Function at 0x41d370
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x224]
sub esp, 0x224
push 0xffffffffffffffff
push 0x644b58
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x758898]
xor eax, ebp
mov dword [ebp + 0x220], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
xor edi, edi
mov dword [ebp - 4], edi
push 0x104
lea eax, [ebp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x41d44a
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x14], edi
xor ecx, ecx
mov word [ebp - 0x18], cx
mov bl, 1
mov byte [ebp - 4], bl
push edi
lea edx, [ebp + 0x18]
push edx
push str._sdriversidmtdi.sys
lea ecx, [ebp - 0x1c]
call fcn.004021a0
mov eax, dword [ebp - 0x1c]
cmp eax, edi
jne 0x41d3f7
lea eax, [ebp - 0x18]
push eax
mov ecx, esi
call fcn.0041c630
mov dword [ebp], edi
mov dword [ebp + 8], edi
xor eax, eax
mov word [ebp + 4], ax
mov byte [ebp - 4], 2
push edi
lea ecx, [ebp + 0x18]
push ecx
push str._sdriversidmwfp.sys
lea ecx, [ebp]
call fcn.004021a0
mov eax, dword [ebp]
cmp eax, edi
jne 0x41d42b
lea eax, [ebp + 4]
push eax
mov ecx, esi
call fcn.0041c630
mov byte [ebp - 4], bl
lea ecx, [ebp]
call fcn.00401210
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.00401210
mov dword [ebp + 0xc], edi
mov dword [ebp + 0x14], edi
xor edx, edx
mov word [ebp + 0x10], dx
mov byte [ebp - 4], 3
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d468
mov eax, 0x75dc5c
push edi
push str.IDMIECC.dll
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402310
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d486
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c630
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d49c
mov eax, 0x75dc5c
push edi
push str.IDMIECC64.dll
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402310
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d4ba
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c630
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d4d0
mov eax, 0x75dc5c
push edi
push str.IDMGetAll.dll
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402310
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d4ee
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c630
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d504
mov eax, 0x75dc5c
push edi
push str.idmmkb.dll
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402310
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d522
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c630
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d538
mov eax, 0x75dc5c
push edi
push 0x67d948
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402310
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d556
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c630
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d56c
mov eax, 0x75dc5c
push edi
push str.IDManTypeInfo.tlb
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402310
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d58a
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c630
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d5a0
mov eax, 0x75dc5c
push edi
push str.Uninstall.exe
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402310
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d5be
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c630
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d5d4
mov eax, 0x75dc5c
push edi
push str.IEExt.htm
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402310
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d5f2
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c630
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d608
mov eax, 0x75dc5c
push edi
push str.IEGetAll.htm
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402310
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d626
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c630
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d63c
mov eax, 0x75dc5c
push edi
push str.idmmzcc3.xpi
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402310
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d65a
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c630
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d670
mov eax, 0x75dc5c
push edi
push str.IDMShellExt.dll
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402310
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d68e
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c630
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d6a4
mov eax, 0x75dc5c
push edi
push str.IDMNetMon.dll
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402310
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d6c2
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c630
mov eax, dword [0x75dc58]
cmp dword [0x75dbc0], edi
je 0x41d7bf
cmp eax, edi
jne 0x41d6e4
mov eax, 0x75dc5c
push edi
push str.IDMNetMonAA.dll
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402310
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d702
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c630
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d718
mov eax, 0x75dc5c
push edi
push str.IDMShellExtAA.dll
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402310
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d736
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c630
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d74c
mov eax, 0x75dc5c
push edi
push str.IDMVMPrsAA.dll
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402310
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d76a
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c630
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d780
mov eax, 0x75dc5c
push edi
push str.idmbrbtnAA.dll
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402310
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d79e
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c630
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d7b4
mov eax, 0x75dc5c
push edi
push str.IDMIntegratorAA.exe
jmp 0x41d89e
cmp eax, edi
jne 0x41d7c8
mov eax, 0x75dc5c
push edi
push str.IDMNetMon64.dll
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402310
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d7e6
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c630
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d7fc
mov eax, 0x75dc5c
push edi
push str.IDMShellExt64.dll
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402310
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d81a
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c630
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d830
mov eax, 0x75dc5c
push edi
push str.idmbrbtn64.dll
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402310
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d84e
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c630
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d864
mov eax, 0x75dc5c
push edi
push str.IDMVMPrs64.dll
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402310
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d882
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c630
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d898
mov eax, 0x75dc5c
push edi
push str.IDMIntegrator64.exe
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402310
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d8b6
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c630
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d8cc
mov eax, 0x75dc5c
push edi
push 0x67d744
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402310
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d8ea
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c630
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d900
mov eax, 0x75dc5c
push edi
push str.IDMGrHlp.exe
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402310
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d91e
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c630
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d934
mov eax, 0x75dc5c
push edi
push str.idmfsa.dll
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402310
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d952
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c630
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d968
mov eax, 0x75dc5c
push edi
push str.IEMonitor.exe
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402310
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d986
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c630
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d99c
mov eax, 0x75dc5c
push edi
push str.idmftype.dll
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402310
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d9ba
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c630
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d9d0
mov eax, 0x75dc5c
push edi
push str.IDMGetAll64.dll
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402310
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d9ee
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c630
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41da04
mov eax, 0x75dc5c
push edi
push str.downlWithIDM64.dll
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402310
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41da22
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c630
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41da38
mov eax, 0x75dc5c
push edi
push str.IDMFType.dat
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402310
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41da56
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c630
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41da6c
mov eax, 0x75dc5c
push edi
push str.IDMFType64.dll
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402310
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41da8a
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c630
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41daa0
mov eax, 0x75dc5c
push edi
push str.IDMGCExt.crx
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402310
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41dabe
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c630
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41dad4
mov eax, 0x75dc5c
push edi
push str.idmvs.dll
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402310
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41daf2
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c630
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41db08
mov eax, 0x75dc5c
push edi
push str.idmBroker.exe
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402310
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41db26
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c630
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41db3c
mov eax, 0x75dc5c
push edi
push str.MediumILStart.exe
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402310
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41db5a
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c630
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41db70
mov eax, 0x75dc5c
push edi
push str.idmindex.dll
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402310
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41db8e
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c630
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41dba4
mov eax, 0x75dc5c
push edi
push str.idmvconv.dll
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402310
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41dbc2
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c630
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41dbd8
mov eax, 0x75dc5c
push edi
push str.IDMMsgHost.exe
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402310
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41dbf6
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c630
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41dc0c
mov eax, 0x75dc5c
push edi
push str.IDMMsgHost.json
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402310
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41dc2a
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c630
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41dc40
mov eax, 0x75dc5c
push edi
push str.IDMMsgHostMoz.json
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402310
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41dc5e
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c630
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41dc74
mov eax, 0x75dc5c
push edi
push str.IDMOpExt.nex
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402310
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41dc92
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c630
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41dca8
mov eax, 0x75dc5c
push edi
push str.IDMGCExt59.crx
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402310
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41dcc6
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c630
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41dcdc
mov eax, 0x75dc5c
push edi
push str.idmfc.dat
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402310
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41dcfa
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c630
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41dd10
mov eax, 0x75dc5c
push edi
push str.IDMVMPrs.dll
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402310
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41dd2e
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c630
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41dd44
mov eax, 0x75dc5c
push edi
push str.libcrypto.dll
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402310
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41dd62
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c630
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41dd78
mov eax, 0x75dc5c
push edi
push str.libssl.dll
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402310
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41dd96
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c630
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41ddac
mov eax, 0x75dc5c
push edi
push str.IDMEdgeExt.crx
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402310
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41ddca
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c630
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.00401210
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x220]
xor ecx, ebp
call fcn.00620b8d
add ebp, 0x224
mov esp, ebp
pop ebp
ret