Function at 0x41d3a0
Capabilities:
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov edi, dword [esp + 0x2c]
mov dword [esp + 4], 0
lea eax, [edi + 2]
lea esi, [edi + 4]
lea ecx, [esp + 4]
push esi
push eax
push edi
push ecx
push str.e__d_rgb:_hx__hx__hxe_
push str.e_10__e_
call fcn.004742e0
add esp, 0x18
test eax, eax
jne 0x41d474
cmp dword [esp + 4], 0xa
jne 0x41d474
movzx edx, word [edi]
movzx eax, word [edi + 2]
cmp edx, 0x101
jb 0x41d414
movzx ecx, word [esi]
movzx edx, dx
shr edx, 8
mov word [edi], dx
shr eax, 8
mov word [edi + 2], ax
movzx eax, cx
shr eax, 8
mov word [edi + 4], ax
jmp 0x41d429
movzx ecx, word [esi]
cmp eax, 0x100
ja 0x41d3f8
movzx esi, cx
cmp esi, 0x101
jae 0x41d3f8
lea esi, [edi + 8]
lea ebp, [edi + 0xa]
lea ebx, [edi + 0xc]
push ebx
push ebp
push esi
lea eax, [esp + 0x10]
push eax
push str.e__d_rgb:_hx__hx__hxe_
push str.e_11__e_
call fcn.004742e0
add esp, 0x18
test eax, eax
jne 0x41d474
cmp dword [esp + 4], 0xb
jne 0x41d474
movzx eax, word [esi]
movzx ecx, word [ebp]
movzx edx, cx
cmp eax, 0x101
jb 0x41d4f2
movzx ecx, word [ebx]
jmp 0x41d50f
push str.COLORFGBG
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
add esp, 4
test eax, eax
je 0x41d4eb
mov edi, eax
mov ebp, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isspace]
mov esi, eax
nop
movsx ebx, byte [esi]
push ebx
call ebp
add esp, 4
inc esi
test eax, eax
jne 0x41d490
test bl, bl
je 0x41d4eb
sub esp, 0x10
lea eax, [esp + 0x20]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x24]
mov dword [esp + 8], eax
mov dword [esp], edi
call fcn.0041d610
add esp, 0x10
cmp eax, 2
jne 0x41d4eb
mov eax, dword [esp + 0x14]
lea ecx, [eax - 1]
cmp ecx, 0xe
ja 0x41d541
movzx edi, word [eax + eax + 0x4ab95c]
movzx ecx, word [eax + eax + 0x4ab97a]
movzx edx, word [eax + eax + 0x4ab998]
jmp 0x41d547
xor eax, eax
jmp 0x41d602
mov dword [esp], ecx
movzx ecx, word [ebx]
cmp edx, 0x100
ja 0x41d50f
movzx edi, cx
cmp edi, 0x101
mov edi, dword [esp + 0x2c]
jb 0x41d52b
movzx eax, ax
shr eax, 8
mov word [esi], ax
shr edx, 8
mov word [ebp], dx
movzx ecx, cx
shr ecx, 8
mov word [ebx], cx
mov dword [esp], edx
movzx ebp, word [edi]
movzx esi, word [edi + 2]
movzx edx, word [edi + 4]
mov ebx, edi
mov edi, edx
mov edx, ebp
mov ebp, dword [esp]
jmp 0x41d5b4
xor edi, edi
xor ecx, ecx
xor edx, edx
mov esi, dword [esp + 0x2c]
movzx eax, di
mov dword [esp + 0xc], ecx
shl ecx, 0x10
mov dword [esp + 8], edx
movzx edx, dx
or edx, ecx
mov dword [esi + 4], eax
mov dword [esi], edx
mov eax, dword [esp + 0x10]
lea ecx, [eax - 1]
cmp ecx, 0xe
mov dword [esp], edi
ja 0x41d58c
movzx ecx, word [eax + eax + 0x4ab95c]
movzx ebp, word [eax + eax + 0x4ab97a]
movzx eax, word [eax + eax + 0x4ab998]
jmp 0x41d592
xor ecx, ecx
xor ebp, ebp
xor eax, eax
movzx edx, cx
mov edi, ebp
shl edi, 0x10
movzx esi, ax
or esi, edi
mov ebx, dword [esp + 0x2c]
mov dword [ebx + 0xc], edx
mov dword [ebx + 8], esi
mov edi, dword [esp]
mov esi, dword [esp + 0xc]
mov edx, dword [esp + 8]
movzx edx, dx
imul edx, edx, 0x12b
movzx esi, si
imul esi, esi, 0x24b
movzx edi, di
imul edi, edi, 0x72
add edi, esi
add edi, edx
cmp edi, 0x1f400
setb byte [ebx + 6]
movzx eax, ax
imul eax, eax, 0x12b
movzx edx, bp
imul edx, edx, 0x24b
movzx ecx, cx
imul ecx, ecx, 0x72
add ecx, edx
add ecx, eax
cmp ecx, 0x1f400
setb byte [ebx + 0xe]
mov al, 1
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret