Function at 0x4064a0
Capabilities:
Query environment variable

Disassembly:
push ebx
mov edx, 0xb
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x4064a6
call fcn.00431250
push dword [esp + 0x3c]
call fcn.004176d0
mov edx, dword [esp + 0x34]
lea ecx, [esp]
call fcn.00417000
push edx
call fcn.004310e0
pop edx
push eax
push edx
call fcn.004310e0
pop edx
push eax
push 0x1f4
call fcn.0042e920
lea eax, [esp + 8]
push eax
call fcn.00431180
push 0x1f4
mov eax, dword [esp + 8]
push eax
mov eax, str.WINDIR
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
mov ebx, dword [esp + 0x38]
and ebx, ebx
jle 0x406560
push edx
call fcn.004310e0
pop edx
push eax
push 0x2e
mov edx, dword [esp + 0xc]
push edx
call fcn.004310e0
pop edx
push eax
push edx
call fcn.00431120
mov edx, str.System32
push edx
call fcn.00431120
call fcn.00431310
push dword [esp + 0xc]
mov eax, str.wmic.exe
push eax
call fcn.004176b2
add dword [esp + 8], edx
call fcn.0041913f
call fcn.004176d0
mov dword [esp + 8], eax
jmp 0x4065d7
push edx
call fcn.004310e0
pop edx
push eax
push 0x2e
mov edx, dword [esp + 0xc]
push edx
call fcn.004310e0
pop edx
push eax
push edx
call fcn.00431120
mov edx, str.System32
push edx
call fcn.00431120
call fcn.00431310
mov edx, dword [esp + 0xc]
push edx
call fcn.004310e0
pop edx
push eax
push edx
call fcn.00431120
mov edx, str.__FORMAT:List
push edx
call fcn.00431120
call fcn.00431310
mov eax, str.wmic.exe
push eax
call fcn.004176b2
add dword [esp + 4], edx
call fcn.004176b2
add dword [esp + 8], edx
call fcn.0041913f
call fcn.004176d0
mov dword [esp + 8], eax
mov edx, 0x4bd028
lea ecx, [esp + 0xc]
call fcn.00417008
cmp dword [esp + 8], 0
je 0x4068ad
push 0x9c40
call fcn.0042ff50
mov dword [esp + 0x18], eax
push dword [esp + 8]
call fcn.004196a4
and eax, eax
je 0x406881
push dword [esp + 8]
call fcn.004196eb
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10], 0
je 0x40687c
push dword [esp + 0x10]
push dword [esp + 0x1c]
push dword [esp + 0x10]
call fcn.00419711
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10], 0
je 0x40687c
push edx
call fcn.004310e0
pop edx
push eax
push edx
call fcn.004310e0
pop edx
push eax
push 0x18
push dword [esp + 0x1c]
push dword [esp + 0x28]
call fcn.00430150
lea eax, [esp + 0x18]
push eax
call fcn.00431180
push dword [esp + 0x14]
call fcn.0042eee0
mov ebx, eax
add ebx, 4
push ebx
call fcn.0042ff50
mov dword [esp + 0x1c], eax
push dword [esp + 0x14]
call fcn.0042eee0
mov ebx, eax
add ebx, 4
push ebx
call fcn.0042ff50
mov dword [esp + 0x20], eax
push 0x18
push 0xffffffff
push dword [esp + 0x1c]
push dword [esp + 0x28]
call fcn.0042ff70
push dword [esp + 0x20]
push dword [esp + 0x20]
call sub.USER32.dll_OemToCharW
mov dword [esp + 0x24], 0
jmp 0x4066d1
push dword [esp + 0x14]
call fcn.0042eee0
mov ebx, eax
add ebx, 4
cmp ebx, dword [esp + 0x24]
jl 0x406816
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
push ebx
call fcn.004300c0
mov ebx, eax
cmp ebx, 0x6a
jne 0x40671b
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
inc ebx
push ebx
call fcn.004300c0
mov ebx, eax
cmp ebx, 0x26
jne 0x40671b
mov eax, 1
jmp 0x40671d
xor eax, eax
and eax, eax
je 0x406748
push 0xd
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
push ebx
call fcn.004300d0
push 0
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
inc ebx
push ebx
call fcn.004300d0
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
push ebx
call fcn.004300c0
mov ebx, eax
cmp ebx, 0xd9
jne 0x40677d
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
inc ebx
push ebx
call fcn.004300c0
mov ebx, eax
cmp ebx, 0x25
jne 0x40677d
mov eax, 1
jmp 0x40677f
xor eax, eax
and eax, eax
je 0x4067aa
push 0xa
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
push ebx
call fcn.004300d0
push 0
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
inc ebx
push ebx
call fcn.004300d0
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
push ebx
call fcn.004300c0
mov ebx, eax
cmp ebx, 0xcb
jne 0x4067df
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
inc ebx
push ebx
call fcn.004300c0
mov ebx, eax
cmp ebx, 0x25
jne 0x4067df
mov eax, 1
jmp 0x4067e1
xor eax, eax
and eax, eax
je 0x40680c
push 9
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
push ebx
call fcn.004300d0
push 0
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
inc ebx
push ebx
call fcn.004300d0
inc dword [esp + 0x24]
jno 0x4066d1
push edx
call fcn.004310e0
pop edx
push eax
push edx
call fcn.004310e0
pop edx
push eax
push dword [esp + 0x28]
call fcn.004300e0
lea eax, [esp + 0x18]
push eax
call fcn.00431180
push dword [esp + 0x1c]
call fcn.00430130
push dword [esp + 0x20]
call fcn.00430130
mov edx, dword [esp + 0xc]
push edx
call fcn.004310e0
pop edx
push eax
push edx
call fcn.00431120
mov edx, dword [esp + 0x18]
push edx
call fcn.00431120
mov edx, 0x4c21c0
push edx
call fcn.00431120
lea eax, [esp + 0x10]
push eax
call fcn.00431180
jmp 0x4065fe
push dword [esp + 0x18]
call fcn.00430130
push dword [esp + 8]
call fcn.0041976b
and eax, eax
je 0x4068ad
push dword [esp + 8]
call fcn.004197a2
mov dword [esp + 0x28], eax
push dword [esp + 8]
call fcn.004197c2
mov ebx, dword [esp + 0x38]
and ebx, ebx
jle 0x4068e5
push edx
call fcn.004310e0
pop edx
push eax
push edx
call fcn.004310e0
pop edx
push eax
mov eax, dword [esp + 0x30]
cdq
push edx
push eax
call fcn.0042ef10
pop eax
push eax
call fcn.004176a0
pop edx
add eax, edx
jmp 0x406a09
push edx
call fcn.004310e0
pop edx
push eax
push edx
call fcn.004310e0
pop edx
push eax
mov eax, 0x4bd186
push eax
push dword [esp + 0x18]
call fcn.0042f520
lea eax, [esp + 0x10]
push eax
call fcn.00431180
push edx
call fcn.004310e0
pop edx
push eax
push edx
call fcn.004310e0
pop edx
push eax
mov eax, 0x4bd152
push eax
mov eax, 0x4c0ff6
push eax
push dword [esp + 0x1c]
call fcn.0042f880
lea eax, [esp + 0x10]
push eax
call fcn.00431180
mov eax, 0x4c0ff6
push eax
push dword [esp + 0x10]
call fcn.0042ea30
mov ebx, eax
and ebx, ebx
jne 0x40690e
push edx
call fcn.004310e0
pop edx
push eax
push edx
call fcn.004310e0
pop edx
push eax
push 1
push dword [esp + 0x18]
call fcn.0042f8a0
call fcn.00431310
mov edx, 0x4bd152
pop ecx
push ecx
call fcn.004176e0
mov ecx, eax
call fcn.00417660
je 0x4069b2
push edx
call fcn.004310e0
pop edx
push eax
push edx
call fcn.004310e0
pop edx
push eax
push 2
push dword [esp + 0x18]
call fcn.0042eae0
lea eax, [esp + 0x10]
push eax
call fcn.00431180
push edx
call fcn.004310e0
pop edx
push eax
push edx
call fcn.004310e0
pop edx
push eax
mov eax, 0x4bd028
push eax
mov eax, 0x4bd152
push eax
push dword [esp + 0x1c]
call fcn.0042f880
lea eax, [esp + 0x10]
push eax
call fcn.00431180
mov edx, dword [esp + 0xc]
push edx
call fcn.004310e0
pop edx
push eax
push edx
call fcn.00431120
pop eax
push eax
call fcn.004176a0
pop edx
add eax, edx
jmp 0x406a09
push dword [esp + 0xc]
call fcn.004312e0
push dword [esp]
call fcn.004312e0
push dword [esp + 4]
call fcn.004312e0
push dword [esp + 0x14]
call fcn.004312e0
add esp, 0x2c
pop ebx
ret 8