Function at 0x1401e7e00
Capabilities:
Get common file path
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0xa60
mov rax, qword [0x140415a10]
xor rax, rsp
mov qword [rsp + 0xa50], rax
lea rdx, [0x14034f2fc]
mov r8d, 1
mov rdi, rcx
call fcn.1401ff2c0
mov r8d, 1
mov rcx, rdi
test al, al
je 0x1401e7e6a
lea rdx, [0x14034f2fc]
call fcn.1401fd400
test eax, eax
jle 0x1401e7e8a
mov r8d, dword [rdi + 0xc]
mov edx, eax
mov rcx, rdi
sub r8d, eax
call fcn.1401fdf50
mov r8d, 1
jmp 0x1401e7e80
lea rdx, [0x140353dd0]
call fcn.1401ff2c0
test al, al
je 0x1401e7e8a
mov r8d, 4
xor edx, edx
mov rcx, rdi
call fcn.1401fdf50
lea rdx, str.system32_
xor r8d, r8d
mov rcx, rdi
call fcn.1401ff2c0
or rbx, 0xffffffffffffffff
test al, al
je 0x1401e7edc
lea rcx, [rsp + 0x40]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1401e7fb1
lea r8d, [rbx + 9]
xor edx, edx
mov rcx, rdi
call fcn.1401fdf50
lea r8, [rsp + 0x40]
mov rcx, rdi
call fcn.1401fda10
jmp 0x1401e7fb1
lea rdx, str.SystemRoot_
xor r8d, r8d
mov rcx, rdi
call fcn.1401ff2c0
test al, al
je 0x1401e7f2a
lea rcx, [rsp + 0x40]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x1401e7fb1
xor edx, edx
mov rcx, rdi
lea r8d, [rdx + 0xb]
call fcn.1401fdf50
lea r8, [rsp + 0x40]
mov rcx, rdi
call fcn.1401fda10
jmp 0x1401e7fb1
xor edx, edx
mov rcx, rdi
call fcn.1401fb010
cmp ax, 0x25
jne 0x1401e7fb1
mov rcx, qword [rdi]
lea rdx, [rsp + 0x250]
mov r8d, 0x400
mov qword [rsp + 0xa78], rsi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rax, [rsp + 0x250]
mov rsi, rbx
inc rsi
cmp word [rax + rsi*2], 0
jne 0x1401e7f64
test esi, esi
jle 0x1401e7f99
mov edx, esi
mov rcx, rdi
call fcn.1401fcb40
mov eax, dword [rdi + 8]
mov rcx, qword [rdi]
inc eax
lea r8, [rsp + 0x250]
movsxd r9, esi
movsxd rdx, eax
call fcn.1402ba94c
jmp 0x1401e7f9f
cmp dword [rdi + 0xc], 0
jle 0x1401e7fa9
mov edx, esi
mov rcx, rdi
call fcn.1401fde50
mov rsi, qword [rsp + 0xa78]
mov rcx, qword [rdi]
mov edx, 0x5c
call fcn.1402ba4e4
test rax, rax
jne 0x1401e8075
mov rdx, qword [rdi]
lea rax, [rsp + 0x30]
mov r9d, 0x400
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x250]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
jne 0x1401e8037
lea rcx, [rsp + 0x250]
mov edx, 0x400
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea r8, [0x140345f98]
lea rcx, [rsp + 0x250]
mov edx, 0x400
call fcn.1402b9308
mov r8, qword [rdi]
lea rcx, [rsp + 0x250]
mov edx, 0x400
call fcn.1402b9308
lea rax, [rsp + 0x250]
nop
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401e8040
test ebx, ebx
jle 0x1401e80bd
mov edx, ebx
mov rcx, rdi
call fcn.1401fcb40
mov eax, dword [rdi + 8]
mov rcx, qword [rdi]
inc eax
lea r8, [rsp + 0x250]
movsxd r9, ebx
movsxd rdx, eax
call fcn.1402ba94c
jmp 0x1401e80c3
lea rdx, [0x14035ec70]
mov r8d, 1
mov rcx, rdi
call fcn.1401fc8b0
test al, al
je 0x1401e80cd
mov rcx, qword [rdi]
lea rdx, [rsp + 0x250]
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
je 0x1401e80cd
lea rax, [rsp + 0x250]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401e80b1
jmp 0x1401e804a
cmp dword [rdi + 0xc], 0
jle 0x1401e80cd
mov edx, ebx
mov rcx, rdi
call fcn.1401fde50
mov rcx, qword [rsp + 0xa50]
xor rcx, rsp
call fcn.1402b6d40
mov rbx, qword [rsp + 0xa80]
add rsp, 0xa60
pop rdi
ret