Function at 0x41cd50
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x224]
sub esp, 0x224
push 0xffffffffffffffff
push 0x6441e8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x758898]
xor eax, ebp
mov dword [ebp + 0x220], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
xor edi, edi
mov dword [ebp - 4], edi
push 0x104
lea eax, [ebp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x41ce2a
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x14], edi
xor ecx, ecx
mov word [ebp - 0x18], cx
mov bl, 1
mov byte [ebp - 4], bl
push edi
lea edx, [ebp + 0x18]
push edx
push str._sdriversidmtdi.sys
lea ecx, [ebp - 0x1c]
call fcn.004021c0
mov eax, dword [ebp - 0x1c]
cmp eax, edi
jne 0x41cdd7
lea eax, [ebp - 0x18]
push eax
mov ecx, esi
call fcn.0041c000
mov dword [ebp], edi
mov dword [ebp + 8], edi
xor eax, eax
mov word [ebp + 4], ax
mov byte [ebp - 4], 2
push edi
lea ecx, [ebp + 0x18]
push ecx
push str._sdriversidmwfp.sys
lea ecx, [ebp]
call fcn.004021c0
mov eax, dword [ebp]
cmp eax, edi
jne 0x41ce0b
lea eax, [ebp + 4]
push eax
mov ecx, esi
call fcn.0041c000
mov byte [ebp - 4], bl
lea ecx, [ebp]
call fcn.00401210
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.00401210
mov dword [ebp + 0xc], edi
mov dword [ebp + 0x14], edi
xor edx, edx
mov word [ebp + 0x10], dx
mov byte [ebp - 4], 3
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41ce48
mov eax, 0x75dc5c
push edi
push str.IDMIECC.dll
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402330
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41ce66
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c000
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41ce7c
mov eax, 0x75dc5c
push edi
push str.IDMIECC64.dll
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402330
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41ce9a
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c000
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41ceb0
mov eax, 0x75dc5c
push edi
push str.IDMGetAll.dll
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402330
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41cece
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c000
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41cee4
mov eax, 0x75dc5c
push edi
push str.idmmkb.dll
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402330
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41cf02
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c000
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41cf18
mov eax, 0x75dc5c
push edi
push 0x67d948
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402330
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41cf36
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c000
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41cf4c
mov eax, 0x75dc5c
push edi
push str.IDManTypeInfo.tlb
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402330
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41cf6a
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c000
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41cf80
mov eax, 0x75dc5c
push edi
push str.Uninstall.exe
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402330
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41cf9e
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c000
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41cfb4
mov eax, 0x75dc5c
push edi
push str.IEExt.htm
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402330
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41cfd2
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c000
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41cfe8
mov eax, 0x75dc5c
push edi
push str.IEGetAll.htm
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402330
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d006
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c000
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d01c
mov eax, 0x75dc5c
push edi
push str.idmmzcc3.xpi
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402330
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d03a
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c000
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d050
mov eax, 0x75dc5c
push edi
push str.IDMShellExt.dll
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402330
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d06e
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c000
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d084
mov eax, 0x75dc5c
push edi
push str.IDMNetMon.dll
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402330
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d0a2
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c000
mov eax, dword [0x75dc58]
cmp dword [0x75dbc0], edi
je 0x41d19f
cmp eax, edi
jne 0x41d0c4
mov eax, 0x75dc5c
push edi
push str.IDMNetMonAA.dll
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402330
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d0e2
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c000
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d0f8
mov eax, 0x75dc5c
push edi
push str.IDMShellExtAA.dll
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402330
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d116
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c000
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d12c
mov eax, 0x75dc5c
push edi
push str.IDMVMPrsAA.dll
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402330
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d14a
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c000
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d160
mov eax, 0x75dc5c
push edi
push str.idmbrbtnAA.dll
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402330
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d17e
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c000
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d194
mov eax, 0x75dc5c
push edi
push str.IDMIntegratorAA.exe
jmp 0x41d27e
cmp eax, edi
jne 0x41d1a8
mov eax, 0x75dc5c
push edi
push str.IDMNetMon64.dll
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402330
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d1c6
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c000
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d1dc
mov eax, 0x75dc5c
push edi
push str.IDMShellExt64.dll
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402330
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d1fa
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c000
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d210
mov eax, 0x75dc5c
push edi
push str.idmbrbtn64.dll
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402330
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d22e
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c000
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d244
mov eax, 0x75dc5c
push edi
push str.IDMVMPrs64.dll
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402330
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d262
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c000
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d278
mov eax, 0x75dc5c
push edi
push str.IDMIntegrator64.exe
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402330
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d296
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c000
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d2ac
mov eax, 0x75dc5c
push edi
push 0x67d744
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402330
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d2ca
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c000
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d2e0
mov eax, 0x75dc5c
push edi
push str.IDMGrHlp.exe
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402330
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d2fe
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c000
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d314
mov eax, 0x75dc5c
push edi
push str.idmfsa.dll
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402330
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d332
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c000
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d348
mov eax, 0x75dc5c
push edi
push str.IEMonitor.exe
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402330
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d366
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c000
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d37c
mov eax, 0x75dc5c
push edi
push str.idmftype.dll
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402330
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d39a
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c000
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d3b0
mov eax, 0x75dc5c
push edi
push str.IDMGetAll64.dll
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402330
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d3ce
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c000
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d3e4
mov eax, 0x75dc5c
push edi
push str.downlWithIDM64.dll
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402330
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d402
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c000
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d418
mov eax, 0x75dc5c
push edi
push str.IDMFType.dat
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402330
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d436
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c000
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d44c
mov eax, 0x75dc5c
push edi
push str.IDMFType64.dll
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402330
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d46a
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c000
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d480
mov eax, 0x75dc5c
push edi
push str.IDMGCExt.crx
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402330
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d49e
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c000
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d4b4
mov eax, 0x75dc5c
push edi
push str.idmvs.dll
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402330
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d4d2
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c000
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d4e8
mov eax, 0x75dc5c
push edi
push str.idmBroker.exe
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402330
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d506
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c000
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d51c
mov eax, 0x75dc5c
push edi
push str.MediumILStart.exe
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402330
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d53a
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c000
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d550
mov eax, 0x75dc5c
push edi
push str.idmindex.dll
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402330
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d56e
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c000
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d584
mov eax, 0x75dc5c
push edi
push str.idmvconv.dll
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402330
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d5a2
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c000
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d5b8
mov eax, 0x75dc5c
push edi
push str.IDMMsgHost.exe
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402330
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d5d6
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c000
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d5ec
mov eax, 0x75dc5c
push edi
push str.IDMMsgHost.json
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402330
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d60a
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c000
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d620
mov eax, 0x75dc5c
push edi
push str.IDMMsgHostMoz.json
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402330
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d63e
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c000
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d654
mov eax, 0x75dc5c
push edi
push str.IDMOpExt.nex
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402330
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d672
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c000
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d688
mov eax, 0x75dc5c
push edi
push str.IDMGCExt59.crx
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402330
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d6a6
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c000
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d6bc
mov eax, 0x75dc5c
push edi
push str.idmfc.dat
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402330
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d6da
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c000
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d6f0
mov eax, 0x75dc5c
push edi
push str.IDMVMPrs.dll
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402330
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d70e
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c000
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d724
mov eax, 0x75dc5c
push edi
push str.libcrypto.dll
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402330
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d742
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c000
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d758
mov eax, 0x75dc5c
push edi
push str.libssl.dll
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402330
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d776
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c000
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d78c
mov eax, 0x75dc5c
push edi
push str.IDMEdgeExt.crx
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402330
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d7aa
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c000
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.00401210
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x220]
xor ecx, ebp
call fcn.0062023e
add ebp, 0x224
mov esp, ebp
pop ebp
ret