Function at 0x1400ac5b0
Capabilities:
Get common file path
Link many functions at runtime
Query environment variable
Query or enumerate registry value
Set environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x260
mov rax, qword [0x1401737a8]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov edx, 1
lea rcx, str.shcore.dll
call fcn.140035800
mov rcx, rax
lea rdx, str.GetProcessDpiAwareness
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, 1
lea rcx, str.iphlpapi.dll
mov qword [0x1401a08a8], rax
call fcn.140035800
mov rcx, rax
lea rdx, str.AllocateAndGetTcpExTable2FromStack
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, 1
lea rcx, str.iphlpapi.dll
mov qword [0x140194160], rax
call fcn.140035800
mov rcx, rax
lea rdx, str.AllocateAndGetUdpExTable2FromStack
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, 1
lea rcx, str.user32.dll
mov qword [0x140194158], rax
call fcn.140035800
mov rcx, rax
lea rdx, str.HungWindowFromGhostWindow
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, 1
lea rcx, str.kernel32.dll
mov qword [0x1401a08b0], rax
call fcn.140035800
mov rcx, rax
lea rdx, str.GetLogicalProcessorInformationEx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, 1
lea rcx, str.kernel32.dll
mov qword [0x140194168], rax
call fcn.140035800
mov rcx, rax
lea rdx, [0x140138368]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, 1
lea rcx, str.winsta.dll
mov qword [0x140194170], rax
call fcn.140035800
mov rcx, rax
lea rdx, str.WinStationConnectW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140194178], rax
test rax, rax
jne 0x1400ac723
lea r8, str.winsta_WinStationConnectW
lea rdx, str.Not_able_to_run_on_this_version_of_Windows:_nMissing_function:__s
lea rcx, [rsp + 0x40]
call fcn.1400358d0
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetDim
lea r8, [0x14011f590]
lea rdx, [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov edx, 1
lea rcx, str.winsta.dll
call fcn.140035800
mov rcx, rax
lea rdx, str.WinStationShadow
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140194180], rax
test rax, rax
jne 0x1400ac782
lea r8, str.winsta_WinStationShadow
lea rdx, str.Not_able_to_run_on_this_version_of_Windows:_nMissing_function:__s
lea rcx, [rsp + 0x40]
call fcn.1400358d0
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetDim
lea r8, [0x14011f590]
lea rdx, [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
lea rdi, [0x14018dfc4]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
test rax, rax
jne 0x1400ac8c5
lea r8, [rsp + 0x38]
mov rcx, 0xffffffff80000001
lea rdx, str.SoftwareMicrosoftDebuggingTools
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x1400ac89a
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, str.Windbg
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov dword [rsp + 0x30], 0x208
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea r8, str.DbgHelp.dll
mov edx, 0x104
mov rcx, rdi
call fcn.1400f7f64
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
test rax, rax
jne 0x1400ac8c5
lea r8, str.C:Debuggersdbghelp.dll
mov edx, 0x104
mov rcx, rdi
call fcn.1400e86e4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
test rax, rax
jne 0x1400ac8c5
mov r8d, 0x104
lea rcx, str._ProgramFiles_Debugging_Tools_for_Windows__x64_dbghelp.dll
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
test rax, rax
jne 0x1400ac8c5
mov rdx, rdi
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea r8, [0x140138560]
mov edx, 0x104
mov rcx, rdi
call fcn.1400f7f64
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
test rax, rax
jne 0x1400ac8c5
mov edx, 1
lea rcx, str.dbghelp.dll
call fcn.140035800
mov rbx, rax
test rax, rax
jne 0x1400ac8c5
lea edx, [rax + 1]
lea rcx, str.imagehlp.dll
call fcn.140035800
mov rbx, rax
mov r8d, 0x104
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
lea rdx, str.SymInitialize
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.EnumerateLoadedModulesW64
mov rcx, rdi
mov qword [0x1401940a8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SymRegisterCallback64
mov rcx, rdi
mov qword [0x140194110], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SymGetModuleInfoW64
mov rcx, rdi
mov qword [0x140194118], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SymCleanup
mov rcx, rdi
mov qword [0x140194108], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SymFromAddrW
mov rcx, rdi
mov qword [0x1401940d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SymGetSymFromName
mov rcx, rdi
mov qword [0x1401940c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MiniDumpWriteDump
mov rcx, rdi
mov qword [0x1401940c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SymSetOptions
mov rcx, rdi
mov qword [0x1401a08f8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SymGetOptions
mov rcx, rdi
mov qword [0x1401940d8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SymLoadModuleExW
mov rcx, rdi
mov qword [0x1401940b0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor esi, esi
mov qword [0x1401940f8], rax
test rax, rax
je 0x1400ac9f0
lea rcx, [0x1400bcb60]
jmp 0x1400aca18
lea rdx, str.SymLoadModule64
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rsi
lea rdx, [0x1400bcb90]
test rax, rax
mov qword [0x1401940f0], rax
cmovne rcx, rdx
mov qword [0x1401940e8], rcx
lea rdx, str.SymUnloadModule64
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ImageNtHeader
mov rcx, rdi
mov qword [0x140194100], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.StackWalk64
mov rcx, rdi
mov qword [0x140194130], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SymGetModuleBase64
mov rcx, rdi
mov qword [0x1401940e0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SymFunctionTableAccess64
mov rcx, rdi
mov qword [0x140194128], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp byte [0x14018e1cc], sil
mov qword [0x1401940b8], rax
jne 0x1400acaad
cmp qword [0x1401940a8], rsi
je 0x1400acac1
cmp word [0x14018e1ce], si
je 0x1400acac1
lea rdx, [0x14018e1ce]
lea rcx, str._NT_SYMBOL_PATH
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
cmp qword [0x140194130], rsi
jne 0x1400acaf2
mov edx, 1
lea rcx, str.imagehlp.dll
call fcn.140035800
mov rcx, rax
lea rdx, str.ImageNtHeader
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140194130], rax
lea rdx, str.FindExecutableImageExW
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140194148], rax
test rax, rax
je 0x1400acb17
lea rsi, [0x1400a7d90]
jmp 0x1400acb4d
mov edx, 1
lea rcx, str.imagehlp.dll
call fcn.140035800
mov rcx, rax
lea rdx, str.FindExecutableImage
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x140194138], rax
lea rcx, [0x1400a7db0]
cmovne rsi, rcx
lea rcx, str.kernel32.dll
mov qword [0x140194140], rsi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.QueryProcessCycleTime
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.kernel32.dll
mov qword [0x1401a0890], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.QueryIdleProcessorCycleTime
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.kernel32.dll
mov qword [0x140194188], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [0x140138620]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.Shell32.dll
mov qword [0x1401a08a0], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [0x140138638]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.user32.dll
mov qword [0x14018f9a8], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.ChangeWindowMessageFilter
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, 1
lea rcx, str.advapi32.dll
mov qword [0x140194190], rax
call fcn.140035800
mov rcx, rax
lea rdx, str.I_QueryTagInformation
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x14011eb90]
mov qword [0x1401a08e8], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.CreateProcessWithTokenW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, 1
lea rcx, str.wow64cpu
mov qword [0x1401a08f0], rax
call fcn.140035800
mov rcx, rax
lea rdx, str.CpuGetContext
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, 1
lea rcx, str.kernel32.dll
mov qword [0x140194198], rax
call fcn.140035800
mov rcx, rax
lea rdx, str.GetProcessorSystemCycleTime
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, 1
lea rcx, str.kernel32.dll
mov qword [0x1401a0898], rax
call fcn.140035800
mov rcx, rax
lea rdx, [0x1401386e8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, 1
lea rcx, str.user32.dll
mov qword [0x1401940a0], rax
call fcn.140035800
mov rcx, rax
lea rdx, str.IsImmersiveProcess
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, 1
lea rcx, str.kernel32.dll
mov qword [0x14018fa18], rax
call fcn.140035800
mov rcx, rax
lea rdx, str.GetPackageFullName
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14018fa20], rax
mov edx, 1
lea rcx, str.kernel32.dll
call fcn.140035800
mov rcx, rax
lea rdx, str.GetPackagePathByFullName
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401941a0], rax
mov al, 1
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400e17a0
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret