Function at 0x47ab90
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xb
push 0
push 0
dec ecx
jne 0x47ab98
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x47b105
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
dec eax
test eax, eax
jl 0x47ac1b
inc eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 8], 0
mov eax, dword [ebp - 8]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x20]
mov edx, dword [edx + 4]
lea ecx, [edx + eax*8]
mov eax, dword [ecx + 0x10]
dec eax
test eax, eax
jl 0x47ac13
inc eax
xor edx, edx
lea esi, [edx + edx*2]
mov ebx, dword [ecx + 0x14]
mov ebx, dword [ebx + esi*4]
mov edi, dword [ebp + 8]
cmp ebx, dword [edi - 8]
jne 0x47ac0f
mov eax, dword [ecx + 0x14]
mov eax, dword [eax + esi*4 + 4]
mov edx, dword [ebp + 8]
mov dword [edx - 0xc], eax
jmp 0x47b0ea
inc edx
dec eax
jne 0x47abec
inc dword [ebp - 8]
dec dword [ebp - 0x24]
jne 0x47abd2
call sym.D3DWindower.exe__Madremote_GetKernel32ProcessHandle_qqrv
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x47b0ea
xor ecx, ecx
push ebp
push 0x47b0e3
push dword fs:[ecx]
mov dword fs:[ecx], esp
lea edx, [ebp - 0x30]
mov eax, 0x47b11c
call sym.D3DWindower.exe__Madstrings_DecryptStr_qqr17System_AnsiString
lea eax, [ebp - 0x30]
push eax
lea edx, [ebp - 0x34]
mov eax, 0x47b138
call sym.D3DWindower.exe__Madstrings_DecryptStr_qqr17System_AnsiString
mov edx, dword [ebp - 0x34]
pop eax
call fcn.0046bf04
mov eax, dword [ebp - 0x30]
call fcn.0046c0c0
push eax
push 0
push 0
call sub.KERNEL32.DLL_CreateMutexA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x47b0cc
push 0xffffffffffffffff
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_WaitForSingleObject
xor ecx, ecx
push ebp
push 0x47b0bc
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0xc
lea edx, [ebp - 0x38]
mov eax, 0x47b11c
call sym.D3DWindower.exe__Madstrings_DecryptStr_qqr17System_AnsiString
lea eax, [ebp - 0x38]
push eax
lea edx, [ebp - 0x3c]
mov eax, 0x47b148
call sym.D3DWindower.exe__Madstrings_DecryptStr_qqr17System_AnsiString
mov edx, dword [ebp - 0x3c]
pop eax
call fcn.0046bf04
mov eax, dword [ebp - 0x38]
call fcn.0046c0c0
push eax
call sym.D3DWindower.exe__Madcodehook_CreateGlobalFileMapping_qqspcui
mov esi, eax
test esi, esi
je 0x47b0a5
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0xb7
setne byte [ebp - 0x11]
push 0
push 0
push 0
push 0xf001f
push esi
call sub.KERNEL32.DLL_MapViewOfFile
mov ebx, eax
test ebx, ebx
je 0x47b09f
cmp byte [ebp - 0x11], 0
je 0x47ad48
xor eax, eax
mov dword [ebx], eax
xor eax, eax
mov dword [ebx + 4], eax
push 0
push 0
mov eax, 0x47a2d8
xor ecx, ecx
xor edx, edx
call sym.D3DWindower.exe__Madremote_CopyFunction_qqrpvuioppvp23Maddisasm_TFunctionInfo
mov edi, eax
mov dword [ebx + 8], edi
test edi, edi
je 0x47ad48
push 2
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0xc]
push eax
push esi
call sub.KERNEL32.DLL_GetCurrentProcess
push eax
call sub.KERNEL32.DLL_DuplicateHandle
cmp dword [ebx + 8], 0
je 0x47b099
mov byte [ebp - 0x12], 1
mov eax, dword [ebx]
dec eax
test eax, eax
jl 0x47adb3
inc eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 8], 0
mov eax, dword [ebx + 4]
mov edx, dword [ebp - 8]
mov edx, dword [eax + edx*4]
mov eax, dword [edx + 0x208]
dec eax
test eax, eax
jl 0x47adab
inc eax
mov ecx, dword [edx + 0x208]
mov ecx, dword [edx + ecx*4 + 0x108]
mov edi, dword [ebp + 8]
cmp ecx, dword [edi - 8]
jne 0x47ada8
mov eax, dword [edx + 0x208]
mov eax, dword [edx + eax*4 + 0xc]
mov edx, dword [ebp + 8]
mov dword [edx - 0xc], eax
mov byte [ebp - 0x12], 0
jmp 0x47adab
dec eax
jne 0x47ad7d
inc dword [ebp - 8]
dec dword [ebp - 0x24]
jne 0x47ad68
cmp byte [ebp - 0x12], 0
je 0x47b099
push 2
push 0
push 0
mov eax, dword [ebp + 8]
add eax, 0xfffffff4
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
push eax
call sub.KERNEL32.DLL_GetCurrentProcess
push eax
call sub.KERNEL32.DLL_DuplicateHandle
mov eax, dword [ebx]
dec eax
test eax, eax
jl 0x47aeb1
inc eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 8], 0
mov eax, dword [ebx + 4]
mov edx, dword [ebp - 8]
mov eax, dword [eax + edx*4]
cmp dword [eax + 0x208], 0x3f
jge 0x47aea5
inc dword [eax + 0x208]
mov edx, dword [eax + 0x208]
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx - 8]
mov dword [eax + edx*4 + 0x108], ecx
mov edx, dword [eax + 0x208]
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx - 0xc]
mov dword [eax + edx*4 + 0xc], ecx
lea edx, [ebp - 0x44]
mov eax, 0x47b11c
call sym.D3DWindower.exe__Madstrings_DecryptStr_qqr17System_AnsiString
push dword [ebp - 0x44]
lea edx, [ebp - 0x48]
mov eax, 0x47b154
call sym.D3DWindower.exe__Madstrings_DecryptStr_qqr17System_AnsiString
push dword [ebp - 0x48]
lea eax, [ebp - 0x4c]
push eax
mov cl, 0x30
mov edx, 1
mov eax, dword [ebp - 8]
call sym.D3DWindower.exe__Madstrings_IntToStrEx_qqriic
push dword [ebp - 0x4c]
lea eax, [ebp - 0x40]
mov edx, 3
call fcn.0046bfbc
mov eax, dword [ebp - 0x40]
call fcn.0046c0c0
push eax
push 0
push 0x1f0003
call sub.KERNEL32.DLL_OpenEventA
mov edi, eax
test edi, edi
je 0x47ae9f
push edi
call sub.KERNEL32.DLL_SetEvent
push edi
call sub.KERNEL32.DLL_CloseHandle
mov byte [ebp - 0x12], 0
jmp 0x47aeb1
inc dword [ebp - 8]
dec dword [ebp - 0x24]
jne 0x47adf6
cmp byte [ebp - 0x12], 0
je 0x47b099
mov dword [ebp - 0x28], ebx
lea edx, [ebp - 0x54]
mov eax, 0x47b11c
call sym.D3DWindower.exe__Madstrings_DecryptStr_qqr17System_AnsiString
push dword [ebp - 0x54]
lea edx, [ebp - 0x58]
mov eax, 0x47b154
call sym.D3DWindower.exe__Madstrings_DecryptStr_qqr17System_AnsiString
push dword [ebp - 0x58]
lea eax, [ebp - 0x5c]
push eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax]
mov cl, 0x30
mov edx, 1
call sym.D3DWindower.exe__Madstrings_IntToStrEx_qqriic
push dword [ebp - 0x5c]
lea eax, [ebp - 0x50]
mov edx, 3
call fcn.0046bfbc
mov eax, dword [ebp - 0x50]
call fcn.0046c0c0
push eax
push 0
push 0
push 0
call sub.KERNEL32.DLL_CreateEventA
mov edi, eax
test edi, edi
je 0x47b099
mov eax, dword [ebp - 0x28]
inc dword [eax]
push 0
mov eax, dword [ebp - 0x28]
mov eax, dword [eax]
shl eax, 2
push eax
call sym.D3DWindower.exe__Madremote_AllocMemEx_qqsuiui
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax]
sub eax, 2
test eax, eax
jl 0x47af6d
inc eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 8]
mov eax, dword [eax + edx*4]
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 8]
mov dword [edx + ecx*4], eax
inc dword [ebp - 8]
dec dword [ebp - 0x24]
jne 0x47af50
push 0
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 4]
push eax
call sym.D3DWindower.exe__Madremote_FreeMemEx_qqspvui
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x18]
mov dword [eax + 4], edx
push 0
push 0x20c
call sym.D3DWindower.exe__Madremote_AllocMemEx_qqsuiui
mov edx, dword [ebp - 0x28]
mov edx, dword [edx]
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ecx + 4]
mov dword [ecx + edx*4 - 4], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax]
mov edx, dword [ebp - 0x28]
mov edx, dword [edx + 4]
mov eax, dword [edx + eax*4 - 4]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [eax + 0x208], 1
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0x10c], eax
push 2
push 0
push 0
mov eax, dword [ebp - 0x2c]
add eax, 0xc
push eax
mov eax, dword [ebp - 0xc]
push eax
push edi
call sub.KERNEL32.DLL_GetCurrentProcess
push eax
call sub.KERNEL32.DLL_DuplicateHandle
push edi
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0x10], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0x2c]
mov dword [edx + 8], eax
mov eax, dword [ebp - 0x28]
cmp dword [eax], 1
jne 0x47b04f
push 2
push 0
push 0
mov eax, dword [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_GetCurrentProcess
push eax
call sub.KERNEL32.DLL_DuplicateHandle
push 2
push 0
push 0
mov eax, dword [ebp - 0x2c]
add eax, 4
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_GetCurrentProcess
push eax
call sub.KERNEL32.DLL_DuplicateHandle
jmp 0x47b06f
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 4]
mov eax, dword [eax]
mov eax, dword [eax]
mov edx, dword [ebp - 0x2c]
mov dword [edx], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 4]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0x2c]
mov dword [edx + 4], eax
lea eax, [ebp - 0x1c]
push eax
push 0
mov eax, dword [ebp - 0x28]
mov eax, dword [eax]
mov edx, dword [ebp - 0x28]
mov edx, dword [edx + 4]
mov eax, dword [edx + eax*4 - 4]
push eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 8]
push eax
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
call sym.D3DWindower.exe__Madremote_CreateRemoteThreadEx_qqsuip20_SECURITY_ATTRIBUTESipvt4uirui
push ebx
call sub.KERNEL32.DLL_UnmapViewOfFile
push esi
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47b0c3
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_ReleaseMutex
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47b0ea
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_CloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47b10c
lea eax, [ebp - 0x5c]
mov edx, 0xc
call fcn.0046bca4
ret