Function at 0x405d56
Capabilities:
Query environment variable

Disassembly:
push ebx
mov edx, 0xb
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x405d5c
call fcn.0042f150
push dword [esp + 0x3c]
call fcn.004176e0
mov edx, dword [esp + 0x34]
lea ecx, [esp]
call fcn.00417000
push edx
call fcn.0042efb0
pop edx
push eax
push edx
call fcn.0042efb0
pop edx
push eax
push 0x1f4
call fcn.0042c6b0
lea eax, [esp + 8]
push eax
call fcn.0042f050
push 0x1f4
mov eax, dword [esp + 8]
push eax
mov eax, str.WINDIR
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
mov ebx, dword [esp + 0x38]
and ebx, ebx
jle 0x405e65
push edx
call fcn.0042efb0
pop edx
push eax
push 0x2e
mov edx, dword [esp + 0xc]
push edx
call fcn.0042efb0
pop edx
push eax
push edx
call fcn.0042eff0
mov edx, str.System32
push edx
call fcn.0042eff0
call fcn.0042f0e0
push edx
call fcn.0042efb0
pop edx
push eax
mov edx, str.__c_wmic
push edx
call fcn.0042eff0
mov edx, dword [esp + 0x10]
push edx
call fcn.0042eff0
call fcn.0042f0e0
mov edx, dword [0x5234e8]
push edx
call fcn.0042efb0
pop edx
push eax
push edx
call fcn.0042eff0
mov edx, 0x47f7fa
push edx
call fcn.0042eff0
call fcn.004176c2
add dword [esp], edx
call fcn.004176c2
add dword [esp + 4], edx
call fcn.004176c2
add dword [esp + 8], edx
call fcn.0041902b
call fcn.004176e0
mov dword [esp + 8], eax
jmp 0x405f08
push edx
call fcn.0042efb0
pop edx
push eax
push 0x2e
mov edx, dword [esp + 0xc]
push edx
call fcn.0042efb0
pop edx
push eax
push edx
call fcn.0042eff0
mov edx, str.System32
push edx
call fcn.0042eff0
call fcn.0042f0e0
push edx
call fcn.0042efb0
pop edx
push eax
mov edx, str.__c_wmic
push edx
call fcn.0042eff0
mov edx, dword [esp + 0x10]
push edx
call fcn.0042eff0
mov edx, str.__FORMAT:List
push edx
call fcn.0042eff0
call fcn.0042f0e0
mov edx, dword [0x5234e8]
push edx
call fcn.0042efb0
pop edx
push eax
push edx
call fcn.0042eff0
mov edx, 0x47f7fa
push edx
call fcn.0042eff0
call fcn.004176c2
add dword [esp], edx
call fcn.004176c2
add dword [esp + 4], edx
call fcn.004176c2
add dword [esp + 8], edx
call fcn.0041902b
call fcn.004176e0
mov dword [esp + 8], eax
mov edx, 0x47b028
lea ecx, [esp + 0xc]
call fcn.00417008
cmp dword [esp + 8], 0
je 0x40620e
push 0x9c40
call fcn.0042dd50
mov dword [esp + 0x10], eax
push dword [esp + 8]
call fcn.00419590
and eax, eax
je 0x4061e2
push dword [esp + 8]
call fcn.004195d7
mov dword [esp + 0x14], eax
cmp dword [esp + 0x14], 0
je 0x4061ad
push dword [esp + 0x14]
push dword [esp + 0x14]
push dword [esp + 0x10]
call fcn.004195fd
mov dword [esp + 0x14], eax
cmp dword [esp + 0x14], 0
je 0x4061ad
push edx
call fcn.0042efb0
pop edx
push eax
push edx
call fcn.0042efb0
pop edx
push eax
push 0x18
push dword [esp + 0x20]
push dword [esp + 0x20]
call fcn.0042df50
lea eax, [esp + 0x1c]
push eax
call fcn.0042f050
push dword [esp + 0x18]
call fcn.0042cd60
mov ebx, eax
add ebx, 4
push ebx
call fcn.0042dd50
mov dword [esp + 0x1c], eax
push dword [esp + 0x18]
call fcn.0042cd60
mov ebx, eax
add ebx, 4
push ebx
call fcn.0042dd50
mov dword [esp + 0x20], eax
push 0x18
push 0xffffffff
push dword [esp + 0x20]
push dword [esp + 0x28]
call fcn.0042dda0
push dword [esp + 0x20]
push dword [esp + 0x20]
call sub.USER32.dll_OemToCharW
mov dword [esp + 0x24], 0
jmp 0x406002
push dword [esp + 0x18]
call fcn.0042cd60
mov ebx, eax
add ebx, 4
cmp ebx, dword [esp + 0x24]
jl 0x406147
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
push ebx
call fcn.0042dd70
mov ebx, eax
cmp ebx, 0x6a
jne 0x40604c
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
inc ebx
push ebx
call fcn.0042dd70
mov ebx, eax
cmp ebx, 0x26
jne 0x40604c
mov eax, 1
jmp 0x40604e
xor eax, eax
and eax, eax
je 0x406079
push 0xd
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
push ebx
call fcn.0042def0
push 0
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
inc ebx
push ebx
call fcn.0042def0
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
push ebx
call fcn.0042dd70
mov ebx, eax
cmp ebx, 0xd9
jne 0x4060ae
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
inc ebx
push ebx
call fcn.0042dd70
mov ebx, eax
cmp ebx, 0x25
jne 0x4060ae
mov eax, 1
jmp 0x4060b0
xor eax, eax
and eax, eax
je 0x4060db
push 0xa
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
push ebx
call fcn.0042def0
push 0
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
inc ebx
push ebx
call fcn.0042def0
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
push ebx
call fcn.0042dd70
mov ebx, eax
cmp ebx, 0xcb
jne 0x406110
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
inc ebx
push ebx
call fcn.0042dd70
mov ebx, eax
cmp ebx, 0x25
jne 0x406110
mov eax, 1
jmp 0x406112
xor eax, eax
and eax, eax
je 0x40613d
push 9
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
push ebx
call fcn.0042def0
push 0
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
inc ebx
push ebx
call fcn.0042def0
inc dword [esp + 0x24]
jno 0x406002
push edx
call fcn.0042efb0
pop edx
push eax
push edx
call fcn.0042efb0
pop edx
push eax
push dword [esp + 0x28]
call fcn.0042df00
lea eax, [esp + 0x1c]
push eax
call fcn.0042f050
push dword [esp + 0x1c]
call fcn.0042dd80
push dword [esp + 0x20]
call fcn.0042dd80
mov edx, dword [esp + 0xc]
push edx
call fcn.0042efb0
pop edx
push eax
push edx
call fcn.0042eff0
mov edx, dword [esp + 0x1c]
push edx
call fcn.0042eff0
mov edx, 0x4802ea
push edx
call fcn.0042eff0
lea eax, [esp + 0x10]
push eax
call fcn.0042f050
push dword [0x5234c4]
call fcn.0042050f
and eax, eax
je 0x4061dd
call fcn.00420106
and eax, eax
je 0x4061c7
jmp 0x4061bc
call fcn.00420106
and eax, eax
je 0x4061d2
jmp 0x4061c7
call fcn.00420106
and eax, eax
je 0x4061dd
jmp 0x4061d2
jmp 0x405f2f
push dword [esp + 0x10]
call fcn.0042dd80
push dword [esp + 8]
call fcn.00419657
and eax, eax
je 0x40620e
push dword [esp + 8]
call fcn.0041968e
mov dword [esp + 0x28], eax
push dword [esp + 8]
call fcn.004196ae
mov ebx, dword [esp + 0x38]
and ebx, ebx
jle 0x406246
push edx
call fcn.0042efb0
pop edx
push eax
push edx
call fcn.0042efb0
pop edx
push eax
mov eax, dword [esp + 0x30]
cdq
push edx
push eax
call fcn.0042c700
pop eax
push eax
call fcn.004176b0
pop edx
add eax, edx
jmp 0x40633b
push edx
call fcn.0042efb0
pop edx
push eax
push edx
call fcn.0042efb0
pop edx
push eax
mov eax, 0x47b186
push eax
push dword [esp + 0x18]
call fcn.0042d240
lea eax, [esp + 0x10]
push eax
call fcn.0042f050
push edx
call fcn.0042efb0
pop edx
push eax
push edx
call fcn.0042efb0
pop edx
push eax
mov eax, 0x47b152
push eax
mov eax, 0x47ef82
push eax
push dword [esp + 0x1c]
call fcn.0042d5a0
lea eax, [esp + 0x10]
push eax
call fcn.0042f050
mov eax, 0x47ef82
push eax
push dword [esp + 0x10]
call fcn.0042c920
mov ebx, eax
and ebx, ebx
jne 0x40626f
push edx
call fcn.0042efb0
pop edx
push eax
push edx
call fcn.0042efb0
pop edx
push eax
push 1
push dword [esp + 0x18]
call fcn.0042d5c0
call fcn.0042f0e0
mov edx, 0x47b152
pop ecx
push ecx
call fcn.004176f0
mov ecx, eax
call fcn.00417670
je 0x406313
push edx
call fcn.0042efb0
pop edx
push eax
push edx
call fcn.0042efb0
pop edx
push eax
push 2
push dword [esp + 0x18]
call fcn.0042c9d0
lea eax, [esp + 0x10]
push eax
call fcn.0042f050
mov edx, dword [esp + 0xc]
push edx
call fcn.0042efb0
pop edx
push eax
push edx
call fcn.0042eff0
pop eax
push eax
call fcn.004176b0
pop edx
add eax, edx
jmp 0x40633b
push dword [esp + 0xc]
call fcn.0042f1e0
push dword [esp]
call fcn.0042f1e0
push dword [esp + 4]
call fcn.0042f1e0
push dword [esp + 0x18]
call fcn.0042f1e0
add esp, 0x2c
pop ebx
ret 8