Function at 0x405a55
Capabilities:
Query environment variable

Disassembly:
push ebx
mov edx, 0xb
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x405a5b
call fcn.00453120
push dword [esp + 0x3c]
call fcn.00418690
mov edx, dword [esp + 0x34]
lea ecx, [esp]
call fcn.00418000
push edx
call fcn.00453030
pop edx
push eax
push edx
call fcn.00453030
pop edx
push eax
push 0x1f4
call fcn.00450630
lea eax, [esp + 8]
push eax
call fcn.004530b0
push 0x1f4
mov eax, dword [esp + 8]
push eax
mov eax, str.WINDIR
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
mov ebx, dword [esp + 0x38]
and ebx, ebx
jle 0x405b64
push edx
call fcn.00453030
pop edx
push eax
push 0x2e
mov edx, dword [esp + 0xc]
push edx
call fcn.00453030
pop edx
push eax
push edx
call fcn.00453060
mov edx, str.System32
push edx
call fcn.00453060
call fcn.004531e0
push edx
call fcn.00453030
pop edx
push eax
mov edx, str.__c_wmic
push edx
call fcn.00453060
mov edx, dword [esp + 0x10]
push edx
call fcn.00453060
call fcn.004531e0
mov edx, dword [0x62ac74]
push edx
call fcn.00453030
pop edx
push eax
push edx
call fcn.00453060
mov edx, 0x52a884
push edx
call fcn.00453060
call fcn.00418672
add dword [esp], edx
call fcn.00418672
add dword [esp + 4], edx
call fcn.00418672
add dword [esp + 8], edx
call fcn.0043c6b4
call fcn.00418690
mov dword [esp + 8], eax
jmp 0x405c07
push edx
call fcn.00453030
pop edx
push eax
push 0x2e
mov edx, dword [esp + 0xc]
push edx
call fcn.00453030
pop edx
push eax
push edx
call fcn.00453060
mov edx, str.System32
push edx
call fcn.00453060
call fcn.004531e0
push edx
call fcn.00453030
pop edx
push eax
mov edx, str.__c_wmic
push edx
call fcn.00453060
mov edx, dword [esp + 0x10]
push edx
call fcn.00453060
mov edx, str.__FORMAT:List
push edx
call fcn.00453060
call fcn.004531e0
mov edx, dword [0x62ac74]
push edx
call fcn.00453030
pop edx
push eax
push edx
call fcn.00453060
mov edx, 0x52a884
push edx
call fcn.00453060
call fcn.00418672
add dword [esp], edx
call fcn.00418672
add dword [esp + 4], edx
call fcn.00418672
add dword [esp + 8], edx
call fcn.0043c6b4
call fcn.00418690
mov dword [esp + 8], eax
mov edx, 0x52602e
lea ecx, [esp + 0xc]
call fcn.00418008
cmp dword [esp + 8], 0
je 0x405f0d
push 0x9c40
call fcn.00451dd0
mov dword [esp + 0x10], eax
push dword [esp + 8]
call fcn.0043cc2f
and eax, eax
je 0x405ee1
push dword [esp + 8]
call fcn.0043cc71
mov dword [esp + 0x14], eax
cmp dword [esp + 0x14], 0
je 0x405eac
push dword [esp + 0x14]
push dword [esp + 0x14]
push dword [esp + 0x10]
call fcn.0043cc95
mov dword [esp + 0x14], eax
cmp dword [esp + 0x14], 0
je 0x405eac
push edx
call fcn.00453030
pop edx
push eax
push edx
call fcn.00453030
pop edx
push eax
push 0x18
push dword [esp + 0x20]
push dword [esp + 0x20]
call fcn.00451fb0
lea eax, [esp + 0x1c]
push eax
call fcn.004530b0
push dword [esp + 0x18]
call fcn.00450f10
mov ebx, eax
add ebx, 4
push ebx
call fcn.00451dd0
mov dword [esp + 0x1c], eax
push dword [esp + 0x18]
call fcn.00450f10
mov ebx, eax
add ebx, 4
push ebx
call fcn.00451dd0
mov dword [esp + 0x20], eax
push 0x18
push 0xffffffff
push dword [esp + 0x20]
push dword [esp + 0x28]
call fcn.00451df0
push dword [esp + 0x20]
push dword [esp + 0x20]
call sub.USER32.dll_OemToCharW
mov dword [esp + 0x24], 0
jmp 0x405d01
push dword [esp + 0x18]
call fcn.00450f10
mov ebx, eax
add ebx, 4
cmp ebx, dword [esp + 0x24]
jl 0x405e46
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
push ebx
call fcn.00451f20
mov ebx, eax
cmp ebx, 0x6a
jne 0x405d4b
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
inc ebx
push ebx
call fcn.00451f20
mov ebx, eax
cmp ebx, 0x26
jne 0x405d4b
mov eax, 1
jmp 0x405d4d
xor eax, eax
and eax, eax
je 0x405d78
push 0xd
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
push ebx
call fcn.00451f30
push 0
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
inc ebx
push ebx
call fcn.00451f30
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
push ebx
call fcn.00451f20
mov ebx, eax
cmp ebx, 0xd9
jne 0x405dad
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
inc ebx
push ebx
call fcn.00451f20
mov ebx, eax
cmp ebx, 0x25
jne 0x405dad
mov eax, 1
jmp 0x405daf
xor eax, eax
and eax, eax
je 0x405dda
push 0xa
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
push ebx
call fcn.00451f30
push 0
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
inc ebx
push ebx
call fcn.00451f30
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
push ebx
call fcn.00451f20
mov ebx, eax
cmp ebx, 0xcb
jne 0x405e0f
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
inc ebx
push ebx
call fcn.00451f20
mov ebx, eax
cmp ebx, 0x25
jne 0x405e0f
mov eax, 1
jmp 0x405e11
xor eax, eax
and eax, eax
je 0x405e3c
push 9
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
push ebx
call fcn.00451f30
push 0
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
inc ebx
push ebx
call fcn.00451f30
inc dword [esp + 0x24]
jno 0x405d01
push edx
call fcn.00453030
pop edx
push eax
push edx
call fcn.00453030
pop edx
push eax
push dword [esp + 0x28]
call fcn.00451f40
lea eax, [esp + 0x1c]
push eax
call fcn.004530b0
push dword [esp + 0x1c]
call fcn.00451f90
push dword [esp + 0x20]
call fcn.00451f90
mov edx, dword [esp + 0xc]
push edx
call fcn.00453030
pop edx
push eax
push edx
call fcn.00453060
mov edx, dword [esp + 0x1c]
push edx
call fcn.00453060
mov edx, 0x52b37e
push edx
call fcn.00453060
lea eax, [esp + 0x10]
push eax
call fcn.004530b0
push dword [0x62ac50]
call fcn.00443c3c
and eax, eax
je 0x405edc
call fcn.004437fb
and eax, eax
je 0x405ec6
jmp 0x405ebb
call fcn.004437fb
and eax, eax
je 0x405ed1
jmp 0x405ec6
call fcn.004437fb
and eax, eax
je 0x405edc
jmp 0x405ed1
jmp 0x405c2e
push dword [esp + 0x10]
call fcn.00451f90
push dword [esp + 8]
call fcn.0043ccef
and eax, eax
je 0x405f0d
push dword [esp + 8]
call fcn.0043cd25
mov dword [esp + 0x28], eax
push dword [esp + 8]
call fcn.0043cd43
mov ebx, dword [esp + 0x38]
and ebx, ebx
jle 0x405f45
push edx
call fcn.00453030
pop edx
push eax
push edx
call fcn.00453030
pop edx
push eax
mov eax, dword [esp + 0x30]
cdq
push edx
push eax
call fcn.00450680
pop eax
push eax
call fcn.00418660
pop edx
add eax, edx
jmp 0x40603a
push edx
call fcn.00453030
pop edx
push eax
push edx
call fcn.00453030
pop edx
push eax
mov eax, 0x52618c
push eax
push dword [esp + 0x18]
call fcn.004513e0
lea eax, [esp + 0x10]
push eax
call fcn.004530b0
push edx
call fcn.00453030
pop edx
push eax
push edx
call fcn.00453030
pop edx
push eax
mov eax, 0x526158
push eax
mov eax, 0x529ffa
push eax
push dword [esp + 0x1c]
call fcn.00451730
lea eax, [esp + 0x10]
push eax
call fcn.004530b0
mov eax, 0x529ffa
push eax
push dword [esp + 0x10]
call fcn.004509e0
mov ebx, eax
and ebx, ebx
jne 0x405f6e
push edx
call fcn.00453030
pop edx
push eax
push edx
call fcn.00453030
pop edx
push eax
push 1
push dword [esp + 0x18]
call fcn.00451750
call fcn.004531e0
mov edx, 0x526158
pop ecx
push ecx
call fcn.004186a0
mov ecx, eax
call fcn.00418620
je 0x406012
push edx
call fcn.00453030
pop edx
push eax
push edx
call fcn.00453030
pop edx
push eax
push 2
push dword [esp + 0x18]
call fcn.00450ab0
lea eax, [esp + 0x10]
push eax
call fcn.004530b0
mov edx, dword [esp + 0xc]
push edx
call fcn.00453030
pop edx
push eax
push edx
call fcn.00453060
pop eax
push eax
call fcn.00418660
pop edx
add eax, edx
jmp 0x40603a
push dword [esp + 0xc]
call fcn.004531b0
push dword [esp]
call fcn.004531b0
push dword [esp + 4]
call fcn.004531b0
push dword [esp + 0x18]
call fcn.004531b0
add esp, 0x2c
pop ebx
ret 8