Function at 0x14003ced0
Capabilities:
Get common file path
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x18], r8
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xf70]
mov eax, 0x1070
call fcn.140247340
sub rsp, rax
mov r12, r8
mov r13d, r9d
mov rbx, rdx
mov r8d, r9d
mov rsi, rcx
xor edx, edx
mov rcx, r12
call fcn.140249b10
lea rax, [0x14028d140]
mov dword [rsp + 0x38], 0x1d
mov qword [rsp + 0x40], rax
lea rdi, [0x14028d128]
lea rax, [0x14028d150]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x50], rax
xor r14d, r14d
lea rax, [0x14028d160]
mov dword [rsp + 0x48], 0x1a
mov qword [rsp + 0x60], rax
lea rax, [0x14028d178]
mov qword [rsp + 0x70], rax
lea rax, [0x14028d190]
mov qword [rbp - 0x80], rax
lea rax, [0x14028d1b0]
mov qword [rbp - 0x70], rax
lea rax, [0x14028d1c8]
mov qword [rbp - 0x60], rax
lea rax, [0x14028d1e0]
mov qword [rbp - 0x50], rax
lea rax, [0x14028d1f8]
mov qword [rbp - 0x40], rax
lea rax, [0x14028d210]
mov qword [rbp - 0x30], rax
lea rax, [0x14028d228]
mov qword [rbp - 0x20], rax
lea rax, [0x14028d240]
mov qword [rbp - 0x10], rax
lea rax, [0x14028d250]
mov qword [rbp], rax
lea rax, [0x14028d260]
mov qword [rbp + 0x10], rax
lea rax, [0x14028d270]
mov qword [rbp + 0x20], rax
lea rax, [0x14028d288]
mov qword [rbp + 0x30], rax
lea rax, [0x14028d298]
mov qword [rbp + 0x40], rax
lea rax, [0x14028d2a8]
mov qword [rbp + 0x50], rax
lea rax, [0x14028d2b8]
mov qword [rbp + 0x60], rax
lea rax, [0x14028d2c8]
mov qword [rbp + 0x70], rax
lea rax, [0x14028d2d8]
mov qword [rbp + 0x80], rax
lea rax, [0x14028d2f0]
mov qword [rbp + 0x90], rax
lea rax, [0x14028d308]
mov qword [rbp + 0xa0], rax
mov dword [rsp + 0x58], 0xa
mov dword [rsp + 0x68], 0x1e
mov dword [rsp + 0x78], 0x23
mov dword [rbp - 0x78], 0x19
mov dword [rbp - 0x68], PathResolve
mov dword [rbp - 0x58], 0x1f
mov dword [rbp - 0x48], reloc.OLEAUT32.dll_SafeArrayUnaccessData
mov dword [rbp - 0x38], reloc.WSOCK32.dll_shutdown
mov dword [rbp - 0x28], reloc.OLEAUT32.dll_SafeArrayGetElement
mov dword [rbp - 0x18], PathResolve
mov dword [rbp - 8], 3
mov dword [rbp + 8], 0x21
mov dword [rbp + 0x18], r14d
mov dword [rbp + 0x28], reloc.OLEAUT32.dll_SafeArrayGetDim
mov dword [rbp + 0x38], reloc.COMCTL32.dll_InitCommonControls
mov dword [rbp + 0x48], 6
mov dword [rbp + 0x58], SafeArrayUnaccessData
mov dword [rbp + 0x68], 0x22
mov dword [rbp + 0x78], 1
mov dword [rbp + 0x88], 0x20
mov dword [rbp + 0x98], 0x1c
mov dword [rbp + 0xa8], 5
lea rax, [0x14028d318]
mov dword [rbp + 0xb8], 0x26
mov qword [rbp + 0xb0], rax
lea rcx, [rbp + 0x340]
lea rax, [0x14028d330]
mov dword [rbp + 0xc8], PathResolve
mov qword [rbp + 0xc0], rax
xor edx, edx
lea rax, [0x14028d348]
mov dword [rbp + 0xd8], PathResolve
mov qword [rbp + 0xd0], rax
mov r8d, 0x410
lea rax, [0x14028d368]
mov dword [rbp + 0xe8], PathResolve
mov qword [rbp + 0xe0], rax
lea rax, [0x14028d388]
mov qword [rbp + 0xf0], rax
lea rax, [0x14028d398]
mov qword [rbp + 0x100], rax
lea rax, [0x14028d3a8]
mov qword [rbp + 0x110], rax
lea rax, [0x14028d3b8]
mov qword [rbp + 0x120], rax
lea rax, [0x14028d3c8]
mov qword [rbp + 0x130], rax
lea rax, [0x14028d3d8]
mov qword [rbp + 0x140], rax
lea rax, [0x14028d3e8]
mov qword [rbp + 0x150], rax
lea rax, [0x14028d3f8]
mov qword [rbp + 0x160], rax
lea rax, [0x14028d408]
mov qword [rbp + 0x170], rax
lea rax, [0x14028d418]
mov qword [rbp + 0x180], rax
mov dword [rbp + 0xf8], 2
mov dword [rbp + 0x108], 8
mov dword [rbp + 0x118], 9
mov dword [rbp + 0x128], SafeArrayGetDim
mov dword [rbp + 0x138], 7
mov dword [rbp + 0x148], 0x25
mov dword [rbp + 0x158], 0x29
mov dword [rbp + 0x168], SafeArrayUnaccessData
mov dword [rbp + 0x178], 0x24
mov dword [rbp + 0x188], 0x28
mov qword [rbp + 0x190], r14
mov dword [rbp + 0x198], r14d
call fcn.140249b10
lea rdx, [0x14028d428]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrStrIA]
mov r15, rax
test rax, rax
je 0x14003d3aa
xor edx, edx
lea rcx, [rbp + 0xb60]
mov r8d, 0x410
call fcn.140249b10
mov r8, r15
lea rcx, [rbp + 0x340]
sub r8, rbx
mov rdx, rbx
call fcn.1402496a0
lea rdx, [0x14028d430]
lea rcx, [r15 + 1]
call qword [sym.imp.SHLWAPI.dll_StrStrIA]
mov r8, rax
lea rdx, [r15 + 1]
sub r8, r15
lea rcx, [rbp + 0xb60]
dec r8
mov r12, rax
call fcn.1402496a0
mov ebx, r14d
nop
mov rdx, rdi
lea rcx, [rbp + 0xb60]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x14003d2f5
inc ebx
mov eax, ebx
add rax, rax
mov rdi, qword [rsp + rax*8 + 0x30]
test rdi, rdi
jne 0x14003d2d0
mov eax, ebx
add rax, rax
mov ebx, dword [rsp + rax*8 + 0x38]
test ebx, ebx
je 0x14003d6d3
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x410
call fcn.140249b10
lea rax, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, ebx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jne 0x14003d6d3
lea rcx, [rbp + 0x340]
dec rcx
cmp byte [rcx + 1], r14b
lea rcx, [rcx + 1]
jne 0x14003d344
lea r8, [rsp + 0x30]
xor edx, edx
nop word [rax + rax]
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x14003d360
lea rcx, [rbp + 0x340]
dec rcx
nop word [rax + rax]
cmp byte [rcx + 1], r14b
lea rcx, [rcx + 1]
jne 0x14003d380
xor edx, edx
nop dword [rax]
movzx eax, byte [r12 + rdx + 1]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x14003d390
mov r12, qword [rbp + 0xfb0]
jmp 0x14003d3ce
lea rcx, [rbp + 0x340]
sub rcx, rbx
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rbx]
mov byte [rcx + rbx], al
lea rbx, [rbx + 1]
test al, al
jne 0x14003d3c0
xor edx, edx
lea rcx, [rbp + 0x750]
mov r8d, 0x410
call fcn.140249b10
lea rdx, [0x14028d438]
lea rcx, [rbp + 0x340]
call qword [sym.imp.SHLWAPI.dll_StrStrIA]
test rax, rax
je 0x14003d6e0
lea rdx, [0x14028d438]
mov r15, r14
lea rcx, [rbp + 0x340]
lea rbx, [rbp + 0x340]
call qword [sym.imp.SHLWAPI.dll_StrStrIA]
mov rdi, rax
test rax, rax
je 0x14003d6a0
nop dword [rax]
xor edx, edx
lea rcx, [rbp + 0xb60]
mov r8d, 0x410
call fcn.140249b10
mov r8, rdi
lea rcx, [rbp + 0x750]
sub r8, rbx
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], r14b
jne 0x14003d460
lea rcx, [rbp + 0x750]
mov rdx, rbx
add rcx, rax
call fcn.1402496a0
lea rdx, [0x14028d430]
lea rcx, [rdi + 1]
call qword [sym.imp.SHLWAPI.dll_StrStrIA]
mov r8, rax
lea rdx, [rdi + 1]
sub r8, rdi
lea rcx, [rbp + 0xb60]
dec r8
mov r15, rax
call fcn.1402496a0
lea rdx, [0x14028d448]
lea rcx, [rbp + 0xb60]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x14003d585
cmp dword [rsi + 0x18], r14d
jne 0x14003d553
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x410
call fcn.140249b10
xor r9d, r9d
lea rax, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea edx, [r9 + 0x1a]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea rbx, [rsp + 0x30]
mov edi, 3
test rbx, rbx
je 0x14003d525
lea rdx, [0x140287e84]
mov rcx, rbx
call fcn.140248db4
mov rbx, rax
test rax, rax
je 0x14003d525
inc rbx
sub rdi, 1
jne 0x14003d506
test rbx, rbx
je 0x14003d553
lea rdx, [0x140287e84]
mov rcx, rbx
call fcn.140248db4
test rax, rax
je 0x14003d547
mov byte [rax], r14b
lea rcx, [rsi + 8]
mov rdx, rbx
call fcn.140004820
lea rcx, [rbp + 0x750]
dec rcx
nop dword [rax]
cmp byte [rcx + 1], r14b
lea rcx, [rcx + 1]
jne 0x14003d560
mov r8, qword [rsi + 0x10]
xor edx, edx
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x14003d570
jmp 0x14003d680
lea rdx, [0x14028d468]
lea rcx, [rbp + 0xb60]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x14003d6d3
cmp dword [rsi + 0x30], r14d
jne 0x14003d656
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x410
call fcn.140249b10
xor r9d, r9d
lea rax, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea edx, [r9 + 0x1a]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea rdx, [0x140287e84]
lea rcx, [rsp + 0x30]
call fcn.140248db4
test rax, rax
je 0x14003d656
lea rcx, [rax + 1]
lea rdx, [0x140287e84]
call fcn.140248db4
test rax, rax
je 0x14003d656
mov byte [rax], r14b
mov rcx, qword [rsi + 0x28]
test rcx, rcx
je 0x14003d619
call fcn.140247060
mov qword [rsi + 0x28], r14
lea rcx, [rsp + 0x30]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], r14b
jne 0x14003d625
lea ecx, [rax + 1]
mov dword [rsi + 0x30], eax
call fcn.140247068
mov qword [rsi + 0x28], rax
test rax, rax
je 0x14003d656
mov r8d, dword [rsi + 0x30]
lea rdx, [rsp + 0x30]
inc r8d
mov rcx, rax
call fcn.1402496a0
lea rcx, [rbp + 0x750]
dec rcx
cmp byte [rcx + 1], r14b
lea rcx, [rcx + 1]
jne 0x14003d660
mov r8, qword [rsi + 0x28]
xor edx, edx
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x14003d670
lea rbx, [r15 + 1]
mov rcx, rbx
lea rdx, [0x14028d438]
call qword [sym.imp.SHLWAPI.dll_StrStrIA]
mov rdi, rax
test rax, rax
jne 0x14003d430
lea rcx, [rbp + 0x750]
dec rcx
nop word [rax + rax]
cmp byte [rcx + 1], r14b
lea rcx, [rcx + 1]
jne 0x14003d6b0
xor edx, edx
nop dword [rax]
movzx eax, byte [r15 + rdx + 1]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x14003d6c0
jmp 0x14003d6f9
mov eax, 0xffffffff
jmp 0x14003d70c
movzx eax, byte [rbp + r14 + 0x340]
mov byte [rbp + r14 + 0x750], al
lea r14, [r14 + 1]
test al, al
jne 0x14003d6e0
mov r8d, r13d
lea rcx, [rbp + 0x750]
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea r11, [rsp + 0x1070]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret