Function at 0x471f23
Capabilities:
Accept command line arguments
Check for peb beingdebugged flag
Check for trap flag exception
Check mutex on windows
Create process on windows
Get number of processors
Packed with generic packer
Query environment variable
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4affb0
push 0x487170
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xfffff874
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov byte [ebp - 0x24], 1
mov eax, 1
test eax, eax
je 0x471f65
mov dword [ebp - 0x750], 0
jmp 0x471f75
push 1
call fcn.0047be40
add esp, 4
mov dword [ebp - 0x750], eax
mov ecx, 1
test ecx, ecx
je 0x471f8a
mov dword [ebp - 0x754], 0
jmp 0x471f9d
push 0x4aaf18
call fcn.0047bf94
add esp, 4
mov dword [ebp - 0x754], eax
mov edx, dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
add eax, 1
mov dword [ebp - 0x20], eax
mov ecx, dword [sym.imp.USER32.dll_LoadStringA]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
add edx, 1
mov dword [ebp - 0x20], edx
mov eax, dword [sym.imp.USER32.dll_LoadStringW]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
add ecx, 1
mov dword [ebp - 0x20], ecx
push 0x4709fc
call fcn.0048704c
add esp, 4
mov edx, dword [0x4aa674]
xor edx, dword [0x4aa694]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x4aaf0c
lea eax, [ebp - 0x128]
push eax
call fcn.00486ffa
add esp, 0x10
lea ecx, [ebp - 0x128]
push ecx
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0x472023
mov byte [ebp - 0x24], 0
mov edx, dword [ebp - 0x24]
and edx, 0xff
test edx, edx
je 0x4721cb
mov eax, dword [0x4aa654]
xor eax, dword [0x4aa65c]
xor eax, dword [0x4aa690]
and eax, 0x20
test eax, eax
je 0x4721cb
mov ecx, dword [0x4aa620]
xor ecx, dword [0x4aa684]
xor ecx, dword [0x4aa674]
push ecx
push 0x4aaf04
lea edx, [ebp - 0x128]
push edx
call fcn.00486ffa
add esp, 0xc
lea eax, [ebp - 0x128]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0
je 0x4721cb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4721cb
push 0x7530
mov ecx, dword [ebp - 0x12c]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0
je 0x4720dd
cmp dword [ebp - 0x130], 0x80
jne 0x4721c1
mov edx, dword [0x4aa620]
xor edx, dword [0x4aa684]
xor edx, dword [0x4aa674]
push edx
push 0x4aaefc
lea eax, [ebp - 0x128]
push eax
call fcn.00486ffa
add esp, 0xc
mov dword [ebp - 0x138], 0
jmp 0x47211f
mov ecx, dword [ebp - 0x138]
add ecx, 1
mov dword [ebp - 0x138], ecx
cmp dword [ebp - 0x138], 0x12c
jge 0x472158
lea edx, [ebp - 0x128]
push edx
push 0x4aaef0
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0
je 0x47214e
jmp 0x472158
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x472110
cmp dword [ebp - 0x134], 0
je 0x4721b4
mov eax, dword [0x4aa620]
xor eax, dword [0x4aa684]
xor eax, dword [0x4aa674]
mov dword [ebp - 0x144], eax
mov ecx, dword [0x4b20a0]
push ecx
call fcn.00486d20
add esp, 4
add eax, 1
mov dword [ebp - 0x140], eax
mov edx, dword [0x4b20a0]
mov dword [ebp - 0x13c], edx
lea eax, [ebp - 0x144]
push eax
push 0
push 0x4a
mov ecx, dword [ebp - 0x134]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edx, dword [ebp - 0x12c]
push edx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, 1
jmp 0x472a0c
mov eax, 1
test eax, eax
je 0x4721e0
mov dword [ebp - 0x758], 0
jmp 0x4721f3
push 0x4aaedc
call fcn.0047bf94
add esp, 4
mov dword [ebp - 0x758], eax
push 1
call fcn.00472a1d
add esp, 4
mov ecx, dword [ebp - 0x24]
and ecx, 0xff
test ecx, ecx
je 0x4723ee
mov edx, dword [0x4aa654]
xor edx, dword [0x4aa65c]
xor edx, dword [0x4aa690]
and edx, 0x40
test edx, edx
jne 0x4723ee
push 0x200
lea eax, [ebp - 0x344]
push eax
push 0x4aaed4
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x4723ee
push 0xc8
push 0x23
lea ecx, [ebp - 0x344]
push ecx
call fcn.00486a10
add esp, 0xc
mov byte [ebp - 0x27c], 0
mov dword [ebp - 0x448], 1
jmp 0x472282
mov edx, dword [ebp - 0x448]
add edx, 1
mov dword [ebp - 0x448], edx
cmp dword [ebp - 0x448], 0x40
jg 0x4722bc
mov eax, dword [ebp - 0x448]
push eax
push 0x4aaecc
lea ecx, [ebp - 0x444]
push ecx
call fcn.00486ffa
add esp, 0xc
lea edx, [ebp - 0x344]
push edx
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
jmp 0x472273
mov ecx, dword [0x4aa654]
xor ecx, dword [0x4aa65c]
xor ecx, dword [0x4aa690]
and ecx, 0x10
test ecx, ecx
jne 0x4723ee
lea edx, [ebp - 0x5a0]
push edx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov al, byte [0x4b2088]
mov byte [ebp - 0x6a4], al
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x6a3]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov cl, byte [0x4b2088]
mov byte [ebp - 0x55c], cl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x55b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
cmp dword [0x4b2098], 1
jne 0x472357
cmp dword [ebp - 0x594], 0
jne 0x472357
lea edx, [ebp - 0x6a4]
push edx
call fcn.004741b0
add esp, 4
and eax, 0xff
test eax, eax
je 0x472357
lea eax, [ebp - 0x6a4]
mov dword [ebp - 0x594], eax
push 0x104
lea ecx, [ebp - 0x55c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x472376
xor eax, eax
jmp 0x472a0c
lea edx, [ebp - 0x458]
push edx
lea eax, [ebp - 0x5a0]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
lea ecx, [ebp - 0x55c]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x4723d2
mov dword [0x4b22d8], 6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4aaeac
push 0x4b22dc
call fcn.00486ffa
add esp, 0xc
xor eax, eax
jmp 0x472a0c
push 0x2710
mov edx, dword [ebp - 0x458]
push edx
call dword [sym.imp.USER32.dll_WaitForInputIdle]
mov eax, 1
jmp 0x472a0c
mov eax, 1
test eax, eax
je 0x472403
mov dword [ebp - 0x75c], 0
jmp 0x472416
push 0x4aae98
call fcn.0047bf94
add esp, 4
mov dword [ebp - 0x75c], eax
mov ecx, dword [0x4aa654]
xor ecx, dword [0x4aa65c]
xor ecx, dword [0x4aa690]
and ecx, 0x10
test ecx, ecx
je 0x472907
mov edx, dword [0x4aa674]
xor edx, dword [0x4aa694]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x4aaf0c
lea eax, [ebp - 0x128]
push eax
call fcn.00486ffa
add esp, 0x10
mov ecx, 1
test ecx, ecx
je 0x472470
mov dword [ebp - 0x760], 0
jmp 0x472483
push 0x4aae84
call fcn.0047bf94
add esp, 4
mov dword [ebp - 0x760], eax
lea edx, [ebp - 0x128]
push edx
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
jne 0x472905
mov eax, 1
test eax, eax
je 0x4724b4
mov dword [ebp - 0x764], 0
jmp 0x4724c7
push 0x4aae70
call fcn.0047bf94
add esp, 4
mov dword [ebp - 0x764], eax
push 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov byte [ebp - 0x6a8], 0
push 0x4aae64
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x6ac], eax
cmp dword [ebp - 0x6ac], 0
je 0x472551
push 0x4aae50
mov ecx, dword [ebp - 0x6ac]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x744], eax
cmp dword [ebp - 0x744], 0
je 0x472551
call dword [ebp - 0x744]
test eax, eax
je 0x472551
mov edx, 1
test edx, edx
je 0x472537
mov dword [ebp - 0x768], 0
jmp 0x47254a
push 0x4aae2c
call fcn.0047bf94
add esp, 4
mov dword [ebp - 0x768], eax
mov byte [ebp - 0x6a8], 1
mov eax, 1
test eax, eax
je 0x472566
mov dword [ebp - 0x76c], 0
jmp 0x472579
push 0x4aae18
call fcn.0047bf94
add esp, 4
mov dword [ebp - 0x76c], eax
mov dword [ebp - 0x740], 0x94
lea ecx, [ebp - 0x740]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x730], 2
je 0x472606
mov byte [ebp - 0x748], 0
mov dword [ebp - 4], 0
pushf
pop eax
or eax, 0x100
push eax
popf
nop
mov dword [ebp - 4], 0xffffffff
jmp 0x4725ef
mov edx, dword [ebp - 0x748]
and edx, 0xff
test edx, edx
jne 0x472606
mov byte [0x4b2590], 1
mov eax, 1
test eax, eax
je 0x47261b
mov dword [ebp - 0x770], 0
jmp 0x47262e
push 0x4aae04
call fcn.0047bf94
add esp, 4
mov dword [ebp - 0x770], eax
cmp dword [ebp - 0x730], 2
jne 0x472698
push ecx
bswap ecx
not ecx
push eax
not eax
mov eax, 0x6c65696d
xchg ecx, eax
mov ecx, 0xdeadc0de
xchg ecx, eax
not eax
pop eax
not ecx
pop ecx
pushfd
pushal
xor ebx, ebx
je 0x47265a
jmp 0x47267b
jmp 0x47268e
xor ebx, ebx
je 0x47265e
jmp 0x47266d
mov ecx, 0x34f9c987
nop
stc
je 0x472671
jmp 0x4726a1
xor eax, eax
je 0x472663
mov eax, 0x4840c987
test eax, eax
jne 0x472657
jmp 0x92adc3e0
popal
popfd
xchg dx, ax
xchg dx, ax
mov eax, eax
mov eax, dword fs:[0x30]
movzx eax, byte [eax + 2]
or al, al
jne 0x4726b2
sal byte [ebp + 0x21], 0xe9
fild dword [eax]
add byte [eax], al
jmp 0x4726b2
jmp 0x472771
jo 0x4726a1
jl 0x47269f
jmp 0x4726a3
je 0x47269c
jmp 0x47269c
mov eax, dword fs:[0x20]
or eax, eax
jne 0x4726b2
jmp 0x472771
pushal
xor eax, eax
jne 0x4726b9
jmp 0x4726ce
jmp 0x4726ee
xor eax, eax
jne 0x4726d6
jp 0x4726cc
jo 0x4726d0
jmp 0x4726d1
jb 0x4726d5
jns 0x4726ba
call dword [0x74097900]
invalid
jns 0x4726d7
je 0x4726c0
jmp 0x472659
xchg ebx, ebx
jp 0x4726c5
mov al, byte [0x5c66133]
xor esp, dword [ecx - 0x3a]
add eax, 0x4b22c4
add dword [ecx + 1], edi
popal
mov byte [0x4b22c4], 1
les esp, [edx]
dec ebx
add byte [ecx], al
mov ecx, 1
test ecx, ecx
je 0x4726f4
mov dword [ebp - 0x774], 0
add byte [eax], al
add byte [eax], al
jmp 0x47272d
cmp dword [ebp - 0x730], 2
jne 0x472709
mov dword [ebp - 0x778], 0x4aae00
jmp 0x472713
mov dword [ebp - 0x778], 0x4aadfc
mov edx, dword [ebp - 0x778]
push edx
push 0x4aaddc
call fcn.0047bf94
add esp, 8
mov dword [ebp - 0x774], eax
push eax
not eax
bswap eax
pop eax
jae 0x472735
pushfd
pushal
jmp 0x472764
sub edx, edx
jo 0x47274a
jmp 0x47275b
xor ecx, ecx
je 0x472742
jmp 0x472754
stc
xor ecx, 3
je 0x4726da
jmp 0x472751
jmp 0x47275f
jae 0x47274d
sbb bl, bl
sbb bl, bl
xor ebx, ebx
jmp 0x472744
jmp 0x47273e
sbb al, 0xdb
jmp 0x472767
jmp 0x472738
popal
popfd
bswap eax
not ecx
bswap eax
not ecx
mov eax, 1
test eax, eax
je 0x472786
mov dword [ebp - 0x77c], 0
jmp 0x472799
push 0x4aadc8
call fcn.0047bf94
add esp, 4
mov dword [ebp - 0x77c], eax
mov ecx, dword [ebp - 0x6a8]
and ecx, 0xff
test ecx, ecx
je 0x472802
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x4aadc0
lea edx, [ebp - 0x128]
push edx
call fcn.00486ffa
add esp, 0xc
lea eax, [ebp - 0x128]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ecx, 1
test ecx, ecx
je 0x4727ea
mov dword [ebp - 0x780], 0
jmp 0x4727fd
push 0x4aadac
call fcn.0047bf94
add esp, 4
mov dword [ebp - 0x780], eax
jmp 0x4728dd
mov edx, 1
test edx, edx
je 0x472817
mov dword [ebp - 0x784], 0
jmp 0x47282a
push 0x4aad9c
call fcn.0047bf94
add esp, 4
mov dword [ebp - 0x784], eax
xor eax, eax
cmp dword [0x4b2098], 0
sete al
push eax
call fcn.004753a8
add esp, 4
and eax, 0xff
test eax, eax
jne 0x4728a1
mov ecx, 1
test ecx, ecx
je 0x47285d
mov dword [ebp - 0x788], 0
jmp 0x472877
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4aad84
call fcn.0047bf94
add esp, 8
mov dword [ebp - 0x788], eax
mov dword [0x4b22d8], 6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4aad74
push 0x4b22dc
call fcn.00486ffa
add esp, 0xc
xor eax, eax
jmp 0x472a0c
mov edx, 1
test edx, edx
je 0x4728b6
mov dword [ebp - 0x78c], 0
jmp 0x4728c9
push 0x4aad58
call fcn.0047bf94
add esp, 4
mov dword [ebp - 0x78c], eax
push 0
call fcn.00472a1d
add esp, 4
mov eax, 1
jmp 0x472a0c
mov eax, 1
test eax, eax
je 0x4728f2
mov dword [ebp - 0x790], 0
jmp 0x472905
push 0x4aad44
call fcn.0047bf94
add esp, 4
mov dword [ebp - 0x790], eax
jmp 0x47294d
mov ecx, dword [0x4aa650]
xor ecx, dword [0x4aa65c]
xor ecx, dword [0x4aa690]
and ecx, 2
test ecx, ecx
je 0x47294d
mov edx, 1
test edx, edx
je 0x472935
mov dword [ebp - 0x794], 0
jmp 0x472948
push 0x4aad28
call fcn.0047bf94
add esp, 4
mov dword [ebp - 0x794], eax
call fcn.0046fb9d
mov eax, 1
test eax, eax
je 0x472962
mov dword [ebp - 0x798], 0
jmp 0x472975
push 0x4aad14
call fcn.0047bf94
add esp, 4
mov dword [ebp - 0x798], eax
call fcn.00470a2b
mov dword [ebp - 0x1c], eax
push 0
call fcn.00472a1d
add esp, 4
push 0
call fcn.0048704c
add esp, 4
cmp dword [ebp - 0x1c], 1
jne 0x4729a8
push 0x4b2098
call dword [0x4b20c0]
add esp, 4
mov dword [ebp - 0x1c], eax
mov ecx, 1
test ecx, ecx
je 0x4729bd
mov dword [ebp - 0x79c], 0
jmp 0x4729d4
mov edx, dword [ebp - 0x1c]
push edx
push 0x4aacf8
call fcn.0047bf94
add esp, 8
mov dword [ebp - 0x79c], eax
push 0x4709fc
call fcn.0048704c
add esp, 4
cmp dword [0x4b20bc], 0
je 0x4729f0
call dword [0x4b20bc]
cmp dword [0x4b22d0], 0
je 0x472a09
push 0
push 0
mov eax, dword [0x4b22cc]
push eax
call dword [0x4b22d0]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret