Function at 0x18000a3b0
Capabilities:
Get common file path
Get session user name

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rax - 0x258]
sub rsp, 0x340
movaps xmmword [rax - 0x28], xmm6
movaps xmmword [rax - 0x38], xmm7
mov rax, qword [0x180078040]
xor rax, rsp
mov qword [rbp + 0x210], rax
mov rsi, rcx
xor r14d, r14d
mov edx, 0x104
lea rcx, [rbp]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov rbx, 0xffffffffffffffff
xorps xmm0, xmm0
mov qword [rbp - 0x38], r14
mov qword [rbp - 0x30], r14
movups xmmword [rbp - 0x48], xmm0
test eax, eax
jne 0x18000a421
xor r8d, r8d
lea rdx, [0x18006e8b0]
jmp 0x18000a43e
lea rax, [rbp]
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], r14w
jne 0x18000a430
lea rdx, [rbp]
lea rcx, [rbp - 0x48]
call fcn.180007c60
nop
mov dword [rsp + 0x70], 0x104
lea rdx, [rsp + 0x70]
lea rcx, [rbp]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
xorps xmm0, xmm0
mov qword [rbp - 0x78], r14
mov qword [rbp - 0x70], r14
movups xmmword [rsp + 0x78], xmm0
test eax, eax
jne 0x18000a47f
xor r8d, r8d
lea rdx, [0x18006e8b0]
jmp 0x18000a494
lea rax, [rbp]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x18000a483
mov r8, rbx
lea rdx, [rbp]
lea rcx, [rsp + 0x78]
call fcn.180007c60
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x58], r14
mov qword [rbp - 0x50], r14
xor r8d, r8d
lea rdx, [0x18006e8b0]
lea rcx, [rbp - 0x68]
call fcn.180007c60
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x18], xmm1
mov r8d, 1
cmp qword [rbp - 0x38], r8
cmovb r8, qword [rbp - 0x38]
lea rdx, [rbp - 0x48]
cmp qword [rbp - 0x30], 7
cmova rdx, qword [rbp - 0x48]
lea rcx, [rbp - 0x28]
call fcn.180007c60
nop
cmp dword [0x18007b988], 0
je 0x18000a6d3
lea r8, str.:Users_
lea rdx, [rbp - 0x28]
lea rcx, [rsp + 0x50]
call fcn.180007850
nop
lea rdx, [rsp + 0x78]
cmp qword [rbp - 0x70], 7
cmova rdx, qword [rsp + 0x78]
mov r8, qword [rbp - 0x78]
mov rcx, rax
call fcn.1800071b0
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
mov rdi, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
sub rax, rdi
cmp rax, 0x1c
jb 0x18000a5ba
lea rax, [rdi + 0x1c]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x30]
cmp rcx, 7
cmova rbx, qword [rsp + 0x30]
lea rcx, [rbx + rdi*2]
mov r8d, 0x38
lea rdx, str.AppDataLocalGoogleChrome
call fcn.18005f780
mov word [rbx + rdi*2 + 0x38], r14w
lea rax, [rsp + 0x30]
jmp 0x18000a5dc
mov qword [rsp + 0x20], 0x1c
lea r9, str.AppDataLocalGoogleChrome
xor r8d, r8d
mov edx, 0x1c
lea rcx, [rsp + 0x30]
call fcn.180008ef0
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
mov rdx, qword [rbp - 0x50]
cmp rdx, 7
jbe 0x18000a633
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000a62e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000abe0
call fcn.180030860
movups xmmword [rbp - 0x68], xmm6
movups xmmword [rbp - 0x58], xmm7
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x18000a67d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000a678
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000abe6
call fcn.180030860
movdqa xmm0, xmmword [0x18006ef90]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x30], r14w
mov rdx, qword [rsp + 0x68]
cmp rdx, 7
jbe 0x18000a6d3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000a6ce
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000abec
call fcn.180030860
cmp dword [0x18007b77c], 0
je 0x18000a8ae
lea r8, str.:Users_
lea rdx, [rbp - 0x28]
lea rcx, [rsp + 0x50]
call fcn.180007850
nop
lea rdx, [rsp + 0x78]
cmp qword [rbp - 0x70], 7
cmova rdx, qword [rsp + 0x78]
mov r8, qword [rbp - 0x78]
mov rcx, rax
call fcn.1800071b0
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
mov rdi, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
sub rax, rdi
cmp rax, 0x21
jb 0x18000a795
lea rax, [rdi + 0x21]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x30]
cmp rcx, 7
cmova rbx, qword [rsp + 0x30]
lea rcx, [rbx + rdi*2]
mov r8d, 0x42
lea rdx, str.AppDataLocalGoogleChrome_Beta
call fcn.18005f780
mov word [rbx + rdi*2 + 0x42], r14w
lea rax, [rsp + 0x30]
jmp 0x18000a7b7
mov qword [rsp + 0x20], 0x21
lea r9, str.AppDataLocalGoogleChrome_Beta
xor r8d, r8d
mov edx, 0x21
lea rcx, [rsp + 0x30]
call fcn.180008ef0
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
mov rdx, qword [rbp - 0x50]
cmp rdx, 7
jbe 0x18000a80e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000a809
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000abf2
call fcn.180030860
movups xmmword [rbp - 0x68], xmm6
movups xmmword [rbp - 0x58], xmm7
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x18000a858
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000a853
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000abf8
call fcn.180030860
movdqa xmm0, xmmword [0x18006ef90]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x30], r14w
mov rdx, qword [rsp + 0x68]
cmp rdx, 7
jbe 0x18000a8ae
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000a8a9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000abfe
call fcn.180030860
cmp dword [0x18007b778], 0
je 0x18000aa89
lea r8, str.:Users_
lea rdx, [rbp - 0x28]
lea rcx, [rsp + 0x50]
call fcn.180007850
nop
lea rdx, [rsp + 0x78]
cmp qword [rbp - 0x70], 7
cmova rdx, qword [rsp + 0x78]
mov r8, qword [rbp - 0x78]
mov rcx, rax
call fcn.1800071b0
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
mov rdi, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
sub rax, rdi
cmp rax, 0x1d
jb 0x18000a970
lea rax, [rdi + 0x1d]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x30]
cmp rcx, 7
cmova rbx, qword [rsp + 0x30]
lea rcx, [rbx + rdi*2]
mov r8d, 0x3a
lea rdx, str.AppDataLocalMicrosoftEdge
call fcn.18005f780
mov word [rbx + rdi*2 + 0x3a], r14w
lea rax, [rsp + 0x30]
jmp 0x18000a992
mov qword [rsp + 0x20], 0x1d
lea r9, str.AppDataLocalMicrosoftEdge
xor r8d, r8d
mov edx, 0x1d
lea rcx, [rsp + 0x30]
call fcn.180008ef0
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
mov rdx, qword [rbp - 0x50]
cmp rdx, 7
jbe 0x18000a9e9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000a9e4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000ac04
call fcn.180030860
movups xmmword [rbp - 0x68], xmm6
movups xmmword [rbp - 0x58], xmm7
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x18000aa33
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000aa2e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000ac0a
call fcn.180030860
movdqa xmm0, xmmword [0x18006ef90]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x30], r14w
mov rdx, qword [rsp + 0x68]
cmp rdx, 7
jbe 0x18000aa89
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000aa84
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000ac10
call fcn.180030860
cmp qword [rbp - 0x58], 0
je 0x18000aaa4
mov rdx, rsi
lea rcx, [rbp - 0x68]
call fcn.180002bf0
test al, al
je 0x18000aaa4
mov bl, 1
jmp 0x18000aaa6
xor bl, bl
mov rdx, qword [rbp - 0x10]
cmp rdx, 7
jbe 0x18000aae7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000aae1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000ac16
call fcn.180030860
nop
mov rdx, qword [rbp - 0x50]
cmp rdx, 7
jbe 0x18000ab28
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000ab22
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000ac1c
call fcn.180030860
nop
mov rdx, qword [rbp - 0x70]
cmp rdx, 7
jbe 0x18000ab6a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000ab64
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000ac22
call fcn.180030860
nop
mov rdx, qword [rbp - 0x30]
cmp rdx, 7
jbe 0x18000aba6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000aba1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000abda
call fcn.180030860
movzx eax, bl
mov rcx, qword [rbp + 0x210]
xor rcx, rsp
call fcn.180030840
lea r11, [rsp + 0x340]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.180042c58
nop
call fcn.180042c58
nop
call fcn.180042c58
nop
call fcn.180042c58
nop
call fcn.180042c58
nop
call fcn.180042c58
nop
call fcn.180042c58
nop
call fcn.180042c58
nop
call fcn.180042c58
nop
call fcn.180042c58
nop
call fcn.180042c58
nop
call fcn.180042c58
nop
call fcn.180042c58
int3