Function at 0x140018d30
Capabilities:
Get common file path
Get startup folder

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
mov eax, 0x26f0
call fcn.14028b850
sub rsp, rax
mov qword [rsp + 0x26d8], 0xfffffffffffffffe
mov rax, qword [0x1403710d8]
xor rax, rsp
mov qword [rsp + 0x26e0], rax
mov rax, qword [rsp + 0x2708]
mov dword [rax], 0
mov qword [rsp + 0xf0], 0
mov dword [rsp + 0x6c], 0
lea rcx, [rsp + 0x38]
call fcn.14002b4a0
nop
lea rcx, [rsp + 0x38]
call fcn.14002b4f0
mov dword [rsp + 0x70], eax
cmp dword [rsp + 0x70], 1
jne 0x140018e40
lea rax, [rsp + 0x6c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x38]
call fcn.14002b720
test eax, eax
jne 0x140018e3e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x108], eax
xor r8d, r8d
lea rdx, str...............AhnLabCommonMedicineFramework2.5TrunkSrcCommonClassEnumUserInfo.cpp
lea rcx, [0x1403749c0]
call fcn.14002d540
mov r8d, dword [rsp + 0x108]
lea rdx, str._CEnumUserInfo::UpdateAllVariables__wtses___u
lea rcx, [0x1403749c0]
call fcn.14002d6f0
mov eax, dword [rsp + 0x108]
mov dword [rsp + 0x26a0], eax
lea rcx, [rsp + 0x38]
call fcn.14002b4d0
mov eax, dword [rsp + 0x26a0]
jmp 0x140019ad2
jmp 0x140018e72
xor r8d, r8d
lea rdx, str...............AhnLabCommonMedicineFramework2.5TrunkSrcCommonClassEnumUserInfo.cpp
lea rcx, [0x1403749c0]
call fcn.14002d540
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str._CEnumUserInfo::UpdateAllVariables__Wtsapi32.dll_load_is_failed___u
lea rcx, [0x1403749c0]
call fcn.14002d6f0
cmp qword [rsp + 0xf0], 0
jne 0x140018edd
mov dword [rsp + 0x10c], 8
xor r8d, r8d
lea rdx, str...............AhnLabCommonMedicineFramework2.5TrunkSrcCommonClassEnumUserInfo.cpp
lea rcx, [0x1403749c0]
call fcn.14002d540
mov r8d, dword [rsp + 0x10c]
lea rdx, str._CEnumUserInfo::UpdateAllVariables__wtses2___u
lea rcx, [0x1403749c0]
call fcn.14002d6f0
mov eax, dword [rsp + 0x10c]
mov dword [rsp + 0x26a4], eax
lea rcx, [rsp + 0x38]
call fcn.14002b4d0
mov eax, dword [rsp + 0x26a4]
jmp 0x140019ad2
mov dword [rsp + 0x28], 0xa
movss xmm0, dword [0x1402950f0]
movss dword [rsp + 0x20], xmm0
movss xmm3, dword [0x1402950ec]
movss xmm2, dword [0x1402950e8]
mov edx, send
lea rcx, [rsp + 0xa0]
call fcn.14001c550
nop
mov dword [rsp + 0x30], 0
lea r8, [rsp + 0x30]
mov edx, 2
lea rcx, str.SeTcbPrivilege
call fcn.1400185b0
lea rcx, [rsp + 0x78]
call fcn.140029a90
nop
lea rcx, [rsp + 0x78]
call fcn.140029ae0
mov dword [rsp + 0x68], eax
cmp dword [rsp + 0x68], 0
jne 0x140018f86
xor r8d, r8d
lea rdx, str...............AhnLabCommonMedicineFramework2.5TrunkSrcCommonClassEnumUserInfo.cpp
lea rcx, [0x1403749c0]
call fcn.14002d540
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str._CEnumUserInfo::UpdateAllVariables__Userenv.dll_load_is_failed___u
lea rcx, [0x1403749c0]
call fcn.14002d6f0
mov dword [rsp + 0x110], 0
jmp 0x140018fa4
mov eax, dword [rsp + 0x110]
add eax, 1
mov dword [rsp + 0x110], eax
mov eax, dword [rsp + 0x6c]
cmp dword [rsp + 0x110], eax
jae 0x14001998a
mov ecx, dword [rsp + 0x110]
imul rcx, rcx, 0x18
mov rax, qword [rsp + 0xf0]
cmp dword [rax + rcx], 0
jne 0x140018fe6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 6
call fcn.14001af60
test eax, eax
je 0x140018fe6
jmp 0x140018f93
mov ecx, dword [rsp + 0x110]
imul rcx, rcx, 0x18
mov rax, qword [rsp + 0xf0]
cmp dword [rax + rcx + 0x10], 0
je 0x140019077
mov ecx, dword [rsp + 0x110]
imul rcx, rcx, 0x18
mov rax, qword [rsp + 0xf0]
cmp dword [rax + rcx + 0x10], 4
je 0x140019077
xor r8d, r8d
lea rdx, str...............AhnLabCommonMedicineFramework2.5TrunkSrcCommonClassEnumUserInfo.cpp
lea rcx, [0x1403749c0]
call fcn.14002d540
mov edx, dword [rsp + 0x110]
imul rdx, rdx, 0x18
mov ecx, dword [rsp + 0x110]
imul rcx, rcx, 0x18
mov rax, qword [rsp + 0xf0]
mov r9d, dword [rax + rdx + 0x10]
mov rax, qword [rsp + 0xf0]
mov r8d, dword [rax + rcx]
lea rdx, str._CEnumUserInfo::UpdateAllVariables__env_s___u___u
lea rcx, [0x1403749c0]
call fcn.14002d670
jmp 0x140018f93
mov qword [rsp + 0x118], 0
cmp dword [rsp + 0x70], 1
jne 0x1400190f9
mov ecx, dword [rsp + 0x110]
imul rcx, rcx, 0x18
lea r8, [rsp + 0x118]
mov rax, qword [rsp + 0xf0]
mov edx, dword [rax + rcx]
lea rcx, [rsp + 0x38]
call fcn.14002b8b0
test eax, eax
jne 0x1400190f9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x230], eax
xor r8d, r8d
lea rdx, str...............AhnLabCommonMedicineFramework2.5TrunkSrcCommonClassEnumUserInfo.cpp
lea rcx, [0x1403749c0]
call fcn.14002d540
mov r8d, dword [rsp + 0x230]
lea rdx, str._CEnumUserInfo::UpdateAllVariables__wtsqut___u
lea rcx, [0x1403749c0]
call fcn.14002d6f0
jmp 0x140018f93
lea rcx, [rsp + 0x130]
call fcn.140015260
nop
mov rdx, qword [rsp + 0x118]
lea rcx, [rsp + 0x130]
call fcn.1400152e0
lea rcx, [rsp + 0x130]
call fcn.140015310
movzx eax, al
test eax, eax
jne 0x140019175
xor r8d, r8d
lea rdx, str...............AhnLabCommonMedicineFramework2.5TrunkSrcCommonClassEnumUserInfo.cpp
lea rcx, [0x1403749c0]
call fcn.14002d540
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str._CEnumUserInfo::UpdateAllVariables__tgu___u
lea rcx, [0x1403749c0]
call fcn.14002d6f0
nop
lea rcx, [rsp + 0x130]
call fcn.1400152a0
jmp 0x140018f93
lea rcx, [rsp + 0x130]
call fcn.140015440
mov qword [rsp + 0x220], rax
cmp qword [rsp + 0x220], 0
je 0x1400191a7
mov rcx, qword [rsp + 0x220]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x1400191e3
xor r8d, r8d
lea rdx, str...............AhnLabCommonMedicineFramework2.5TrunkSrcCommonClassEnumUserInfo.cpp
lea rcx, [0x1403749c0]
call fcn.14002d540
lea rdx, str._CEnumUserInfo::UpdateAllVariables__tgu2__inv
lea rcx, [0x1403749c0]
call fcn.14002d6f0
nop
lea rcx, [rsp + 0x130]
call fcn.1400152a0
jmp 0x140018f93
mov qword [rsp + 0x228], 0
mov rcx, qword [rsp + 0x2700]
add rcx, 0x50
lea r8, [rsp + 0x228]
mov rdx, qword [rsp + 0x220]
call fcn.14001c640
movzx eax, al
test eax, eax
jne 0x14001933c
mov ecx, 0xa2c
call sub.MSVCR90.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov qword [rsp + 0x26a8], rax
mov rax, qword [rsp + 0x26a8]
mov qword [rsp + 0x228], rax
cmp qword [rsp + 0x228], 0
je 0x1400192ef
mov r8d, 0xa2c
xor edx, edx
mov rcx, qword [rsp + 0x228]
call sub.MSVCR90.dll_memset
mov r8, qword [rsp + 0x220]
mov edx, 0x104
mov rcx, qword [rsp + 0x228]
call fcn.14000af60
xor r8d, r8d
lea rdx, str...............AhnLabCommonMedicineFramework2.5TrunkSrcCommonClassEnumUserInfo.cpp
lea rcx, [0x1403749c0]
call fcn.14002d540
mov r8, qword [rsp + 0x228]
lea rdx, str._CEnumUserInfo::UpdateAllVariables__new___s
lea rcx, [0x1403749c0]
call fcn.14002d670
mov rdx, qword [rsp + 0x2708]
mov dword [rdx], 1
mov rax, qword [rsp + 0x228]
mov dword [rax + 0xa28], 1
mov rcx, qword [rsp + 0x2700]
add rcx, 0x50
lea r8, [rsp + 0x228]
mov rdx, qword [rsp + 0x228]
call fcn.14001c6a0
jmp 0x14001933c
xor r8d, r8d
lea rdx, str...............AhnLabCommonMedicineFramework2.5TrunkSrcCommonClassEnumUserInfo.cpp
lea rcx, [0x1403749c0]
call fcn.14002d540
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
mov r8, qword [rsp + 0x220]
lea rdx, str._CEnumUserInfo::UpdateAllVariables__pst_alloc_err___s___u
lea rcx, [0x1403749c0]
call fcn.14002d6f0
nop
lea rcx, [rsp + 0x130]
call fcn.1400152a0
jmp 0x140018f93
cmp qword [rsp + 0x228], 0
jne 0x140019383
xor r8d, r8d
lea rdx, str...............AhnLabCommonMedicineFramework2.5TrunkSrcCommonClassEnumUserInfo.cpp
lea rcx, [0x1403749c0]
call fcn.14002d540
lea rdx, str._CEnumUserInfo::UpdateAllVariables__pst_null
lea rcx, [0x1403749c0]
call fcn.14002d6f0
nop
lea rcx, [rsp + 0x130]
call fcn.1400152a0
jmp 0x140018f93
mov qword [rsp + 0x26b0], 0
lea r8, [rsp + 0x26b0]
mov rdx, qword [rsp + 0x228]
lea rcx, [rsp + 0xa0]
call fcn.14001c6a0
mov rax, qword [rsp + 0x228]
add rax, 0x820
mov qword [rsp + 0x1b0], rax
mov dword [rsp + 0x1b8], 0x104
lea rax, str._TEMP_
mov qword [rsp + 0x1c0], rax
lea rax, str._TEMP_ALLUSERS_
mov qword [rsp + 0x1c8], rax
mov qword [rsp + 0x238], 0
jmp 0x14001940d
mov rax, qword [rsp + 0x238]
add rax, 1
mov qword [rsp + 0x238], rax
cmp qword [rsp + 0x238], 1
jae 0x140019682
mov rax, qword [rsp + 0x238]
imul rax, rax, 0x20
lea rax, [rsp + rax + 0x1b0]
mov qword [rsp + 0x458], rax
xor eax, eax
mov word [rsp + 0x240], ax
lea rdi, [rsp + 0x242]
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
mov dword [rsp + 0x450], 0x104
cmp dword [rsp + 0x68], 1
jne 0x14001967d
mov eax, dword [rsp + 0x450]
mov dword [rsp + 0x20], eax
lea r9, [rsp + 0x240]
mov r8, qword [rsp + 0x458]
mov r8, qword [r8 + 0x10]
mov rdx, qword [rsp + 0x118]
lea rcx, [rsp + 0x78]
call fcn.140029dd0
test eax, eax
je 0x14001963f
xor eax, eax
mov word [rsp + 0x460], ax
lea rdi, [rsp + 0x462]
xor eax, eax
mov ecx, 0x1ffe
rep stosb byte [rdi], al
mov r8d, 0x1000
lea rdx, [rsp + 0x460]
lea rcx, [rsp + 0x240]
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
jne 0x1400194f7
lea r8, [rsp + 0x240]
mov edx, 0x1000
lea rcx, [rsp + 0x460]
call fcn.14000af60
xor r8d, r8d
lea rdx, str...............AhnLabCommonMedicineFramework2.5TrunkSrcCommonClassEnumUserInfo.cpp
lea rcx, [0x1403749c0]
call fcn.14002d540
lea rdx, [rsp + 0x460]
mov qword [rsp + 0x20], rdx
mov r9, qword [rsp + 0x458]
mov r9, qword [r9]
mov r8, qword [rsp + 0x458]
mov r8, qword [r8 + 0x10]
lea rdx, str._CEnumUserInfo::UpdateAllVariables__Diff___s:__s______s
lea rcx, [0x1403749c0]
call fcn.14002d670
lea rdx, [rsp + 0x460]
mov rcx, qword [rsp + 0x458]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1400195f5
mov rax, qword [rsp + 0x2708]
mov dword [rax], 1
mov rax, qword [rsp + 0x228]
mov dword [rax + 0xa28], 1
xor r8d, r8d
lea rdx, str...............AhnLabCommonMedicineFramework2.5TrunkSrcCommonClassEnumUserInfo.cpp
lea rcx, [0x1403749c0]
call fcn.14002d540
lea rdx, [rsp + 0x460]
mov qword [rsp + 0x20], rdx
mov r9, qword [rsp + 0x458]
mov r9, qword [r9]
mov r8, qword [rsp + 0x458]
mov r8, qword [r8 + 0x10]
lea rdx, str._CEnumUserInfo::UpdateAllVariables__Update___s:__s_____s
lea rcx, [0x1403749c0]
call fcn.14002d670
mov rdx, qword [rsp + 0x458]
mov edx, dword [rdx + 8]
lea r8, [rsp + 0x460]
mov rcx, qword [rsp + 0x458]
mov rcx, qword [rcx]
call fcn.14000af60
mov rdx, qword [rsp + 0x458]
mov rdx, qword [rdx]
lea rcx, [rsp + 0x26b8]
call fcn.140012e40
nop
lea r8, [rsp + 0x26b8]
mov rdx, qword [rsp + 0x458]
mov rdx, qword [rdx + 0x18]
mov rcx, qword [rsp + 0x2700]
call fcn.140019b00
nop
lea rcx, [rsp + 0x26b8]
call fcn.140012ea0
jmp 0x14001967d
xor r8d, r8d
lea rdx, str...............AhnLabCommonMedicineFramework2.5TrunkSrcCommonClassEnumUserInfo.cpp
lea rcx, [0x1403749c0]
call fcn.14002d540
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
mov r8, qword [rsp + 0x458]
mov r8, qword [r8 + 0x10]
lea rdx, str._CEnumUserInfo::UpdateAllVariables__EESS___s___u
lea rcx, [0x1403749c0]
call fcn.14002d6f0
jmp 0x1400193f9
mov rax, qword [rsp + 0x228]
add rax, 0x208
mov qword [rsp + 0x1d0], rax
mov dword [rsp + 0x1d8], 0x104
mov dword [rsp + 0x1dc], 0x28
lea rax, str._USERPROFILE_ALLUSERS_
mov qword [rsp + 0x1e0], rax
mov rax, qword [rsp + 0x228]
add rax, 0x410
mov qword [rsp + 0x1e8], rax
mov dword [rsp + 0x1f0], 0x104
mov dword [rsp + 0x1f4], 0x1a
lea rax, str._APPDATA_ALLUSERS_
mov qword [rsp + 0x1f8], rax
mov rax, qword [rsp + 0x228]
add rax, 0x618
mov qword [rsp + 0x200], rax
mov dword [rsp + 0x208], 0x104
mov dword [rsp + 0x20c], 0x1c
lea rax, str._LOCALAPPDATA_ALLUSERS_
mov qword [rsp + 0x210], rax
mov qword [rsp + 0x2460], 0
jmp 0x140019755
mov rax, qword [rsp + 0x2460]
add rax, 1
mov qword [rsp + 0x2460], rax
cmp qword [rsp + 0x2460], 3
jae 0x140019978
mov rax, qword [rsp + 0x2460]
imul rax, rax, 0x18
lea rax, [rsp + rax + 0x1d0]
mov qword [rsp + 0x2680], rax
xor eax, eax
mov word [rsp + 0x2470], ax
lea rdi, [rsp + 0x2472]
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rax, [rsp + 0x2470]
mov qword [rsp + 0x20], rax
mov r9d, 1
mov r8, qword [rsp + 0x118]
mov rax, qword [rsp + 0x2680]
mov edx, dword [rax + 0xc]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov dword [rsp + 0x2688], eax
cmp dword [rsp + 0x2688], 0
jl 0x140019926
xor r8d, r8d
lea rdx, str...............AhnLabCommonMedicineFramework2.5TrunkSrcCommonClassEnumUserInfo.cpp
lea rcx, [0x1403749c0]
call fcn.14002d540
lea rdx, [rsp + 0x2470]
mov qword [rsp + 0x20], rdx
mov r9, qword [rsp + 0x2680]
mov r9, qword [r9]
mov rax, qword [rsp + 0x2680]
mov r8d, dword [rax + 0xc]
lea rdx, str._CEnumUserInfo::UpdateAllVariables__DiffS___d:__s______s
lea rcx, [0x1403749c0]
call fcn.14002d670
lea rdx, [rsp + 0x2470]
mov rcx, qword [rsp + 0x2680]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1400198dc
mov rax, qword [rsp + 0x2708]
mov dword [rax], 1
mov rax, qword [rsp + 0x228]
mov dword [rax + 0xa28], 1
xor r8d, r8d
lea rdx, str...............AhnLabCommonMedicineFramework2.5TrunkSrcCommonClassEnumUserInfo.cpp
lea rcx, [0x1403749c0]
call fcn.14002d540
lea rdx, [rsp + 0x2470]
mov qword [rsp + 0x20], rdx
mov r9, qword [rsp + 0x2680]
mov r9, qword [r9]
mov rax, qword [rsp + 0x2680]
mov r8d, dword [rax + 0xc]
lea rdx, str._CEnumUserInfo::UpdateAllVariables__UpdateS___d:__s_____s
lea rcx, [0x1403749c0]
call fcn.14002d670
mov rdx, qword [rsp + 0x2680]
mov edx, dword [rdx + 8]
lea r8, [rsp + 0x2470]
mov rcx, qword [rsp + 0x2680]
mov rcx, qword [rcx]
call fcn.14000af60
mov rdx, qword [rsp + 0x2680]
mov rdx, qword [rdx]
lea rcx, [rsp + 0x26c0]
call fcn.140012e40
nop
lea r8, [rsp + 0x26c0]
mov rdx, qword [rsp + 0x2680]
mov rdx, qword [rdx + 0x10]
mov rcx, qword [rsp + 0x2700]
call fcn.140019b00
nop
lea rcx, [rsp + 0x26c0]
call fcn.140012ea0
jmp 0x140019973
xor r8d, r8d
lea rdx, str...............AhnLabCommonMedicineFramework2.5TrunkSrcCommonClassEnumUserInfo.cpp
lea rcx, [0x1403749c0]
call fcn.14002d540
mov eax, dword [rsp + 0x2688]
and eax, 0xffff
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x2688]
mov rax, qword [rsp + 0x2680]
mov r8d, dword [rax + 0xc]
lea rdx, str._CEnumUserInfo::UpdateAllVariables__EESSS___d__0x08_x___u
lea rcx, [0x1403749c0]
call fcn.14002d6f0
jmp 0x140019741
lea rcx, [rsp + 0x130]
call fcn.1400152a0
jmp 0x140018f93
cmp dword [rsp + 0x70], 1
jne 0x1400199a3
mov rdx, qword [rsp + 0xf0]
lea rcx, [rsp + 0x38]
call fcn.14002b860
mov qword [rsp + 0xf0], 0
mov rcx, qword [rsp + 0x2700]
add rcx, 0x50
call fcn.14001c410
mov qword [rsp + 0x100], rax
mov qword [rsp + 0xf8], 0
cmp qword [rsp + 0x100], 0
je 0x140019a9d
mov rcx, qword [rsp + 0x2700]
add rcx, 0x50
lea rdx, [rsp + 0x100]
call fcn.14001c7b0
mov qword [rsp + 0xf8], rax
cmp qword [rsp + 0xf8], 0
jne 0x140019a11
jmp 0x1400199d4
mov rax, qword [rsp + 0xf8]
mov rax, qword [rax + 8]
mov qword [rsp + 0x2698], rax
cmp qword [rsp + 0x2698], 0
jne 0x140019a32
jmp 0x1400199d4
mov qword [rsp + 0x2690], 0
lea r8, [rsp + 0x2690]
mov rdx, qword [rsp + 0x2698]
lea rcx, [rsp + 0xa0]
call fcn.14001c640
movzx eax, al
test eax, eax
jne 0x140019a98
mov rcx, qword [rsp + 0x2700]
add rcx, 0x50
mov rdx, qword [rsp + 0x2698]
call fcn.14001c740
mov rax, qword [rsp + 0x2698]
mov qword [rsp + 0x26c8], rax
mov rcx, qword [rsp + 0x26c8]
call sub.MSVCR90.dll_void___cdecl_operator_delete_void____ptr64_
jmp 0x1400199d4
mov dword [rsp + 0x26d0], 0
lea rcx, [rsp + 0x78]
call fcn.140029ac0
nop
lea rcx, [rsp + 0xa0]
call fcn.14001c520
nop
lea rcx, [rsp + 0x38]
call fcn.14002b4d0
mov eax, dword [rsp + 0x26d0]
mov rcx, qword [rsp + 0x26e0]
xor rcx, rsp
call fcn.14028a900
add rsp, 0x26f0
pop rdi
ret