Function at 0x405807
Capabilities:
Query environment variable

Disassembly:
push ebx
mov edx, 0xb
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x40580d
call fcn.0042f040
push dword [esp + 0x3c]
call fcn.004176d0
mov edx, dword [esp + 0x34]
lea ecx, [esp]
call fcn.00417000
push edx
call fcn.0042eed0
pop edx
push eax
push edx
call fcn.0042eed0
pop edx
push eax
push 0x1f4
call fcn.0042c710
lea eax, [esp + 8]
push eax
call fcn.0042ef70
push 0x1f4
mov eax, dword [esp + 8]
push eax
mov eax, str.WINDIR
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
mov ebx, dword [esp + 0x38]
and ebx, ebx
jle 0x405916
push edx
call fcn.0042eed0
pop edx
push eax
push 0x2e
mov edx, dword [esp + 0xc]
push edx
call fcn.0042eed0
pop edx
push eax
push edx
call fcn.0042ef10
mov edx, str.System32
push edx
call fcn.0042ef10
call fcn.0042f100
push edx
call fcn.0042eed0
pop edx
push eax
mov edx, str.__c_wmic
push edx
call fcn.0042ef10
mov edx, dword [esp + 0x10]
push edx
call fcn.0042ef10
call fcn.0042f100
mov edx, dword [0x8eed68]
push edx
call fcn.0042eed0
pop edx
push eax
push edx
call fcn.0042ef10
mov edx, 0x47f7bc
push edx
call fcn.0042ef10
call fcn.004176b2
add dword [esp], edx
call fcn.004176b2
add dword [esp + 4], edx
call fcn.004176b2
add dword [esp + 8], edx
call fcn.00418fa4
call fcn.004176d0
mov dword [esp + 8], eax
jmp 0x4059b9
push edx
call fcn.0042eed0
pop edx
push eax
push 0x2e
mov edx, dword [esp + 0xc]
push edx
call fcn.0042eed0
pop edx
push eax
push edx
call fcn.0042ef10
mov edx, str.System32
push edx
call fcn.0042ef10
call fcn.0042f100
push edx
call fcn.0042eed0
pop edx
push eax
mov edx, str.__c_wmic
push edx
call fcn.0042ef10
mov edx, dword [esp + 0x10]
push edx
call fcn.0042ef10
mov edx, str.__FORMAT:List
push edx
call fcn.0042ef10
call fcn.0042f100
mov edx, dword [0x8eed68]
push edx
call fcn.0042eed0
pop edx
push eax
push edx
call fcn.0042ef10
mov edx, 0x47f7bc
push edx
call fcn.0042ef10
call fcn.004176b2
add dword [esp], edx
call fcn.004176b2
add dword [esp + 4], edx
call fcn.004176b2
add dword [esp + 8], edx
call fcn.00418fa4
call fcn.004176d0
mov dword [esp + 8], eax
mov edx, 0x47b028
lea ecx, [esp + 0xc]
call fcn.00417008
cmp dword [esp + 8], 0
je 0x405cbf
push 0x9c40
call fcn.0042dd40
mov dword [esp + 0x10], eax
push dword [esp + 8]
call fcn.00419509
and eax, eax
je 0x405c93
push dword [esp + 8]
call fcn.00419550
mov dword [esp + 0x14], eax
cmp dword [esp + 0x14], 0
je 0x405c5e
push dword [esp + 0x14]
push dword [esp + 0x14]
push dword [esp + 0x10]
call fcn.00419576
mov dword [esp + 0x14], eax
cmp dword [esp + 0x14], 0
je 0x405c5e
push edx
call fcn.0042eed0
pop edx
push eax
push edx
call fcn.0042eed0
pop edx
push eax
push 0x18
push dword [esp + 0x20]
push dword [esp + 0x20]
call fcn.0042df40
lea eax, [esp + 0x1c]
push eax
call fcn.0042ef70
push dword [esp + 0x18]
call fcn.0042cc60
mov ebx, eax
add ebx, 4
push ebx
call fcn.0042dd40
mov dword [esp + 0x1c], eax
push dword [esp + 0x18]
call fcn.0042cc60
mov ebx, eax
add ebx, 4
push ebx
call fcn.0042dd40
mov dword [esp + 0x20], eax
push 0x18
push 0xffffffff
push dword [esp + 0x20]
push dword [esp + 0x28]
call fcn.0042dd60
push dword [esp + 0x20]
push dword [esp + 0x20]
call sub.USER32.dll_OemToCharW
mov dword [esp + 0x24], 0
jmp 0x405ab3
push dword [esp + 0x18]
call fcn.0042cc60
mov ebx, eax
add ebx, 4
cmp ebx, dword [esp + 0x24]
jl 0x405bf8
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
push ebx
call fcn.0042deb0
mov ebx, eax
cmp ebx, 0x6a
jne 0x405afd
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
inc ebx
push ebx
call fcn.0042deb0
mov ebx, eax
cmp ebx, 0x26
jne 0x405afd
mov eax, 1
jmp 0x405aff
xor eax, eax
and eax, eax
je 0x405b2a
push 0xd
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
push ebx
call fcn.0042dec0
push 0
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
inc ebx
push ebx
call fcn.0042dec0
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
push ebx
call fcn.0042deb0
mov ebx, eax
cmp ebx, 0xd9
jne 0x405b5f
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
inc ebx
push ebx
call fcn.0042deb0
mov ebx, eax
cmp ebx, 0x25
jne 0x405b5f
mov eax, 1
jmp 0x405b61
xor eax, eax
and eax, eax
je 0x405b8c
push 0xa
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
push ebx
call fcn.0042dec0
push 0
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
inc ebx
push ebx
call fcn.0042dec0
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
push ebx
call fcn.0042deb0
mov ebx, eax
cmp ebx, 0xcb
jne 0x405bc1
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
inc ebx
push ebx
call fcn.0042deb0
mov ebx, eax
cmp ebx, 0x25
jne 0x405bc1
mov eax, 1
jmp 0x405bc3
xor eax, eax
and eax, eax
je 0x405bee
push 9
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
push ebx
call fcn.0042dec0
push 0
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
inc ebx
push ebx
call fcn.0042dec0
inc dword [esp + 0x24]
jno 0x405ab3
push edx
call fcn.0042eed0
pop edx
push eax
push edx
call fcn.0042eed0
pop edx
push eax
push dword [esp + 0x28]
call fcn.0042ded0
lea eax, [esp + 0x1c]
push eax
call fcn.0042ef70
push dword [esp + 0x1c]
call fcn.0042df20
push dword [esp + 0x20]
call fcn.0042df20
mov edx, dword [esp + 0xc]
push edx
call fcn.0042eed0
pop edx
push eax
push edx
call fcn.0042ef10
mov edx, dword [esp + 0x1c]
push edx
call fcn.0042ef10
mov edx, 0x4800f2
push edx
call fcn.0042ef10
lea eax, [esp + 0x10]
push eax
call fcn.0042ef70
push dword [0x8eed44]
call fcn.004204f3
and eax, eax
je 0x405c8e
call fcn.004200ea
and eax, eax
je 0x405c78
jmp 0x405c6d
call fcn.004200ea
and eax, eax
je 0x405c83
jmp 0x405c78
call fcn.004200ea
and eax, eax
je 0x405c8e
jmp 0x405c83
jmp 0x4059e0
push dword [esp + 0x10]
call fcn.0042df20
push dword [esp + 8]
call fcn.004195d0
and eax, eax
je 0x405cbf
push dword [esp + 8]
call fcn.00419607
mov dword [esp + 0x28], eax
push dword [esp + 8]
call fcn.00419627
mov ebx, dword [esp + 0x38]
and ebx, ebx
jle 0x405cf7
push edx
call fcn.0042eed0
pop edx
push eax
push edx
call fcn.0042eed0
pop edx
push eax
mov eax, dword [esp + 0x30]
cdq
push edx
push eax
call fcn.0042cc90
pop eax
push eax
call fcn.004176a0
pop edx
add eax, edx
jmp 0x405dec
push edx
call fcn.0042eed0
pop edx
push eax
push edx
call fcn.0042eed0
pop edx
push eax
mov eax, 0x47b186
push eax
push dword [esp + 0x18]
call fcn.0042d2a0
lea eax, [esp + 0x10]
push eax
call fcn.0042ef70
push edx
call fcn.0042eed0
pop edx
push eax
push edx
call fcn.0042eed0
pop edx
push eax
mov eax, 0x47b152
push eax
mov eax, 0x47ef44
push eax
push dword [esp + 0x1c]
call fcn.0042d600
lea eax, [esp + 0x10]
push eax
call fcn.0042ef70
mov eax, 0x47ef44
push eax
push dword [esp + 0x10]
call fcn.0042c820
mov ebx, eax
and ebx, ebx
jne 0x405d20
push edx
call fcn.0042eed0
pop edx
push eax
push edx
call fcn.0042eed0
pop edx
push eax
push 1
push dword [esp + 0x18]
call fcn.0042d620
call fcn.0042f100
mov edx, 0x47b152
pop ecx
push ecx
call fcn.004176e0
mov ecx, eax
call fcn.00417660
je 0x405dc4
push edx
call fcn.0042eed0
pop edx
push eax
push edx
call fcn.0042eed0
pop edx
push eax
push 2
push dword [esp + 0x18]
call fcn.0042c8d0
lea eax, [esp + 0x10]
push eax
call fcn.0042ef70
mov edx, dword [esp + 0xc]
push edx
call fcn.0042eed0
pop edx
push eax
push edx
call fcn.0042ef10
pop eax
push eax
call fcn.004176a0
pop edx
add eax, edx
jmp 0x405dec
push dword [esp + 0xc]
call fcn.0042f0d0
push dword [esp]
call fcn.0042f0d0
push dword [esp + 4]
call fcn.0042f0d0
push dword [esp + 0x18]
call fcn.0042f0d0
add esp, 0x2c
pop ebx
ret 8