Function at 0x404c18
Capabilities:
Query environment variable

Disassembly:
push ebx
mov edx, 0xb
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x404c1e
call fcn.00420660
push dword [esp + 0x3c]
call fcn.0040e240
mov edx, dword [esp + 0x34]
lea ecx, [esp]
call fcn.0040e000
push edx
call fcn.004204c0
pop edx
push eax
push edx
call fcn.004204c0
pop edx
push eax
push 0x1f4
call fcn.0041e310
lea eax, [esp + 8]
push eax
call fcn.00420500
push 0x1f4
mov eax, dword [esp + 8]
push eax
mov eax, str.WINDIR
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
mov ebx, dword [esp + 0x38]
and ebx, ebx
jle 0x404cd8
push edx
call fcn.004204c0
pop edx
push eax
push 0x2e
mov edx, dword [esp + 0xc]
push edx
call fcn.004204c0
pop edx
push eax
push edx
call fcn.00420590
mov edx, str.System32
push edx
call fcn.00420590
call fcn.004205f0
push dword [esp + 0xc]
mov eax, str.wmic.exe
push eax
call fcn.0040e222
add dword [esp + 8], edx
call fcn.0040eb7a
call fcn.0040e240
mov dword [esp + 8], eax
jmp 0x404d4f
push edx
call fcn.004204c0
pop edx
push eax
push 0x2e
mov edx, dword [esp + 0xc]
push edx
call fcn.004204c0
pop edx
push eax
push edx
call fcn.00420590
mov edx, str.System32
push edx
call fcn.00420590
call fcn.004205f0
mov edx, dword [esp + 0xc]
push edx
call fcn.004204c0
pop edx
push eax
push edx
call fcn.00420590
mov edx, str.__FORMAT:List
push edx
call fcn.00420590
call fcn.004205f0
mov eax, str.wmic.exe
push eax
call fcn.0040e222
add dword [esp + 4], edx
call fcn.0040e222
add dword [esp + 8], edx
call fcn.0040eb7a
call fcn.0040e240
mov dword [esp + 8], eax
mov edx, 0x477028
lea ecx, [esp + 0xc]
call fcn.0040e008
cmp dword [esp + 8], 0
je 0x405025
push 0x9c40
call fcn.0041f5f0
mov dword [esp + 0x18], eax
push dword [esp + 8]
call fcn.0040f0c8
and eax, eax
je 0x404ff9
push dword [esp + 8]
call fcn.0040f10f
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10], 0
je 0x404ff4
push dword [esp + 0x10]
push dword [esp + 0x1c]
push dword [esp + 0x10]
call fcn.0040f1c4
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10], 0
je 0x404ff4
push edx
call fcn.004204c0
pop edx
push eax
push edx
call fcn.004204c0
pop edx
push eax
push 0x18
push dword [esp + 0x1c]
push dword [esp + 0x28]
call fcn.0041f7f0
lea eax, [esp + 0x18]
push eax
call fcn.00420500
push dword [esp + 0x14]
call fcn.0041eec0
mov ebx, eax
add ebx, 4
push ebx
call fcn.0041f5f0
mov dword [esp + 0x1c], eax
push dword [esp + 0x14]
call fcn.0041eec0
mov ebx, eax
add ebx, 4
push ebx
call fcn.0041f5f0
mov dword [esp + 0x20], eax
push 0x18
push 0xffffffff
push dword [esp + 0x1c]
push dword [esp + 0x28]
call fcn.0041f610
push dword [esp + 0x20]
push dword [esp + 0x20]
call sub.USER32.dll_OemToCharW
mov dword [esp + 0x24], 0
jmp 0x404e49
push dword [esp + 0x14]
call fcn.0041eec0
mov ebx, eax
add ebx, 4
cmp ebx, dword [esp + 0x24]
jl 0x404f8e
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
push ebx
call fcn.0041f760
mov ebx, eax
cmp ebx, 0x6a
jne 0x404e93
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
inc ebx
push ebx
call fcn.0041f760
mov ebx, eax
cmp ebx, 0x26
jne 0x404e93
mov eax, 1
jmp 0x404e95
xor eax, eax
and eax, eax
je 0x404ec0
push 0xd
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
push ebx
call fcn.0041f770
push 0
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
inc ebx
push ebx
call fcn.0041f770
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
push ebx
call fcn.0041f760
mov ebx, eax
cmp ebx, 0xd9
jne 0x404ef5
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
inc ebx
push ebx
call fcn.0041f760
mov ebx, eax
cmp ebx, 0x25
jne 0x404ef5
mov eax, 1
jmp 0x404ef7
xor eax, eax
and eax, eax
je 0x404f22
push 0xa
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
push ebx
call fcn.0041f770
push 0
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
inc ebx
push ebx
call fcn.0041f770
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
push ebx
call fcn.0041f760
mov ebx, eax
cmp ebx, 0xcb
jne 0x404f57
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
inc ebx
push ebx
call fcn.0041f760
mov ebx, eax
cmp ebx, 0x25
jne 0x404f57
mov eax, 1
jmp 0x404f59
xor eax, eax
and eax, eax
je 0x404f84
push 9
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
push ebx
call fcn.0041f770
push 0
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
inc ebx
push ebx
call fcn.0041f770
inc dword [esp + 0x24]
jno 0x404e49
push edx
call fcn.004204c0
pop edx
push eax
push edx
call fcn.004204c0
pop edx
push eax
push dword [esp + 0x28]
call fcn.0041f780
lea eax, [esp + 0x18]
push eax
call fcn.00420500
push dword [esp + 0x1c]
call fcn.0041f7d0
push dword [esp + 0x20]
call fcn.0041f7d0
mov edx, dword [esp + 0xc]
push edx
call fcn.004204c0
pop edx
push eax
push edx
call fcn.00420590
mov edx, dword [esp + 0x18]
push edx
call fcn.00420590
mov edx, 0x477c8e
push edx
call fcn.00420590
lea eax, [esp + 0x10]
push eax
call fcn.00420500
jmp 0x404d76
push dword [esp + 0x18]
call fcn.0041f7d0
push dword [esp + 8]
call fcn.0040f21e
and eax, eax
je 0x405025
push dword [esp + 8]
call fcn.0040f14e
mov dword [esp + 0x28], eax
push dword [esp + 8]
call fcn.0040f16e
mov ebx, dword [esp + 0x38]
and ebx, ebx
jle 0x40505d
push edx
call fcn.004204c0
pop edx
push eax
push edx
call fcn.004204c0
pop edx
push eax
mov eax, dword [esp + 0x30]
cdq
push edx
push eax
call fcn.0041ed60
pop eax
push eax
call fcn.0040e210
pop edx
add eax, edx
jmp 0x40517f
push edx
call fcn.004204c0
pop edx
push eax
push edx
call fcn.004204c0
pop edx
push eax
mov eax, 0x47702e
push eax
push dword [esp + 0x18]
call fcn.0041f410
lea eax, [esp + 0x10]
push eax
call fcn.00420500
push edx
call fcn.004204c0
pop edx
push eax
push edx
call fcn.004204c0
pop edx
push eax
mov eax, 0x47702a
push eax
mov eax, 0x47798a
push eax
push dword [esp + 0x1c]
call fcn.0041e6c0
lea eax, [esp + 0x10]
push eax
call fcn.00420500
mov eax, 0x47798a
push eax
push dword [esp + 0x10]
call fcn.0041e810
mov ebx, eax
and ebx, ebx
jne 0x405086
push edx
call fcn.004204c0
pop edx
push eax
push edx
call fcn.004204c0
pop edx
push eax
push 1
push dword [esp + 0x18]
call fcn.0041ea80
call fcn.004205f0
mov edx, 0x47702a
call fcn.0040e250
mov ecx, eax
call fcn.0040e1d0
je 0x405128
push edx
call fcn.004204c0
pop edx
push eax
push edx
call fcn.004204c0
pop edx
push eax
push 2
push dword [esp + 0x18]
call fcn.0041e8f0
lea eax, [esp + 0x10]
push eax
call fcn.00420500
push edx
call fcn.004204c0
pop edx
push eax
push edx
call fcn.004204c0
pop edx
push eax
mov eax, 0x477028
push eax
mov eax, 0x47702a
push eax
push dword [esp + 0x1c]
call fcn.0041e6c0
lea eax, [esp + 0x10]
push eax
call fcn.00420500
mov edx, dword [esp + 0xc]
push edx
call fcn.004204c0
pop edx
push eax
push edx
call fcn.00420590
pop eax
push eax
call fcn.0040e210
pop edx
add eax, edx
jmp 0x40517f
push dword [esp + 0xc]
call fcn.004206f0
push dword [esp]
call fcn.004206f0
push dword [esp + 4]
call fcn.004206f0
push dword [esp + 0x14]
call fcn.004206f0
add esp, 0x2c
pop ebx
ret 8