Function at 0x1401f4eb0
Capabilities:
Get common file path
Query environment variable

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x9b8]
sub rsp, 0xaa0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x14041da10]
xor rax, rsp
mov qword [rbp + 0x990], rax
mov rbx, rcx
mov r8d, 1
lea rdx, [0x140355194]
call fcn.140205020
test al, al
je 0x1401f4f38
mov r8d, 1
lea rdx, [0x140355194]
mov rcx, rbx
call fcn.140203160
test eax, eax
jle 0x1401f4f38
mov r8d, dword [rbx + 0xc]
sub r8d, eax
mov edx, eax
mov rcx, rbx
call fcn.140203cb0
xor edx, edx
lea r8d, [rdx + 1]
mov rcx, rbx
call fcn.140203cb0
xor r8d, r8d
lea rdx, str._globalroot
mov rcx, rbx
call fcn.140205020
mov rcx, rbx
test al, al
je 0x1401f4f5c
xor edx, edx
lea r8d, [rdx + 0xe]
jmp 0x1401f501f
mov r8d, 1
lea rdx, [0x14035a510]
call fcn.140205020
test al, al
je 0x1401f4f7d
xor edx, edx
lea r8d, [rdx + 4]
jmp 0x1401f501c
cmp dword [rbx + 0xc], 0
jle 0x1401f5028
xor edx, edx
mov rcx, rbx
call fcn.140200d70
cmp ax, 0x25
jne 0x1401f4fbc
mov r8d, 0x400
lea rdx, [rbp + 0x190]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rdx, [rbp + 0x190]
mov rcx, rbx
call fcn.140200d00
mov rcx, rbx
call fcn.1400d44f0
test al, al
jne 0x1401f4fe2
mov edx, 0x20
mov rcx, qword [rbx]
call fcn.1402c0274
test rax, rax
je 0x1401f5024
sub rax, qword [rbx]
sar rax, 1
jmp 0x1401f500f
lea rdx, [0x14036a018]
mov rcx, rbx
call fcn.140203040
mov rcx, rbx
test eax, eax
jle 0x1401f5003
mov r8d, dword [rbx + 0xc]
sub r8d, eax
mov edx, eax
jmp 0x1401f501f
lea rdx, [0x14036dd68]
call fcn.140203040
test eax, eax
jle 0x1401f5024
mov r8d, dword [rbx + 0xc]
mov edx, eax
sub r8d, eax
mov rcx, rbx
call fcn.140203cb0
cmp dword [rbx + 0xc], 0
je 0x1401f5265
xor r8d, r8d
lea rdx, str.system32_
mov rcx, rbx
call fcn.140205020
test al, al
je 0x1401f505a
mov edx, 0x104
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1401f50d3
jmp 0x1401f50b6
xor r8d, r8d
lea rdx, str.SystemRoot_
mov rcx, rbx
call fcn.140205020
test al, al
je 0x1401f508c
mov edx, 0x104
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x1401f50d3
mov r8d, 0xb
jmp 0x1401f50bc
xor r8d, r8d
lea rdx, str.SysWOW64
mov rcx, rbx
call fcn.140205020
test al, al
je 0x1401f50d3
mov edx, 0x104
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
test eax, eax
jle 0x1401f50d3
mov r8d, 8
xor edx, edx
mov rcx, rbx
call fcn.140203cb0
lea r8, [rsp + 0x40]
mov rcx, rbx
call fcn.140203770
or rdi, 0xffffffffffffffff
cmp dword [rbx + 0xc], 0
je 0x1401f51e7
lea edx, [rdi + 0x5d]
mov rcx, qword [rbx]
call fcn.1402c00ac
mov rsi, rax
test rax, rax
je 0x1401f51e7
mov rcx, qword [rbx]
sub rsi, rcx
sar rsi, 1
test esi, esi
jle 0x1401f51e7
cmp dword [rbx + 0xc], 0
jne 0x1401f5113
mov eax, edi
jmp 0x1401f512c
mov edx, 0x2e
call fcn.1402c00ac
test rax, rax
jne 0x1401f5126
mov eax, edi
jmp 0x1401f512c
sub rax, qword [rbx]
sar rax, 1
cmp eax, esi
jge 0x1401f51e7
xor eax, eax
mov qword [rsp + 0x28], rax
mov edx, dword [rbx + 0xc]
test edx, edx
jne 0x1401f5150
lea rax, [0x14034d1a0]
mov qword [rsp + 0x20], rax
jmp 0x1401f5174
lea rcx, [rsp + 0x20]
call fcn.1402028a0
movsxd r9, dword [rbx + 0xc]
mov eax, dword [rsp + 0x28]
inc eax
movsxd rdx, eax
mov r8, qword [rbx]
mov rcx, qword [rsp + 0x20]
call fcn.1402c06dc
mov edx, dword [rbx + 0xc]
lea rcx, [rsp + 0x20]
call fcn.140203bb0
nop
lea rdx, [0x14035b978]
lea rcx, [rsp + 0x20]
call fcn.140200ef0
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x1401f51d6
inc esi
mov r8d, dword [rbx + 0xc]
sub r8d, esi
mov edx, esi
mov rcx, rbx
call fcn.140203cb0
lea rdx, [rsp + 0x6c]
mov rcx, rbx
call fcn.140200ef0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
cmp dword [rsp + 0x28], 0
jle 0x1401f51e7
mov rcx, qword [rsp + 0x20]
call fcn.1402bd0e0
mov r8d, 1
lea rdx, [0x140365654]
mov rcx, rbx
call fcn.140202610
test al, al
je 0x1401f5265
mov r8d, 0x400
lea rdx, [rbp + 0x190]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
je 0x1401f5265
lea rax, [rbp + 0x190]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x1401f5221
test edi, edi
jle 0x1401f5255
mov edx, edi
mov rcx, rbx
call fcn.1402028a0
movsxd r9, edi
mov eax, dword [rbx + 8]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x190]
mov rcx, qword [rbx]
call fcn.1402c06dc
jmp 0x1401f525b
cmp dword [rbx + 0xc], 0
jle 0x1401f5265
mov edx, edi
mov rcx, rbx
call fcn.140203bb0
mov rcx, qword [rbp + 0x990]
xor rcx, rsp
call fcn.1402bcad0
lea r11, [rsp + 0xaa0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret