Function at 0x1401edb40
Capabilities:
Get common file path
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0xa60
mov rax, qword [0x14041da10]
xor rax, rsp
mov qword [rsp + 0xa50], rax
lea rdx, [0x140355194]
mov r8d, 1
mov rdi, rcx
call fcn.140205020
mov r8d, 1
mov rcx, rdi
test al, al
je 0x1401edbaa
lea rdx, [0x140355194]
call fcn.140203160
test eax, eax
jle 0x1401edbca
mov r8d, dword [rdi + 0xc]
mov edx, eax
mov rcx, rdi
sub r8d, eax
call fcn.140203cb0
mov r8d, 1
jmp 0x1401edbc0
lea rdx, [0x14035a510]
call fcn.140205020
test al, al
je 0x1401edbca
mov r8d, 4
xor edx, edx
mov rcx, rdi
call fcn.140203cb0
lea rdx, str.system32_
xor r8d, r8d
mov rcx, rdi
call fcn.140205020
or rbx, 0xffffffffffffffff
test al, al
je 0x1401edc1c
lea rcx, [rsp + 0x40]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1401edcf1
lea r8d, [rbx + 9]
xor edx, edx
mov rcx, rdi
call fcn.140203cb0
lea r8, [rsp + 0x40]
mov rcx, rdi
call fcn.140203770
jmp 0x1401edcf1
lea rdx, str.SystemRoot_
xor r8d, r8d
mov rcx, rdi
call fcn.140205020
test al, al
je 0x1401edc6a
lea rcx, [rsp + 0x40]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x1401edcf1
xor edx, edx
mov rcx, rdi
lea r8d, [rdx + 0xb]
call fcn.140203cb0
lea r8, [rsp + 0x40]
mov rcx, rdi
call fcn.140203770
jmp 0x1401edcf1
xor edx, edx
mov rcx, rdi
call fcn.140200d70
cmp ax, 0x25
jne 0x1401edcf1
mov rcx, qword [rdi]
lea rdx, [rsp + 0x250]
mov r8d, 0x400
mov qword [rsp + 0xa78], rsi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rax, [rsp + 0x250]
mov rsi, rbx
inc rsi
cmp word [rax + rsi*2], 0
jne 0x1401edca4
test esi, esi
jle 0x1401edcd9
mov edx, esi
mov rcx, rdi
call fcn.1402028a0
mov eax, dword [rdi + 8]
mov rcx, qword [rdi]
inc eax
lea r8, [rsp + 0x250]
movsxd r9, esi
movsxd rdx, eax
call fcn.1402c06dc
jmp 0x1401edcdf
cmp dword [rdi + 0xc], 0
jle 0x1401edce9
mov edx, esi
mov rcx, rdi
call fcn.140203bb0
mov rsi, qword [rsp + 0xa78]
mov rcx, qword [rdi]
mov edx, 0x5c
call fcn.1402c0274
test rax, rax
jne 0x1401eddb5
mov rdx, qword [rdi]
lea rax, [rsp + 0x30]
mov r9d, 0x400
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x250]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
jne 0x1401edd77
lea rcx, [rsp + 0x250]
mov edx, 0x400
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea r8, [0x14034c088]
lea rcx, [rsp + 0x250]
mov edx, 0x400
call fcn.1402bf098
mov r8, qword [rdi]
lea rcx, [rsp + 0x250]
mov edx, 0x400
call fcn.1402bf098
lea rax, [rsp + 0x250]
nop
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401edd80
test ebx, ebx
jle 0x1401eddfd
mov edx, ebx
mov rcx, rdi
call fcn.1402028a0
mov eax, dword [rdi + 8]
mov rcx, qword [rdi]
inc eax
lea r8, [rsp + 0x250]
movsxd r9, ebx
movsxd rdx, eax
call fcn.1402c06dc
jmp 0x1401ede03
lea rdx, [0x140365654]
mov r8d, 1
mov rcx, rdi
call fcn.140202610
test al, al
je 0x1401ede0d
mov rcx, qword [rdi]
lea rdx, [rsp + 0x250]
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
je 0x1401ede0d
lea rax, [rsp + 0x250]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401eddf1
jmp 0x1401edd8a
cmp dword [rdi + 0xc], 0
jle 0x1401ede0d
mov edx, ebx
mov rcx, rdi
call fcn.140203bb0
mov rcx, qword [rsp + 0xa50]
xor rcx, rsp
call fcn.1402bcad0
mov rbx, qword [rsp + 0xa80]
add rsp, 0xa60
pop rdi
ret