Function at 0x41d300
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x224]
sub esp, 0x224
push 0xffffffffffffffff
push 0x63bf58
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x74f8a0]
xor eax, ebp
mov dword [ebp + 0x220], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
xor edi, edi
mov dword [ebp - 4], edi
push 0x104
lea eax, [ebp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x41d3da
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x14], edi
xor ecx, ecx
mov word [ebp - 0x18], cx
mov bl, 1
mov byte [ebp - 4], bl
push edi
lea edx, [ebp + 0x18]
push edx
push str._sdriversidmtdi.sys
lea ecx, [ebp - 0x1c]
call fcn.004021b0
mov eax, dword [ebp - 0x1c]
cmp eax, edi
jne 0x41d387
lea eax, [ebp - 0x18]
push eax
mov ecx, esi
call fcn.0041c5d0
mov dword [ebp], edi
mov dword [ebp + 8], edi
xor eax, eax
mov word [ebp + 4], ax
mov byte [ebp - 4], 2
push edi
lea ecx, [ebp + 0x18]
push ecx
push str._sdriversidmwfp.sys
lea ecx, [ebp]
call fcn.004021b0
mov eax, dword [ebp]
cmp eax, edi
jne 0x41d3bb
lea eax, [ebp + 4]
push eax
mov ecx, esi
call fcn.0041c5d0
mov byte [ebp - 4], bl
lea ecx, [ebp]
call fcn.00401210
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.00401210
mov dword [ebp + 0xc], edi
mov dword [ebp + 0x14], edi
xor edx, edx
mov word [ebp + 0x10], dx
mov byte [ebp - 4], 3
mov eax, dword [0x754c5c]
cmp eax, edi
jne 0x41d3f8
mov eax, 0x754c60
push edi
push str.IDMIECC.dll
push eax
push 0x66fde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d416
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c5d0
mov eax, dword [0x754c5c]
cmp eax, edi
jne 0x41d42c
mov eax, 0x754c60
push edi
push str.IDMIECC64.dll
push eax
push 0x66fde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d44a
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c5d0
mov eax, dword [0x754c5c]
cmp eax, edi
jne 0x41d460
mov eax, 0x754c60
push edi
push str.IDMGetAll.dll
push eax
push 0x66fde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d47e
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c5d0
mov eax, dword [0x754c5c]
cmp eax, edi
jne 0x41d494
mov eax, 0x754c60
push edi
push str.idmmkb.dll
push eax
push 0x66fde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d4b2
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c5d0
mov eax, dword [0x754c5c]
cmp eax, edi
jne 0x41d4c8
mov eax, 0x754c60
push edi
push 0x6746dc
push eax
push 0x66fde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d4e6
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c5d0
mov eax, dword [0x754c5c]
cmp eax, edi
jne 0x41d4fc
mov eax, 0x754c60
push edi
push str.IDManTypeInfo.tlb
push eax
push 0x66fde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d51a
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c5d0
mov eax, dword [0x754c5c]
cmp eax, edi
jne 0x41d530
mov eax, 0x754c60
push edi
push str.Uninstall.exe
push eax
push 0x66fde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d54e
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c5d0
mov eax, dword [0x754c5c]
cmp eax, edi
jne 0x41d564
mov eax, 0x754c60
push edi
push str.IEExt.htm
push eax
push 0x66fde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d582
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c5d0
mov eax, dword [0x754c5c]
cmp eax, edi
jne 0x41d598
mov eax, 0x754c60
push edi
push str.IEGetAll.htm
push eax
push 0x66fde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d5b6
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c5d0
mov eax, dword [0x754c5c]
cmp eax, edi
jne 0x41d5cc
mov eax, 0x754c60
push edi
push str.idmmzcc3.xpi
push eax
push 0x66fde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d5ea
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c5d0
mov eax, dword [0x754c5c]
cmp eax, edi
jne 0x41d600
mov eax, 0x754c60
push edi
push str.IDMShellExt.dll
push eax
push 0x66fde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d61e
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c5d0
mov eax, dword [0x754c5c]
cmp eax, edi
jne 0x41d634
mov eax, 0x754c60
push edi
push str.IDMNetMon.dll
push eax
push 0x66fde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d652
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c5d0
mov eax, dword [0x754c5c]
cmp eax, edi
jne 0x41d668
mov eax, 0x754c60
push edi
push str.IDMNetMon64.dll
push eax
push 0x66fde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d686
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c5d0
mov eax, dword [0x754c5c]
cmp eax, edi
jne 0x41d69c
mov eax, 0x754c60
push edi
push str.IDMShellExt64.dll
push eax
push 0x66fde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d6ba
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c5d0
mov eax, dword [0x754c5c]
cmp eax, edi
jne 0x41d6d0
mov eax, 0x754c60
push edi
push 0x6745ec
push eax
push 0x66fde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d6ee
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c5d0
mov eax, dword [0x754c5c]
cmp eax, edi
jne 0x41d704
mov eax, 0x754c60
push edi
push str.idmbrbtn64.dll
push eax
push 0x66fde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d722
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c5d0
mov eax, dword [0x754c5c]
cmp eax, edi
jne 0x41d738
mov eax, 0x754c60
push edi
push str.IDMGrHlp.exe
push eax
push 0x66fde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d756
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c5d0
mov eax, dword [0x754c5c]
cmp eax, edi
jne 0x41d76c
mov eax, 0x754c60
push edi
push str.idmfsa.dll
push eax
push 0x66fde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d78a
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c5d0
mov eax, dword [0x754c5c]
cmp eax, edi
jne 0x41d7a0
mov eax, 0x754c60
push edi
push str.IEMonitor.exe
push eax
push 0x66fde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d7be
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c5d0
mov eax, dword [0x754c5c]
cmp eax, edi
jne 0x41d7d4
mov eax, 0x754c60
push edi
push str.idmftype.dll
push eax
push 0x66fde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d7f2
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c5d0
mov eax, dword [0x754c5c]
cmp eax, edi
jne 0x41d808
mov eax, 0x754c60
push edi
push str.IDMGetAll64.dll
push eax
push 0x66fde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d826
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c5d0
mov eax, dword [0x754c5c]
cmp eax, edi
jne 0x41d83c
mov eax, 0x754c60
push edi
push str.downlWithIDM64.dll
push eax
push 0x66fde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d85a
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c5d0
mov eax, dword [0x754c5c]
cmp eax, edi
jne 0x41d870
mov eax, 0x754c60
push edi
push str.IDMIntegrator64.exe
push eax
push 0x66fde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d88e
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c5d0
mov eax, dword [0x754c5c]
cmp eax, edi
jne 0x41d8a4
mov eax, 0x754c60
push edi
push str.IDMFType.dat
push eax
push 0x66fde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d8c2
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c5d0
mov eax, dword [0x754c5c]
cmp eax, edi
jne 0x41d8d8
mov eax, 0x754c60
push edi
push str.IDMFType64.dll
push eax
push 0x66fde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d8f6
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c5d0
mov eax, dword [0x754c5c]
cmp eax, edi
jne 0x41d90c
mov eax, 0x754c60
push edi
push str.IDMGCExt.crx
push eax
push 0x66fde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d92a
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c5d0
mov eax, dword [0x754c5c]
cmp eax, edi
jne 0x41d940
mov eax, 0x754c60
push edi
push str.idmvs.dll
push eax
push 0x66fde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d95e
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c5d0
mov eax, dword [0x754c5c]
cmp eax, edi
jne 0x41d974
mov eax, 0x754c60
push edi
push str.idmBroker.exe
push eax
push 0x66fde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d992
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c5d0
mov eax, dword [0x754c5c]
cmp eax, edi
jne 0x41d9a8
mov eax, 0x754c60
push edi
push str.MediumILStart.exe
push eax
push 0x66fde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d9c6
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c5d0
mov eax, dword [0x754c5c]
cmp eax, edi
jne 0x41d9dc
mov eax, 0x754c60
push edi
push str.idmindex.dll
push eax
push 0x66fde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d9fa
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c5d0
mov eax, dword [0x754c5c]
cmp eax, edi
jne 0x41da10
mov eax, 0x754c60
push edi
push str.idmvconv.dll
push eax
push 0x66fde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41da2e
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c5d0
mov eax, dword [0x754c5c]
cmp eax, edi
jne 0x41da44
mov eax, 0x754c60
push edi
push str.IDMMsgHost.exe
push eax
push 0x66fde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41da62
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c5d0
mov eax, dword [0x754c5c]
cmp eax, edi
jne 0x41da78
mov eax, 0x754c60
push edi
push str.IDMMsgHost.json
push eax
push 0x66fde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41da96
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c5d0
mov eax, dword [0x754c5c]
cmp eax, edi
jne 0x41daac
mov eax, 0x754c60
push edi
push str.IDMMsgHostMoz.json
push eax
push 0x66fde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41daca
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c5d0
mov eax, dword [0x754c5c]
cmp eax, edi
jne 0x41dae0
mov eax, 0x754c60
push edi
push str.IDMOpExt.nex
push eax
push 0x66fde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41dafe
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c5d0
mov eax, dword [0x754c5c]
cmp eax, edi
jne 0x41db14
mov eax, 0x754c60
push edi
push str.IDMGCExt59.crx
push eax
push 0x66fde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41db32
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c5d0
mov eax, dword [0x754c5c]
cmp eax, edi
jne 0x41db48
mov eax, 0x754c60
push edi
push str.idmfc.dat
push eax
push 0x66fde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41db66
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c5d0
mov eax, dword [0x754c5c]
cmp eax, edi
jne 0x41db7c
mov eax, 0x754c60
push edi
push str.IDMVMPrs.dll
push eax
push 0x66fde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41db9a
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c5d0
mov eax, dword [0x754c5c]
cmp eax, edi
jne 0x41dbb0
mov eax, 0x754c60
push edi
push str.IDMVMPrs64.dll
push eax
push 0x66fde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41dbce
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c5d0
mov eax, dword [0x754c5c]
cmp eax, edi
jne 0x41dbe4
mov eax, 0x754c60
push edi
push str.libcrypto.dll
push eax
push 0x66fde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41dc02
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c5d0
mov eax, dword [0x754c5c]
cmp eax, edi
jne 0x41dc18
mov eax, 0x754c60
push edi
push str.libssl.dll
push eax
push 0x66fde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41dc36
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c5d0
mov eax, dword [0x754c5c]
cmp eax, edi
jne 0x41dc4c
mov eax, 0x754c60
push edi
push str.IDMEdgeExt.crx
push eax
push 0x66fde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41dc6a
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c5d0
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.00401210
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x220]
xor ecx, ebp
call fcn.0061807e
add ebp, 0x224
mov esp, ebp
pop ebp
ret