Function at 0x18000d38c
Capabilities:
Get common file path
Get session user name

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov qword [rcx + 0x18], rdx
mov rcx, rdx
call qword [sym.imp.msvcrt.dll_wcslen]
mov rdx, qword [rbx + 0x18]
lea rcx, [rdx + rax*2 + 2]
mov qword [rbx + 0x20], rcx
call qword [sym.imp.msvcrt.dll_wcslen]
mov rdx, qword [rbx + 0x20]
lea rax, [rdx + rax*2 + 2]
mov rcx, rbx
mov qword [rbx + 0x28], rax
add rsp, 0x20
pop rbx
jmp 0x18000d38c
push rbp
push rbx
push rsi
push rdi
push r12
push r13
lea rbp, [rsp - 0x2f]
sub rsp, 0xa8
mov r12, qword [rcx + 0x18]
mov rdi, rcx
mov rcx, qword [rcx + 8]
mov edx, 8
mov r8d, 0x802
mov dword [rbp + 0x6f], 0x401
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
jne 0x18000d3d3
xor al, al
jmp 0x18000d68c
lea rdx, [rbp + 0x6f]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x18000d3f5
mov rcx, qword [rdi + 8]
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x18000d3cc
mov rcx, qword [rdi + 0x20]
call qword [sym.imp.msvcrt.dll_wcslen]
mov rcx, rsi
mov rbx, rax
call qword [sym.imp.msvcrt.dll_wcslen]
mov rcx, qword [rdi + 8]
lea rbx, [rbx + rax + 0x400]
mov edx, 8
lea r8, [rbx + rbx]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r13, rax
test rax, rax
je 0x18000d3e4
mov r9, qword [rdi + 0x20]
lea r8, str._s____s
mov rdx, rbx
mov rcx, rax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.msvcrt.dll__snwprintf]
mov rcx, qword [rdi + 0x10]
mov rdx, r13
mov rax, qword [rcx]
call qword [rax + 0x38]
mov rcx, qword [rdi + 0x10]
lea rdx, [rbp + 0x77]
mov rax, qword [rcx]
mov qword [rsp + 0x20], rdx
lea r9, [0x180039898]
lea r8, [0x1800398b8]
mov rdx, r13
call qword [rax + 0x40]
mov rcx, qword [rdi + 8]
mov r8, r13
xor edx, edx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test ebx, ebx
js 0x18000d3e4
mov rcx, qword [rbp + 0x77]
mov rdx, qword [rdi + 0x28]
mov rax, qword [rcx]
call qword [rax + 0x90]
mov rcx, qword [rbp + 0x77]
test eax, eax
mov rax, qword [rcx]
jns 0x18000d4b8
call qword [rax + 0x10]
jmp 0x18000d3e4
xor r8d, r8d
mov rdx, rsi
call qword [rax + 0xf0]
mov rcx, qword [rdi + 8]
mov r8, rsi
xor edx, edx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rbp + 0x77]
mov rax, qword [rcx]
test ebx, ebx
jns 0x18000d4e8
call qword [rax + 0x10]
jmp 0x18000d3cc
mov edx, 0x2200
call qword [rax + 0xe0]
mov rcx, qword [rbp + 0x77]
test eax, eax
mov rax, qword [rcx]
js 0x18000d4e0
mov rdx, r12
call qword [rax + 0x100]
mov rcx, qword [rbp + 0x77]
test eax, eax
mov rax, qword [rcx]
js 0x18000d4e0
lea r8, [rbp + 0x7f]
lea rdx, [rbp + 0x67]
call qword [rax + 0x18]
test eax, eax
jns 0x18000d52a
mov rcx, qword [rbp + 0x77]
mov rax, qword [rcx]
jmp 0x18000d4e0
mov rcx, qword [rdi + 8]
mov edx, 8
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
jne 0x18000d553
mov rcx, qword [rbp + 0x7f]
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x18000d521
mov edx, 0x400
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x18000d547
and qword [rsp + 0x30], 0
xor r9d, r9d
mov edx, 0x80000000
lea r12d, [r9 + 1]
mov rcx, rbx
mov dword [rsp + 0x28], 0x2000008
mov r8d, r12d
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rcx, qword [rdi + 8]
mov r8, rbx
xor edx, edx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp rsi, 0xffffffffffffffff
je 0x18000d547
lea rdx, [rbp - 0x31]
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x18000d547
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbp - 0x19]
lea rcx, [rbp - 0x31]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
lea r8, [rbp - 0x29]
lea rdx, [rbp - 0x19]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
lea ebx, [r12 + 0x2f]
lea rcx, [rbp - 9]
mov r8d, ebx
xor edx, edx
call qword [sym.imp.msvcrt.dll_memset]
movzx eax, word [rbp - 0x27]
movzx r11d, word [rbp - 0x23]
mov rcx, qword [rbp + 0x7f]
mov word [rbp - 3], ax
movzx eax, word [rbp - 0x29]
mov word [rbp - 5], ax
mov word [rbp - 1], r11w
mov word [rbp - 9], bx
mov dword [rbp + 0x17], 7
mov rax, qword [rcx]
lea rdx, [rbp - 9]
call qword [rax + 0x18]
mov rcx, qword [rbp + 0x7f]
mov rdx, qword [rcx]
mov ebx, eax
call qword [rdx + 0x10]
mov rcx, qword [rbp + 0x77]
mov rax, qword [rcx]
test ebx, ebx
js 0x18000d4e0
lea r8, [rbp - 0x39]
lea rdx, [0x1800398d8]
call qword [rax]
mov rcx, qword [rbp + 0x77]
mov rdx, qword [rcx]
mov ebx, eax
call qword [rdx + 0x10]
test ebx, ebx
js 0x18000d3cc
mov rcx, qword [rbp - 0x39]
mov r8d, r12d
xor edx, edx
mov rax, qword [rcx]
call qword [rax + 0x30]
mov rcx, qword [rbp - 0x39]
mov rdx, qword [rcx]
mov ebx, eax
call qword [rdx + 0x10]
test ebx, ebx
setns al
add rsp, 0xa8
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret