Function at 0x403f1a
Capabilities:
Query environment variable
Terminate process

Disassembly:
push 0x416759
jmp fcn.00401542
cmp bx, 0x5e04
je 0x404029
cmp bx, 0x4a7
je 0x404062
cmp bx, 0xa4a
je 0x404029
cmp bx, 0xaa
je 0x40407c
cmp bx, 0x2da1
je 0x404075
cmp bx, 0x23b
je 0x4040aa
cmp bx, 0x2eab
je 0x40414b
cmp bx, 0x2df7
je 0x4040d1
cmp bx, 0x2dc8
je 0x403f13
cmp bx, 0x2c62
je 0x403f13
cmp bx, 0x3b53
je 0x403f13
jmp fcn.00403f1a
or byte [0x416cad], 0xff
lea eax, [edi + 0x100]
cmp eax, dword [0x416bb4]
jae 0x401926
lodsb al, byte [esi]
cmp al, 0x3a
je 0x404337
cmp al, 0x2c
je 0x404334
cmp al, 0x3d
je 0x404334
cmp al, 0x7c
je 0x404334
cmp al, 0x26
je 0x404334
cmp al, 0x7e
je 0x404334
cmp al, 0x3e
je 0x40433d
cmp al, 0x3c
je 0x404347
cmp al, 0x29
je 0x404332
or al, al
je 0x404398
cmp al, 0x5b
je 0x4042af
cmp al, 0x5d
je 0x404334
cmp al, 0x7b
je 0x40432e
cmp al, 0x7d
je 0x40432e
cmp al, 0x23
je 0x40432e
cmp al, 0x60
je 0x40432e
dec esi
cmp al, 0x1a
jne 0x404206
push edi
mov edi, 0x4128c0
call fcn.004043da
or al, al
jne 0x403ff2
inc esi
movzx ecx, byte [esi]
inc esi
call fcn.0040443e
jae 0x403fea
cmp ecx, 1
jne 0x4041d7
cmp byte [esi], 0x3f
jne 0x4041d7
pop edi
movsb byte es:[edi], byte [esi]
jmp 0x404361
pop edi
stosw word es:[edi], ax
jmp 0x404361
pop edi
cmp al, 0x85
je 0x4041cd
stosb byte es:[edi], al
cmp al, 0x80
je 0x404290
cmp al, 0x8c
je 0x404290
cmp al, 0x81
je 0x404324
cmp al, 0x82
je 0x404192
cmp al, 0x89
je 0x404173
jmp 0x404361
cmp byte [esi], 0x1a
jne fcn.00403f1a
push edi
inc esi
movzx ecx, byte [esi]
inc esi
call fcn.004044db
jae 0x40404f
call fcn.004044af
jae 0x40404f
pop edi
sub esi, 2
jmp fcn.00403f1a
pop edi
mov dl, al
mov al, 1
stosb byte es:[edi], al
mov ax, bx
stosw word es:[edi], ax
mov al, dl
stosb byte es:[edi], al
jmp 0x403ea4
mov al, 0x28
stosb byte es:[edi], al
call fcn.00404805
mov al, 0x29
stosb byte es:[edi], al
cmp byte [esi], 0x3a
jne 0x404029
movsb byte es:[edi], byte [esi]
jmp 0x404029
or byte [0x416cad], 0xff
cmp byte [esi], 0x1a
jne 0x404361
push esi
inc esi
movzx ecx, byte [esi]
inc esi
call fcn.004043ad
pop ebx
cmp eax, 0xf
je 0x4040a3
mov byte [edi], 2
inc edi
stosd dword es:[edi], eax
xor al, al
stosb byte es:[edi], al
jmp 0x404361
mov esi, ebx
jmp 0x404361
cmp byte [esi], 0x1a
jne 0x404361
push esi
inc esi
movzx ecx, byte [esi]
inc esi
call fcn.00404542
pop ebx
cmp eax, 0xf
je 0x4040a3
mov byte [edi], 2
inc edi
stosd dword es:[edi], eax
xor al, al
stosb byte es:[edi], al
jmp 0x404361
cmp byte [esi], 0x1a
jne fcn.00403f1a
inc esi
push esi
movzx ecx, byte [esi]
inc esi
push esi
push ecx
push edi
or byte [0x416cad], 0xff
call fcn.0040443e
mov byte [0x416cad], 0
pop edi
jb 0x404104
cmp al, 0x1d
jne 0x404104
add esp, 0xc
stosw word es:[edi], ax
jmp 0x4040d1
pop ecx
pop esi
mov al, 2
stosb byte es:[edi], al
call fcn.00404542
stosd dword es:[edi], eax
mov ax, 0x8600
stosw word es:[edi], ax
pop ebx
push ebx
push esi
push edi
mov edi, 0x4128c0
call fcn.004043da
pop edi
pop edx
pop ebx
cmp al, 0x86
je 0x404361
mov esi, edx
xchg ebx, esi
movzx ecx, byte [esi]
inc esi
mov ax, 0x28
stosw word es:[edi], ax
mov eax, ecx
stosd dword es:[edi], eax
rep movsb byte es:[edi], byte [esi]
xor al, al
stosb byte es:[edi], al
xchg ebx, esi
jmp 0x404361
cmp byte [esi], 0x22
je 0x4041a0
cmp byte [esi], 0x1a
jne fcn.00403f1a
push esi
movzx ecx, byte [esi + 1]
add esi, 2
mov ax, 0x28
stosw word es:[edi], ax
mov eax, ecx
stosd dword es:[edi], eax
rep movsb byte es:[edi], byte [esi]
mov ax, 0x8600
stosw word es:[edi], ax
pop esi
cmp byte [esi], 0x1a
jne 0x404361
inc esi
movzx ecx, byte [esi]
inc esi
mov al, 2
stosb byte es:[edi], al
call fcn.00404542
stosd dword es:[edi], eax
xor al, al
stosb byte es:[edi], al
jmp 0x404361
cmp byte [esi], 0x22
jne 0x404290
jmp 0x404361
inc esi
mov ax, 0x28
stosw word es:[edi], ax
lodsd eax, dword [esi]
mov ecx, eax
stosd dword es:[edi], eax
rep movsb byte es:[edi], byte [esi]
xor al, al
stosb byte es:[edi], al
push esi
push edi
mov edi, 0x4128c0
call fcn.004043da
mov edx, esi
pop edi
pop esi
cmp al, 0x86
jne 0x404361
stosb byte es:[edi], al
mov esi, edx
jmp 0x404173
call fcn.004042ca
jmp 0x4042c2
push esi
push ecx
sub esi, 2
mov edi, 0x4128aa
call fcn.004043da
pop ecx
pop esi
or al, al
jne 0x404202
call fcn.004044db
jae 0x40404f
call fcn.004044af
jae 0x40404f
pop edi
sub esi, 2
cmp byte [esi], 0x22
jne 0x404251
mov eax, dword [esi + 1]
lea ebx, [esi + eax + 5]
push ebx
push ecx
push esi
push edi
mov al, 0x28
stosb byte es:[edi], al
call fcn.00404805
mov al, 0x29
stosb byte es:[edi], al
pop eax
pop edx
pop ecx
pop ebx
cmp esi, ebx
jne 0x404379
mov edi, eax
mov esi, edx
inc esi
mov ax, 0x28
stosw word es:[edi], ax
lodsd eax, dword [esi]
mov ecx, eax
stosd dword es:[edi], eax
shr ecx, 1
jae 0x404241
movsb byte es:[edi], byte [esi]
shr ecx, 1
jae 0x404247
movsw word es:[edi], word [esi]
rep movsd dword es:[edi], dword [esi]
xor al, al
stosb byte es:[edi], al
jmp 0x404379
cmp byte [esi], 0x28
jne 0x404280
mov eax, esp
sub eax, 0x100
jb 0x401930
cmp eax, dword [0x416b44]
jb 0x401930
push esi
push edi
inc esi
mov al, 0x7b
stosb byte es:[edi], al
inc dword [0x416c78]
jmp fcn.00403f1a
mov al, 0x28
stosb byte es:[edi], al
call fcn.00404805
mov al, 0x29
stosb byte es:[edi], al
jmp 0x404379
xor al, al
xchg byte [0x416cad], al
push eax
mov al, 0x28
stosb byte es:[edi], al
call fcn.00404805
mov al, 0x29
stosb byte es:[edi], al
pop eax
mov byte [0x416cad], al
jmp 0x404361
call fcn.004042ca
lodsb al, byte [esi]
cmp al, 0x5d
je 0x4042c2
dec esi
mov al, 0x29
stosb byte es:[edi], al
jmp 0x404361
mov al, 0x5d
stosb byte es:[edi], al
jmp 0x404361
cmp byte [esi], 0x28
jne 0x404361
inc esi
mov al, 0x7b
jmp 0x404334
mov al, 0xff
jmp 0x404334
mov al, 0x7d
stosb byte es:[edi], al
jmp 0x404361
stosb byte es:[edi], al
jmp 0x404029
cmp byte [esi], 0x3d
jne 0x404334
inc esi
mov al, 0xf2
jmp 0x404334
cmp byte [edi - 1], 0xf6
je 0x404334
cmp byte [esi], 0x3e
je 0x40435c
cmp byte [esi], 0x3d
jne 0x404334
inc esi
mov al, 0xf3
jmp 0x404334
inc esi
mov al, 0xf1
jmp 0x404334
cmp dword [0x416c78], 0
je fcn.00403f1a
dec dword [0x416c78]
add esp, 8
jmp 0x404361
cmp dword [0x416c78], 0
je fcn.00403f1a
cmp byte [esi], 0x29
jne 0x404361
dec dword [0x416c78]
pop edi
pop esi
jmp 0x404280
cmp dword [0x416c78], 0
je 0x4043ac
dec dword [0x416c78]
add esp, 8
jmp 0x404398
ret