Function at 0x510150
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x2004
call fcn.00530230
mov eax, dword [0x58cb30]
xor eax, esp
mov dword [esp + 0x2000], eax
mov eax, dword [esp + 0x2008]
push ebx
mov ebx, dword [esp + 0x2010]
push ebp
mov eax, dword [eax]
mov ebp, dword [esp + 0x2024]
push esi
push edi
mov edi, dword [esp + 0x2024]
cmp eax, 0xf
ja case.default.0x510193
jmp dword [eax*4 + 0x5108ec]
mov esi, dword [esp + 0x2028]
push esi
push 0x558718
push edi
push str.TaskbarGroupIcon
push str.Applications_avpui.exe
push SysReAllocString
call fcn.004d0070
push esi
push str.avp.com
push edi
call fcn.004a3880
push 1
push 1
push str.SCAN
push dword [esp + 0x203c]
push ebp
push edi
push dword [esp + 0x2038]
push ebx
push str.Kaspersky_Anti_Virus
call fcn.00510930
test al, al
jne 0x5108c6
push esi
push 0x558718
push edi
push 0x558718
push str.AVP_shellopencommand
push SysReAllocString
call fcn.004d0070
cmp word [edi], 0x22
jne 0x51022d
lea eax, [edi + 2]
push 0x22
push eax
call fcn.005317e5
add esp, 8
test eax, eax
je 0x51022d
xor ecx, ecx
mov word [eax + 2], cx
push esi
push str.avp.com
push edi
call fcn.004a3880
push 1
push 1
push str.SCAN
push dword [esp + 0x203c]
push ebp
push edi
push dword [esp + 0x2038]
push ebx
push str.Kaspersky_Anti_Virus
jmp 0x5107c3
mov esi, dword [esp + 0x2028]
push esi
push 0x558718
push edi
push 0x558718
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsDrweb32w.exe
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d0070
cmp word [edi], 0
jne 0x51029b
push esi
push 0x558718
push edi
push str.ExePath
push str.SoftwareIDAVLABDrweb32w
call fcn.004d0210
push 1
push 0
push str._AL__SS___SD__SHELL
push dword [esp + 0x203c]
push ebp
push edi
push dword [esp + 0x2038]
push ebx
push str.Dr.Web
jmp 0x5107c3
push dword [esp + 0x2028]
push 0x558718
push edi
push 0x558718
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsNavw32.exe
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d0070
push 1
push 0
push 0
push dword [esp + 0x203c]
push ebp
push edi
push dword [esp + 0x2038]
push ebx
push str.Norton_AntiVirus
jmp 0x5107c3
push dword [esp + 0x2028]
push 0x558718
push edi
push str.szScannerExe
push str.SOFTWARENetwork_AssociatesTVDVirusScanAVConsolGeneral
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d0070
push 1
push 0
push 0
push dword [esp + 0x203c]
push ebp
push edi
push dword [esp + 0x2038]
push ebx
push str.McAfee_VirusScan
jmp 0x5107c3
mov esi, dword [esp + 0x2028]
push esi
push 0x558718
push edi
push str.InstallLocation
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallEAAAB119_D0BF_4FF4_B6F0_B6FB0393921A
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d0070
push esi
push edi
call fcn.004a1860
push esi
push str.scanner.exe
push edi
call fcn.004bda80
push 1
push 0
push str._nostartup
push dword [esp + 0x203c]
push ebp
push edi
push dword [esp + 0x2038]
push ebx
push str.Stop__Scanner
jmp 0x5107c3
mov esi, dword [esp + 0x2028]
push esi
push 0x558718
push edi
push 0x55bfec
push str.SOFTWAREData_FellowsF_SecureAnti_Virus
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d0070
push esi
push edi
call fcn.004a1860
push esi
push str.fsav.exe
push edi
call fcn.004bda80
push 1
push 0
push str._BEEP__NOBOOT
push dword [esp + 0x203c]
push ebp
push edi
push dword [esp + 0x2038]
push ebx
push str.F_Secure_Anti_Virus
jmp 0x5107c3
mov esi, dword [esp + 0x2028]
push esi
push 0x558718
push edi
push 0x55bfec
push str.SOFTWARESophosSweepNT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d0070
push esi
push edi
call fcn.004a1860
push esi
push str.sav32cli.exe
push edi
call fcn.004bda80
push 1
push 0
push 0
push dword [esp + 0x203c]
push ebp
push edi
push dword [esp + 0x2038]
push ebx
push str.Sophos_Anti_Virus
jmp 0x5107c3
mov esi, dword [esp + 0x2028]
push esi
push 0x558718
push edi
push 0x558718
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsAVGSE.DLL
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d0070
push 2
push 0x558920
push edi
call fcn.004a3820
push 1
push 0
push 0
push dword [esp + 0x203c]
push ebp
push edi
push dword [esp + 0x2038]
push ebx
push str.AVG_Anti_Virus
call fcn.00510930
test al, al
jne 0x5108c6
push esi
push str.avgw.exe
push edi
call fcn.004a3880
push 1
push 1
push 0x56d29c
push dword [esp + 0x203c]
push ebp
push edi
push dword [esp + 0x2038]
push ebx
push str.AVG_Anti_Virus
call fcn.00510930
test al, al
jne 0x5108c6
push esi
push str.avgscanx.exe
push edi
call fcn.004a3880
push 0
push 1
push str._SCAN
push dword [esp + 0x203c]
push ebp
push edi
push dword [esp + 0x2038]
push ebx
push str.AVG_Anti_Virus
call fcn.00510930
test al, al
jne 0x5108c6
push esi
push str.avgscana.exe
push edi
call fcn.004a3880
push 0
push 1
push str._SCAN
push dword [esp + 0x203c]
push ebp
push edi
push dword [esp + 0x2038]
push ebx
push str.AVG_Anti_Virus
jmp 0x5107c3
push dword [esp + 0x2028]
push 0x558718
push edi
push 0x558718
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths_vet32.exe
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d0070
push 1
push 0
push str._sub__nobootscan__nomemoryscan
push dword [esp + 0x203c]
push ebp
push edi
push dword [esp + 0x2038]
push ebx
push str.eTrust_EZ_Antivirus
jmp 0x5107c3
mov esi, dword [esp + 0x2028]
push esi
push 0x558718
push edi
push str.InstallDir
push str.SOFTWAREESetNODCurrentVersionInfo
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d0070
push esi
push edi
call fcn.004a1860
push esi
push str.nod32.exe
push edi
call fcn.004bda80
push 1
push 0
push str._scanfile__scanboot___scanmbr_
push dword [esp + 0x203c]
push ebp
push edi
push dword [esp + 0x2038]
push ebx
push str.NOD32_Antivirus
jmp 0x5107c3
mov esi, dword [esp + 0x2028]
push esi
push 0x558718
push edi
push str.UninstallString
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallClamAV
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d0070
push esi
push str.binclamscan.exe
push edi
call fcn.004a3880
push 1
push 0
push str.__infected___recursive
push dword [esp + 0x203c]
push ebp
push edi
push dword [esp + 0x2038]
push ebx
push str.Clam_AntiVirus
jmp 0x5107c3
mov esi, dword [esp + 0x2028]
push esi
push 0x558718
push edi
push 0x558718
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsAvastUI.exe
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d0070
cmp word [edi], 0
jne 0x510676
push esi
push 0x558718
push edi
push 0x558718
push str.CLSID472083B0_C522_11CF_8763_00608CC02F24InProcServer32
push SysReAllocString
call fcn.004d0070
push esi
push str.ashQuick.exe
push edi
call fcn.004a3880
push 1
push 0
push 0
push dword [esp + 0x203c]
push ebp
push edi
push dword [esp + 0x2038]
push ebx
push str.avast__Antivirus
jmp 0x5107c3
push 0x800
push 0x558718
lea eax, [esp + 0x18]
push eax
push str.AppID
push str.AppIDKVSrvXP.exe
push SysReAllocString
call fcn.004d0070
cmp word [esp + 0x10], 0
je 0x5107d0
lea eax, [esp + 0x10]
push eax
push str.CLSID_sInprocServer32
lea eax, [esp + 0x1018]
push 0x800
push eax
call fcn.00404ce0
mov esi, dword [esp + 0x2038]
lea eax, [esp + 0x1020]
add esp, 0x10
push esi
push 0x558718
push edi
push 0x558718
push eax
push SysReAllocString
call fcn.004d0070
push esi
push str.KVScan.kxp
push edi
call fcn.004a3880
push 1
push 0
push 0
push dword [esp + 0x203c]
push ebp
push edi
push dword [esp + 0x2038]
push ebx
push str.Jiangmin_AntiVirus
jmp 0x5107c3
push 0x800
push 0x558718
lea eax, [esp + 0x18]
push eax
push str.ImagePath
push str.SYSTEMCurrentControlSetServices_avgntflt
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d0070
push 4
lea eax, [esp + 0x14]
push 0x568508
push eax
call fcn.0053968d
add esp, 0xc
test eax, eax
lea eax, [esp + 0x18]
je 0x510786
lea eax, [esp + 0x10]
mov esi, dword [esp + 0x2028]
push esi
push eax
push edi
call fcn.005396c7
add esp, 0xc
push esi
push str.avcmd.exe
push edi
call fcn.004a3880
push 1
push 0
push str._s__noboot__nombr
push dword [esp + 0x203c]
push ebp
push edi
push dword [esp + 0x2038]
push ebx
push str.Avira_AntiVir
call fcn.00510930
test al, al
jne 0x5108c6
mov eax, 1
jmp 0x5108cf
mov esi, dword [esp + 0x2028]
push esi
push edi
push str._ProgramFiles_Windows_DefenderMpCmdRun.exe
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x510822
cmp eax, esi
jae 0x510822
push 1
push 1
push str._Scan__ScanType_3__File
push dword [esp + 0x203c]
push ebp
push edi
push dword [esp + 0x2038]
push ebx
push str.Windows_Defender
call fcn.00510930
test al, al
jne 0x5108c6
push esi
push 0x558718
push edi
push 0x558718
push str.windowsdefenderDefaultIcon
push SysReAllocString
call fcn.004d0070
push esi
push str.MpCmdRun.exe
push edi
call fcn.004a3880
push 1
push 1
push str._Scan__ScanType_3__File
push dword [esp + 0x203c]
push ebp
push edi
push dword [esp + 0x2038]
push ebx
push str.Windows_Defender
call fcn.00510930
xor ecx, ecx
test al, al
sete cl
mov eax, ecx
jmp 0x5108cf
push dword [esp + 0x2020]
push 0x544
call fcn.004b7300
push eax
push ebx
call fcn.004bdae0
push dword [esp + 0x2028]
push 0x558718
push edi
push 0x568624
push str.VirusScan
call fcn.004d0210
push 0x800
push 0x558718
push ebp
push str.Param
push str.VirusScan
call fcn.004d0210
xor eax, eax
jmp 0x5108cf
mov eax, 2
mov ecx, dword [esp + 0x2010]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00530218
add esp, 0x2004
ret 0x1c