The function #61 exported by the shell32.dll uses an internal name RunFileDlg.
So, there is no surprise that running:
rundll32.exe shell32.dll, #61
presents us the familiar Run Dialog Box:
shell32.dll, #61
Shell32.dll, #44 lolbin
There is a well known shell32.dll lolbas that relies on a function called Control_RunDLL. BUT, there is one more. The shell32.dll library exports a function called Control_RunDLLNoFallback under ordinal #44.
We can use it to launch CPL files using the syntax below:
"C:\windows\SysWOW64\rundll32.exe" "C:\windows\SysWOW64\shell32.dll",#44 "<localpath>.cpl"
I didn’t discover this technique – it was observed being used by various malware families including RaspberryRobin.