Function at 0x513998
Capabilities:
Query environment variable

Disassembly:
push 0x8a0
mov eax, 0x60d9d9
call fcn.005793f3
mov esi, dword [ebp + 0x10]
cmp esi, 2
mov eax, dword [ebp + 8]
mov dword [ebp - 0x8a4], eax
je 0x5139c4
cmp esi, 1
je 0x5139c4
xor al, al
jmp 0x513c53
lea eax, [ebp - 0x8a8]
push eax
lea eax, [ebp - 0x1c]
mov edi, 0x6e42c0
xor ebx, ebx
push eax
mov ecx, edi
mov byte [ebp - 0x89d], bl
mov dword [ebp - 0x8a8], esi
call fcn.00512a34
push edi
push dword [0x6e42c4]
lea ecx, [ebp - 0x8ac]
call fcn.005123ad
lea eax, [ebp - 0x8ac]
push eax
lea ecx, [ebp - 0x1c]
call fcn.00511eba
test al, al
jne 0x513a6b
lea ecx, [ebp - 0x1c]
call fcn.00511f86
mov ecx, dword [eax + 0xc]
sub ecx, dword [eax + 8]
add eax, 4
push ecx
mov ecx, dword [ebp - 0x8a4]
call fcn.004da8e8
lea ecx, [ebp - 0x1c]
call fcn.00511f86
mov esi, dword [eax + 0xc]
sub esi, dword [eax + 8]
add eax, 4
lea ecx, [ebp - 0x1c]
call fcn.00511f86
push esi
push ebx
lea ecx, [eax + 4]
call fcn.0041eeb0
mov ecx, dword [ebp - 0x8a4]
push eax
push ebx
call fcn.0041eeb0
push eax
call fcn.0057fb20
add esp, 0xc
mov al, 1
jmp 0x513c53
push 1
push str.BootCode.HarvestBootCode
mov ecx, 0x6e6e58
call fcn.00414253
mov ecx, eax
call fcn.004779cf
test al, al
je 0x513c4d
cmp esi, 2
push 0x3ff
lea eax, [ebp - 0x81c]
push eax
jne 0x513aa3
push str._WINDIR__system32untfs.dll
jmp 0x513aa8
push 0x63f6f4
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 1
lea ecx, [ebp - 0x89c]
call fcn.0042674a
lea eax, [ebp - 0x81c]
push eax
mov dword [ebp - 4], ebx
call fcn.0042602b
test al, al
pop ecx
je 0x513c33
push 3
push 0x81
lea eax, [ebp - 0x81c]
push eax
lea ecx, [ebp - 0x89c]
call fcn.00426de1
lea ecx, [ebp - 0x89c]
call fcn.00426890
test al, al
je 0x513c33
push 2
push ebx
push ebx
lea ecx, [ebp - 0x89c]
call fcn.004114ed
lea ecx, [ebp - 0x89c]
call fcn.004114a4
mov esi, eax
push esi
call fcn.0040101b
pop ecx
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x89c]
mov dword [ebp - 0x8a8], eax
call fcn.004114ed
push esi
push dword [ebp - 0x8a8]
lea ecx, [ebp - 0x89c]
call fcn.004113bf
cmp dword [ebp + 0x10], 2
jne 0x513b71
push ebx
lea ecx, [ebp - 0x11]
push ebx
push ecx
mov byte [ebp - 0x18], 0xeb
mov byte [ebp - 0x17], 0x52
mov byte [ebp - 0x16], 0x90
mov byte [ebp - 0x14], 0x54
mov byte [ebp - 0x13], 0x46
mov byte [ebp - 0x12], 0x53
lea ecx, [ebp - 0x18]
jmp 0x513bac
cmp dword [ebp + 0x10], 1
jne 0x513c1c
push ebx
lea ecx, [ebp - 0x11]
push ebx
push ecx
mov byte [ebp - 0x1c], 0xeb
mov byte [ebp - 0x1b], 0x58
mov byte [ebp - 0x1a], 0x90
mov byte [ebp - 0x19], 0x4d
mov byte [ebp - 0x18], 0x53
mov byte [ebp - 0x17], 0x57
mov byte [ebp - 0x16], 0x49
mov byte [ebp - 0x14], 0x34
mov byte [ebp - 0x13], 0x2e
mov byte [ebp - 0x12], 0x31
lea ecx, [ebp - 0x1c]
mov eax, dword [ebp - 0x8a8]
push ecx
add esi, eax
push esi
push eax
mov byte [ebp - 0x15], 0x4e
call fcn.005126ea
add esp, 0x18
cmp eax, ebx
mov dword [ebp - 0x18], eax
je 0x513c1c
cmp eax, esi
jae 0x513c1c
push dword [ebp + 0xc]
mov ecx, dword [ebp - 0x8a4]
call fcn.004da8e8
push dword [ebp + 0xc]
mov ecx, dword [ebp - 0x8a4]
push dword [ebp - 0x18]
push ebx
call fcn.0041eeb0
push eax
call fcn.0057fb20
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
mov ecx, edi
call fcn.005138a8
push dword [ebp - 0x8a4]
mov ecx, eax
call fcn.00512880
mov byte [ebp - 0x89d], 1
push dword [ebp - 0x8a8]
call fcn.00401009
pop ecx
lea ecx, [ebp - 0x89c]
call fcn.00426863
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x894]
call fcn.00426190
lea ecx, [ebp - 0x834]
call fcn.0040db2e
mov al, byte [ebp - 0x89d]
call fcn.00579476
ret 0xc