Function at 0x402c24
Capabilities:
Query environment variable

Disassembly:
push ebx
mov edx, 0xb
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x402c2a
call fcn.0041f3e0
push dword [esp + 0x3c]
call fcn.0040b5d0
mov edx, dword [esp + 0x34]
lea ecx, [esp]
call fcn.0040b000
push edx
call fcn.0041f240
pop edx
push eax
push edx
call fcn.0041f240
pop edx
push eax
push 0x1f4
call fcn.0041cd10
lea eax, [esp + 8]
push eax
call fcn.0041f2e0
push 0x1f4
mov eax, dword [esp + 8]
push eax
mov eax, str.WINDIR
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
mov ebx, dword [esp + 0x38]
and ebx, ebx
jle 0x402ce4
push edx
call fcn.0041f240
pop edx
push eax
push 0x2e
mov edx, dword [esp + 0xc]
push edx
call fcn.0041f240
pop edx
push eax
push edx
call fcn.0041f280
mov edx, str.System32
push edx
call fcn.0041f280
call fcn.0041f370
push dword [esp + 0xc]
mov eax, str.wmic.exe
push eax
call fcn.0040b5b2
add dword [esp + 8], edx
call fcn.0040c0fa
call fcn.0040b5d0
mov dword [esp + 8], eax
jmp 0x402d5b
push edx
call fcn.0041f240
pop edx
push eax
push 0x2e
mov edx, dword [esp + 0xc]
push edx
call fcn.0041f240
pop edx
push eax
push edx
call fcn.0041f280
mov edx, str.System32
push edx
call fcn.0041f280
call fcn.0041f370
mov edx, dword [esp + 0xc]
push edx
call fcn.0041f240
pop edx
push eax
push edx
call fcn.0041f280
mov edx, str.__FORMAT:List
push edx
call fcn.0041f280
call fcn.0041f370
mov eax, str.wmic.exe
push eax
call fcn.0040b5b2
add dword [esp + 4], edx
call fcn.0040b5b2
add dword [esp + 8], edx
call fcn.0040c0fa
call fcn.0040b5d0
mov dword [esp + 8], eax
mov edx, 0x4ac028
lea ecx, [esp + 0xc]
call fcn.0040b008
cmp dword [esp + 8], 0
je 0x403031
push 0x9c40
call fcn.0041e1f0
mov dword [esp + 0x18], eax
push dword [esp + 8]
call fcn.0040c65f
and eax, eax
je 0x403005
push dword [esp + 8]
call fcn.0040c743
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10], 0
je 0x403000
push dword [esp + 0x10]
push dword [esp + 0x1c]
push dword [esp + 0x10]
call fcn.0040c82c
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10], 0
je 0x403000
push edx
call fcn.0041f240
pop edx
push eax
push edx
call fcn.0041f240
pop edx
push eax
push 0x18
push dword [esp + 0x1c]
push dword [esp + 0x28]
call fcn.0041e3f0
lea eax, [esp + 0x18]
push eax
call fcn.0041f2e0
push dword [esp + 0x14]
call fcn.0041cf80
mov ebx, eax
add ebx, 4
push ebx
call fcn.0041e1f0
mov dword [esp + 0x1c], eax
push dword [esp + 0x14]
call fcn.0041cf80
mov ebx, eax
add ebx, 4
push ebx
call fcn.0041e1f0
mov dword [esp + 0x20], eax
push 0x18
push 0xffffffff
push dword [esp + 0x1c]
push dword [esp + 0x28]
call fcn.0041e210
push dword [esp + 0x20]
push dword [esp + 0x20]
call sub.USER32.dll_OemToCharW
mov dword [esp + 0x24], 0
jmp 0x402e55
push dword [esp + 0x14]
call fcn.0041cf80
mov ebx, eax
add ebx, 4
cmp ebx, dword [esp + 0x24]
jl 0x402f9a
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
push ebx
call fcn.0041e360
mov ebx, eax
cmp ebx, 0x6a
jne 0x402e9f
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
inc ebx
push ebx
call fcn.0041e360
mov ebx, eax
cmp ebx, 0x26
jne 0x402e9f
mov eax, 1
jmp 0x402ea1
xor eax, eax
and eax, eax
je 0x402ecc
push 0xd
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
push ebx
call fcn.0041e370
push 0
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
inc ebx
push ebx
call fcn.0041e370
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
push ebx
call fcn.0041e360
mov ebx, eax
cmp ebx, 0xd9
jne 0x402f01
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
inc ebx
push ebx
call fcn.0041e360
mov ebx, eax
cmp ebx, 0x25
jne 0x402f01
mov eax, 1
jmp 0x402f03
xor eax, eax
and eax, eax
je 0x402f2e
push 0xa
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
push ebx
call fcn.0041e370
push 0
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
inc ebx
push ebx
call fcn.0041e370
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
push ebx
call fcn.0041e360
mov ebx, eax
cmp ebx, 0xcb
jne 0x402f63
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
inc ebx
push ebx
call fcn.0041e360
mov ebx, eax
cmp ebx, 0x25
jne 0x402f63
mov eax, 1
jmp 0x402f65
xor eax, eax
and eax, eax
je 0x402f90
push 9
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
push ebx
call fcn.0041e370
push 0
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
inc ebx
push ebx
call fcn.0041e370
inc dword [esp + 0x24]
jno 0x402e55
push edx
call fcn.0041f240
pop edx
push eax
push edx
call fcn.0041f240
pop edx
push eax
push dword [esp + 0x28]
call fcn.0041e380
lea eax, [esp + 0x18]
push eax
call fcn.0041f2e0
push dword [esp + 0x1c]
call fcn.0041e3d0
push dword [esp + 0x20]
call fcn.0041e3d0
mov edx, dword [esp + 0xc]
push edx
call fcn.0041f240
pop edx
push eax
push edx
call fcn.0041f280
mov edx, dword [esp + 0x18]
push edx
call fcn.0041f280
mov edx, 0x4b02c8
push edx
call fcn.0041f280
lea eax, [esp + 0x10]
push eax
call fcn.0041f2e0
jmp 0x402d82
push dword [esp + 0x18]
call fcn.0041e3d0
push dword [esp + 8]
call fcn.0040c886
and eax, eax
je 0x403031
push dword [esp + 8]
call fcn.0040c7b6
mov dword [esp + 0x28], eax
push dword [esp + 8]
call fcn.0040c7d6
mov ebx, dword [esp + 0x38]
and ebx, ebx
jle 0x403069
push edx
call fcn.0041f240
pop edx
push eax
push edx
call fcn.0041f240
pop edx
push eax
mov eax, dword [esp + 0x30]
cdq
push edx
push eax
call fcn.0041cfb0
pop eax
push eax
call fcn.0040b5a0
pop edx
add eax, edx
jmp 0x40318d
push edx
call fcn.0041f240
pop edx
push eax
push edx
call fcn.0041f240
pop edx
push eax
mov eax, 0x4ac0b6
push eax
push dword [esp + 0x18]
call fcn.0041d310
lea eax, [esp + 0x10]
push eax
call fcn.0041f2e0
push edx
call fcn.0041f240
pop edx
push eax
push edx
call fcn.0041f240
pop edx
push eax
mov eax, 0x4ac082
push eax
mov eax, 0x4af33e
push eax
push dword [esp + 0x1c]
call fcn.0041d670
lea eax, [esp + 0x10]
push eax
call fcn.0041f2e0
mov eax, 0x4af33e
push eax
push dword [esp + 0x10]
call fcn.0041ccf0
mov ebx, eax
and ebx, ebx
jne 0x403092
push edx
call fcn.0041f240
pop edx
push eax
push edx
call fcn.0041f240
pop edx
push eax
push 1
push dword [esp + 0x18]
call fcn.0041d690
call fcn.0041f370
mov edx, 0x4ac082
pop ecx
push ecx
call fcn.0040b620
mov ecx, eax
call fcn.0040b5e0
je 0x403136
push edx
call fcn.0041f240
pop edx
push eax
push edx
call fcn.0041f240
pop edx
push eax
push 2
push dword [esp + 0x18]
call fcn.0041cdf0
lea eax, [esp + 0x10]
push eax
call fcn.0041f2e0
push edx
call fcn.0041f240
pop edx
push eax
push edx
call fcn.0041f240
pop edx
push eax
mov eax, 0x4ac028
push eax
mov eax, 0x4ac082
push eax
push dword [esp + 0x1c]
call fcn.0041d670
lea eax, [esp + 0x10]
push eax
call fcn.0041f2e0
mov edx, dword [esp + 0xc]
push edx
call fcn.0041f240
pop edx
push eax
push edx
call fcn.0041f280
pop eax
push eax
call fcn.0040b5a0
pop edx
add eax, edx
jmp 0x40318d
push dword [esp + 0xc]
call fcn.0041f470
push dword [esp]
call fcn.0041f470
push dword [esp + 4]
call fcn.0041f470
push dword [esp + 0x14]
call fcn.0041f470
add esp, 0x2c
pop ebx
ret 8