Function at 0x140005dcc
Capabilities:
Get common file path
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rdx, rcx
mov esi, 0x1770
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x140005e08
mov r8b, 1
mov rcx, rdi
mov dl, r8b
call fcn.140005c7c
test al, al
jne 0x14000603c
lea rcx, [0x1400305c0]
mov r8d, esi
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x140005e48
lea rdx, [0x1400305a8]
mov rcx, rdi
call fcn.1400140f0
test rax, rax
je 0x140005e48
mov r8b, 1
xor edx, edx
mov rcx, rdi
call fcn.140005c7c
test al, al
jne 0x14000603c
lea rcx, [0x140030598]
mov r8d, esi
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x140005ea0
mov rcx, rdi
call fcn.140013bc0
mov ebx, esi
mov rcx, rdi
sub ebx, eax
call fcn.140013bc0
lea rcx, [0x140030588]
lea rdx, [rdi + rax]
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x140005ea0
mov r8b, 1
xor edx, edx
mov rcx, rdi
call fcn.140005c7c
test al, al
jne 0x14000603c
mov edx, esi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x140005ed8
lea rdx, [0x140030580]
mov rcx, rdi
call fcn.1400140f0
test rax, rax
je 0x140005ed8
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call fcn.140005c7c
test al, al
jne 0x14000603c
lea rdx, [0x140030578]
mov rcx, rdi
call fcn.140014190
test rax, rax
je 0x140005f01
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call fcn.140005c7c
test al, al
jne 0x14000603c
lea rdx, [0x14003056c]
mov rcx, rdi
call fcn.140014190
test rax, rax
je 0x140005f2a
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call fcn.140005c7c
test al, al
jne 0x14000603c
mov edx, esi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x140005f4e
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call fcn.140005c7c
test al, al
jne 0x14000603c
lea rdx, [0x14003056c]
mov rcx, rdi
call fcn.140014190
test rax, rax
je 0x140005f77
xor r8d, r8d
mov dl, 1
mov rcx, rdi
call fcn.140005c7c
test al, al
jne 0x14000603c
mov rdx, rdi
mov ecx, esi
mov byte [0x140048ed2], 1
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x140005fa2
xor r8d, r8d
mov dl, 1
mov rcx, rdi
call fcn.140005c7c
test al, al
jne 0x14000603c
lea rcx, [0x1400305c0]
mov r8d, esi
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x140005fde
lea rdx, [0x1400305a8]
mov rcx, rdi
call fcn.1400140f0
test rax, rax
je 0x140005fde
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call fcn.140005c7c
test al, al
jne 0x14000603c
lea rcx, [0x140030598]
mov r8d, esi
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x140006030
mov rcx, rdi
call fcn.140013bc0
mov rcx, rdi
sub esi, eax
call fcn.140013bc0
lea rcx, [0x140030588]
lea rdx, [rdi + rax]
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x140006030
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call fcn.140005c7c
test al, al
jne 0x14000603c
xor edx, edx
mov ecx, 0x3f7
call fcn.140004efc
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret