Function at 0x1400ea920
Capabilities:
Get common file path
Query environment variable

Disassembly:
push rbp
lea rbp, [rsp - 0x490]
sub rsp, 0x590
mov rax, qword [0x14027df48]
xor rax, rsp
mov qword [rbp + 0x480], rax
xor edx, edx
lea rcx, [rbp + 0x370]
mov r8d, 0x104
call fcn.140104310
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x104
call fcn.140104310
xor edx, edx
lea rcx, [rbp + 0x40]
mov r8d, 0x104
call fcn.140104310
xor edx, edx
lea rcx, [rbp + 0x260]
mov r8d, 0x104
call fcn.140104310
xor edx, edx
lea rcx, [rbp + 0x150]
mov r8d, 0x104
call fcn.140104310
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
mov rcx, rax
mov edx, 0x80
call qword [sym.imp.KERNEL32.DLL_SetPriorityClass]
mov edx, 0x104
lea rcx, [rbp + 0x370]
call qword [sym.imp.KERNEL32.DLL_GetSystemWindowsDirectoryA]
test eax, eax
jne 0x1400ea9f3
mov r9, 0xffffffffffffffff
lea r8, str.C:Windows
mov edx, 0x104
lea rcx, [rbp + 0x370]
call fcn.1401121b8
mov edx, 0x104
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
test eax, eax
jne 0x1400eaa24
mov r9, 0xffffffffffffffff
lea r8, str.C:WindowsSystem32
mov edx, 0x104
lea rcx, [rsp + 0x30]
call fcn.1401121b8
lea rdx, [rbp + 0x40]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.DLL_GetTempPathA]
mov eax, eax
cmp rax, 1
jbe 0x1400eaa51
dec rax
cmp rax, 0x104
jae 0x1400eaba5
mov byte [rbp + rax + 0x40], 0
jmp 0x1400eaa6d
mov r9, 0xffffffffffffffff
lea r8, str.C:WindowsTemp
mov edx, 0x104
lea rcx, [rbp + 0x40]
call fcn.1401121b8
mov r8d, 0x104
lea rdx, [rbp + 0x150]
lea rcx, str.DriverData
call qword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableA]
test eax, eax
jne 0x1400eaaa8
lea r9, [rsp + 0x30]
mov ecx, 0x104
lea r8, str._sdriversDriverData
lea rdx, [rbp + 0x150]
call fcn.1400e9920
lea r8, [rsp + 0x20]
mov ecx, 6
lea rdx, [fcn.1400ea920]
call qword [sym.imp.KERNEL32.DLL_GetModuleHandleExW]
test eax, eax
je 0x1400eaaf8
mov rcx, qword [rsp + 0x20]
lea rdx, [rbp + 0x260]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
test eax, eax
je 0x1400eaaf8
mov edx, 0x5c
lea rcx, [rbp + 0x260]
call fcn.140104a18
test rax, rax
je 0x1400eaaf8
mov byte [rax], 0
mov r9d, 0x400
lea r8, [rsp + 0x30]
lea rdx, str._SYSTEM_
lea rcx, str.HOME_DRVDATA_IntelIPFlog_nTEMP_TEMP__nDV_DRVDATA_IntelIPFdv_nLOG_DRVDATA_IntelIPFlog_nBIN_DRVDATA_IntelIPF_bin_nLOCK_DRVDATA_IntelIPF_nEXE_DLLDIR__nDLL_DLLDIR__nDLLALT_SYSTEM_IntelIPF_nDSP_DRVDATA_IntelIPFdsp_nCMD_DRVDATA_IntelIPFcmd_nDATA_DRVDATA_IntelIPFui_n
call fcn.1400eabb0
mov r9d, 0x400
lea r8, [rbp + 0x40]
lea rdx, str._TEMP_
lea rcx, str.HOME_DRVDATA_IntelIPFlog_nTEMP_TEMP__nDV_DRVDATA_IntelIPFdv_nLOG_DRVDATA_IntelIPFlog_nBIN_DRVDATA_IntelIPF_bin_nLOCK_DRVDATA_IntelIPF_nEXE_DLLDIR__nDLL_DLLDIR__nDLLALT_SYSTEM_IntelIPF_nDSP_DRVDATA_IntelIPFdsp_nCMD_DRVDATA_IntelIPFcmd_nDATA_DRVDATA_IntelIPFui_n
call fcn.1400eabb0
mov r9d, 0x400
lea r8, [rbp + 0x150]
lea rdx, str._DRVDATA_
lea rcx, str.HOME_DRVDATA_IntelIPFlog_nTEMP_TEMP__nDV_DRVDATA_IntelIPFdv_nLOG_DRVDATA_IntelIPFlog_nBIN_DRVDATA_IntelIPF_bin_nLOCK_DRVDATA_IntelIPF_nEXE_DLLDIR__nDLL_DLLDIR__nDLLALT_SYSTEM_IntelIPF_nDSP_DRVDATA_IntelIPFdsp_nCMD_DRVDATA_IntelIPFcmd_nDATA_DRVDATA_IntelIPFui_n
call fcn.1400eabb0
mov r9d, 0x400
lea r8, [rbp + 0x260]
lea rdx, str._DLLDIR_
lea rcx, str.HOME_DRVDATA_IntelIPFlog_nTEMP_TEMP__nDV_DRVDATA_IntelIPFdv_nLOG_DRVDATA_IntelIPFlog_nBIN_DRVDATA_IntelIPF_bin_nLOCK_DRVDATA_IntelIPF_nEXE_DLLDIR__nDLL_DLLDIR__nDLLALT_SYSTEM_IntelIPF_nDSP_DRVDATA_IntelIPFdsp_nCMD_DRVDATA_IntelIPFcmd_nDATA_DRVDATA_IntelIPFui_n
call fcn.1400eabb0
mov ecx, dword [0x140286158]
lea eax, [rcx - 2]
test eax, 0xfffffffc
jne 0x1400eab8d
cmp ecx, 3
je 0x1400eab8d
call fcn.1400ea5a0
mov rcx, qword [rbp + 0x480]
xor rcx, rsp
call fcn.140102a00
add rsp, 0x590
pop rbp
ret
call fcn.140102b64
int3