Function at 0x404c2b
Capabilities:
Query environment variable
Terminate process

Disassembly:
push edi
push esi
lodsb al, byte [esi]
cmp al, 0x1a
je 0x404c3f
cmp al, 0x2d
je 0x404c3a
cmp al, 0x2b
jne 0x404c7a
lodsb al, byte [esi]
cmp al, 0x1a
jne 0x404c7a
lodsb al, byte [esi]
movzx ecx, al
cmp cl, 1
jbe 0x404c7a
lea edx, [esi + 1]
xor ah, ah
lodsb al, byte [esi]
cmp al, 0x2e
je 0x404c6c
cmp al, 0x45
je 0x404c88
cmp al, 0x65
je 0x404c88
cmp al, 0x46
je 0x404c7e
cmp al, 0x66
je 0x404c7e
cmp al, 0x30
jb 0x404c7a
cmp al, 0x39
ja 0x404c7a
jmp 0x404caf
cmp esi, edx
je 0x404c7a
or ah, ah
jne 0x404c7a
or ah, 1
lodsb al, byte [esi]
loop 0x404c62
pop esi
pop edi
stc
ret
cmp cl, 1
jne 0x404c7a
or ah, 4
jmp 0x404caf
cmp esi, edx
je 0x404c7a
cmp ah, 1
ja 0x404c7a
or ah, 2
cmp ecx, 1
jne 0x404caf
cmp byte [esi], 0x2b
je 0x404ca3
cmp byte [esi], 0x2d
jne 0x404caf
inc esi
cmp byte [esi], 0x1a
jne 0x404c7a
inc esi
lodsb al, byte [esi]
movzx ecx, al
inc ecx
dec ecx
jne 0x404c4d
or ah, ah
je 0x404c7a
pop esi
lodsb al, byte [esi]
mov byte [0x416ca2], 0
cmp al, 0x1a
je 0x404ccf
inc esi
cmp al, 0x2b
je 0x404ccf
mov byte [0x416ca2], 1
lodsb al, byte [esi]
movzx ecx, al
xor edx, edx
mov edi, 0x416c0c
mov dword [edi], edx
mov dword [edi + 4], edx
mov dword [edi + 0xc], edx
call fcn.00404feb
mov byte [0x416ca3], 0
mov al, byte [esi]
lodsb al, byte [esi]
cmp al, 0x2e
je 0x404d50
cmp al, 0x45
je 0x404de5
cmp al, 0x65
je 0x404de5
cmp al, 0x46
je 0x404e50
cmp al, 0x66
je 0x404e50
sub al, 0x30
mov edi, 0x416c1c
xor edx, edx
mov dword [edi + 0xc], edx
mov dword [edi], edx
mov dword [edi + 4], edx
mov byte [edi + 7], al
mov dl, 7
mov dword [edi + 8], edx
call fcn.00404feb
mov edi, 0x416c0c
push ecx
mov ecx, 0xa
call fcn.00404e8c
pop ecx
mov ebx, 0x416c1c
call fcn.00404f59
loop 0x404cf0
mov edi, 0x416c1c
xor edx, edx
mov dword [edi], edx
mov dword [edi + 4], edx
mov byte [edi + 7], pe_nt_image_headers32
mov dword [edi + 8], edx
mov dword [edi + 0xc], edx
dec ecx
je 0x404e50
lodsb al, byte [esi]
cmp al, 0x45
je 0x404de5
cmp al, 0x65
je 0x404de5
cmp al, 0x46
je 0x404e50
cmp al, 0x66
je 0x404e50
inc byte [0x416ca3]
cmp byte [0x416ca3], 0x80
jne 0x404d9c
mov byte [0x416ca3], 0x7f
dec esi
mov edi, 0x416c1c
push ecx
mov ecx, 0xa
call fcn.00404ee6
push dword [edi]
push dword [edi + 4]
push dword [edi + 8]
push dword [edi + 0xc]
lodsb al, byte [esi]
sub al, 0x30
movzx ecx, al
call fcn.00404e8c
mov ebx, edi
mov edi, 0x416c0c
call fcn.00404f59
mov edi, 0x416c1c
pop dword [edi + 0xc]
pop dword [edi + 8]
pop dword [edi + 4]
pop dword [edi]
pop ecx
dec ecx
jne 0x404d6d
jmp 0x404e50
or byte [0x416ca3], 0x80
xor edx, edx
xor ebp, ebp
dec ecx
jne 0x404e06
cmp byte [esi], 0x2b
je 0x404dff
cmp byte [esi], 0x2d
jne 0x404e50
not ebp
add esi, 2
lodsb al, byte [esi]
movzx ecx, al
movzx eax, byte [esi]
inc esi
sub al, 0x30
cmp al, 0xa
jae 0x404e23
imul edx, edx, 0xa
cmp edx, 0x8000
jae 0x401a40
add edx, eax
loop 0x404e06
mov edi, 0x416c0c
or edx, edx
je 0x404e50
mov ecx, edx
or ebp, ebp
jne 0x404e42
push ecx
mov ecx, 0xa
call fcn.00404e8c
pop ecx
loop 0x404e32
jmp 0x404e50
push ecx
mov ecx, 0xa
call fcn.00404ee6
pop ecx
loop 0x404e42
mov edi, 0x416c0c
mov al, byte [0x416ca3]
mov byte [edi + 0xa], al
mov al, byte [0x416ca2]
mov byte [edi + 0xb], al
test byte [edi + 0xf], 0x80
je 0x404e89
add dword [edi], 1
adc dword [edi + 4], 0
jae 0x404e89
mov eax, dword [edi + 4]
shrd dword [edi], eax, 1
shr eax, 1
or eax, 0x80000000
mov dword [edi + 4], eax
inc word [edi + 8]
pop edi
clc
ret