Function at 0x1400efb90
Capabilities:
Get common file path
Query environment variable

Disassembly:
push rbp
lea rbp, [rsp - 0x490]
sub rsp, 0x590
mov rax, qword [0x1402854d8]
xor rax, rsp
mov qword [rbp + 0x480], rax
xor edx, edx
lea rcx, [rbp + 0x370]
mov r8d, 0x104
call fcn.140107f60
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x104
call fcn.140107f60
xor edx, edx
lea rcx, [rbp + 0x40]
mov r8d, 0x104
call fcn.140107f60
xor edx, edx
lea rcx, [rbp + 0x260]
mov r8d, 0x104
call fcn.140107f60
xor edx, edx
lea rcx, [rbp + 0x150]
mov r8d, 0x104
call fcn.140107f60
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
mov rcx, rax
mov edx, 0x80
call qword [sym.imp.KERNEL32.DLL_SetPriorityClass]
mov edx, 0x104
lea rcx, [rbp + 0x370]
call qword [sym.imp.KERNEL32.DLL_GetSystemWindowsDirectoryA]
test eax, eax
jne 0x1400efc63
mov r9, 0xffffffffffffffff
lea r8, str.C:Windows
mov edx, 0x104
lea rcx, [rbp + 0x370]
call fcn.140115e08
mov edx, 0x104
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
test eax, eax
jne 0x1400efc94
mov r9, 0xffffffffffffffff
lea r8, str.C:WindowsSystem32
mov edx, 0x104
lea rcx, [rsp + 0x30]
call fcn.140115e08
lea rdx, [rbp + 0x40]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.DLL_GetTempPathA]
mov eax, eax
cmp rax, 1
jbe 0x1400efcc1
dec rax
cmp rax, 0x104
jae 0x1400efe15
mov byte [rbp + rax + 0x40], 0
jmp 0x1400efcdd
mov r9, 0xffffffffffffffff
lea r8, str.C:WindowsTemp
mov edx, 0x104
lea rcx, [rbp + 0x40]
call fcn.140115e08
mov r8d, 0x104
lea rdx, [rbp + 0x150]
lea rcx, str.DriverData
call qword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableA]
test eax, eax
jne 0x1400efd18
lea r9, [rsp + 0x30]
mov ecx, 0x104
lea r8, str._sdriversDriverData
lea rdx, [rbp + 0x150]
call fcn.1400eeba0
lea r8, [rsp + 0x20]
mov ecx, 6
lea rdx, [fcn.1400efb90]
call qword [sym.imp.KERNEL32.DLL_GetModuleHandleExW]
test eax, eax
je 0x1400efd68
mov rcx, qword [rsp + 0x20]
lea rdx, [rbp + 0x260]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
test eax, eax
je 0x1400efd68
mov edx, 0x5c
lea rcx, [rbp + 0x260]
call fcn.140108668
test rax, rax
je 0x1400efd68
mov byte [rax], 0
mov r9d, 0x400
lea r8, [rsp + 0x30]
lea rdx, str._SYSTEM_
lea rcx, str.HOME_DRVDATA_IntelIPFlog_nTEMP_TEMP__nDV_DRVDATA_IntelIPFdv_nLOG_DRVDATA_IntelIPFlog_nBIN_DRVDATA_IntelIPF_bin_nLOCK_DRVDATA_IntelIPF_nEXE_DLLDIR__nDLL_DLLDIR__nDLLALT_SYSTEM_IntelIPF_nDSP_DRVDATA_IntelIPFdsp_nCMD_DRVDATA_IntelIPFcmd_nDATA_DRVDATA_IntelIPFui_n
call fcn.1400efe20
mov r9d, 0x400
lea r8, [rbp + 0x40]
lea rdx, str._TEMP_
lea rcx, str.HOME_DRVDATA_IntelIPFlog_nTEMP_TEMP__nDV_DRVDATA_IntelIPFdv_nLOG_DRVDATA_IntelIPFlog_nBIN_DRVDATA_IntelIPF_bin_nLOCK_DRVDATA_IntelIPF_nEXE_DLLDIR__nDLL_DLLDIR__nDLLALT_SYSTEM_IntelIPF_nDSP_DRVDATA_IntelIPFdsp_nCMD_DRVDATA_IntelIPFcmd_nDATA_DRVDATA_IntelIPFui_n
call fcn.1400efe20
mov r9d, 0x400
lea r8, [rbp + 0x150]
lea rdx, str._DRVDATA_
lea rcx, str.HOME_DRVDATA_IntelIPFlog_nTEMP_TEMP__nDV_DRVDATA_IntelIPFdv_nLOG_DRVDATA_IntelIPFlog_nBIN_DRVDATA_IntelIPF_bin_nLOCK_DRVDATA_IntelIPF_nEXE_DLLDIR__nDLL_DLLDIR__nDLLALT_SYSTEM_IntelIPF_nDSP_DRVDATA_IntelIPFdsp_nCMD_DRVDATA_IntelIPFcmd_nDATA_DRVDATA_IntelIPFui_n
call fcn.1400efe20
mov r9d, 0x400
lea r8, [rbp + 0x260]
lea rdx, str._DLLDIR_
lea rcx, str.HOME_DRVDATA_IntelIPFlog_nTEMP_TEMP__nDV_DRVDATA_IntelIPFdv_nLOG_DRVDATA_IntelIPFlog_nBIN_DRVDATA_IntelIPF_bin_nLOCK_DRVDATA_IntelIPF_nEXE_DLLDIR__nDLL_DLLDIR__nDLLALT_SYSTEM_IntelIPF_nDSP_DRVDATA_IntelIPFdsp_nCMD_DRVDATA_IntelIPFcmd_nDATA_DRVDATA_IntelIPFui_n
call fcn.1400efe20
mov ecx, dword [0x14028d6d8]
lea eax, [rcx - 2]
test eax, 0xfffffffc
jne 0x1400efdfd
cmp ecx, 3
je 0x1400efdfd
call fcn.1400ef810
mov rcx, qword [rbp + 0x480]
xor rcx, rsp
call fcn.140106650
add rsp, 0x590
pop rbp
ret
call fcn.1401067b4
int3