Function at 0x5a4eb3
Capabilities:
Accept command line arguments
Check for trap flag exception
Check mutex on windows
Create process on windows
Query environment variable
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d3720
push 0x5b84d0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xfffff8c0
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov byte [ebp - 0x28], 1
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
add ecx, 1
mov dword [ebp - 0x24], ecx
mov edx, dword [sym.imp.USER32.dll_LoadStringA]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
add eax, 1
mov dword [ebp - 0x24], eax
mov ecx, dword [sym.imp.USER32.dll_LoadStringW]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x24]
add edx, 1
mov dword [ebp - 0x24], edx
push 0x5a3e4c
call fcn.005b83ab
add esp, 4
mov eax, dword [0x5cf2a4]
xor eax, dword [0x5cf2e4]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str._X::DA_08X
lea ecx, [ebp - 0x12c]
push ecx
call fcn.005b82d1
add esp, 0x10
lea edx, [ebp - 0x12c]
push edx
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0x5a4f65
mov byte [ebp - 0x28], 0
mov eax, dword [ebp - 0x28]
and eax, 0xff
test eax, eax
je 0x5a510c
mov ecx, dword [0x5cf304]
xor ecx, dword [0x5cf2d8]
xor ecx, dword [0x5cf2c8]
and ecx, 0x20
test ecx, ecx
je 0x5a510c
mov edx, dword [0x5cf320]
xor edx, dword [0x5cf300]
xor edx, dword [0x5cf2a4]
push edx
push str.RN_08X
lea eax, [ebp - 0x12c]
push eax
call fcn.005b82d1
add esp, 0xc
lea ecx, [ebp - 0x12c]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0
je 0x5a510c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x5a510c
push 0x7530
mov edx, dword [ebp - 0x130]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0
je 0x5a501f
cmp dword [ebp - 0x134], 0x80
jne 0x5a5102
mov eax, dword [0x5cf320]
xor eax, dword [0x5cf300]
xor eax, dword [0x5cf2a4]
push eax
push str._08X
lea ecx, [ebp - 0x12c]
push ecx
call fcn.005b82d1
add esp, 0xc
mov dword [ebp - 0x13c], 0
jmp 0x5a5060
mov edx, dword [ebp - 0x13c]
add edx, 1
mov dword [ebp - 0x13c], edx
cmp dword [ebp - 0x13c], 0x12c
jge 0x5a5099
lea eax, [ebp - 0x12c]
push eax
push str.MainClass
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 0
je 0x5a508f
jmp 0x5a5099
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x5a5051
cmp dword [ebp - 0x138], 0
je 0x5a50f5
mov ecx, dword [0x5cf320]
xor ecx, dword [0x5cf300]
xor ecx, dword [0x5cf2a4]
mov dword [ebp - 0x148], ecx
mov edx, dword [0x5d52d0]
push edx
call fcn.005b8330
add esp, 4
add eax, 1
mov dword [ebp - 0x144], eax
mov eax, dword [0x5d52d0]
mov dword [ebp - 0x140], eax
lea ecx, [ebp - 0x148]
push ecx
push 0
push 0x4a
mov edx, dword [ebp - 0x138]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, 1
jmp 0x5a571f
push 1
call fcn.005a5730
add esp, 4
mov ecx, dword [ebp - 0x28]
and ecx, 0xff
test ecx, ecx
je 0x5a52f5
mov edx, dword [0x5cf304]
xor edx, dword [0x5cf2d8]
xor edx, dword [0x5cf2c8]
and edx, 0x40
test edx, edx
jne 0x5a52f5
push 0x200
lea eax, [ebp - 0x348]
push eax
push str._PAD64
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x5a52f5
push 0xc8
push 0x23
lea ecx, [ebp - 0x348]
push ecx
call fcn.005b8140
add esp, 0xc
mov byte [ebp - 0x280], 0
mov dword [ebp - 0x44c], 1
jmp 0x5a519b
mov edx, dword [ebp - 0x44c]
add edx, 1
mov dword [ebp - 0x44c], edx
cmp dword [ebp - 0x44c], 0x40
jg 0x5a51d5
mov eax, dword [ebp - 0x44c]
push eax
push str._PAD_d
lea ecx, [ebp - 0x448]
push ecx
call fcn.005b82d1
add esp, 0xc
lea edx, [ebp - 0x348]
push edx
lea eax, [ebp - 0x448]
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
jmp 0x5a518c
mov ecx, dword [0x5cf304]
xor ecx, dword [0x5cf2d8]
xor ecx, dword [0x5cf2c8]
and ecx, 0x10
test ecx, ecx
jne 0x5a52f5
lea edx, [ebp - 0x5a4]
push edx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov al, byte [0x5d5614]
mov byte [ebp - 0x6a8], al
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x6a7]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov cl, byte [0x5d5614]
mov byte [ebp - 0x560], cl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x55f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
cmp dword [0x5d52c8], 1
jne 0x5a5270
cmp dword [ebp - 0x598], 0
jne 0x5a5270
lea edx, [ebp - 0x6a8]
push edx
call fcn.005a705f
add esp, 4
and eax, 0xff
test eax, eax
je 0x5a5270
lea eax, [ebp - 0x6a8]
mov dword [ebp - 0x598], eax
push 0x104
lea ecx, [ebp - 0x560]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x5a528f
xor eax, eax
jmp 0x5a571f
lea edx, [ebp - 0x45c]
push edx
lea eax, [ebp - 0x5a4]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
lea ecx, [ebp - 0x560]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x5a52eb
mov dword [0x5d5504], 6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._Location_XEB__error_code__d_
push 0x5d5508
call fcn.005b82d1
add esp, 0xc
xor eax, eax
jmp 0x5a571f
mov eax, 1
jmp 0x5a571f
mov edx, dword [0x5cf304]
xor edx, dword [0x5cf2d8]
xor edx, dword [0x5cf2c8]
and edx, 0x10
test edx, edx
je 0x5a55cf
mov eax, dword [0x5cf2a4]
xor eax, dword [0x5cf2e4]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str._X::DA_08X
lea ecx, [ebp - 0x12c]
push ecx
call fcn.005b82d1
add esp, 0x10
lea edx, [ebp - 0x12c]
push edx
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
jne 0x5a55cf
push 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov byte [ebp - 0x6ac], 0
push str.Kernel32
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x6b0], eax
cmp dword [ebp - 0x6b0], 0
je 0x5a53b7
push str.IsDebuggerPresent
mov eax, dword [ebp - 0x6b0]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x748], eax
cmp dword [ebp - 0x748], 0
je 0x5a53b7
call dword [ebp - 0x748]
test eax, eax
je 0x5a53b7
mov byte [ebp - 0x6ac], 1
mov dword [ebp - 0x744], 0x94
lea ecx, [ebp - 0x744]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x734], 2
je 0x5a5444
mov byte [ebp - 0x74c], 0
mov dword [ebp - 4], 0
pushf
pop eax
or eax, 0x100
push eax
popf
nop
mov dword [ebp - 4], 0xffffffff
jmp 0x5a542d
mov edx, dword [ebp - 0x74c]
and edx, 0xff
test edx, edx
jne 0x5a5444
mov byte [0x5d579c], 1
cmp dword [ebp - 0x734], 2
jne 0x5a54ae
push ecx
bswap ecx
not ecx
push eax
not eax
mov eax, 0x6c65696d
xchg ecx, eax
mov ecx, 0xdeadc0de
xchg ecx, eax
not eax
pop eax
not ecx
pop ecx
pushfd
pushal
xor ebx, ebx
je 0x5a5470
add ebp, ebx
and ch, bl
jmp 0x5a5491
xor ebx, ebx
je 0x5a5474
jmp 0x5a5483
mov ecx, 0x34f9c987
nop
stc
je 0x5a5487
jmp 0x5a54b7
xor eax, eax
je 0x5a5479
mov eax, 0x4840c987
test eax, eax
jne 0x5a546d
jmp 0x92c0f1f6
popal
popfd
xchg dx, ax
xchg dx, ax
mov eax, eax
mov eax, dword fs:[0x30]
movzx eax, byte [eax + 2]
or al, al
jne 0x5a54c5
jmp 0x5a5536
jo 0x5a54b7
jl 0x5a54b5
jmp 0x5a54b9
je 0x5a54b2
jmp 0x5a54b2
mov eax, dword fs:[0x20]
or eax, eax
jne 0x5a54c5
jmp 0x5a5536
pushal
xor eax, eax
jne 0x5a54cc
jmp 0x5a54e1
jmp 0x5a5501
xor eax, eax
jne 0x5a54e9
jp 0x5a54df
jo 0x5a54e3
jmp 0x5a54e4
jb 0x5a54e8
jns 0x5a54cd
call dword [0x74097900]
invalid
jns 0x5a54ea
je 0x5a54d3
jmp 0x5a546c
xchg ebx, ebx
jp 0x5a54d8
mov al, byte [0x5c66133]
invalid
xor esp, dword [ecx - 0x3a]
add eax, 0x5d54f0
add dword [eax - 9], edx
ror byte [edi], 1
enter 0x7358, 0
popal
mov byte [0x5d54f0], 1
push eax
not eax
bswap eax
pop eax
jae 0x5a54fa
pushfd
pushal
jmp 0x5a5529
sub edx, edx
jo 0x5a550f
jmp 0x5a5520
xor ecx, ecx
je 0x5a5507
jmp 0x5a5519
stc
xor ecx, 3
je 0x5a549f
jmp 0x5a5516
jmp 0x5a5524
jae 0x5a5512
sbb bl, bl
sbb bl, bl
xor ebx, ebx
jmp 0x5a5509
jmp 0x5a5503
sbb al, 0xdb
jmp 0x5a552c
jmp 0x5a54fd
popal
popfd
bswap eax
not ecx
bswap eax
not ecx
mov eax, dword [ebp - 0x6ac]
and eax, 0xff
test eax, eax
je 0x5a5573
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str._X:DAF
lea ecx, [ebp - 0x12c]
push ecx
call fcn.005b82d1
add esp, 0xc
lea edx, [ebp - 0x12c]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
jmp 0x5a55cf
xor eax, eax
cmp dword [0x5d52c8], 0
sete al
push eax
call fcn.005a75d6
add esp, 4
and eax, 0xff
test eax, eax
jne 0x5a55bb
rcl byte [eax - 0x18], 0x51
and byte [eax], al
add byte [ebx - 0xdafb3c], al
add byte [eax], al
add byte [ebp - 0x38d58a40], al
add eax, 0x5d5504
push es
add byte [eax], al
add bh, bh
adc eax, sym.imp.KERNEL32.dll_GetLastError
mov dword [0x5d5504], 6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._Error_code__d_
push 0x5d5508
call fcn.005b82d1
add esp, 0xc
xor eax, eax
jmp 0x5a571f
push 0
call fcn.005a5730
add esp, 4
mov eax, 1
jmp 0x5a571f
add al, ch
outsb dx, byte [esi]
add dword [eax], eax
add byte [ebx + 0x1b804c4], al
add byte [eax], al
add cl, ch
push eax
add dword [eax], eax
add al, ch
cmpsd dword [esi], dword es:[edi]
call 0x45e455d5
in al, 0x60
call fcn.005a3e7b
mov dword [ebp - 0x1c], eax
pushal
xor eax, eax
jne 0x5a55de
jmp 0x5a55f3
jmp 0x5a5613
xor eax, eax
jne 0x5a55fb
jp 0x5a55f1
jo 0x5a55f5
jmp 0x5a55f6
jb 0x5a55fa
jns 0x5a55df
call dword [0x74097900]
invalid
jns 0x5a55fc
je 0x5a55e5
jmp 0x5a557e
xchg ebx, ebx
jp 0x5a55ea
mov al, byte [0xd8b6133]
pop esp
int1
pop esp
add byte [ecx - 0x18], dl
pop es
call 0xc4de560a
add al, 0x88
inc ebp
loopne 0x5a5660
xor esp, dword [ecx - 0x75]
or eax, sym.imp.KERNEL32.dll_WriteProcessMemory
popal
mov ecx, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push ecx
call 0x5a3e10
add esp, 4
mov byte [ebp - 0x20], al
push eax
not eax
bswap eax
pop eax
jae 0x5a5617
enter 0x7358, 0
pushfd
pushal
jmp 0x5a5646
sub edx, edx
jo 0x5a562c
jmp 0x5a563d
xor ecx, ecx
je 0x5a5624
jmp 0x5a5636
stc
xor ecx, 3
je 0x5a55bc
jmp 0x5a5633
jmp 0x5a5641
jae 0x5a562f
sbb bl, bl
sbb bl, bl
xor ebx, ebx
jmp 0x5a5626
jmp 0x5a5620
sbb al, 0xdb
jmp 0x5a5649
jmp 0x5a561a
popal
popfd
bswap eax
not ecx
bswap eax
not ecx
mov edx, dword [ebp - 0x20]
and edx, 0xff
test edx, edx
je 0x5a566f
mov eax, dword [0x5cf314]
xor eax, 0x7c3
mov dword [0x5cf314], eax
push ecx
bswap ecx
not ecx
push eax
not eax
mov eax, 0x6c65696d
xchg ecx, eax
mov ecx, 0xdeadc0de
xchg ecx, eax
not eax
pop eax
not ecx
pop ecx
pushfd
pushal
xor ebx, ebx
je 0x5a5692
jmp 0x5a56b3
xor ebx, ebx
je 0x5a5696
jmp 0x5a56a5
mov ecx, 0x34f9c987
nop
stc
je 0x5a56a9
jmp 0x5a56d9
xor eax, eax
je 0x5a569b
mov eax, 0x4840c987
test eax, eax
jne 0x5a568f
jmp 0x92c0f418
popal
popfd
xchg dx, ax
xchg dx, ax
mov eax, eax
push 0
call fcn.005a5730
add esp, 4
push 0
call fcn.005b83ab
add esp, 4
cmp dword [ebp - 0x1c], 1
jne 0x5a56e6
push 0x5d52c8
call dword [0x5d52ec]
add bh, bh
adc eax, 0x5d52ec
add esp, 4
mov dword [ebp - 0x1c], eax
push 0x5a3e4c
call fcn.005b83ab
add esp, 4
cmp dword [0x5d52e8], 0
je 0x5a5702
call dword [0x5d52e8]
cmp dword [0x5d54fc], 0
je 0x5a571c
push 0
push 0
mov ecx, dword [0x5d54f8]
push ecx
call dword [0x5d54fc]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret