Function at 0x4033ee
Capabilities:
Query environment variable

Disassembly:
push ebx
mov edx, 0xa
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x4033f4
call fcn.00426350
push dword [esp + 0x34]
call fcn.0040c9e0
mov edx, dword [esp + 0x30]
lea ecx, [esp]
call fcn.0040c000
push edx
call fcn.004261b0
pop edx
push eax
push edx
call fcn.004261b0
pop edx
push eax
push 0x1f4
call fcn.00423a90
lea eax, [esp + 8]
push eax
call fcn.004261f0
push 0x1f4
mov eax, dword [esp + 8]
push eax
mov eax, str.WINDIR
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
push edx
call fcn.004261b0
pop edx
push eax
push 0x2e
mov edx, dword [esp + 0xc]
push edx
call fcn.004261b0
pop edx
push eax
push edx
call fcn.00426280
mov edx, str.System32
push edx
call fcn.00426280
call fcn.004262e0
push edx
call fcn.004261b0
pop edx
push eax
mov edx, str.__c_wmic
push edx
call fcn.00426280
mov edx, dword [esp + 0x10]
push edx
call fcn.00426280
call fcn.004262e0
mov edx, dword [esp + 0x14]
push edx
call fcn.004261b0
pop edx
push eax
push edx
call fcn.00426280
mov edx, str.System32cmd.exe
push edx
call fcn.00426280
call fcn.0040c9c2
add dword [esp], edx
call fcn.0040c9c2
add dword [esp + 4], edx
call fcn.0040c9c2
add dword [esp + 8], edx
call fcn.0040d8ca
call fcn.0040c9e0
mov dword [esp + 8], eax
mov edx, 0x472028
lea ecx, [esp + 0xc]
call fcn.0040c008
cmp dword [esp + 8], 0
je 0x4037b3
push 0x9c40
call fcn.004250c0
mov dword [esp + 0x10], eax
push dword [esp + 8]
call fcn.0040de18
and eax, eax
je 0x403794
push dword [esp + 8]
call fcn.0040de5f
mov dword [esp + 0x14], eax
cmp dword [esp + 0x14], 0
je 0x40378f
push dword [esp + 0x14]
push dword [esp + 0x14]
push dword [esp + 0x10]
call fcn.0040de85
mov dword [esp + 0x14], eax
cmp dword [esp + 0x14], 0
je 0x40378f
push edx
call fcn.004261b0
pop edx
push eax
push edx
call fcn.004261b0
pop edx
push eax
push 0x18
push dword [esp + 0x20]
push dword [esp + 0x20]
call fcn.004250e0
lea eax, [esp + 0x1c]
push eax
call fcn.004261f0
push dword [esp + 0x18]
call fcn.00423eb0
mov ebx, eax
add ebx, 4
push ebx
call fcn.004250c0
mov dword [esp + 0x1c], eax
push dword [esp + 0x18]
call fcn.00423eb0
mov ebx, eax
add ebx, 4
push ebx
call fcn.004250c0
mov dword [esp + 0x20], eax
push 0x18
push 0xffffffff
push dword [esp + 0x20]
push dword [esp + 0x28]
call fcn.00425200
push dword [esp + 0x20]
push dword [esp + 0x20]
call sub.USER32.dll_OemToCharW
mov dword [esp + 0x24], 0
jmp 0x4035e4
push dword [esp + 0x18]
call fcn.00423eb0
mov ebx, eax
add ebx, 4
cmp ebx, dword [esp + 0x24]
jl 0x403729
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
push ebx
call fcn.00425350
mov ebx, eax
cmp ebx, 0x6a
jne 0x40362e
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
inc ebx
push ebx
call fcn.00425350
mov ebx, eax
cmp ebx, 0x26
jne 0x40362e
mov eax, 1
jmp 0x403630
xor eax, eax
and eax, eax
je 0x40365b
push 0xd
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
push ebx
call fcn.00425360
push 0
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
inc ebx
push ebx
call fcn.00425360
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
push ebx
call fcn.00425350
mov ebx, eax
cmp ebx, 0xd9
jne 0x403690
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
inc ebx
push ebx
call fcn.00425350
mov ebx, eax
cmp ebx, 0x25
jne 0x403690
mov eax, 1
jmp 0x403692
xor eax, eax
and eax, eax
je 0x4036bd
push 0xa
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
push ebx
call fcn.00425360
push 0
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
inc ebx
push ebx
call fcn.00425360
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
push ebx
call fcn.00425350
mov ebx, eax
cmp ebx, 0xcb
jne 0x4036f2
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
inc ebx
push ebx
call fcn.00425350
mov ebx, eax
cmp ebx, 0x25
jne 0x4036f2
mov eax, 1
jmp 0x4036f4
xor eax, eax
and eax, eax
je 0x40371f
push 9
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
push ebx
call fcn.00425360
push 0
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
inc ebx
push ebx
call fcn.00425360
inc dword [esp + 0x24]
jno 0x4035e4
push edx
call fcn.004261b0
pop edx
push eax
push edx
call fcn.004261b0
pop edx
push eax
push dword [esp + 0x28]
call fcn.00425370
lea eax, [esp + 0x1c]
push eax
call fcn.004261f0
push dword [esp + 0x1c]
call fcn.004253c0
push dword [esp + 0x20]
call fcn.004253c0
mov edx, dword [esp + 0xc]
push edx
call fcn.004261b0
pop edx
push eax
push edx
call fcn.00426280
mov edx, dword [esp + 0x1c]
push edx
call fcn.00426280
mov edx, 0x475622
push edx
call fcn.00426280
lea eax, [esp + 0x10]
push eax
call fcn.004261f0
jmp 0x403511
push dword [esp + 0x10]
call fcn.004253c0
push dword [esp + 8]
call fcn.0040dedf
and eax, eax
je 0x4037b3
push dword [esp + 8]
call fcn.0040df16
mov edx, dword [esp + 0xc]
push edx
call fcn.004261b0
pop edx
push eax
push edx
call fcn.00426280
pop eax
push eax
call fcn.0040c9b0
pop edx
add eax, edx
jmp 0x4037db
push dword [esp + 0xc]
call fcn.004263b0
push dword [esp]
call fcn.004263b0
push dword [esp + 4]
call fcn.004263b0
push dword [esp + 0x18]
call fcn.004263b0
add esp, 0x28
pop ebx
ret 4