Function at 0x1400049e0
Capabilities:
Get common file path
Get disk information
Get process image filename
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0xa80
mov rax, qword [0x14010a0c0]
xor rax, rsp
mov qword [rsp + 0xa70], rax
mov ebp, edx
mov r14, rcx
lea rdx, str.WindowsGlobalizationSortingSortDefault.nls
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x140004d5c
mov ebx, 0x82
lea rax, [rsp + 0x20]
mov r8, r14
lea rcx, [rsp + 0x20]
mov edx, ebx
sub r8, rax
nop word [rax + rax]
lea rax, [rdx + 0x7fffff7c]
test rax, rax
je 0x140004a63
movzx eax, word [r8 + rcx]
test ax, ax
je 0x140004a63
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140004a40
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
xor r15d, r15d
lea rcx, [rsp + 0x20]
mov word [rax], r15w
call fcn.140004770
mov rcx, rbx
lea rax, [rsp + 0x20]
cmp word [rax], r15w
je 0x140004a97
add rax, 2
sub rcx, 1
jne 0x140004a87
test rcx, rcx
je 0x140004aae
mov rsi, rbx
sub rsi, rcx
add rsi, rsi
test rcx, rcx
cmove rsi, r15
jmp 0x140004ab1
mov rsi, r15
cmp ebp, 0xffffffff
jne 0x140004aeb
test r14, r14
je 0x140004ae8
mov rcx, rbx
mov rax, r14
cmp word [rax], r15w
je 0x140004ad1
add rax, 2
sub rcx, 1
jne 0x140004ac1
test rcx, rcx
je 0x140004ae8
mov rbp, rbx
sub rbp, rcx
add rbp, rbp
test rcx, rcx
cmove rbp, r15
jmp 0x140004aeb
mov rbp, r15
mov edx, 0x104
lea rcx, [rsp + 0x440]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8d, 0x104
lea rdx, [rsp + 0x650]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32GetProcessImageFileNameW]
lea rcx, [rsp + 0x650]
call fcn.140004770
mov r8d, 0x104
lea rdx, [rsp + 0x860]
lea rcx, str.SystemDrive
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x140004d42
mov r8d, 0x104
lea rdx, [rsp + 0x230]
lea rcx, [rsp + 0x860]
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x140004d42
mov rcx, rbx
lea rax, [rsp + 0x230]
nop word [rax + rax]
cmp word [rax], r15w
je 0x140004b90
add rax, 2
sub rcx, 1
jne 0x140004b80
mov rax, rbx
mov edi, 0x7ffffffe
sub rax, rcx
test rcx, rcx
cmove rax, r15
je 0x140004bf4
mov rdx, rbx
lea rcx, [rsp + 0x230]
lea rcx, [rcx + rax*2]
sub rdx, rax
je 0x140004be5
lea r9, str.WindowsSystem32_
mov eax, edi
sub r9, rcx
test rax, rax
je 0x140004be5
movzx r8d, word [rcx + r9]
test r8w, r8w
je 0x140004be5
mov word [rcx], r8w
dec rax
add rcx, 2
sub rdx, 1
jne 0x140004bc4
test rdx, rdx
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], r15w
mov rcx, rbx
lea rax, [rsp + 0x230]
nop
cmp word [rax], r15w
je 0x140004c10
add rax, 2
sub rcx, 1
jne 0x140004c00
test rcx, rcx
je 0x140004c27
mov r8, rbx
sub r8, rcx
add r8, r8
test rcx, rcx
cmove r8, r15
jmp 0x140004c2a
mov r8, r15
mov eax, ebp
lea rcx, [rsp + 0x230]
cmp r8, rax
mov rdx, r14
cmovae r8, rax
shr r8, 1
call qword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
je 0x140004d5c
mov rcx, rbx
lea rax, [rsp + 0x440]
nop word [rax + rax]
cmp word [rax], r15w
je 0x140004c70
add rax, 2
sub rcx, 1
jne 0x140004c60
mov rax, rbx
sub rax, rcx
test rcx, rcx
cmove rax, r15
je 0x140004cce
mov rdx, rbx
lea rcx, [rsp + 0x440]
lea rcx, [rcx + rax*2]
sub rdx, rax
je 0x140004cbf
lea r8, [0x1400ea1a0]
sub r8, rcx
nop dword [rax]
test rdi, rdi
je 0x140004cbf
movzx eax, word [rcx + r8]
test ax, ax
je 0x140004cbf
mov word [rcx], ax
dec rdi
add rcx, 2
sub rdx, 1
jne 0x140004ca0
test rdx, rdx
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], r15w
mov rcx, rbx
lea rax, [rsp + 0x440]
nop dword [rax]
cmp word [rax], r15w
je 0x140004cf0
add rax, 2
sub rcx, 1
jne 0x140004ce0
test rcx, rcx
je 0x140004d04
sub rbx, rcx
add rbx, rbx
test rcx, rcx
cmove rbx, r15
jmp 0x140004d07
mov rbx, r15
cmp rbx, rsi
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x440]
cmovb rsi, rbx
shr rsi, 1
mov r8d, esi
call qword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
je 0x140004d5c
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x650]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x140004d5c
lea rdx, str.miniz.dll
lea rcx, [rsp + 0x20]
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
sete al
jmp 0x140004d5e
xor al, al
mov rcx, qword [rsp + 0xa70]
xor rcx, rsp
call fcn.1400d3a80
mov rbx, qword [rsp + 0xac0]
add rsp, 0xa80
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret