Function at 0x405a2b
Capabilities:
Query environment variable

Disassembly:
push ebx
mov edx, 0xb
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x405a31
call fcn.0042f100
push dword [esp + 0x3c]
call fcn.004176e0
mov edx, dword [esp + 0x34]
lea ecx, [esp]
call fcn.00417000
push edx
call fcn.0042ef90
pop edx
push eax
push edx
call fcn.0042ef90
pop edx
push eax
push 0x1f4
call fcn.0042c690
lea eax, [esp + 8]
push eax
call fcn.0042f030
push 0x1f4
mov eax, dword [esp + 8]
push eax
mov eax, str.WINDIR
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
mov ebx, dword [esp + 0x38]
and ebx, ebx
jle 0x405b3a
push edx
call fcn.0042ef90
pop edx
push eax
push 0x2e
mov edx, dword [esp + 0xc]
push edx
call fcn.0042ef90
pop edx
push eax
push edx
call fcn.0042efd0
mov edx, str.System32
push edx
call fcn.0042efd0
call fcn.0042f1c0
push edx
call fcn.0042ef90
pop edx
push eax
mov edx, str.__c_wmic
push edx
call fcn.0042efd0
mov edx, dword [esp + 0x10]
push edx
call fcn.0042efd0
call fcn.0042f1c0
mov edx, dword [0x575d08]
push edx
call fcn.0042ef90
pop edx
push eax
push edx
call fcn.0042efd0
mov edx, 0x47f828
push edx
call fcn.0042efd0
call fcn.004176c2
add dword [esp], edx
call fcn.004176c2
add dword [esp + 4], edx
call fcn.004176c2
add dword [esp + 8], edx
call fcn.0041902b
call fcn.004176e0
mov dword [esp + 8], eax
jmp 0x405bdd
push edx
call fcn.0042ef90
pop edx
push eax
push 0x2e
mov edx, dword [esp + 0xc]
push edx
call fcn.0042ef90
pop edx
push eax
push edx
call fcn.0042efd0
mov edx, str.System32
push edx
call fcn.0042efd0
call fcn.0042f1c0
push edx
call fcn.0042ef90
pop edx
push eax
mov edx, str.__c_wmic
push edx
call fcn.0042efd0
mov edx, dword [esp + 0x10]
push edx
call fcn.0042efd0
mov edx, str.__FORMAT:List
push edx
call fcn.0042efd0
call fcn.0042f1c0
mov edx, dword [0x575d08]
push edx
call fcn.0042ef90
pop edx
push eax
push edx
call fcn.0042efd0
mov edx, 0x47f828
push edx
call fcn.0042efd0
call fcn.004176c2
add dword [esp], edx
call fcn.004176c2
add dword [esp + 4], edx
call fcn.004176c2
add dword [esp + 8], edx
call fcn.0041902b
call fcn.004176e0
mov dword [esp + 8], eax
mov edx, 0x47b028
lea ecx, [esp + 0xc]
call fcn.00417008
cmp dword [esp + 8], 0
je 0x405ee3
push 0x9c40
call fcn.0042dd30
mov dword [esp + 0x10], eax
push dword [esp + 8]
call fcn.00419590
and eax, eax
je 0x405eb7
push dword [esp + 8]
call fcn.004195d7
mov dword [esp + 0x14], eax
cmp dword [esp + 0x14], 0
je 0x405e82
push dword [esp + 0x14]
push dword [esp + 0x14]
push dword [esp + 0x10]
call fcn.004195fd
mov dword [esp + 0x14], eax
cmp dword [esp + 0x14], 0
je 0x405e82
push edx
call fcn.0042ef90
pop edx
push eax
push edx
call fcn.0042ef90
pop edx
push eax
push 0x18
push dword [esp + 0x20]
push dword [esp + 0x20]
call fcn.0042df30
lea eax, [esp + 0x1c]
push eax
call fcn.0042f030
push dword [esp + 0x18]
call fcn.0042cd40
mov ebx, eax
add ebx, 4
push ebx
call fcn.0042dd30
mov dword [esp + 0x1c], eax
push dword [esp + 0x18]
call fcn.0042cd40
mov ebx, eax
add ebx, 4
push ebx
call fcn.0042dd30
mov dword [esp + 0x20], eax
push 0x18
push 0xffffffff
push dword [esp + 0x20]
push dword [esp + 0x28]
call fcn.0042dd50
push dword [esp + 0x20]
push dword [esp + 0x20]
call sub.USER32.dll_OemToCharW
mov dword [esp + 0x24], 0
jmp 0x405cd7
push dword [esp + 0x18]
call fcn.0042cd40
mov ebx, eax
add ebx, 4
cmp ebx, dword [esp + 0x24]
jl 0x405e1c
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
push ebx
call fcn.0042dea0
mov ebx, eax
cmp ebx, 0x6a
jne 0x405d21
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
inc ebx
push ebx
call fcn.0042dea0
mov ebx, eax
cmp ebx, 0x26
jne 0x405d21
mov eax, 1
jmp 0x405d23
xor eax, eax
and eax, eax
je 0x405d4e
push 0xd
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
push ebx
call fcn.0042deb0
push 0
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
inc ebx
push ebx
call fcn.0042deb0
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
push ebx
call fcn.0042dea0
mov ebx, eax
cmp ebx, 0xd9
jne 0x405d83
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
inc ebx
push ebx
call fcn.0042dea0
mov ebx, eax
cmp ebx, 0x25
jne 0x405d83
mov eax, 1
jmp 0x405d85
xor eax, eax
and eax, eax
je 0x405db0
push 0xa
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
push ebx
call fcn.0042deb0
push 0
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
inc ebx
push ebx
call fcn.0042deb0
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
push ebx
call fcn.0042dea0
mov ebx, eax
cmp ebx, 0xcb
jne 0x405de5
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
inc ebx
push ebx
call fcn.0042dea0
mov ebx, eax
cmp ebx, 0x25
jne 0x405de5
mov eax, 1
jmp 0x405de7
xor eax, eax
and eax, eax
je 0x405e12
push 9
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
push ebx
call fcn.0042deb0
push 0
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
inc ebx
push ebx
call fcn.0042deb0
inc dword [esp + 0x24]
jno 0x405cd7
push edx
call fcn.0042ef90
pop edx
push eax
push edx
call fcn.0042ef90
pop edx
push eax
push dword [esp + 0x28]
call fcn.0042dec0
lea eax, [esp + 0x1c]
push eax
call fcn.0042f030
push dword [esp + 0x1c]
call fcn.0042df10
push dword [esp + 0x20]
call fcn.0042df10
mov edx, dword [esp + 0xc]
push edx
call fcn.0042ef90
pop edx
push eax
push edx
call fcn.0042efd0
mov edx, dword [esp + 0x1c]
push edx
call fcn.0042efd0
mov edx, 0x480318
push edx
call fcn.0042efd0
lea eax, [esp + 0x10]
push eax
call fcn.0042f030
push dword [0x575ce4]
call fcn.0042050f
and eax, eax
je 0x405eb2
call fcn.00420106
and eax, eax
je 0x405e9c
jmp 0x405e91
call fcn.00420106
and eax, eax
je 0x405ea7
jmp 0x405e9c
call fcn.00420106
and eax, eax
je 0x405eb2
jmp 0x405ea7
jmp 0x405c04
push dword [esp + 0x10]
call fcn.0042df10
push dword [esp + 8]
call fcn.00419657
and eax, eax
je 0x405ee3
push dword [esp + 8]
call fcn.0041968e
mov dword [esp + 0x28], eax
push dword [esp + 8]
call fcn.004196ae
mov ebx, dword [esp + 0x38]
and ebx, ebx
jle 0x405f1b
push edx
call fcn.0042ef90
pop edx
push eax
push edx
call fcn.0042ef90
pop edx
push eax
mov eax, dword [esp + 0x30]
cdq
push edx
push eax
call fcn.0042c6e0
pop eax
push eax
call fcn.004176b0
pop edx
add eax, edx
jmp 0x406010
push edx
call fcn.0042ef90
pop edx
push eax
push edx
call fcn.0042ef90
pop edx
push eax
mov eax, 0x47b186
push eax
push dword [esp + 0x18]
call fcn.0042d220
lea eax, [esp + 0x10]
push eax
call fcn.0042f030
push edx
call fcn.0042ef90
pop edx
push eax
push edx
call fcn.0042ef90
pop edx
push eax
mov eax, 0x47b152
push eax
mov eax, 0x47efb0
push eax
push dword [esp + 0x1c]
call fcn.0042d580
lea eax, [esp + 0x10]
push eax
call fcn.0042f030
mov eax, 0x47efb0
push eax
push dword [esp + 0x10]
call fcn.0042c900
mov ebx, eax
and ebx, ebx
jne 0x405f44
push edx
call fcn.0042ef90
pop edx
push eax
push edx
call fcn.0042ef90
pop edx
push eax
push 1
push dword [esp + 0x18]
call fcn.0042d5a0
call fcn.0042f1c0
mov edx, 0x47b152
pop ecx
push ecx
call fcn.004176f0
mov ecx, eax
call fcn.00417670
je 0x405fe8
push edx
call fcn.0042ef90
pop edx
push eax
push edx
call fcn.0042ef90
pop edx
push eax
push 2
push dword [esp + 0x18]
call fcn.0042c9b0
lea eax, [esp + 0x10]
push eax
call fcn.0042f030
mov edx, dword [esp + 0xc]
push edx
call fcn.0042ef90
pop edx
push eax
push edx
call fcn.0042efd0
pop eax
push eax
call fcn.004176b0
pop edx
add eax, edx
jmp 0x406010
push dword [esp + 0xc]
call fcn.0042f190
push dword [esp]
call fcn.0042f190
push dword [esp + 4]
call fcn.0042f190
push dword [esp + 0x18]
call fcn.0042f190
add esp, 0x2c
pop ebx
ret 8