Function at 0x402235
Capabilities:
Query environment variable

Disassembly:
push ebx
mov edx, 0xa
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x40223b
call fcn.00422720
push dword [esp + 0x34]
call fcn.0040a780
mov edx, dword [esp + 0x30]
lea ecx, [esp]
call fcn.0040a000
push edx
call fcn.00422580
pop edx
push eax
push edx
call fcn.00422580
pop edx
push eax
push 0x1f4
call fcn.0041fe60
lea eax, [esp + 8]
push eax
call fcn.004225c0
push 0x1f4
mov eax, dword [esp + 8]
push eax
mov eax, str.WINDIR
push eax
call sub.KERNEL32.DLL_GetEnvironmentVariableW
push edx
call fcn.00422580
pop edx
push eax
push 0x2e
mov edx, dword [esp + 0xc]
push edx
call fcn.00422580
pop edx
push eax
push edx
call fcn.00422650
mov edx, str.System32
push edx
call fcn.00422650
call fcn.004226b0
push edx
call fcn.00422580
pop edx
push eax
mov edx, str.__c_wmic
push edx
call fcn.00422650
mov edx, dword [esp + 0x10]
push edx
call fcn.00422650
call fcn.004226b0
mov edx, dword [esp + 0x14]
push edx
call fcn.00422580
pop edx
push eax
push edx
call fcn.00422650
mov edx, str.System32cmd.exe
push edx
call fcn.00422650
call fcn.0040a762
add dword [esp], edx
call fcn.0040a762
add dword [esp + 4], edx
call fcn.0040a762
add dword [esp + 8], edx
call fcn.0040b5d9
call fcn.0040a780
mov dword [esp + 8], eax
mov edx, 0x46a024
lea ecx, [esp + 0xc]
call fcn.0040a008
cmp dword [esp + 8], 0
je 0x4025fa
push 0x9c40
call fcn.00421490
mov dword [esp + 0x10], eax
push dword [esp + 8]
call fcn.0040bb20
and eax, eax
je 0x4025db
push dword [esp + 8]
call fcn.0040bb67
mov dword [esp + 0x14], eax
cmp dword [esp + 0x14], 0
je 0x4025d6
push dword [esp + 0x14]
push dword [esp + 0x14]
push dword [esp + 0x10]
call fcn.0040bb8d
mov dword [esp + 0x14], eax
cmp dword [esp + 0x14], 0
je 0x4025d6
push edx
call fcn.00422580
pop edx
push eax
push edx
call fcn.00422580
pop edx
push eax
push 0x18
push dword [esp + 0x20]
push dword [esp + 0x20]
call fcn.004214b0
lea eax, [esp + 0x1c]
push eax
call fcn.004225c0
push dword [esp + 0x18]
call fcn.00420280
mov ebx, eax
add ebx, 4
push ebx
call fcn.00421490
mov dword [esp + 0x1c], eax
push dword [esp + 0x18]
call fcn.00420280
mov ebx, eax
add ebx, 4
push ebx
call fcn.00421490
mov dword [esp + 0x20], eax
push 0x18
push 0xffffffff
push dword [esp + 0x20]
push dword [esp + 0x28]
call fcn.004215d0
push dword [esp + 0x20]
push dword [esp + 0x20]
call sub.USER32.DLL_OemToCharW
mov dword [esp + 0x24], 0
jmp 0x40242b
push dword [esp + 0x18]
call fcn.00420280
mov ebx, eax
add ebx, 4
cmp ebx, dword [esp + 0x24]
jl 0x402570
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
push ebx
call fcn.00421720
mov ebx, eax
cmp ebx, 0x6a
jne 0x402475
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
inc ebx
push ebx
call fcn.00421720
mov ebx, eax
cmp ebx, 0x26
jne 0x402475
mov eax, 1
jmp 0x402477
xor eax, eax
and eax, eax
je 0x4024a2
push 0xd
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
push ebx
call fcn.00421730
push 0
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
inc ebx
push ebx
call fcn.00421730
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
push ebx
call fcn.00421720
mov ebx, eax
cmp ebx, 0xd9
jne 0x4024d7
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
inc ebx
push ebx
call fcn.00421720
mov ebx, eax
cmp ebx, 0x25
jne 0x4024d7
mov eax, 1
jmp 0x4024d9
xor eax, eax
and eax, eax
je 0x402504
push 0xa
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
push ebx
call fcn.00421730
push 0
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
inc ebx
push ebx
call fcn.00421730
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
push ebx
call fcn.00421720
mov ebx, eax
cmp ebx, 0xcb
jne 0x402539
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
inc ebx
push ebx
call fcn.00421720
mov ebx, eax
cmp ebx, 0x25
jne 0x402539
mov eax, 1
jmp 0x40253b
xor eax, eax
and eax, eax
je 0x402566
push 9
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
push ebx
call fcn.00421730
push 0
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
inc ebx
push ebx
call fcn.00421730
inc dword [esp + 0x24]
jno 0x40242b
push edx
call fcn.00422580
pop edx
push eax
push edx
call fcn.00422580
pop edx
push eax
push dword [esp + 0x28]
call fcn.00421740
lea eax, [esp + 0x1c]
push eax
call fcn.004225c0
push dword [esp + 0x1c]
call fcn.00421790
push dword [esp + 0x20]
call fcn.00421790
mov edx, dword [esp + 0xc]
push edx
call fcn.00422580
pop edx
push eax
push edx
call fcn.00422650
mov edx, dword [esp + 0x1c]
push edx
call fcn.00422650
mov edx, 0x46cdd6
push edx
call fcn.00422650
lea eax, [esp + 0x10]
push eax
call fcn.004225c0
jmp 0x402358
push dword [esp + 0x10]
call fcn.00421790
push dword [esp + 8]
call fcn.0040bbe7
and eax, eax
je 0x4025fa
push dword [esp + 8]
call fcn.0040bc1e
mov edx, dword [esp + 0xc]
push edx
call fcn.00422580
pop edx
push eax
push edx
call fcn.00422650
pop eax
push eax
call fcn.0040a750
pop edx
add eax, edx
jmp 0x402622
push dword [esp + 0xc]
call fcn.00422780
push dword [esp]
call fcn.00422780
push dword [esp + 4]
call fcn.00422780
push dword [esp + 0x18]
call fcn.00422780
add esp, 0x28
pop ebx
ret 4