Function at 0x1400bd650
Capabilities:
Check if file exists
Get disk information
Get token membership
Query environment variable

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x250
mov rbp, qword [0x140207460]
mov r9d, 0xffffffff
mov r8d, 0x104
mov rax, qword [rbp]
mov qword [rsp + 0x248], rax
xor eax, eax
lea rsi, [rsp + 0x40]
mov rbx, rcx
mov rdi, rdx
mov rcx, rsi
call fcn.1400bb020
test eax, eax
js 0x1400bd800
xor r9d, r9d
mov r8d, 0x104
mov edx, eax
mov rcx, rsi
call fcn.1400bc630
test eax, eax
js 0x1400bd80e
mov dword [rsp + 0x28], 0x2000000
xor r9d, r9d
xor edx, edx
mov rcx, rsi
mov r14, qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r8d, 7
xor r12d, r12d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x20], 3
call r14
mov r13, rax
cmp rax, 0xffffffffffffffff
je 0x1400bd818
xor r9d, r9d
mov r8d, 0x104
mov rdx, rsi
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetFinalPathNameByHandleW]
mov rcx, r13
mov edi, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
sub edi, 1
cmp edi, 0x102
ja 0x1400bd826
mov rcx, rsi
call sub.msvcrt.dll_wcslen
mov rcx, rbx
lea edi, [rax + rax*2]
movsxd rdi, edi
mov rdx, rdi
call fcn.14007da40
mov rcx, rsi
call fcn.1400b8820
mov rcx, qword [rbx + 0x10]
mov r8, rdi
mov rdx, rax
call fcn.1400bb580
test eax, eax
js 0x1400bd826
cdqe
mov qword [rbx + 8], rax
test r12, r12
je 0x1400bd7d2
test rax, rax
je 0x1400bd7b4
mov rdx, qword [rbx + 0x10]
cmp byte [rdx + rax - 1], 0x2f
je 0x1400bd7b4
mov rcx, qword [rbx]
test rcx, rcx
jne 0x1400bd880
mov edx, 1
mov rcx, rbx
call fcn.14007da40
mov rdx, qword [rbx + 0x10]
mov rax, qword [rbx + 8]
lea rcx, [rax + 1]
mov qword [rbx + 8], rcx
mov byte [rdx + rax], 0x2f
mov rdx, qword [rbx + 0x10]
mov rax, qword [rbx + 8]
mov byte [rdx + rax], 0
mov rcx, r12
call sub.msvcrt.dll_strlen
mov rcx, rbx
mov rdx, r12
mov r8, rax
call fcn.14007e800
mov rcx, r12
call fcn.1400d2670
mov rax, qword [rbx + 0x10]
mov rdx, qword [rsp + 0x248]
sub rdx, qword [rbp]
jne 0x1400bd939
add rsp, 0x250
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rbx, qword [sym.imp.msvcrt.dll__errno]
call rbx
cmp dword [rax], 0x22
je 0x1400bd838
xor eax, eax
jmp 0x1400bd7d6
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x1400bd848
xor r12d, r12d
mov rcx, r12
call fcn.1400d2670
xor eax, eax
jmp 0x1400bd7d6
call rbx
mov dword [rax], 0x26
xor eax, eax
jmp 0x1400bd7d6
mov rcx, rsi
call sub.msvcrt.dll_wcslen
lea r13, [rsi + rax*2]
jmp 0x1400bd875
movzx eax, word [r13 - 2]
sub r13, 2
cmp ax, 0x5c
je 0x1400bd898
cmp ax, 0x2f
je 0x1400bd898
cmp r13, rsi
jne 0x1400bd860
jmp 0x1400bd823
sub rcx, rax
cmp rcx, 1
jne 0x1400bd79c
jmp 0x1400bd787
cmp r13, rsi
je 0x1400bd823
movzx eax, byte [rdi]
test al, al
je 0x1400bd823
xor ecx, ecx
jmp 0x1400bd8c1
cmp edx, 0x2f
je 0x1400bd8c8
movzx eax, byte [rdi + 1]
add rdi, 1
test al, al
je 0x1400bd8d0
movsx edx, al
cmp al, 0x5c
jne 0x1400bd8b0
mov rcx, rdi
jmp 0x1400bd8b5
test rcx, rcx
je 0x1400bd823
add rcx, 1
call fcn.1400a5f80
cmp word [r13 - 2], 0x3a
mov r12, rax
je 0x1400bd930
xor eax, eax
mov word [r13], ax
mov dword [rsp + 0x28], 0x2000000
xor r9d, r9d
xor edx, edx
mov rcx, rsi
mov qword [rsp + 0x30], 0
mov r8d, 7
mov dword [rsp + 0x20], 3
call r14
mov r13, rax
cmp rax, 0xffffffffffffffff
jne 0x1400bd6f9
jmp 0x1400bd826
xor edx, edx
mov word [r13 + 2], dx
jmp 0x1400bd8f4
call fcn.1401be670
nop
nop