Function at 0x41b5ba
Capabilities:
Query environment variable

Disassembly:
push ebx
mov edx, 0xb
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x41b5c0
call fcn.00487690
push dword [esp + 0x3c]
call fcn.004426d0
mov edx, dword [esp + 0x34]
lea ecx, [esp]
call fcn.00442000
push edx
call fcn.004874f0
pop edx
push eax
push edx
call fcn.004874f0
pop edx
push eax
push 0x1f4
call fcn.00484bf0
lea eax, [esp + 8]
push eax
call fcn.00487590
push 0x1f4
mov eax, dword [esp + 8]
push eax
mov eax, str.WINDIR
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
mov ebx, dword [esp + 0x38]
and ebx, ebx
jle 0x41b67a
push edx
call fcn.004874f0
pop edx
push eax
push 0x2e
mov edx, dword [esp + 0xc]
push edx
call fcn.004874f0
pop edx
push eax
push edx
call fcn.00487530
mov edx, str.System32
push edx
call fcn.00487530
call fcn.00487620
push dword [esp + 0xc]
mov eax, str.wmic.exe
push eax
call fcn.004426b2
add dword [esp + 8], edx
call fcn.0045ecee
call fcn.004426d0
mov dword [esp + 8], eax
jmp 0x41b6f1
push edx
call fcn.004874f0
pop edx
push eax
push 0x2e
mov edx, dword [esp + 0xc]
push edx
call fcn.004874f0
pop edx
push eax
push edx
call fcn.00487530
mov edx, str.System32
push edx
call fcn.00487530
call fcn.00487620
mov edx, dword [esp + 0xc]
push edx
call fcn.004874f0
pop edx
push eax
push edx
call fcn.00487530
mov edx, str.__FORMAT:List
push edx
call fcn.00487530
call fcn.00487620
mov eax, str.wmic.exe
push eax
call fcn.004426b2
add dword [esp + 4], edx
call fcn.004426b2
add dword [esp + 8], edx
call fcn.0045ecee
call fcn.004426d0
mov dword [esp + 8], eax
mov edx, 0x55a098
lea ecx, [esp + 0xc]
call fcn.00442008
cmp dword [esp + 8], 0
je 0x41b9f7
push 0x9c40
call fcn.00486310
mov dword [esp + 0x10], eax
push dword [esp + 8]
call fcn.0045f24c
and eax, eax
je 0x41b9cb
push dword [esp + 8]
call fcn.0045f293
mov dword [esp + 0x14], eax
cmp dword [esp + 0x14], 0
je 0x41b996
push dword [esp + 0x14]
push dword [esp + 0x14]
push dword [esp + 0x10]
call fcn.0045f37a
mov dword [esp + 0x14], eax
cmp dword [esp + 0x14], 0
je 0x41b996
push edx
call fcn.004874f0
pop edx
push eax
push edx
call fcn.004874f0
pop edx
push eax
push 0x18
push dword [esp + 0x20]
push dword [esp + 0x20]
call fcn.00486510
lea eax, [esp + 0x1c]
push eax
call fcn.00487590
push dword [esp + 0x18]
call fcn.004851d0
mov ebx, eax
add ebx, 4
push ebx
call fcn.00486310
mov dword [esp + 0x1c], eax
push dword [esp + 0x18]
call fcn.004851d0
mov ebx, eax
add ebx, 4
push ebx
call fcn.00486310
mov dword [esp + 0x20], eax
push 0x18
push 0xffffffff
push dword [esp + 0x20]
push dword [esp + 0x28]
call fcn.00486350
push dword [esp + 0x20]
push dword [esp + 0x20]
call sub.USER32.dll_OemToCharW
mov dword [esp + 0x24], 0
jmp 0x41b7eb
push dword [esp + 0x18]
call fcn.004851d0
mov ebx, eax
add ebx, 4
cmp ebx, dword [esp + 0x24]
jl 0x41b930
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
push ebx
call fcn.004864a0
mov ebx, eax
cmp ebx, 0x6a
jne 0x41b835
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
inc ebx
push ebx
call fcn.004864a0
mov ebx, eax
cmp ebx, 0x26
jne 0x41b835
mov eax, 1
jmp 0x41b837
xor eax, eax
and eax, eax
je 0x41b862
push 0xd
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
push ebx
call fcn.004864b0
push 0
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
inc ebx
push ebx
call fcn.004864b0
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
push ebx
call fcn.004864a0
mov ebx, eax
cmp ebx, 0xd9
jne 0x41b897
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
inc ebx
push ebx
call fcn.004864a0
mov ebx, eax
cmp ebx, 0x25
jne 0x41b897
mov eax, 1
jmp 0x41b899
xor eax, eax
and eax, eax
je 0x41b8c4
push 0xa
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
push ebx
call fcn.004864b0
push 0
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
inc ebx
push ebx
call fcn.004864b0
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
push ebx
call fcn.004864a0
mov ebx, eax
cmp ebx, 0xcb
jne 0x41b8f9
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
inc ebx
push ebx
call fcn.004864a0
mov ebx, eax
cmp ebx, 0x25
jne 0x41b8f9
mov eax, 1
jmp 0x41b8fb
xor eax, eax
and eax, eax
je 0x41b926
push 9
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
push ebx
call fcn.004864b0
push 0
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
inc ebx
push ebx
call fcn.004864b0
inc dword [esp + 0x24]
jno 0x41b7eb
push edx
call fcn.004874f0
pop edx
push eax
push edx
call fcn.004874f0
pop edx
push eax
push dword [esp + 0x28]
call fcn.004864c0
lea eax, [esp + 0x1c]
push eax
call fcn.00487590
push dword [esp + 0x1c]
call fcn.00486330
push dword [esp + 0x20]
call fcn.00486330
mov edx, dword [esp + 0xc]
push edx
call fcn.004874f0
pop edx
push eax
push edx
call fcn.00487530
mov edx, dword [esp + 0x1c]
push edx
call fcn.00487530
mov edx, 0x571962
push edx
call fcn.00487530
lea eax, [esp + 0x10]
push eax
call fcn.00487590
push dword [0xa62a24]
call fcn.0046b5d3
and eax, eax
je 0x41b9c6
call fcn.0046bae6
and eax, eax
je 0x41b9b0
jmp 0x41b9a5
call fcn.0046bae6
and eax, eax
je 0x41b9bb
jmp 0x41b9b0
call fcn.0046bae6
and eax, eax
je 0x41b9c6
jmp 0x41b9bb
jmp 0x41b718
push dword [esp + 0x10]
call fcn.00486330
push dword [esp + 8]
call fcn.0045f3d4
and eax, eax
je 0x41b9f7
push dword [esp + 8]
call fcn.0045f304
mov dword [esp + 0x28], eax
push dword [esp + 8]
call fcn.0045f324
mov ebx, dword [esp + 0x38]
and ebx, ebx
jle 0x41ba2f
push edx
call fcn.004874f0
pop edx
push eax
push edx
call fcn.004874f0
pop edx
push eax
mov eax, dword [esp + 0x30]
cdq
push edx
push eax
call fcn.00484fe0
pop eax
push eax
call fcn.004426a0
pop edx
add eax, edx
jmp 0x41bb24
push edx
call fcn.004874f0
pop edx
push eax
push edx
call fcn.004874f0
pop edx
push eax
mov eax, 0x55a55c
push eax
push dword [esp + 0x18]
call fcn.00485bf0
lea eax, [esp + 0x10]
push eax
call fcn.00487590
push edx
call fcn.004874f0
pop edx
push eax
push edx
call fcn.004874f0
pop edx
push eax
mov eax, 0x55a4b2
push eax
mov eax, 0x56bce2
push eax
push dword [esp + 0x1c]
call fcn.004859d0
lea eax, [esp + 0x10]
push eax
call fcn.00487590
mov eax, 0x56bce2
push eax
push dword [esp + 0x10]
call fcn.00484ee0
mov ebx, eax
and ebx, ebx
jne 0x41ba58
push edx
call fcn.004874f0
pop edx
push eax
push edx
call fcn.004874f0
pop edx
push eax
push 1
push dword [esp + 0x18]
call fcn.00485c10
call fcn.00487620
mov edx, 0x55a4b2
pop ecx
push ecx
call fcn.004426e0
mov ecx, eax
call fcn.00442660
je 0x41bafc
push edx
call fcn.004874f0
pop edx
push eax
push edx
call fcn.004874f0
pop edx
push eax
push 2
push dword [esp + 0x18]
call fcn.00484f90
lea eax, [esp + 0x10]
push eax
call fcn.00487590
mov edx, dword [esp + 0xc]
push edx
call fcn.004874f0
pop edx
push eax
push edx
call fcn.00487530
pop eax
push eax
call fcn.004426a0
pop edx
add eax, edx
jmp 0x41bb24
push dword [esp + 0xc]
call fcn.004876f0
push dword [esp]
call fcn.004876f0
push dword [esp + 4]
call fcn.004876f0
push dword [esp + 0x18]
call fcn.004876f0
add esp, 0x2c
pop ebx
ret 8