Function at 0x40df08
Capabilities:
Query environment variable

Disassembly:
push ebx
mov edx, 0xb
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x40df0e
call fcn.00465f10
push dword [esp + 0x3c]
call fcn.004236d0
mov edx, dword [esp + 0x34]
lea ecx, [esp]
call fcn.00423000
push edx
call fcn.00465d70
pop edx
push eax
push edx
call fcn.00465d70
pop edx
push eax
push 0x1f4
call fcn.00463790
lea eax, [esp + 8]
push eax
call fcn.00465e10
push 0x1f4
mov eax, dword [esp + 8]
push eax
mov eax, str.WINDIR
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
mov ebx, dword [esp + 0x38]
and ebx, ebx
jle 0x40dfc8
push edx
call fcn.00465d70
pop edx
push eax
push 0x2e
mov edx, dword [esp + 0xc]
push edx
call fcn.00465d70
pop edx
push eax
push edx
call fcn.00465db0
mov edx, str.System32
push edx
call fcn.00465db0
call fcn.00465ea0
push dword [esp + 0xc]
mov eax, str.wmic.exe
push eax
call fcn.004236b2
add dword [esp + 8], edx
call fcn.0043f5fe
call fcn.004236d0
mov dword [esp + 8], eax
jmp 0x40e03f
push edx
call fcn.00465d70
pop edx
push eax
push 0x2e
mov edx, dword [esp + 0xc]
push edx
call fcn.00465d70
pop edx
push eax
push edx
call fcn.00465db0
mov edx, str.System32
push edx
call fcn.00465db0
call fcn.00465ea0
mov edx, dword [esp + 0xc]
push edx
call fcn.00465d70
pop edx
push eax
push edx
call fcn.00465db0
mov edx, str.__FORMAT:List
push edx
call fcn.00465db0
call fcn.00465ea0
mov eax, str.wmic.exe
push eax
call fcn.004236b2
add dword [esp + 4], edx
call fcn.004236b2
add dword [esp + 8], edx
call fcn.0043f5fe
call fcn.004236d0
mov dword [esp + 8], eax
mov edx, 0x4ff050
lea ecx, [esp + 0xc]
call fcn.00423008
cmp dword [esp + 8], 0
je 0x40e315
push 0x9c40
call fcn.00464be0
mov dword [esp + 0x18], eax
push dword [esp + 8]
call fcn.0043fb63
and eax, eax
je 0x40e2e9
push dword [esp + 8]
call fcn.0043fbaa
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10], 0
je 0x40e2e4
push dword [esp + 0x10]
push dword [esp + 0x1c]
push dword [esp + 0x10]
call fcn.0043fc93
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10], 0
je 0x40e2e4
push edx
call fcn.00465d70
pop edx
push eax
push edx
call fcn.00465d70
pop edx
push eax
push 0x18
push dword [esp + 0x1c]
push dword [esp + 0x28]
call fcn.00464de0
lea eax, [esp + 0x18]
push eax
call fcn.00465e10
push dword [esp + 0x14]
call fcn.00464010
mov ebx, eax
add ebx, 4
push ebx
call fcn.00464be0
mov dword [esp + 0x1c], eax
push dword [esp + 0x14]
call fcn.00464010
mov ebx, eax
add ebx, 4
push ebx
call fcn.00464be0
mov dword [esp + 0x20], eax
push 0x18
push 0xffffffff
push dword [esp + 0x1c]
push dword [esp + 0x28]
call fcn.00464c00
push dword [esp + 0x20]
push dword [esp + 0x20]
call sub.USER32.dll_OemToCharW
mov dword [esp + 0x24], 0
jmp 0x40e139
push dword [esp + 0x14]
call fcn.00464010
mov ebx, eax
add ebx, 4
cmp ebx, dword [esp + 0x24]
jl 0x40e27e
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
push ebx
call fcn.00464d50
mov ebx, eax
cmp ebx, 0x6a
jne 0x40e183
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
inc ebx
push ebx
call fcn.00464d50
mov ebx, eax
cmp ebx, 0x26
jne 0x40e183
mov eax, 1
jmp 0x40e185
xor eax, eax
and eax, eax
je 0x40e1b0
push 0xd
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
push ebx
call fcn.00464d60
push 0
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
inc ebx
push ebx
call fcn.00464d60
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
push ebx
call fcn.00464d50
mov ebx, eax
cmp ebx, 0xd9
jne 0x40e1e5
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
inc ebx
push ebx
call fcn.00464d50
mov ebx, eax
cmp ebx, 0x25
jne 0x40e1e5
mov eax, 1
jmp 0x40e1e7
xor eax, eax
and eax, eax
je 0x40e212
push 0xa
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
push ebx
call fcn.00464d60
push 0
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
inc ebx
push ebx
call fcn.00464d60
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
push ebx
call fcn.00464d50
mov ebx, eax
cmp ebx, 0xcb
jne 0x40e247
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
inc ebx
push ebx
call fcn.00464d50
mov ebx, eax
cmp ebx, 0x25
jne 0x40e247
mov eax, 1
jmp 0x40e249
xor eax, eax
and eax, eax
je 0x40e274
push 9
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
push ebx
call fcn.00464d60
push 0
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
inc ebx
push ebx
call fcn.00464d60
inc dword [esp + 0x24]
jno 0x40e139
push edx
call fcn.00465d70
pop edx
push eax
push edx
call fcn.00465d70
pop edx
push eax
push dword [esp + 0x28]
call fcn.00464d70
lea eax, [esp + 0x18]
push eax
call fcn.00465e10
push dword [esp + 0x1c]
call fcn.00464dc0
push dword [esp + 0x20]
call fcn.00464dc0
mov edx, dword [esp + 0xc]
push edx
call fcn.00465d70
pop edx
push eax
push edx
call fcn.00465db0
mov edx, dword [esp + 0x18]
push edx
call fcn.00465db0
mov edx, 0x50b49e
push edx
call fcn.00465db0
lea eax, [esp + 0x10]
push eax
call fcn.00465e10
jmp 0x40e066
push dword [esp + 0x18]
call fcn.00464dc0
push dword [esp + 8]
call fcn.0043fced
and eax, eax
je 0x40e315
push dword [esp + 8]
call fcn.0043fc1d
mov dword [esp + 0x28], eax
push dword [esp + 8]
call fcn.0043fc3d
mov ebx, dword [esp + 0x38]
and ebx, ebx
jle 0x40e34d
push edx
call fcn.00465d70
pop edx
push eax
push edx
call fcn.00465d70
pop edx
push eax
mov eax, dword [esp + 0x30]
cdq
push edx
push eax
call fcn.00463eb0
pop eax
push eax
call fcn.004236a0
pop edx
add eax, edx
jmp 0x40e471
push edx
call fcn.00465d70
pop edx
push eax
push edx
call fcn.00465d70
pop edx
push eax
mov eax, 0x4ff34e
push eax
push dword [esp + 0x18]
call fcn.00464510
lea eax, [esp + 0x10]
push eax
call fcn.00465e10
push edx
call fcn.00465d70
pop edx
push eax
push edx
call fcn.00465d70
pop edx
push eax
mov eax, 0x4ff2d4
push eax
mov eax, 0x5086ec
push eax
push dword [esp + 0x1c]
call fcn.00463e20
lea eax, [esp + 0x10]
push eax
call fcn.00465e10
mov eax, 0x5086ec
push eax
push dword [esp + 0x10]
call fcn.004639e0
mov ebx, eax
and ebx, ebx
jne 0x40e376
push edx
call fcn.00465d70
pop edx
push eax
push edx
call fcn.00465d70
pop edx
push eax
push 1
push dword [esp + 0x18]
call fcn.00464530
call fcn.00465ea0
mov edx, 0x4ff2d4
pop ecx
push ecx
call fcn.004236e0
mov ecx, eax
call fcn.00423660
je 0x40e41a
push edx
call fcn.00465d70
pop edx
push eax
push edx
call fcn.00465d70
pop edx
push eax
push 2
push dword [esp + 0x18]
call fcn.00463a90
lea eax, [esp + 0x10]
push eax
call fcn.00465e10
push edx
call fcn.00465d70
pop edx
push eax
push edx
call fcn.00465d70
pop edx
push eax
mov eax, 0x4ff050
push eax
mov eax, 0x4ff2d4
push eax
push dword [esp + 0x1c]
call fcn.00463e20
lea eax, [esp + 0x10]
push eax
call fcn.00465e10
mov edx, dword [esp + 0xc]
push edx
call fcn.00465d70
pop edx
push eax
push edx
call fcn.00465db0
pop eax
push eax
call fcn.004236a0
pop edx
add eax, edx
jmp 0x40e471
push dword [esp + 0xc]
call fcn.00465fa0
push dword [esp]
call fcn.00465fa0
push dword [esp + 4]
call fcn.00465fa0
push dword [esp + 0x14]
call fcn.00465fa0
add esp, 0x2c
pop ebx
ret 8