Function at 0x140006377
Capabilities:
Get common file path
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rdx, rcx
mov esi, 0x1770
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x1400063b7
mov r8b, 1
mov rcx, rdi
mov dl, r8b
call fcn.140006201
test al, al
jne 0x14000662f
lea rcx, [0x14003d620]
mov r8d, esi
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x1400063ff
lea rdx, [0x14003d608]
mov rcx, rdi
call fcn.14001588c
test rax, rax
je 0x1400063ff
mov r8b, 1
xor edx, edx
mov rcx, rdi
call fcn.140006201
test al, al
jne 0x14000662f
lea rcx, [0x14003d5f8]
mov r8d, esi
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x14000645f
mov rcx, rdi
call fcn.140015251
mov ebx, esi
mov rcx, rdi
sub ebx, eax
call fcn.140015251
lea rcx, [0x14003d5e8]
lea rdx, [rdi + rax]
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x14000645f
mov r8b, 1
xor edx, edx
mov rcx, rdi
call fcn.140006201
test al, al
jne 0x14000662f
mov edx, esi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x14000649f
lea rdx, [0x14003d5e0]
mov rcx, rdi
call fcn.14001588c
test rax, rax
je 0x14000649f
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call fcn.140006201
test al, al
jne 0x14000662f
lea rdx, [0x14003d5d8]
mov rcx, rdi
call fcn.14001595b
test rax, rax
je 0x1400064cc
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call fcn.140006201
test al, al
jne 0x14000662f
lea rdx, [0x14003d5cc]
mov rcx, rdi
call fcn.14001595b
test rax, rax
je 0x1400064f9
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call fcn.140006201
test al, al
jne 0x14000662f
mov edx, esi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x140006521
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call fcn.140006201
test al, al
jne 0x14000662f
lea rdx, [0x14003d5cc]
mov rcx, rdi
call fcn.14001595b
test rax, rax
je 0x14000654e
xor r8d, r8d
mov dl, 1
mov rcx, rdi
call fcn.140006201
test al, al
jne 0x14000662f
mov rdx, rdi
mov ecx, esi
mov byte [0x140134ed2], 1
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x14000657d
xor r8d, r8d
mov dl, 1
mov rcx, rdi
call fcn.140006201
test al, al
jne 0x14000662f
lea rcx, [0x14003d620]
mov r8d, esi
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x1400065c5
lea rdx, [0x14003d608]
mov rcx, rdi
call fcn.14001588c
test rax, rax
je 0x1400065c5
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call fcn.140006201
test al, al
jne 0x14000662f
lea rcx, [0x14003d5f8]
mov r8d, esi
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x140006623
mov rcx, rdi
call fcn.140015251
mov rcx, rdi
sub esi, eax
call fcn.140015251
lea rcx, [0x14003d5e8]
lea rdx, [rdi + rax]
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x140006623
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call fcn.140006201
test al, al
jne 0x14000662f
xor edx, edx
mov ecx, 0x3f7
call fcn.140005384
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret