Function at 0x4058a8
Capabilities:
Query environment variable

Disassembly:
push ebx
mov edx, 0xb
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x4058ae
call fcn.00431250
push dword [esp + 0x3c]
call fcn.004176d0
mov edx, dword [esp + 0x34]
lea ecx, [esp]
call fcn.00417000
push edx
call fcn.004310e0
pop edx
push eax
push edx
call fcn.004310e0
pop edx
push eax
push 0x1f4
call fcn.0042e920
lea eax, [esp + 8]
push eax
call fcn.00431180
push 0x1f4
mov eax, dword [esp + 8]
push eax
mov eax, str.WINDIR
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
mov ebx, dword [esp + 0x38]
and ebx, ebx
jle 0x4059b7
push edx
call fcn.004310e0
pop edx
push eax
push 0x2e
mov edx, dword [esp + 0xc]
push edx
call fcn.004310e0
pop edx
push eax
push edx
call fcn.00431120
mov edx, str.System32
push edx
call fcn.00431120
call fcn.00431310
push edx
call fcn.004310e0
pop edx
push eax
mov edx, str.__c_wmic
push edx
call fcn.00431120
mov edx, dword [esp + 0x10]
push edx
call fcn.00431120
call fcn.00431310
mov edx, dword [0x9340b8]
push edx
call fcn.004310e0
pop edx
push eax
push edx
call fcn.00431120
mov edx, 0x4c186e
push edx
call fcn.00431120
call fcn.004176b2
add dword [esp], edx
call fcn.004176b2
add dword [esp + 4], edx
call fcn.004176b2
add dword [esp + 8], edx
call fcn.0041913f
call fcn.004176d0
mov dword [esp + 8], eax
jmp 0x405a5a
push edx
call fcn.004310e0
pop edx
push eax
push 0x2e
mov edx, dword [esp + 0xc]
push edx
call fcn.004310e0
pop edx
push eax
push edx
call fcn.00431120
mov edx, str.System32
push edx
call fcn.00431120
call fcn.00431310
push edx
call fcn.004310e0
pop edx
push eax
mov edx, str.__c_wmic
push edx
call fcn.00431120
mov edx, dword [esp + 0x10]
push edx
call fcn.00431120
mov edx, str.__FORMAT:List
push edx
call fcn.00431120
call fcn.00431310
mov edx, dword [0x9340b8]
push edx
call fcn.004310e0
pop edx
push eax
push edx
call fcn.00431120
mov edx, 0x4c186e
push edx
call fcn.00431120
call fcn.004176b2
add dword [esp], edx
call fcn.004176b2
add dword [esp + 4], edx
call fcn.004176b2
add dword [esp + 8], edx
call fcn.0041913f
call fcn.004176d0
mov dword [esp + 8], eax
mov edx, 0x4bd028
lea ecx, [esp + 0xc]
call fcn.00417008
cmp dword [esp + 8], 0
je 0x405d60
push 0x9c40
call fcn.0042ff50
mov dword [esp + 0x10], eax
push dword [esp + 8]
call fcn.004196a4
and eax, eax
je 0x405d34
push dword [esp + 8]
call fcn.004196eb
mov dword [esp + 0x14], eax
cmp dword [esp + 0x14], 0
je 0x405cff
push dword [esp + 0x14]
push dword [esp + 0x14]
push dword [esp + 0x10]
call fcn.00419711
mov dword [esp + 0x14], eax
cmp dword [esp + 0x14], 0
je 0x405cff
push edx
call fcn.004310e0
pop edx
push eax
push edx
call fcn.004310e0
pop edx
push eax
push 0x18
push dword [esp + 0x20]
push dword [esp + 0x20]
call fcn.00430150
lea eax, [esp + 0x1c]
push eax
call fcn.00431180
push dword [esp + 0x18]
call fcn.0042eee0
mov ebx, eax
add ebx, 4
push ebx
call fcn.0042ff50
mov dword [esp + 0x1c], eax
push dword [esp + 0x18]
call fcn.0042eee0
mov ebx, eax
add ebx, 4
push ebx
call fcn.0042ff50
mov dword [esp + 0x20], eax
push 0x18
push 0xffffffff
push dword [esp + 0x20]
push dword [esp + 0x28]
call fcn.0042ff70
push dword [esp + 0x20]
push dword [esp + 0x20]
call sub.USER32.dll_OemToCharW
mov dword [esp + 0x24], 0
jmp 0x405b54
push dword [esp + 0x18]
call fcn.0042eee0
mov ebx, eax
add ebx, 4
cmp ebx, dword [esp + 0x24]
jl 0x405c99
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
push ebx
call fcn.004300c0
mov ebx, eax
cmp ebx, 0x6a
jne 0x405b9e
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
inc ebx
push ebx
call fcn.004300c0
mov ebx, eax
cmp ebx, 0x26
jne 0x405b9e
mov eax, 1
jmp 0x405ba0
xor eax, eax
and eax, eax
je 0x405bcb
push 0xd
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
push ebx
call fcn.004300d0
push 0
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
inc ebx
push ebx
call fcn.004300d0
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
push ebx
call fcn.004300c0
mov ebx, eax
cmp ebx, 0xd9
jne 0x405c00
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
inc ebx
push ebx
call fcn.004300c0
mov ebx, eax
cmp ebx, 0x25
jne 0x405c00
mov eax, 1
jmp 0x405c02
xor eax, eax
and eax, eax
je 0x405c2d
push 0xa
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
push ebx
call fcn.004300d0
push 0
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
inc ebx
push ebx
call fcn.004300d0
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
push ebx
call fcn.004300c0
mov ebx, eax
cmp ebx, 0xcb
jne 0x405c62
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
inc ebx
push ebx
call fcn.004300c0
mov ebx, eax
cmp ebx, 0x25
jne 0x405c62
mov eax, 1
jmp 0x405c64
xor eax, eax
and eax, eax
je 0x405c8f
push 9
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
push ebx
call fcn.004300d0
push 0
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
inc ebx
push ebx
call fcn.004300d0
inc dword [esp + 0x24]
jno 0x405b54
push edx
call fcn.004310e0
pop edx
push eax
push edx
call fcn.004310e0
pop edx
push eax
push dword [esp + 0x28]
call fcn.004300e0
lea eax, [esp + 0x1c]
push eax
call fcn.00431180
push dword [esp + 0x1c]
call fcn.00430130
push dword [esp + 0x20]
call fcn.00430130
mov edx, dword [esp + 0xc]
push edx
call fcn.004310e0
pop edx
push eax
push edx
call fcn.00431120
mov edx, dword [esp + 0x1c]
push edx
call fcn.00431120
mov edx, 0x4c21c0
push edx
call fcn.00431120
lea eax, [esp + 0x10]
push eax
call fcn.00431180
push dword [0x934094]
call fcn.0042114b
and eax, eax
je 0x405d2f
call fcn.00420d42
and eax, eax
je 0x405d19
jmp 0x405d0e
call fcn.00420d42
and eax, eax
je 0x405d24
jmp 0x405d19
call fcn.00420d42
and eax, eax
je 0x405d2f
jmp 0x405d24
jmp 0x405a81
push dword [esp + 0x10]
call fcn.00430130
push dword [esp + 8]
call fcn.0041976b
and eax, eax
je 0x405d60
push dword [esp + 8]
call fcn.004197a2
mov dword [esp + 0x28], eax
push dword [esp + 8]
call fcn.004197c2
mov ebx, dword [esp + 0x38]
and ebx, ebx
jle 0x405d98
push edx
call fcn.004310e0
pop edx
push eax
push edx
call fcn.004310e0
pop edx
push eax
mov eax, dword [esp + 0x30]
cdq
push edx
push eax
call fcn.0042ef10
pop eax
push eax
call fcn.004176a0
pop edx
add eax, edx
jmp 0x405e8d
push edx
call fcn.004310e0
pop edx
push eax
push edx
call fcn.004310e0
pop edx
push eax
mov eax, 0x4bd186
push eax
push dword [esp + 0x18]
call fcn.0042f520
lea eax, [esp + 0x10]
push eax
call fcn.00431180
push edx
call fcn.004310e0
pop edx
push eax
push edx
call fcn.004310e0
pop edx
push eax
mov eax, 0x4bd152
push eax
mov eax, 0x4c0ff6
push eax
push dword [esp + 0x1c]
call fcn.0042f880
lea eax, [esp + 0x10]
push eax
call fcn.00431180
mov eax, 0x4c0ff6
push eax
push dword [esp + 0x10]
call fcn.0042ea30
mov ebx, eax
and ebx, ebx
jne 0x405dc1
push edx
call fcn.004310e0
pop edx
push eax
push edx
call fcn.004310e0
pop edx
push eax
push 1
push dword [esp + 0x18]
call fcn.0042f8a0
call fcn.00431310
mov edx, 0x4bd152
pop ecx
push ecx
call fcn.004176e0
mov ecx, eax
call fcn.00417660
je 0x405e65
push edx
call fcn.004310e0
pop edx
push eax
push edx
call fcn.004310e0
pop edx
push eax
push 2
push dword [esp + 0x18]
call fcn.0042eae0
lea eax, [esp + 0x10]
push eax
call fcn.00431180
mov edx, dword [esp + 0xc]
push edx
call fcn.004310e0
pop edx
push eax
push edx
call fcn.00431120
pop eax
push eax
call fcn.004176a0
pop edx
add eax, edx
jmp 0x405e8d
push dword [esp + 0xc]
call fcn.004312e0
push dword [esp]
call fcn.004312e0
push dword [esp + 4]
call fcn.004312e0
push dword [esp + 0x18]
call fcn.004312e0
add esp, 0x2c
pop ebx
ret 8