Function at 0x41b4e8
Capabilities:
Query environment variable

Disassembly:
push ebx
mov edx, 0xb
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x41b4ee
call fcn.0047f360
push dword [esp + 0x3c]
call fcn.0043d330
mov edx, dword [esp + 0x34]
lea ecx, [esp]
call fcn.0043d000
push edx
call fcn.0047f1c0
pop edx
push eax
push edx
call fcn.0047f1c0
pop edx
push eax
push 0x1f4
call fcn.0047cca0
lea eax, [esp + 8]
push eax
call fcn.0047f260
push 0x1f4
mov eax, dword [esp + 8]
push eax
mov eax, str.WINDIR
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
mov ebx, dword [esp + 0x38]
and ebx, ebx
jle 0x41b5a8
push edx
call fcn.0047f1c0
pop edx
push eax
push 0x2e
mov edx, dword [esp + 0xc]
push edx
call fcn.0047f1c0
pop edx
push eax
push edx
call fcn.0047f200
mov edx, 0x5481dc
push edx
call fcn.0047f200
call fcn.0047f2f0
push dword [esp + 0xc]
mov eax, str.wmic.exe
push eax
call fcn.0043d312
add dword [esp + 8], edx
call fcn.0045981e
call fcn.0043d330
mov dword [esp + 8], eax
jmp 0x41b61f
push edx
call fcn.0047f1c0
pop edx
push eax
push 0x2e
mov edx, dword [esp + 0xc]
push edx
call fcn.0047f1c0
pop edx
push eax
push edx
call fcn.0047f200
mov edx, 0x5481dc
push edx
call fcn.0047f200
call fcn.0047f2f0
mov edx, dword [esp + 0xc]
push edx
call fcn.0047f1c0
pop edx
push eax
push edx
call fcn.0047f200
mov edx, str.__FORMAT:List
push edx
call fcn.0047f200
call fcn.0047f2f0
mov eax, str.wmic.exe
push eax
call fcn.0043d312
add dword [esp + 4], edx
call fcn.0043d312
add dword [esp + 8], edx
call fcn.0045981e
call fcn.0043d330
mov dword [esp + 8], eax
mov edx, 0x53c098
lea ecx, [esp + 0xc]
call fcn.0043d008
cmp dword [esp + 8], 0
je 0x41b925
push 0x9c40
call fcn.0047e080
mov dword [esp + 0x10], eax
push dword [esp + 8]
call fcn.00459d83
and eax, eax
je 0x41b8f9
push dword [esp + 8]
call fcn.00459dca
mov dword [esp + 0x14], eax
cmp dword [esp + 0x14], 0
je 0x41b8c4
push dword [esp + 0x14]
push dword [esp + 0x14]
push dword [esp + 0x10]
call fcn.00459e7f
mov dword [esp + 0x14], eax
cmp dword [esp + 0x14], 0
je 0x41b8c4
push edx
call fcn.0047f1c0
pop edx
push eax
push edx
call fcn.0047f1c0
pop edx
push eax
push 0x18
push dword [esp + 0x20]
push dword [esp + 0x20]
call fcn.0047e280
lea eax, [esp + 0x1c]
push eax
call fcn.0047f260
push dword [esp + 0x18]
call fcn.0047d270
mov ebx, eax
add ebx, 4
push ebx
call fcn.0047e080
mov dword [esp + 0x1c], eax
push dword [esp + 0x18]
call fcn.0047d270
mov ebx, eax
add ebx, 4
push ebx
call fcn.0047e080
mov dword [esp + 0x20], eax
push 0x18
push 0xffffffff
push dword [esp + 0x20]
push dword [esp + 0x28]
call fcn.0047e0c0
push dword [esp + 0x20]
push dword [esp + 0x20]
call sub.USER32.dll_OemToCharW
mov dword [esp + 0x24], 0
jmp 0x41b719
push dword [esp + 0x18]
call fcn.0047d270
mov ebx, eax
add ebx, 4
cmp ebx, dword [esp + 0x24]
jl 0x41b85e
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
push ebx
call fcn.0047e210
mov ebx, eax
cmp ebx, 0x6a
jne 0x41b763
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
inc ebx
push ebx
call fcn.0047e210
mov ebx, eax
cmp ebx, 0x26
jne 0x41b763
mov eax, 1
jmp 0x41b765
xor eax, eax
and eax, eax
je 0x41b790
push 0xd
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
push ebx
call fcn.0047e220
push 0
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
inc ebx
push ebx
call fcn.0047e220
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
push ebx
call fcn.0047e210
mov ebx, eax
cmp ebx, 0xd9
jne 0x41b7c5
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
inc ebx
push ebx
call fcn.0047e210
mov ebx, eax
cmp ebx, 0x25
jne 0x41b7c5
mov eax, 1
jmp 0x41b7c7
xor eax, eax
and eax, eax
je 0x41b7f2
push 0xa
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
push ebx
call fcn.0047e220
push 0
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
inc ebx
push ebx
call fcn.0047e220
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
push ebx
call fcn.0047e210
mov ebx, eax
cmp ebx, 0xcb
jne 0x41b827
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
inc ebx
push ebx
call fcn.0047e210
mov ebx, eax
cmp ebx, 0x25
jne 0x41b827
mov eax, 1
jmp 0x41b829
xor eax, eax
and eax, eax
je 0x41b854
push 9
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
push ebx
call fcn.0047e220
push 0
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
inc ebx
push ebx
call fcn.0047e220
inc dword [esp + 0x24]
jno 0x41b719
push edx
call fcn.0047f1c0
pop edx
push eax
push edx
call fcn.0047f1c0
pop edx
push eax
push dword [esp + 0x28]
call fcn.0047e230
lea eax, [esp + 0x1c]
push eax
call fcn.0047f260
push dword [esp + 0x1c]
call fcn.0047e0a0
push dword [esp + 0x20]
call fcn.0047e0a0
mov edx, dword [esp + 0xc]
push edx
call fcn.0047f1c0
pop edx
push eax
push edx
call fcn.0047f200
mov edx, dword [esp + 0x1c]
push edx
call fcn.0047f200
mov edx, 0x551870
push edx
call fcn.0047f200
lea eax, [esp + 0x10]
push eax
call fcn.0047f260
push dword [0x9d7d80]
call fcn.004659bf
and eax, eax
je 0x41b8f4
call fcn.00465ed2
and eax, eax
je 0x41b8de
jmp 0x41b8d3
call fcn.00465ed2
and eax, eax
je 0x41b8e9
jmp 0x41b8de
call fcn.00465ed2
and eax, eax
je 0x41b8f4
jmp 0x41b8e9
jmp 0x41b646
push dword [esp + 0x10]
call fcn.0047e0a0
push dword [esp + 8]
call fcn.00459ed9
and eax, eax
je 0x41b925
push dword [esp + 8]
call fcn.00459e09
mov dword [esp + 0x28], eax
push dword [esp + 8]
call fcn.00459e29
mov ebx, dword [esp + 0x38]
and ebx, ebx
jle 0x41b95d
push edx
call fcn.0047f1c0
pop edx
push eax
push edx
call fcn.0047f1c0
pop edx
push eax
mov eax, dword [esp + 0x30]
cdq
push edx
push eax
call fcn.0047d090
pop eax
push eax
call fcn.0043d300
pop edx
add eax, edx
jmp 0x41ba52
push edx
call fcn.0047f1c0
pop edx
push eax
push edx
call fcn.0047f1c0
pop edx
push eax
mov eax, 0x53c4dc
push eax
push dword [esp + 0x18]
call fcn.0047dc90
lea eax, [esp + 0x10]
push eax
call fcn.0047f260
push edx
call fcn.0047f1c0
pop edx
push eax
push edx
call fcn.0047f1c0
pop edx
push eax
mov eax, 0x53c484
push eax
mov eax, 0x54c1f6
push eax
push dword [esp + 0x1c]
call fcn.0047da70
lea eax, [esp + 0x10]
push eax
call fcn.0047f260
mov eax, 0x54c1f6
push eax
push dword [esp + 0x10]
call fcn.0047cf90
mov ebx, eax
and ebx, ebx
jne 0x41b986
push edx
call fcn.0047f1c0
pop edx
push eax
push edx
call fcn.0047f1c0
pop edx
push eax
push 1
push dword [esp + 0x18]
call fcn.0047dcb0
call fcn.0047f2f0
mov edx, 0x53c484
pop ecx
push ecx
call fcn.0043d340
mov ecx, eax
call fcn.0043d2c0
je 0x41ba2a
push edx
call fcn.0047f1c0
pop edx
push eax
push edx
call fcn.0047f1c0
pop edx
push eax
push 2
push dword [esp + 0x18]
call fcn.0047d040
lea eax, [esp + 0x10]
push eax
call fcn.0047f260
mov edx, dword [esp + 0xc]
push edx
call fcn.0047f1c0
pop edx
push eax
push edx
call fcn.0047f200
pop eax
push eax
call fcn.0043d300
pop edx
add eax, edx
jmp 0x41ba52
push dword [esp + 0xc]
call fcn.0047f3c0
push dword [esp]
call fcn.0047f3c0
push dword [esp + 4]
call fcn.0047f3c0
push dword [esp + 0x18]
call fcn.0047f3c0
add esp, 0x2c
pop ebx
ret 8