Function at 0x4874c0
Capabilities:
Check if file exists
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x558490
mov eax, dword fs:[0]
push eax
sub esp, 0xb0
mov eax, dword [0x5b2920]
xor eax, esp
mov dword [esp + 0xa8], eax
push ebx
push esi
push edi
mov eax, dword [0x5b2920]
xor eax, esp
push eax
lea eax, [esp + 0xc0]
mov dword fs:[0], eax
push str.CC8D6A53_2AD6_4272_BAF1_0662B377FCDF
xor esi, esi
push esi
push esi
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx + 0xa4], eax
call edi
cmp eax, 0xb7
je 0x48754f
call edi
cmp eax, 5
jne 0x4877ce
push str.CC8D6A53_2AD6_4272_BAF1_0662B377FCDF
push esi
push esi
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [ebx + 0xa4], eax
call edi
cmp eax, 2
je 0x4877ce
mov eax, dword [0x5c1180]
cmp eax, 1
jne 0x48757b
mov eax, dword [0x5c6004]
cmp eax, esi
je 0x4877c7
push esi
push esi
push 0xfc8
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
jmp 0x487bca
cmp eax, 2
jne 0x4877c7
cmp dword [section.Shared_X], esi
je 0x4877c7
mov eax, dword [0x5c1188]
mov ecx, dword [eax + 4]
push ecx
lea ecx, [esp + 0x84]
call fcn.004029b0
push 0x5799b0
mov ebx, 0xb
xor eax, eax
lea edx, [esp + 0x84]
mov dword [esp + 0xcc], esi
call fcn.00404be0
or edi, 0xffffffff
cmp eax, edi
je 0x487656
push edi
lea ecx, [eax + 0xb]
lea esi, [esp + 0xa0]
lea edx, [esp + 0x84]
call fcn.00404b90
push edi
xor ebx, ebx
push ebx
push eax
lea ecx, [esp + 0x8c]
mov byte [esp + 0xd4], 1
call fcn.004025b0
mov ecx, esi
mov byte [esp + 0xc8], bl
call fcn.00402790
cmp dword [esp + 0x98], 8
mov edx, dword [esp + 0x94]
lea eax, [edx + edx]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ebx
jb 0x487636
mov ecx, dword [esp + 0x84]
mov dword [esp + 0x18], ecx
jmp 0x487641
lea edx, [esp + 0x84]
mov dword [esp + 0x18], edx
mov ecx, dword [section.Shared_X]
lea eax, [esp + 0x10]
push eax
push ebx
push 0x4a
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
push str.powerword:
mov ebx, 0xa
xor eax, eax
lea edx, [esp + 0x84]
call fcn.00404be0
cmp eax, edi
lea edx, [esp + 0x80]
je 0x487708
push edi
lea ecx, [eax + 0xa]
lea esi, [esp + 0xa0]
call fcn.00404b90
push edi
push 0
push eax
lea ecx, [esp + 0x8c]
mov byte [esp + 0xd4], 2
call fcn.004025b0
mov ecx, esi
call fcn.00402790
cmp dword [esp + 0x98], 8
mov edx, dword [esp + 0x94]
lea eax, [edx + edx]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], edi
jb 0x4876e8
mov ecx, dword [esp + 0x84]
lea eax, [esp + 0x10]
push eax
push 0
mov dword [esp + 0x20], ecx
mov ecx, dword [section.Shared_X]
push 0x4a
push ecx
jmp 0x4877b5
mov ecx, dword [section.Shared_X]
lea eax, [esp + 0x10]
push eax
push 0
lea edx, [esp + 0x8c]
push 0x4a
mov dword [esp + 0x24], edx
push ecx
jmp 0x4877b5
push str.powerword:__
mov ebx, 0xc
xor eax, eax
call fcn.00404be0
cmp eax, edi
je 0x487790
push edi
lea ecx, [eax + 0xc]
lea esi, [esp + 0xa0]
lea edx, [esp + 0x84]
call fcn.00404b90
push edi
push 0
push eax
lea ecx, [esp + 0x8c]
mov byte [esp + 0xd4], 3
call fcn.004025b0
mov ecx, esi
call fcn.00402790
cmp dword [esp + 0x98], 8
mov edx, dword [esp + 0x94]
lea eax, [edx + edx]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], edi
jb 0x4876e8
mov ecx, dword [esp + 0x84]
lea eax, [esp + 0x10]
push eax
push 0
mov dword [esp + 0x20], ecx
mov ecx, dword [section.Shared_X]
push 0x4a
push ecx
jmp 0x4877b5
mov esi, str.dicts_inst
lea ecx, [esp + 0x80]
call fcn.004060f0
test al, al
je 0x4877bb
mov edx, dword [section.Shared_X]
push 0
push 0
push 0x13df
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [esp + 0x80]
call fcn.00402790
xor eax, eax
jmp 0x487bca
cmp dword [0x5c1180], 2
jne 0x487879
mov eax, dword [0x5c1188]
mov ecx, dword [eax + 4]
push ecx
lea ecx, [esp + 0x84]
call fcn.004029b0
mov dword [esp + 0xc8], 4
mov eax, dword [esp + 0x94]
push str.switch_user
mov edi, 0xb
lea ecx, [esp + 0x84]
call fcn.00405f30
test eax, eax
jne 0x487828
mov dword [ebx + 0x8b4], 1
jmp 0x487853
mov eax, dword [esp + 0x94]
push str.auto_run
mov edi, 8
lea ecx, [esp + 0x84]
call fcn.00405f30
test eax, eax
jne 0x487853
mov dword [ebx + 0x8b0], 1
or edi, 0xffffffff
mov dword [esp + 0xc8], edi
cmp dword [esp + 0x98], 8
jb 0x48787c
mov edx, dword [esp + 0x84]
push edx
call fcn.004e946d
add esp, 4
jmp 0x48787c
or edi, 0xffffffff
call fcn.00500067
test eax, eax
je 0x4877c7
mov ecx, ebx
call fcn.004886b0
test al, al
je 0x4877c7
mov dword [ebx + 0xdc], 1
call fcn.00488610
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x24], 8
mov dword [esp + 0x28], 0xff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov ecx, ebx
call fcn.004fea9f
push esi
call fcn.005008c4
add esp, 4
push esi
call fcn.00500eb5
lea ecx, [esp + 0x28]
call fcn.004ff0f0
lea ecx, [esp + 0x28]
push ecx
mov ecx, ebx
mov dword [esp + 0xcc], 5
call fcn.004fe701
call fcn.0048b9f0
test eax, eax
jl 0x487938
cmp dword [esp + 0x30], esi
jne 0x487bb5
cmp dword [esp + 0x34], esi
jne 0x487bb5
mov eax, dword [esp + 0x38]
cmp eax, 6
jne 0x48794f
push esi
call fcn.00487110
mov eax, dword [0x5c344c]
cmp eax, esi
je 0x487933
call eax
cmp eax, esi
jl 0x487938
call fcn.0048b120
lea ecx, [esp + 0x28]
mov dword [esp + 0xc8], edi
call fcn.004ff12f
xor eax, eax
jmp 0x487bca
cmp eax, 5
jne 0x487990
push 1
call fcn.00487110
call fcn.0048b6e0
cmp eax, esi
jl 0x487979
mov eax, dword [0x5c3448]
cmp eax, esi
je 0x487979
mov edx, dword [0x5c209c]
push edx
call eax
add esp, 4
lea ecx, [esp + 0x28]
mov dword [esp + 0xc8], edi
call fcn.004ff12f
xor eax, eax
jmp 0x487bca
call fcn.00429120
test eax, eax
jne 0x487938
call fcn.004e3620
call fcn.00487de0
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0x50]
push ecx
lea edx, [ebx + 0xd8]
push edx
mov dword [esp + 0x58], 1
mov dword [esp + 0x5c], esi
mov dword [esp + 0x60], esi
mov dword [esp + 0x64], esi
call sub.gdiplus.dll_GdiplusStartup
mov eax, dword [ebx + 0x8c0]
mov edx, dword [eax + 0x134]
lea ecx, [ebx + 0x8c0]
push esi
push 0x65
call edx
push 0x39c
call fcn.004e943d
add esp, 4
mov dword [esp + 0x1c], eax
cmp eax, esi
mov byte [esp + 0xc8], 6
je 0x487a09
push eax
call fcn.00476fc0
jmp 0x487a0b
xor eax, eax
cmp eax, esi
lea edi, [ebx + 0xa8]
mov byte [esp + 0xc8], 5
mov dword [edi], eax
jne 0x487a3a
lea ecx, [esp + 0x28]
mov dword [esp + 0xc8], 0xffffffff
call fcn.004ff12f
xor eax, eax
jmp 0x487bca
lea esi, [ebx + 0xac]
push ebx
mov dword [esp + 0x20], esi
call fcn.0048a550
test al, al
je 0x487a1f
mov eax, esi
mov ecx, dword [eax]
mov edx, dword [ecx + 0x20]
mov dword [0x5c3438], edx
mov eax, dword [eax]
mov ecx, dword [eax + 0x20]
push ebx
mov esi, edi
mov dword [section.Shared_X], ecx
call fcn.0048a620
mov ecx, dword [edi]
test ecx, ecx
jne 0x487a7c
mov dword [0x5c6004], ecx
jmp 0x487a85
mov edx, dword [ecx + 0x20]
mov dword [0x5c6004], edx
push 0
call fcn.004f3a53
cmp dword [0x5c1180], 2
mov eax, dword [edi]
mov dword [ebx + 0x20], eax
jne 0x487b36
mov ecx, dword [0x5c1188]
mov edx, dword [ecx + 4]
push edx
lea ecx, [esp + 0xa0]
call fcn.004029b0
push 0
lea eax, [esp + 0xa0]
push eax
mov edx, 0x5799b0
mov byte [esp + 0xd0], 7
call fcn.00404b60
cmp eax, 0xffffffff
je 0x487b22
push 0xffffffffffffffff
lea ecx, [eax + 0xb]
lea esi, [esp + 0x68]
lea edx, [esp + 0xa0]
call fcn.00404b90
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebx + 0xbc]
mov byte [esp + 0xd4], 8
call fcn.004025b0
mov ecx, esi
call fcn.00402790
mov ecx, dword [section.Shared_X]
push 0
push 0x1f4
push 0x3ec
push ecx
call dword [sym.imp.USER32.dll_SetTimer]
lea ecx, [esp + 0x9c]
mov byte [esp + 0xc8], 5
call fcn.00402790
mov eax, ebx
call fcn.00487e70
lea esi, [ebx + 0x7b4]
call fcn.00482430
mov edi, dword [esp + 0x1c]
mov eax, dword [edi]
test eax, eax
je 0x487b7b
mov edx, dword [eax + 0x20]
push edx
call dword [sym.imp.USER32.dll_IsWindowVisible]
cmp eax, 1
jne 0x487b7b
mov esi, dword [edi]
call fcn.00485570
mov ecx, dword [edi]
push 0x814d
call fcn.004f3841
mov ecx, eax
call fcn.004f3ab0
push 0x233
call fcn.0048b970
mov esi, eax
call fcn.0048b9a0
push 0x4a
call fcn.0048b970
mov esi, eax
call fcn.0048b9a0
push 0x49
call fcn.0048b970
mov esi, eax
call fcn.0048b9a0
mov dword [esp + 0xc8], 0xffffffff
jmp 0x487bbc
mov dword [esp + 0xc8], edi
lea ecx, [esp + 0x28]
call fcn.004ff12f
mov eax, 1
mov ecx, dword [esp + 0xc0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xa8]
xor ecx, esp
call fcn.0050fe87
mov esp, ebp
pop ebp
ret