Function at 0x140009490
Capabilities:
Create directory
Get common file path
Query environment variable
Set environment variable

Disassembly:
push r15
mov eax, 0x4028
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.140012240
sub rsp, rax
mov r14, rcx
mov r12, rdx
test rdx, rdx
je 0x140009720
xor r8d, r8d
xor ecx, ecx
lea rsi, [rsp + 0x20]
lea rdx, [0x14002836e]
call fcn.14000a880
mov r8d, 0x2000
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x1400096d8
xor r13d, r13d
xor r8d, r8d
mov rdx, r12
xor ecx, ecx
call fcn.14000a880
mov r15, rax
test rax, rax
je 0x1400097c0
mov rcx, rax
mov r8d, 0x1000
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov rcx, r15
mov ebx, eax
call sub.msvcrt.dll_free
test ebx, ebx
je 0x140009790
mov rcx, rsi
call fcn.14000acb0
test eax, eax
jne 0x1400096c0
mov r8d, 0x1000
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.msvcrt.dll__wfullpath]
mov r15, rax
test r15, r15
je 0x1400097d4
lea rbp, [rsp + 0x2020]
xor eax, eax
mov ecx, 0x400
mov edx, 0x5c
mov rdi, rbp
rep stosq qword [rdi], rax
mov rcx, r15
call sub.msvcrt.dll_wcschr
mov rdi, qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov rbx, rax
test rax, rax
je 0x1400095c5
nop word cs:[rax + rax]
mov r8, rbx
mov rdx, r15
mov rcx, rbp
sub r8, r15
sar r8, 1
add r8, 1
call sub.msvcrt.dll_wcsncpy
xor edx, edx
mov rcx, rbp
call rdi
lea rcx, [rbx + 2]
mov edx, 0x5c
call sub.msvcrt.dll_wcschr
mov rbx, rax
test rax, rax
jne 0x140009590
xor edx, edx
mov rcx, r15
call rdi
lea rcx, [0x140028444]
mov rdx, r15
call qword [sym.imp.msvcrt.dll__wputenv_s]
mov rcx, r15
mov ebx, eax
call sub.msvcrt.dll_free
test ebx, ebx
jne 0x1400097a8
mov rdx, rbp
mov ecx, 0x1000
mov ebx, 5
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
call sub.msvcrt.dll__getpid
lea r8, str._MEI_d
mov edx, 0x10
mov rcx, rsi
mov r9d, eax
call fcn.140009220
mov rdi, qword [sym.imp.msvcrt.dll__wtempnam]
mov rcx, rbp
mov rdx, rsi
call rdi
mov rcx, rax
mov r15, rax
call fcn.14000aaa0
test eax, eax
je 0x140009738
mov rcx, r15
call sub.msvcrt.dll_free
sub ebx, 1
jne 0x140009624
xor r14d, r14d
test r12, r12
je 0x1400096a5
xor r8d, r8d
lea rdx, [0x14002836e]
xor ecx, ecx
test r13, r13
je 0x140009768
call fcn.14000a880
xor r8d, r8d
mov rdx, r13
xor ecx, ecx
mov r15, rax
call fcn.14000a880
mov rcx, r15
mov rdx, rax
mov r12, rax
call qword [sym.imp.msvcrt.dll__wputenv_s]
mov rcx, r15
call sub.msvcrt.dll_free
mov rcx, r12
call sub.msvcrt.dll_free
mov rcx, r13
call sub.msvcrt.dll_free
mov eax, r14d
add rsp, 0x4028
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__wcsdup]
mov r15, rax
jmp 0x14000954c
lea rdx, [rsp + 0x2020]
mov r8d, 0x2000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor ecx, ecx
xor r8d, r8d
mov rdx, rsi
call fcn.14000a760
mov rcx, rax
test rax, rax
je 0x1400094e8
cmp byte [rax], 0
je 0x1400094e8
call sub.msvcrt.dll__strdup
mov r13, rax
jmp 0x1400094eb
xor r13d, r13d
lea rsi, [rsp + 0x20]
lea rbp, [rsp + 0x2020]
jmp 0x1400095ee
mov rcx, r14
mov r8d, 0x1000
mov rdx, r15
mov r14d, 1
call fcn.14000a760
mov rcx, r15
call sub.msvcrt.dll_free
test r12, r12
jne 0x140009654
jmp 0x1400096a5
call fcn.14000a880
xor edx, edx
mov r12, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, r12
call sub.msvcrt.dll_free
jmp 0x1400096a5
lea rcx, str.LOADER:_Failed_to_expand_environment_variables_in_the_runtime_tmpdir._n
xor r14d, r14d
call fcn.140002500
jmp 0x1400096a5
lea rcx, str.LOADER:_Failed_to_set_the_TMP_environment_variable._n
xor r14d, r14d
call fcn.140002500
jmp 0x1400096a5
lea rcx, str.LOADER:_Failed_to_convert_runtime_tmpdir_to_a_wide_string._n
xor r14d, r14d
call fcn.140002500
jmp 0x1400096a5
lea rcx, str.LOADER:_Failed_to_obtain_the_absolute_path_of_the_runtime_tmpdir._n
xor r14d, r14d
call fcn.140002500
jmp 0x1400096a5