Function at 0x14002b130
Capabilities:
Get common file path
Query environment variable

Disassembly:
mov r11, rsp
push r13
sub rsp, 0x920
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rdi
mov qword [r11 + 0x18], r12
mov rax, qword [0x1400d2478]
xor rax, rsp
mov qword [rsp + 0x910], rax
mov rcx, qword [0x1400d50d0]
sub rcx, qword [0x1400d50c8]
movabs rax, 0x2aaaaaaaaaaaaaab
imul rcx
sar rdx, 3
mov rax, rdx
shr rax, 0x3f
add rdx, rax
jne 0x14002b8d4
mov qword [r11 - 0x8a8], 7
xor r12d, r12d
mov qword [rsp + 0x78], r12
mov word [rsp + 0x68], r12w
cmp byte [0x1400d5081], r12b
jne 0x14002b1b9
call fcn.14001dc80
lea rcx, [rsp + 0x90]
lea rdx, [0x1400d3740]
mov r8d, 0x254
call fcn.140071590
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], r12
mov word [rsp + 0x38], r12w
mov r8d, 0x1c
lea rdx, str.:System_Volume_Information_
lea rcx, [rsp + 0x30]
call fcn.140001870
mov r13d, 1
mov edx, r13d
lea rcx, [rsp + 0x30]
call fcn.14002aff0
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], r12
mov word [rsp + 0x38], r12w
lea r8d, [r13 + 0xa]
lea rdx, str.:Recycled_
lea rcx, [rsp + 0x30]
call fcn.140001870
mov edx, r13d
lea rcx, [rsp + 0x30]
call fcn.14002aff0
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], r12
mov word [rsp + 0x38], r12w
lea r8d, [r13 + 0xa]
lea rdx, str.:Recycler_
lea rcx, [rsp + 0x30]
call fcn.140001870
mov edx, r13d
lea rcx, [rsp + 0x30]
call fcn.14002aff0
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], r12
mov word [rsp + 0x38], r12w
lea r8d, [r13 + 0xe]
lea rdx, str.:_recycle.bin_
lea rcx, [rsp + 0x30]
call fcn.140001870
mov edx, r13d
lea rcx, [rsp + 0x30]
call fcn.14002aff0
mov rax, qword [0x1400d5340]
test rax, rax
je 0x14002b329
lea rcx, [rsp + 0x2f0]
mov qword [rsp + 0x20], rcx
mov r9d, r13d
xor r8d, r8d
lea edx, [r13 + 9]
xor ecx, ecx
call rax
test eax, eax
js 0x14002b329
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], r12
mov word [rsp + 0x38], r12w
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x2f0]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x2f0]
lea rcx, [rsp + 0x30]
call fcn.140001870
mov edx, r13d
lea rcx, [rsp + 0x30]
call fcn.14002aff0
xor dil, dil
mov edx, 0x104
lea rcx, [rsp + 0x700]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
movzx ebx, dil
test eax, eax
cmovne ebx, r13d
lea rax, [0x1400ad318]
lea rdx, [rsp + 0x700]
test bl, bl
cmove rdx, rax
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x60]
call fcn.140001870
test bl, bl
je 0x14002b477
mov rbx, qword [rsp + 0x78]
test rbx, rbx
je 0x14002b440
test rbx, rbx
je 0x14002b42c
cmp rbx, 0xffffffffffffffff
jbe 0x14002b3a6
or rcx, 0xffffffffffffffff
jmp 0x14002b3aa
lea rcx, [rbx - 1]
lea rax, [rsp + 0x68]
cmp qword [rsp + 0x80], 8
cmovae rax, qword [rsp + 0x68]
lea rdi, [rax + rcx*2]
nop word [rax + rax]
mov rcx, r13
lea rax, [0x1400ad338]
movzx edx, word [rdi]
nop dword [rax]
cmp word [rax], dx
je 0x14002b403
add rax, 2
sub rcx, r13
jne 0x14002b3e0
lea rcx, [rsp + 0x60]
call fcn.1400016d0
cmp rdi, rax
je 0x14002b42c
sub rdi, 2
jmp 0x14002b3d0
lea rax, [rsp + 0x68]
cmp qword [rsp + 0x80], 8
cmovae rax, qword [rsp + 0x68]
sub rdi, rax
sar rdi, 1
cmp rdi, 0xffffffffffffffff
je 0x14002b42c
lea rax, [rdi + 1]
cmp rbx, rax
je 0x14002b440
mov r8, r13
lea rdx, [0x1400ad338]
lea rcx, [rsp + 0x60]
call fcn.14000a130
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], r12
mov word [rsp + 0x38], r12w
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x30]
call fcn.140001500
mov edx, r13d
lea rcx, [rsp + 0x30]
call fcn.14002aff0
mov rax, qword [0x1400d5340]
test rax, rax
je 0x14002b637
lea rcx, [rsp + 0x2f0]
mov qword [rsp + 0x20], rcx
mov r9d, r13d
xor r8d, r8d
lea edx, [r8 + 0x26]
xor ecx, ecx
call rax
test eax, eax
js 0x14002b550
lea rax, [rsp + 0x2f0]
test rax, rax
je 0x14002b503
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x2f0]
repne scasw ax, word [rdi]
not rcx
dec rcx
test ecx, ecx
je 0x14002b503
lea eax, [rcx + 1]
cmp eax, 0x208
jae 0x14002b503
lea eax, [rcx - 1]
cmp word [rsp + rax*2 + 0x2f0], 0x5c
je 0x14002b503
lea r8, [0x1400ad338]
mov edx, 0x208
lea rcx, [rsp + 0x2f0]
call fcn.140065928
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], r12
mov word [rsp + 0x38], r12w
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x2f0]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x2f0]
lea rcx, [rsp + 0x30]
call fcn.140001870
mov edx, 2
lea rcx, [rsp + 0x30]
call fcn.14002aff0
mov rax, qword [0x1400d5340]
test rax, rax
je 0x14002b637
lea rcx, [rsp + 0x2f0]
mov qword [rsp + 0x20], rcx
mov r9d, r13d
xor r8d, r8d
lea edx, [r8 + 0x2b]
xor ecx, ecx
call rax
test eax, eax
js 0x14002b630
lea rax, [rsp + 0x2f0]
test rax, rax
je 0x14002b5dc
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x2f0]
repne scasw ax, word [rdi]
not rcx
dec rcx
test ecx, ecx
je 0x14002b5dc
lea eax, [rcx + 1]
cmp eax, 0x208
jae 0x14002b5dc
lea eax, [rcx - 1]
cmp word [rsp + rax*2 + 0x2f0], 0x5c
je 0x14002b5dc
lea r8, [0x1400ad338]
mov edx, 0x208
lea rcx, [rsp + 0x2f0]
call fcn.140065928
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], r12
mov word [rsp + 0x38], r12w
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x2f0]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x2f0]
lea rcx, [rsp + 0x30]
call fcn.140001870
mov edx, r13d
lea rcx, [rsp + 0x30]
call fcn.14002aff0
mov rax, qword [0x1400d5340]
jmp 0x14002b637
mov rax, qword [0x1400d5340]
cmp byte [rsp + 0x98], 0
je 0x14002b7e3
mov r8d, 0x208
lea rdx, [rsp + 0x2f0]
lea rcx, str._ProgramW6432_
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x14002b70c
lea rax, [rsp + 0x2f0]
test rax, rax
je 0x14002b6c1
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x2f0]
repne scasw ax, word [rdi]
not rcx
dec rcx
test ecx, ecx
je 0x14002b6c1
lea eax, [rcx + 1]
cmp eax, 0x208
jae 0x14002b6c1
lea eax, [rcx - 1]
cmp word [rsp + rax*2 + 0x2f0], 0x5c
je 0x14002b6c1
lea r8, [0x1400ad338]
mov edx, 0x208
lea rcx, [rsp + 0x2f0]
call fcn.140065928
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], r12
mov word [rsp + 0x38], r12w
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x2f0]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x2f0]
lea rcx, [rsp + 0x30]
call fcn.140001870
mov edx, r13d
lea rcx, [rsp + 0x30]
call fcn.14002aff0
mov r8d, 0x208
lea rdx, [rsp + 0x2f0]
lea rcx, str._CommonProgramW6432_
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x14002b7dc
lea rax, [rsp + 0x2f0]
test rax, rax
je 0x14002b788
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x2f0]
repne scasw ax, word [rdi]
not rcx
dec rcx
test ecx, ecx
je 0x14002b788
lea eax, [rcx + 1]
cmp eax, 0x208
jae 0x14002b788
lea eax, [rcx - 1]
cmp word [rsp + rax*2 + 0x2f0], 0x5c
je 0x14002b788
lea r8, [0x1400ad338]
mov edx, 0x208
lea rcx, [rsp + 0x2f0]
call fcn.140065928
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], r12
mov word [rsp + 0x38], r12w
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x2f0]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x2f0]
lea rcx, [rsp + 0x30]
call fcn.140001870
mov edx, r13d
lea rcx, [rsp + 0x30]
call fcn.14002aff0
mov rax, qword [0x1400d5340]
jmp 0x14002b7e3
mov rax, qword [0x1400d5340]
test rax, rax
je 0x14002b8bf
lea rcx, [rsp + 0x2f0]
mov qword [rsp + 0x20], rcx
mov r9d, r13d
xor r8d, r8d
lea edx, [r8 + 0x2e]
xor ecx, ecx
call rax
test eax, eax
js 0x14002b8bf
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x2f0]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x2f0]
lea rcx, [rsp + 0x60]
call fcn.140001870
mov r9, r13
mov r8d, 3
lea rdx, [0x1400ad338]
lea rcx, [rsp + 0x60]
call fcn.1400021c0
cmp rax, 0xffffffffffffffff
je 0x14002b8bf
lea rdx, [rax + 1]
mov rax, qword [rsp + 0x78]
cmp rdx, rax
ja 0x14002b877
or r8, 0xffffffffffffffff
lea rcx, [rsp + 0x60]
call fcn.1400019e0
jmp 0x14002b887
xor r8d, r8d
sub rdx, rax
lea rcx, [rsp + 0x60]
call fcn.1400022f0
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], r12
mov word [rsp + 0x38], r12w
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x30]
call fcn.140001500
mov edx, r13d
lea rcx, [rsp + 0x30]
call fcn.14002aff0
nop
cmp qword [rsp + 0x80], 8
jb 0x14002b8d4
mov rcx, qword [rsp + 0x68]
call fcn.140065920
mov rcx, qword [rsp + 0x910]
xor rcx, rsp
call fcn.140064b70
lea r11, [rsp + 0x920]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov r12, qword [r11 + 0x20]
mov rsp, r11
pop r13
ret