Function at 0x404bd4
Capabilities:
Query environment variable

Disassembly:
push ebp
push ebx
push edi
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00426350
push edx
call fcn.004261b0
pop edx
push eax
push edx
call fcn.004261b0
pop edx
push eax
call fcn.0041a920
lea eax, [esp + 4]
push eax
call fcn.004261f0
push edx
call fcn.004261b0
pop edx
push eax
push edx
call fcn.004261b0
pop edx
push eax
push 0x1f4
call fcn.00423a90
lea eax, [esp + 8]
push eax
call fcn.004261f0
push 0x1f4
mov eax, dword [esp + 8]
push eax
mov eax, str.WINDIR
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
push 0x1f4
mov eax, dword [esp + 8]
push eax
mov eax, str.WINDIR
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
mov edx, dword [esp + 4]
push edx
call fcn.004261b0
pop edx
push eax
push edx
call fcn.00426280
mov edx, str.System32
push edx
call fcn.00426280
push 0x5064a8
call fcn.004261f0
mov edx, dword [esp + 4]
push edx
call fcn.004261b0
pop edx
push eax
push edx
call fcn.00426280
push 0x506404
call fcn.004261f0
push edx
call fcn.004261b0
pop edx
push eax
mov edx, dword [esp + 8]
push edx
call fcn.004261b0
pop edx
push eax
push edx
call fcn.00426280
mov edx, str.SysNativecmd.exe
push edx
call fcn.00426280
call fcn.0040c9c2
add dword [esp], edx
call fcn.0041a66e
call fcn.0040c9e0
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jg 0x404cde
jl 0x404cda
cmp ebx, 0
ja 0x404cde
xor eax, eax
jmp 0x404ce3
mov eax, 1
or eax, eax
je 0x404d10
mov edx, dword [esp + 4]
push edx
call fcn.004261b0
pop edx
push eax
push edx
call fcn.00426280
mov edx, str.SysNative
push edx
call fcn.00426280
lea eax, [esp + 8]
push eax
call fcn.004261f0
jmp 0x404d37
mov edx, dword [esp + 4]
push edx
call fcn.004261b0
pop edx
push eax
push edx
call fcn.00426280
mov edx, str.System32
push edx
call fcn.00426280
lea eax, [esp + 8]
push eax
call fcn.004261f0
push dword [0x506404]
call fcn.0041a965
push edx
call fcn.004261b0
pop edx
push eax
mov edx, dword [0x506404]
push edx
call fcn.004261b0
pop edx
push eax
push edx
call fcn.00426280
mov edx, str.DefenderTools.xml
push edx
call fcn.00426280
call fcn.004262e0
push 0
call fcn.0040c9c2
add dword [esp + 4], edx
call fcn.0041b470
call fcn.0040c9e0
mov ebp, str.__xml_version_1.0__encoding_UTF_16____r_n_Task_version_1.2__xmlns_http:__schemas.microsoft.com_windows_2004_02_mit_task___r_n___RegistrationInfo__r_n_____Date_2014_10_15T18:54:19.4648216__Date__r_n_____Author_RATIBORUS__Author__r_n_____URI_DefenderTools__URI__r_n____RegistrationInfo__r_n___Triggers__r_n_____LogonTrigger__r_n_______Enabled_true__Enabled__r_n_______Delay_PT30S__Delay__r_n______LogonTrigger__r_n____Triggers__r_n___Principals__r_n_____Principal_id_Author___r_n_______GroupId_S_1_5_32_544__GroupId__r_n_______RunLevel_HighestAvailable__RunLevel__r_n______Principal__r_n____Principals__r_n___Settings__r_n_____MultipleInstancesPolicy_IgnoreNew__MultipleInstancesPolicy__r_n_____DisallowStartIfOnBatteries_false__DisallowStartIfOnBatteries__r_n_____StopIfGoingOnBatteries_true__StopIfGoingOnBatteries__r_n_____AllowHardTerminate_false__AllowHardTerminate__r_n_____StartWhenAvailable_true__StartWhenAvailable__r_n_____RunOnlyIfNetworkAvailable_false__RunOnlyIfNetworkAvailable__r_n_____IdleSettings__r_n_______StopOnIdleEnd_true__StopOnIdleEnd__r_n_______RestartOnIdle_false__RestartOnIdle__r_n______IdleSettings__r_n_____AllowStartOnDemand_true__AllowStartOnDemand__r_n_____Enabled_true__Enabled__r_n_____Hidden_true__Hidden__r_n_____RunOnlyIfIdle_false__RunOnlyIfIdle__r_n_____WakeToRun_false__WakeToRun__r_n_____ExecutionTimeLimit_PT0S__ExecutionTimeLimit__r_n_____Priority_7__Priority__r_n_____RestartOnFailure__r_n_______Interval_PT1M__Interval__r_n_______Count_3__Count__r_n______RestartOnFailure__r_n____Settings__r_n___Actions_Context_Author___r_n_____Exec__r_n_______Command__XXXXXXXXXX___Command__r_n_t___Arguments__min__Arguments__r_n_______WorkingDirectory_YYYYYYYYYY__WorkingDirectory__r_n______Exec__r_n____Actions__r_n__Task_
mov dword [esp + 8], ebp
jmp 0x404d91
mov ebp, 0x502efa
mov ebx, ebp
dec ebx
cmp ebx, dword [esp + 8]
jl 0x404db9
mov eax, dword [esp + 8]
call fcn.0040c920
push eax
push 0
call fcn.0041b900
inc dword [esp + 8]
jno 0x404d91
push 0
call fcn.0041b180
push edx
call fcn.004261b0
pop edx
push eax
mov edx, dword [0x506404]
push edx
call fcn.004261b0
pop edx
push eax
push edx
call fcn.00426280
mov edx, str.DefenderTools.xml
push edx
call fcn.00426280
call fcn.0040c9c2
add dword [esp], edx
call fcn.0041a66e
call fcn.0040c9e0
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jg 0x404e10
jl 0x404e0c
cmp ebx, 0
ja 0x404e10
xor eax, eax
jmp 0x404e15
mov eax, 1
or eax, eax
je 0x404ecd
push edx
call fcn.004261b0
pop edx
push eax
mov edx, dword [0x506404]
push edx
call fcn.004261b0
pop edx
push eax
push edx
call fcn.00426280
mov edx, str.DefenderTools.xml
push edx
call fcn.00426280
call fcn.004262e0
push 0
call fcn.0040c9c2
add dword [esp + 4], edx
call fcn.0041b600
call fcn.0040c9e0
push 0
call fcn.0041b6c0
mov ebx, eax
and ebx, ebx
jne 0x404ecd
push edx
call fcn.004261b0
pop edx
push eax
push edx
call fcn.004261b0
pop edx
push eax
push 0x19
push 0
call fcn.0041b760
lea eax, [esp + 0x10]
push eax
call fcn.004261f0
mov edx, dword [esp + 0x10]
push edx
call fcn.004261b0
pop edx
push eax
push edx
call fcn.00426280
mov edx, dword [esp + 0x10]
push edx
call fcn.00426280
mov edx, 0x475622
push edx
call fcn.00426280
lea eax, [esp + 0x14]
push eax
call fcn.004261f0
jmp 0x404e61
push 0
call fcn.0041b180
push edx
call fcn.004261b0
pop edx
push eax
push 2
mov edx, dword [0x506404]
push edx
call fcn.004261b0
pop edx
push eax
push edx
call fcn.00426280
mov edx, str.DefenderTools.xml
push edx
call fcn.00426280
call fcn.0040c9c2
add dword [esp], edx
call fcn.0041a8b7
call fcn.0040c9e0
push edx
call fcn.004261b0
pop edx
push eax
push edx
call fcn.004261b0
pop edx
push eax
push 1
push 1
push 0
push edx
call fcn.004261b0
pop edx
push eax
push edx
call fcn.004261b0
pop edx
push eax
call fcn.0040d82b
call fcn.004262e0
mov eax, str.XXXXXXXXXX
push eax
push dword [esp + 0x2c]
call fcn.0040c9c2
add dword [esp + 8], edx
call fcn.004243a0
lea eax, [esp + 0x14]
push eax
call fcn.004261f0
push edx
call fcn.004261b0
pop edx
push eax
push edx
call fcn.004261b0
pop edx
push eax
push 1
push 1
push 0
push edx
call fcn.004261b0
pop edx
push eax
push edx
call fcn.004261b0
pop edx
push eax
push edx
call fcn.004261b0
pop edx
push eax
push edx
call fcn.004261b0
pop edx
push eax
call fcn.0040d82b
call fcn.0040c9c2
add dword [esp], edx
call fcn.0041a838
call fcn.004262e0
mov eax, 0x475628
push eax
push dword [esp + 0x2c]
call fcn.0040c9c2
add dword [esp + 8], edx
call fcn.004243a0
lea eax, [esp + 0x14]
push eax
call fcn.004261f0
push edx
call fcn.004261b0
pop edx
push eax
mov edx, dword [0x506404]
push edx
call fcn.004261b0
pop edx
push eax
push edx
call fcn.00426280
mov edx, str.DefenderTools.xml
push edx
call fcn.00426280
call fcn.004262e0
push 0
call fcn.0040c9c2
add dword [esp + 4], edx
call fcn.0041b470
call fcn.0040c9e0
push 0x19
push dword [esp + 0x14]
push 0
call fcn.0041ba60
push 0
call fcn.0041b180
push 3
push dword [0x506404]
mov eax, str._End__TN_DefenderTools
push eax
mov eax, str.schtasks.exe
push eax
call fcn.0040d8ca
push 3
push dword [0x506404]
mov eax, str._delete__TN_DefenderTools__F
push eax
mov eax, str.schtasks.exe
push eax
call fcn.0040d8ca
push edx
call fcn.004261b0
pop edx
push eax
push 3
push dword [0x506404]
push edx
call fcn.004261b0
pop edx
push eax
mov edx, 0x472aac
push edx
call fcn.00426280
mov edx, dword [0x506404]
push edx
call fcn.00426280
mov edx, str.DefenderTools.xml
push edx
call fcn.00426280
call fcn.004262e0
mov eax, str.schtasks.exe
push eax
call fcn.0040c9c2
add dword [esp + 4], edx
call fcn.0040d8ca
call fcn.0040c9e0
push edx
call fcn.004261b0
pop edx
push eax
push 2
mov edx, dword [0x506404]
push edx
call fcn.004261b0
pop edx
push eax
push edx
call fcn.00426280
mov edx, str.DefenderTools.xml
push edx
call fcn.00426280
call fcn.0040c9c2
add dword [esp], edx
call fcn.0041a8b7
call fcn.0040c9e0
call fcn.00403985
xor eax, eax
push dword [esp]
call fcn.004263b0
push dword [esp + 4]
call fcn.004263b0
push dword [esp + 0xc]
call fcn.004263b0
push dword [esp + 0x10]
call fcn.004263b0
add esp, 0x14
pop edi
pop ebx
pop ebp
ret