Function at 0x4047c8
Capabilities:
Check mutex on windows
Create process on windows

Disassembly:
push 0xb8
mov eax, 0x50696e
call fcn.005060cc
mov dword [ebp - 0xac], edx
push 0x7f02
xor edi, edi
push edi
call dword [sym.imp.USER32.dll_LoadCursorA]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
push str.ANVIR_RESTARTING
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
or esi, 0xffffffff
mov ebx, edi
mov dword [ebp - 0xc4], esi
mov dword [ebp - 4], edi
or edi, esi
mov dword [ebp - 0xc0], edi
and dword [ebp - 0xb4], ebx
push str.ANVIRLAUNCHER_START
push ebx
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
mov dword [ebp - 0xb8], eax
mov byte [ebp - 4], 2
cmp dword [0xd5b26c], ebx
jne 0x4048bc
xor eax, eax
inc eax
mov dword [0xd5b26c], eax
cmp dword [0xd5b274], ebx
jne 0x404894
push 0x90
mov dword [0xd5b274], eax
lea eax, [ebp - 0xa0]
push ebx
push eax
mov dword [ebp - 0xa4], 0x94
call fcn.004f1a90
add esp, 0xc
lea eax, [ebp - 0xa4]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
imul eax, dword [ebp - 0xa0], 0xa
add eax, dword [ebp - 0x9c]
mov dword [0xd5b270], eax
jmp 0x404899
mov eax, dword [0xd5b270]
cmp eax, 0x3c
jl 0x4048ac
call fcn.00426031
test eax, eax
jne 0x4048ac
xor ecx, ecx
inc ecx
jmp 0x4048ae
xor ecx, ecx
mov eax, dword [ebp - 0xb8]
mov dword [0xd5b268], ecx
jmp 0x4048c2
mov ecx, dword [0xd5b268]
test ecx, ecx
je 0x4049e3
test eax, eax
je 0x4049e3
push ecx
mov ecx, esp
push str.anvirlauncher.exe
call fcn.004094e6
call fcn.00410963
pop ecx
test eax, eax
je 0x4049e3
mov edx, eax
lea ecx, [ebp - 0xb0]
call fcn.00411153
mov edx, str.anvirlauncher.exe
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xbc]
call fcn.004232a6
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xb0]
push dword [eax]
call fcn.00405d1e
neg eax
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0xbc]
sbb al, al
add edx, 0xfffffff0
inc al
or ecx, 0xffffffff
mov dword [ebp - 0xa8], eax
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x404953
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0xa8]
test al, al
je 0x4049b8
push str.ANVIRLAUNCHER_CHECK
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov edi, eax
mov dword [ebp - 0xc0], edi
cmp edi, 0xffffffff
je 0x4049b8
push str.ANVIRLAUNCHER_RUN
push 1
push 2
call dword [sym.imp.KERNEL32.dll_OpenEventA]
mov esi, eax
mov dword [ebp - 0xc4], esi
cmp esi, 0xffffffff
je 0x4049b8
push esi
call dword [sym.imp.KERNEL32.dll_PulseEvent]
test eax, eax
je 0x4049b8
push 0x7d0
push edi
mov dword [ebp - 0xb4], 1
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebx, eax
neg ebx
sbb ebx, ebx
inc ebx
mov byte [ebp - 4], 2
or eax, 0xffffffff
mov edx, dword [ebp - 0xb0]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4049da
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [ebp - 0xb4], 0
jne 0x404a3d
cmp dword [ebp - 0xac], 0
jne 0x404a3d
lea ecx, [ebp - 0xac]
call fcn.004232f6
push 1
xor ecx, ecx
push ecx
push ecx
push dword [eax]
push str.runas
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov edx, dword [ebp - 0xac]
or ecx, 0xffffffff
mov dword [ebp - 0xa8], eax
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x404a35
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0xa8]
xor ebx, ebx
cmp eax, 0x20
setg bl
test ebx, ebx
je 0x404a6b
mov eax, dword [0xd58f54]
test eax, eax
je 0x404a6b
push dword [eax + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x404a6b
mov eax, dword [0xd58f54]
push 8
push 8
push pe_nt_image_headers32
push dword [eax + 4]
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, dword [ebp - 0xb8]
test eax, eax
je 0x404a7c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, 0xffffffff
je 0x404a88
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 0xffffffff
je 0x404a94
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
call fcn.00506076
ret