Function at 0x4170c0
Capabilities:
Query environment variable

Disassembly:
push ebx
mov edx, 0xb
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x4170c6
call fcn.00486110
push dword [esp + 0x3c]
call fcn.004416d0
mov edx, dword [esp + 0x34]
lea ecx, [esp]
call fcn.00441000
push edx
call fcn.00485f70
pop edx
push eax
push edx
call fcn.00485f70
pop edx
push eax
push 0x1f4
call fcn.004835b0
lea eax, [esp + 8]
push eax
call fcn.00486010
push 0x1f4
mov eax, dword [esp + 8]
push eax
mov eax, 0x56e2a4
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
mov ebx, dword [esp + 0x38]
and ebx, ebx
jle 0x417180
push edx
call fcn.00485f70
pop edx
push eax
push 0x2e
mov edx, dword [esp + 0xc]
push edx
call fcn.00485f70
pop edx
push eax
push edx
call fcn.00485fb0
mov edx, 0x56a4c2
push edx
call fcn.00485fb0
call fcn.004860a0
push dword [esp + 0xc]
mov eax, str.wmic.exe
push eax
call fcn.004416b2
add dword [esp + 8], edx
call fcn.0045dcfe
call fcn.004416d0
mov dword [esp + 8], eax
jmp 0x4171f7
push edx
call fcn.00485f70
pop edx
push eax
push 0x2e
mov edx, dword [esp + 0xc]
push edx
call fcn.00485f70
pop edx
push eax
push edx
call fcn.00485fb0
mov edx, 0x56a4c2
push edx
call fcn.00485fb0
call fcn.004860a0
mov edx, dword [esp + 0xc]
push edx
call fcn.00485f70
pop edx
push eax
push edx
call fcn.00485fb0
mov edx, str.__FORMAT:List
push edx
call fcn.00485fb0
call fcn.004860a0
mov eax, str.wmic.exe
push eax
call fcn.004416b2
add dword [esp + 4], edx
call fcn.004416b2
add dword [esp + 8], edx
call fcn.0045dcfe
call fcn.004416d0
mov dword [esp + 8], eax
mov edx, 0x55d09e
lea ecx, [esp + 0xc]
call fcn.00441008
cmp dword [esp + 8], 0
je 0x4174fd
push 0x9c40
call fcn.00484d90
mov dword [esp + 0x10], eax
push dword [esp + 8]
call fcn.0045e263
and eax, eax
je 0x4174d1
push dword [esp + 8]
call fcn.0045e2aa
mov dword [esp + 0x14], eax
cmp dword [esp + 0x14], 0
je 0x41749c
push dword [esp + 0x14]
push dword [esp + 0x14]
push dword [esp + 0x10]
call fcn.0045e393
mov dword [esp + 0x14], eax
cmp dword [esp + 0x14], 0
je 0x41749c
push edx
call fcn.00485f70
pop edx
push eax
push edx
call fcn.00485f70
pop edx
push eax
push 0x18
push dword [esp + 0x20]
push dword [esp + 0x20]
call fcn.00484f90
lea eax, [esp + 0x1c]
push eax
call fcn.00486010
push dword [esp + 0x18]
call fcn.00483b80
mov ebx, eax
add ebx, 4
push ebx
call fcn.00484d90
mov dword [esp + 0x1c], eax
push dword [esp + 0x18]
call fcn.00483b80
mov ebx, eax
add ebx, 4
push ebx
call fcn.00484d90
mov dword [esp + 0x20], eax
push 0x18
push 0xffffffff
push dword [esp + 0x20]
push dword [esp + 0x28]
call fcn.00484dd0
push dword [esp + 0x20]
push dword [esp + 0x20]
call sub.USER32.dll_OemToCharW
mov dword [esp + 0x24], 0
jmp 0x4172f1
push dword [esp + 0x18]
call fcn.00483b80
mov ebx, eax
add ebx, 4
cmp ebx, dword [esp + 0x24]
jl 0x417436
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
push ebx
call fcn.00484f20
mov ebx, eax
cmp ebx, 0x6a
jne 0x41733b
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
inc ebx
push ebx
call fcn.00484f20
mov ebx, eax
cmp ebx, 0x26
jne 0x41733b
mov eax, 1
jmp 0x41733d
xor eax, eax
and eax, eax
je 0x417368
push 0xd
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
push ebx
call fcn.00484f30
push 0
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
inc ebx
push ebx
call fcn.00484f30
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
push ebx
call fcn.00484f20
mov ebx, eax
cmp ebx, 0xd9
jne 0x41739d
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
inc ebx
push ebx
call fcn.00484f20
mov ebx, eax
cmp ebx, 0x25
jne 0x41739d
mov eax, 1
jmp 0x41739f
xor eax, eax
and eax, eax
je 0x4173ca
push 0xa
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
push ebx
call fcn.00484f30
push 0
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
inc ebx
push ebx
call fcn.00484f30
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
push ebx
call fcn.00484f20
mov ebx, eax
cmp ebx, 0xcb
jne 0x4173ff
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
inc ebx
push ebx
call fcn.00484f20
mov ebx, eax
cmp ebx, 0x25
jne 0x4173ff
mov eax, 1
jmp 0x417401
xor eax, eax
and eax, eax
je 0x41742c
push 9
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
push ebx
call fcn.00484f30
push 0
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
inc ebx
push ebx
call fcn.00484f30
inc dword [esp + 0x24]
jno 0x4172f1
push edx
call fcn.00485f70
pop edx
push eax
push edx
call fcn.00485f70
pop edx
push eax
push dword [esp + 0x28]
call fcn.00484f40
lea eax, [esp + 0x1c]
push eax
call fcn.00486010
push dword [esp + 0x1c]
call fcn.00484db0
push dword [esp + 0x20]
call fcn.00484db0
mov edx, dword [esp + 0xc]
push edx
call fcn.00485f70
pop edx
push eax
push edx
call fcn.00485fb0
mov edx, dword [esp + 0x1c]
push edx
call fcn.00485fb0
mov edx, 0x57418a
push edx
call fcn.00485fb0
lea eax, [esp + 0x10]
push eax
call fcn.00486010
push dword [0xb2cb18]
call fcn.0046a9a5
and eax, eax
je 0x4174cc
call fcn.0046aeb8
and eax, eax
je 0x4174b6
jmp 0x4174ab
call fcn.0046aeb8
and eax, eax
je 0x4174c1
jmp 0x4174b6
call fcn.0046aeb8
and eax, eax
je 0x4174cc
jmp 0x4174c1
jmp 0x41721e
push dword [esp + 0x10]
call fcn.00484db0
push dword [esp + 8]
call fcn.0045e3ed
and eax, eax
je 0x4174fd
push dword [esp + 8]
call fcn.0045e31d
mov dword [esp + 0x28], eax
push dword [esp + 8]
call fcn.0045e33d
mov ebx, dword [esp + 0x38]
and ebx, ebx
jle 0x417535
push edx
call fcn.00485f70
pop edx
push eax
push edx
call fcn.00485f70
pop edx
push eax
mov eax, dword [esp + 0x30]
cdq
push edx
push eax
call fcn.004839a0
pop eax
push eax
call fcn.004416a0
pop edx
add eax, edx
jmp 0x41762a
push edx
call fcn.00485f70
pop edx
push eax
push edx
call fcn.00485f70
pop edx
push eax
mov eax, 0x55d54c
push eax
push dword [esp + 0x18]
call fcn.00484170
lea eax, [esp + 0x10]
push eax
call fcn.00486010
push edx
call fcn.00485f70
pop edx
push eax
push edx
call fcn.00485f70
pop edx
push eax
mov eax, 0x55d4a2
push eax
mov eax, 0x56e9fc
push eax
push dword [esp + 0x1c]
call fcn.004844d0
lea eax, [esp + 0x10]
push eax
call fcn.00486010
mov eax, 0x56e9fc
push eax
push dword [esp + 0x10]
call fcn.004838a0
mov ebx, eax
and ebx, ebx
jne 0x41755e
push edx
call fcn.00485f70
pop edx
push eax
push edx
call fcn.00485f70
pop edx
push eax
push 1
push dword [esp + 0x18]
call fcn.00483ee0
call fcn.004860a0
mov edx, 0x55d4a2
pop ecx
push ecx
call fcn.004416e0
mov ecx, eax
call fcn.00441660
je 0x417602
push edx
call fcn.00485f70
pop edx
push eax
push edx
call fcn.00485f70
pop edx
push eax
push 2
push dword [esp + 0x18]
call fcn.00483950
lea eax, [esp + 0x10]
push eax
call fcn.00486010
mov edx, dword [esp + 0xc]
push edx
call fcn.00485f70
pop edx
push eax
push edx
call fcn.00485fb0
pop eax
push eax
call fcn.004416a0
pop edx
add eax, edx
jmp 0x41762a
push dword [esp + 0xc]
call fcn.00486170
push dword [esp]
call fcn.00486170
push dword [esp + 4]
call fcn.00486170
push dword [esp + 0x18]
call fcn.00486170
add esp, 0x2c
pop ebx
ret 8