Function at 0x50f6d0
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x2004
call fcn.0052f720
mov eax, dword [0x58bb30]
xor eax, esp
mov dword [esp + 0x2000], eax
mov eax, dword [esp + 0x2008]
push ebx
mov ebx, dword [esp + 0x2010]
push ebp
mov eax, dword [eax]
mov ebp, dword [esp + 0x2024]
push esi
push edi
mov edi, dword [esp + 0x2024]
cmp eax, 0xf
ja case.default.0x50f713
jmp dword [eax*4 + 0x50fe6c]
mov esi, dword [esp + 0x2028]
push esi
push 0x557718
push edi
push str.TaskbarGroupIcon
push str.Applications_avpui.exe
push SysReAllocString
call fcn.004cf620
push esi
push str.avp.com
push edi
call fcn.004a2ea0
push 1
push 1
push str.SCAN
push dword [esp + 0x203c]
push ebp
push edi
push dword [esp + 0x2038]
push ebx
push str.Kaspersky_Anti_Virus
call fcn.0050feb0
test al, al
jne 0x50fe46
push esi
push 0x557718
push edi
push 0x557718
push str.AVP_shellopencommand
push SysReAllocString
call fcn.004cf620
cmp word [edi], 0x22
jne 0x50f7ad
lea eax, [edi + 2]
push 0x22
push eax
call fcn.00530cd5
add esp, 8
test eax, eax
je 0x50f7ad
xor ecx, ecx
mov word [eax + 2], cx
push esi
push str.avp.com
push edi
call fcn.004a2ea0
push 1
push 1
push str.SCAN
push dword [esp + 0x203c]
push ebp
push edi
push dword [esp + 0x2038]
push ebx
push str.Kaspersky_Anti_Virus
jmp 0x50fd43
mov esi, dword [esp + 0x2028]
push esi
push 0x557718
push edi
push 0x557718
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsDrweb32w.exe
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004cf620
cmp word [edi], 0
jne 0x50f81b
push esi
push 0x557718
push edi
push str.ExePath
push str.SoftwareIDAVLABDrweb32w
call fcn.004cf7c0
push 1
push 0
push str._AL__SS___SD__SHELL
push dword [esp + 0x203c]
push ebp
push edi
push dword [esp + 0x2038]
push ebx
push str.Dr.Web
jmp 0x50fd43
push dword [esp + 0x2028]
push 0x557718
push edi
push 0x557718
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsNavw32.exe
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004cf620
push 1
push 0
push 0
push dword [esp + 0x203c]
push ebp
push edi
push dword [esp + 0x2038]
push ebx
push str.Norton_AntiVirus
jmp 0x50fd43
push dword [esp + 0x2028]
push 0x557718
push edi
push str.szScannerExe
push str.SOFTWARENetwork_AssociatesTVDVirusScanAVConsolGeneral
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004cf620
push 1
push 0
push 0
push dword [esp + 0x203c]
push ebp
push edi
push dword [esp + 0x2038]
push ebx
push str.McAfee_VirusScan
jmp 0x50fd43
mov esi, dword [esp + 0x2028]
push esi
push 0x557718
push edi
push str.InstallLocation
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallEAAAB119_D0BF_4FF4_B6F0_B6FB0393921A
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004cf620
push esi
push edi
call fcn.004a0eb0
push esi
push str.scanner.exe
push edi
call fcn.004bd030
push 1
push 0
push str._nostartup
push dword [esp + 0x203c]
push ebp
push edi
push dword [esp + 0x2038]
push ebx
push str.Stop__Scanner
jmp 0x50fd43
mov esi, dword [esp + 0x2028]
push esi
push 0x557718
push edi
push 0x55afdc
push str.SOFTWAREData_FellowsF_SecureAnti_Virus
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004cf620
push esi
push edi
call fcn.004a0eb0
push esi
push str.fsav.exe
push edi
call fcn.004bd030
push 1
push 0
push str._BEEP__NOBOOT
push dword [esp + 0x203c]
push ebp
push edi
push dword [esp + 0x2038]
push ebx
push str.F_Secure_Anti_Virus
jmp 0x50fd43
mov esi, dword [esp + 0x2028]
push esi
push 0x557718
push edi
push 0x55afdc
push str.SOFTWARESophosSweepNT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004cf620
push esi
push edi
call fcn.004a0eb0
push esi
push str.sav32cli.exe
push edi
call fcn.004bd030
push 1
push 0
push 0
push dword [esp + 0x203c]
push ebp
push edi
push dword [esp + 0x2038]
push ebx
push str.Sophos_Anti_Virus
jmp 0x50fd43
mov esi, dword [esp + 0x2028]
push esi
push 0x557718
push edi
push 0x557718
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsAVGSE.DLL
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004cf620
push 2
push 0x557920
push edi
call fcn.004a2e40
push 1
push 0
push 0
push dword [esp + 0x203c]
push ebp
push edi
push dword [esp + 0x2038]
push ebx
push str.AVG_Anti_Virus
call fcn.0050feb0
test al, al
jne 0x50fe46
push esi
push str.avgw.exe
push edi
call fcn.004a2ea0
push 1
push 1
push 0x56c09c
push dword [esp + 0x203c]
push ebp
push edi
push dword [esp + 0x2038]
push ebx
push str.AVG_Anti_Virus
call fcn.0050feb0
test al, al
jne 0x50fe46
push esi
push str.avgscanx.exe
push edi
call fcn.004a2ea0
push 0
push 1
push str._SCAN
push dword [esp + 0x203c]
push ebp
push edi
push dword [esp + 0x2038]
push ebx
push str.AVG_Anti_Virus
call fcn.0050feb0
test al, al
jne 0x50fe46
push esi
push str.avgscana.exe
push edi
call fcn.004a2ea0
push 0
push 1
push str._SCAN
push dword [esp + 0x203c]
push ebp
push edi
push dword [esp + 0x2038]
push ebx
push str.AVG_Anti_Virus
jmp 0x50fd43
push dword [esp + 0x2028]
push 0x557718
push edi
push 0x557718
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths_vet32.exe
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004cf620
push 1
push 0
push str._sub__nobootscan__nomemoryscan
push dword [esp + 0x203c]
push ebp
push edi
push dword [esp + 0x2038]
push ebx
push str.eTrust_EZ_Antivirus
jmp 0x50fd43
mov esi, dword [esp + 0x2028]
push esi
push 0x557718
push edi
push str.InstallDir
push str.SOFTWAREESetNODCurrentVersionInfo
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004cf620
push esi
push edi
call fcn.004a0eb0
push esi
push str.nod32.exe
push edi
call fcn.004bd030
push 1
push 0
push str._scanfile__scanboot___scanmbr_
push dword [esp + 0x203c]
push ebp
push edi
push dword [esp + 0x2038]
push ebx
push str.NOD32_Antivirus
jmp 0x50fd43
mov esi, dword [esp + 0x2028]
push esi
push 0x557718
push edi
push str.UninstallString
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallClamAV
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004cf620
push esi
push str.binclamscan.exe
push edi
call fcn.004a2ea0
push 1
push 0
push str.__infected___recursive
push dword [esp + 0x203c]
push ebp
push edi
push dword [esp + 0x2038]
push ebx
push str.Clam_AntiVirus
jmp 0x50fd43
mov esi, dword [esp + 0x2028]
push esi
push 0x557718
push edi
push 0x557718
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsAvastUI.exe
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004cf620
cmp word [edi], 0
jne 0x50fbf6
push esi
push 0x557718
push edi
push 0x557718
push str.CLSID472083B0_C522_11CF_8763_00608CC02F24InProcServer32
push SysReAllocString
call fcn.004cf620
push esi
push str.ashQuick.exe
push edi
call fcn.004a2ea0
push 1
push 0
push 0
push dword [esp + 0x203c]
push ebp
push edi
push dword [esp + 0x2038]
push ebx
push str.avast__Antivirus
jmp 0x50fd43
push 0x800
push 0x557718
lea eax, [esp + 0x18]
push eax
push str.AppID
push str.AppIDKVSrvXP.exe
push SysReAllocString
call fcn.004cf620
cmp word [esp + 0x10], 0
je 0x50fd50
lea eax, [esp + 0x10]
push eax
push str.CLSID_sInprocServer32
lea eax, [esp + 0x1018]
push 0x800
push eax
call fcn.00404ce0
mov esi, dword [esp + 0x2038]
lea eax, [esp + 0x1020]
add esp, 0x10
push esi
push 0x557718
push edi
push 0x557718
push eax
push SysReAllocString
call fcn.004cf620
push esi
push str.KVScan.kxp
push edi
call fcn.004a2ea0
push 1
push 0
push 0
push dword [esp + 0x203c]
push ebp
push edi
push dword [esp + 0x2038]
push ebx
push str.Jiangmin_AntiVirus
jmp 0x50fd43
push 0x800
push 0x557718
lea eax, [esp + 0x18]
push eax
push str.ImagePath
push str.SYSTEMCurrentControlSetServices_avgntflt
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004cf620
push 4
lea eax, [esp + 0x14]
push 0x567308
push eax
call fcn.00538b7d
add esp, 0xc
test eax, eax
lea eax, [esp + 0x18]
je 0x50fd06
lea eax, [esp + 0x10]
mov esi, dword [esp + 0x2028]
push esi
push eax
push edi
call fcn.00538bb7
add esp, 0xc
push esi
push str.avcmd.exe
push edi
call fcn.004a2ea0
push 1
push 0
push str._s__noboot__nombr
push dword [esp + 0x203c]
push ebp
push edi
push dword [esp + 0x2038]
push ebx
push str.Avira_AntiVir
call fcn.0050feb0
test al, al
jne 0x50fe46
mov eax, 1
jmp 0x50fe4f
mov esi, dword [esp + 0x2028]
push esi
push edi
push str._ProgramFiles_Windows_DefenderMpCmdRun.exe
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x50fda2
cmp eax, esi
jae 0x50fda2
push 1
push 1
push str._Scan__ScanType_3__File
push dword [esp + 0x203c]
push ebp
push edi
push dword [esp + 0x2038]
push ebx
push str.Windows_Defender
call fcn.0050feb0
test al, al
jne 0x50fe46
push esi
push 0x557718
push edi
push 0x557718
push str.windowsdefenderDefaultIcon
push SysReAllocString
call fcn.004cf620
push esi
push str.MpCmdRun.exe
push edi
call fcn.004a2ea0
push 1
push 1
push str._Scan__ScanType_3__File
push dword [esp + 0x203c]
push ebp
push edi
push dword [esp + 0x2038]
push ebx
push str.Windows_Defender
call fcn.0050feb0
xor ecx, ecx
test al, al
sete cl
mov eax, ecx
jmp 0x50fe4f
push dword [esp + 0x2020]
push 0x544
call fcn.004b68d0
push eax
push ebx
call fcn.004bd090
push dword [esp + 0x2028]
push 0x557718
push edi
push 0x567424
push str.VirusScan
call fcn.004cf7c0
push 0x800
push 0x557718
push ebp
push str.Param
push str.VirusScan
call fcn.004cf7c0
xor eax, eax
jmp 0x50fe4f
mov eax, 2
mov ecx, dword [esp + 0x2010]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0052f708
add esp, 0x2004
ret 0x1c