Function at 0x1400022b0
Capabilities:
Get common file path
Query environment variable

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb0
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov rax, qword [0x1400120a8]
xor rax, rsp
mov qword [rsp + 0xa8], rax
mov r14, rdx
mov r12, rcx
mov qword [rsp + 0x48], rdx
xor r15d, r15d
mov ebx, r15d
mov qword [rsp + 0x38], rbx
xor eax, eax
or r9, 0xffffffffffffffff
mov rcx, r9
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
mov esi, ecx
lea eax, [rcx + 0x104]
mov dword [rsp + 0x30], eax
mov edi, r15d
lea r13d, [r8 - 0x4000]
cmp r13d, 0x3ffe
ja 0x140002388
lea rcx, [0x14000f6a8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rdi, rax
test rax, rax
je 0x140002d97
lea rdx, str.SHGetFolderPathW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
test rax, rax
je 0x14000237a
mov ecx, 0x20a
call fcn.1400044f4
mov rbx, rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, r13d
xor ecx, ecx
call rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x140002d97
cmp r8d, 0x101d0
jg 0x140002bec
je 0x140002b3e
cmp r8d, 0x37
ja case.0x1400023bd.0
movsxd rax, r8d
lea rdx, [0x140000000]
movzx eax, byte [rdx + rax + 0x2e44]
mov ecx, dword [rdx + rax*4 + 0x2dfc]
add rcx, rdx
jmp rcx
mov ecx, dword [rsp + 0x30]
inc ecx
mov eax, 2
mul rcx
cmovo rax, r9
mov rcx, rax
call fcn.1400044f4
mov rbx, rax
mov qword [rsp + 0x38], rax
mov word [rax], r15w
jmp 0x140002d97
cmp qword [r12 + 0x80], 0
jne 0x140002459
mov eax, 0x5c
mov word [rsp + 0x40], ax
lea rdx, [rsp + 0x40]
lea rcx, [r12 + 0x48]
call fcn.140002f60
mov r8, rax
lea rdx, [rsp + 0x58]
lea rcx, [r12 + 0x48]
call fcn.140002e80
nop
lea rcx, [r12 + 0x70]
mov rdx, rax
call fcn.140002ec0
nop
cmp qword [rsp + 0x70], 8
jb 0x140002441
mov rcx, qword [rsp + 0x58]
call fcn.140004530
mov qword [rsp + 0x70], 7
mov qword [rsp + 0x68], r15
mov word [rsp + 0x58], r15w
or r9, 0xffffffffffffffff
mov rax, qword [r12 + 0x80]
add eax, esi
mov dword [rsp + 0x30], eax
lea ecx, [rax + 1]
mov eax, 2
mul rcx
cmovo rax, r9
mov rcx, rax
call fcn.1400044f4
mov rbx, rax
lea r8, [r12 + 0x70]
cmp qword [r8 + 0x18], 8
mov qword [rsp + 0x38], rax
jb 0x140002495
mov r8, qword [r8]
mov edx, dword [rsp + 0x30]
inc edx
mov rcx, rax
call fcn.140004fb0
jmp 0x140002d97
test rbx, rbx
je 0x1400024c5
mov rcx, rbx
call fcn.140004d54
mov qword [rsp + 0x38], r15
lea eax, [rdi + rsi]
mov dword [rsp + 0x30], eax
or r9, 0xffffffffffffffff
mov ecx, dword [rsp + 0x30]
inc ecx
mov eax, 2
mul rcx
cmovo rax, r9
mov rcx, rax
call fcn.1400044f4
mov rbx, rax
mov qword [rsp + 0x38], rax
mov edx, dword [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
mov r9, 0xffffffffffffffff
je case.0x1400023bd.10
jmp 0x140002d97
test rbx, rbx
je 0x14000252d
mov rcx, rbx
call fcn.140004d54
mov qword [rsp + 0x38], r15
lea eax, [rdi + rsi]
mov dword [rsp + 0x30], eax
or r9, 0xffffffffffffffff
mov ecx, dword [rsp + 0x30]
inc ecx
mov eax, 2
mul rcx
cmovo rax, r9
mov rcx, rax
call fcn.1400044f4
mov rbx, rax
mov qword [rsp + 0x38], rax
mov edx, dword [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
mov r9, 0xffffffffffffffff
je case.0x1400023bd.11
jmp 0x140002d97
test rbx, rbx
je 0x140002592
mov rcx, rbx
call fcn.140004d54
mov qword [rsp + 0x38], r15
lea eax, [rdi + rsi]
mov dword [rsp + 0x30], eax
or r9, 0xffffffffffffffff
mov ecx, dword [rsp + 0x30]
add ecx, 9
mov eax, 2
mul rcx
cmovo rax, r9
mov rcx, rax
call fcn.1400044f4
mov rbx, rax
mov qword [rsp + 0x38], rax
mov edx, dword [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
mov r9, 0xffffffffffffffff
je case.0x1400023bd.12
mov edx, dword [rsp + 0x30]
add edx, 9
lea r8, str.drivers
mov rcx, rbx
call fcn.14000501c
jmp 0x140002d97
test rbx, rbx
je 0x14000260e
mov rcx, rbx
call fcn.140004d54
mov qword [rsp + 0x38], r15
lea eax, [rdi + rsi]
mov dword [rsp + 0x30], eax
or r9, 0xffffffffffffffff
mov ecx, dword [rsp + 0x30]
add ecx, 5
mov eax, 2
mul rcx
cmovo rax, r9
mov rcx, rax
call fcn.1400044f4
mov rbx, rax
mov qword [rsp + 0x38], rax
mov edx, dword [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
mov r9, 0xffffffffffffffff
je case.0x1400023bd.17
mov edx, dword [rsp + 0x30]
add edx, 5
lea r8, str.inf
mov rcx, rbx
call fcn.14000501c
jmp 0x140002d97
test rbx, rbx
je 0x14000268d
mov rcx, rbx
call fcn.140004d54
mov qword [rsp + 0x38], r15
lea eax, [rdi + rsi]
mov dword [rsp + 0x30], eax
or r9, 0xffffffffffffffff
mov ecx, dword [rsp + 0x30]
add ecx, 6
mov eax, 2
mul rcx
cmovo rax, r9
mov rcx, rax
call fcn.1400044f4
mov rbx, rax
mov qword [rsp + 0x38], rax
mov edx, dword [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
mov r9, 0xffffffffffffffff
je case.0x1400023bd.18
mov edx, dword [rsp + 0x30]
add edx, 6
lea r8, str.Help
mov rcx, rbx
call fcn.14000501c
jmp 0x140002d97
test rbx, rbx
je 0x14000270d
mov rcx, rbx
call fcn.140004d54
mov qword [rsp + 0x38], r15
lea eax, [rdi + rsi]
mov dword [rsp + 0x30], eax
or r9, 0xffffffffffffffff
mov ecx, dword [rsp + 0x30]
add ecx, 7
mov eax, 2
mul rcx
cmovo rax, r9
mov rcx, rax
call fcn.1400044f4
mov rbx, rax
mov qword [rsp + 0x38], rax
mov edx, dword [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
mov r9, 0xffffffffffffffff
je case.0x1400023bd.20
mov edx, dword [rsp + 0x30]
add edx, 7
lea r8, str.Fonts
mov rcx, rbx
call fcn.14000501c
jmp 0x140002d97
test rbx, rbx
je 0x14000278d
mov rcx, rbx
call fcn.140004d54
mov qword [rsp + 0x38], r15
lea eax, [rdi + rsi]
mov dword [rsp + 0x30], eax
or r9, 0xffffffffffffffff
mov ecx, dword [rsp + 0x30]
add ecx, 9
mov eax, 2
mul rcx
cmovo rax, r9
mov rcx, rax
call fcn.1400044f4
mov rbx, rax
mov qword [rsp + 0x38], rax
mov edx, dword [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
mov r9, 0xffffffffffffffff
je case.0x1400023bd.21
mov edx, dword [rsp + 0x30]
add edx, 9
lea r8, str.Viewers
mov rcx, rbx
call fcn.14000501c
jmp 0x140002d97
test rbx, rbx
je 0x14000280d
mov rcx, rbx
call fcn.140004d54
mov qword [rsp + 0x38], r15
lea eax, [rdi + rsi]
mov dword [rsp + 0x30], eax
or r9, 0xffffffffffffffff
mov ecx, dword [rsp + 0x30]
inc ecx
mov eax, 2
mul rcx
cmovo rax, r9
mov rcx, rax
call fcn.1400044f4
mov rbx, rax
mov qword [rsp + 0x38], rax
mov r8d, dword [rsp + 0x30]
mov rdx, rax
lea rcx, str.HOMEDRIVE
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
mov r9, 0xffffffffffffffff
je case.0x1400023bd.24
jmp 0x140002d97
test rbx, rbx
je 0x14000287d
mov rcx, rbx
call fcn.140004d54
mov qword [rsp + 0x38], r15
lea eax, [rdi + rsi]
mov dword [rsp + 0x30], eax
or r9, 0xffffffffffffffff
mov ecx, dword [rsp + 0x30]
inc ecx
mov eax, 2
mul rcx
cmovo rax, r9
mov rcx, rax
call fcn.1400044f4
mov rbx, rax
mov qword [rsp + 0x38], rax
mov r8d, dword [rsp + 0x30]
mov rdx, rax
lea rcx, str.SystemDrive
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
mov r9, 0xffffffffffffffff
je case.0x1400023bd.30
jmp 0x140002d97
test rbx, rbx
je 0x1400028ed
mov rcx, rbx
call fcn.140004d54
mov qword [rsp + 0x38], r15
lea eax, [rdi + rsi]
mov dword [rsp + 0x30], eax
or r9, 0xffffffffffffffff
mov ecx, dword [rsp + 0x30]
add ecx, 8
mov eax, 2
mul rcx
cmovo rax, r9
mov rcx, rax
call fcn.1400044f4
mov rbx, rax
mov qword [rsp + 0x38], rax
mov edx, dword [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
mov r9, 0xffffffffffffffff
je case.0x1400023bd.50
mov edx, dword [rsp + 0x30]
add edx, 8
lea r8, str._system
mov rcx, rbx
call fcn.14000501c
jmp 0x140002d97
test rbx, rbx
je 0x14000296d
mov rcx, rbx
call fcn.140004d54
mov qword [rsp + 0x38], r15
lea eax, [rdi + rsi]
mov dword [rsp + 0x30], eax
or r9, 0xffffffffffffffff
mov ecx, dword [rsp + 0x30]
add ecx, 7
mov eax, 2
mul rcx
cmovo rax, r9
mov rcx, rax
call fcn.1400044f4
mov rbx, rax
mov qword [rsp + 0x38], rax
mov edx, dword [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
mov r9, 0xffffffffffffffff
je case.0x1400023bd.51
mov edx, dword [rsp + 0x30]
add edx, 7
lea r8, str._spool
mov rcx, rbx
call fcn.14000501c
jmp 0x140002d97
test rbx, rbx
je 0x1400029ea
mov rcx, rbx
call fcn.140004d54
mov qword [rsp + 0x38], r15
add dword [rsp + 0x30], esi
or r9, 0xffffffffffffffff
mov ecx, dword [rsp + 0x30]
inc ecx
mov eax, 2
mul rcx
cmovo rax, r9
mov rcx, rax
call fcn.1400044f4
mov rbx, rax
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x20], eax
mov r9, rbx
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
call qword [sym.imp.WINSPOOL.DRV_GetPrinterDriverDirectoryW]
test eax, eax
jne 0x140002d97
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
mov r9, 0xffffffffffffffff
je case.0x1400023bd.52
jmp 0x140002d97
test rbx, rbx
je 0x140002a6d
mov rcx, rbx
call fcn.140004d54
mov qword [rsp + 0x38], r15
lea eax, [rdi + rsi]
mov dword [rsp + 0x30], eax
or r9, 0xffffffffffffffff
mov ecx, dword [rsp + 0x30]
inc ecx
mov eax, 2
mul rcx
cmovo rax, r9
mov rcx, rax
call fcn.1400044f4
mov rbx, rax
mov qword [rsp + 0x38], rax
mov r8d, dword [rsp + 0x30]
mov rdx, rax
lea rcx, str.USERPROFILE
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
mov r9, 0xffffffffffffffff
je case.0x1400023bd.53
jmp 0x140002d97
test rbx, rbx
je 0x140002ada
mov rcx, rbx
call fcn.140004d54
mov qword [rsp + 0x38], r15
add dword [rsp + 0x30], esi
or r9, 0xffffffffffffffff
mov ecx, dword [rsp + 0x30]
inc ecx
mov eax, 2
mul rcx
cmovo rax, r9
mov rcx, rax
call fcn.1400044f4
mov rbx, rax
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x20], eax
mov r9, rbx
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
call qword [sym.imp.WINSPOOL.DRV_GetPrintProcessorDirectoryW]
test eax, eax
jne 0x140002d97
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
mov r9, 0xffffffffffffffff
je case.0x1400023bd.55
jmp 0x140002d97
cmp qword [r12 + 0x80], 0
jne 0x140002bbf
mov eax, 0x5c
mov word [rsp + 0x40], ax
lea rdx, [rsp + 0x40]
lea rcx, [r12 + 0x48]
call fcn.140002f60
mov r8, rax
lea rdx, [rsp + 0x80]
lea rcx, [r12 + 0x48]
call fcn.140002e80
nop
lea rcx, [r12 + 0x70]
mov rdx, rax
call fcn.140002ec0
nop
cmp qword [rsp + 0x98], 8
jb 0x140002b9e
mov rcx, qword [rsp + 0x80]
call fcn.140004530
mov qword [rsp + 0x98], 7
mov qword [rsp + 0x90], r15
mov word [rsp + 0x80], r15w
or r9, 0xffffffffffffffff
mov rax, qword [r12 + 0x80]
add eax, esi
mov dword [rsp + 0x30], eax
lea ecx, [rax + 1]
mov eax, 2
mul rcx
cmovo rax, r9
mov rcx, rax
call fcn.1400044f4
mov rbx, rax
jmp 0x140002481
sub r8d, 0x101d1
je 0x140002d22
dec r8d
je 0x140002cc0
dec r8d
je case.0x1400023bd.23
dec r8d
je 0x140002d97
jmp case.0x1400023bd.0
lea rcx, str.mscms.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r12, rax
test rax, rax
je 0x140002d97
lea rdx, str.GetColorDirectoryW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x140002cac
or r13, 0xffffffffffffffff
nop word [rax + rax]
test rbx, rbx
je 0x140002c6e
mov rcx, rbx
call fcn.140004d54
mov qword [rsp + 0x38], r15
mov eax, dword [rsp + 0x30]
add eax, esi
mov dword [rsp + 0x30], eax
jmp 0x140002c72
mov eax, dword [rsp + 0x30]
lea ecx, [rax + 1]
mov eax, 2
mul rcx
cmovo rax, r13
mov rcx, rax
call fcn.1400044f4
mov rbx, rax
mov qword [rsp + 0x38], rax
lea r8, [rsp + 0x30]
mov rdx, rax
xor ecx, ecx
call rdi
test eax, eax
jne 0x140002cac
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x140002c50
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x140002d97
test rbx, rbx
je 0x140002cdd
mov rcx, rbx
call fcn.140004d54
mov qword [rsp + 0x38], r15
lea eax, [rdi + rsi]
mov dword [rsp + 0x30], eax
or r9, 0xffffffffffffffff
mov ecx, dword [rsp + 0x30]
inc ecx
mov eax, 2
mul rcx
cmovo rax, r9
mov rcx, rax
call fcn.1400044f4
mov rbx, rax
mov qword [rsp + 0x38], rax
mov edx, dword [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
mov r9, 0xffffffffffffffff
je 0x140002cc0
jmp 0x140002d97
test rbx, rbx
je 0x140002d3c
mov rcx, rbx
call fcn.140004d54
mov qword [rsp + 0x38], r15
add dword [rsp + 0x30], esi
or r9, 0xffffffffffffffff
mov ecx, dword [rsp + 0x30]
inc ecx
mov eax, 2
mul rcx
cmovo rax, r9
mov rcx, rax
call fcn.1400044f4
mov rbx, rax
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x20], eax
mov r9, rbx
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
call qword [sym.imp.WINSPOOL.DRV_GetPrintProcessorDirectoryW]
test eax, eax
jne 0x140002d97
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
mov r9, 0xffffffffffffffff
je 0x140002d22
jmp 0x140002da3
test rbx, rbx
je 0x140002dd4
cmp word [rbx], 0
je 0x140002dc3
mov edx, dword [rsp + 0x30]
inc edx
lea r8, [0x14000f7d0]
mov rcx, rbx
call fcn.14000501c
mov edx, dword [rsp + 0x30]
inc edx
mov r8, r14
mov rcx, rbx
call fcn.14000501c
mov rax, rbx
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.140004510
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret