Function at 0x1400e89e0
Capabilities:
Get common file path
Query environment variable

Disassembly:
push rbp
lea rbp, [rsp - 0x490]
sub rsp, 0x590
mov rax, qword [0x14027aef8]
xor rax, rsp
mov qword [rbp + 0x480], rax
xor edx, edx
lea rcx, [rbp + 0x370]
mov r8d, 0x104
call fcn.140102230
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x104
call fcn.140102230
xor edx, edx
lea rcx, [rbp + 0x40]
mov r8d, 0x104
call fcn.140102230
xor edx, edx
lea rcx, [rbp + 0x260]
mov r8d, 0x104
call fcn.140102230
xor edx, edx
lea rcx, [rbp + 0x150]
mov r8d, 0x104
call fcn.140102230
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
mov rcx, rax
mov edx, 0x80
call qword [sym.imp.KERNEL32.DLL_SetPriorityClass]
mov edx, 0x104
lea rcx, [rbp + 0x370]
call qword [sym.imp.KERNEL32.DLL_GetSystemWindowsDirectoryA]
test eax, eax
jne 0x1400e8ab3
mov r9, 0xffffffffffffffff
lea r8, str.C:Windows
mov edx, 0x104
lea rcx, [rbp + 0x370]
call fcn.1401100d8
mov edx, 0x104
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
test eax, eax
jne 0x1400e8ae4
mov r9, 0xffffffffffffffff
lea r8, str.C:WindowsSystem32
mov edx, 0x104
lea rcx, [rsp + 0x30]
call fcn.1401100d8
lea rdx, [rbp + 0x40]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.DLL_GetTempPathA]
mov eax, eax
cmp rax, 1
jbe 0x1400e8b11
dec rax
cmp rax, 0x104
jae 0x1400e8c65
mov byte [rbp + rax + 0x40], 0
jmp 0x1400e8b2d
mov r9, 0xffffffffffffffff
lea r8, str.C:WindowsTemp
mov edx, 0x104
lea rcx, [rbp + 0x40]
call fcn.1401100d8
mov r8d, 0x104
lea rdx, [rbp + 0x150]
lea rcx, str.DriverData
call qword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableA]
test eax, eax
jne 0x1400e8b68
lea r9, [rsp + 0x30]
mov ecx, 0x104
lea r8, str._sdriversDriverData
lea rdx, [rbp + 0x150]
call fcn.1400e79e0
lea r8, [rsp + 0x20]
mov ecx, 6
lea rdx, [fcn.1400e89e0]
call qword [sym.imp.KERNEL32.DLL_GetModuleHandleExW]
test eax, eax
je 0x1400e8bb8
mov rcx, qword [rsp + 0x20]
lea rdx, [rbp + 0x260]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
test eax, eax
je 0x1400e8bb8
mov edx, 0x5c
lea rcx, [rbp + 0x260]
call fcn.140102938
test rax, rax
je 0x1400e8bb8
mov byte [rax], 0
mov r9d, 0x400
lea r8, [rsp + 0x30]
lea rdx, str._SYSTEM_
lea rcx, str.HOME_DRVDATA_IntelIPFlog_nTEMP_TEMP__nDV_DRVDATA_IntelIPFdv_nLOG_DRVDATA_IntelIPFlog_nBIN_DRVDATA_IntelIPF_bin_nLOCK_DRVDATA_IntelIPF_nEXE_DLLDIR__nDLL_DLLDIR__nDLLALT_SYSTEM_IntelIPF_nDSP_DRVDATA_IntelIPFdsp_nCMD_DRVDATA_IntelIPFcmd_nDATA_DRVDATA_IntelIPFui_n
call fcn.1400e8c70
mov r9d, 0x400
lea r8, [rbp + 0x40]
lea rdx, str._TEMP_
lea rcx, str.HOME_DRVDATA_IntelIPFlog_nTEMP_TEMP__nDV_DRVDATA_IntelIPFdv_nLOG_DRVDATA_IntelIPFlog_nBIN_DRVDATA_IntelIPF_bin_nLOCK_DRVDATA_IntelIPF_nEXE_DLLDIR__nDLL_DLLDIR__nDLLALT_SYSTEM_IntelIPF_nDSP_DRVDATA_IntelIPFdsp_nCMD_DRVDATA_IntelIPFcmd_nDATA_DRVDATA_IntelIPFui_n
call fcn.1400e8c70
mov r9d, 0x400
lea r8, [rbp + 0x150]
lea rdx, str._DRVDATA_
lea rcx, str.HOME_DRVDATA_IntelIPFlog_nTEMP_TEMP__nDV_DRVDATA_IntelIPFdv_nLOG_DRVDATA_IntelIPFlog_nBIN_DRVDATA_IntelIPF_bin_nLOCK_DRVDATA_IntelIPF_nEXE_DLLDIR__nDLL_DLLDIR__nDLLALT_SYSTEM_IntelIPF_nDSP_DRVDATA_IntelIPFdsp_nCMD_DRVDATA_IntelIPFcmd_nDATA_DRVDATA_IntelIPFui_n
call fcn.1400e8c70
mov r9d, 0x400
lea r8, [rbp + 0x260]
lea rdx, str._DLLDIR_
lea rcx, str.HOME_DRVDATA_IntelIPFlog_nTEMP_TEMP__nDV_DRVDATA_IntelIPFdv_nLOG_DRVDATA_IntelIPFlog_nBIN_DRVDATA_IntelIPF_bin_nLOCK_DRVDATA_IntelIPF_nEXE_DLLDIR__nDLL_DLLDIR__nDLLALT_SYSTEM_IntelIPF_nDSP_DRVDATA_IntelIPFdsp_nCMD_DRVDATA_IntelIPFcmd_nDATA_DRVDATA_IntelIPFui_n
call fcn.1400e8c70
mov ecx, dword [0x1402830d8]
lea eax, [rcx - 2]
test eax, 0xfffffffc
jne 0x1400e8c4d
cmp ecx, 3
je 0x1400e8c4d
call fcn.1400e8660
mov rcx, qword [rbp + 0x480]
xor rcx, rsp
call fcn.140100920
add rsp, 0x590
pop rbp
ret
call fcn.140100a84
int3