Function at 0x7d8547
Capabilities:
Accept command line arguments
Check for trap flag exception
Check mutex on windows
Create process on windows
Query environment variable
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x815a70
push 0x7f6380
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xfffff8c0
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov byte [ebp - 0x28], 1
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
add ecx, 1
mov dword [ebp - 0x24], ecx
mov edx, dword [sym.imp.USER32.dll_LoadStringA]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
add eax, 1
mov dword [ebp - 0x24], eax
mov ecx, dword [sym.imp.USER32.dll_LoadStringW]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x24]
add edx, 1
mov dword [ebp - 0x24], edx
push 0x7d758c
call fcn.007f625b
add esp, 4
mov eax, dword [0x8112c8]
xor eax, dword [0x811284]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str._X::DA_08X
lea ecx, [ebp - 0x12c]
push ecx
call fcn.007f6181
add esp, 0x10
lea edx, [ebp - 0x12c]
push edx
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0x7d85f9
mov byte [ebp - 0x28], 0
mov eax, dword [ebp - 0x28]
and eax, 0xff
test eax, eax
je 0x7d87a0
mov ecx, dword [0x8112b8]
xor ecx, dword [0x8112cc]
xor ecx, dword [0x8112d0]
and ecx, 0x20
test ecx, ecx
je 0x7d87a0
mov edx, dword [0x8112c4]
xor edx, dword [0x8112a0]
xor edx, dword [0x8112c8]
push edx
push str.RN_08X
lea eax, [ebp - 0x12c]
push eax
call fcn.007f6181
add esp, 0xc
lea ecx, [ebp - 0x12c]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0
je 0x7d87a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x7d87a0
push 0x7530
mov edx, dword [ebp - 0x130]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0
je 0x7d86b3
cmp dword [ebp - 0x134], 0x80
jne 0x7d8796
mov eax, dword [0x8112c4]
xor eax, dword [0x8112a0]
xor eax, dword [0x8112c8]
push eax
push str._08X
lea ecx, [ebp - 0x12c]
push ecx
call fcn.007f6181
add esp, 0xc
mov dword [ebp - 0x13c], 0
jmp 0x7d86f4
mov edx, dword [ebp - 0x13c]
add edx, 1
mov dword [ebp - 0x13c], edx
cmp dword [ebp - 0x13c], 0x12c
jge 0x7d872d
lea eax, [ebp - 0x12c]
push eax
push str.MainClass
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 0
je 0x7d8723
jmp 0x7d872d
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x7d86e5
cmp dword [ebp - 0x138], 0
je 0x7d8789
mov ecx, dword [0x8112c4]
xor ecx, dword [0x8112a0]
xor ecx, dword [0x8112c8]
mov dword [ebp - 0x148], ecx
mov edx, dword [0x8170f8]
push edx
call fcn.007f61e0
add esp, 4
add eax, 1
mov dword [ebp - 0x144], eax
mov eax, dword [0x8170f8]
mov dword [ebp - 0x140], eax
lea ecx, [ebp - 0x148]
push ecx
push 0
push 0x4a
mov edx, dword [ebp - 0x138]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, 1
jmp 0x7d8db3
push 1
call fcn.007d8dc4
add esp, 4
mov ecx, dword [ebp - 0x28]
and ecx, 0xff
test ecx, ecx
je 0x7d8989
mov edx, dword [0x8112b8]
xor edx, dword [0x8112cc]
xor edx, dword [0x8112d0]
and edx, 0x40
test edx, edx
jne 0x7d8989
push 0x200
lea eax, [ebp - 0x348]
push eax
push str._PAD64
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x7d8989
push 0xc8
push 0x23
lea ecx, [ebp - 0x348]
push ecx
call fcn.007f5ff0
add esp, 0xc
mov byte [ebp - 0x280], 0
mov dword [ebp - 0x44c], 1
jmp 0x7d882f
mov edx, dword [ebp - 0x44c]
add edx, 1
mov dword [ebp - 0x44c], edx
cmp dword [ebp - 0x44c], 0x40
jg 0x7d8869
mov eax, dword [ebp - 0x44c]
push eax
push str._PAD_d
lea ecx, [ebp - 0x448]
push ecx
call fcn.007f6181
add esp, 0xc
lea edx, [ebp - 0x348]
push edx
lea eax, [ebp - 0x448]
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
jmp 0x7d8820
mov ecx, dword [0x8112b8]
xor ecx, dword [0x8112cc]
xor ecx, dword [0x8112d0]
and ecx, 0x10
test ecx, ecx
jne 0x7d8989
lea edx, [ebp - 0x5a4]
push edx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov al, byte [0x81743c]
mov byte [ebp - 0x6a8], al
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x6a7]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov cl, byte [0x81743c]
mov byte [ebp - 0x560], cl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x55f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
cmp dword [0x8170f0], 1
jne 0x7d8904
cmp dword [ebp - 0x598], 0
jne 0x7d8904
lea edx, [ebp - 0x6a8]
push edx
call fcn.007e501f
add esp, 4
and eax, 0xff
test eax, eax
je 0x7d8904
lea eax, [ebp - 0x6a8]
mov dword [ebp - 0x598], eax
push 0x104
lea ecx, [ebp - 0x560]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x7d8923
xor eax, eax
jmp 0x7d8db3
lea edx, [ebp - 0x45c]
push edx
lea eax, [ebp - 0x5a4]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
lea ecx, [ebp - 0x560]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x7d897f
mov dword [0x81732c], 6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._Location_XEB__error_code__d_
push 0x817330
call fcn.007f6181
add esp, 0xc
xor eax, eax
jmp 0x7d8db3
mov eax, 1
jmp 0x7d8db3
mov edx, dword [0x8112b8]
xor edx, dword [0x8112cc]
xor edx, dword [0x8112d0]
and edx, 0x10
test edx, edx
je 0x7d8c63
mov eax, dword [0x8112c8]
xor eax, dword [0x811284]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str._X::DA_08X
lea ecx, [ebp - 0x12c]
push ecx
call fcn.007f6181
add esp, 0x10
lea edx, [ebp - 0x12c]
push edx
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
jne 0x7d8c63
push 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov byte [ebp - 0x6ac], 0
push str.Kernel32
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x6b0], eax
cmp dword [ebp - 0x6b0], 0
je 0x7d8a4b
push str.IsDebuggerPresent
mov eax, dword [ebp - 0x6b0]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x748], eax
cmp dword [ebp - 0x748], 0
je 0x7d8a4b
call dword [ebp - 0x748]
test eax, eax
je 0x7d8a4b
mov byte [ebp - 0x6ac], 1
mov dword [ebp - 0x744], 0x94
lea ecx, [ebp - 0x744]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x734], 2
je 0x7d8ad8
mov byte [ebp - 0x74c], 0
mov dword [ebp - 4], 0
pushf
pop eax
or eax, 0x100
push eax
popf
nop
mov dword [ebp - 4], 0xffffffff
jmp 0x7d8ac1
mov edx, dword [ebp - 0x74c]
and edx, 0xff
test edx, edx
jne 0x7d8ad8
mov byte [0x8175c4], 1
cmp dword [ebp - 0x734], 2
jne 0x7d8b42
push ecx
bswap ecx
not ecx
push eax
not eax
mov eax, 0x6c65696d
xchg ecx, eax
mov ecx, 0xdeadc0de
xchg ecx, eax
not eax
pop eax
not ecx
pop ecx
pushfd
pushal
xor ebx, ebx
je 0x7d8b04
add ebp, ebx
and ch, bl
jmp 0x7d8b25
xor ebx, ebx
je 0x7d8b08
jmp 0x7d8b17
mov ecx, 0x34f9c987
nop
stc
je 0x7d8b1b
jmp 0x7d8b4b
xor eax, eax
je 0x7d8b0d
mov eax, 0x4840c987
test eax, eax
jne 0x7d8b01
jmp 0x92e4288a
popal
popfd
xchg dx, ax
xchg dx, ax
mov eax, eax
mov eax, dword fs:[0x30]
movzx eax, byte [eax + 2]
or al, al
jne 0x7d8b59
jmp 0x7d8bca
jo 0x7d8b4b
jl 0x7d8b49
jmp 0x7d8b4d
je 0x7d8b46
jmp 0x7d8b46
mov eax, dword fs:[0x20]
or eax, eax
jne 0x7d8b59
jmp 0x7d8bca
pushal
xor eax, eax
jne 0x7d8b60
jmp 0x7d8b75
jmp 0x7d8b95
xor eax, eax
jne 0x7d8b7d
jp 0x7d8b73
jo 0x7d8b77
jmp 0x7d8b78
jb 0x7d8b7c
jns 0x7d8b61
call dword [0x74097900]
invalid
jns 0x7d8b7e
je 0x7d8b67
jmp 0x7d8b00
xchg ebx, ebx
jp 0x7d8b6c
mov al, byte [0x5c66133]
sbb byte [ebx - 0x7f], dh
add byte [ecx], al
xor esp, dword [ecx - 0x3a]
add eax, 0x817318
add dword [eax - 9], edx
ror byte [edi], 1
enter 0x7358, 0
popal
mov byte [0x817318], 1
push eax
not eax
bswap eax
pop eax
jae 0x7d8b8e
pushfd
pushal
jmp 0x7d8bbd
sub edx, edx
jo 0x7d8ba3
jmp 0x7d8bb4
xor ecx, ecx
je 0x7d8b9b
jmp 0x7d8bad
stc
xor ecx, 3
je 0x7d8b33
jmp 0x7d8baa
jmp 0x7d8bb8
jae 0x7d8ba6
sbb bl, bl
sbb bl, bl
xor ebx, ebx
jmp 0x7d8b9d
jmp 0x7d8b97
sbb al, 0xdb
jmp 0x7d8bc0
jmp 0x7d8b91
popal
popfd
bswap eax
not ecx
bswap eax
not ecx
mov eax, dword [ebp - 0x6ac]
and eax, 0xff
test eax, eax
je 0x7d8c07
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str._X:DAF
lea ecx, [ebp - 0x12c]
push ecx
call fcn.007f6181
add esp, 0xc
lea edx, [ebp - 0x12c]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
jmp 0x7d8c63
xor eax, eax
cmp dword [0x8170f0], 0
sete al
push eax
call fcn.007e5596
rcl byte [eax - 0x18], 0x7d
leave
add byte [eax], al
add esp, 4
and eax, 0xff
test eax, eax
jne 0x7d8c4f
mov dword [0x81732c], 6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._Error_code__d_
push 0x817330
call fcn.007f6181
add esp, 0xc
xor eax, eax
jmp 0x7d8db3
push 0
call fcn.007d8dc4
add esp, 4
mov eax, 1
jmp 0x7d8db3
add al, ch
outsb dx, byte [esi]
add dword [eax], eax
add byte [ebx + 0x1b804c4], al
add byte [eax], al
add cl, ch
push eax
add dword [eax], eax
add al, ch
push ebx
jmp 0x46078c69
call fcn.007d75bb
mov dword [ebp - 0x1c], eax
pushal
xor eax, eax
jne 0x7d8c72
jmp 0x7d8c87
jmp 0x7d8ca7
xor eax, eax
jne 0x7d8c8f
jp 0x7d8c85
jo 0x7d8c89
jmp 0x7d8c8a
jb 0x7d8c8e
jns 0x7d8c73
call dword [0x74097900]
invalid
jns 0x7d8c90
je 0x7d8c79
jmp 0x7d8c12
xchg ebx, ebx
jp 0x7d8c7e
mov al, byte [0xd8b6133]
adc dword fs:[ecx - 0x4c17af00], eax
call 0xc5018c9e
add al, 0x88
inc ebp
loopne 0x7d8cf4
xor esp, dword [ecx - 0x75]
or eax, sym.imp.KERNEL32.dll_WriteProcessMemory
popal
mov ecx, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push ecx
call 0x7d7550
add esp, 4
mov byte [ebp - 0x20], al
push eax
not eax
bswap eax
pop eax
jae 0x7d8cab
enter 0x7358, 0
pushfd
pushal
jmp 0x7d8cda
sub edx, edx
jo 0x7d8cc0
jmp 0x7d8cd1
xor ecx, ecx
je 0x7d8cb8
jmp 0x7d8cca
stc
xor ecx, 3
je 0x7d8c50
jmp 0x7d8cc7
jmp 0x7d8cd5
jae 0x7d8cc3
sbb bl, bl
sbb bl, bl
xor ebx, ebx
jmp 0x7d8cba
jmp 0x7d8cb4
sbb al, 0xdb
jmp 0x7d8cdd
jmp 0x7d8cae
popal
popfd
bswap eax
not ecx
bswap eax
not ecx
mov edx, dword [ebp - 0x20]
and edx, 0xff
test edx, edx
je 0x7d8d03
mov eax, dword [0x811268]
xor eax, 0x7c3
mov dword [0x811268], eax
push ecx
bswap ecx
not ecx
push eax
not eax
mov eax, 0x6c65696d
xchg ecx, eax
mov ecx, 0xdeadc0de
xchg ecx, eax
not eax
pop eax
not ecx
pop ecx
pushfd
pushal
xor ebx, ebx
je 0x7d8d26
jmp 0x7d8d47
xor ebx, ebx
je 0x7d8d2a
jmp 0x7d8d39
mov ecx, 0x34f9c987
nop
stc
je 0x7d8d3d
jmp 0x7d8d6d
xor eax, eax
je 0x7d8d2f
mov eax, 0x4840c987
test eax, eax
jne 0x7d8d23
jmp 0x92e42aac
popal
popfd
xchg dx, ax
xchg dx, ax
mov eax, eax
push 0
call fcn.007d8dc4
add esp, 4
push 0
call fcn.007f625b
add esp, 4
cmp dword [ebp - 0x1c], 1
jne 0x7d8d7a
push 0x8170f0
call dword [0x817114]
add bh, bh
adc eax, 0x817114
add esp, 4
mov dword [ebp - 0x1c], eax
push 0x7d758c
call fcn.007f625b
add esp, 4
cmp dword [0x817110], 0
je 0x7d8d96
call dword [0x817110]
cmp dword [0x817324], 0
je 0x7d8db0
push 0
push 0
mov ecx, dword [0x817320]
push ecx
call dword [0x817324]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret