Function at 0x14007de70
Capabilities:
Get common file path
Query environment variable

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1210]
mov eax, 0x1310
call fcn.1400ab0e0
sub rsp, rax
mov qword [rbp - 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x1350], rbx
mov rax, qword [0x1401222f0]
xor rax, rsp
mov qword [rbp + 0x1200], rax
mov qword [rsp + 0x40], r9
mov rbx, r8
mov qword [rsp + 0x38], rbx
mov rsi, rdx
mov byte [rsp + 0x30], cl
mov rdi, qword [rbp + 0x1270]
mov qword [rbp - 0x70], rdi
mov r12, qword [rbp + 0x1278]
mov qword [rsp + 0x70], r12
mov r13, qword [rbp + 0x1280]
mov qword [rsp + 0x48], r13
test rdx, rdx
jne 0x14007df01
mov ecx, dword [r8 + 0x30]
call fcn.14007e7c0
mov rsi, rax
test rax, rax
cmove rsi, rdi
lea rcx, [0x14012c178]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, 0x104
lea rcx, [rbp + 0x3f0]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea r15, [rbx + 0x40]
xor eax, eax
or r14d, 0xffffffff
mov word [r15], ax
test r12, r12
je 0x14007e1af
or r12, 0xffffffffffffffff
mov rdi, qword [rsp + 0x70]
mov rdi, qword [rdi + 0x60]
mov ebx, eax
cmp dword [rdi], eax
jbe 0x14007e1af
nop
mov eax, ebx
imul rdx, rax, 0x128
add rdx, rdi
mov rcx, qword [rdx + 0x18]
cmp rsi, rcx
jbe 0x14007df90
mov eax, dword [rdx + 0x20]
add rax, rcx
cmp rsi, rax
jae 0x14007df90
mov r12, rcx
movzx eax, word [rdx + 0x2e]
lea r8, [rdx + 0x30]
add r8, rax
lea rdx, [0x1400e5b98]
mov rcx, r15
call fcn.14002d7d0
mov r14d, ebx
inc ebx
cmp ebx, dword [rdi]
jb 0x14007df50
cmp r14d, 0xffffffff
je 0x14007e1ad
cmp byte [rsp + 0x30], 0
je 0x14007e5d5
mov eax, r14d
imul r13, rax, 0x128
add r13, rdi
lea rdi, [r13 + 0x30]
call fcn.1400450d0
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
je 0x14007e658
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x60], rbx
test rdi, rdi
je 0x14007e016
test rdi, 0xffffffffffff0000
jne 0x14007e016
movzx r14d, di
xor edx, edx
mov ecx, r14d
call fcn.1400447e0
test rax, rax
je 0x14007e028
mov r8d, r14d
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.1400451c0
jmp 0x14007e023
mov rdx, rdi
lea rcx, [rsp + 0x60]
call fcn.14004ed00
mov rbx, qword [rsp + 0x60]
mov rcx, rbx
call fcn.1400a8238
mov rcx, qword [rsp + 0x38]
mov qword [rcx + 0x248], rax
lea rdx, [rbx - 0x18]
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14007e050
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
cmp qword [0x140130e08], 0
je 0x14007e1a3
call fcn.1400450d0
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
je 0x14007e64d
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x50], rbx
test rdi, rdi
je 0x14007e0b8
test rdi, 0xffffffffffff0000
jne 0x14007e0b8
movzx r14d, di
xor edx, edx
mov ecx, r14d
call fcn.1400447e0
test rax, rax
je 0x14007e0ca
mov r8d, r14d
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.1400451c0
jmp 0x14007e0c5
mov rdx, rdi
lea rcx, [rsp + 0x50]
call fcn.14004ed00
mov rbx, qword [rsp + 0x50]
lea r8, [rbp - 0x30]
xor edx, edx
mov rcx, rbx
call qword [0x140130e60]
mov r14, rax
lea rdx, [rbx - 0x18]
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14007e0f1
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.WS2_32.dll_htonl + 8]
call fcn.1400450d0
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
je 0x14007e642
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x58], rbx
test rdi, rdi
je 0x14007e149
test rdi, 0xffffffffffff0000
jne 0x14007e149
movzx edi, di
xor edx, edx
mov ecx, edi
call fcn.1400447e0
test rax, rax
je 0x14007e15b
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.1400451c0
jmp 0x14007e156
mov rdx, rdi
lea rcx, [rsp + 0x58]
call fcn.14004ed00
mov rbx, qword [rsp + 0x58]
mov dword [rsp + 0x28], 0
mov rax, qword [r13 + 0x18]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8, rbx
mov rdx, r14
mov rcx, qword [rsp + 0x40]
call qword [0x140130e08]
nop
lea rdx, [rbx - 0x18]
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14007e195
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
test r14, r14
je 0x14007e1a3
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r13, qword [rsp + 0x48]
jmp 0x14007e5d5
xor eax, eax
or r12, 0xffffffffffffffff
mov qword [rsp + 0x68], r12
mov ebx, eax
cmp dword [r13], 0
jbe 0x14007e4a9
nop word [rax + rax]
mov eax, ebx
imul rcx, rax, 0x128
mov rdx, qword [rcx + r13 + 0x18]
cmp rsi, rdx
jbe 0x14007e227
mov eax, dword [rcx + r13 + 0x20]
add rax, rdx
cmp rsi, rax
jae 0x14007e227
mov qword [rsp + 0x68], rdx
lea rdi, [rcx + 0x30]
add rdi, r13
mov edx, 0x5c
mov rcx, rdi
call fcn.1400abc6c
test rax, rax
je 0x14007e212
lea rdi, [rax + 1]
mov r8, rdi
lea rdx, [0x1400e5b98]
mov rcx, r15
call fcn.14002d7d0
mov r14d, ebx
inc ebx
cmp ebx, dword [r13]
jb 0x14007e1d0
cmp r14d, 0xffffffff
je 0x14007e4a4
xor edi, edi
call fcn.1400450d0
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
je 0x14007e66e
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rbp - 0x80], rax
mov eax, r14d
imul r14, rax, 0x128
add r14, r13
lea rdx, [r14 + 0x30]
lea rcx, [rbp - 0x80]
call fcn.14004ed00
nop
lea r8d, [rdi + 0xc]
lea rdx, str.SystemRoot_
mov rbx, qword [rbp - 0x80]
mov rcx, rbx
call fcn.1400a9d30
test eax, eax
sete r12b
lea rdx, [rbx - 0x18]
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14007e2ad
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
test r12b, r12b
je 0x14007e337
call fcn.1400450d0
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
je 0x14007e663
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x78], rax
lea rdx, [r14 + 0x3c]
lea rcx, [rsp + 0x78]
call fcn.14004ed00
nop
mov rbx, qword [rsp + 0x78]
mov r8, rbx
lea rdx, str.__SystemRoot___s
lea rcx, [rbp + 0x1e0]
call fcn.1400793d0
lea rdx, [rbx - 0x18]
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14007e31b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov r8d, 0x105
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x14007e437
cmp byte [r14 + 0x31], 0x3a
jne 0x14007e362
lea rdx, [r14 + 0x30]
lea rcx, [rbp - 0x60]
call fcn.14004ec60
mov r8, qword [rax]
mov edx, 0x105
lea rcx, [rbp - 0x30]
call fcn.1400a97ac
mov rdx, qword [rbp - 0x60]
jmp 0x14007e38b
cmp byte [r14 + 0x35], 0x3a
jne 0x14007e3a8
lea rdx, [r14 + 0x34]
lea rcx, [rbp - 0x78]
call fcn.14004ec60
mov r8, qword [rax]
mov edx, 0x105
lea rcx, [rbp - 0x30]
call fcn.1400a97ac
mov rdx, qword [rbp - 0x78]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14007e437
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
jmp 0x14007e437
mov r9, r15
lea r8, [rbp + 0x3f0]
lea rdx, str._sdrivers_s
lea rcx, [rbp - 0x30]
call fcn.1400793d0
lea r8, [rbp + 0x1e0]
lea rdx, [rbp + 0x3f0]
lea rcx, [rbp - 0x30]
call qword [0x140130e60]
mov rdi, rax
test rax, rax
je 0x14007e3ff
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0x1e0]
call fcn.1400a9bbc
test eax, eax
je 0x14007e437
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r9, r15
lea r8, [rbp + 0x3f0]
lea rdx, str._sdrivers_s
lea rcx, [rbp + 0x1e0]
call fcn.1400793d0
lea r8, [rbp - 0x30]
lea rdx, [rbp + 0x3f0]
lea rcx, [rbp + 0x1e0]
call qword [0x140130e60]
mov rdi, rax
lea rcx, [rbp - 0x30]
call fcn.1400a8238
mov rbx, qword [rsp + 0x38]
mov qword [rbx + 0x248], rax
mov r10, qword [0x140130e08]
test r10, r10
je 0x14007e482
cmp byte [rsp + 0x30], 0
je 0x14007e482
mov eax, dword [r14 + 0x20]
mov dword [rsp + 0x28], eax
mov rax, qword [r14 + 0x18]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rbp - 0x30]
mov rdx, rdi
mov rcx, qword [rsp + 0x40]
call r10
test rdi, rdi
je 0x14007e490
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r12, qword [rsp + 0x68]
mov r13, qword [rsp + 0x48]
mov r14, qword [rsp + 0x40]
jmp 0x14007e5df
mov r12, qword [rsp + 0x68]
mov r14, qword [rsp + 0x40]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov edx, eax
mov rcx, r14
call fcn.14008f4d0
cmp al, 1
jne 0x14007e5da
mov rbx, qword [rsp + 0x38]
cmp qword [0x140130e30], 0
je 0x14007e5df
mov byte [rbp - 0x58], 0
add rbx, 0x248
mov qword [rbp - 0x40], rbx
mov qword [rbp - 0x50], rsi
lea rcx, [0x14012c178]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, 0x2000
call qword [0x140130df8]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov ecx, eax
xor r8d, r8d
xor edx, edx
call qword [0x140130dc8]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov ecx, eax
lea r8, [rbp - 0x58]
lea rdx, [0x14007b680]
call qword [0x140130e30]
lea rcx, [0x14012c178]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp byte [rbp - 0x58], 1
jne 0x14007e5da
cmp byte [rsp + 0x30], 0
je 0x14007e5a7
cmp qword [0x140130e08], 0
je 0x14007e5a7
lea r8, [rbp + 0x1e0]
xor edx, edx
mov rcx, qword [rbx]
call qword [0x140130e60]
mov rdi, rax
mov dword [rsp + 0x28], 0
mov rcx, qword [rbp - 0x48]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8, qword [rbx]
mov rdx, rax
mov rcx, r14
call qword [0x140130e08]
test rdi, rdi
je 0x14007e5a7
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r12, qword [rbp - 0x48]
mov edx, 0x5c
mov rcx, qword [rbx]
call fcn.1400a9910
test rax, rax
lea r8, [rax + 2]
jne 0x14007e5c4
mov r8, qword [rbx]
lea rdx, [0x1400d22c8]
mov rcx, r15
call fcn.14002d7d0
jmp 0x14007e5da
mov r14, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov dword [rbp + 0x600], 0x58
mov dword [rbp + 0x650], 0x1d5
cmp byte [rsp + 0x30], 0
je 0x14007e61d
mov rax, qword [0x140130de8]
test rax, rax
je 0x14007e61d
lea r9, [rbp + 0x600]
lea r8, [rbp - 0x68]
mov rdx, rsi
mov rcx, r14
call rax
test eax, eax
jne 0x14007e679
cmp word [r15], 0
jne 0x14007e74d
mov rdi, qword [rbp - 0x70]
cmp rsi, rdi
je 0x14007e744
mov rsi, rdi
mov r12, qword [rsp + 0x70]
jmp 0x14007df24
mov ecx, 0x80004005
call fcn.140044890
int3
mov ecx, 0x80004005
call fcn.140044890
int3
mov ecx, 0x80004005
call fcn.140044890
int3
mov ecx, 0x80004005
call fcn.140044890
int3
mov ecx, 0x80004005
call fcn.140044890
int3
mov eax, dword [rbp + 0x64c]
mov byte [rbp + rax*2 + 0x654], 0
mov rdx, qword [rbp - 0x68]
or rax, 0xffffffffffffffff
test rdx, rdx
je 0x14007e6f0
inc rax
cmp word [r15 + rax*2], 0
jne 0x14007e694
mov r10d, 0x104
sub r10, rax
or rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [r15 + rax*2], 0
jne 0x14007e6b0
add rax, 0x20
lea rcx, [rbx + rax*2]
mov qword [rsp + 0x28], rdx
lea rax, [rbp + 0x654]
mov qword [rsp + 0x20], rax
lea r9, str.__s0x_x
or r8, 0xffffffffffffffff
mov rdx, r10
call fcn.1400aa840
jmp 0x14007e77a
inc rax
cmp word [r15 + rax*2], 0
jne 0x14007e6f0
mov r10d, 0x104
sub r10, rax
or rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [r15 + rax*2], 0
jne 0x14007e710
add rax, 0x20
lea rcx, [rbx + rax*2]
lea rax, [rbp + 0x654]
mov qword [rsp + 0x20], rax
lea r9, [0x1400eb840]
or r8, 0xffffffffffffffff
mov rdx, r10
call fcn.1400aa840
jmp 0x14007e77a
lea rdx, str.0x_x
jmp 0x14007e757
sub rsi, r12
lea rdx, [0x1400eb848]
mov r8, rsi
lea rcx, [rbp + 0xa00]
call fcn.14004a790
lea r8, [rbp + 0xa00]
mov edx, 0x104
mov rcx, r15
call fcn.1400abdb0
lea rcx, [0x14012c178]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rbp + 0x1200]
xor rcx, rsp
call fcn.1400ab140
mov rbx, qword [rsp + 0x1350]
add rsp, 0x1310
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret