Function at 0x1400286e0
Capabilities:
Get common file path
Get session user name

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, reloc.mfc120u.dll_Ordinal_2256
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov rax, qword [0x1401f3f10]
xor rax, rsp
mov qword [rsp + 0x8c0], rax
mov byte [rsp + 0x30], 0
mov byte [rsp + 0x31], 1
xor eax, eax
mov word [rsp + 0x80], ax
lea rax, [rsp + 0x82]
mov rdi, rax
xor eax, eax
mov ecx, Ordinal_521
rep stosb byte [rdi], al
mov qword [rsp + 0x40], 0
lea rdx, str.shfolder.dll
lea rcx, [rsp + 0x58]
call fcn.140030130
nop
lea rcx, [rsp + 0x58]
call fcn.140030730
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x14002882a
lea rdx, str.SHGetFolderPathW
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
je 0x14002881f
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x801a
xor ecx, ecx
call qword [rsp + 0x40]
test eax, eax
jl 0x14002881f
mov byte [rsp + 0x31], 0
lea rcx, [rsp + 0x80]
call qword [sym.imp.MSVCR120.dll_wcslen]
mov dword [rsp + 0x34], eax
mov rax, qword [rsp + 0x8e8]
mov ecx, dword [rsp + 0x34]
cmp dword [rax], ecx
jle 0x140028811
mov byte [rsp + 0x30], 1
movsxd rax, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x8e8]
movsxd rcx, dword [rcx]
mov r9, rax
lea r8, [rsp + 0x80]
mov rdx, rcx
mov rcx, qword [rsp + 0x8e0]
call qword [sym.imp.MSVCR120.dll_wcsncpy_s]
mov rax, qword [rsp + 0x8e8]
mov ecx, dword [rsp + 0x34]
mov dword [rax], ecx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
movzx eax, byte [rsp + 0x31]
test eax, eax
je 0x14002895b
xor eax, eax
mov word [rsp + 0x290], ax
lea rax, [rsp + 0x292]
mov rdi, rax
xor eax, eax
mov ecx, Ordinal_521
rep stosb byte [rdi], al
xor eax, eax
mov word [rsp + Ordinal_1714], ax
lea rax, [rsp + reloc.mfc120u.dll_Ordinal_1714]
mov rdi, rax
xor eax, eax
mov ecx, Ordinal_521
rep stosb byte [rdi], al
mov dword [rsp + 0x48], Ordinal_265
xor eax, eax
mov word [rsp + 0x4a0], ax
lea rax, [rsp + 0x4a2]
mov rdi, rax
xor eax, eax
mov ecx, Ordinal_521
rep stosb byte [rdi], al
mov edx, 0x104
lea rcx, [rsp + 0x290]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x4a0]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea r8, [0x14013c2e0]
lea rdx, [rsp + 0x290]
lea rcx, [rsp + 0x6b0]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
lea r8, [rsp + 0x4a0]
lea rdx, [rsp + 0x6b0]
lea rcx, [rsp + 0x80]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
lea rcx, [rsp + 0x80]
call qword [sym.imp.MSVCR120.dll_wcslen]
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0x8e8]
mov ecx, dword [rsp + 0x38]
cmp dword [rax], ecx
jle 0x14002894d
mov byte [rsp + 0x30], 1
movsxd rax, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x8e8]
movsxd rcx, dword [rcx]
mov r9, rax
lea r8, [rsp + 0x80]
mov rdx, rcx
mov rcx, qword [rsp + 0x8e0]
call qword [sym.imp.MSVCR120.dll_wcsncpy_s]
mov rax, qword [rsp + 0x8e8]
mov ecx, dword [rsp + 0x38]
mov dword [rax], ecx
movzx eax, byte [rsp + 0x30]
mov byte [rsp + 0x32], al
lea rcx, [rsp + 0x58]
call fcn.140030070
movzx eax, byte [rsp + 0x32]
mov rcx, qword [rsp + 0x8c0]
xor rcx, rsp
call fcn.14010f170
add rsp, reloc.mfc120u.dll_Ordinal_2256
pop rdi
ret