Function at 0x180005aa0
Capabilities:
Get common file path
Get session user name

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rax - 0x258]
sub rsp, 0x340
movaps xmmword [rax - 0x28], xmm6
movaps xmmword [rax - 0x38], xmm7
mov rax, qword [0x18006f040]
xor rax, rsp
mov qword [rbp + 0x210], rax
mov rsi, rcx
xor r14d, r14d
mov edx, 0x104
lea rcx, [rbp]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov rbx, 0xffffffffffffffff
xorps xmm0, xmm0
mov qword [rbp - 0x38], r14
mov qword [rbp - 0x30], r14
movups xmmword [rbp - 0x48], xmm0
test eax, eax
jne 0x180005b11
xor r8d, r8d
lea rdx, [0x18006669c]
jmp 0x180005b2e
lea rax, [rbp]
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], r14w
jne 0x180005b20
lea rdx, [rbp]
lea rcx, [rbp - 0x48]
call fcn.1800046b0
nop
mov dword [rsp + 0x70], 0x104
lea rdx, [rsp + 0x70]
lea rcx, [rbp]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
xorps xmm0, xmm0
mov qword [rbp - 0x78], r14
mov qword [rbp - 0x70], r14
movups xmmword [rsp + 0x78], xmm0
test eax, eax
jne 0x180005b6f
xor r8d, r8d
lea rdx, [0x18006669c]
jmp 0x180005b84
lea rax, [rbp]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x180005b73
mov r8, rbx
lea rdx, [rbp]
lea rcx, [rsp + 0x78]
call fcn.1800046b0
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x58], r14
mov qword [rbp - 0x50], r14
xor r8d, r8d
lea rdx, [0x18006669c]
lea rcx, [rbp - 0x68]
call fcn.1800046b0
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x18], xmm1
mov r8d, 1
cmp qword [rbp - 0x38], r8
cmovb r8, qword [rbp - 0x38]
lea rdx, [rbp - 0x48]
cmp qword [rbp - 0x30], 7
cmova rdx, qword [rbp - 0x48]
lea rcx, [rbp - 0x28]
call fcn.1800046b0
nop
cmp dword [0x180072678], 0
je 0x180005dc3
lea r8, str.:Users_
lea rdx, [rbp - 0x28]
lea rcx, [rsp + 0x50]
call fcn.1800043e0
nop
lea rdx, [rsp + 0x78]
cmp qword [rbp - 0x70], 7
cmova rdx, qword [rsp + 0x78]
mov r8, qword [rbp - 0x78]
mov rcx, rax
call fcn.1800040d0
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
mov rdi, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
sub rax, rdi
cmp rax, 0x1c
jb 0x180005caa
lea rax, [rdi + 0x1c]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x30]
cmp rcx, 7
cmova rbx, qword [rsp + 0x30]
lea rcx, [rbx + rdi*2]
mov r8d, 0x38
lea rdx, str.AppDataLocalGoogleChrome
call fcn.180057cd0
mov word [rbx + rdi*2 + 0x38], r14w
lea rax, [rsp + 0x30]
jmp 0x180005ccc
mov qword [rsp + 0x20], 0x1c
lea r9, str.AppDataLocalGoogleChrome
xor r8d, r8d
mov edx, 0x1c
lea rcx, [rsp + 0x30]
call fcn.180005030
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
mov rdx, qword [rbp - 0x50]
cmp rdx, 7
jbe 0x180005d23
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005d1e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800062d0
call fcn.18002e220
movups xmmword [rbp - 0x68], xmm6
movups xmmword [rbp - 0x58], xmm7
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x180005d6d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005d68
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800062d6
call fcn.18002e220
movdqa xmm0, xmmword [0x180066bb0]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x30], r14w
mov rdx, qword [rsp + 0x68]
cmp rdx, 7
jbe 0x180005dc3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005dbe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800062dc
call fcn.18002e220
cmp dword [0x18007246c], 0
je 0x180005f9e
lea r8, str.:Users_
lea rdx, [rbp - 0x28]
lea rcx, [rsp + 0x50]
call fcn.1800043e0
nop
lea rdx, [rsp + 0x78]
cmp qword [rbp - 0x70], 7
cmova rdx, qword [rsp + 0x78]
mov r8, qword [rbp - 0x78]
mov rcx, rax
call fcn.1800040d0
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
mov rdi, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
sub rax, rdi
cmp rax, 0x21
jb 0x180005e85
lea rax, [rdi + 0x21]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x30]
cmp rcx, 7
cmova rbx, qword [rsp + 0x30]
lea rcx, [rbx + rdi*2]
mov r8d, 0x42
lea rdx, str.AppDataLocalGoogleChrome_Beta
call fcn.180057cd0
mov word [rbx + rdi*2 + 0x42], r14w
lea rax, [rsp + 0x30]
jmp 0x180005ea7
mov qword [rsp + 0x20], 0x21
lea r9, str.AppDataLocalGoogleChrome_Beta
xor r8d, r8d
mov edx, 0x21
lea rcx, [rsp + 0x30]
call fcn.180005030
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
mov rdx, qword [rbp - 0x50]
cmp rdx, 7
jbe 0x180005efe
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005ef9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800062e2
call fcn.18002e220
movups xmmword [rbp - 0x68], xmm6
movups xmmword [rbp - 0x58], xmm7
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x180005f48
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005f43
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800062e8
call fcn.18002e220
movdqa xmm0, xmmword [0x180066bb0]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x30], r14w
mov rdx, qword [rsp + 0x68]
cmp rdx, 7
jbe 0x180005f9e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005f99
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800062ee
call fcn.18002e220
cmp dword [0x180072468], 0
je 0x180006179
lea r8, str.:Users_
lea rdx, [rbp - 0x28]
lea rcx, [rsp + 0x50]
call fcn.1800043e0
nop
lea rdx, [rsp + 0x78]
cmp qword [rbp - 0x70], 7
cmova rdx, qword [rsp + 0x78]
mov r8, qword [rbp - 0x78]
mov rcx, rax
call fcn.1800040d0
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
mov rdi, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
sub rax, rdi
cmp rax, 0x1d
jb 0x180006060
lea rax, [rdi + 0x1d]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x30]
cmp rcx, 7
cmova rbx, qword [rsp + 0x30]
lea rcx, [rbx + rdi*2]
mov r8d, 0x3a
lea rdx, str.AppDataLocalMicrosoftEdge
call fcn.180057cd0
mov word [rbx + rdi*2 + 0x3a], r14w
lea rax, [rsp + 0x30]
jmp 0x180006082
mov qword [rsp + 0x20], 0x1d
lea r9, str.AppDataLocalMicrosoftEdge
xor r8d, r8d
mov edx, 0x1d
lea rcx, [rsp + 0x30]
call fcn.180005030
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
mov rdx, qword [rbp - 0x50]
cmp rdx, 7
jbe 0x1800060d9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800060d4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800062f4
call fcn.18002e220
movups xmmword [rbp - 0x68], xmm6
movups xmmword [rbp - 0x58], xmm7
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x180006123
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000611e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800062fa
call fcn.18002e220
movdqa xmm0, xmmword [0x180066bb0]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x30], r14w
mov rdx, qword [rsp + 0x68]
cmp rdx, 7
jbe 0x180006179
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006174
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006300
call fcn.18002e220
cmp qword [rbp - 0x58], 0
je 0x180006194
mov rdx, rsi
lea rcx, [rbp - 0x68]
call fcn.180002af0
test al, al
je 0x180006194
mov bl, 1
jmp 0x180006196
xor bl, bl
mov rdx, qword [rbp - 0x10]
cmp rdx, 7
jbe 0x1800061d7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800061d1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006306
call fcn.18002e220
nop
mov rdx, qword [rbp - 0x50]
cmp rdx, 7
jbe 0x180006218
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006212
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000630c
call fcn.18002e220
nop
mov rdx, qword [rbp - 0x70]
cmp rdx, 7
jbe 0x18000625a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006254
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006312
call fcn.18002e220
nop
mov rdx, qword [rbp - 0x30]
cmp rdx, 7
jbe 0x180006296
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006291
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800062ca
call fcn.18002e220
movzx eax, bl
mov rcx, qword [rbp + 0x210]
xor rcx, rsp
call fcn.18002e200
lea r11, [rsp + 0x340]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.18003da5c
nop
call fcn.18003da5c
nop
call fcn.18003da5c
nop
call fcn.18003da5c
nop
call fcn.18003da5c
nop
call fcn.18003da5c
nop
call fcn.18003da5c
nop
call fcn.18003da5c
nop
call fcn.18003da5c
nop
call fcn.18003da5c
nop
call fcn.18003da5c
nop
call fcn.18003da5c
nop
call fcn.18003da5c
int3