Function at 0x5140bd
Capabilities:
Query environment variable

Disassembly:
push 0x8a0
mov eax, 0x60e149
call fcn.00579b23
mov esi, dword [ebp + 0x10]
cmp esi, 2
mov eax, dword [ebp + 8]
mov dword [ebp - 0x8a4], eax
je 0x5140e9
cmp esi, 1
je 0x5140e9
xor al, al
jmp 0x514378
lea eax, [ebp - 0x8a8]
push eax
lea eax, [ebp - 0x1c]
mov edi, 0x6e5ac0
xor ebx, ebx
push eax
mov ecx, edi
mov byte [ebp - 0x89d], bl
mov dword [ebp - 0x8a8], esi
call fcn.00513159
push edi
push dword [0x6e5ac4]
lea ecx, [ebp - 0x8ac]
call fcn.00512ad2
lea eax, [ebp - 0x8ac]
push eax
lea ecx, [ebp - 0x1c]
call fcn.005125df
test al, al
jne 0x514190
lea ecx, [ebp - 0x1c]
call fcn.005126ab
mov ecx, dword [eax + 0xc]
sub ecx, dword [eax + 8]
add eax, 4
push ecx
mov ecx, dword [ebp - 0x8a4]
call fcn.004db00d
lea ecx, [ebp - 0x1c]
call fcn.005126ab
mov esi, dword [eax + 0xc]
sub esi, dword [eax + 8]
add eax, 4
lea ecx, [ebp - 0x1c]
call fcn.005126ab
push esi
push ebx
lea ecx, [eax + 4]
call fcn.0041f3a3
mov ecx, dword [ebp - 0x8a4]
push eax
push ebx
call fcn.0041f3a3
push eax
call fcn.005804e0
add esp, 0xc
mov al, 1
jmp 0x514378
push 1
push str.BootCode.HarvestBootCode
mov ecx, 0x6e8660
call fcn.00414746
mov ecx, eax
call fcn.00477ffa
test al, al
je 0x514372
cmp esi, 2
push 0x3ff
lea eax, [ebp - 0x81c]
push eax
jne 0x5141c8
push str._WINDIR__system32untfs.dll
jmp 0x5141cd
push 0x64063c
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 1
lea ecx, [ebp - 0x89c]
call fcn.00426c3d
lea eax, [ebp - 0x81c]
push eax
mov dword [ebp - 4], ebx
call fcn.0042651e
test al, al
pop ecx
je 0x514358
push 3
push 0x81
lea eax, [ebp - 0x81c]
push eax
lea ecx, [ebp - 0x89c]
call fcn.004272d4
lea ecx, [ebp - 0x89c]
call fcn.00426d83
test al, al
je 0x514358
push 2
push ebx
push ebx
lea ecx, [ebp - 0x89c]
call fcn.00412a04
lea ecx, [ebp - 0x89c]
call fcn.004129bb
mov esi, eax
push esi
call fcn.0040101b
pop ecx
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x89c]
mov dword [ebp - 0x8a8], eax
call fcn.00412a04
push esi
push dword [ebp - 0x8a8]
lea ecx, [ebp - 0x89c]
call fcn.004128d6
cmp dword [ebp + 0x10], 2
jne 0x514296
push ebx
lea ecx, [ebp - 0x11]
push ebx
push ecx
mov byte [ebp - 0x18], 0xeb
mov byte [ebp - 0x17], 0x52
mov byte [ebp - 0x16], 0x90
mov byte [ebp - 0x14], 0x54
mov byte [ebp - 0x13], 0x46
mov byte [ebp - 0x12], 0x53
lea ecx, [ebp - 0x18]
jmp 0x5142d1
cmp dword [ebp + 0x10], 1
jne 0x514341
push ebx
lea ecx, [ebp - 0x11]
push ebx
push ecx
mov byte [ebp - 0x1c], 0xeb
mov byte [ebp - 0x1b], 0x58
mov byte [ebp - 0x1a], 0x90
mov byte [ebp - 0x19], 0x4d
mov byte [ebp - 0x18], 0x53
mov byte [ebp - 0x17], 0x57
mov byte [ebp - 0x16], 0x49
mov byte [ebp - 0x14], 0x34
mov byte [ebp - 0x13], 0x2e
mov byte [ebp - 0x12], 0x31
lea ecx, [ebp - 0x1c]
mov eax, dword [ebp - 0x8a8]
push ecx
add esi, eax
push esi
push eax
mov byte [ebp - 0x15], 0x4e
call fcn.00512e0f
add esp, 0x18
cmp eax, ebx
mov dword [ebp - 0x18], eax
je 0x514341
cmp eax, esi
jae 0x514341
push dword [ebp + 0xc]
mov ecx, dword [ebp - 0x8a4]
call fcn.004db00d
push dword [ebp + 0xc]
mov ecx, dword [ebp - 0x8a4]
push dword [ebp - 0x18]
push ebx
call fcn.0041f3a3
push eax
call fcn.005804e0
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
mov ecx, edi
call fcn.00513fcd
push dword [ebp - 0x8a4]
mov ecx, eax
call fcn.00512fa5
mov byte [ebp - 0x89d], 1
push dword [ebp - 0x8a8]
call fcn.00401009
pop ecx
lea ecx, [ebp - 0x89c]
call fcn.00426d56
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x894]
call fcn.00426683
lea ecx, [ebp - 0x834]
call fcn.0040d273
mov al, byte [ebp - 0x89d]
call fcn.00579ba6
ret 0xc