Function at 0x47bd10
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Get common file path
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x5c0
push ecx
push edi
lea edi, [esp + 8]
mov eax, 0xcccccccc
mov ecx, 0x170
rep stosd dword es:[edi], eax
pop edi
pop ecx
mov dword [ebp - 0x59c], 0
mov ecx, 0x529254
call fcn.004e71d0
mov dword [ebp - 0x5a0], eax
mov dword [ebp - 0x5a4], 0
jmp 0x47be18
push dword [ebp - 0x5a4]
lea eax, [ebp - 0x1c]
push eax
mov ecx, 0x529254
call fcn.004e7350
cmp dword [ebp - 0x1c], 0x5242506c
jne 0x47be12
mov eax, dword [ebp - 0x59c]
mov dword [ebp - 0x5a8], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x5ac], eax
mov eax, dword [ebp - 0x5ac]
movsx edx, byte [eax]
mov dword [ebp - 0x5b0], edx
push 0x10
call fcn.00476140
pop ecx
cmp eax, 0
je 0x47bdb3
mov dword [eax + 8], 0
mov eax, eax
mov dword [ebp - 0x59c], eax
mov eax, dword [ebp - 0x59c]
mov ecx, dword [ebp - 0x5a8]
mov dword [eax + 0xc], ecx
mov edx, dword [ebp - 0x10]
sub edx, dword [ebp - 0x5b0]
add edx, 0xffffffff
mov eax, dword [ebp - 0x59c]
mov dword [eax], edx
mov edx, dword [ebp - 0x5b0]
add edx, 1
add edx, dword [ebp - 0x5ac]
mov eax, dword [ebp - 0x59c]
mov dword [eax + 4], edx
push dword [ebp - 0x5b0]
mov eax, dword [ebp - 0x5ac]
add eax, 1
push eax
mov ecx, dword [ebp - 0x59c]
add ecx, 8
call fcn.0040c560
inc dword [ebp - 0x5a4]
mov eax, dword [ebp - 0x5a0]
cmp dword [ebp - 0x5a4], eax
jl 0x47bd58
cmp dword [ebp - 0x59c], 0
je 0x47bead
push 8
call fcn.00476140
pop ecx
cmp eax, 0
je 0x47beaa
mov esi, eax
mov dword [ebp - 0x598], 0
push 0x528208
call fcn.0040dc70
pop ecx
push eax
push 0x528208
lea ecx, [ebp - 0x598]
call fcn.0040c560
cmp dword [ebp - 0x598], 0
je 0x47be80
mov ebx, dword [ebp - 0x598]
mov edx, dword [0x5022fc]
mov dword [ebx + 0x10], edx
lea eax, [ebp - 0x598]
push eax
mov ecx, esi
call fcn.00435af0
cmp dword [ebp - 0x598], 0
je 0x47bea2
mov ecx, dword [ebp - 0x598]
call fcn.0040c380
mov dword [esi], 0x528df8
mov eax, esi
mov dword [ebp - 0x20], eax
push str.REALBASIC_MUTEX
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 0x5b4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x47c41a
push 0xfa0
push dword [ebp - 0x5b4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x47c41a
mov byte [ebp - 0x420], 0
mov dword [ebp - 0x424], 0
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
cmp eax, 0
jl 0x47bfa7
mov byte [ebp - 0x5b6], 0
lea eax, [ebp - 0x424]
push eax
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
cmp eax, 0
jne 0x47bf5d
lea eax, [ebp - 0x420]
push eax
push dword [ebp - 0x424]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
mov byte [ebp - 0x5b6], al
push dword [ebp - 0x424]
push dword [ebp - 0x428]
mov edx, dword [ebp - 0x428]
mov esi, dword [edx]
call dword [esi + 0x14]
push dword [ebp - 0x428]
mov edx, dword [ebp - 0x428]
mov esi, dword [edx]
call dword [esi + 8]
cmp byte [ebp - 0x5b6], 0
je 0x47bfa7
push 0x528285
lea eax, [ebp - 0x420]
push eax
call fcn.004f6bb0
pop ecx
pop ecx
mov ecx, dword [ebp - 0x59c]
add ecx, 8
call fcn.0040caf0
push eax
lea eax, [ebp - 0x420]
push eax
call fcn.004f6bb0
pop ecx
pop ecx
mov dword [ebp - 0x580], 0
push 0x528208
call fcn.0040dc70
pop ecx
push eax
push 0x528208
lea ecx, [ebp - 0x580]
call fcn.0040c560
cmp dword [ebp - 0x580], 0
je 0x47bfe5
mov ebx, dword [ebp - 0x580]
mov edx, dword [0x5022fc]
mov dword [ebx + 0x10], edx
mov dword [ebp - 0x584], 0
lea edx, [ebp - 0x420]
lea eax, [ebp - 0x420]
push eax
call fcn.0040dc70
pop ecx
push eax
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x584]
call fcn.0040c560
cmp dword [ebp - 0x584], 0
je 0x47c02d
mov ebx, dword [ebp - 0x584]
mov edx, dword [0x5022fc]
mov dword [ebx + 0x10], edx
cmp dword [ebp - 0x584], 0
je 0x47c041
mov edx, dword [ebp - 0x584]
mov esi, dword [edx + 0xc]
jmp 0x47c046
mov esi, 0
cmp dword [ebp - 0x580], 0
je 0x47c05a
mov edx, dword [ebp - 0x580]
mov ebx, dword [edx + 0xc]
jmp 0x47c05f
mov ebx, 0
push esi
lea ecx, [ebp - 0x584]
call fcn.0040cb50
push eax
push ebx
lea ecx, [ebp - 0x580]
call fcn.0040cb50
push eax
call fcn.0040ddf0
add esp, 0x10
cmp eax, 0
jne 0x47c08a
mov bl, 1
jmp 0x47c08c
mov bl, 0
cmp dword [ebp - 0x584], 0
je 0x47c0a0
mov ecx, dword [ebp - 0x584]
call fcn.0040c380
cmp dword [ebp - 0x580], 0
je 0x47c0b4
mov ecx, dword [ebp - 0x580]
call fcn.0040c380
cmp bl, 0
jne 0x47c0ec
mov eax, dword [ebp - 0x59c]
push dword [eax]
mov eax, dword [ebp - 0x59c]
push dword [eax + 4]
lea eax, [ebp - 0x420]
push eax
call fcn.0047bc70
add esp, 0xc
mov byte [ebp - 0x5b5], al
cmp byte [ebp - 0x5b5], 0
jne 0x47c354
push 0x400
lea eax, [ebp - 0x420]
push eax
push dword [0x52921c]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [ebp - 0x5bc], eax
mov eax, dword [ebp - 0x5bc]
mov dword [ebp - 0x5c0], eax
jmp 0x47c13e
mov eax, dword [ebp - 0x5c0]
cmp byte [ebp + eax - 0x420], 0x5c
jne 0x47c138
mov eax, dword [ebp - 0x5c0]
mov byte [ebp + eax - 0x41f], 0
jmp 0x47c147
dec dword [ebp - 0x5c0]
cmp dword [ebp - 0x5c0], 0
jg 0x47c118
mov ecx, dword [ebp - 0x59c]
add ecx, 8
call fcn.0040caf0
push eax
lea eax, [ebp - 0x420]
push eax
call fcn.004f6bb0
pop ecx
pop ecx
mov eax, dword [ebp - 0x59c]
push dword [eax]
mov eax, dword [ebp - 0x59c]
push dword [eax + 4]
lea eax, [ebp - 0x420]
push eax
call fcn.0047bc70
add esp, 0xc
mov byte [ebp - 0x5b5], al
cmp byte [ebp - 0x5b5], 0
jne 0x47c354
push 0x400
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov dword [ebp - 0x588], 0
push 0x528285
call fcn.0040dc70
pop ecx
push eax
push 0x528285
lea ecx, [ebp - 0x588]
call fcn.0040c560
cmp dword [ebp - 0x588], 0
je 0x47c1e7
mov ebx, dword [ebp - 0x588]
mov edx, dword [0x5022fc]
mov dword [ebx + 0x10], edx
mov eax, dword [ebp - 0x59c]
add eax, 8
push eax
lea eax, [ebp - 0x588]
push eax
lea eax, [ebp - 0x58c]
push eax
call fcn.0040d4b0
add esp, 0xc
lea ecx, [ebp - 0x58c]
call fcn.0040caf0
push eax
lea eax, [ebp - 0x420]
push eax
call fcn.004f6bb0
pop ecx
pop ecx
cmp dword [ebp - 0x58c], 0
je 0x47c235
mov ecx, dword [ebp - 0x58c]
call fcn.0040c380
cmp dword [ebp - 0x588], 0
je 0x47c249
mov ecx, dword [ebp - 0x588]
call fcn.0040c380
mov eax, dword [ebp - 0x59c]
push dword [eax]
mov eax, dword [ebp - 0x59c]
push dword [eax + 4]
lea eax, [ebp - 0x420]
push eax
call fcn.0047bc70
add esp, 0xc
mov byte [ebp - 0x5b5], al
cmp byte [ebp - 0x5b5], 0
jne 0x47c354
push 0x400
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov dword [ebp - 0x590], 0
push 0x528285
call fcn.0040dc70
pop ecx
push eax
push 0x528285
lea ecx, [ebp - 0x590]
call fcn.0040c560
cmp dword [ebp - 0x590], 0
je 0x47c2cc
mov ebx, dword [ebp - 0x590]
mov edx, dword [0x5022fc]
mov dword [ebx + 0x10], edx
mov eax, dword [ebp - 0x59c]
add eax, 8
push eax
lea eax, [ebp - 0x590]
push eax
lea eax, [ebp - 0x594]
push eax
call fcn.0040d4b0
add esp, 0xc
lea ecx, [ebp - 0x594]
call fcn.0040caf0
push eax
lea eax, [ebp - 0x420]
push eax
call fcn.004f6bb0
pop ecx
pop ecx
cmp dword [ebp - 0x594], 0
je 0x47c31a
mov ecx, dword [ebp - 0x594]
call fcn.0040c380
cmp dword [ebp - 0x590], 0
je 0x47c32e
mov ecx, dword [ebp - 0x590]
call fcn.0040c380
mov eax, dword [ebp - 0x59c]
push dword [eax]
mov eax, dword [ebp - 0x59c]
push dword [eax + 4]
lea eax, [ebp - 0x420]
push eax
call fcn.0047bc70
add esp, 0xc
mov byte [ebp - 0x5b5], al
cmp byte [ebp - 0x5b5], 0
jne 0x47c3bd
lea eax, [ebp - 0x568]
push eax
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x5c4], eax
cmp dword [ebp - 0x5c4], 0xffffffff
jne 0x47c3b1
push 0x10
push 0
push str.The_application_cannot_continue_because_a_needed_file_cannot_be_installed._You_dont_have_appropriate_permission_to_install_the_file._Running_the_application_once_with_Standard_User_or_Administrator_privileges_will_solve_the_problem.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push dword [ebp - 0x5b4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp - 0x5b4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push dword [ebp - 0x5c4]
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0
push 0
lea eax, [ebp - 0x420]
push eax
call fcn.0047ba70
add esp, 0xc
mov eax, dword [ebp - 0x59c]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x5c8], ecx
cmp dword [ebp - 0x59c], 0
je 0x47c40e
mov eax, dword [ebp - 0x59c]
cmp dword [eax + 8], 0
je 0x47c402
mov eax, dword [ebp - 0x59c]
mov ecx, dword [eax + 8]
call fcn.0040c380
push dword [ebp - 0x59c]
call fcn.00476180
pop ecx
mov eax, dword [ebp - 0x5c8]
mov dword [ebp - 0x59c], eax
cmp dword [ebp - 0x59c], 0
jne 0x47bee9
push 0
call fcn.0047b9c0
pop ecx
push dword [ebp - 0x5b4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp - 0x5b4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret