Function at 0x63e547
Capabilities:
Accept command line arguments
Check for trap flag exception
Check mutex on windows
Create process on windows
Query environment variable
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x67ba70
push 0x65c380
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xfffff8c0
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov byte [ebp - 0x28], 1
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
add ecx, 1
mov dword [ebp - 0x24], ecx
mov edx, dword [sym.imp.USER32.dll_LoadStringA]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
add eax, 1
mov dword [ebp - 0x24], eax
mov ecx, dword [sym.imp.USER32.dll_LoadStringW]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x24]
add edx, 1
mov dword [ebp - 0x24], edx
push 0x63d58c
call fcn.0065c25b
add esp, 4
mov eax, dword [0x6772c8]
xor eax, dword [0x677284]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x677540
lea ecx, [ebp - 0x12c]
push ecx
call fcn.0065c181
add esp, 0x10
lea edx, [ebp - 0x12c]
push edx
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0x63e5f9
mov byte [ebp - 0x28], 0
mov eax, dword [ebp - 0x28]
and eax, 0xff
test eax, eax
je 0x63e7a0
mov ecx, dword [0x6772b8]
xor ecx, dword [0x6772cc]
xor ecx, dword [0x6772d0]
and ecx, 0x20
test ecx, ecx
je 0x63e7a0
mov edx, dword [0x6772c4]
xor edx, dword [0x6772a0]
xor edx, dword [0x6772c8]
push edx
push 0x677538
lea eax, [ebp - 0x12c]
push eax
call fcn.0065c181
add esp, 0xc
lea ecx, [ebp - 0x12c]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0
je 0x63e7a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x63e7a0
push 0x7530
mov edx, dword [ebp - 0x130]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0
je 0x63e6b3
cmp dword [ebp - 0x134], 0x80
jne 0x63e796
mov eax, dword [0x6772c4]
xor eax, dword [0x6772a0]
xor eax, dword [0x6772c8]
push eax
push 0x677530
lea ecx, [ebp - 0x12c]
push ecx
call fcn.0065c181
add esp, 0xc
mov dword [ebp - 0x13c], 0
jmp 0x63e6f4
mov edx, dword [ebp - 0x13c]
add edx, 1
mov dword [ebp - 0x13c], edx
cmp dword [ebp - 0x13c], 0x12c
jge 0x63e72d
lea eax, [ebp - 0x12c]
push eax
push 0x677524
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 0
je 0x63e723
jmp 0x63e72d
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x63e6e5
cmp dword [ebp - 0x138], 0
je 0x63e789
mov ecx, dword [0x6772c4]
xor ecx, dword [0x6772a0]
xor ecx, dword [0x6772c8]
mov dword [ebp - 0x148], ecx
mov edx, dword [0x67d0f8]
push edx
call fcn.0065c1e0
add esp, 4
add eax, 1
mov dword [ebp - 0x144], eax
mov eax, dword [0x67d0f8]
mov dword [ebp - 0x140], eax
lea ecx, [ebp - 0x148]
push ecx
push 0
push 0x4a
mov edx, dword [ebp - 0x138]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, 1
jmp 0x63edb3
push 1
call fcn.0063edc4
add esp, 4
mov ecx, dword [ebp - 0x28]
and ecx, 0xff
test ecx, ecx
je 0x63e989
mov edx, dword [0x6772b8]
xor edx, dword [0x6772cc]
xor edx, dword [0x6772d0]
and edx, 0x40
test edx, edx
jne 0x63e989
push 0x200
lea eax, [ebp - 0x348]
push eax
push 0x67751c
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x63e989
push 0xc8
push 0x23
lea ecx, [ebp - 0x348]
push ecx
call fcn.0065bff0
add esp, 0xc
mov byte [ebp - 0x280], 0
mov dword [ebp - 0x44c], 1
jmp 0x63e82f
mov edx, dword [ebp - 0x44c]
add edx, 1
mov dword [ebp - 0x44c], edx
cmp dword [ebp - 0x44c], 0x40
jg 0x63e869
mov eax, dword [ebp - 0x44c]
push eax
push 0x677514
lea ecx, [ebp - 0x448]
push ecx
call fcn.0065c181
add esp, 0xc
lea edx, [ebp - 0x348]
push edx
lea eax, [ebp - 0x448]
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
jmp 0x63e820
mov ecx, dword [0x6772b8]
xor ecx, dword [0x6772cc]
xor ecx, dword [0x6772d0]
and ecx, 0x10
test ecx, ecx
jne 0x63e989
lea edx, [ebp - 0x5a4]
push edx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov al, byte [0x67d43c]
mov byte [ebp - 0x6a8], al
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [ebp - 0x6a7]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov cl, byte [0x67d43c]
mov byte [ebp - 0x560], cl
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [ebp - 0x55f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
cmp dword [0x67d0f0], 1
jne 0x63e904
cmp dword [ebp - 0x598], 0
jne 0x63e904
lea edx, [ebp - 0x6a8]
push edx
call fcn.0064b01f
add esp, 4
and eax, 0xff
test eax, eax
je 0x63e904
lea eax, [ebp - 0x6a8]
mov dword [ebp - 0x598], eax
push 0x104
lea ecx, [ebp - 0x560]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x63e923
xor eax, eax
jmp 0x63edb3
lea edx, [ebp - 0x45c]
push edx
lea eax, [ebp - 0x5a4]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
lea ecx, [ebp - 0x560]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x63e97f
mov dword [0x67d32c], 6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x6774f4
push 0x67d330
call fcn.0065c181
add esp, 0xc
xor eax, eax
jmp 0x63edb3
mov eax, 1
jmp 0x63edb3
mov edx, dword [0x6772b8]
xor edx, dword [0x6772cc]
xor edx, dword [0x6772d0]
and edx, 0x10
test edx, edx
je 0x63ec63
mov eax, dword [0x6772c8]
xor eax, dword [0x677284]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x677540
lea ecx, [ebp - 0x12c]
push ecx
call fcn.0065c181
add esp, 0x10
lea edx, [ebp - 0x12c]
push edx
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
jne 0x63ec63
push 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov byte [ebp - 0x6ac], 0
push 0x6774e8
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x6b0], eax
cmp dword [ebp - 0x6b0], 0
je 0x63ea4b
push 0x6774d4
mov eax, dword [ebp - 0x6b0]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x748], eax
cmp dword [ebp - 0x748], 0
je 0x63ea4b
call dword [ebp - 0x748]
test eax, eax
je 0x63ea4b
mov byte [ebp - 0x6ac], 1
mov dword [ebp - 0x744], 0x94
lea ecx, [ebp - 0x744]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x734], 2
je 0x63ead8
mov byte [ebp - 0x74c], 0
mov dword [ebp - 4], 0
pushf
pop eax
or eax, 0x100
push eax
popf
nop
mov dword [ebp - 4], 0xffffffff
jmp 0x63eac1
mov edx, dword [ebp - 0x74c]
and edx, 0xff
test edx, edx
jne 0x63ead8
mov byte [0x67d5c4], 1
cmp dword [ebp - 0x734], 2
jne 0x63eb42
push ecx
bswap ecx
not ecx
push eax
not eax
mov eax, 0x6c65696d
xchg ecx, eax
mov ecx, 0xdeadc0de
xchg ecx, eax
not eax
pop eax
not ecx
pop ecx
pushfd
pushal
xor ebx, ebx
je 0x63eb04
add ebp, ebx
and ch, bl
jmp 0x63eb25
xor ebx, ebx
je 0x63eb08
jmp 0x63eb17
mov ecx, 0x34f9c987
nop
stc
je 0x63eb1b
jmp 0x63eb4b
xor eax, eax
je 0x63eb0d
mov eax, 0x4840c987
test eax, eax
jne 0x63eb01
jmp 0x92ca888a
popal
popfd
xchg dx, ax
xchg dx, ax
mov eax, eax
mov eax, dword fs:[0x30]
movzx eax, byte [eax + 2]
or al, al
jne 0x63eb59
jmp 0x63ebca
jo 0x63eb4b
jl 0x63eb49
jmp 0x63eb4d
je 0x63eb46
jmp 0x63eb46
mov eax, dword fs:[0x20]
or eax, eax
jne 0x63eb59
jmp 0x63ebca
pushal
xor eax, eax
jne 0x63eb60
jmp 0x63eb75
jmp 0x63eb95
xor eax, eax
jne 0x63eb7d
jp 0x63eb73
jo 0x63eb77
jmp 0x63eb78
jb 0x63eb7c
jns 0x63eb61
call dword [0x74097900]
invalid
jns 0x63eb7e
je 0x63eb67
jmp 0x63eb00
xchg ebx, ebx
jp 0x63eb6c
mov al, byte [0x5c66133]
sbb bl, dl
add byte [bx + di], al
xor esp, dword [ecx - 0x3a]
add eax, 0x67d318
add dword [eax - 9], edx
ror byte [edi], 1
enter 0x7358, 0
popal
mov byte [0x67d318], 1
push eax
not eax
bswap eax
pop eax
jae 0x63eb8e
pushfd
pushal
jmp 0x63ebbd
sub edx, edx
jo 0x63eba3
jmp 0x63ebb4
xor ecx, ecx
je 0x63eb9b
jmp 0x63ebad
stc
xor ecx, 3
je 0x63eb33
jmp 0x63ebaa
jmp 0x63ebb8
jae 0x63eba6
sbb bl, bl
sbb bl, bl
xor ebx, ebx
jmp 0x63eb9d
jmp 0x63eb97
sbb al, 0xdb
jmp 0x63ebc0
jmp 0x63eb91
popal
popfd
bswap eax
not ecx
bswap eax
not ecx
mov eax, dword [ebp - 0x6ac]
and eax, 0xff
test eax, eax
je 0x63ec07
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x6774cc
lea ecx, [ebp - 0x12c]
push ecx
call fcn.0065c181
add esp, 0xc
lea edx, [ebp - 0x12c]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
jmp 0x63ec63
xor eax, eax
cmp dword [0x67d0f0], 0
sete al
push eax
call fcn.0064b596
rcl byte [eax - 0x18], 0x7d
leave
add byte [eax], al
add esp, 4
and eax, 0xff
test eax, eax
jne 0x63ec4f
mov dword [0x67d32c], 6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x6774bc
push 0x67d330
call fcn.0065c181
add esp, 0xc
xor eax, eax
jmp 0x63edb3
push 0
call fcn.0063edc4
add esp, 4
mov eax, 1
jmp 0x63edb3
add al, ch
outsb dx, byte [esi]
add dword [eax], eax
add byte [ebx + 0x1b804c4], al
add byte [eax], al
add cl, ch
push eax
add dword [eax], eax
add al, ch
push ebx
jmp 0x45edec69
call fcn.0063d5bb
mov dword [ebp - 0x1c], eax
pushal
xor eax, eax
jne 0x63ec72
jmp 0x63ec87
jmp 0x63eca7
xor eax, eax
jne 0x63ec8f
jp 0x63ec85
jo 0x63ec89
jmp 0x63ec8a
jb 0x63ec8e
jns 0x63ec73
call dword [0x74097900]
invalid
jns 0x63ec90
je 0x63ec79
jmp 0x63ec12
xchg ebx, ebx
jp 0x63ec7e
mov al, byte [0xd8b6133]
jno 0x63ecfd
xor esp, dword [ecx - 0x75]
or eax, sym.imp.KERNEL32.dll_WriteProcessMemory
popal
mov ecx, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
add byte [ecx - 0x18], dl
mov bl, 0xe8
invalid
push ecx
call 0x63d550
add esp, 4
mov byte [ebp - 0x20], al
push eax
not eax
bswap eax
pop eax
jae 0x63ecab
enter 0x7358, 0
pushfd
pushal
jmp 0x63ecda
sub edx, edx
jo 0x63ecc0
jmp 0x63ecd1
xor ecx, ecx
je 0x63ecb8
jmp 0x63ecca
stc
xor ecx, 3
je 0x63ec50
jmp 0x63ecc7
jmp 0x63ecd5
jae 0x63ecc3
sbb bl, bl
sbb bl, bl
xor ebx, ebx
jmp 0x63ecba
jmp 0x63ecb4
sbb al, 0xdb
jmp 0x63ecdd
jmp 0x63ecae
popal
popfd
bswap eax
not ecx
bswap eax
not ecx
mov edx, dword [ebp - 0x20]
and edx, 0xff
test edx, edx
je 0x63ed03
mov eax, dword [0x677268]
xor eax, 0x7c3
mov dword [0x677268], eax
add byte [ebx + 0x677268], ah
push ecx
bswap ecx
not ecx
push eax
not eax
mov eax, 0x6c65696d
xchg ecx, eax
mov ecx, 0xdeadc0de
xchg ecx, eax
not eax
pop eax
not ecx
pop ecx
pushfd
pushal
xor ebx, ebx
je 0x63ed26
jmp 0x63ed47
xor ebx, ebx
je 0x63ed2a
jmp 0x63ed39
mov ecx, 0x34f9c987
nop
stc
je 0x63ed3d
jmp 0x63ed6d
xor eax, eax
je 0x63ed2f
mov eax, 0x4840c987
test eax, eax
jne 0x63ed23
jmp 0x92ca8aac
popal
popfd
xchg dx, ax
xchg dx, ax
mov eax, eax
push 0
call fcn.0063edc4
add esp, 4
push 0
call fcn.0065c25b
add esp, 4
cmp dword [ebp - 0x1c], 1
jne 0x63ed7a
push 0x67d0f0
call dword [0x67d114]
add bh, bh
adc eax, 0x67d114
add esp, 4
mov dword [ebp - 0x1c], eax
push 0x63d58c
call fcn.0065c25b
add esp, 4
cmp dword [0x67d110], 0
je 0x63ed96
call dword [0x67d110]
cmp dword [0x67d324], 0
je 0x63edb0
push 0
push 0
mov ecx, dword [0x67d320]
push ecx
call dword [0x67d324]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret