Function at 0x40288f
Capabilities:
Query environment variable
Set environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x15944
call fcn.0040d5c0
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
cmp dword [edi + 0x590c], ebx
jne 0x40293e
cmp dword [edi + 0x4ec8], 1
jne 0x40293e
lea edx, [ebp - 0xd98]
call fcn.0040b7dd
push ebx
mov eax, edx
xor ecx, ecx
push eax
inc ecx
call fcn.0040bb9a
push 1
lea eax, [ebp - 0xd98]
call fcn.00401a63
mov eax, dword [ebp - 0x740]
cmp eax, ebx
jne 0x4028f0
mov eax, 0x40e548
push eax
or eax, 0xffffffff
mov edi, 0x4128d4
call fcn.004067ae
mov eax, dword [ebp + 0xc]
add eax, 0x4ecc
push eax
mov eax, 0xff
mov edi, 0x4122d0
call fcn.00405aca
pop ecx
mov ecx, 0x4122a8
call fcn.0040c2b0
lea esi, [ebp - 0x750]
mov edi, eax
call fcn.00406786
lea esi, [ebp - 0x97c]
call fcn.0040666e
jmp 0x403226
mov eax, dword [ebp + 8]
push 0x40
mov word [eax], bx
lea eax, [ebp - 0xc4]
push ebx
push eax
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
call sub.msvcrt.dll_memset
xor eax, eax
mov dword [ebp - 0x28], ebx
lea edi, [ebp - 0x24]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
mov esi, 0x208
push esi
stosd dword es:[edi], eax
lea eax, [ebp - 0x526]
push ebx
push eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], 0x100
mov dword [ebp - 0x3c], ebx
mov word [ebp - 0x528], bx
call sub.msvcrt.dll_memset
add esp, 0xc
push esi
lea eax, [ebp - 0x316]
push ebx
push eax
mov word [ebp - 0x318], bx
call sub.msvcrt.dll_memset
mov eax, dword [ebp + 0xc]
add eax, 8
add esp, 0xc
push eax
mov eax, 0x104
lea edi, [ebp - 0x318]
mov word [ebp - 0x15940], bx
mov dword [ebp - 0xc8], 0x44
call fcn.00405aca
mov eax, dword [ebp + 0xc]
pop ecx
add eax, 8
push 0x25
push eax
call sub.msvcrt.dll_wcschr
test eax, eax
pop ecx
pop ecx
je 0x402a07
push 0x104
mov eax, edi
push eax
mov eax, dword [ebp + 0xc]
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x50e8], ebx
je 0x402ae0
lea eax, [ebp - 0x318]
push 0x5c
push eax
call sub.msvcrt.dll_wcschr
test eax, eax
pop ecx
pop ecx
jne 0x402ae0
push esi
lea eax, [ebp - 0x736]
push ebx
push eax
mov dword [ebp - 4], ebx
mov word [ebp - 0x738], bx
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x738]
push eax
push 0x104
push ebx
lea eax, [ebp - 0x318]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SearchPathW]
cmp word [ebp - 0x738], bx
jne 0x402ac8
push 0x1fe
lea eax, [ebp - 0x1136]
push ebx
push eax
mov word [ebp - 0x1138], bx
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x318]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths_s
lea eax, [ebp - 0x1138]
push 0xff
push eax
call sub.msvcrt.dll__snwprintf
lea eax, [ebp - 0x1138]
push eax
lea esi, [ebp - 0x738]
call fcn.0040b496
add esp, 0x14
cmp word [ebp - 0x738], bx
je 0x402ae0
lea eax, [ebp - 0x738]
push eax
mov eax, 0x104
lea edi, [ebp - 0x318]
call fcn.00405aca
pop ecx
mov esi, dword [ebp + 0xc]
add esi, 0x4214
cmp word [esi], bx
mov dword [ebp - 0x14], esi
je 0x402b17
push 0x25
push esi
mov dword [ebp - 0x10], esi
call sub.msvcrt.dll_wcschr
test eax, eax
pop ecx
pop ecx
je 0x402b3c
push 0x104
lea eax, [ebp - 0x528]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x402b33
lea eax, [ebp - 0x318]
push eax
lea esi, [ebp - 0x528]
call fcn.00405d03
cmp word [ebp - 0x528], bx
pop ecx
je 0x402b3c
lea eax, [ebp - 0x528]
mov dword [ebp - 0x10], eax
mov esi, dword [ebp + 0xc]
cmp dword [esi + 0x462c], 1
je 0x402b5d
mov ax, word [esi + 0x462c]
or dword [ebp - 0x9c], 1
mov word [ebp - 0x98], ax
cmp dword [esi + 0x4630], ebx
mov edi, 0x40eb90
je 0x402c05
cmp word [esi + 0x4634], bx
je 0x402c05
push 0x3e
lea eax, [ebp - 0x106]
push ebx
push eax
mov word [ebp - 0x108], bx
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x3e
lea eax, [ebp - 0x7e]
push ebx
push eax
mov word [ebp - 0x80], bx
call sub.msvcrt.dll_memset
add esp, 0xc
push edi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x108]
push 0x1f
push eax
lea eax, [esi + 0x4634]
mov dword [ebp - 4], ebx
call fcn.004064a8
push edi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x80]
push 0x1f
push eax
lea eax, [esi + 0x4634]
call fcn.004064a8
or dword [ebp - 0x9c], 4
lea eax, [ebp - 0x108]
push eax
call sub.msvcrt.dll__wtoi
mov dword [ebp - 0xb8], eax
add esp, 0x24
lea eax, [ebp - 0x80]
push eax
call sub.msvcrt.dll__wtoi
pop ecx
mov dword [ebp - 0xb4], eax
cmp dword [esi + 0x4674], ebx
je 0x402ca8
cmp word [esi + 0x4678], bx
je 0x402ca8
push 0x3e
lea eax, [ebp - 0x106]
push ebx
push eax
mov word [ebp - 0x108], bx
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x3e
lea eax, [ebp - 0x7e]
push ebx
push eax
mov word [ebp - 0x80], bx
call sub.msvcrt.dll_memset
add esp, 0xc
push edi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x108]
push 0x1f
push eax
lea eax, [esi + 0x4678]
mov dword [ebp - 4], ebx
call fcn.004064a8
push edi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x80]
push 0x1f
push eax
lea eax, [esi + 0x4678]
call fcn.004064a8
or dword [ebp - 0x9c], 2
lea eax, [ebp - 0x108]
push eax
call sub.msvcrt.dll__wtoi
mov dword [ebp - 0xb0], eax
add esp, 0x24
lea eax, [ebp - 0x80]
push eax
call sub.msvcrt.dll__wtoi
pop ecx
mov dword [ebp - 0xac], eax
lea edi, [esi + 0x212]
cmp word [edi], bx
mov dword [ebp - 4], edi
je 0x402d2e
cmp dword [esi + 0x50ec], ebx
je 0x402d04
push 0x25
push edi
call sub.msvcrt.dll_wcschr
test eax, eax
pop ecx
pop ecx
je 0x402d04
push 0x4000
lea eax, [ebp - 0x593e]
push ebx
push eax
mov word [ebp - 0x5940], bx
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x2000
lea eax, [ebp - 0x5940]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x5940]
push eax
jmp 0x402d05
push edi
lea eax, [ebp - 0x318]
push eax
push 0x40eb94
lea eax, [ebp - 0x15940]
push 0x7fff
push eax
call sub.msvcrt.dll__snwprintf
lea eax, [ebp - 0x15940]
add esp, 0x14
mov dword [ebp - 0x18], eax
mov eax, dword [esi + 0x4628]
cmp eax, 0x20
je 0x402d3c
mov dword [ebp - 8], eax
cmp dword [esi + 0x46b8], 2
mov edi, dword [ebp + 8]
jne 0x402d54
push str.RunAsInvoker
mov eax, edi
call fcn.00402018
mov eax, dword [esi + 0x50cc]
cmp eax, ebx
je 0x402d74
lea ecx, [eax - 1]
cmp ecx, 0xc
ja 0x402d74
push dword [eax*4 + 0x4128ec]
mov eax, edi
call fcn.00402018
mov eax, dword [esi + 0x50d0]
cmp eax, 1
jne 0x402d86
push str.256COLOR
jmp 0x402d90
cmp eax, 2
jne 0x402d97
push str.16BITCOLOR
mov eax, edi
call fcn.00402018
cmp dword [esi + 0x50d4], ebx
je 0x402dab
push str.640X480
mov eax, edi
call fcn.00402018
cmp dword [esi + 0x50d8], ebx
je 0x402dbf
push str.DISABLETHEMES
mov eax, edi
call fcn.00402018
cmp dword [esi + 0x50dc], ebx
je 0x402dd3
push str.DISABLEDWM
mov eax, edi
call fcn.00402018
cmp dword [esi + 0x50e0], ebx
je 0x402de7
push str.DISABLEDXMAXIMIZEDWINDOWEDMODE
mov eax, edi
call fcn.00402018
mov eax, dword [esi + 0x50e4]
cmp eax, 1
jne 0x402df9
push str.HIGHDPIAWARE
jmp 0x402e0f
cmp eax, 2
jne 0x402e05
push str.DPIUNAWARE
jmp 0x402e0f
cmp eax, 3
jne 0x402e16
push str.GDIDPISCALING
mov eax, edi
call fcn.00402018
mov eax, dword [esi + 0x58f4]
cmp eax, 3
jne 0x402e7c
lea eax, [ebp - 0x60]
call fcn.0040664c
lea eax, [esi + 0x58f8]
call fcn.004067a1
lea ecx, [ebp - 0x60]
push ecx
call fcn.00401354
cmp word [edi], bx
je 0x402e4c
push edi
lea eax, [ebp - 0x60]
push eax
call fcn.004014e1
lea eax, [ebp - 0x3c]
lea esi, [ebp - 0x60]
call fcn.00401419
mov eax, dword [ebp - 0x2c]
cmp eax, ebx
mov dword [ebp - 0xc], 0x40e548
je 0x402e68
mov dword [ebp - 0xc], eax
or dword [ebp - 8], 0x400
lea esi, [ebp - 0x60]
call fcn.0040666e
jmp 0x402f12
cmp eax, 2
jne 0x402f1a
lea eax, [ebp - 0x60]
call fcn.0040664c
lea eax, [ebp - 0xe8]
call fcn.0040664c
lea eax, [ebp - 0x60]
push eax
call fcn.00401497
lea eax, [esi + 0x58f8]
call fcn.004067a1
lea ecx, [ebp - 0xe8]
push ecx
call fcn.00401354
lea eax, [ebp - 0x60]
push eax
lea ebx, [ebp - 0xe8]
call fcn.00401549
mov eax, dword [ebp + 8]
cmp word [eax], 0
je 0x402eda
push eax
lea eax, [ebp - 0x60]
push eax
call fcn.004014e1
lea eax, [ebp - 0x3c]
lea esi, [ebp - 0x60]
call fcn.00401419
mov eax, dword [ebp - 0x2c]
test eax, eax
mov dword [ebp - 0xc], 0x40e548
je 0x402ef6
mov dword [ebp - 0xc], eax
or dword [ebp - 8], 0x400
lea esi, [ebp - 0xe8]
call fcn.0040666e
lea esi, [ebp - 0x60]
call fcn.0040666e
xor ebx, ebx
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
jmp 0x402f2e
cmp word [edi], bx
je 0x402f22
push edi
jmp 0x402f23
push ebx
push str.__COMPAT_LAYER
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov eax, dword [esi]
cmp eax, 2
jne 0x402fe4
mov edi, 0x7fe
push edi
lea eax, [ebp - 0xf36]
push ebx
push eax
mov word [ebp - 0xf38], bx
call sub.msvcrt.dll_memset
add esp, 0xc
push edi
lea eax, [ebp - 0x1936]
push ebx
push eax
mov word [ebp - 0x1938], bx
call sub.msvcrt.dll_memset
lea eax, [ebp - 0xf38]
add esp, 0xc
push eax
call fcn.00405c80
pop ecx
push dword [esi + 0x462c]
lea eax, [esi + 0x441e]
push dword [ebp - 0x14]
push dword [ebp - 4]
push eax
push str._CallShellExecute
lea eax, [ebp - 0xf38]
push eax
push str.__s___s___s____s____s___d
lea eax, [ebp - 0x1938]
push 0x3ff
push eax
call sub.msvcrt.dll__snwprintf
add esp, 0x24
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0xc8]
push eax
push dword [ebp - 0x10]
lea eax, [ebp - 0x1938]
push dword [ebp - 0xc]
push eax
lea eax, [ebp - 0xf38]
push eax
push dword [ebp + 8]
mov ecx, esi
mov eax, dword [ebp - 8]
call fcn.00402358
jmp 0x4031b6
cmp eax, 3
jne 0x4030ce
mov edi, 0x7fe
push edi
lea eax, [ebp - 0xf36]
push ebx
push eax
mov dword [ebp - 0x14], ebx
mov word [ebp - 0xf38], bx
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xf38]
push eax
push 0x3ff
push ebx
push str.cmd.exe
push ebx
call dword [sym.imp.KERNEL32.dll_SearchPathW]
cmp word [ebp - 0xf38], bx
je 0x4031b0
push edi
lea eax, [ebp - 0x1936]
push ebx
push eax
mov word [ebp - 0x1938], bx
call sub.msvcrt.dll_memset
mov esi, 0x40ed48
lea edi, [ebp - 0x54]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor eax, eax
lea edi, [ebp - 0x4e]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [ebp + 0xc]
add esp, 0xc
cmp dword [eax + 4], 2
jne 0x40307d
lea eax, [ebp - 0x54]
push 0x40ed50
push eax
call sub.msvcrt.dll_wcscpy
pop ecx
pop ecx
push dword [ebp - 4]
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0xf38]
push eax
push str.__s___s__s
lea eax, [ebp - 0x1938]
push 0x3ff
push eax
call sub.msvcrt.dll__snwprintf
mov ecx, dword [ebp + 0xc]
add esp, 0x18
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0xc8]
push eax
push dword [ebp - 0x10]
lea eax, [ebp - 0x1938]
push dword [ebp - 0xc]
push eax
lea eax, [ebp - 0xf38]
push eax
push dword [ebp + 8]
jmp 0x402fd7
cmp eax, 4
je 0x4030f9
cmp eax, 5
je 0x4030f9
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0xc8]
push eax
push dword [ebp - 0x10]
lea eax, [ebp - 0x318]
push dword [ebp - 0xc]
push dword [ebp - 0x18]
push eax
push edi
jmp 0x402fd5
mov edi, 0x7fe
push edi
lea eax, [ebp - 0xf36]
push ebx
push eax
mov dword [ebp - 0x14], ebx
mov word [ebp - 0xf38], bx
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xf38]
push eax
push 0x3ff
push ebx
push str.powershell.exe
push ebx
call dword [sym.imp.KERNEL32.dll_SearchPathW]
cmp word [ebp - 0xf38], bx
je 0x4031b0
push edi
lea eax, [ebp - 0x1936]
push ebx
push eax
mov word [ebp - 0x1938], bx
call sub.msvcrt.dll_memset
mov esi, str._NoExit
lea edi, [ebp - 0x54]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor eax, eax
lea edi, [ebp - 0x44]
stosd dword es:[edi], eax
mov eax, dword [ebp + 0xc]
add esp, 0xc
cmp dword [eax + 4], 2
jne 0x403176
mov word [ebp - 0x54], bx
push dword [ebp - 4]
mov esi, eax
cmp dword [esi], 5
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0xf38]
push eax
lea eax, [ebp - 0x1938]
jne 0x403198
push str.__s___s__executionpolicy_bypass__File___s_
jmp 0x40319d
push str.__s___s__s
push 0x3ff
push eax
call sub.msvcrt.dll__snwprintf
add esp, 0x18
jmp 0x402fb3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, ebx
jne 0x40321e
cmp dword [ebp - 0x28], ebx
je 0x40321e
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x50f0], ebx
je 0x403200
add eax, 0x50f4
push eax
call fcn.00401b0f
or dword [ebp + 8], 0xffffffff
mov esi, eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x28]
mov dword [ebp - 0x14], ebx
call dword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
mov eax, dword [ebp + 8]
and eax, esi
push eax
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_SetProcessAffinityMask]
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x4620], ebx
je 0x40321e
cmp dword [eax + 0x4624], ebx
je 0x40321e
push 0xffffffffffffffff
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea esi, [ebp - 0x3c]
call fcn.00406786
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 8