Function at 0x1401ef160
Capabilities:
Get common file path
Query environment variable

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x9b8]
sub rsp, 0xaa0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x140415a10]
xor rax, rsp
mov qword [rbp + 0x990], rax
mov rbx, rcx
mov r8d, 1
lea rdx, [0x14034f2fc]
call fcn.1401ff2c0
test al, al
je 0x1401ef1e8
mov r8d, 1
lea rdx, [0x14034f2fc]
mov rcx, rbx
call fcn.1401fd400
test eax, eax
jle 0x1401ef1e8
mov r8d, dword [rbx + 0xc]
sub r8d, eax
mov edx, eax
mov rcx, rbx
call fcn.1401fdf50
xor edx, edx
lea r8d, [rdx + 1]
mov rcx, rbx
call fcn.1401fdf50
xor r8d, r8d
lea rdx, str._globalroot
mov rcx, rbx
call fcn.1401ff2c0
mov rcx, rbx
test al, al
je 0x1401ef20c
xor edx, edx
lea r8d, [rdx + 0xe]
jmp 0x1401ef2cf
mov r8d, 1
lea rdx, [0x140353dd0]
call fcn.1401ff2c0
test al, al
je 0x1401ef22d
xor edx, edx
lea r8d, [rdx + 4]
jmp 0x1401ef2cc
cmp dword [rbx + 0xc], 0
jle 0x1401ef2d8
xor edx, edx
mov rcx, rbx
call fcn.1401fb010
cmp ax, 0x25
jne 0x1401ef26c
mov r8d, 0x400
lea rdx, [rbp + 0x190]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rdx, [rbp + 0x190]
mov rcx, rbx
call fcn.1401fafa0
mov rcx, rbx
call fcn.1400d3040
test al, al
jne 0x1401ef292
mov edx, 0x20
mov rcx, qword [rbx]
call fcn.1402ba4e4
test rax, rax
je 0x1401ef2d4
sub rax, qword [rbx]
sar rax, 1
jmp 0x1401ef2bf
lea rdx, [0x1403635e8]
mov rcx, rbx
call fcn.1401fd2e0
mov rcx, rbx
test eax, eax
jle 0x1401ef2b3
mov r8d, dword [rbx + 0xc]
sub r8d, eax
mov edx, eax
jmp 0x1401ef2cf
lea rdx, [0x140366970]
call fcn.1401fd2e0
test eax, eax
jle 0x1401ef2d4
mov r8d, dword [rbx + 0xc]
mov edx, eax
sub r8d, eax
mov rcx, rbx
call fcn.1401fdf50
cmp dword [rbx + 0xc], 0
je 0x1401ef515
xor r8d, r8d
lea rdx, str.system32_
mov rcx, rbx
call fcn.1401ff2c0
test al, al
je 0x1401ef30a
mov edx, 0x104
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1401ef383
jmp 0x1401ef366
xor r8d, r8d
lea rdx, str.SystemRoot_
mov rcx, rbx
call fcn.1401ff2c0
test al, al
je 0x1401ef33c
mov edx, 0x104
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x1401ef383
mov r8d, 0xb
jmp 0x1401ef36c
xor r8d, r8d
lea rdx, str.SysWOW64
mov rcx, rbx
call fcn.1401ff2c0
test al, al
je 0x1401ef383
mov edx, 0x104
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
test eax, eax
jle 0x1401ef383
mov r8d, 8
xor edx, edx
mov rcx, rbx
call fcn.1401fdf50
lea r8, [rsp + 0x40]
mov rcx, rbx
call fcn.1401fda10
or rdi, 0xffffffffffffffff
cmp dword [rbx + 0xc], 0
je 0x1401ef497
lea edx, [rdi + 0x5d]
mov rcx, qword [rbx]
call fcn.1402ba31c
mov rsi, rax
test rax, rax
je 0x1401ef497
mov rcx, qword [rbx]
sub rsi, rcx
sar rsi, 1
test esi, esi
jle 0x1401ef497
cmp dword [rbx + 0xc], 0
jne 0x1401ef3c3
mov eax, edi
jmp 0x1401ef3dc
mov edx, 0x2e
call fcn.1402ba31c
test rax, rax
jne 0x1401ef3d6
mov eax, edi
jmp 0x1401ef3dc
sub rax, qword [rbx]
sar rax, 1
cmp eax, esi
jge 0x1401ef497
xor eax, eax
mov qword [rsp + 0x28], rax
mov edx, dword [rbx + 0xc]
test edx, edx
jne 0x1401ef400
lea rax, [0x140346ce0]
mov qword [rsp + 0x20], rax
jmp 0x1401ef424
lea rcx, [rsp + 0x20]
call fcn.1401fcb40
movsxd r9, dword [rbx + 0xc]
mov eax, dword [rsp + 0x28]
inc eax
movsxd rdx, eax
mov r8, qword [rbx]
mov rcx, qword [rsp + 0x20]
call fcn.1402ba94c
mov edx, dword [rbx + 0xc]
lea rcx, [rsp + 0x20]
call fcn.1401fde50
nop
lea rdx, [0x140355288]
lea rcx, [rsp + 0x20]
call fcn.1401fb190
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x1401ef486
inc esi
mov r8d, dword [rbx + 0xc]
sub r8d, esi
mov edx, esi
mov rcx, rbx
call fcn.1401fdf50
lea rdx, [rsp + 0x6c]
mov rcx, rbx
call fcn.1401fb190
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
cmp dword [rsp + 0x28], 0
jle 0x1401ef497
mov rcx, qword [rsp + 0x20]
call fcn.1402b7350
mov r8d, 1
lea rdx, [0x14035ec70]
mov rcx, rbx
call fcn.1401fc8b0
test al, al
je 0x1401ef515
mov r8d, 0x400
lea rdx, [rbp + 0x190]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
je 0x1401ef515
lea rax, [rbp + 0x190]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x1401ef4d1
test edi, edi
jle 0x1401ef505
mov edx, edi
mov rcx, rbx
call fcn.1401fcb40
movsxd r9, edi
mov eax, dword [rbx + 8]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x190]
mov rcx, qword [rbx]
call fcn.1402ba94c
jmp 0x1401ef50b
cmp dword [rbx + 0xc], 0
jle 0x1401ef515
mov edx, edi
mov rcx, rbx
call fcn.1401fde50
mov rcx, qword [rbp + 0x990]
xor rcx, rsp
call fcn.1402b6d40
lea r11, [rsp + 0xaa0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret