Function at 0x493a40
Capabilities:
Get common file path
Link many functions at runtime
Query environment variable
Query or enumerate registry value
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x535a40]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push str.GetProcessDpiAwareness
push 1
push str.shcore.dll
call fcn.0042f970
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
add esp, 8
push eax
call edi
push str.AllocateAndGetTcpExTable2FromStack
push 1
push str.iphlpapi.dll
mov dword [0x561864], eax
call fcn.0042f970
add esp, 8
push eax
call edi
push str.AllocateAndGetUdpExTable2FromStack
push 1
push str.iphlpapi.dll
mov dword [0x555194], eax
call fcn.0042f970
add esp, 8
push eax
call edi
push str.HungWindowFromGhostWindow
push 1
push str.user32.dll
mov dword [0x555190], eax
call fcn.0042f970
add esp, 8
push eax
call edi
push str.GetLogicalProcessorInformationEx
push 1
push str.kernel32.dll
mov dword [0x561868], eax
call fcn.0042f970
add esp, 8
push eax
call edi
push 0x511a88
push 1
push str.kernel32.dll
mov dword [0x555198], eax
call fcn.0042f970
add esp, 8
push eax
call edi
push str.WinStationConnectW
push 1
push str.winsta.dll
mov dword [0x55519c], eax
call fcn.0042f970
add esp, 8
push eax
call edi
mov esi, dword [sym.imp.USER32.dll_MessageBoxW]
mov dword [0x5551a0], eax
test eax, eax
jne 0x493b54
push str.winsta_WinStationConnectW
lea eax, [ebp - 0x20c]
push str.Not_able_to_run_on_this_version_of_Windows:_nMissing_function:__s
push eax
call fcn.0042fa30
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x10
push str.Process_Explorer
push eax
push 0
call esi
push str.WinStationShadow
push 1
push str.winsta.dll
call fcn.0042f970
add esp, 8
push eax
call edi
mov dword [0x5551a4], eax
test eax, eax
jne 0x493b9f
push str.winsta_WinStationShadow
lea eax, [ebp - 0x20c]
push str.Not_able_to_run_on_this_version_of_Windows:_nMissing_function:__s
push eax
call fcn.0042fa30
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x10
push str.Process_Explorer
push eax
push 0
call esi
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 0x54f284
call ebx
mov esi, eax
test esi, esi
jne 0x493cc7
lea eax, [ebp - 0x214]
push eax
push str.SoftwareMicrosoftDebuggingTools
push reloc.ACLUI.dll_CreateSecurityPage
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x493ca1
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], 0x208
push eax
push 0x54f284
push esi
push esi
push str.Windbg
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push str.DbgHelp.dll
push 0x104
push 0x54f284
call fcn.004d6355
add esp, 0xc
push 0x54f284
call ebx
mov esi, eax
test esi, esi
jne 0x493cc7
push str.C:Debuggersdbghelp.dll
push 0x104
push 0x54f284
call fcn.004c913a
add esp, 0xc
push 0x54f284
call ebx
mov esi, eax
test esi, esi
jne 0x493cc7
push 0x104
push 0x54f284
push str._ProgramFiles_Debugging_Tools_for_Windows__x86_dbghelp.dll
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0x54f284
call ebx
mov esi, eax
test esi, esi
jne 0x493cc7
push 0x54f284
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0x511c64
push 0x104
push 0x54f284
call fcn.004d6355
add esp, 0xc
push 0x54f284
call ebx
mov esi, eax
test esi, esi
jne 0x493cc7
push 1
push str.dbghelp.dll
call fcn.0042f970
mov esi, eax
add esp, 8
test esi, esi
jne 0x493cc7
push 1
push str.imagehlp.dll
call fcn.0042f970
add esp, 8
mov esi, eax
push 0x104
push 0x54f284
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x54f284
call ebx
mov ebx, eax
push str.SymInitialize
push ebx
call edi
push str.EnumerateLoadedModulesW64
push ebx
mov dword [0x555138], eax
call edi
push str.SymRegisterCallback64
push ebx
mov dword [0x555170], eax
call edi
push str.SymGetModuleInfoW64
push ebx
mov dword [0x555174], eax
call edi
push str.SymCleanup
push ebx
mov dword [0x55516c], eax
call edi
push str.SymFromAddrW
push ebx
mov dword [0x55514c], eax
call edi
push str.SymGetSymFromName
push ebx
mov dword [0x555148], eax
call edi
push str.MiniDumpWriteDump
push ebx
mov dword [0x555144], eax
call edi
push str.SymSetOptions
push ebx
mov dword [0x550a88], eax
call edi
push str.SymGetOptions
push ebx
mov dword [0x555150], eax
call edi
push str.SymLoadModuleExW
push ebx
mov dword [0x55513c], eax
call edi
mov dword [0x555164], eax
test eax, eax
je 0x493d7b
mov ecx, 0x4a2e30
jmp 0x493d94
push str.SymLoadModule64
push ebx
call edi
xor ecx, ecx
mov dword [0x55515c], eax
test eax, eax
mov edx, 0x4a2e60
cmovne ecx, edx
push str.SymUnloadModule64
push ebx
mov dword [0x555158], ecx
call edi
push str.ImageNtHeader
push ebx
mov dword [0x555168], eax
call edi
push str.StackWalk64
push ebx
mov dword [0x55517c], eax
call edi
push str.SymGetModuleBase64
push ebx
mov dword [0x555154], eax
call edi
push str.SymFunctionTableAccess64
push ebx
mov dword [0x555178], eax
call edi
cmp byte [0x54f48c], 0
mov dword [0x555140], eax
pop ebx
jne 0x493df8
cmp dword [0x555138], 0
je 0x493e08
cmp word [0x54f48e], 0
je 0x493e08
push 0x54f48e
push str._NT_SYMBOL_PATH
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
cmp dword [0x55517c], 0
jne 0x493e2d
push str.ImageNtHeader
push 1
push str.imagehlp.dll
call fcn.0042f970
add esp, 8
push eax
call edi
mov dword [0x55517c], eax
push str.FindExecutableImageExW
push esi
call edi
mov dword [0x555188], eax
test eax, eax
je 0x493e45
mov ecx, 0x48fcb0
jmp 0x493e6d
push str.FindExecutableImage
push 1
push str.imagehlp.dll
call fcn.0042f970
add esp, 8
push eax
call edi
xor ecx, ecx
mov dword [0x555180], eax
test eax, eax
mov edx, 0x48fcd0
cmovne ecx, edx
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.QueryProcessCycleTime
push str.kernel32.dll
mov dword [0x555184], ecx
call esi
push eax
call edi
push str.QueryIdleProcessorCycleTime
push str.kernel32.dll
mov dword [0x561858], eax
call esi
push eax
call edi
push 0x511d14
push str.kernel32.dll
mov dword [0x5551a8], eax
call esi
push eax
call edi
push 0x511d2c
push str.Shell32.dll
mov dword [0x561860], eax
call esi
push eax
call edi
push str.ChangeWindowMessageFilter
push str.user32.dll
mov dword [0x550a9c], eax
call esi
push eax
call edi
push str.I_QueryTagInformation
push 1
push str.advapi32.dll
mov dword [0x5551ac], eax
call fcn.0042f970
add esp, 8
push eax
call edi
push str.CreateProcessWithTokenW
push 0x4f9e00
mov dword [0x550a80], eax
call esi
push eax
call edi
push str.CpuGetContext
push 1
push str.wow64cpu
mov dword [0x550a84], eax
call fcn.0042f970
add esp, 8
push eax
call edi
push str.GetProcessorSystemCycleTime
push 1
push str.kernel32.dll
mov dword [0x5551b0], eax
call fcn.0042f970
add esp, 8
push eax
call edi
push 0x511dcc
push 1
push str.kernel32.dll
mov dword [0x56185c], eax
call fcn.0042f970
add esp, 8
push eax
call edi
push str.IsImmersiveProcess
push 1
push str.user32.dll
mov dword [0x551134], eax
call fcn.0042f970
add esp, 8
push eax
call edi
push str.GetPackageFullName
push 1
mov dword [0x550ae0], eax
push str.kernel32.dll
call fcn.0042f970
add esp, 8
push eax
call edi
push str.GetPackagePathByFullName
push 1
push str.kernel32.dll
mov dword [0x550ae4], eax
call fcn.0042f970
add esp, 8
push eax
call edi
mov ecx, dword [ebp - 4]
pop edi
mov dword [0x5551b4], eax
xor ecx, ebp
mov al, 1
pop esi
call fcn.004c34b7
mov esp, ebp
pop ebp
ret