Function at 0x40322a
Capabilities:
Query environment variable
Terminate process

Disassembly:
push dword [0x416cab]
or byte [0x416cab], 0x10
push dword [0x416be0]
push dword [0x416b80]
push dword [0x416b84]
push dword [0x416b88]
push dword [0x416b94]
push dword [0x416b90]
push eax
push dword [0x416b78]
lodsb al, byte [esi]
cmp al, 0x7b
je 0x403290
or al, al
jne 0x4019aa
mov dword [0x416b7c], esi
add esi, 0x12
lodsb al, byte [esi]
or al, al
je 0x40326f
cmp al, 0x7b
je 0x403290
cmp al, 0x3b
jne 0x4019aa
call fcn.00403546
jmp 0x40326f
mov ecx, 0x80000000
mov dword [0x416b80], esi
mov eax, dword [0x416b7c]
mov dword [0x416b84], eax
mov dword [0x416b88], ecx
xor eax, eax
mov dword [0x416be0], eax
cmp dword [0x416be4], eax
je 0x4032c0
inc dword [0x416be0]
mov dword [0x416b78], edi
lea eax, [edi + 0x10]
cmp eax, dword [0x416b38]
jae 0x401926
mov eax, dword [esp + 4]
or eax, eax
je 0x4032ed
stosd dword es:[edi], eax
mov eax, ecx
stosd dword es:[edi], eax
mov eax, dword [esp]
stosd dword es:[edi], eax
mov eax, dword [0x416b7c]
stosd dword es:[edi], eax
jmp 0x403300
mov eax, dword [0x416b7c]
add eax, 0x11
stosd dword es:[edi], eax
mov eax, ecx
stosd dword es:[edi], eax
mov eax, dword [0x416b7c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
or byte [0x416cab], 0x20
push ebx
push ecx
test byte [0x416cab], 0xf
je 0x403318
mov ax, 0x3b
stosw word es:[edi], ax
lea eax, [edi + 0x100]
cmp eax, dword [0x416b38]
jae 0x401926
lodsb al, byte [esi]
cmp al, 0x7d
je 0x403568
or al, al
je 0x403568
cmp al, 0x1a
je 0x40335f
cmp al, 0x3b
je 0x403563
and byte [0x416cab], 0xdf
stosb byte es:[edi], al
cmp al, 0x22
jne 0x403318
mov ecx, dword [esi]
add ecx, 4
call fcn.00402aaf
jmp 0x403318
push esi
push edi
test byte [0x416cab], 0x20
je 0x403389
movzx ecx, byte [esi]
inc esi
mov edi, 0x41285a
call fcn.0040235d
jae 0x40337d
dec esi
jmp 0x403389
mov edx, eax
pop edi
pop eax
mov byte [edi], 0
inc edi
pop ecx
pop ebx
jmp edx
and byte [0x416cab], 0xdf
movzx ecx, byte [esi]
inc esi
mov eax, dword [0x416be0]
call fcn.00403758
jae 0x4033d5
xor eax, eax
cmp dword [0x416be0], eax
je 0x4033f6
call fcn.00403758
jb 0x4034c6
pop edi
pop eax
mov ecx, dword [edx + 8]
mov edx, dword [edx + 0xc]
or edx, edx
je 0x40343f
and ecx, 0x7fffffff
xchg edx, esi
call fcn.00402aaf
mov esi, edx
jmp 0x403318
xor eax, eax
cmp dword [0x416be0], eax
je 0x4033b5
push esi
push edx
sub esi, ecx
call fcn.00403758
mov ebx, edx
pop edx
pop esi
jb 0x4033b5
cmp edx, ebx
ja 0x4033b5
mov edx, ebx
jmp 0x4033b5
inc eax
push eax
call fcn.00403758
pop eax
jb 0x4034c6
pop edi
push ecx
mov ecx, dword [edx + 8]
mov edx, dword [edx + 0xc]
xchg edx, esi
btr ecx, 0x1f
jb 0x403418
rep movsb byte es:[edi], byte [esi]
jmp 0x403422
mov byte [edi], 0x3c
inc edi
rep movsb byte es:[edi], byte [esi]
mov byte [edi], 0x3e
inc edi
cmp eax, dword [0x416be4]
je 0x403436
mov byte [edi], 0x2c
inc edi
mov esi, edx
pop ecx
push edi
sub esi, ecx
jmp 0x4033f6
pop ecx
pop eax
mov esi, edx
jmp 0x403318
mov eax, dword [0x416be0]
and eax, 0x7fffffff
je 0x403458
add ecx, eax
dec ecx
call fcn.0040347a
jmp 0x403318
mov edx, ecx
xor ecx, ecx
push ecx
push edx
add ecx, edx
call fcn.0040347a
pop edx
pop ecx
inc ecx
cmp ecx, dword [0x416be4]
je 0x403318
mov byte [edi], 0x2c
inc edi
jmp 0x40345c
pop edi
pop esi
mov al, 0x1a
stosb byte es:[edi], al
mov al, byte [esi]
inc esi
stosb byte es:[edi], al
cmp byte [esi], 0x2e
jne 0x4034f3
mov ebx, dword [esp + 0x10]
or ebx, ebx
je 0x4034f3
cmp al, 1
je 0x4034fd
xchg ebx, esi
movzx ecx, byte [esi - 1]
add byte [edi - 1], cl
jb 0x401ad3
rep movsb byte es:[edi], byte [esi]
xchg ebx, esi
movzx ecx, al
rep movsb byte es:[edi], byte [esi]
jmp 0x403318
inc esi
xchg ebx, esi
movzx ecx, byte [esi - 1]
mov byte [edi - 1], cl
rep movsb byte es:[edi], byte [esi]
xchg ebx, esi
mov eax, dword [esp + 0x14]
cmp byte [eax], 0x3b
je 0x403318
cmp byte [eax], 0x1a
jne 0x403525
mov byte [eax], 0x3b
jmp 0x403318
mov ebx, dword [esp + 0x10]
push esi
push edi
lea edi, [ebx - 3]
lea esi, [edi - 2]
lea ecx, [esi + 1]
sub ecx, eax
std
rep movsb byte es:[edi], byte [esi]
cld
mov word [eax], 0x3b
pop edi
pop esi
jmp 0x403318
call fcn.00403546
mov byte [edi], 0
inc edi
push eax
call fcn.004023aa
pop eax
pop ecx
pop ebx
cmp al, 0x7d
je 0x403588
inc ecx
mov dword [0x416b7c], esi
add esi, 0x12
jmp 0x4032c0
call fcn.0040370c
jb 0x4032c0
pop dword [0x416b78]
add esp, 0xc
pop dword [0x416b88]
pop dword [0x416b84]
pop dword [0x416b80]
pop dword [0x416be0]
pop eax
and al, 0xf0
and byte [0x416cab], 0xf
or byte [0x416cab], al
ret