Function at 0x1401d64e0
Capabilities:
Get common file path
Query environment variable

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x9d8]
sub rsp, 0xab0
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x140418a10]
xor rax, rsp
mov qword [rbp + 0x9a0], rax
mov rbx, rdx
cmp dword [rdx + 0xc], 0
je 0x1401d6c26
xor r8d, r8d
lea rdx, str.rundll32.exe
mov rcx, rbx
call fcn.1401ffc40
mov edi, eax
test eax, eax
js 0x1401d6545
add edi, 0xd
jmp 0x1401d6560
xor r8d, r8d
lea rdx, str.rundll32
mov rcx, rbx
call fcn.1401ffc40
mov edi, eax
test eax, eax
js 0x1401d65c4
add edi, 9
test edi, edi
js 0x1401d65c4
cmp edi, dword [rbx + 0xc]
jge 0x1401d65c4
mov edx, 0x2c
mov r8d, edi
mov rcx, rbx
call fcn.1401ff870
mov r8d, edi
lea rdx, [rsp + 0x30]
mov rcx, rbx
test eax, eax
jle 0x1401d65a1
sub eax, edi
mov r9d, eax
call fcn.140201490
nop
mov rdx, rax
mov rcx, rbx
call fcn.1401fd670
nop
jmp 0x1401d65b3
call fcn.1402011d0
nop
mov rdx, rax
mov rcx, rbx
call fcn.1401fd670
nop
cmp dword [rsp + 0x38], 0
jle 0x1401d65c4
mov rcx, qword [rsp + 0x30]
call fcn.1402b9c20
mov r8d, 1
lea rdx, [0x1403512cc]
mov rcx, rbx
call fcn.1402019e0
mov rcx, rbx
test al, al
je 0x1401d665d
mov r8d, 1
lea rdx, [0x1403512cc]
call fcn.1401ffb20
test eax, eax
jle 0x1401d6615
mov r8d, dword [rbx + 0xc]
sub r8d, eax
mov edx, eax
mov rcx, rbx
call fcn.140200670
xor edx, edx
lea r8d, [rdx + 1]
mov rcx, rbx
call fcn.140200670
cmp dword [rbx + 0xc], 0
jle 0x1401d678e
xor edx, edx
mov rcx, rbx
call fcn.1401fd730
cmp ax, 0x25
jne 0x1401d678e
mov r8d, 0x400
lea rdx, [rbp + 0x1a0]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rdx, [rbp + 0x1a0]
mov rcx, rbx
call fcn.1401fd6c0
jmp 0x1401d678e
xor r8d, r8d
lea rdx, str._globalroot
call fcn.1402019e0
test al, al
jne 0x1401d677e
xor r8d, r8d
lea rdx, str..globalroot
mov rcx, rbx
call fcn.1402019e0
test al, al
jne 0x1401d677e
mov r8d, 1
lea rdx, [0x140355e60]
mov rcx, rbx
call fcn.1402019e0
test al, al
je 0x1401d66b2
mov r8d, 4
jmp 0x1401d6784
cmp dword [rbx + 0xc], 0
jle 0x1401d678e
xor edx, edx
mov rcx, rbx
call fcn.1401fd730
cmp ax, 0x25
jne 0x1401d66f1
mov r8d, 0x400
lea rdx, [rbp + 0x1a0]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rdx, [rbp + 0x1a0]
mov rcx, rbx
call fcn.1401fd6c0
cmp dword [rbx + 0xc], 0
je 0x1401d6738
mov edx, 0x5c
mov rcx, qword [rbx]
call fcn.1402bcbec
test rax, rax
je 0x1401d6738
sub rax, qword [rbx]
sar rax, 1
test eax, eax
jle 0x1401d6738
mov edx, 0x20
mov r8d, eax
mov rcx, rbx
call fcn.1401ff870
test eax, eax
jle 0x1401d6738
mov r8d, dword [rbx + 0xc]
sub r8d, eax
mov edx, eax
mov rcx, rbx
call fcn.140200670
lea rdx, [0x140365920]
mov rcx, rbx
call fcn.1401ffa00
test eax, eax
jle 0x1401d678e
mov r9d, eax
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140201490
nop
mov rdx, rax
mov rcx, rbx
call fcn.1401fd670
nop
cmp dword [rsp + 0x38], 0
jle 0x1401d678e
mov rcx, qword [rsp + 0x30]
call fcn.1402b9c20
jmp 0x1401d678e
mov r8d, 0xe
xor edx, edx
mov rcx, rbx
call fcn.140200670
xor r8d, r8d
lea rdx, str.system32_
mov rcx, rbx
call fcn.1402019e0
test al, al
je 0x1401d67c0
mov edx, 0x104
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1401d6807
mov r8d, 8
jmp 0x1401d67f0
xor r8d, r8d
lea rdx, str.SystemRoot_
mov rcx, rbx
call fcn.1402019e0
test al, al
je 0x1401d6807
mov edx, 0x104
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x1401d6807
mov r8d, 0xb
xor edx, edx
mov rcx, rbx
call fcn.140200670
lea r8, [rsp + 0x50]
mov rcx, rbx
call fcn.140200130
xor r15d, r15d
lea r12, [0x140348ca0]
or rdi, 0xffffffffffffffff
cmp dword [rbx + 0xc], r15d
je 0x1401d691c
lea edx, [rdi + 0x5d]
mov rcx, qword [rbx]
call fcn.1402bcbec
mov rsi, rax
test rax, rax
je 0x1401d691c
mov rcx, qword [rbx]
sub rsi, rcx
sar rsi, 1
test esi, esi
jle 0x1401d691c
cmp dword [rbx + 0xc], r15d
jne 0x1401d6851
mov eax, edi
jmp 0x1401d686a
mov edx, 0x2e
call fcn.1402bcbec
test rax, rax
jne 0x1401d6864
mov eax, edi
jmp 0x1401d686a
sub rax, qword [rbx]
sar rax, 1
cmp eax, esi
jge 0x1401d691c
mov qword [rsp + 0x38], r15
mov edx, dword [rbx + 0xc]
test edx, edx
jne 0x1401d6885
mov qword [rsp + 0x30], r12
jmp 0x1401d68a9
lea rcx, [rsp + 0x30]
call fcn.1401ff260
movsxd r9, dword [rbx + 0xc]
mov eax, dword [rsp + 0x38]
inc eax
movsxd rdx, eax
mov r8, qword [rbx]
mov rcx, qword [rsp + 0x30]
call fcn.1402bd21c
mov edx, dword [rbx + 0xc]
lea rcx, [rsp + 0x30]
call fcn.140200570
nop
lea rdx, [0x1403572b0]
lea rcx, [rsp + 0x30]
call fcn.1401fd8b0
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x1401d690b
inc esi
mov r8d, dword [rbx + 0xc]
sub r8d, esi
mov edx, esi
mov rcx, rbx
call fcn.140200670
lea rdx, [rsp + 0x7c]
mov rcx, rbx
call fcn.1401fd8b0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
cmp dword [rsp + 0x38], 0
jle 0x1401d691c
mov rcx, qword [rsp + 0x30]
call fcn.1402b9c20
mov r8d, 1
lea rdx, [0x140360f58]
mov rcx, rbx
call fcn.1401fefd0
test al, al
je 0x1401d69a4
mov r8d, 0x400
lea rdx, [rbp + 0x1a0]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
je 0x1401d69a4
lea rax, [rbp + 0x1a0]
mov rsi, rdi
nop dword [rax]
inc rsi
cmp word [rax + rsi*2], 0
jne 0x1401d6960
test esi, esi
jle 0x1401d6994
mov edx, esi
mov rcx, rbx
call fcn.1401ff260
movsxd r9, esi
mov eax, dword [rbx + 8]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x1a0]
mov rcx, qword [rbx]
call fcn.1402bd21c
jmp 0x1401d699a
cmp dword [rbx + 0xc], 0
jle 0x1401d69a4
mov edx, esi
mov rcx, rbx
call fcn.140200570
mov edx, 0x5c
mov rcx, qword [rbx]
call fcn.1402bcdb4
test rax, rax
jne 0x1401d6bb4
lea r8d, [rax + 1]
lea rdx, [0x140347c20]
mov rcx, rbx
call fcn.1401fefd0
test al, al
jne 0x1401d6aeb
mov qword [rsp + 0x38], r15
mov edx, dword [rbx + 0xc]
test edx, edx
jne 0x1401d69e8
mov qword [rsp + 0x30], r12
jmp 0x1401d6a0c
lea rcx, [rsp + 0x30]
call fcn.1401ff260
movsxd r9, dword [rbx + 0xc]
mov eax, dword [rsp + 0x38]
inc eax
movsxd rdx, eax
mov r8, qword [rbx]
mov rcx, qword [rsp + 0x30]
call fcn.1402bd21c
mov edx, dword [rbx + 0xc]
lea rcx, [rsp + 0x30]
call fcn.140200570
nop
lea rdx, [0x14034de00]
lea rcx, [rsp + 0x30]
call fcn.1401fd8b0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x1a0]
mov qword [rsp + 0x20], rax
mov r9d, 0x400
xor r8d, r8d
mov rdx, qword [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
jne 0x1401d6ad8
mov edx, dword [rbx + 0xc]
lea rcx, [rsp + 0x30]
call fcn.1401ff260
movsxd r9, dword [rbx + 0xc]
mov eax, dword [rsp + 0x38]
inc eax
movsxd rdx, eax
mov r8, qword [rbx]
mov rcx, qword [rsp + 0x30]
call fcn.1402bd21c
mov edx, dword [rbx + 0xc]
lea rcx, [rsp + 0x30]
call fcn.140200570
lea rdx, str..dll
lea rcx, [rsp + 0x30]
call fcn.1401fd8b0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x1a0]
mov qword [rsp + 0x20], rax
mov r9d, 0x400
xor r8d, r8d
mov rdx, qword [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
jne 0x1401d6ad8
mov word [rbp + 0x1a0], r15w
cmp dword [rsp + 0x38], 0
jle 0x1401d6b57
mov rcx, qword [rsp + 0x30]
call fcn.1402b9c20
jmp 0x1401d6b57
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x1a0]
mov qword [rsp + 0x20], rax
mov r9d, 0x400
xor r8d, r8d
mov rdx, qword [rbx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
jne 0x1401d6b57
mov edx, 0x400
lea rcx, [rbp + 0x1a0]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea r8, [0x140347f58]
mov edx, 0x400
lea rcx, [rbp + 0x1a0]
call fcn.1402bbbd8
mov r8, qword [rbx]
mov edx, 0x400
lea rcx, [rbp + 0x1a0]
call fcn.1402bbbd8
cmp word [rbp + 0x1a0], 0
je 0x1401d6bb4
lea rax, [rbp + 0x1a0]
nop dword [rax + rax]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x1401d6b70
test edi, edi
jle 0x1401d6ba4
mov edx, edi
mov rcx, rbx
call fcn.1401ff260
movsxd r9, edi
mov eax, dword [rbx + 8]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x1a0]
mov rcx, qword [rbx]
call fcn.1402bd21c
jmp 0x1401d6baa
cmp dword [rbx + 0xc], 0
jle 0x1401d6bb4
mov edx, edi
mov rcx, rbx
call fcn.140200570
mov r8d, 1
lea rdx, [0x140347c20]
mov rcx, rbx
call fcn.1401ff110
test al, al
je 0x1401d6c26
mov r9d, dword [rbx + 0xc]
dec r9d
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140201490
mov rdi, rax
mov edx, dword [rax + 0xc]
mov rcx, rbx
call fcn.1401ff260
movsxd r9, dword [rdi + 0xc]
mov edx, dword [rbx + 8]
inc edx
movsxd rdx, edx
mov r8, qword [rdi]
mov rcx, qword [rbx]
call fcn.1402bd21c
mov edx, dword [rdi + 0xc]
mov rcx, rbx
call fcn.140200570
nop
cmp dword [rsp + 0x38], 0
jle 0x1401d6c26
mov rcx, qword [rsp + 0x30]
call fcn.1402b9c20
mov rcx, qword [rbp + 0x9a0]
xor rcx, rsp
call fcn.1402b9610
lea r11, [rsp + 0xab0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret