Function at 0x1401c36c0
Capabilities:
Get common file path
Query environment variable

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x9d8]
sub rsp, 0xab0
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1403eaa10]
xor rax, rsp
mov qword [rbp + 0x9a0], rax
mov rbx, rdx
cmp dword [rdx + 0xc], 0
je 0x1401c3e06
xor r8d, r8d
lea rdx, str.rundll32.exe
mov rcx, rbx
call fcn.1401e9960
mov edi, eax
test eax, eax
js 0x1401c3725
add edi, 0xd
jmp 0x1401c3740
xor r8d, r8d
lea rdx, str.rundll32
mov rcx, rbx
call fcn.1401e9960
mov edi, eax
test eax, eax
js 0x1401c37a4
add edi, 9
test edi, edi
js 0x1401c37a4
cmp edi, dword [rbx + 0xc]
jge 0x1401c37a4
mov edx, 0x2c
mov r8d, edi
mov rcx, rbx
call fcn.1401e9590
mov r8d, edi
lea rdx, [rsp + 0x30]
mov rcx, rbx
test eax, eax
jle 0x1401c3781
sub eax, edi
mov r9d, eax
call fcn.1401eb1b0
nop
mov rdx, rax
mov rcx, rbx
call fcn.1401e7440
nop
jmp 0x1401c3793
call fcn.1401eaef0
nop
mov rdx, rax
mov rcx, rbx
call fcn.1401e7440
nop
cmp dword [rsp + 0x38], 0
jle 0x1401c37a4
mov rcx, qword [rsp + 0x30]
call fcn.140298600
mov r8d, 1
lea rdx, [0x14032c0d4]
mov rcx, rbx
call fcn.1401eb700
mov rcx, rbx
test al, al
je 0x1401c383d
mov r8d, 1
lea rdx, [0x14032c0d4]
call fcn.1401e9840
test eax, eax
jle 0x1401c37f5
mov r8d, dword [rbx + 0xc]
sub r8d, eax
mov edx, eax
mov rcx, rbx
call fcn.1401ea390
xor edx, edx
lea r8d, [rdx + 1]
mov rcx, rbx
call fcn.1401ea390
cmp dword [rbx + 0xc], 0
jle 0x1401c396e
xor edx, edx
mov rcx, rbx
call fcn.1401e7500
cmp ax, 0x25
jne 0x1401c396e
mov r8d, 0x400
lea rdx, [rbp + 0x1a0]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rdx, [rbp + 0x1a0]
mov rcx, rbx
call fcn.1401e7490
jmp 0x1401c396e
xor r8d, r8d
lea rdx, str._globalroot
call fcn.1401eb700
test al, al
jne 0x1401c395e
xor r8d, r8d
lea rdx, str..globalroot
mov rcx, rbx
call fcn.1401eb700
test al, al
jne 0x1401c395e
mov r8d, 1
lea rdx, [0x1403300d8]
mov rcx, rbx
call fcn.1401eb700
test al, al
je 0x1401c3892
mov r8d, 4
jmp 0x1401c3964
cmp dword [rbx + 0xc], 0
jle 0x1401c396e
xor edx, edx
mov rcx, rbx
call fcn.1401e7500
cmp ax, 0x25
jne 0x1401c38d1
mov r8d, 0x400
lea rdx, [rbp + 0x1a0]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rdx, [rbp + 0x1a0]
mov rcx, rbx
call fcn.1401e7490
cmp dword [rbx + 0xc], 0
je 0x1401c3918
mov edx, 0x5c
mov rcx, qword [rbx]
call fcn.14029aea8
test rax, rax
je 0x1401c3918
sub rax, qword [rbx]
sar rax, 1
test eax, eax
jle 0x1401c3918
mov edx, 0x20
mov r8d, eax
mov rcx, rbx
call fcn.1401e9590
test eax, eax
jle 0x1401c3918
mov r8d, dword [rbx + 0xc]
sub r8d, eax
mov edx, eax
mov rcx, rbx
call fcn.1401ea390
lea rdx, [0x14033edc0]
mov rcx, rbx
call fcn.1401e9720
test eax, eax
jle 0x1401c396e
mov r9d, eax
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.1401eb1b0
nop
mov rdx, rax
mov rcx, rbx
call fcn.1401e7440
nop
cmp dword [rsp + 0x38], 0
jle 0x1401c396e
mov rcx, qword [rsp + 0x30]
call fcn.140298600
jmp 0x1401c396e
mov r8d, 0xe
xor edx, edx
mov rcx, rbx
call fcn.1401ea390
xor r8d, r8d
lea rdx, str.system32_
mov rcx, rbx
call fcn.1401eb700
test al, al
je 0x1401c39a0
mov edx, 0x104
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1401c39e7
mov r8d, 8
jmp 0x1401c39d0
xor r8d, r8d
lea rdx, str.SystemRoot_
mov rcx, rbx
call fcn.1401eb700
test al, al
je 0x1401c39e7
mov edx, 0x104
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x1401c39e7
mov r8d, 0xb
xor edx, edx
mov rcx, rbx
call fcn.1401ea390
lea r8, [rsp + 0x50]
mov rcx, rbx
call fcn.1401e9e50
xor r15d, r15d
lea r12, [0x140323de0]
or rdi, 0xffffffffffffffff
cmp dword [rbx + 0xc], r15d
je 0x1401c3afc
lea edx, [rdi + 0x5d]
mov rcx, qword [rbx]
call fcn.14029aea8
mov rsi, rax
test rax, rax
je 0x1401c3afc
mov rcx, qword [rbx]
sub rsi, rcx
sar rsi, 1
test esi, esi
jle 0x1401c3afc
cmp dword [rbx + 0xc], r15d
jne 0x1401c3a31
mov eax, edi
jmp 0x1401c3a4a
mov edx, 0x2e
call fcn.14029aea8
test rax, rax
jne 0x1401c3a44
mov eax, edi
jmp 0x1401c3a4a
sub rax, qword [rbx]
sar rax, 1
cmp eax, esi
jge 0x1401c3afc
mov qword [rsp + 0x38], r15
mov edx, dword [rbx + 0xc]
test edx, edx
jne 0x1401c3a65
mov qword [rsp + 0x30], r12
jmp 0x1401c3a89
lea rcx, [rsp + 0x30]
call fcn.1401e9030
movsxd r9, dword [rbx + 0xc]
mov eax, dword [rsp + 0x38]
inc eax
movsxd rdx, eax
mov r8, qword [rbx]
mov rcx, qword [rsp + 0x30]
call fcn.14029b4d8
mov edx, dword [rbx + 0xc]
lea rcx, [rsp + 0x30]
call fcn.1401ea290
nop
lea rdx, [0x140331794]
lea rcx, [rsp + 0x30]
call fcn.1401e7680
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x1401c3aeb
inc esi
mov r8d, dword [rbx + 0xc]
sub r8d, esi
mov edx, esi
mov rcx, rbx
call fcn.1401ea390
lea rdx, [rsp + 0x7c]
mov rcx, rbx
call fcn.1401e7680
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
cmp dword [rsp + 0x38], 0
jle 0x1401c3afc
mov rcx, qword [rsp + 0x30]
call fcn.140298600
mov r8d, 1
lea rdx, [0x14033a5a8]
mov rcx, rbx
call fcn.1401e8da0
test al, al
je 0x1401c3b84
mov r8d, 0x400
lea rdx, [rbp + 0x1a0]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
je 0x1401c3b84
lea rax, [rbp + 0x1a0]
mov rsi, rdi
nop dword [rax]
inc rsi
cmp word [rax + rsi*2], 0
jne 0x1401c3b40
test esi, esi
jle 0x1401c3b74
mov edx, esi
mov rcx, rbx
call fcn.1401e9030
movsxd r9, esi
mov eax, dword [rbx + 8]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x1a0]
mov rcx, qword [rbx]
call fcn.14029b4d8
jmp 0x1401c3b7a
cmp dword [rbx + 0xc], 0
jle 0x1401c3b84
mov edx, esi
mov rcx, rbx
call fcn.1401ea290
mov edx, 0x5c
mov rcx, qword [rbx]
call fcn.14029b070
test rax, rax
jne 0x1401c3d94
lea r8d, [rax + 1]
lea rdx, [0x140322fd0]
mov rcx, rbx
call fcn.1401e8da0
test al, al
jne 0x1401c3ccb
mov qword [rsp + 0x38], r15
mov edx, dword [rbx + 0xc]
test edx, edx
jne 0x1401c3bc8
mov qword [rsp + 0x30], r12
jmp 0x1401c3bec
lea rcx, [rsp + 0x30]
call fcn.1401e9030
movsxd r9, dword [rbx + 0xc]
mov eax, dword [rsp + 0x38]
inc eax
movsxd rdx, eax
mov r8, qword [rbx]
mov rcx, qword [rsp + 0x30]
call fcn.14029b4d8
mov edx, dword [rbx + 0xc]
lea rcx, [rsp + 0x30]
call fcn.1401ea290
nop
lea rdx, [0x140328b70]
lea rcx, [rsp + 0x30]
call fcn.1401e7680
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x1a0]
mov qword [rsp + 0x20], rax
mov r9d, 0x400
xor r8d, r8d
mov rdx, qword [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
jne 0x1401c3cb8
mov edx, dword [rbx + 0xc]
lea rcx, [rsp + 0x30]
call fcn.1401e9030
movsxd r9, dword [rbx + 0xc]
mov eax, dword [rsp + 0x38]
inc eax
movsxd rdx, eax
mov r8, qword [rbx]
mov rcx, qword [rsp + 0x30]
call fcn.14029b4d8
mov edx, dword [rbx + 0xc]
lea rcx, [rsp + 0x30]
call fcn.1401ea290
lea rdx, str..dll
lea rcx, [rsp + 0x30]
call fcn.1401e7680
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x1a0]
mov qword [rsp + 0x20], rax
mov r9d, 0x400
xor r8d, r8d
mov rdx, qword [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
jne 0x1401c3cb8
mov word [rbp + 0x1a0], r15w
cmp dword [rsp + 0x38], 0
jle 0x1401c3d37
mov rcx, qword [rsp + 0x30]
call fcn.140298600
jmp 0x1401c3d37
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x1a0]
mov qword [rsp + 0x20], rax
mov r9d, 0x400
xor r8d, r8d
mov rdx, qword [rbx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
jne 0x1401c3d37
mov edx, 0x400
lea rcx, [rbp + 0x1a0]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea r8, [0x1403232c8]
mov edx, 0x400
lea rcx, [rbp + 0x1a0]
call fcn.14029a500
mov r8, qword [rbx]
mov edx, 0x400
lea rcx, [rbp + 0x1a0]
call fcn.14029a500
cmp word [rbp + 0x1a0], 0
je 0x1401c3d94
lea rax, [rbp + 0x1a0]
nop dword [rax + rax]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x1401c3d50
test edi, edi
jle 0x1401c3d84
mov edx, edi
mov rcx, rbx
call fcn.1401e9030
movsxd r9, edi
mov eax, dword [rbx + 8]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x1a0]
mov rcx, qword [rbx]
call fcn.14029b4d8
jmp 0x1401c3d8a
cmp dword [rbx + 0xc], 0
jle 0x1401c3d94
mov edx, edi
mov rcx, rbx
call fcn.1401ea290
mov r8d, 1
lea rdx, [0x140322fd0]
mov rcx, rbx
call fcn.1401e8ee0
test al, al
je 0x1401c3e06
mov r9d, dword [rbx + 0xc]
dec r9d
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.1401eb1b0
mov rdi, rax
mov edx, dword [rax + 0xc]
mov rcx, rbx
call fcn.1401e9030
movsxd r9, dword [rdi + 0xc]
mov edx, dword [rbx + 8]
inc edx
movsxd rdx, edx
mov r8, qword [rdi]
mov rcx, qword [rbx]
call fcn.14029b4d8
mov edx, dword [rdi + 0xc]
mov rcx, rbx
call fcn.1401ea290
nop
cmp dword [rsp + 0x38], 0
jle 0x1401c3e06
mov rcx, qword [rsp + 0x30]
call fcn.140298600
mov rcx, qword [rbp + 0x9a0]
xor rcx, rsp
call fcn.140297ff0
lea r11, [rsp + 0xab0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret