Function at 0x402361
Capabilities:
Query environment variable
Terminate process

Disassembly:
push 0x416b46
jmp fcn.004019f4
push 0x416b6f
jmp fcn.004019f4
mov eax, esp
sub eax, 0x100
jb 0x4017b7
cmp eax, dword [0x417180]
jb 0x4017b7
push ecx
push esi
mov esi, dword [0x4171b4]
add esi, 0x10
cmp word [esi], 0x3b
jne 0x40238e
add esi, 2
test byte [0x4172fc], 0xf0
jne 0x4023d8
cmp byte [esi], 0x1a
jne 0x4023d1
movzx edx, byte [esi + 1]
lea edx, [esi + edx + 2]
cmp word [edx], 0x31a
jne 0x4023d1
mov ebx, 0x417301
movzx eax, byte [edx + 2]
xlatb
ror eax, 8
mov al, byte [edx + 3]
xlatb
ror eax, 8
mov al, byte [edx + 4]
xlatb
ror eax, 0x10
cmp eax, 0x786966
je 0x40274d
call fcn.00402a97
jmp 0x4023dd
call fcn.00402b8e
mov esi, dword [0x4171b4]
add esi, 0x10
mov al, byte [0x4172fc]
test al, 2
jne 0x40291a
test al, 1
jne 0x4028ff
mov dword [0x41723c], esi
lodsb al, byte [esi]
movzx ecx, byte [esi]
inc esi
cmp al, 0x1a
jne 0x4025b5
cmp cl, 3
jb 0x402427
push edi
mov edi, 0x412a6a
call fcn.00402314
pop edi
jb 0x402427
mov byte [edx - 2], 0x3b
jmp eax
xor ch, ch
call fcn.004025c3
jb 0x402443
mov byte [ebx - 2], 0x3b
mov dword [0x4171cc], 0
jmp 0x402d5d
mov dword [0x4171cc], esi
add esi, ecx
lodsb al, byte [esi]
cmp al, 0x3a
je 0x402534
cmp al, 0x1a
jne 0x4025b5
lodsb al, byte [esi]
cmp al, 3
jne 0x402488
mov ebx, 0x417301
movzx eax, byte [esi]
xlatb
ror eax, 8
mov al, byte [esi + 1]
xlatb
ror eax, 8
mov al, byte [esi + 2]
xlatb
ror eax, 0x10
cmp eax, 0x757165
je 0x402758
mov al, 3
mov ch, 1
mov cl, al
call fcn.004025c3
jb 0x4025b5
push edx
push esi
mov esi, dword [0x4171cc]
mov dword [0x4171d0], esi
sub dword [0x4171d0], 2
mov cl, byte [esi - 1]
mov ch, 2
call fcn.004025c3
jb 0x402509
mov ecx, dword [edx + 0xc]
add ecx, 3
lea ebx, [edi + ecx]
mov ecx, edi
sub ecx, dword [0x4171d0]
lea esi, [edi - 1]
lea edi, [ebx - 1]
std
rep movsb byte es:[edi], byte [esi]
cld
mov edi, dword [0x4171d0]
mov esi, dword [edx + 8]
mov ecx, dword [edx + 0xc]
add dword [0x4171cc], ecx
add dword [0x4171cc], 3
call fcn.00402b17
mov al, 0x3a
stosb byte es:[edi], al
mov ax, 0x3b
stosw word es:[edi], ax
mov edi, ebx
pop esi
add esi, dword [edx + 0xc]
add esi, 3
pop edx
jmp 0x402d5d
mov edx, dword [0x4171cc]
movzx eax, byte [edx - 1]
add edx, eax
push edi
lea esi, [edi - 1]
mov ecx, edi
sub ecx, edx
std
rep movsb byte es:[edi], byte [esi]
cld
pop edi
inc edi
mov al, 0x3a
mov byte [edx], al
inc al
mov byte [edx + 1], al
pop esi
pop edx
inc esi
jmp 0x402d5d
dec esi
sub esi, ecx
lea ebp, [esi - 2]
mov ch, 2
call fcn.004025c3
jae 0x40254c
lea esi, [esi + ecx + 1]
jmp 0x4023fb
mov ebx, dword [edx + 8]
mov ecx, dword [edx + 0xc]
add ecx, ebx
cmp ebx, ecx
je 0x402571
cmp byte [ebx], 0x1a
jne 0x402571
movzx eax, byte [ebx + 1]
lea ebx, [ebx + eax + 2]
cmp ebx, ecx
je 0x40257b
cmp byte [ebx], 0x3a
jne 0x402571
inc ebx
jmp 0x402554
push 0x4025c0
jmp 0x402ae8
mov ecx, edi
sub ecx, esi
mov edi, dword [edx + 0xc]
add edi, ebp
push edi
lea eax, [edi + ecx]
push eax
cmp esi, edi
je 0x40259f
jb 0x402593
rep movsb byte es:[edi], byte [esi]
jmp 0x40259f
lea esi, [esi + ecx - 1]
lea edi, [edi + ecx - 1]
std
rep movsb byte es:[edi], byte [esi]
cld
mov ecx, dword [edx + 0xc]
mov edi, dword [esp + 4]
sub edi, ecx
mov esi, dword [edx + 8]
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
inc esi
jmp 0x4023fb
mov esi, dword [0x41723c]
call fcn.00402aa0
pop esi
pop ecx
ret
add edx, 5
add esi, 2
push edx
mov ch, 3
jmp 0x402769
add esi, 3
push esi
call fcn.00402aa0
mov esi, dword [0x4171cc]
mov ch, 2
mov byte [esi - 2], 0x3b
mov cl, byte [esi - 1]
call fcn.0040265a
pop ebx
mov ecx, edi
dec ecx
sub ecx, ebx
mov dword [edx + 8], ebx
mov dword [edx + 0xc], ecx
jmp 0x4025c0
add esi, 2
lodsb al, byte [esi]
or al, al
je 0x4025c0
cmp al, 0x7b
jne 0x401853
or byte [0x4172fc], 2
lodsb al, byte [esi]
cmp al, 0x1a
je 0x402983
cmp al, 0x3b
je 0x402983
cmp al, 0x22
je 0x40298b
or al, al
je 0x4025c0
cmp al, 0x7d
jne 0x40291a
mov al, byte [0x4172fc]
and byte [0x4172fc], 0xf0
test al, 8
jne 0x402e94
cmp byte [esi], 0
je 0x4025c0
mov ecx, edi
sub ecx, esi
mov edx, esi
lea esi, [esi + ecx - 1]
lea edi, [edi + 0x11]
mov ebx, edi
dec edi
std
rep movsb byte es:[edi], byte [esi]
cld
mov edi, edx
xor al, al
stosb byte es:[edi], al
mov esi, dword [0x4171b4]
mov dword [0x4171b4], edi
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
mov edi, ebx
jmp 0x4023dd
movzx eax, byte [esi]
inc esi
add esi, eax
jmp 0x40291a
lodsd eax, dword [esi]
add esi, eax
jmp 0x40291a
push dword [0x417198]
push dword [0x4171c8]
mov dword [0x4171c8], 0
push dword [0x417220]
push dword [edx + 4]
mov dword [edx + 4], 1
push edx
mov ebx, esi
mov esi, dword [edx + 8]
mov eax, dword [edx + 0xc]
mov dword [0x4171b8], eax
mov dword [0x417220], 0
xor ebp, ebp
mov al, byte [esi]
or al, al
je 0x402e66
cmp al, 0x7b
je 0x402e66
inc esi
cmp al, 0x5b
jne 0x402dbd
mov ebp, esi
inc esi
inc dword [0x417220]
call fcn.00402ded
lodsb al, byte [esi]
cmp al, 0x2c
je 0x402dd1
cmp al, 0x5d
je 0x402dd9
dec esi
jmp 0x402e66
cmp byte [ebx], 0x2c
jne 0x402d9d
inc ebx
jmp 0x402d9d
cmp byte [ebx], 0x2c
jne 0x402e66
inc ebx
inc dword [0x417220]
mov esi, ebp
jmp 0x402d9d
cmp byte [ebx], 0
jne 0x40183f
mov eax, dword [esp + 4]
dec eax
call fcn.0040329c
pop edx
pop dword [edx + 4]
pop dword [0x417220]
pop dword [0x4171c8]
pop dword [0x417198]
jmp 0x4025c0
push edi
push dword [0x4171b4]
push esi
mov eax, dword [0x417228]
mov dword [0x4171b4], eax
mov dword [0x4171b8], eax
mov esi, dword [0x4171d4]
cmp byte [0x4172e0], 0x10
jae 0x403109
cmp byte [0x4172e0], 0
jne 0x403000
call fcn.00402fb3
cmp eax, 0
jl 0x4018e9
push dword [0x417198]
push dword [0x4171c8]
mov dword [0x4171c8], 0
push dword [0x417220]
mov dword [0x4171cc], 0
mov dword [0x417220], eax
lodsb al, byte [esi]
or al, al
je 0x402f58
cmp al, 0x7b
je 0x402f58
cmp al, 0x1a
jne 0x40183f
lodsb al, byte [esi]
movzx ecx, al
xor eax, eax
call fcn.00403829
add esi, ecx
xor eax, eax
mov dword [edx + 0xc], eax
inc eax
mov dword [edx + 8], eax
lodsb al, byte [esi]
cmp al, 0x3a
jne 0x402f49
push edx
call fcn.00402fb3
mov edx, eax
add edx, dword [0x417220]
jo 0x4018e9
pop edx
mov dword [edx + 8], eax
lodsb al, byte [esi]
cmp al, 0x2c
jne 0x402f58
lodsb al, byte [esi]
cmp al, 0x1a
jne 0x40183f
jmp 0x402f15
dec esi
cmp dword [0x417220], 0
je 0x402f69
xor eax, eax
call fcn.0040329c
pop dword [0x417220]
pop dword [0x4171c8]
pop dword [0x417198]
pop ebx
pop esi
pop edx
cmp byte [ebx], 0
je 0x4025c0
mov dword [0x4171b4], edi
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
test byte [0x4172fc], 0xf
je 0x402fa3
mov ax, 0x3b
stosw word es:[edi], ax
mov esi, ebx
sub edx, ebx
mov ecx, edx
call fcn.00402b17
jmp 0x4023dd
cmp byte [esi], 0x1a
jne 0x40183f
movzx eax, byte [esi + 1]
lea esi, [esi + eax + 2]
lodsb al, byte [esi]
cmp byte [0x4172e0], 1
ja 0x40303d
cmp al, 0x3d
je 0x40302e
cmp al, 0x2a
jne 0x403024
lodsb al, byte [esi]
cmp al, 0x2c
jne 0x40183f
jmp 0x403057
xor ebp, ebp
or byte [0x4172fd], 0xff
call fcn.00402869
inc esi
cmp al, 0x2c
jne 0x40183f
mov al, byte [esi]
or al, al
je 0x402f7b
cmp al, 0x7b
je 0x402f7b
xor eax, eax
push dword [0x417198]
push dword [0x4171c8]
mov dword [0x4171c8], eax
push dword [0x417220]
mov dword [0x417220], eax
mov dword [0x4171cc], eax
mov ebx, esi
cmp byte [0x4172e0], 1
ja 0x4030b5
mov edx, dword [0x4171d8]
mov al, byte [edx]
push eax
mov byte [edx], 0
inc dword [0x417220]
mov esi, dword [0x4171d4]
inc esi
call fcn.00402ded
cmp byte [ebx], 0x2c
jne 0x4030ab
inc ebx
jmp 0x403091
mov esi, ebx
pop eax
mov byte [esi], al
jmp 0x402f62
mov esi, dword [0x4171d4]
inc esi
lodsb al, byte [esi]
movzx ecx, al
inc dword [0x417220]
mov eax, dword [0x417220]
call fcn.00403829
mov dword [edx + 0xc], ebx
cmp byte [ebx], 0x1a
je 0x4030ec
cmp byte [ebx], 0x22
je 0x4030e4
mov eax, 1
jmp 0x4030f3
mov eax, dword [ebx + 1]
add eax, 5
jmp 0x4030f3
movzx eax, byte [ebx + 1]
add eax, 2
mov dword [edx + 8], eax
add ebx, eax
cmp byte [ebx], 0
je 0x403102
cmp byte [ebx], 0x7b
jne 0x4030b5
mov esi, ebx
jmp 0x402f62
mov ebx, esi
call fcn.00402a27
call fcn.004031dc
mov edx, edi
mov al, byte [ebx]
cmp al, 0x1a
je 0x403136
cmp al, 0x2c
jne 0x402f7b
cmp esi, dword [0x4171d8]
je 0x403248
jmp 0x402f7b
add edx, 0xc
cmp edx, dword [0x417174]
ja 0x4017ad
mov dword [edx - 0xc], ebx
mov dword [edx - 8], esi
call fcn.004031b2
jb 0x403188
mov dword [edx - 4], esi
movzx eax, byte [ebx + 1]
lea ebx, [ebx + eax + 2]
cmp byte [ebx], 0x1a
je 0x403136
call fcn.004031dc
cmp esi, dword [0x4171d8]
je 0x40323f
cmp byte [ebx], 0x1a
je 0x403136
mov ebx, dword [edx - 0xc]
movzx eax, byte [ebx + 1]
lea ebx, [ebx + eax + 2]
mov esi, dword [edx - 4]
jmp 0x4031a6
sub edx, 0xc
cmp edx, edi
je 0x402f7b
mov ebx, dword [edx - 0xc]
movzx eax, byte [ebx + 1]
lea ebx, [ebx + eax + 2]
cmp byte [ebx], 0x1a
je 0x403188
mov esi, dword [edx - 4]
call fcn.004031b2
jb 0x403188
mov dword [edx - 4], esi
jmp 0x403162
cmp byte [ebx], 0x2c
jne 0x402f7b
xor eax, eax
push dword [0x417198]
push dword [0x4171c8]
mov dword [0x4171c8], eax
push dword [0x417220]
mov dword [0x417220], eax
mov dword [0x4171cc], eax
push esi
push edi
push edx
cmp edi, dword [esp]
je 0x403294
mov esi, dword [edi]
inc esi
lodsb al, byte [esi]
movzx ecx, al
xor eax, eax
call fcn.00403829
mov eax, dword [edi + 4]
mov dword [edx + 0xc], eax
mov ecx, dword [edi + 8]
sub ecx, eax
mov dword [edx + 8], ecx
add edi, 0xc
jmp 0x40326e
pop edx
pop edi
pop esi
jmp 0x402f62