Function at 0x4dad17
Capabilities:
Accept command line arguments
Check for trap flag exception
Check mutex on windows
Create process on windows
Query environment variable
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5091f0
push 0x4e3a90
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xfffff8c4
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov byte [ebp - 0x20], 1
push 0x4d9e0c
call fcn.004e396b
add esp, 4
mov eax, dword [0x506290]
xor eax, dword [0x506244]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x50648c
lea ecx, [ebp - 0x128]
push ecx
call fcn.004e3891
add esp, 0x10
lea edx, [ebp - 0x128]
push edx
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0x4dad94
mov byte [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
and eax, 0xff
test eax, eax
je 0x4daf3b
mov ecx, dword [0x5062a0]
xor ecx, dword [0x506268]
xor ecx, dword [0x506298]
and ecx, 0x20
test ecx, ecx
je 0x4daf3b
mov edx, dword [0x506270]
xor edx, dword [0x506260]
xor edx, dword [0x506290]
push edx
push str.RN_08X
lea eax, [ebp - 0x128]
push eax
call fcn.004e3891
add esp, 0xc
lea ecx, [ebp - 0x128]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0
je 0x4daf3b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4daf3b
push 0x7530
mov edx, dword [ebp - 0x12c]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0
je 0x4dae4e
cmp dword [ebp - 0x130], 0x80
jne 0x4daf31
mov eax, dword [0x506270]
xor eax, dword [0x506260]
xor eax, dword [0x506290]
push eax
push 0x5064a0
lea ecx, [ebp - 0x128]
push ecx
call fcn.004e3891
add esp, 0xc
mov dword [ebp - 0x138], 0
jmp 0x4dae8f
mov edx, dword [ebp - 0x138]
add edx, 1
mov dword [ebp - 0x138], edx
cmp dword [ebp - 0x138], 0x12c
jge 0x4daec8
lea eax, [ebp - 0x128]
push eax
push str.MainClass
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0
je 0x4daebe
jmp 0x4daec8
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4dae80
cmp dword [ebp - 0x134], 0
je 0x4daf24
mov ecx, dword [0x506270]
xor ecx, dword [0x506260]
xor ecx, dword [0x506290]
mov dword [ebp - 0x144], ecx
mov edx, dword [0x5096f0]
push edx
call fcn.004e38f0
add esp, 4
add eax, 1
mov dword [ebp - 0x140], eax
mov eax, dword [0x5096f0]
mov dword [ebp - 0x13c], eax
lea ecx, [ebp - 0x144]
push ecx
push 0
push 0x4a
mov edx, dword [ebp - 0x134]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, 1
jmp 0x4db50b
push 1
call fcn.004db51c
add esp, 4
mov ecx, dword [ebp - 0x20]
and ecx, 0xff
test ecx, ecx
je 0x4db124
mov edx, dword [0x5062a0]
xor edx, dword [0x506268]
xor edx, dword [0x506298]
and edx, 0x40
test edx, edx
jne 0x4db124
push 0x200
lea eax, [ebp - 0x344]
push eax
push str._PAD64
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x4db124
push 0xc8
push 0x23
lea ecx, [ebp - 0x344]
push ecx
call fcn.004e3700
add esp, 0xc
mov byte [ebp - 0x27c], 0
mov dword [ebp - 0x448], 1
jmp 0x4dafca
mov edx, dword [ebp - 0x448]
add edx, 1
mov dword [ebp - 0x448], edx
cmp dword [ebp - 0x448], 0x40
jg 0x4db004
mov eax, dword [ebp - 0x448]
push eax
push str._PAD_d
lea ecx, [ebp - 0x444]
push ecx
call fcn.004e3891
add esp, 0xc
lea edx, [ebp - 0x344]
push edx
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
jmp 0x4dafbb
mov ecx, dword [0x5062a0]
xor ecx, dword [0x506268]
xor ecx, dword [0x506298]
and ecx, 0x10
test ecx, ecx
jne 0x4db124
lea edx, [ebp - 0x5a0]
push edx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov al, byte [0x509a2c]
mov byte [ebp - 0x6a4], al
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x6a3]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov cl, byte [0x509a30]
mov byte [ebp - 0x55c], cl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x55b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
cmp dword [0x5096e8], 1
jne 0x4db09f
cmp dword [ebp - 0x594], 0
jne 0x4db09f
lea edx, [ebp - 0x6a4]
push edx
call fcn.004dcc14
add esp, 4
and eax, 0xff
test eax, eax
je 0x4db09f
lea eax, [ebp - 0x6a4]
mov dword [ebp - 0x594], eax
push 0x104
lea ecx, [ebp - 0x55c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4db0be
xor eax, eax
jmp 0x4db50b
lea edx, [ebp - 0x458]
push edx
lea eax, [ebp - 0x5a0]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
lea ecx, [ebp - 0x55c]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x4db11a
mov dword [0x509920], 6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._Location_XEB__error_code__d_
push 0x509924
call fcn.004e3891
add esp, 0xc
xor eax, eax
jmp 0x4db50b
mov eax, 1
jmp 0x4db50b
mov edx, dword [0x5062a0]
xor edx, dword [0x506268]
xor edx, dword [0x506298]
and edx, 0x10
test edx, edx
je 0x4db3f1
mov eax, dword [0x506290]
xor eax, dword [0x506244]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x5064e4
lea ecx, [ebp - 0x128]
push ecx
call fcn.004e3891
add esp, 0x10
lea edx, [ebp - 0x128]
push edx
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
jne 0x4db3f1
push 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov byte [ebp - 0x6a8], 0
push 0x5064f0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x6ac], eax
cmp dword [ebp - 0x6ac], 0
je 0x4db1e6
push 0x5064fc
mov eax, dword [ebp - 0x6ac]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x744], eax
cmp dword [ebp - 0x744], 0
je 0x4db1e6
call dword [ebp - 0x744]
test eax, eax
je 0x4db1e6
mov byte [ebp - 0x6a8], 1
mov dword [ebp - 0x740], 0x94
lea ecx, [ebp - 0x740]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x730], 2
je 0x4db273
mov byte [ebp - 0x748], 0
mov dword [ebp - 4], 0
pushf
pop eax
or eax, 0x100
push eax
popf
nop
mov dword [ebp - 4], 0xffffffff
jmp 0x4db25c
mov edx, dword [ebp - 0x748]
and edx, 0xff
test edx, edx
jne 0x4db273
mov byte [0x509a88], 1
cmp dword [ebp - 0x730], 2
jne 0x4db2b7
pushal
xor eax, eax
jne 0x4db283
jmp 0x4db298
jmp 0x4db2b8
xor eax, eax
jne 0x4db2a0
jp 0x4db296
jo 0x4db29a
jmp 0x4db29b
jb 0x4db29f
jns 0x4db284
call dword [0x74097900]
invalid
jns 0x4db2a1
je 0x4db28a
jmp 0x4db223
xchg ebx, ebx
jp 0x4db28f
invalid
mov al, byte [0xa1646133]
xor byte [eax], al
add byte [eax], al
xor esp, dword [ecx + 0x64]
mov eax, dword [0x30]
popal
mov eax, dword fs:[0x30]
movzx eax, byte [eax + 2]
or al, al
jne 0x4db2f7
jmp 0x4db358
pushfd
pushal
jmp 0x4db2e6
sub edx, edx
jo 0x4db2cc
jmp 0x4db2dd
xor ecx, ecx
je 0x4db2c4
jmp 0x4db2d6
stc
xor ecx, 3
je 0x4db25c
add esi, dword [eax + edx*4 - 0x15]
add eax, 0x7410ebb9
out dx, eax
jmp 0x4db2d3
jmp 0x4db2e1
jae 0x4db2cf
sbb bl, bl
sbb bl, bl
xor ebx, ebx
jmp 0x4db2c6
jmp 0x4db2c0
sbb al, 0xdb
jmp 0x4db2e9
jmp 0x4db2ba
popal
popfd
mov eax, dword fs:[0x20]
or eax, eax
jne 0x4db2f7
jmp 0x4db358
pushal
xor eax, eax
jne 0x4db2fe
jmp 0x4db313
jmp 0x4db333
xor eax, eax
jne 0x4db31b
jp 0x4db311
jo 0x4db315
jmp 0x4db316
jb 0x4db31a
jns 0x4db2ff
call dword [0x74097900]
invalid
jns 0x4db31c
je 0x4db305
jmp 0x4db29e
xchg ebx, ebx
jp 0x4db30a
mov al, byte [0x5c66133]
adc byte [ecx - 0x63feffb0], bl
xor esp, dword [ecx - 0x3a]
add eax, 0x509910
add dword [eax + 0x70d22beb], ebx
push cs
popal
mov byte [0x509910], 1
pushfd
pushal
jmp 0x4db353
sub edx, edx
jo 0x4db339
jmp 0x4db34a
xor ecx, ecx
je 0x4db331
jmp 0x4db343
stc
xor ecx, 3
je 0x4db2c9
jmp 0x4db340
jmp 0x4db34e
jae 0x4db33c
sbb bl, bl
sbb bl, bl
xor ebx, ebx
jmp 0x4db333
jmp 0x4db32d
sbb al, 0xdb
jmp 0x4db356
jmp 0x4db327
popal
popfd
mov eax, dword [ebp - 0x6a8]
and eax, 0xff
test eax, eax
je 0x4db395
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x506510
lea ecx, [ebp - 0x128]
push ecx
call fcn.004e3891
add esp, 0xc
lea edx, [ebp - 0x128]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
jmp 0x4db3f1
xor eax, eax
cmp dword [0x5096e8], 0
sete al
push eax
call fcn.004dd0b9
add esp, 4
and eax, 0xff
rcl byte [eax - 0x18], 0x12
sbb eax, 0xc4830000
add al, 0x25
inc dword [eax]
add byte [eax], al
test eax, eax
jne 0x4db3dd
mov dword [0x509920], 6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._Error_code__d_
push 0x509924
call fcn.004e3891
add esp, 0xc
xor eax, eax
jmp 0x4db50b
push 0
call fcn.004db51c
add esp, 4
mov eax, 1
jmp 0x4db50b
call fcn.004d9e3b
mov dword [ebp - 0x1c], eax
pushal
xor eax, eax
jne 0x4db400
jmp 0x4db415
jmp 0x4db435
xor eax, eax
jne 0x4db41d
jp 0x4db413
jo 0x4db417
jmp 0x4db418
jb 0x4db41c
jns 0x4db401
call dword [0x74097900]
invalid
jns 0x4db41e
je 0x4db407
jmp 0x4db3a0
xchg ebx, ebx
jp 0x4db40c
mov al, byte [0xd8b6133]
inc esp
popal
push eax
add byte [ecx - 0x18], dl
movsd dword es:[edi], dword [esi]
xor esp, dword [ecx - 0x75]
or eax, sym.imp.KERNEL32.dll_WriteProcessMemory
popal
mov ecx, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push ecx
call 0x4d9dd0
add esp, 4
mov byte [ebp - 0x24], al
pushfd
pushal
jmp 0x4db460
jmp 0xc4d1b42c
sub edx, edx
jo 0x4db446
sal byte [eax + 0xe], cl
jmp 0x4db457
xor ecx, ecx
je 0x4db43e
jmp 0x4db450
stc
xor ecx, 3
je 0x4db3d6
jmp 0x4db44d
jmp 0x4db45b
jae 0x4db449
sbb bl, bl
sbb bl, bl
xor ebx, ebx
jmp 0x4db440
jmp 0x4db43a
sbb al, 0xdb
jmp 0x4db463
jmp 0x4db434
popal
popfd
mov edx, dword [ebp - 0x24]
and edx, 0xff
test edx, edx
je 0x4db481
mov eax, dword [0x50623c]
xor eax, 0x7c3
mov dword [0x50623c], eax
pushal
xor eax, eax
jne 0x4db488
jmp 0x4db49d
jmp 0x4db4bd
xor eax, eax
jne 0x4db4a5
jp 0x4db49b
jo 0x4db49f
jmp 0x4db4a0
jb 0x4db4a4
jns 0x4db489
call dword [0x74097900]
invalid
jns 0x4db4a6
je 0x4db48f
jmp 0x4db428
xchg ebx, ebx
jp 0x4db494
mov al, byte [0x6a6133]
xor esp, dword [ecx + 0x6a]
add al, ch
outsb dx, byte [esi]
add byte [eax], al
add byte [ebx + 0x6a04c4], al
popal
push 0
call fcn.004db51c
add esp, 4
push 0
call fcn.004e396b
add esp, 4
cmp dword [ebp - 0x1c], 1
in al, 1
jne 0x4db4d2
push 0x5096e8
call dword [0x50970c]
add esp, 4
mov dword [ebp - 0x1c], eax
push 0x4d9e0c
call fcn.004e396b
add esp, 4
cmp dword [0x509708], 0
je 0x4db4ee
call dword [0x509708]
cmp dword [0x509918], 0
je 0x4db508
push 0
push 0
mov ecx, dword [0x509914]
push ecx
call dword [0x509918]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret