Function at 0x1401db7f0
Capabilities:
Get common file path
Query environment variable

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x9b8]
sub rsp, 0xaa0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1403eaa10]
xor rax, rsp
mov qword [rbp + 0x990], rax
mov rbx, rcx
mov r8d, 1
lea rdx, [0x14032c0d4]
call fcn.1401eb700
test al, al
je 0x1401db878
mov r8d, 1
lea rdx, [0x14032c0d4]
mov rcx, rbx
call fcn.1401e9840
test eax, eax
jle 0x1401db878
mov r8d, dword [rbx + 0xc]
sub r8d, eax
mov edx, eax
mov rcx, rbx
call fcn.1401ea390
xor edx, edx
lea r8d, [rdx + 1]
mov rcx, rbx
call fcn.1401ea390
xor r8d, r8d
lea rdx, str._globalroot
mov rcx, rbx
call fcn.1401eb700
mov rcx, rbx
test al, al
je 0x1401db89c
xor edx, edx
lea r8d, [rdx + 0xe]
jmp 0x1401db95f
mov r8d, 1
lea rdx, [0x1403300d8]
call fcn.1401eb700
test al, al
je 0x1401db8bd
xor edx, edx
lea r8d, [rdx + 4]
jmp 0x1401db95c
cmp dword [rbx + 0xc], 0
jle 0x1401db968
xor edx, edx
mov rcx, rbx
call fcn.1401e7500
cmp ax, 0x25
jne 0x1401db8fc
mov r8d, 0x400
lea rdx, [rbp + 0x190]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rdx, [rbp + 0x190]
mov rcx, rbx
call fcn.1401e7490
mov rcx, rbx
call fcn.1400d1b30
test al, al
jne 0x1401db922
mov edx, 0x20
mov rcx, qword [rbx]
call fcn.14029b070
test rax, rax
je 0x1401db964
sub rax, qword [rbx]
sar rax, 1
jmp 0x1401db94f
lea rdx, [0x14033edc0]
mov rcx, rbx
call fcn.1401e9720
mov rcx, rbx
test eax, eax
jle 0x1401db943
mov r8d, dword [rbx + 0xc]
sub r8d, eax
mov edx, eax
jmp 0x1401db95f
lea rdx, [0x140341dac]
call fcn.1401e9720
test eax, eax
jle 0x1401db964
mov r8d, dword [rbx + 0xc]
mov edx, eax
sub r8d, eax
mov rcx, rbx
call fcn.1401ea390
cmp dword [rbx + 0xc], 0
je 0x1401dbba5
xor r8d, r8d
lea rdx, str.system32_
mov rcx, rbx
call fcn.1401eb700
test al, al
je 0x1401db99a
mov edx, 0x104
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1401dba13
jmp 0x1401db9f6
xor r8d, r8d
lea rdx, str.SystemRoot_
mov rcx, rbx
call fcn.1401eb700
test al, al
je 0x1401db9cc
mov edx, 0x104
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x1401dba13
mov r8d, 0xb
jmp 0x1401db9fc
xor r8d, r8d
lea rdx, str.SysWOW64
mov rcx, rbx
call fcn.1401eb700
test al, al
je 0x1401dba13
mov edx, 0x104
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
test eax, eax
jle 0x1401dba13
mov r8d, 8
xor edx, edx
mov rcx, rbx
call fcn.1401ea390
lea r8, [rsp + 0x40]
mov rcx, rbx
call fcn.1401e9e50
or rdi, 0xffffffffffffffff
cmp dword [rbx + 0xc], 0
je 0x1401dbb27
lea edx, [rdi + 0x5d]
mov rcx, qword [rbx]
call fcn.14029aea8
mov rsi, rax
test rax, rax
je 0x1401dbb27
mov rcx, qword [rbx]
sub rsi, rcx
sar rsi, 1
test esi, esi
jle 0x1401dbb27
cmp dword [rbx + 0xc], 0
jne 0x1401dba53
mov eax, edi
jmp 0x1401dba6c
mov edx, 0x2e
call fcn.14029aea8
test rax, rax
jne 0x1401dba66
mov eax, edi
jmp 0x1401dba6c
sub rax, qword [rbx]
sar rax, 1
cmp eax, esi
jge 0x1401dbb27
xor eax, eax
mov qword [rsp + 0x28], rax
mov edx, dword [rbx + 0xc]
test edx, edx
jne 0x1401dba90
lea rax, [0x140323de0]
mov qword [rsp + 0x20], rax
jmp 0x1401dbab4
lea rcx, [rsp + 0x20]
call fcn.1401e9030
movsxd r9, dword [rbx + 0xc]
mov eax, dword [rsp + 0x28]
inc eax
movsxd rdx, eax
mov r8, qword [rbx]
mov rcx, qword [rsp + 0x20]
call fcn.14029b4d8
mov edx, dword [rbx + 0xc]
lea rcx, [rsp + 0x20]
call fcn.1401ea290
nop
lea rdx, [0x140331794]
lea rcx, [rsp + 0x20]
call fcn.1401e7680
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x1401dbb16
inc esi
mov r8d, dword [rbx + 0xc]
sub r8d, esi
mov edx, esi
mov rcx, rbx
call fcn.1401ea390
lea rdx, [rsp + 0x6c]
mov rcx, rbx
call fcn.1401e7680
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
cmp dword [rsp + 0x28], 0
jle 0x1401dbb27
mov rcx, qword [rsp + 0x20]
call fcn.140298600
mov r8d, 1
lea rdx, [0x14033a5a8]
mov rcx, rbx
call fcn.1401e8da0
test al, al
je 0x1401dbba5
mov r8d, 0x400
lea rdx, [rbp + 0x190]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
je 0x1401dbba5
lea rax, [rbp + 0x190]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x1401dbb61
test edi, edi
jle 0x1401dbb95
mov edx, edi
mov rcx, rbx
call fcn.1401e9030
movsxd r9, edi
mov eax, dword [rbx + 8]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x190]
mov rcx, qword [rbx]
call fcn.14029b4d8
jmp 0x1401dbb9b
cmp dword [rbx + 0xc], 0
jle 0x1401dbba5
mov edx, edi
mov rcx, rbx
call fcn.1401ea290
mov rcx, qword [rbp + 0x990]
xor rcx, rsp
call fcn.140297ff0
lea r11, [rsp + 0xaa0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret