Function at 0x1401d4ec0
Capabilities:
Get common file path
Query environment variable

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x9d8]
sub rsp, 0xab0
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x140415a10]
xor rax, rsp
mov qword [rbp + 0x9a0], rax
mov rbx, rdx
cmp dword [rdx + 0xc], 0
je 0x1401d5606
xor r8d, r8d
lea rdx, str.rundll32.exe
mov rcx, rbx
call fcn.1401fd520
mov edi, eax
test eax, eax
js 0x1401d4f25
add edi, 0xd
jmp 0x1401d4f40
xor r8d, r8d
lea rdx, str.rundll32
mov rcx, rbx
call fcn.1401fd520
mov edi, eax
test eax, eax
js 0x1401d4fa4
add edi, 9
test edi, edi
js 0x1401d4fa4
cmp edi, dword [rbx + 0xc]
jge 0x1401d4fa4
mov edx, 0x2c
mov r8d, edi
mov rcx, rbx
call fcn.1401fd150
mov r8d, edi
lea rdx, [rsp + 0x30]
mov rcx, rbx
test eax, eax
jle 0x1401d4f81
sub eax, edi
mov r9d, eax
call fcn.1401fed70
nop
mov rdx, rax
mov rcx, rbx
call fcn.1401faf50
nop
jmp 0x1401d4f93
call fcn.1401feab0
nop
mov rdx, rax
mov rcx, rbx
call fcn.1401faf50
nop
cmp dword [rsp + 0x38], 0
jle 0x1401d4fa4
mov rcx, qword [rsp + 0x30]
call fcn.1402b7350
mov r8d, 1
lea rdx, [0x14034f2fc]
mov rcx, rbx
call fcn.1401ff2c0
mov rcx, rbx
test al, al
je 0x1401d503d
mov r8d, 1
lea rdx, [0x14034f2fc]
call fcn.1401fd400
test eax, eax
jle 0x1401d4ff5
mov r8d, dword [rbx + 0xc]
sub r8d, eax
mov edx, eax
mov rcx, rbx
call fcn.1401fdf50
xor edx, edx
lea r8d, [rdx + 1]
mov rcx, rbx
call fcn.1401fdf50
cmp dword [rbx + 0xc], 0
jle 0x1401d516e
xor edx, edx
mov rcx, rbx
call fcn.1401fb010
cmp ax, 0x25
jne 0x1401d516e
mov r8d, 0x400
lea rdx, [rbp + 0x1a0]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rdx, [rbp + 0x1a0]
mov rcx, rbx
call fcn.1401fafa0
jmp 0x1401d516e
xor r8d, r8d
lea rdx, str._globalroot
call fcn.1401ff2c0
test al, al
jne 0x1401d515e
xor r8d, r8d
lea rdx, str..globalroot
mov rcx, rbx
call fcn.1401ff2c0
test al, al
jne 0x1401d515e
mov r8d, 1
lea rdx, [0x140353dd0]
mov rcx, rbx
call fcn.1401ff2c0
test al, al
je 0x1401d5092
mov r8d, 4
jmp 0x1401d5164
cmp dword [rbx + 0xc], 0
jle 0x1401d516e
xor edx, edx
mov rcx, rbx
call fcn.1401fb010
cmp ax, 0x25
jne 0x1401d50d1
mov r8d, 0x400
lea rdx, [rbp + 0x1a0]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rdx, [rbp + 0x1a0]
mov rcx, rbx
call fcn.1401fafa0
cmp dword [rbx + 0xc], 0
je 0x1401d5118
mov edx, 0x5c
mov rcx, qword [rbx]
call fcn.1402ba31c
test rax, rax
je 0x1401d5118
sub rax, qword [rbx]
sar rax, 1
test eax, eax
jle 0x1401d5118
mov edx, 0x20
mov r8d, eax
mov rcx, rbx
call fcn.1401fd150
test eax, eax
jle 0x1401d5118
mov r8d, dword [rbx + 0xc]
sub r8d, eax
mov edx, eax
mov rcx, rbx
call fcn.1401fdf50
lea rdx, [0x1403635e8]
mov rcx, rbx
call fcn.1401fd2e0
test eax, eax
jle 0x1401d516e
mov r9d, eax
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.1401fed70
nop
mov rdx, rax
mov rcx, rbx
call fcn.1401faf50
nop
cmp dword [rsp + 0x38], 0
jle 0x1401d516e
mov rcx, qword [rsp + 0x30]
call fcn.1402b7350
jmp 0x1401d516e
mov r8d, 0xe
xor edx, edx
mov rcx, rbx
call fcn.1401fdf50
xor r8d, r8d
lea rdx, str.system32_
mov rcx, rbx
call fcn.1401ff2c0
test al, al
je 0x1401d51a0
mov edx, 0x104
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1401d51e7
mov r8d, 8
jmp 0x1401d51d0
xor r8d, r8d
lea rdx, str.SystemRoot_
mov rcx, rbx
call fcn.1401ff2c0
test al, al
je 0x1401d51e7
mov edx, 0x104
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x1401d51e7
mov r8d, 0xb
xor edx, edx
mov rcx, rbx
call fcn.1401fdf50
lea r8, [rsp + 0x50]
mov rcx, rbx
call fcn.1401fda10
xor r15d, r15d
lea r12, [0x140346ce0]
or rdi, 0xffffffffffffffff
cmp dword [rbx + 0xc], r15d
je 0x1401d52fc
lea edx, [rdi + 0x5d]
mov rcx, qword [rbx]
call fcn.1402ba31c
mov rsi, rax
test rax, rax
je 0x1401d52fc
mov rcx, qword [rbx]
sub rsi, rcx
sar rsi, 1
test esi, esi
jle 0x1401d52fc
cmp dword [rbx + 0xc], r15d
jne 0x1401d5231
mov eax, edi
jmp 0x1401d524a
mov edx, 0x2e
call fcn.1402ba31c
test rax, rax
jne 0x1401d5244
mov eax, edi
jmp 0x1401d524a
sub rax, qword [rbx]
sar rax, 1
cmp eax, esi
jge 0x1401d52fc
mov qword [rsp + 0x38], r15
mov edx, dword [rbx + 0xc]
test edx, edx
jne 0x1401d5265
mov qword [rsp + 0x30], r12
jmp 0x1401d5289
lea rcx, [rsp + 0x30]
call fcn.1401fcb40
movsxd r9, dword [rbx + 0xc]
mov eax, dword [rsp + 0x38]
inc eax
movsxd rdx, eax
mov r8, qword [rbx]
mov rcx, qword [rsp + 0x30]
call fcn.1402ba94c
mov edx, dword [rbx + 0xc]
lea rcx, [rsp + 0x30]
call fcn.1401fde50
nop
lea rdx, [0x140355288]
lea rcx, [rsp + 0x30]
call fcn.1401fb190
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x1401d52eb
inc esi
mov r8d, dword [rbx + 0xc]
sub r8d, esi
mov edx, esi
mov rcx, rbx
call fcn.1401fdf50
lea rdx, [rsp + 0x7c]
mov rcx, rbx
call fcn.1401fb190
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
cmp dword [rsp + 0x38], 0
jle 0x1401d52fc
mov rcx, qword [rsp + 0x30]
call fcn.1402b7350
mov r8d, 1
lea rdx, [0x14035ec70]
mov rcx, rbx
call fcn.1401fc8b0
test al, al
je 0x1401d5384
mov r8d, 0x400
lea rdx, [rbp + 0x1a0]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
je 0x1401d5384
lea rax, [rbp + 0x1a0]
mov rsi, rdi
nop dword [rax]
inc rsi
cmp word [rax + rsi*2], 0
jne 0x1401d5340
test esi, esi
jle 0x1401d5374
mov edx, esi
mov rcx, rbx
call fcn.1401fcb40
movsxd r9, esi
mov eax, dword [rbx + 8]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x1a0]
mov rcx, qword [rbx]
call fcn.1402ba94c
jmp 0x1401d537a
cmp dword [rbx + 0xc], 0
jle 0x1401d5384
mov edx, esi
mov rcx, rbx
call fcn.1401fde50
mov edx, 0x5c
mov rcx, qword [rbx]
call fcn.1402ba4e4
test rax, rax
jne 0x1401d5594
lea r8d, [rax + 1]
lea rdx, [0x140345c60]
mov rcx, rbx
call fcn.1401fc8b0
test al, al
jne 0x1401d54cb
mov qword [rsp + 0x38], r15
mov edx, dword [rbx + 0xc]
test edx, edx
jne 0x1401d53c8
mov qword [rsp + 0x30], r12
jmp 0x1401d53ec
lea rcx, [rsp + 0x30]
call fcn.1401fcb40
movsxd r9, dword [rbx + 0xc]
mov eax, dword [rsp + 0x38]
inc eax
movsxd rdx, eax
mov r8, qword [rbx]
mov rcx, qword [rsp + 0x30]
call fcn.1402ba94c
mov edx, dword [rbx + 0xc]
lea rcx, [rsp + 0x30]
call fcn.1401fde50
nop
lea rdx, [0x14034be40]
lea rcx, [rsp + 0x30]
call fcn.1401fb190
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x1a0]
mov qword [rsp + 0x20], rax
mov r9d, 0x400
xor r8d, r8d
mov rdx, qword [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
jne 0x1401d54b8
mov edx, dword [rbx + 0xc]
lea rcx, [rsp + 0x30]
call fcn.1401fcb40
movsxd r9, dword [rbx + 0xc]
mov eax, dword [rsp + 0x38]
inc eax
movsxd rdx, eax
mov r8, qword [rbx]
mov rcx, qword [rsp + 0x30]
call fcn.1402ba94c
mov edx, dword [rbx + 0xc]
lea rcx, [rsp + 0x30]
call fcn.1401fde50
lea rdx, str..dll
lea rcx, [rsp + 0x30]
call fcn.1401fb190
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x1a0]
mov qword [rsp + 0x20], rax
mov r9d, 0x400
xor r8d, r8d
mov rdx, qword [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
jne 0x1401d54b8
mov word [rbp + 0x1a0], r15w
cmp dword [rsp + 0x38], 0
jle 0x1401d5537
mov rcx, qword [rsp + 0x30]
call fcn.1402b7350
jmp 0x1401d5537
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x1a0]
mov qword [rsp + 0x20], rax
mov r9d, 0x400
xor r8d, r8d
mov rdx, qword [rbx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
jne 0x1401d5537
mov edx, 0x400
lea rcx, [rbp + 0x1a0]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea r8, [0x140345f98]
mov edx, 0x400
lea rcx, [rbp + 0x1a0]
call fcn.1402b9308
mov r8, qword [rbx]
mov edx, 0x400
lea rcx, [rbp + 0x1a0]
call fcn.1402b9308
cmp word [rbp + 0x1a0], 0
je 0x1401d5594
lea rax, [rbp + 0x1a0]
nop dword [rax + rax]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x1401d5550
test edi, edi
jle 0x1401d5584
mov edx, edi
mov rcx, rbx
call fcn.1401fcb40
movsxd r9, edi
mov eax, dword [rbx + 8]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x1a0]
mov rcx, qword [rbx]
call fcn.1402ba94c
jmp 0x1401d558a
cmp dword [rbx + 0xc], 0
jle 0x1401d5594
mov edx, edi
mov rcx, rbx
call fcn.1401fde50
mov r8d, 1
lea rdx, [0x140345c60]
mov rcx, rbx
call fcn.1401fc9f0
test al, al
je 0x1401d5606
mov r9d, dword [rbx + 0xc]
dec r9d
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.1401fed70
mov rdi, rax
mov edx, dword [rax + 0xc]
mov rcx, rbx
call fcn.1401fcb40
movsxd r9, dword [rdi + 0xc]
mov edx, dword [rbx + 8]
inc edx
movsxd rdx, edx
mov r8, qword [rdi]
mov rcx, qword [rbx]
call fcn.1402ba94c
mov edx, dword [rdi + 0xc]
mov rcx, rbx
call fcn.1401fde50
nop
cmp dword [rsp + 0x38], 0
jle 0x1401d5606
mov rcx, qword [rsp + 0x30]
call fcn.1402b7350
mov rcx, qword [rbp + 0x9a0]
xor rcx, rsp
call fcn.1402b6d40
lea r11, [rsp + 0xab0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret