Function at 0x1401ea500
Capabilities:
Get common file path
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0xa60
mov rax, qword [0x140418a10]
xor rax, rsp
mov qword [rsp + 0xa50], rax
lea rdx, [0x1403512cc]
mov r8d, 1
mov rdi, rcx
call fcn.1402019e0
mov r8d, 1
mov rcx, rdi
test al, al
je 0x1401ea56a
lea rdx, [0x1403512cc]
call fcn.1401ffb20
test eax, eax
jle 0x1401ea58a
mov r8d, dword [rdi + 0xc]
mov edx, eax
mov rcx, rdi
sub r8d, eax
call fcn.140200670
mov r8d, 1
jmp 0x1401ea580
lea rdx, [0x140355e60]
call fcn.1402019e0
test al, al
je 0x1401ea58a
mov r8d, 4
xor edx, edx
mov rcx, rdi
call fcn.140200670
lea rdx, str.system32_
xor r8d, r8d
mov rcx, rdi
call fcn.1402019e0
or rbx, 0xffffffffffffffff
test al, al
je 0x1401ea5dc
lea rcx, [rsp + 0x40]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1401ea6b1
lea r8d, [rbx + 9]
xor edx, edx
mov rcx, rdi
call fcn.140200670
lea r8, [rsp + 0x40]
mov rcx, rdi
call fcn.140200130
jmp 0x1401ea6b1
lea rdx, str.SystemRoot_
xor r8d, r8d
mov rcx, rdi
call fcn.1402019e0
test al, al
je 0x1401ea62a
lea rcx, [rsp + 0x40]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x1401ea6b1
xor edx, edx
mov rcx, rdi
lea r8d, [rdx + 0xb]
call fcn.140200670
lea r8, [rsp + 0x40]
mov rcx, rdi
call fcn.140200130
jmp 0x1401ea6b1
xor edx, edx
mov rcx, rdi
call fcn.1401fd730
cmp ax, 0x25
jne 0x1401ea6b1
mov rcx, qword [rdi]
lea rdx, [rsp + 0x250]
mov r8d, 0x400
mov qword [rsp + 0xa78], rsi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rax, [rsp + 0x250]
mov rsi, rbx
inc rsi
cmp word [rax + rsi*2], 0
jne 0x1401ea664
test esi, esi
jle 0x1401ea699
mov edx, esi
mov rcx, rdi
call fcn.1401ff260
mov eax, dword [rdi + 8]
mov rcx, qword [rdi]
inc eax
lea r8, [rsp + 0x250]
movsxd r9, esi
movsxd rdx, eax
call fcn.1402bd21c
jmp 0x1401ea69f
cmp dword [rdi + 0xc], 0
jle 0x1401ea6a9
mov edx, esi
mov rcx, rdi
call fcn.140200570
mov rsi, qword [rsp + 0xa78]
mov rcx, qword [rdi]
mov edx, 0x5c
call fcn.1402bcdb4
test rax, rax
jne 0x1401ea775
mov rdx, qword [rdi]
lea rax, [rsp + 0x30]
mov r9d, 0x400
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x250]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
jne 0x1401ea737
lea rcx, [rsp + 0x250]
mov edx, 0x400
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea r8, [0x140347f58]
lea rcx, [rsp + 0x250]
mov edx, 0x400
call fcn.1402bbbd8
mov r8, qword [rdi]
lea rcx, [rsp + 0x250]
mov edx, 0x400
call fcn.1402bbbd8
lea rax, [rsp + 0x250]
nop
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401ea740
test ebx, ebx
jle 0x1401ea7bd
mov edx, ebx
mov rcx, rdi
call fcn.1401ff260
mov eax, dword [rdi + 8]
mov rcx, qword [rdi]
inc eax
lea r8, [rsp + 0x250]
movsxd r9, ebx
movsxd rdx, eax
call fcn.1402bd21c
jmp 0x1401ea7c3
lea rdx, [0x140360f58]
mov r8d, 1
mov rcx, rdi
call fcn.1401fefd0
test al, al
je 0x1401ea7cd
mov rcx, qword [rdi]
lea rdx, [rsp + 0x250]
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
je 0x1401ea7cd
lea rax, [rsp + 0x250]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401ea7b1
jmp 0x1401ea74a
cmp dword [rdi + 0xc], 0
jle 0x1401ea7cd
mov edx, ebx
mov rcx, rdi
call fcn.140200570
mov rcx, qword [rsp + 0xa50]
xor rcx, rsp
call fcn.1402b9610
mov rbx, qword [rsp + 0xa80]
add rsp, 0xa60
pop rdi
ret