Function at 0xa0eda
Capabilities:
Check if file exists
Check mutex and terminate process on windows
Check mutex on windows
Create process on windows
Get common file path
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x63c
push ebx
push esi
mov dword [ebp - 4], ecx
mov ecx, 0x102328
push edi
call fcn.00091f8b
push eax
push 1
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
jne 0xa0f0b
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esi, 0x102248
mov ecx, esi
call fcn.0009245c
push eax
mov ecx, esi
call fcn.00091f8b
push eax
push 0x208
lea eax, [ebp - 0x228]
mov edi, 0x102200
push eax
push str.exepath
mov ecx, edi
call fcn.00091f8b
mov edx, eax
call fcn.000a20e8
add esp, 0x14
test al, al
jne 0xa0f4e
push ebx
jmp 0xa0f05
lea ecx, [ebp - 0x1c]
call fcn.000920bf
lea edx, [ebp - 0x1c]
lea ecx, [ebp - 0x228]
call fcn.000aa20f
push ebx
test al, al
je 0xa0f05
push 0x80
push 3
push ebx
push 1
push 0x80000000
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push dword [ebp - 4]
push ebx
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0xf921c
mov ecx, edi
call fcn.00091f8b
mov edx, eax
call fcn.000a2268
pop ecx
pop ecx
test al, al
je 0xa0f03
mov edi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
lea eax, [ebp - 0x228]
jne 0xa109b
push ebx
push eax
lea ecx, [ebp - 0x1c]
call fcn.0009245c
lea ecx, [ebp - 0x1c]
mov esi, eax
call fcn.00091f8b
mov edx, esi
mov ecx, eax
call fcn.000aa17b
pop ecx
pop ecx
test al, al
je 0xa1019
lea eax, [ebp - 0x228]
jmp 0xa109b
push 0x208
lea eax, [ebp - 0x638]
push ebx
push eax
call fcn.000c4c30
add esp, 0xc
lea eax, [ebp - 0x638]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x430]
push eax
push ebx
push str.temp_
lea eax, [ebp - 0x638]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push str..exe
lea eax, [ebp - 0x430]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push ebx
lea eax, [ebp - 0x430]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0009245c
lea ecx, [ebp - 0x1c]
mov esi, eax
call fcn.00091f8b
mov edx, esi
mov ecx, eax
call fcn.000aa17b
pop ecx
pop ecx
test al, al
je 0xa10a8
lea eax, [ebp - 0x430]
push 1
push ebx
push ebx
push eax
push 0xf30ac
push ebx
call edi
mov esi, 0x102200
lea eax, [ebp - 4]
mov ecx, esi
push eax
push 0xf403c
call fcn.00091f8b
mov edx, eax
call fcn.000a1f34
mov bl, al
pop ecx
pop ecx
test bl, bl
je 0xa10e2
push 0xf403c
mov ecx, esi
call fcn.00091f8b
mov edx, eax
call fcn.000a239a
pop ecx
jmp 0xa10ed
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
test bl, bl
je 0xa10ad
push dword [ebp - 4]
xor ebx, ebx
push ebx
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0xf921c
mov ecx, 0x102200
call fcn.00091f8b
mov edx, eax
call fcn.000a2268
pop ecx
pop ecx
test al, al
jne 0xa0fd0
jmp 0xa0f03