Function at 0x1400ec650
Capabilities:
Get common file path
Set current directory

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x210]
sub rsp, 0x310
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rsp + 0x360], rbx
mov rax, qword [0x14028a238]
xor rax, rsp
mov qword [rbp + 0x200], rax
mov r15, rcx
lea rdi, [rcx + 0x10]
mov r8, rdx
mov rdx, rdi
lea rcx, [rbp - 0x30]
call fcn.1400ca9b0
nop
lea r8, str.core
mov rdx, rdi
lea rcx, [rbp - 0x70]
call fcn.1400e15e0
nop
lea r8, str.quarantine
mov rdx, rdi
lea rcx, [rsp + 0x70]
call fcn.1400e15e0
nop
xor r14d, r14d
mov ebx, r14d
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x10]
call fcn.1401b04b0
lea rdx, [rbp - 0x10]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
cmp qword [rdi + 0x18], 8
jb 0x1400ec6ff
mov rcx, qword [rdi]
jmp 0x1400ec702
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rcx, qword [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [r15], rax
test rax, rax
je 0x1400ec985
lea rdx, str.CreateMalwareSDK
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x1400ec985
mov qword [rbp - 0x38], reloc.OLEAUT32.dll_SafeArrayDestroy
mov qword [rbp - 0x40], r14
mov byte [rbp - 0x50], bl
mov r8d, 0x669
lea rdx, str.__xml_version_1.0__encoding_UTF_8__standalone_no_____enabledScanType_value_0___dsig:Signature_xmlns:dsig_http:__www.w3.org_2000_09_xmldsig___r_n_dsig:SignedInfo__r_n_dsig:CanonicalizationMethod_Algorithm_http:__www.w3.org_2001_10_xml_exc_c14nWithComments____r_n_dsig:SignatureMethod_Algorithm_http:__www.w3.org_2001_04_xmldsig_morersa_sha512____r_n_dsig:Reference_URI____r_n_dsig:Transforms__r_n_dsig:Transform_Algorithm_http:__www.w3.org_2000_09_xmldsigenveloped_signature____r_n__dsig:Transforms__r_n_dsig:DigestMethod_Algorithm_http:__www.w3.org_2000_09_xmldsigsha1____r_n_dsig:DigestValue_5zcfD5_k8PZe7LezoiYUY4eyFc__dsig:DigestValue__r_n__dsig:Reference__r_n__dsig:SignedInfo__r_n_dsig:SignatureValue_ocawCXUVIIjkSnh9t48vihlRl4tXo3tehlQIHQ4MBtVBk3zEkT_oT2veJ9SPRDd_r_nldUOD9xYgr7qvuKnJkmXoIMODrB1wXcOLRDU0O9dzkJVJcnEPDUooX7v7fxcbHlG_r_nA66kjrIxg6zZoggizFU0JyE3qd3PQKvVoQr1zenU1mTyeMEUcrJPCRl1RY8EdQi_r_nINUgng4xTjDqoOc_sbJKkOez9i584LVGf6BUwEYpVfTHL7MwqInGsyZQ2s1tzc6p_r_n23XRo7kWHqEONccHoXJ65VTD_DoAWg1zBQgGzyq5VAnqK97DSxGZLK0jFE1Y0t4_r_nvV7bkGCVVi7cLIJYMRht1w__dsig:SignatureValue__r_n_dsig:KeyInfo__r_n_dsig:KeyValue__r_n_dsig:RSAKeyValue__r_n_dsig:Modulus_uWQ_ZQEsEwN6YYkQ0nMyzHPhPmB3JlA90CcJVd3qTUICG_FoXq3F3F8KaUS4qXhgz24_yWTSe1h_r_nrC8wZN2UXdqj1B4tO3CFtQUM3Meq3FSoXzMfKqrdEmrB6tntvulTO7NbdrgDoheIJ6EiDKzM7sq_r_nXg2Tm3ZiMNorr0OZbiT3CoDdH_hAlEW3OwObndCPOkSIy7htN1qnmvssEnXM5iypNXyjNLUXuc_r_nAgOuxdDaNOCx_2GFcMseFJHdDEc3QwN0MsKSxK4USA14dcwx14gRKyTGQjv8Tk82TsscBMYaN_r_nHOYfY2s4gKaT2DbXNgcps3vVfloYz5DzrEKQHw__dsig:Modulus__r_n_dsig:Exponent_AQAB__dsig:Exponent__r_n__dsig:RSAKeyValue__r_n__dsig:KeyValue__r_n__dsig:KeyInfo__r_n__dsig:Signature___enabledScanType_
lea rcx, [rbp - 0x50]
call fcn.1400d1eb0
nop
mov ecx, 0x66c
call fcn.14016d418
mov rsi, rax
test rax, rax
jne 0x1400ec792
lea rcx, [rbp - 0x50]
call fcn.1400d0c70
or ebx, 0xffffffff
jmp 0x1400ec990
xor edx, edx
mov r8d, 0x66c
mov rcx, rsi
call fcn.1401b04b0
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rcx, qword [rbp - 0x50]
mov rdx, rsi
mov eax, SafeArrayDestroy
nop dword [rax + rax]
movups xmm0, xmmword [rcx]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rdx - 0x10], xmm1
lea rcx, [rcx + 0x80]
sub rax, 1
jne 0x1400ec7c0
movups xmm0, xmmword [rcx]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx + 0x50], xmm1
mov rax, qword [rcx + 0x60]
mov qword [rdx + 0x60], rax
movzx eax, word [rcx + 0x68]
mov word [rdx + 0x68], ax
lea rax, [rsp + 0x70]
cmp qword [rbp - 0x78], 8
cmovae rax, qword [rsp + 0x70]
mov qword [rsp + 0x58], rax
lea rax, [rbp - 0x70]
cmp qword [rbp - 0x58], 8
cmovae rax, qword [rbp - 0x70]
mov qword [rsp + 0x60], rax
cmp qword [rdi + 0x18], 8
jb 0x1400ec884
mov r14, qword [rdi]
jmp 0x1400ec887
mov r14, rdi
lea r13, [r15 + 8]
mov rcx, r12
call qword [fcn.140005fb0]
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x38], r13
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x30], rax
lea rax, [0x1402305b4]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x60]
mov r8, r14
mov edx, 0x66a
mov rcx, rsi
call r12
mov r14d, eax
test eax, eax
je 0x1400ec948
lea r14, [rsp + 0x70]
cmp qword [rbp - 0x78], 8
cmovae r14, qword [rsp + 0x70]
lea r12, [rbp - 0x70]
cmp qword [rbp - 0x58], 8
cmovae r12, qword [rbp - 0x70]
cmp qword [rdi + 0x18], 8
jb 0x1400ec8fe
mov rdi, qword [rdi]
mov rcx, qword [rsp + 0x50]
call qword [fcn.140005fb0]
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r14
lea rax, [0x1402305b4]
mov qword [rsp + 0x28], rax
lea rax, [0x14023068c]
mov qword [rsp + 0x20], rax
mov r9, r12
mov r8, rdi
mov edx, 0x66a
mov rcx, rsi
call qword [rsp + 0x50]
mov r14d, eax
mov rcx, rsi
call fcn.14016d8bc
cmp qword [r13], 0
je 0x1400ec95c
test r14d, r14d
je 0x1400ec95f
or ebx, 0xffffffff
lea rcx, [rbp - 0x50]
call fcn.1400d0c70
test ebx, ebx
jns 0x1400ec982
mov rcx, qword [r15]
test rcx, rcx
je 0x1400ec982
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor r14d, r14d
mov qword [r15], r14
jmp 0x1400ec985
xor r14d, r14d
lea rcx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
nop
mov r8, qword [rbp - 0x78]
cmp r8, 8
jb 0x1400ec9ac
inc r8
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x70]
call fcn.1400c3a10
mov qword [rbp - 0x78], 7
mov qword [rbp - 0x80], r14
mov word [rsp + 0x70], r14w
mov r8, qword [rbp - 0x58]
cmp r8, 8
jb 0x1400ec9d8
inc r8
mov rdx, qword [rbp - 0x70]
lea rcx, [rbp - 0x70]
call fcn.1400c3a10
mov qword [rbp - 0x58], 7
mov qword [rbp - 0x60], r14
mov word [rbp - 0x70], r14w
mov r8, qword [rbp - 0x18]
cmp r8, 8
jb 0x1400eca03
inc r8
mov rdx, qword [rbp - 0x30]
lea rcx, [rbp - 0x30]
call fcn.1400c3a10
mov eax, ebx
mov rcx, qword [rbp + 0x200]
xor rcx, rsp
call fcn.14016ce60
mov rbx, qword [rsp + 0x360]
add rsp, 0x310
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret