Function at 0x404921
Capabilities:
Get comspec environment variable
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov ebx, dword [eax + 0x18c]
lea esi, [eax + 4]
push str.SERVER_NAME
and dword [edi + 0x2108], 0
and dword [edi + 0x2104], 0
add ebx, 0x28
mov dword [edi], esi
call dword [sym.imp.MSVCRT.dll_getenv]
test eax, eax
pop ecx
jne 0x40495c
lea eax, [esi + 0x40]
push eax
push str.SERVER_NAME_s
push edi
call fcn.00404c4e
add esp, 0xc
push dword [ebx + 0x18]
push str.SERVER_ROOT_s
push edi
call fcn.00404c4e
push dword [ebx + 0x18]
push str.DOCUMENT_ROOT_s
push edi
call fcn.00404c4e
push 0x41f0ec
push 0x41f0e0
push str.SERVER_SOFTWARE_s__s
push edi
call fcn.00404c4e
mov ebx, 0x41e778
push str.GATEWAY_INTERFACECGI_1.1
push ebx
push edi
call fcn.00404c4e
push str.SERVER_PROTOCOLHTTP_1.1
push ebx
push edi
call fcn.00404c4e
add esp, 0x40
push str.REDIRECT_STATUS200
push ebx
push edi
call fcn.00404c4e
push dword [esi]
push str.REQUEST_METHOD_s
push edi
call fcn.00404c4e
lea eax, [esi + 0x10]
push eax
push str.REMOTE_ADDR_s
push edi
call fcn.00404c4e
movzx eax, word [esi + 0x70]
push eax
push str.REMOTE_PORT_d
push edi
call fcn.00404c4e
mov eax, dword [esi + 0xc]
add esp, 0x30
mov ecx, 0x420968
test eax, eax
mov edx, ecx
je 0x404a07
mov edx, eax
test eax, eax
je 0x404a10
mov ecx, 0x41f044
push edx
push ecx
push dword [esi + 4]
push str.REQUEST_URI_s_s_s
push edi
call fcn.00404c4e
mov eax, dword [ebp + 8]
add esp, 0x14
mov eax, dword [eax + 0x198]
test eax, eax
je 0x404a6c
push dword [esi + 4]
push eax
call sub.MSVCRT.dll_strlen
push dword [esi + 4]
mov ebx, eax
call sub.MSVCRT.dll_strlen
pop ecx
sub eax, ebx
pop ecx
push eax
push str.SCRIPT_NAME_.s
push edi
call fcn.00404c4e
mov eax, dword [ebp + 8]
push dword [eax + 0x198]
push str.PATH_INFO_s
push edi
call fcn.00404c4e
add esp, 0x1c
jmp 0x404aaa
mov ebx, dword [sym.imp.MSVCRT.dll_strrchr]
push 0x2f
push dword [ebp + 0xc]
call ebx
push 0x2f
mov dword [ebp + 0x10], eax
push dword [esi + 4]
call ebx
mov ecx, dword [ebp + 0x10]
add esp, 0x10
test ecx, ecx
jne 0x404a90
mov ecx, dword [ebp + 0xc]
test eax, eax
je 0x404a97
sub eax, dword [esi + 4]
push ecx
push dword [esi + 4]
push eax
push str.SCRIPT_NAME_.s_s
push edi
call fcn.00404c4e
add esp, 0x14
push dword [ebp + 0xc]
push str.SCRIPT_FILENAME_s
push edi
call fcn.00404c4e
push dword [ebp + 0xc]
push str.PATH_TRANSLATED_s
push edi
call fcn.00404c4e
mov eax, dword [ebp + 8]
xor ebx, ebx
add esp, 0x18
mov eax, dword [eax]
cmp dword [eax + 0x3c], ebx
mov eax, 0x41efcc
jne 0x404adf
mov eax, 0x41efc8
push eax
push str.HTTPS_s
push edi
call fcn.00404c4e
push str.Content_Type
push esi
call fcn.004022fe
add esp, 0x14
cmp eax, ebx
je 0x404b0c
push eax
push str.CONTENT_TYPE_s
push edi
call fcn.00404c4e
add esp, 0xc
mov eax, dword [esi + 0xc]
cmp eax, ebx
je 0x404b22
push eax
push str.QUERY_STRING_s
push edi
call fcn.00404c4e
add esp, 0xc
push str.Content_Length
push esi
call fcn.004022fe
pop ecx
cmp eax, ebx
pop ecx
je 0x404b42
push eax
push str.CONTENT_LENGTH_s
push edi
call fcn.00404c4e
add esp, 0xc
push str.PATH
push edi
call fcn.00404cab
push 0x41ef5c
push edi
call fcn.00404cab
push str.TEMP
push edi
call fcn.00404cab
push str.TMPDIR
push edi
call fcn.00404cab
push str.PERLLIB
push edi
call fcn.00404cab
push str.MONGOOSE_CGI
push edi
call fcn.00404cab
push str.COMSPEC
push edi
call fcn.00404cab
push str.SYSTEMROOT
push edi
call fcn.00404cab
add esp, 0x40
push str.SystemDrive
push edi
call fcn.00404cab
push str.ProgramFiles
push edi
call fcn.00404cab
push str.ProgramFiles_x86_
push edi
call fcn.00404cab
push str.CommonProgramFiles_x86_
push edi
call fcn.00404cab
add esp, 0x20
cmp dword [esi + 0x74], ebx
mov dword [ebp + 8], ebx
jle 0x404c24
lea eax, [esi + 0x78]
mov dword [ebp + 0xc], eax
jmp 0x404bdf
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
push dword [eax]
push str.HTTP__s_s
push edi
call fcn.00404c4e
add esp, 0x10
mov ebx, eax
mov al, byte [ebx]
cmp al, 0x3d
je 0x404c15
test al, al
je 0x404c15
cmp al, 0x2d
jne 0x404c05
mov byte [ebx], 0x5f
movzx eax, byte [ebx]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
mov byte [ebx], al
pop ecx
inc ebx
jmp 0x404bf4
inc dword [ebp + 8]
add dword [ebp + 0xc], 8
mov eax, dword [ebp + 8]
cmp eax, dword [esi + 0x74]
jl 0x404bdc
mov eax, dword [edi + 0x2108]
and dword [edi + eax*4 + 0x2004], 0
mov eax, dword [edi + 0x2104]
inc dword [edi + 0x2108]
and byte [eax + edi + 4], 0
inc dword [edi + 0x2104]
pop edi
pop esi
pop ebx
pop ebp
ret