Function at 0x1400d4c30
Capabilities:
Check if file exists
Get disk information
Get token membership
Query environment variable

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x250
mov rbp, qword [0x14022c040]
mov r9d, 0xffffffff
mov r8d, 0x104
mov rsi, qword [rbp]
mov qword [rsp + 0x248], rsi
lea rsi, [rsp + 0x40]
mov rbx, rcx
mov rdi, rdx
mov rcx, rsi
call fcn.1400d25c0
test eax, eax
js 0x1400d4de0
xor r9d, r9d
mov r8d, 0x104
mov edx, eax
mov rcx, rsi
call fcn.1400d3b90
test eax, eax
js 0x1400d4dee
mov dword [rsp + 0x28], 0x2000000
xor r9d, r9d
xor edx, edx
mov rcx, rsi
mov r14, qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r8d, 7
xor r12d, r12d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x20], 3
call r14
mov r13, rax
cmp rax, 0xffffffffffffffff
je 0x1400d4df8
xor r9d, r9d
mov r8d, 0x104
mov rdx, rsi
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetFinalPathNameByHandleW]
mov rcx, r13
mov edi, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
sub edi, 1
cmp edi, 0x102
ja 0x1400d4e06
mov rcx, rsi
call sub.msvcrt.dll_wcslen
mov rcx, rbx
lea edi, [rax + rax*2]
movsxd rdi, edi
mov rdx, rdi
call fcn.14008e7e0
mov rcx, rsi
call fcn.1400cfc50
mov rcx, qword [rbx + 0x10]
mov r8, rdi
mov rdx, rax
call fcn.1400d2b10
test eax, eax
js 0x1400d4e06
cdqe
mov qword [rbx + 8], rax
test r12, r12
je 0x1400d4db0
test rax, rax
je 0x1400d4d92
mov rdx, qword [rbx + 0x10]
cmp byte [rdx + rax - 1], 0x2f
je 0x1400d4d92
mov rcx, qword [rbx]
test rcx, rcx
jne 0x1400d4e60
mov edx, 1
mov rcx, rbx
call fcn.14008e7e0
mov rdx, qword [rbx + 0x10]
mov rax, qword [rbx + 8]
lea rcx, [rax + 1]
mov qword [rbx + 8], rcx
mov byte [rdx + rax], 0x2f
mov rdx, qword [rbx + 0x10]
mov rax, qword [rbx + 8]
mov byte [rdx + rax], 0
mov rcx, r12
call sub.msvcrt.dll_strlen
mov rcx, rbx
mov rdx, r12
mov r8, rax
call fcn.14008f5f0
mov rcx, r12
call fcn.1400eaf30
mov rax, qword [rbx + 0x10]
mov rdx, qword [rsp + 0x248]
sub rdx, qword [rbp]
jne 0x1400d4f19
add rsp, 0x250
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rbx, qword [sym.imp.msvcrt.dll__errno]
call rbx
cmp dword [rax], 0x22
je 0x1400d4e18
xor eax, eax
jmp 0x1400d4db4
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x1400d4e28
xor r12d, r12d
mov rcx, r12
call fcn.1400eaf30
xor eax, eax
jmp 0x1400d4db4
call rbx
mov dword [rax], 0x26
xor eax, eax
jmp 0x1400d4db4
mov rcx, rsi
call sub.msvcrt.dll_wcslen
lea r13, [rsi + rax*2]
jmp 0x1400d4e55
movzx eax, word [r13 - 2]
sub r13, 2
cmp ax, 0x5c
je 0x1400d4e78
cmp ax, 0x2f
je 0x1400d4e78
cmp r13, rsi
jne 0x1400d4e40
jmp 0x1400d4e03
sub rcx, rax
cmp rcx, 1
jne 0x1400d4d7a
jmp 0x1400d4d65
cmp r13, rsi
je 0x1400d4e03
movzx eax, byte [rdi]
test al, al
je 0x1400d4e03
xor ecx, ecx
jmp 0x1400d4ea0
cmp al, 0x5c
je 0x1400d4ea4
movzx eax, byte [rdi + 1]
add rdi, 1
test al, al
je 0x1400d4eb0
cmp al, 0x2f
jne 0x1400d4e90
mov rcx, rdi
jmp 0x1400d4e94
test rcx, rcx
je 0x1400d4e03
add rcx, 1
call fcn.1400bd080
cmp word [r13 - 2], 0x3a
mov r12, rax
je 0x1400d4f10
xor eax, eax
mov word [r13], ax
mov dword [rsp + 0x28], 0x2000000
xor r9d, r9d
xor edx, edx
mov rcx, rsi
mov qword [rsp + 0x30], 0
mov r8d, 7
mov dword [rsp + 0x20], 3
call r14
mov r13, rax
cmp rax, 0xffffffffffffffff
jne 0x1400d4cd7
jmp 0x1400d4e06
xor edx, edx
mov word [r13 + 2], dx
jmp 0x1400d4ed4
call fcn.1401d96b0
nop
nop