Function at 0x4c9780
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58debc
mov eax, dword fs:[0]
push eax
sub esp, 0x27c
mov eax, dword [0x5ff1d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x288], ebx
mov eax, dword [ebp + 8]
lea esi, [ebx + 8]
push eax
mov edx, esi
lea ecx, [ebp - 0x260]
call fcn.004ab730
push str.core
mov edx, esi
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x248]
call fcn.004c02b0
push str.quarantine
mov edx, esi
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x230]
call fcn.004c02b0
push 0x208
xor edi, edi
mov byte [ebp - 4], 2
lea eax, [ebp - 0x218]
push edi
push eax
call fcn.00563230
add esp, 0x18
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
cmp dword [esi + 0x14], 8
jb 0x4c9830
mov eax, dword [esi]
jmp 0x4c9832
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
cmp dword [ebp - 0x24c], 8
lea eax, [ebp - 0x260]
cmovae eax, dword [ebp - 0x260]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebx], eax
test eax, eax
je 0x4c9a14
push str.CreateMalwareSDK
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x27c], eax
test eax, eax
je 0x4c9a14
push str.__xml_version_1.0__encoding_UTF_8__standalone_no_____enabledScanType_value_0___dsig:Signature_xmlns:dsig_http:__www.w3.org_2000_09_xmldsig___r_n_dsig:SignedInfo__r_n_dsig:CanonicalizationMethod_Algorithm_http:__www.w3.org_2001_10_xml_exc_c14nWithComments____r_n_dsig:SignatureMethod_Algorithm_http:__www.w3.org_2001_04_xmldsig_morersa_sha512____r_n_dsig:Reference_URI____r_n_dsig:Transforms__r_n_dsig:Transform_Algorithm_http:__www.w3.org_2000_09_xmldsigenveloped_signature____r_n__dsig:Transforms__r_n_dsig:DigestMethod_Algorithm_http:__www.w3.org_2000_09_xmldsigsha1____r_n_dsig:DigestValue_5zcfD5_k8PZe7LezoiYUY4eyFc__dsig:DigestValue__r_n__dsig:Reference__r_n__dsig:SignedInfo__r_n_dsig:SignatureValue_ocawCXUVIIjkSnh9t48vihlRl4tXo3tehlQIHQ4MBtVBk3zEkT_oT2veJ9SPRDd_r_nldUOD9xYgr7qvuKnJkmXoIMODrB1wXcOLRDU0O9dzkJVJcnEPDUooX7v7fxcbHlG_r_nA66kjrIxg6zZoggizFU0JyE3qd3PQKvVoQr1zenU1mTyeMEUcrJPCRl1RY8EdQi_r_nINUgng4xTjDqoOc_sbJKkOez9i584LVGf6BUwEYpVfTHL7MwqInGsyZQ2s1tzc6p_r_n23XRo7kWHqEONccHoXJ65VTD_DoAWg1zBQgGzyq5VAnqK97DSxGZLK0jFE1Y0t4_r_nvV7bkGCVVi7cLIJYMRht1w__dsig:SignatureValue__r_n_dsig:KeyInfo__r_n_dsig:KeyValue__r_n_dsig:RSAKeyValue__r_n_dsig:Modulus_uWQ_ZQEsEwN6YYkQ0nMyzHPhPmB3JlA90CcJVd3qTUICG_FoXq3F3F8KaUS4qXhgz24_yWTSe1h_r_nrC8wZN2UXdqj1B4tO3CFtQUM3Meq3FSoXzMfKqrdEmrB6tntvulTO7NbdrgDoheIJ6EiDKzM7sq_r_nXg2Tm3ZiMNorr0OZbiT3CoDdH_hAlEW3OwObndCPOkSIy7htN1qnmvssEnXM5iypNXyjNLUXuc_r_nAgOuxdDaNOCx_2GFcMseFJHdDEc3QwN0MsKSxK4USA14dcwx14gRKyTGQjv8Tk82TsscBMYaN_r_nHOYfY2s4gKaT2DbXNgcps3vVfloYz5DzrEKQHw__dsig:Modulus__r_n_dsig:Exponent_AQAB__dsig:Exponent__r_n__dsig:RSAKeyValue__r_n__dsig:KeyValue__r_n__dsig:KeyInfo__r_n__dsig:Signature___enabledScanType_
lea ecx, [ebp - 0x278]
call fcn.004b1620
push 0x66c
mov byte [ebp - 4], 3
call fcn.00534493
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x4c98b2
lea ecx, [ebp - 0x278]
call fcn.004b1580
or edi, 0xffffffff
jmp 0x4c9a21
push 0x66c
push 0
push ebx
call fcn.00563230
cmp dword [ebp - 0x264], 0x10
lea eax, [ebp - 0x278]
push 0x66a
cmovae eax, dword [ebp - 0x278]
push eax
push ebx
call fcn.00562cb0
add esp, 0x18
lea edx, [ebp - 0x230]
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x248]
cmovae edx, dword [ebp - 0x230]
cmp dword [ebp - 0x234], 8
cmovae eax, dword [ebp - 0x248]
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x280], eax
jb 0x4c991a
mov ecx, dword [esi]
jmp 0x4c991c
mov ecx, esi
mov eax, dword [ebp - 0x288]
push 0
add eax, 4
push eax
push edx
push 0x5d843c
push 0x5d843c
push dword [ebp - 0x280]
mov dword [ebp - 0x284], eax
push ecx
mov ecx, dword [ebp - 0x27c]
push 0x66a
push ebx
call dword [0x59a43c]
call dword [ebp - 0x27c]
add esp, 0x24
mov dword [ebp - 0x280], eax
test eax, eax
je 0x4c99c7
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
lea ecx, [ebp - 0x248]
cmovae eax, dword [ebp - 0x230]
cmp dword [ebp - 0x234], 8
cmovae ecx, dword [ebp - 0x248]
cmp dword [esi + 0x14], 8
jb 0x4c9995
mov esi, dword [esi]
push 0
push dword [ebp - 0x284]
push eax
push 0x5d843c
push 0x5d8680
push ecx
push esi
mov esi, dword [ebp - 0x27c]
mov ecx, esi
push 0x66a
push ebx
call dword [0x59a43c]
call esi
add esp, 0x24
mov esi, eax
jmp 0x4c99cd
mov esi, dword [ebp - 0x280]
push ebx
call fcn.0053448e
mov eax, dword [ebp - 0x284]
add esp, 4
cmp dword [eax], 0
je 0x4c99e5
test esi, esi
je 0x4c99e8
or edi, 0xffffffff
lea ecx, [ebp - 0x278]
mov byte [ebp - 4], 2
call fcn.004b1580
test edi, edi
jns 0x4c9a14
mov ebx, dword [ebp - 0x288]
mov eax, dword [ebx]
test eax, eax
je 0x4c9a14
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebx], 0
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov eax, dword [ebp - 0x21c]
cmp eax, 8
jb 0x4c9a3f
inc eax
lea ecx, [ebp - 0x230]
push eax
push dword [ebp - 0x230]
call fcn.004a5150
xor eax, eax
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
mov eax, dword [ebp - 0x234]
mov dword [ebp - 0x220], 0
cmp eax, 8
jb 0x4c9a7a
inc eax
lea ecx, [ebp - 0x248]
push eax
push dword [ebp - 0x248]
call fcn.004a5150
mov ecx, dword [ebp - 0x24c]
xor eax, eax
mov dword [ebp - 0x234], 7
mov dword [ebp - 0x238], 0
mov word [ebp - 0x248], ax
cmp ecx, 8
jb 0x4c9ab5
inc ecx
push ecx
push dword [ebp - 0x260]
lea ecx, [ebp - 0x260]
call fcn.004a5150
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00533fc6
mov esp, ebp
pop ebp
ret 4