Function at 0x4feef0
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x2004
call fcn.0051dcc0
mov eax, dword [0x572844]
xor eax, esp
mov dword [esp + 0x2000], eax
mov eax, dword [esp + 0x2008]
push ebx
mov ebx, dword [esp + 0x2010]
push ebp
mov eax, dword [eax]
mov ebp, dword [esp + 0x2024]
push esi
push edi
mov edi, dword [esp + 0x2024]
cmp eax, 0xf
ja case.default.0x4fef33
jmp dword [eax*4 + 0x4ff68c]
mov esi, dword [esp + 0x2028]
push esi
push 0x54266c
push edi
push str.TaskbarGroupIcon
push str.Applications_avpui.exe
push SysReAllocString
call fcn.004c2ff0
push esi
push str.avp.com
push edi
call fcn.00495960
push 1
push 1
push str.SCAN
push dword [esp + 0x203c]
push ebp
push edi
push dword [esp + 0x2038]
push ebx
push str.Kaspersky_Anti_Virus
call fcn.004ff6d0
test al, al
jne 0x4ff666
push esi
push 0x54266c
push edi
push 0x54266c
push str.AVP_shellopencommand
push SysReAllocString
call fcn.004c2ff0
cmp word [edi], 0x22
jne 0x4fefcd
lea eax, [edi + 2]
push 0x22
push eax
call fcn.0051f225
add esp, 8
test eax, eax
je 0x4fefcd
xor ecx, ecx
mov word [eax + 2], cx
push esi
push str.avp.com
push edi
call fcn.00495960
push 1
push 1
push str.SCAN
push dword [esp + 0x203c]
push ebp
push edi
push dword [esp + 0x2038]
push ebx
push str.Kaspersky_Anti_Virus
jmp 0x4ff563
mov esi, dword [esp + 0x2028]
push esi
push 0x54266c
push edi
push 0x54266c
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsDrweb32w.exe
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004c2ff0
cmp word [edi], 0
jne 0x4ff03b
push esi
push 0x54266c
push edi
push str.ExePath
push str.SoftwareIDAVLABDrweb32w
call fcn.004c3190
push 1
push 0
push str._AL__SS___SD__SHELL
push dword [esp + 0x203c]
push ebp
push edi
push dword [esp + 0x2038]
push ebx
push str.Dr.Web
jmp 0x4ff563
push dword [esp + 0x2028]
push 0x54266c
push edi
push 0x54266c
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsNavw32.exe
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004c2ff0
push 1
push 0
push 0
push dword [esp + 0x203c]
push ebp
push edi
push dword [esp + 0x2038]
push ebx
push str.Norton_AntiVirus
jmp 0x4ff563
push dword [esp + 0x2028]
push 0x54266c
push edi
push str.szScannerExe
push str.SOFTWARENetwork_AssociatesTVDVirusScanAVConsolGeneral
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004c2ff0
push 1
push 0
push 0
push dword [esp + 0x203c]
push ebp
push edi
push dword [esp + 0x2038]
push ebx
push str.McAfee_VirusScan
jmp 0x4ff563
mov esi, dword [esp + 0x2028]
push esi
push 0x54266c
push edi
push str.InstallLocation
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallEAAAB119_D0BF_4FF4_B6F0_B6FB0393921A
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004c2ff0
push esi
push edi
call fcn.00493970
push esi
push str.scanner.exe
push edi
call fcn.004b0300
push 1
push 0
push str._nostartup
push dword [esp + 0x203c]
push ebp
push edi
push dword [esp + 0x2038]
push ebx
push str.Stop__Scanner
jmp 0x4ff563
mov esi, dword [esp + 0x2028]
push esi
push 0x54266c
push edi
push 0x545f7c
push str.SOFTWAREData_FellowsF_SecureAnti_Virus
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004c2ff0
push esi
push edi
call fcn.00493970
push esi
push str.fsav.exe
push edi
call fcn.004b0300
push 1
push 0
push str._BEEP__NOBOOT
push dword [esp + 0x203c]
push ebp
push edi
push dword [esp + 0x2038]
push ebx
push str.F_Secure_Anti_Virus
jmp 0x4ff563
mov esi, dword [esp + 0x2028]
push esi
push 0x54266c
push edi
push 0x545f7c
push str.SOFTWARESophosSweepNT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004c2ff0
push esi
push edi
call fcn.00493970
push esi
push str.sav32cli.exe
push edi
call fcn.004b0300
push 1
push 0
push 0
push dword [esp + 0x203c]
push ebp
push edi
push dword [esp + 0x2038]
push ebx
push str.Sophos_Anti_Virus
jmp 0x4ff563
mov esi, dword [esp + 0x2028]
push esi
push 0x54266c
push edi
push 0x54266c
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsAVGSE.DLL
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004c2ff0
push 2
push 0x542900
push edi
call fcn.00495900
push 1
push 0
push 0
push dword [esp + 0x203c]
push ebp
push edi
push dword [esp + 0x2038]
push ebx
push str.AVG_Anti_Virus
call fcn.004ff6d0
test al, al
jne 0x4ff666
push esi
push str.avgw.exe
push edi
call fcn.00495960
push 1
push 1
push 0x556c34
push dword [esp + 0x203c]
push ebp
push edi
push dword [esp + 0x2038]
push ebx
push str.AVG_Anti_Virus
call fcn.004ff6d0
test al, al
jne 0x4ff666
push esi
push str.avgscanx.exe
push edi
call fcn.00495960
push 0
push 1
push str._SCAN
push dword [esp + 0x203c]
push ebp
push edi
push dword [esp + 0x2038]
push ebx
push str.AVG_Anti_Virus
call fcn.004ff6d0
test al, al
jne 0x4ff666
push esi
push str.avgscana.exe
push edi
call fcn.00495960
push 0
push 1
push str._SCAN
push dword [esp + 0x203c]
push ebp
push edi
push dword [esp + 0x2038]
push ebx
push str.AVG_Anti_Virus
jmp 0x4ff563
push dword [esp + 0x2028]
push 0x54266c
push edi
push 0x54266c
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths_vet32.exe
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004c2ff0
push 1
push 0
push str._sub__nobootscan__nomemoryscan
push dword [esp + 0x203c]
push ebp
push edi
push dword [esp + 0x2038]
push ebx
push str.eTrust_EZ_Antivirus
jmp 0x4ff563
mov esi, dword [esp + 0x2028]
push esi
push 0x54266c
push edi
push str.InstallDir
push str.SOFTWAREESetNODCurrentVersionInfo
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004c2ff0
push esi
push edi
call fcn.00493970
push esi
push str.nod32.exe
push edi
call fcn.004b0300
push 1
push 0
push str._scanfile__scanboot___scanmbr_
push dword [esp + 0x203c]
push ebp
push edi
push dword [esp + 0x2038]
push ebx
push str.NOD32_Antivirus
jmp 0x4ff563
mov esi, dword [esp + 0x2028]
push esi
push 0x54266c
push edi
push str.UninstallString
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallClamAV
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004c2ff0
push esi
push str.binclamscan.exe
push edi
call fcn.00495960
push 1
push 0
push str.__infected___recursive
push dword [esp + 0x203c]
push ebp
push edi
push dword [esp + 0x2038]
push ebx
push str.Clam_AntiVirus
jmp 0x4ff563
mov esi, dword [esp + 0x2028]
push esi
push 0x54266c
push edi
push 0x54266c
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsAvastUI.exe
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004c2ff0
cmp word [edi], 0
jne 0x4ff416
push esi
push 0x54266c
push edi
push 0x54266c
push str.CLSID472083B0_C522_11CF_8763_00608CC02F24InProcServer32
push SysReAllocString
call fcn.004c2ff0
push esi
push str.ashQuick.exe
push edi
call fcn.00495960
push 1
push 0
push 0
push dword [esp + 0x203c]
push ebp
push edi
push dword [esp + 0x2038]
push ebx
push str.avast__Antivirus
jmp 0x4ff563
push 0x800
push 0x54266c
lea eax, [esp + 0x18]
push eax
push str.AppID
push str.AppIDKVSrvXP.exe
push SysReAllocString
call fcn.004c2ff0
cmp word [esp + 0x10], 0
je 0x4ff570
lea eax, [esp + 0x10]
push eax
push str.CLSID_sInprocServer32
lea eax, [esp + 0x1018]
push 0x800
push eax
call fcn.00402c90
mov esi, dword [esp + 0x2038]
lea eax, [esp + 0x1020]
add esp, 0x10
push esi
push 0x54266c
push edi
push 0x54266c
push eax
push SysReAllocString
call fcn.004c2ff0
push esi
push str.KVScan.kxp
push edi
call fcn.00495960
push 1
push 0
push 0
push dword [esp + 0x203c]
push ebp
push edi
push dword [esp + 0x2038]
push ebx
push str.Jiangmin_AntiVirus
jmp 0x4ff563
push 0x800
push 0x54266c
lea eax, [esp + 0x18]
push eax
push str.ImagePath
push str.SYSTEMCurrentControlSetServices_avgntflt
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004c2ff0
push 4
lea eax, [esp + 0x14]
push 0x5520b8
push eax
call fcn.00526778
add esp, 0xc
test eax, eax
lea eax, [esp + 0x18]
je 0x4ff526
lea eax, [esp + 0x10]
mov esi, dword [esp + 0x2028]
push esi
push eax
push edi
call fcn.005267b2
add esp, 0xc
push esi
push str.avcmd.exe
push edi
call fcn.00495960
push 1
push 0
push str._s__noboot__nombr
push dword [esp + 0x203c]
push ebp
push edi
push dword [esp + 0x2038]
push ebx
push str.Avira_AntiVir
call fcn.004ff6d0
test al, al
jne 0x4ff666
mov eax, 1
jmp 0x4ff66f
mov esi, dword [esp + 0x2028]
push esi
push edi
push str._ProgramFiles_Windows_DefenderMpCmdRun.exe
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x4ff5c2
cmp eax, esi
jae 0x4ff5c2
push 1
push 1
push str._Scan__ScanType_3__File
push dword [esp + 0x203c]
push ebp
push edi
push dword [esp + 0x2038]
push ebx
push str.Windows_Defender
call fcn.004ff6d0
test al, al
jne 0x4ff666
push esi
push 0x54266c
push edi
push 0x54266c
push str.windowsdefenderDefaultIcon
push SysReAllocString
call fcn.004c2ff0
push esi
push str.MpCmdRun.exe
push edi
call fcn.00495960
push 1
push 1
push str._Scan__ScanType_3__File
push dword [esp + 0x203c]
push ebp
push edi
push dword [esp + 0x2038]
push ebx
push str.Windows_Defender
call fcn.004ff6d0
xor ecx, ecx
test al, al
sete cl
mov eax, ecx
jmp 0x4ff66f
push dword [esp + 0x2020]
push 0x544
call fcn.004a9c90
push eax
push ebx
call fcn.004b0360
push dword [esp + 0x2028]
push 0x54266c
push edi
push 0x5521a4
push str.VirusScan
call fcn.004c3190
push 0x800
push 0x54266c
push ebp
push str.Param
push str.VirusScan
call fcn.004c3190
xor eax, eax
jmp 0x4ff66f
mov eax, 2
mov ecx, dword [esp + 0x2010]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0051dca8
add esp, 0x2004
ret 0x1c