Function at 0x14000aff0
Capabilities:
Get common file path
Query environment variable

Disassembly:
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x330]
sub rsp, 0x430
mov rax, qword [0x140324030]
xor rax, rsp
mov qword [rbp + 0x320], rax
cmp qword [rcx + 0x30], 0
mov rdi, rcx
jne 0x14000b032
mov ecx, reloc.mfc110u.dll_Ordinal_1114
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x14000b3f5
cmp dword [rcx + 0x44], 0
je 0x14000b042
mov eax, 1
jmp 0x14000b3f5
mov qword [rsp + Ordinal_1099], rbx
xor ebx, ebx
test byte [rcx + 0x50], 0x10
je 0x14000b360
mov ecx, 0x1000
call qword [sym.imp.MSVCR110.dll_malloc]
mov rbx, rax
test rax, rax
jne 0x14000b079
lea ecx, [rax + 8]
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x14000b3ed
mov byte [rax], 0
mov r8, qword [rdi + 0x48]
test r8, r8
je 0x14000b0a8
mov edx, 0x1000
mov rcx, rax
call qword [sym.imp.MSVCR110.dll_strcat_s]
lea r8, [0x140223a9c]
mov edx, 0x1000
mov rcx, rbx
call qword [sym.imp.MSVCR110.dll_strcat_s]
lea r8, [0x140223aa0]
mov edx, 0x1000
mov rcx, rbx
call qword [sym.imp.MSVCR110.dll_strcat_s]
lea rdx, [rsp + 0x20]
mov ecx, Ordinal_1028
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x14000b100
lea r8, [rsp + 0x20]
mov edx, 0x1000
mov rcx, rbx
mov byte [rbp + 0x31f], 0
call qword [sym.imp.MSVCR110.dll_strcat_s]
lea r8, [0x140223a9c]
mov edx, 0x1000
mov rcx, rbx
call qword [sym.imp.MSVCR110.dll_strcat_s]
lea rdx, [rsp + 0x20]
mov r8d, Ordinal_1028
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x14000b1bc
or rdx, 0xffffffffffffffff
mov byte [rbp + 0x31f], 0
lea rax, [rsp + 0x20]
mov rcx, rdx
nop
inc rcx
cmp byte [rax + rcx], 0
jne 0x14000b130
lea rax, [rsp + 0x20]
dec rax
add rcx, rax
lea rax, [rsp + 0x20]
cmp rcx, rax
jb 0x14000b181
movabs r8, 0x200000000801
nop dword [rax + rax]
movzx eax, byte [rcx]
sub al, 0x2f
cmp al, 0x2d
ja 0x14000b16f
bt r8, rax
jb 0x14000b17e
lea rax, [rsp + 0x20]
dec rcx
cmp rcx, rax
jae 0x14000b160
jmp 0x14000b181
mov byte [rcx], 0
lea rax, [rsp + 0x20]
inc rdx
cmp byte [rax + rdx], 0
jne 0x14000b186
test rdx, rdx
je 0x14000b1bc
lea r8, [rsp + 0x20]
mov edx, 0x1000
mov rcx, rbx
call qword [sym.imp.MSVCR110.dll_strcat_s]
lea r8, [0x140223a9c]
mov edx, 0x1000
mov rcx, rbx
call qword [sym.imp.MSVCR110.dll_strcat_s]
lea rdx, [rsp + 0x20]
lea rcx, str._NT_SYMBOL_PATH
mov r8d, Ordinal_1028
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x14000b207
lea r8, [rsp + 0x20]
mov edx, 0x1000
mov rcx, rbx
mov byte [rbp + 0x31f], 0
call qword [sym.imp.MSVCR110.dll_strcat_s]
lea r8, [0x140223a9c]
mov edx, 0x1000
mov rcx, rbx
call qword [sym.imp.MSVCR110.dll_strcat_s]
lea rdx, [rsp + 0x20]
lea rcx, str._NT_ALTERNATE_SYMBOL_PATH
mov r8d, Ordinal_1028
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x14000b252
lea r8, [rsp + 0x20]
mov edx, 0x1000
mov rcx, rbx
mov byte [rbp + 0x31f], 0
call qword [sym.imp.MSVCR110.dll_strcat_s]
lea r8, [0x140223a9c]
mov edx, 0x1000
mov rcx, rbx
call qword [sym.imp.MSVCR110.dll_strcat_s]
lea rdx, [rsp + 0x20]
lea rcx, str.SYSTEMROOT
mov r8d, Ordinal_1028
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x14000b2dc
lea r8, [rsp + 0x20]
mov edx, 0x1000
mov rcx, rbx
mov byte [rbp + 0x31f], 0
call qword [sym.imp.MSVCR110.dll_strcat_s]
lea r8, [0x140223a9c]
mov edx, 0x1000
mov rcx, rbx
call qword [sym.imp.MSVCR110.dll_strcat_s]
lea r8, str._system32
lea rcx, [rsp + 0x20]
mov edx, Ordinal_1028
call qword [sym.imp.MSVCR110.dll_strcat_s]
lea r8, [rsp + 0x20]
mov edx, 0x1000
mov rcx, rbx
call qword [sym.imp.MSVCR110.dll_strcat_s]
lea r8, [0x140223a9c]
mov edx, 0x1000
mov rcx, rbx
call qword [sym.imp.MSVCR110.dll_strcat_s]
test byte [rdi + 0x50], 0x10
je 0x14000b360
lea rdx, [rsp + 0x20]
lea rcx, str.SYSTEMDRIVE
mov r8d, Ordinal_1028
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov edx, 0x1000
mov rcx, rbx
test eax, eax
je 0x14000b353
lea r8, str.SRV
mov byte [rbp + 0x31f], 0
call qword [sym.imp.MSVCR110.dll_strcat_s]
lea r8, [rsp + 0x20]
mov edx, 0x1000
mov rcx, rbx
call qword [sym.imp.MSVCR110.dll_strcat_s]
lea r8, str.websymbols
mov edx, 0x1000
mov rcx, rbx
call qword [sym.imp.MSVCR110.dll_strcat_s]
lea r8, str.http:__msdl.microsoft.com_download_symbols_
mov edx, 0x1000
mov rcx, rbx
jmp 0x14000b35a
lea r8, str.SRVc:websymbolshttp:__msdl.microsoft.com_download_symbols_
call qword [sym.imp.MSVCR110.dll_strcat_s]
mov rcx, qword [rdi + 0x30]
mov rdx, rbx
mov qword [rsp + reloc.mfc110u.dll_Ordinal_1104], rsi
call fcn.14000a050
mov esi, eax
test rbx, rbx
je 0x14000b384
mov rcx, rbx
call qword [sym.imp.MSVCR110.dll_free]
test esi, esi
jne 0x14000b3ad
mov rax, qword [rdi]
lea rdx, str.Error_while_initializing_dbghelp.dll
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
call qword [rax + 0x20]
mov ecx, reloc.mfc110u.dll_Ordinal_1114
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x14000b3e5
mov rbx, qword [rdi + 0x38]
mov rsi, qword [rdi + 0x30]
mov r8d, dword [rdi + 0x40]
mov rdx, rbx
mov rcx, rsi
call fcn.14000a490
test eax, eax
je 0x14000b3cf
mov eax, 1
jmp 0x14000b3de
mov rdx, rbx
mov rcx, rsi
call fcn.14000a620
test eax, eax
je 0x14000b3e5
mov dword [rdi + 0x44], 1
mov rsi, qword [rsp + reloc.mfc110u.dll_Ordinal_1104]
mov rbx, qword [rsp + 0x448]
mov rcx, qword [rbp + 0x320]
xor rcx, rsp
call fcn.1401e3980
mov rdi, qword [rsp + reloc.mfc110u.dll_Ordinal_1112]
add rsp, 0x430
pop rbp
ret