Function at 0x1401d4490
Capabilities:
Get common file path
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0xa60
mov rax, qword [0x1403eaa10]
xor rax, rsp
mov qword [rsp + 0xa50], rax
lea rdx, [0x14032c0d4]
mov r8d, 1
mov rdi, rcx
call fcn.1401eb700
mov r8d, 1
mov rcx, rdi
test al, al
je 0x1401d44fa
lea rdx, [0x14032c0d4]
call fcn.1401e9840
test eax, eax
jle 0x1401d451a
mov r8d, dword [rdi + 0xc]
mov edx, eax
mov rcx, rdi
sub r8d, eax
call fcn.1401ea390
mov r8d, 1
jmp 0x1401d4510
lea rdx, [0x1403300d8]
call fcn.1401eb700
test al, al
je 0x1401d451a
mov r8d, 4
xor edx, edx
mov rcx, rdi
call fcn.1401ea390
lea rdx, str.system32_
xor r8d, r8d
mov rcx, rdi
call fcn.1401eb700
or rbx, 0xffffffffffffffff
test al, al
je 0x1401d456c
lea rcx, [rsp + 0x40]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1401d4641
lea r8d, [rbx + 9]
xor edx, edx
mov rcx, rdi
call fcn.1401ea390
lea r8, [rsp + 0x40]
mov rcx, rdi
call fcn.1401e9e50
jmp 0x1401d4641
lea rdx, str.SystemRoot_
xor r8d, r8d
mov rcx, rdi
call fcn.1401eb700
test al, al
je 0x1401d45ba
lea rcx, [rsp + 0x40]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x1401d4641
xor edx, edx
mov rcx, rdi
lea r8d, [rdx + 0xb]
call fcn.1401ea390
lea r8, [rsp + 0x40]
mov rcx, rdi
call fcn.1401e9e50
jmp 0x1401d4641
xor edx, edx
mov rcx, rdi
call fcn.1401e7500
cmp ax, 0x25
jne 0x1401d4641
mov rcx, qword [rdi]
lea rdx, [rsp + 0x250]
mov r8d, 0x400
mov qword [rsp + 0xa78], rsi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rax, [rsp + 0x250]
mov rsi, rbx
inc rsi
cmp word [rax + rsi*2], 0
jne 0x1401d45f4
test esi, esi
jle 0x1401d4629
mov edx, esi
mov rcx, rdi
call fcn.1401e9030
mov eax, dword [rdi + 8]
mov rcx, qword [rdi]
inc eax
lea r8, [rsp + 0x250]
movsxd r9, esi
movsxd rdx, eax
call fcn.14029b4d8
jmp 0x1401d462f
cmp dword [rdi + 0xc], 0
jle 0x1401d4639
mov edx, esi
mov rcx, rdi
call fcn.1401ea290
mov rsi, qword [rsp + 0xa78]
mov rcx, qword [rdi]
mov edx, 0x5c
call fcn.14029b070
test rax, rax
jne 0x1401d4705
mov rdx, qword [rdi]
lea rax, [rsp + 0x30]
mov r9d, 0x400
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x250]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
jne 0x1401d46c7
lea rcx, [rsp + 0x250]
mov edx, 0x400
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea r8, [0x1403232c8]
lea rcx, [rsp + 0x250]
mov edx, 0x400
call fcn.14029a500
mov r8, qword [rdi]
lea rcx, [rsp + 0x250]
mov edx, 0x400
call fcn.14029a500
lea rax, [rsp + 0x250]
nop
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401d46d0
test ebx, ebx
jle 0x1401d474d
mov edx, ebx
mov rcx, rdi
call fcn.1401e9030
mov eax, dword [rdi + 8]
mov rcx, qword [rdi]
inc eax
lea r8, [rsp + 0x250]
movsxd r9, ebx
movsxd rdx, eax
call fcn.14029b4d8
jmp 0x1401d4753
lea rdx, [0x14033a5a8]
mov r8d, 1
mov rcx, rdi
call fcn.1401e8da0
test al, al
je 0x1401d475d
mov rcx, qword [rdi]
lea rdx, [rsp + 0x250]
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
je 0x1401d475d
lea rax, [rsp + 0x250]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401d4741
jmp 0x1401d46da
cmp dword [rdi + 0xc], 0
jle 0x1401d475d
mov edx, ebx
mov rcx, rdi
call fcn.1401ea290
mov rcx, qword [rsp + 0xa50]
xor rcx, rsp
call fcn.140297ff0
mov rbx, qword [rsp + 0xa80]
add rsp, 0xa60
pop rdi
ret