Function at 0x140097570
Capabilities:
Get common file path
Query environment variable

Disassembly:
jmp 0x140097570
sub rsp, 0x588
mov rax, qword [0x140188050]
xor rax, rsp
mov qword [rsp + 0x570], rax
xor edx, edx
lea rcx, [rsp + 0x240]
mov r8d, 0x104
call fcn.1400082a0
xor edx, edx
lea rcx, [rsp + 0x350]
mov r8d, 0x104
call fcn.1400082a0
xor edx, edx
lea rcx, [rsp + 0x130]
mov r8d, 0x104
call fcn.1400082a0
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call fcn.1400082a0
xor edx, edx
lea rcx, [rsp + 0x460]
mov r8d, 0x104
call fcn.1400082a0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x80
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov edx, 0x104
lea rcx, [rsp + 0x240]
call qword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
test eax, eax
jne 0x140097637
or r9, 0xffffffffffffffff
lea r8, str.C:Windows
mov edx, 0x104
lea rcx, [rsp + 0x240]
call fcn.140009db0
mov edx, 0x104
lea rcx, [rsp + 0x350]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x14009766b
or r9, 0xffffffffffffffff
lea r8, str.C:WindowsSystem32
mov edx, 0x104
lea rcx, [rsp + 0x350]
call fcn.140009db0
lea rdx, [rsp + 0x130]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
mov eax, eax
cmp rax, 1
jbe 0x14009769f
dec rax
cmp rax, 0x104
jae 0x1400977e6
mov byte [rsp + rax + 0x130], 0
jmp 0x1400976bc
or r9, 0xffffffffffffffff
lea r8, str.C:WindowsTemp
mov edx, 0x104
lea rcx, [rsp + 0x130]
call fcn.140009db0
mov r8d, 0x104
lea rdx, [rsp + 0x20]
lea rcx, str.ProgramW6432
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x14009770e
mov r8d, 0x104
lea rdx, [rsp + 0x20]
lea rcx, str.ProgramFiles
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x14009770e
or r9, 0xffffffffffffffff
lea r8, str.C:Program_Files
mov edx, 0x104
lea rcx, [rsp + 0x20]
call fcn.140009db0
lea r9, [rsp + 0x20]
mov ecx, 0x104
lea r8, str._sIntelIntel_R__Dynamic_Platform_and_Thermal_Framework
lea rdx, [rsp + 0x460]
call fcn.1400969c0
mov r9d, 0x400
lea r8, [rsp + 0x240]
lea rdx, str._WINDOWS_
lea rcx, str.HOME_ROOT__nTEMP_TEMP__nDV_WINDOWS_ServiceProfilesLocalServiceAppDataLocalIntelDPTF_nLOG_WINDOWS_ServiceProfilesLocalServiceAppDataLocalIntelDPTFlog_nBIN_WINDOWS_ServiceProfilesLocalServiceAppDataLocalIntelDPTF_bin_nLOCK_WINDOWS_ServiceProfilesLocalServiceAppDataLocalIntelDPTF_nEXE_SYSTEM_IntelDPTF_nDLL_SYSTEM_IntelDPTF_nDPTF_ROOT_ui_nDSP_ROOT_dsp_nCMD_ROOT_cmd_nUI_ROOT_ui_n
call fcn.14000d180
mov r9d, 0x400
lea r8, [rsp + 0x350]
lea rdx, str._SYSTEM_
lea rcx, str.HOME_ROOT__nTEMP_TEMP__nDV_WINDOWS_ServiceProfilesLocalServiceAppDataLocalIntelDPTF_nLOG_WINDOWS_ServiceProfilesLocalServiceAppDataLocalIntelDPTFlog_nBIN_WINDOWS_ServiceProfilesLocalServiceAppDataLocalIntelDPTF_bin_nLOCK_WINDOWS_ServiceProfilesLocalServiceAppDataLocalIntelDPTF_nEXE_SYSTEM_IntelDPTF_nDLL_SYSTEM_IntelDPTF_nDPTF_ROOT_ui_nDSP_ROOT_dsp_nCMD_ROOT_cmd_nUI_ROOT_ui_n
call fcn.14000d180
mov r9d, 0x400
lea r8, [rsp + 0x130]
lea rdx, str._TEMP_
lea rcx, str.HOME_ROOT__nTEMP_TEMP__nDV_WINDOWS_ServiceProfilesLocalServiceAppDataLocalIntelDPTF_nLOG_WINDOWS_ServiceProfilesLocalServiceAppDataLocalIntelDPTFlog_nBIN_WINDOWS_ServiceProfilesLocalServiceAppDataLocalIntelDPTF_bin_nLOCK_WINDOWS_ServiceProfilesLocalServiceAppDataLocalIntelDPTF_nEXE_SYSTEM_IntelDPTF_nDLL_SYSTEM_IntelDPTF_nDPTF_ROOT_ui_nDSP_ROOT_dsp_nCMD_ROOT_cmd_nUI_ROOT_ui_n
call fcn.14000d180
mov r9d, 0x400
lea r8, [rsp + 0x20]
lea rdx, str._PROGRAMFILES_
lea rcx, str.HOME_ROOT__nTEMP_TEMP__nDV_WINDOWS_ServiceProfilesLocalServiceAppDataLocalIntelDPTF_nLOG_WINDOWS_ServiceProfilesLocalServiceAppDataLocalIntelDPTFlog_nBIN_WINDOWS_ServiceProfilesLocalServiceAppDataLocalIntelDPTF_bin_nLOCK_WINDOWS_ServiceProfilesLocalServiceAppDataLocalIntelDPTF_nEXE_SYSTEM_IntelDPTF_nDLL_SYSTEM_IntelDPTF_nDPTF_ROOT_ui_nDSP_ROOT_dsp_nCMD_ROOT_cmd_nUI_ROOT_ui_n
call fcn.14000d180
mov r9d, 0x400
lea r8, [rsp + 0x460]
lea rdx, str._ROOT_
lea rcx, str.HOME_ROOT__nTEMP_TEMP__nDV_WINDOWS_ServiceProfilesLocalServiceAppDataLocalIntelDPTF_nLOG_WINDOWS_ServiceProfilesLocalServiceAppDataLocalIntelDPTFlog_nBIN_WINDOWS_ServiceProfilesLocalServiceAppDataLocalIntelDPTF_bin_nLOCK_WINDOWS_ServiceProfilesLocalServiceAppDataLocalIntelDPTF_nEXE_SYSTEM_IntelDPTF_nDLL_SYSTEM_IntelDPTF_nDPTF_ROOT_ui_nDSP_ROOT_dsp_nCMD_ROOT_cmd_nUI_ROOT_ui_n
call fcn.14000d180
mov rcx, qword [rsp + 0x570]
xor rcx, rsp
call fcn.14000d260
add rsp, 0x588
ret
call fcn.140004ad0
int3