Function at 0x1400067c8
Capabilities:
Get common file path
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x30
mov bpl, dl
mov rdi, rcx
mov rdx, rcx
mov esi, 0x1770
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
xor r12d, r12d
cmp eax, r12d
jbe 0x140006816
mov r8b, 1
mov rcx, rdi
mov dl, r8b
call fcn.140006104
cmp al, r12b
jne 0x140006ad9
lea rcx, str.USERPROFILE
mov r8d, esi
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp eax, r12d
jbe 0x140006858
lea rdx, str.AppDataLocalTemp
mov rcx, rdi
call fcn.140017230
cmp rax, r12
je 0x140006858
mov r8b, 1
xor edx, edx
mov rcx, rdi
call fcn.140006104
cmp al, r12b
jne 0x140006ad9
lea rcx, str.HOMEDRIVE
mov r8d, esi
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp eax, r12d
jbe 0x1400068b3
mov rcx, rdi
call fcn.140016b78
mov ebx, esi
mov rcx, rdi
sub ebx, eax
call fcn.140016b78
lea rcx, str.HOMEPATH
lea rdx, [rdi + rax*2]
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp eax, r12d
jbe 0x1400068b3
mov r8b, 1
xor edx, edx
mov rcx, rdi
call fcn.140006104
cmp al, r12b
jne 0x140006ad9
call fcn.140005b1c
mov rax, qword [0x140044238]
cmp rax, r12
je 0x140006926
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 0x23]
mov qword [rsp + 0x20], rdi
call rax
cmp eax, r12d
jne 0x140006926
mov rcx, rdi
call fcn.140016b78
cmp rax, r12
jbe 0x140006926
lea rdx, [0x1400338d8]
mov rcx, rdi
call fcn.140017230
mov rcx, rdi
call fcn.140018644
lea rdx, [0x1400338c8]
mov rcx, rdi
call fcn.140017230
mov r8b, 1
mov rcx, rdi
mov dl, r8b
call fcn.140006104
cmp al, r12b
jne 0x140006ad9
mov edx, esi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
cmp eax, r12d
jbe 0x140006960
lea rdx, [0x1400338c8]
mov rcx, rdi
call fcn.140017230
cmp rax, r12
je 0x140006960
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call fcn.140006104
cmp al, r12b
jne 0x140006ad9
lea rdx, str.c:_temp
mov rcx, rdi
call fcn.14001725c
cmp rax, r12
je 0x14000698a
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call fcn.140006104
cmp al, r12b
jne 0x140006ad9
lea rdx, str.c:_tmp
mov rcx, rdi
call fcn.14001725c
cmp rax, r12
je 0x1400069b4
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call fcn.140006104
cmp al, r12b
jne 0x140006ad9
mov edx, esi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
cmp eax, r12d
jbe 0x1400069da
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call fcn.140006104
cmp al, r12b
jne 0x140006ad9
lea rdx, str.c:_tmp
mov rcx, rdi
call fcn.14001725c
cmp rax, r12
je 0x140006a04
xor r8d, r8d
mov dl, 1
mov rcx, rdi
call fcn.140006104
cmp al, r12b
jne 0x140006ad9
mov rdx, rdi
mov ecx, esi
mov byte [0x14004b772], 1
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, r12d
jbe 0x140006a31
xor r8d, r8d
mov dl, 1
mov rcx, rdi
call fcn.140006104
cmp al, r12b
jne 0x140006ad9
lea rcx, str.USERPROFILE
mov r8d, esi
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp eax, r12d
jbe 0x140006a6f
lea rdx, str.AppDataLocalTemp
mov rcx, rdi
call fcn.140017230
cmp rax, r12
je 0x140006a6f
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call fcn.140006104
cmp al, r12b
jne 0x140006ad9
lea rcx, str.HOMEDRIVE
mov r8d, esi
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp eax, r12d
jbe 0x140006ac4
mov rcx, rdi
call fcn.140016b78
mov rcx, rdi
sub esi, eax
call fcn.140016b78
lea rcx, str.HOMEPATH
lea rdx, [rdi + rax*2]
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp eax, r12d
jbe 0x140006ac4
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call fcn.140006104
cmp al, r12b
jne 0x140006ad9
mov word [rdi], r12w
cmp bpl, r12b
je 0x140006ad9
xor edx, edx
mov ecx, 0x3f7
call fcn.140004f54
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret