Function at 0x1401f1870
Capabilities:
Get common file path
Query environment variable

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x9b8]
sub rsp, 0xaa0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x140418a10]
xor rax, rsp
mov qword [rbp + 0x990], rax
mov rbx, rcx
mov r8d, 1
lea rdx, [0x1403512cc]
call fcn.1402019e0
test al, al
je 0x1401f18f8
mov r8d, 1
lea rdx, [0x1403512cc]
mov rcx, rbx
call fcn.1401ffb20
test eax, eax
jle 0x1401f18f8
mov r8d, dword [rbx + 0xc]
sub r8d, eax
mov edx, eax
mov rcx, rbx
call fcn.140200670
xor edx, edx
lea r8d, [rdx + 1]
mov rcx, rbx
call fcn.140200670
xor r8d, r8d
lea rdx, str._globalroot
mov rcx, rbx
call fcn.1402019e0
mov rcx, rbx
test al, al
je 0x1401f191c
xor edx, edx
lea r8d, [rdx + 0xe]
jmp 0x1401f19df
mov r8d, 1
lea rdx, [0x140355e60]
call fcn.1402019e0
test al, al
je 0x1401f193d
xor edx, edx
lea r8d, [rdx + 4]
jmp 0x1401f19dc
cmp dword [rbx + 0xc], 0
jle 0x1401f19e8
xor edx, edx
mov rcx, rbx
call fcn.1401fd730
cmp ax, 0x25
jne 0x1401f197c
mov r8d, 0x400
lea rdx, [rbp + 0x190]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rdx, [rbp + 0x190]
mov rcx, rbx
call fcn.1401fd6c0
mov rcx, rbx
call fcn.1400d3070
test al, al
jne 0x1401f19a2
mov edx, 0x20
mov rcx, qword [rbx]
call fcn.1402bcdb4
test rax, rax
je 0x1401f19e4
sub rax, qword [rbx]
sar rax, 1
jmp 0x1401f19cf
lea rdx, [0x140365920]
mov rcx, rbx
call fcn.1401ffa00
mov rcx, rbx
test eax, eax
jle 0x1401f19c3
mov r8d, dword [rbx + 0xc]
sub r8d, eax
mov edx, eax
jmp 0x1401f19df
lea rdx, [0x1403691fc]
call fcn.1401ffa00
test eax, eax
jle 0x1401f19e4
mov r8d, dword [rbx + 0xc]
mov edx, eax
sub r8d, eax
mov rcx, rbx
call fcn.140200670
cmp dword [rbx + 0xc], 0
je 0x1401f1c25
xor r8d, r8d
lea rdx, str.system32_
mov rcx, rbx
call fcn.1402019e0
test al, al
je 0x1401f1a1a
mov edx, 0x104
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1401f1a93
jmp 0x1401f1a76
xor r8d, r8d
lea rdx, str.SystemRoot_
mov rcx, rbx
call fcn.1402019e0
test al, al
je 0x1401f1a4c
mov edx, 0x104
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x1401f1a93
mov r8d, 0xb
jmp 0x1401f1a7c
xor r8d, r8d
lea rdx, str.SysWOW64
mov rcx, rbx
call fcn.1402019e0
test al, al
je 0x1401f1a93
mov edx, 0x104
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
test eax, eax
jle 0x1401f1a93
mov r8d, 8
xor edx, edx
mov rcx, rbx
call fcn.140200670
lea r8, [rsp + 0x40]
mov rcx, rbx
call fcn.140200130
or rdi, 0xffffffffffffffff
cmp dword [rbx + 0xc], 0
je 0x1401f1ba7
lea edx, [rdi + 0x5d]
mov rcx, qword [rbx]
call fcn.1402bcbec
mov rsi, rax
test rax, rax
je 0x1401f1ba7
mov rcx, qword [rbx]
sub rsi, rcx
sar rsi, 1
test esi, esi
jle 0x1401f1ba7
cmp dword [rbx + 0xc], 0
jne 0x1401f1ad3
mov eax, edi
jmp 0x1401f1aec
mov edx, 0x2e
call fcn.1402bcbec
test rax, rax
jne 0x1401f1ae6
mov eax, edi
jmp 0x1401f1aec
sub rax, qword [rbx]
sar rax, 1
cmp eax, esi
jge 0x1401f1ba7
xor eax, eax
mov qword [rsp + 0x28], rax
mov edx, dword [rbx + 0xc]
test edx, edx
jne 0x1401f1b10
lea rax, [0x140348ca0]
mov qword [rsp + 0x20], rax
jmp 0x1401f1b34
lea rcx, [rsp + 0x20]
call fcn.1401ff260
movsxd r9, dword [rbx + 0xc]
mov eax, dword [rsp + 0x28]
inc eax
movsxd rdx, eax
mov r8, qword [rbx]
mov rcx, qword [rsp + 0x20]
call fcn.1402bd21c
mov edx, dword [rbx + 0xc]
lea rcx, [rsp + 0x20]
call fcn.140200570
nop
lea rdx, [0x1403572b0]
lea rcx, [rsp + 0x20]
call fcn.1401fd8b0
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x1401f1b96
inc esi
mov r8d, dword [rbx + 0xc]
sub r8d, esi
mov edx, esi
mov rcx, rbx
call fcn.140200670
lea rdx, [rsp + 0x6c]
mov rcx, rbx
call fcn.1401fd8b0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
cmp dword [rsp + 0x28], 0
jle 0x1401f1ba7
mov rcx, qword [rsp + 0x20]
call fcn.1402b9c20
mov r8d, 1
lea rdx, [0x140360f58]
mov rcx, rbx
call fcn.1401fefd0
test al, al
je 0x1401f1c25
mov r8d, 0x400
lea rdx, [rbp + 0x190]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
je 0x1401f1c25
lea rax, [rbp + 0x190]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x1401f1be1
test edi, edi
jle 0x1401f1c15
mov edx, edi
mov rcx, rbx
call fcn.1401ff260
movsxd r9, edi
mov eax, dword [rbx + 8]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x190]
mov rcx, qword [rbx]
call fcn.1402bd21c
jmp 0x1401f1c1b
cmp dword [rbx + 0xc], 0
jle 0x1401f1c25
mov edx, edi
mov rcx, rbx
call fcn.140200570
mov rcx, qword [rbp + 0x990]
xor rcx, rsp
call fcn.1402b9610
lea r11, [rsp + 0xaa0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret