x4079f8]
lea eax, [esp + 0x48]
push eax
push 0x3ea
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, dword [sym.imp.USER32.dll_SetWindowTextA]
push eax
call esi
mov eax, dword [0x4079f8]
lea edx, [esp + 0x48]
push edx
push eax
call esi
mov ecx, dword [0x4079f8]
push 3
push ebp
push ebp
push ebp
push ebp
push 0xffffffffffffffff
push ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
mov edx, dword [0x4079f8]
push 1
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x4079f8]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
push ebp
mov ecx, dword [0x4079f8]
push 0x64
push 1
push ecx
call dword [sym.imp.USER32.dll_SetTimer]
push str.network.ini
lea edx, [esp + 0x4c]
push 0x104
push edx
push str.http:__www.iciba.net_update_cbupdate.ini
push str.updatepath
push str.update
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, dword [0x4079f8]
lea ecx, [esp + 0x48]
mov dword [0x407a08], eax
lea eax, [esp + 0x24]
push eax
push ebp
push 0x407a08
push 0x401a60
lea edx, [esp + 0x15c]
push ebp
push ebp
mov dword [0x407a0c], ecx
mov dword [0x407a10], edx
mov dword [esp + 0x3c], ebp
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
push ebp
push ebp
lea ecx, [esp + 0x34]
push ebp
push ecx
mov edi, eax
call esi
test eax, eax
je 0x4012fa
mov ebp, dword [sym.imp.USER32.dll_TranslateMessage]
mov eax, dword [0x4079f8]
lea edx, [esp + 0x2c]
push edx
push eax
call dword [sym.imp.USER32.dll_IsDialogMessageA]
test eax, eax
jne 0x4012e9
lea ecx, [esp + 0x2c]
push ecx
call ebp
lea edx, [esp + 0x2c]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 0
push 0
lea eax, [esp + 0x34]
push 0
push eax
call esi
test eax, eax
jne 0x4012c2
mov ecx, dword [0x4079f8]
mov ebp, 1
push ebp
push ecx
call dword [sym.imp.USER32.dll_KillTimer]
mov edx, dword [0x4079f8]
push edx
call dword [sym.imp.USER32.dll_DestroyWindow]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x4079f4], ebp
je 0x40185f
mov ecx, dword [0x4079fc]
lea eax, [esp + 0x764]
push 0x10
push eax
push ecx
call fcn.004022a1
add esp, 0xc
mov edi, 0x4070dc
lea esi, [esp + 0x764]
mov dl, byte [esi]
mov cl, byte [edi]
mov al, dl
cmp dl, cl
jne 0x40137a
test al, al
je 0x401376
mov cl, byte [esi + 1]
mov dl, byte [edi + 1]
mov al, cl
cmp cl, dl
jne 0x40137a
add esi, 2
add edi, 2
test al, al
jne 0x401352
xor eax, eax
jmp 0x40137f
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40169d
mov ecx, 0x41
lea edi, [esp + 0x354]
rep stosd dword es:[edi], eax
mov edi, 0x407a14
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], eax
lea edx, [esp + 0x354]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x354]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.xdict.exe
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x41
lea edi, [esp + 0x660]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x660]
lea ecx, [esp + 0x354]
push eax
push ecx
call fcn.00401c40
lea edx, [esp + 0x668]
push edx
call fcn.00401aa0
mov dword [esp + 0x24], eax
lea eax, [esp + 0x66c]
push eax
call fcn.00401b20
add esp, 0x10
mov dword [esp + 0x20], eax
lea ecx, [esp + 0x250]
push 0xa
push ecx
push ebp
call fcn.004022a1
add esp, 0xc
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [esp + 0x14c]
lea eax, [esp + 0x458]
push edx
push 0x104
push eax
push 0x407b1c
lea ecx, [esp + 0x260]
push str.MainVer
push ecx
call edi
lea edx, [esp + 0x458]
mov esi, eax
push edx
call fcn.00402296
add esp, 4
test esi, esi
je 0x4014a6
cmp eax, dword [esp + 0x18]
jne 0x4014a6
inc ebp
mov dword [esp + 0x14], 1
jmp 0x40143d
mov eax, dword [esp + 0x14]
mov esi, 1
cmp eax, esi
jne 0x401692
lea eax, [esp + 0x250]
push 0xa
dec ebp
push eax
push ebp
call fcn.004022a1
add esp, 0xc
lea ecx, [esp + 0x14c]
lea edx, [esp + 0x458]
lea eax, [esp + 0x250]
push ecx
push 0x104
push edx
push 0x407b1c
push str.MinorVer
push eax
call edi
test eax, eax
je 0x40150a
lea ecx, [esp + 0x458]
push ecx
call fcn.00402296
add esp, 4
jmp 0x40150e
mov eax, dword [esp + 0x1c]
cmp eax, dword [esp + 0x20]
jle 0x401692
lea edx, [esp + 0x14c]
push 0x4070b8
push edx
call fcn.004021f8
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x4016f9
push 2
push 0
push ebp
call fcn.0040214c
push ebp
call fcn.00401ff4
push 0
push 0
push ebp
mov esi, eax
call fcn.0040214c
push ebp
call fcn.00401f9e
add esp, 0x20
test esi, esi
je 0x40185f
push esi
call fcn.00401f90
mov edi, eax
push esi
mov dword [esp + 0x18], edi
call fcn.00401f90
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x4016f4
mov ecx, esi
xor eax, eax
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, esi
xor eax, eax
mov edi, ebp
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [esp + 0x14c]
lea ecx, [esp + 0x250]
push eax
push esi
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionA]
cmp byte [ebp], 0
je 0x401669
push str.Comment
push ebp
call fcn.00401f10
add esp, 8
test eax, eax
je 0x40164d
push 0x3d
push ebp
call fcn.00401e50
add esp, 8
test eax, eax
je 0x40164d
inc eax
je 0x40164d
push eax
call fcn.00401bb0
add esp, 4
test eax, eax
je 0x40164d
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, dword [esp + 0x10]
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x4070ac
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, dword [esp + 0x10]
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov al, byte [ecx + ebp + 1]
lea ebp, [ecx + ebp + 1]
test al, al
jne 0x4015c9
mov edi, dword [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x401683
mov dword [0x4079f0], eax
jmp 0x401706
mov dword [0x4079f0], 1
jmp 0x4017cd
mov dword [0x4079f0], esi
jmp 0x4017cd
mov edi, str.800c0006
lea esi, [esp + 0x764]
mov cl, byte [esi]
mov dl, byte [edi]
mov al, cl
cmp cl, dl
jne 0x4016d1
test al, al
je 0x4016cd
mov dl, byte [esi + 1]
mov cl, byte [edi + 1]
mov al, dl
cmp dl, cl
jne 0x4016d1
add esi, 2
add edi, 2
test al, al
jne 0x4016a9
xor eax, eax
jmp 0x4016d6
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4016e5
mov dword [0x4079f0], ebp
jmp 0x4017cd
mov dword [0x4079f0], 2
jmp 0x40180f
mov esi, 1
mov eax, dword [0x4079f0]
test eax, eax
jne 0x4017c9
push str.update
call fcn.00401de0
mov ecx, dword [0x407a00]
add esp, 4
lea eax, [esp + 0x48]
push 0x104
push eax
push 3
push ecx
call ebx
lea edi, [esp + 0x48]
or ecx, 0xffffffff
xor eax, eax
mov ebp, dword [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x104
mov esi, edi
mov edx, ecx
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x4c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [0x407a00]
push 4
push ecx
call ebx
lea edx, [esp + 0x48]
push 0x24
push edx
push ebp
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x4017bb
push str.network.ini
lea eax, [esp + 0x4c]
push 0x104
push eax
push str.http:__www.iciba.net
push 0x407084
push str.update
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 3
push 0
lea ecx, [esp + 0x50]
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push ebp
call fcn.00401e28
add esp, 4
jmp 0x40185f
cmp eax, esi
jne 0x40180a
push str.already
call fcn.00401de0
mov eax, dword [0x407a00]
add esp, 4
lea edx, [esp + 0x48]
push 0x104
push edx
push 6
push eax
call ebx
mov edx, dword [0x407a00]
lea ecx, [esp + 0x55c]
push 0x104
push ecx
push 7
push edx
call ebx
push 0x40
jmp 0x40184a
cmp eax, 2
jne 0x40185f
push str.failure
call fcn.00401de0
mov eax, dword [0x407a00]
add esp, 4
lea edx, [esp + 0x48]
push 0x104
push edx
push 8
push eax
call ebx
mov edx, dword [0x407a00]
lea ecx, [esp + 0x55c]
push 0x104
push ecx
push 9
push edx
call ebx
push 0x30
lea eax, [esp + 0x560]
lea ecx, [esp + 0x4c]
push eax
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
call fcn.00401dc0
mov esi, dword [esp + 0x28]
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 0x14c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop ebx
pop esi
xor eax, eax
pop ebp
add esp, 0x858
ret 0x10