Function at 0x404330
Capabilities:
Query environment variable

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0xc
mov edx, dword [esp + 0x28]
mov dword [esp], edx
call sub.msvcrt.dll_getenv
test eax, eax
mov ebx, eax
je 0x404382
lea esi, [esi]
movsx edx, byte [ebx]
mov ecx, dword [sym.imp.msvcrt.dll___mb_cur_max]
cmp dword [ecx], 1
je 0x404624
mov dword [esp + 4], 8
mov dword [esp], edx
call sub.msvcrt.dll__isctype
test eax, eax
je 0x404379
inc ebx
jmp 0x404350
test ebx, ebx
je 0x404382
cmp byte [ebx], 0
jne 0x4043ca
mov edx, dword [esp + 0x2c]
mov dword [esp], edx
call sub.msvcrt.dll_getenv
test eax, eax
mov ebx, eax
je 0x4043d3
lea esi, [esi]
lea edi, [edi]
movsx edx, byte [ebx]
mov ebp, dword [sym.imp.msvcrt.dll___mb_cur_max]
cmp dword [ebp], 1
je 0x404610
mov dword [esp + 4], 8
mov dword [esp], edx
call sub.msvcrt.dll__isctype
test eax, eax
je 0x4043ca
inc ebx
jmp 0x4043a0
test ebx, ebx
je 0x4043d3
cmp byte [ebx], 0
jne 0x4043dd
xor eax, eax
add esp, 0xc
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
inc eax
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov esi, eax
test esi, esi
mov eax, 4
je 0x4043d5
call fcn.0041d760
test eax, eax
je 0x4045f5
mov dword [esp + 4], ebx
mov dword [esp], esi
call sub.msvcrt.dll_strcpy
mov dword [esp], esi
call fcn.00404640
mov ecx, dword [esp + 0x20]
mov ebp, eax
mov edi, dword [ecx]
add eax, edi
lea ebx, [eax*4 + 4]
mov dword [esp], ebx
call sub.msvcrt.dll_malloc
test eax, eax
mov edi, eax
je 0x4045e3
mov dword [esp + 8], eax
mov ebx, dword [esp + 0x24]
mov ecx, dword [ebx]
mov eax, dword [ecx]
add ecx, 4
mov dword [ebx], ecx
mov dword [edi], eax
add edi, 4
cmp byte [esi], 0x22
je 0x404594
mov dword [edi], esi
add edi, 4
jmp 0x404470
movsx ebx, byte [esi]
test ebx, ebx
je 0x4044c0
mov ecx, dword [sym.imp.msvcrt.dll___mb_cur_max]
cmp dword [ecx], 1
je 0x404580
mov dword [esp + 4], 8
mov dword [esp], ebx
call sub.msvcrt.dll__isctype
test eax, eax
jne 0x4044b2
mov edx, dword [sym.imp.msvcrt.dll___mb_cur_max]
mov ecx, dword [edx]
mov dword [esp], esi
mov dword [esp + 4], ecx
call sub.msvcrt.dll_mblen
add esi, eax
jmp 0x404470
test ebx, ebx
je 0x4044c0
mov byte [esi], 0
inc esi
lea esi, [esi]
movzx eax, byte [esi]
movsx ebx, al
test ebx, ebx
je 0x40450d
mov ecx, dword [sym.imp.msvcrt.dll___mb_cur_max]
cmp dword [ecx], 1
je 0x404568
mov dword [esp + 4], 8
mov dword [esp], ebx
call sub.msvcrt.dll__isctype
test eax, eax
je 0x404505
mov edx, dword [sym.imp.msvcrt.dll___mb_cur_max]
mov ebx, dword [edx]
mov dword [esp], esi
mov dword [esp + 4], ebx
call sub.msvcrt.dll_mblen
add esi, eax
jmp 0x4044c0
test ebx, ebx
jne 0x404453
mov esi, dword [esp + 0x20]
mov eax, dword [esi]
add ebp, eax
dec eax
test eax, eax
mov dword [esi], eax
je 0x40454d
mov ebx, dword [esp + 0x24]
mov edx, eax
mov ecx, dword [ebx]
lea esi, [esi]
lea edi, [edi]
mov esi, dword [ecx]
add ecx, 4
mov dword [edi], esi
add edi, 4
dec edx
jne 0x404530
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
mov dword [edx], 0
mov dword [eax], ecx
mov dword [edi], 0
mov ecx, dword [esp + 8]
mov ebx, dword [esp + 0x24]
mov edi, dword [esp + 0x20]
mov dword [ebx], ecx
mov dword [edi], ebp
jmp 0x4043d3
mov ecx, dword [sym.imp.msvcrt.dll__pctype]
mov edx, dword [ecx]
movzx eax, word [edx + ebx*2]
and eax, 8
jmp 0x4044e9
mov ecx, dword [sym.imp.msvcrt.dll__pctype]
mov edx, dword [ecx]
movzx eax, word [edx + ebx*2]
and eax, 8
jmp 0x404496
inc esi
mov dword [edi], esi
add edi, 4
movzx eax, byte [esi]
movsx ebx, al
test ebx, ebx
je 0x40450d
cmp ebx, 0x22
je 0x4045d6
mov ebx, dword [sym.imp.msvcrt.dll___mb_cur_max]
mov edx, dword [ebx]
mov dword [esp], esi
mov dword [esp + 4], edx
call sub.msvcrt.dll_mblen
add esi, eax
movzx eax, byte [esi]
movsx ebx, al
test ebx, ebx
je 0x40450d
cmp ebx, 0x22
jne 0x4045ad
test ebx, ebx
je 0x4044c3
jmp 0x4044b6
mov dword [esp], esi
call sub.msvcrt.dll_free
mov eax, 4
jmp 0x4043d5
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.USER32.dll_OemToCharA
sub esp, 8
jmp 0x404412
mov esi, dword [sym.imp.msvcrt.dll__pctype]
mov ecx, dword [esi]
movzx eax, word [ecx + edx*2]
and eax, 8
jmp 0x4043c3
mov edi, dword [sym.imp.msvcrt.dll__pctype]
mov esi, dword [edi]
movzx eax, word [esi + edx*2]
and eax, 8
jmp 0x404372