Function at 0x7ffbf1d00374
Capabilities:
Check os version
Get common file path
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x150
mov rax, qword [0x7ffbf1d68270]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor ebp, ebp
mov rbx, rcx
mov dword [rsp + 0x20], 0x114
mov dword [rcx + 8], ebp
mov dword [rcx + 4], ebp
lea rcx, [rsp + 0x20]
mov edi, ebp
mov esi, ebp
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp eax, ebp
jne 0x7ffbf1d003e6
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
cmp eax, ebp
cmovle edi, eax
cmp edi, ebp
jl 0x7ffbf1d005cb
mov edi, 0x8000ffff
jmp 0x7ffbf1d00404
cmp dword [rsp + 0x30], 2
jne 0x7ffbf1d00404
cmp dword [rsp + 0x24], 6
jb 0x7ffbf1d00404
cmp dword [rsp + 0x2c], 0x14ca
mov eax, 1
cmovae esi, eax
cmp edi, ebp
jl 0x7ffbf1d005cb
mov edx, 0x104
mov rcx, rbx
call fcn.7ffbf1cc7ea8
cmp eax, ebp
mov edi, eax
jl 0x7ffbf1d005cb
cmp esi, ebp
je 0x7ffbf1d004ac
cmp dword [rbx + 4], ebp
mov rdx, rbp
jl 0x7ffbf1d00437
mov rdx, qword [rbx + 0x10]
lea rcx, [0x7ffbf1caf8b8]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, ebp
jne 0x7ffbf1d00474
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
cmp eax, ebp
cmovle edi, eax
cmp edi, ebp
jl 0x7ffbf1d005cb
mov edi, 0x8000ffff
jmp 0x7ffbf1d005cb
or edx, 0xffffffff
mov rcx, rbx
call fcn.7ffbf1cc768c
lea rdx, [0x7ffbf1caf8a0]
mov rcx, rbx
call fcn.7ffbf1cd0e14
cmp eax, ebp
mov edi, eax
jl 0x7ffbf1d005cb
lea rdx, [0x7ffbf1caf890]
mov rcx, rbx
call fcn.7ffbf1cd0e14
jmp 0x7ffbf1d00550
mov rdx, rbx
mov ecx, 0x19
call fcn.7ffbf1d00284
cmp eax, ebp
jne 0x7ffbf1d00558
cmp dword [rbx + 4], ebp
jge 0x7ffbf1d004cb
mov rcx, rbp
jmp 0x7ffbf1d004e3
mov edx, 0x104
mov rcx, rbx
call fcn.7ffbf1cc7ea8
mov rcx, rbp
cmp eax, ebp
jl 0x7ffbf1d004e3
mov rcx, qword [rbx + 0x10]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
cmp eax, ebp
jne 0x7ffbf1d0050b
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
cmp eax, ebp
cmovle edi, eax
jmp 0x7ffbf1d005cb
or edx, 0xffffffff
mov rcx, rbx
call fcn.7ffbf1cc768c
lea rdx, [0x7ffbf1caf878]
mov rcx, rbx
call fcn.7ffbf1cd0e14
cmp eax, ebp
mov edi, eax
jl 0x7ffbf1d005cb
mov rcx, rbx
call fcn.7ffbf1cffea4
cmp eax, ebp
jne 0x7ffbf1d005ba
cmp dword [rbx + 4], ebp
mov edx, ebp
jl 0x7ffbf1d00545
mov edx, dword [rbx + 8]
add edx, 0xfffffff5
mov rcx, rbx
call fcn.7ffbf1cffdcc
cmp eax, ebp
mov edi, eax
jl 0x7ffbf1d005cb
jmp 0x7ffbf1d005ba
cmp dword [rbx + 4], ebp
lea rdi, [0x7ffbf1cafb98]
jl 0x7ffbf1d0056f
cmp dword [rbx + 8], ebp
je 0x7ffbf1d0056f
mov rcx, qword [rbx + 0x10]
jmp 0x7ffbf1d00572
mov rcx, rdi
mov edx, 0x5c
call sub.msvcrt.dll_wcsrchr
cmp rax, rbp
je 0x7ffbf1d005ba
cmp dword [rbx + 4], ebp
jl 0x7ffbf1d0058f
cmp dword [rbx + 8], ebp
je 0x7ffbf1d0058f
mov rdi, qword [rbx + 0x10]
sub rax, rdi
sar rax, 1
cmp eax, ebp
jl 0x7ffbf1d005b3
cmp eax, dword [rbx + 0xc]
jge 0x7ffbf1d005b3
cmp eax, dword [rbx + 8]
movsxd rcx, eax
jg 0x7ffbf1d005a9
mov dword [rbx + 8], eax
mov rax, qword [rbx + 0x10]
mov word [rax + rcx*2], bp
jmp 0x7ffbf1d005ba
mov dword [rbx + 4], 0x8007006f
lea rdx, [0x7ffbf1caf870]
mov rcx, rbx
call fcn.7ffbf1cd0e14
mov edi, eax
mov eax, edi
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.7ffbf1d2cc34
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret