Function at 0x1401d86e0
Capabilities:
Get common file path
Query environment variable

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x9d8]
sub rsp, 0xab0
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x14041da10]
xor rax, rsp
mov qword [rbp + 0x9a0], rax
mov rbx, rdx
cmp dword [rdx + 0xc], 0
je 0x1401d8e26
xor r8d, r8d
lea rdx, str.rundll32.exe
mov rcx, rbx
call fcn.140203280
mov edi, eax
test eax, eax
js 0x1401d8745
add edi, 0xd
jmp 0x1401d8760
xor r8d, r8d
lea rdx, str.rundll32
mov rcx, rbx
call fcn.140203280
mov edi, eax
test eax, eax
js 0x1401d87c4
add edi, 9
test edi, edi
js 0x1401d87c4
cmp edi, dword [rbx + 0xc]
jge 0x1401d87c4
mov edx, 0x2c
mov r8d, edi
mov rcx, rbx
call fcn.140202eb0
mov r8d, edi
lea rdx, [rsp + 0x30]
mov rcx, rbx
test eax, eax
jle 0x1401d87a1
sub eax, edi
mov r9d, eax
call fcn.140204ad0
nop
mov rdx, rax
mov rcx, rbx
call fcn.140200cb0
nop
jmp 0x1401d87b3
call fcn.140204810
nop
mov rdx, rax
mov rcx, rbx
call fcn.140200cb0
nop
cmp dword [rsp + 0x38], 0
jle 0x1401d87c4
mov rcx, qword [rsp + 0x30]
call fcn.1402bd0e0
mov r8d, 1
lea rdx, [0x140355194]
mov rcx, rbx
call fcn.140205020
mov rcx, rbx
test al, al
je 0x1401d885d
mov r8d, 1
lea rdx, [0x140355194]
call fcn.140203160
test eax, eax
jle 0x1401d8815
mov r8d, dword [rbx + 0xc]
sub r8d, eax
mov edx, eax
mov rcx, rbx
call fcn.140203cb0
xor edx, edx
lea r8d, [rdx + 1]
mov rcx, rbx
call fcn.140203cb0
cmp dword [rbx + 0xc], 0
jle 0x1401d898e
xor edx, edx
mov rcx, rbx
call fcn.140200d70
cmp ax, 0x25
jne 0x1401d898e
mov r8d, 0x400
lea rdx, [rbp + 0x1a0]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rdx, [rbp + 0x1a0]
mov rcx, rbx
call fcn.140200d00
jmp 0x1401d898e
xor r8d, r8d
lea rdx, str._globalroot
call fcn.140205020
test al, al
jne 0x1401d897e
xor r8d, r8d
lea rdx, str..globalroot
mov rcx, rbx
call fcn.140205020
test al, al
jne 0x1401d897e
mov r8d, 1
lea rdx, [0x14035a510]
mov rcx, rbx
call fcn.140205020
test al, al
je 0x1401d88b2
mov r8d, 4
jmp 0x1401d8984
cmp dword [rbx + 0xc], 0
jle 0x1401d898e
xor edx, edx
mov rcx, rbx
call fcn.140200d70
cmp ax, 0x25
jne 0x1401d88f1
mov r8d, 0x400
lea rdx, [rbp + 0x1a0]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rdx, [rbp + 0x1a0]
mov rcx, rbx
call fcn.140200d00
cmp dword [rbx + 0xc], 0
je 0x1401d8938
mov edx, 0x5c
mov rcx, qword [rbx]
call fcn.1402c00ac
test rax, rax
je 0x1401d8938
sub rax, qword [rbx]
sar rax, 1
test eax, eax
jle 0x1401d8938
mov edx, 0x20
mov r8d, eax
mov rcx, rbx
call fcn.140202eb0
test eax, eax
jle 0x1401d8938
mov r8d, dword [rbx + 0xc]
sub r8d, eax
mov edx, eax
mov rcx, rbx
call fcn.140203cb0
lea rdx, [0x14036a018]
mov rcx, rbx
call fcn.140203040
test eax, eax
jle 0x1401d898e
mov r9d, eax
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140204ad0
nop
mov rdx, rax
mov rcx, rbx
call fcn.140200cb0
nop
cmp dword [rsp + 0x38], 0
jle 0x1401d898e
mov rcx, qword [rsp + 0x30]
call fcn.1402bd0e0
jmp 0x1401d898e
mov r8d, 0xe
xor edx, edx
mov rcx, rbx
call fcn.140203cb0
xor r8d, r8d
lea rdx, str.system32_
mov rcx, rbx
call fcn.140205020
test al, al
je 0x1401d89c0
mov edx, 0x104
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1401d8a07
mov r8d, 8
jmp 0x1401d89f0
xor r8d, r8d
lea rdx, str.SystemRoot_
mov rcx, rbx
call fcn.140205020
test al, al
je 0x1401d8a07
mov edx, 0x104
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x1401d8a07
mov r8d, 0xb
xor edx, edx
mov rcx, rbx
call fcn.140203cb0
lea r8, [rsp + 0x50]
mov rcx, rbx
call fcn.140203770
xor r15d, r15d
lea r12, [0x14034d1a0]
or rdi, 0xffffffffffffffff
cmp dword [rbx + 0xc], r15d
je 0x1401d8b1c
lea edx, [rdi + 0x5d]
mov rcx, qword [rbx]
call fcn.1402c00ac
mov rsi, rax
test rax, rax
je 0x1401d8b1c
mov rcx, qword [rbx]
sub rsi, rcx
sar rsi, 1
test esi, esi
jle 0x1401d8b1c
cmp dword [rbx + 0xc], r15d
jne 0x1401d8a51
mov eax, edi
jmp 0x1401d8a6a
mov edx, 0x2e
call fcn.1402c00ac
test rax, rax
jne 0x1401d8a64
mov eax, edi
jmp 0x1401d8a6a
sub rax, qword [rbx]
sar rax, 1
cmp eax, esi
jge 0x1401d8b1c
mov qword [rsp + 0x38], r15
mov edx, dword [rbx + 0xc]
test edx, edx
jne 0x1401d8a85
mov qword [rsp + 0x30], r12
jmp 0x1401d8aa9
lea rcx, [rsp + 0x30]
call fcn.1402028a0
movsxd r9, dword [rbx + 0xc]
mov eax, dword [rsp + 0x38]
inc eax
movsxd rdx, eax
mov r8, qword [rbx]
mov rcx, qword [rsp + 0x30]
call fcn.1402c06dc
mov edx, dword [rbx + 0xc]
lea rcx, [rsp + 0x30]
call fcn.140203bb0
nop
lea rdx, [0x14035b978]
lea rcx, [rsp + 0x30]
call fcn.140200ef0
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x1401d8b0b
inc esi
mov r8d, dword [rbx + 0xc]
sub r8d, esi
mov edx, esi
mov rcx, rbx
call fcn.140203cb0
lea rdx, [rsp + 0x7c]
mov rcx, rbx
call fcn.140200ef0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
cmp dword [rsp + 0x38], 0
jle 0x1401d8b1c
mov rcx, qword [rsp + 0x30]
call fcn.1402bd0e0
mov r8d, 1
lea rdx, [0x140365654]
mov rcx, rbx
call fcn.140202610
test al, al
je 0x1401d8ba4
mov r8d, 0x400
lea rdx, [rbp + 0x1a0]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
je 0x1401d8ba4
lea rax, [rbp + 0x1a0]
mov rsi, rdi
nop dword [rax]
inc rsi
cmp word [rax + rsi*2], 0
jne 0x1401d8b60
test esi, esi
jle 0x1401d8b94
mov edx, esi
mov rcx, rbx
call fcn.1402028a0
movsxd r9, esi
mov eax, dword [rbx + 8]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x1a0]
mov rcx, qword [rbx]
call fcn.1402c06dc
jmp 0x1401d8b9a
cmp dword [rbx + 0xc], 0
jle 0x1401d8ba4
mov edx, esi
mov rcx, rbx
call fcn.140203bb0
mov edx, 0x5c
mov rcx, qword [rbx]
call fcn.1402c0274
test rax, rax
jne 0x1401d8db4
lea r8d, [rax + 1]
lea rdx, [0x14034bd50]
mov rcx, rbx
call fcn.140202610
test al, al
jne 0x1401d8ceb
mov qword [rsp + 0x38], r15
mov edx, dword [rbx + 0xc]
test edx, edx
jne 0x1401d8be8
mov qword [rsp + 0x30], r12
jmp 0x1401d8c0c
lea rcx, [rsp + 0x30]
call fcn.1402028a0
movsxd r9, dword [rbx + 0xc]
mov eax, dword [rsp + 0x38]
inc eax
movsxd rdx, eax
mov r8, qword [rbx]
mov rcx, qword [rsp + 0x30]
call fcn.1402c06dc
mov edx, dword [rbx + 0xc]
lea rcx, [rsp + 0x30]
call fcn.140203bb0
nop
lea rdx, [0x140352308]
lea rcx, [rsp + 0x30]
call fcn.140200ef0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x1a0]
mov qword [rsp + 0x20], rax
mov r9d, 0x400
xor r8d, r8d
mov rdx, qword [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
jne 0x1401d8cd8
mov edx, dword [rbx + 0xc]
lea rcx, [rsp + 0x30]
call fcn.1402028a0
movsxd r9, dword [rbx + 0xc]
mov eax, dword [rsp + 0x38]
inc eax
movsxd rdx, eax
mov r8, qword [rbx]
mov rcx, qword [rsp + 0x30]
call fcn.1402c06dc
mov edx, dword [rbx + 0xc]
lea rcx, [rsp + 0x30]
call fcn.140203bb0
lea rdx, str..dll
lea rcx, [rsp + 0x30]
call fcn.140200ef0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x1a0]
mov qword [rsp + 0x20], rax
mov r9d, 0x400
xor r8d, r8d
mov rdx, qword [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
jne 0x1401d8cd8
mov word [rbp + 0x1a0], r15w
cmp dword [rsp + 0x38], 0
jle 0x1401d8d57
mov rcx, qword [rsp + 0x30]
call fcn.1402bd0e0
jmp 0x1401d8d57
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x1a0]
mov qword [rsp + 0x20], rax
mov r9d, 0x400
xor r8d, r8d
mov rdx, qword [rbx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
jne 0x1401d8d57
mov edx, 0x400
lea rcx, [rbp + 0x1a0]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea r8, [0x14034c088]
mov edx, 0x400
lea rcx, [rbp + 0x1a0]
call fcn.1402bf098
mov r8, qword [rbx]
mov edx, 0x400
lea rcx, [rbp + 0x1a0]
call fcn.1402bf098
cmp word [rbp + 0x1a0], 0
je 0x1401d8db4
lea rax, [rbp + 0x1a0]
nop dword [rax + rax]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x1401d8d70
test edi, edi
jle 0x1401d8da4
mov edx, edi
mov rcx, rbx
call fcn.1402028a0
movsxd r9, edi
mov eax, dword [rbx + 8]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x1a0]
mov rcx, qword [rbx]
call fcn.1402c06dc
jmp 0x1401d8daa
cmp dword [rbx + 0xc], 0
jle 0x1401d8db4
mov edx, edi
mov rcx, rbx
call fcn.140203bb0
mov r8d, 1
lea rdx, [0x14034bd50]
mov rcx, rbx
call fcn.140202750
test al, al
je 0x1401d8e26
mov r9d, dword [rbx + 0xc]
dec r9d
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140204ad0
mov rdi, rax
mov edx, dword [rax + 0xc]
mov rcx, rbx
call fcn.1402028a0
movsxd r9, dword [rdi + 0xc]
mov edx, dword [rbx + 8]
inc edx
movsxd rdx, edx
mov r8, qword [rdi]
mov rcx, qword [rbx]
call fcn.1402c06dc
mov edx, dword [rdi + 0xc]
mov rcx, rbx
call fcn.140203bb0
nop
cmp dword [rsp + 0x38], 0
jle 0x1401d8e26
mov rcx, qword [rsp + 0x30]
call fcn.1402bd0e0
mov rcx, qword [rbp + 0x9a0]
xor rcx, rsp
call fcn.1402bcad0
lea r11, [rsp + 0xab0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret