Function at 0x41d3f0
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x224]
sub esp, 0x224
push 0xffffffffffffffff
push 0x644128
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x758898]
xor eax, ebp
mov dword [ebp + 0x220], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
xor edi, edi
mov dword [ebp - 4], edi
push 0x104
lea eax, [ebp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x41d4ca
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x14], edi
xor ecx, ecx
mov word [ebp - 0x18], cx
mov bl, 1
mov byte [ebp - 4], bl
push edi
lea edx, [ebp + 0x18]
push edx
push str._sdriversidmtdi.sys
lea ecx, [ebp - 0x1c]
call fcn.004021b0
mov eax, dword [ebp - 0x1c]
cmp eax, edi
jne 0x41d477
lea eax, [ebp - 0x18]
push eax
mov ecx, esi
call fcn.0041c6c0
mov dword [ebp], edi
mov dword [ebp + 8], edi
xor eax, eax
mov word [ebp + 4], ax
mov byte [ebp - 4], 2
push edi
lea ecx, [ebp + 0x18]
push ecx
push str._sdriversidmwfp.sys
lea ecx, [ebp]
call fcn.004021b0
mov eax, dword [ebp]
cmp eax, edi
jne 0x41d4ab
lea eax, [ebp + 4]
push eax
mov ecx, esi
call fcn.0041c6c0
mov byte [ebp - 4], bl
lea ecx, [ebp]
call fcn.00401210
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.00401210
mov dword [ebp + 0xc], edi
mov dword [ebp + 0x14], edi
xor edx, edx
mov word [ebp + 0x10], dx
mov byte [ebp - 4], 3
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d4e8
mov eax, 0x75dc5c
push edi
push str.IDMIECC.dll
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d506
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c6c0
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d51c
mov eax, 0x75dc5c
push edi
push str.IDMIECC64.dll
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d53a
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c6c0
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d550
mov eax, 0x75dc5c
push edi
push str.IDMGetAll.dll
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d56e
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c6c0
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d584
mov eax, 0x75dc5c
push edi
push str.idmmkb.dll
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d5a2
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c6c0
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d5b8
mov eax, 0x75dc5c
push edi
push 0x67d948
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d5d6
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c6c0
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d5ec
mov eax, 0x75dc5c
push edi
push str.IDManTypeInfo.tlb
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d60a
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c6c0
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d620
mov eax, 0x75dc5c
push edi
push str.Uninstall.exe
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d63e
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c6c0
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d654
mov eax, 0x75dc5c
push edi
push str.IEExt.htm
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d672
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c6c0
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d688
mov eax, 0x75dc5c
push edi
push str.IEGetAll.htm
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d6a6
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c6c0
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d6bc
mov eax, 0x75dc5c
push edi
push str.idmmzcc3.xpi
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d6da
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c6c0
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d6f0
mov eax, 0x75dc5c
push edi
push str.IDMShellExt.dll
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d70e
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c6c0
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d724
mov eax, 0x75dc5c
push edi
push str.IDMNetMon.dll
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d742
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c6c0
mov eax, dword [0x75dc58]
cmp dword [0x75dbc0], edi
je 0x41d83f
cmp eax, edi
jne 0x41d764
mov eax, 0x75dc5c
push edi
push str.IDMNetMonAA.dll
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d782
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c6c0
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d798
mov eax, 0x75dc5c
push edi
push str.IDMShellExtAA.dll
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d7b6
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c6c0
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d7cc
mov eax, 0x75dc5c
push edi
push str.IDMVMPrsAA.dll
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d7ea
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c6c0
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d800
mov eax, 0x75dc5c
push edi
push str.idmbrbtnAA.dll
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d81e
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c6c0
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d834
mov eax, 0x75dc5c
push edi
push str.IDMIntegratorAA.exe
jmp 0x41d91e
cmp eax, edi
jne 0x41d848
mov eax, 0x75dc5c
push edi
push str.IDMNetMon64.dll
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d866
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c6c0
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d87c
mov eax, 0x75dc5c
push edi
push str.IDMShellExt64.dll
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d89a
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c6c0
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d8b0
mov eax, 0x75dc5c
push edi
push str.idmbrbtn64.dll
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d8ce
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c6c0
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d8e4
mov eax, 0x75dc5c
push edi
push str.IDMVMPrs64.dll
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d902
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c6c0
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d918
mov eax, 0x75dc5c
push edi
push str.IDMIntegrator64.exe
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d936
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c6c0
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d94c
mov eax, 0x75dc5c
push edi
push 0x67d744
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d96a
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c6c0
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d980
mov eax, 0x75dc5c
push edi
push str.IDMGrHlp.exe
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d99e
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c6c0
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d9b4
mov eax, 0x75dc5c
push edi
push str.idmfsa.dll
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d9d2
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c6c0
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41d9e8
mov eax, 0x75dc5c
push edi
push str.IEMonitor.exe
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41da06
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c6c0
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41da1c
mov eax, 0x75dc5c
push edi
push str.idmftype.dll
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41da3a
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c6c0
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41da50
mov eax, 0x75dc5c
push edi
push str.IDMGetAll64.dll
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41da6e
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c6c0
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41da84
mov eax, 0x75dc5c
push edi
push str.downlWithIDM64.dll
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41daa2
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c6c0
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41dab8
mov eax, 0x75dc5c
push edi
push str.IDMFType.dat
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41dad6
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c6c0
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41daec
mov eax, 0x75dc5c
push edi
push str.IDMFType64.dll
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41db0a
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c6c0
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41db20
mov eax, 0x75dc5c
push edi
push str.IDMGCExt.crx
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41db3e
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c6c0
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41db54
mov eax, 0x75dc5c
push edi
push str.idmvs.dll
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41db72
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c6c0
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41db88
mov eax, 0x75dc5c
push edi
push str.idmBroker.exe
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41dba6
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c6c0
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41dbbc
mov eax, 0x75dc5c
push edi
push str.MediumILStart.exe
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41dbda
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c6c0
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41dbf0
mov eax, 0x75dc5c
push edi
push str.idmindex.dll
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41dc0e
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c6c0
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41dc24
mov eax, 0x75dc5c
push edi
push str.idmvconv.dll
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41dc42
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c6c0
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41dc58
mov eax, 0x75dc5c
push edi
push str.IDMMsgHost.exe
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41dc76
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c6c0
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41dc8c
mov eax, 0x75dc5c
push edi
push str.IDMMsgHost.json
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41dcaa
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c6c0
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41dcc0
mov eax, 0x75dc5c
push edi
push str.IDMMsgHostMoz.json
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41dcde
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c6c0
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41dcf4
mov eax, 0x75dc5c
push edi
push str.IDMOpExt.nex
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41dd12
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c6c0
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41dd28
mov eax, 0x75dc5c
push edi
push str.IDMGCExt59.crx
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41dd46
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c6c0
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41dd5c
mov eax, 0x75dc5c
push edi
push str.idmfc.dat
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41dd7a
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c6c0
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41dd90
mov eax, 0x75dc5c
push edi
push str.IDMVMPrs.dll
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41ddae
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c6c0
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41ddc4
mov eax, 0x75dc5c
push edi
push str.libcrypto.dll
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41dde2
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c6c0
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41ddf8
mov eax, 0x75dc5c
push edi
push str.libssl.dll
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41de16
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c6c0
mov eax, dword [0x75dc58]
cmp eax, edi
jne 0x41de2c
mov eax, 0x75dc5c
push edi
push str.IDMEdgeExt.crx
push eax
push 0x678de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41de4a
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c6c0
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.00401210
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x220]
xor ecx, ebp
call fcn.0062016f
add ebp, 0x224
mov esp, ebp
pop ebp
ret