Function at 0x40329c
Capabilities:
Query environment variable
Terminate process

Disassembly:
push dword [0x4172fc]
or byte [0x4172fc], 0x10
push dword [0x41721c]
push dword [0x4171bc]
push dword [0x4171c0]
push dword [0x4171c4]
push dword [0x4171d0]
push dword [0x4171cc]
push eax
push dword [0x4171b4]
lodsb al, byte [esi]
cmp al, 0x7b
je 0x403302
or al, al
jne 0x401853
mov dword [0x4171b8], esi
add esi, 0x12
lodsb al, byte [esi]
or al, al
je 0x4032e1
cmp al, 0x7b
je 0x403302
cmp al, 0x3b
jne 0x401853
call fcn.004035ca
jmp 0x4032e1
mov ecx, 0x80000000
mov dword [0x4171bc], esi
mov eax, dword [0x4171b8]
mov dword [0x4171c0], eax
mov dword [0x4171c4], ecx
xor eax, eax
mov dword [0x41721c], eax
cmp dword [0x417220], eax
je 0x403332
inc dword [0x41721c]
lodsb al, byte [esi]
or al, al
je 0x4035fd
cmp al, 0x7d
je 0x40360c
dec esi
mov dword [0x4171b4], edi
lea eax, [edi + 0x10]
cmp eax, dword [0x417174]
jae 0x4017ad
mov eax, dword [esp + 4]
or eax, eax
je 0x403371
stosd dword es:[edi], eax
mov eax, ecx
stosd dword es:[edi], eax
mov eax, dword [esp]
stosd dword es:[edi], eax
mov eax, dword [0x4171b8]
stosd dword es:[edi], eax
jmp 0x403384
mov eax, dword [0x4171b8]
add eax, 0x11
stosd dword es:[edi], eax
mov eax, ecx
stosd dword es:[edi], eax
mov eax, dword [0x4171b8]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
or byte [0x4172fc], 0x20
push ebx
push ecx
test byte [0x4172fc], 0xf
je 0x40339c
mov ax, 0x3b
stosw word es:[edi], ax
lea eax, [edi + 0x100]
cmp eax, dword [0x417174]
jae 0x4017ad
lodsb al, byte [esi]
cmp al, 0x7d
je 0x4035ec
or al, al
je 0x4035ec
cmp al, 0x1a
je 0x4033e3
cmp al, 0x3b
je 0x4035e7
and byte [0x4172fc], 0xdf
stosb byte es:[edi], al
cmp al, 0x22
jne 0x40339c
mov ecx, dword [esi]
add ecx, 4
call fcn.00402b17
jmp 0x40339c
push esi
push edi
test byte [0x4172fc], 0x20
je 0x40340d
movzx ecx, byte [esi]
inc esi
mov edi, 0x412ac6
call fcn.00402314
jae 0x403401
dec esi
jmp 0x40340d
mov edx, eax
pop edi
pop eax
mov byte [edi], 0
inc edi
pop ecx
pop ebx
jmp edx
and byte [0x4172fc], 0xdf
movzx ecx, byte [esi]
inc esi
mov eax, dword [0x41721c]
call fcn.004037dc
jae 0x403459
xor eax, eax
cmp dword [0x41721c], eax
je 0x40347a
call fcn.004037dc
jb 0x40354a
pop edi
pop eax
mov ecx, dword [edx + 8]
mov edx, dword [edx + 0xc]
or edx, edx
je 0x4034c3
and ecx, 0x7fffffff
xchg edx, esi
call fcn.00402b17
mov esi, edx
jmp 0x40339c
xor eax, eax
cmp dword [0x41721c], eax
je 0x403439
push esi
push edx
sub esi, ecx
call fcn.004037dc
mov ebx, edx
pop edx
pop esi
jb 0x403439
cmp edx, ebx
ja 0x403439
mov edx, ebx
jmp 0x403439
inc eax
push eax
call fcn.004037dc
pop eax
jb 0x40354a
pop edi
push ecx
mov ecx, dword [edx + 8]
mov edx, dword [edx + 0xc]
xchg edx, esi
btr ecx, 0x1f
jb 0x40349c
rep movsb byte es:[edi], byte [esi]
jmp 0x4034a6
mov byte [edi], 0x3c
inc edi
rep movsb byte es:[edi], byte [esi]
mov byte [edi], 0x3e
inc edi
cmp eax, dword [0x417220]
je 0x4034ba
mov byte [edi], 0x2c
inc edi
mov esi, edx
pop ecx
push edi
sub esi, ecx
jmp 0x40347a
pop ecx
pop eax
mov esi, edx
jmp 0x40339c
mov eax, dword [0x41721c]
and eax, 0x7fffffff
je 0x4034dc
add ecx, eax
dec ecx
call fcn.004034fe
jmp 0x40339c
mov edx, ecx
xor ecx, ecx
push ecx
push edx
add ecx, edx
call fcn.004034fe
pop edx
pop ecx
inc ecx
cmp ecx, dword [0x417220]
je 0x40339c
mov byte [edi], 0x2c
inc edi
jmp 0x4034e0
pop edi
pop esi
mov al, 0x1a
stosb byte es:[edi], al
mov al, byte [esi]
inc esi
stosb byte es:[edi], al
cmp byte [esi], 0x2e
jne 0x403577
mov ebx, dword [esp + 0x10]
or ebx, ebx
je 0x403577
cmp al, 1
je 0x403581
xchg ebx, esi
movzx ecx, byte [esi - 1]
add byte [edi - 1], cl
jb 0x401994
rep movsb byte es:[edi], byte [esi]
xchg ebx, esi
movzx ecx, al
rep movsb byte es:[edi], byte [esi]
jmp 0x40339c
inc esi
xchg ebx, esi
movzx ecx, byte [esi - 1]
mov byte [edi - 1], cl
rep movsb byte es:[edi], byte [esi]
xchg ebx, esi
mov eax, dword [esp + 0x14]
cmp byte [eax], 0x3b
je 0x40339c
cmp byte [eax], 0x1a
jne 0x4035a9
mov byte [eax], 0x3b
jmp 0x40339c
mov ebx, dword [esp + 0x10]
push esi
push edi
lea edi, [ebx - 3]
lea esi, [edi - 2]
lea ecx, [esi + 1]
sub ecx, eax
std
rep movsb byte es:[edi], byte [esi]
cld
mov word [eax], 0x3b
pop edi
pop esi
jmp 0x40339c
call fcn.004035ca
mov byte [edi], 0
inc edi
push eax
call fcn.00402361
pop eax
pop ecx
pop ebx
cmp al, 0x7d
je 0x40360c
inc ecx
mov dword [0x4171b8], esi
add esi, 0x12
jmp 0x403332
call fcn.00403790
jb 0x403332
pop dword [0x4171b4]
add esp, 0xc
pop dword [0x4171c4]
pop dword [0x4171c0]
pop dword [0x4171bc]
pop dword [0x41721c]
pop eax
and al, 0xf0
and byte [0x4172fc], 0xf
or byte [0x4172fc], al
ret