Function at 0x404d17
Capabilities:
Query environment variable
Terminate process

Disassembly:
push edi
push esi
lodsb al, byte [esi]
cmp al, 0x1a
je 0x404d2b
cmp al, 0x2d
je 0x404d26
cmp al, 0x2b
jne 0x404d66
lodsb al, byte [esi]
cmp al, 0x1a
jne 0x404d66
lodsb al, byte [esi]
movzx ecx, al
cmp cl, 1
jbe 0x404d66
lea edx, [esi + 1]
xor ah, ah
lodsb al, byte [esi]
cmp al, 0x2e
je 0x404d58
cmp al, 0x45
je 0x404d74
cmp al, 0x65
je 0x404d74
cmp al, 0x46
je 0x404d6a
cmp al, 0x66
je 0x404d6a
cmp al, 0x30
jb 0x404d66
cmp al, 0x39
ja 0x404d66
jmp 0x404d9b
cmp esi, edx
je 0x404d66
or ah, ah
jne 0x404d66
or ah, 1
lodsb al, byte [esi]
loop 0x404d4e
pop esi
pop edi
stc
ret
cmp cl, 1
jne 0x404d66
or ah, 4
jmp 0x404d9b
cmp esi, edx
je 0x404d66
cmp ah, 1
ja 0x404d66
or ah, 2
cmp ecx, 1
jne 0x404d9b
cmp byte [esi], 0x2b
je 0x404d8f
cmp byte [esi], 0x2d
jne 0x404d9b
inc esi
cmp byte [esi], 0x1a
jne 0x404d66
inc esi
lodsb al, byte [esi]
movzx ecx, al
inc ecx
dec ecx
jne 0x404d39
or ah, ah
je 0x404d66
pop esi
lodsb al, byte [esi]
mov byte [0x4172f0], 0
cmp al, 0x1a
je 0x404dbb
inc esi
cmp al, 0x2b
je 0x404dbb
mov byte [0x4172f0], 1
lodsb al, byte [esi]
movzx ecx, al
xor edx, edx
mov edi, 0x417248
mov dword [edi], edx
mov dword [edi + 4], edx
mov dword [edi + 0xc], edx
call fcn.004050d7
mov byte [0x4172f1], 0
mov al, byte [esi]
lodsb al, byte [esi]
cmp al, 0x2e
je 0x404e3c
cmp al, 0x45
je 0x404ed1
cmp al, 0x65
je 0x404ed1
cmp al, 0x46
je 0x404f3c
cmp al, 0x66
je 0x404f3c
sub al, 0x30
mov edi, 0x417258
xor edx, edx
mov dword [edi + 0xc], edx
mov dword [edi], edx
mov dword [edi + 4], edx
mov byte [edi + 7], al
mov dl, 7
mov dword [edi + 8], edx
call fcn.004050d7
mov edi, 0x417248
push ecx
mov ecx, 0xa
call fcn.00404f78
pop ecx
mov ebx, 0x417258
call fcn.00405045
loop 0x404ddc
mov edi, 0x417258
xor edx, edx
mov dword [edi], edx
mov dword [edi + 4], edx
mov byte [edi + 7], pe_nt_image_headers32
mov dword [edi + 8], edx
mov dword [edi + 0xc], edx
dec ecx
je 0x404f3c
lodsb al, byte [esi]
cmp al, 0x45
je 0x404ed1
cmp al, 0x65
je 0x404ed1
cmp al, 0x46
je 0x404f3c
cmp al, 0x66
je 0x404f3c
inc byte [0x4172f1]
cmp byte [0x4172f1], 0x80
jne 0x404e88
mov byte [0x4172f1], 0x7f
dec esi
mov edi, 0x417258
push ecx
mov ecx, 0xa
call fcn.00404fd2
push dword [edi]
push dword [edi + 4]
push dword [edi + 8]
push dword [edi + 0xc]
lodsb al, byte [esi]
sub al, 0x30
movzx ecx, al
call fcn.00404f78
mov ebx, edi
mov edi, 0x417248
call fcn.00405045
mov edi, 0x417258
pop dword [edi + 0xc]
pop dword [edi + 8]
pop dword [edi + 4]
pop dword [edi]
pop ecx
dec ecx
jne 0x404e59
jmp 0x404f3c
or byte [0x4172f1], 0x80
xor edx, edx
xor ebp, ebp
dec ecx
jne 0x404ef2
cmp byte [esi], 0x2b
je 0x404eeb
cmp byte [esi], 0x2d
jne 0x404f3c
not ebp
add esi, 2
lodsb al, byte [esi]
movzx ecx, al
movzx eax, byte [esi]
inc esi
sub al, 0x30
cmp al, 0xa
jae 0x404f0f
imul edx, edx, 0xa
cmp edx, 0x8000
jae 0x4018e9
add edx, eax
loop 0x404ef2
mov edi, 0x417248
or edx, edx
je 0x404f3c
mov ecx, edx
or ebp, ebp
jne 0x404f2e
push ecx
mov ecx, 0xa
call fcn.00404f78
pop ecx
loop 0x404f1e
jmp 0x404f3c
push ecx
mov ecx, 0xa
call fcn.00404fd2
pop ecx
loop 0x404f2e
mov edi, 0x417248
mov al, byte [0x4172f1]
mov byte [edi + 0xa], al
mov al, byte [0x4172f0]
mov byte [edi + 0xb], al
test byte [edi + 0xf], 0x80
je 0x404f75
add dword [edi], 1
adc dword [edi + 4], 0
jae 0x404f75
mov eax, dword [edi + 4]
shrd dword [edi], eax, 1
shr eax, 1
or eax, 0x80000000
mov dword [edi + 4], eax
inc word [edi + 8]
pop edi
clc
ret