Function at 0x41c9d0
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x224]
sub esp, 0x224
push 0xffffffffffffffff
push 0x61c578
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x70a308]
xor eax, ebp
mov dword [ebp + 0x220], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
xor edi, edi
mov dword [ebp - 4], edi
push 0x104
lea eax, [ebp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x41caaa
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x14], edi
xor ecx, ecx
mov word [ebp - 0x18], cx
mov bl, 1
mov byte [ebp - 4], bl
push edi
lea edx, [ebp + 0x18]
push edx
push str._sdriversidmtdi.sys
lea ecx, [ebp - 0x1c]
call fcn.00402190
mov eax, dword [ebp - 0x1c]
cmp eax, edi
jne 0x41ca57
lea eax, [ebp - 0x18]
push eax
mov ecx, esi
call fcn.0041bca0
mov dword [ebp], edi
mov dword [ebp + 8], edi
xor eax, eax
mov word [ebp + 4], ax
mov byte [ebp - 4], 2
push edi
lea ecx, [ebp + 0x18]
push ecx
push str._sdriversidmwfp.sys
lea ecx, [ebp]
call fcn.00402190
mov eax, dword [ebp]
cmp eax, edi
jne 0x41ca8b
lea eax, [ebp + 4]
push eax
mov ecx, esi
call fcn.0041bca0
mov byte [ebp - 4], bl
lea ecx, [ebp]
call fcn.004011f0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.004011f0
mov dword [ebp + 0xc], edi
mov dword [ebp + 0x14], edi
xor edx, edx
mov word [ebp + 0x10], dx
mov byte [ebp - 4], 3
mov eax, dword [0x70f66c]
cmp eax, edi
jne 0x41cac8
mov eax, 0x70f670
push edi
push str.IDMIECC.dll
push eax
push 0x64ed70
lea ecx, [ebp + 0xc]
call fcn.00402300
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41cae6
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041bca0
mov eax, dword [0x70f66c]
cmp eax, edi
jne 0x41cafc
mov eax, 0x70f670
push edi
push str.IDMIECC64.dll
push eax
push 0x64ed70
lea ecx, [ebp + 0xc]
call fcn.00402300
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41cb1a
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041bca0
mov eax, dword [0x70f66c]
cmp eax, edi
jne 0x41cb30
mov eax, 0x70f670
push edi
push str.IDMGetAll.dll
push eax
push 0x64ed70
lea ecx, [ebp + 0xc]
call fcn.00402300
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41cb4e
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041bca0
mov eax, dword [0x70f66c]
cmp eax, edi
jne 0x41cb64
mov eax, 0x70f670
push edi
push str.idmmkb.dll
push eax
push 0x64ed70
lea ecx, [ebp + 0xc]
call fcn.00402300
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41cb82
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041bca0
mov eax, dword [0x70f66c]
cmp eax, edi
jne 0x41cb98
mov eax, 0x70f670
push edi
push 0x6535dc
push eax
push 0x64ed70
lea ecx, [ebp + 0xc]
call fcn.00402300
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41cbb6
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041bca0
mov eax, dword [0x70f66c]
cmp eax, edi
jne 0x41cbcc
mov eax, 0x70f670
push edi
push str.IDManTypeInfo.tlb
push eax
push 0x64ed70
lea ecx, [ebp + 0xc]
call fcn.00402300
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41cbea
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041bca0
mov eax, dword [0x70f66c]
cmp eax, edi
jne 0x41cc00
mov eax, 0x70f670
push edi
push str.Uninstall.exe
push eax
push 0x64ed70
lea ecx, [ebp + 0xc]
call fcn.00402300
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41cc1e
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041bca0
mov eax, dword [0x70f66c]
cmp eax, edi
jne 0x41cc34
mov eax, 0x70f670
push edi
push str.IEExt.htm
push eax
push 0x64ed70
lea ecx, [ebp + 0xc]
call fcn.00402300
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41cc52
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041bca0
mov eax, dword [0x70f66c]
cmp eax, edi
jne 0x41cc68
mov eax, 0x70f670
push edi
push str.IEGetAll.htm
push eax
push 0x64ed70
lea ecx, [ebp + 0xc]
call fcn.00402300
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41cc86
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041bca0
mov eax, dword [0x70f66c]
cmp eax, edi
jne 0x41cc9c
mov eax, 0x70f670
push edi
push str.idmmzcc3.xpi
push eax
push 0x64ed70
lea ecx, [ebp + 0xc]
call fcn.00402300
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41ccba
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041bca0
mov eax, dword [0x70f66c]
cmp eax, edi
jne 0x41ccd0
mov eax, 0x70f670
push edi
push str.IDMShellExt.dll
push eax
push 0x64ed70
lea ecx, [ebp + 0xc]
call fcn.00402300
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41ccee
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041bca0
mov eax, dword [0x70f66c]
cmp eax, edi
jne 0x41cd04
mov eax, 0x70f670
push edi
push str.IDMNetMon.dll
push eax
push 0x64ed70
lea ecx, [ebp + 0xc]
call fcn.00402300
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41cd22
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041bca0
mov eax, dword [0x70f66c]
cmp eax, edi
jne 0x41cd38
mov eax, 0x70f670
push edi
push str.IDMNetMon64.dll
push eax
push 0x64ed70
lea ecx, [ebp + 0xc]
call fcn.00402300
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41cd56
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041bca0
mov eax, dword [0x70f66c]
cmp eax, edi
jne 0x41cd6c
mov eax, 0x70f670
push edi
push str.IDMShellExt64.dll
push eax
push 0x64ed70
lea ecx, [ebp + 0xc]
call fcn.00402300
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41cd8a
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041bca0
mov eax, dword [0x70f66c]
cmp eax, edi
jne 0x41cda0
mov eax, 0x70f670
push edi
push 0x6534ec
push eax
push 0x64ed70
lea ecx, [ebp + 0xc]
call fcn.00402300
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41cdbe
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041bca0
mov eax, dword [0x70f66c]
cmp eax, edi
jne 0x41cdd4
mov eax, 0x70f670
push edi
push str.idmbrbtn64.dll
push eax
push 0x64ed70
lea ecx, [ebp + 0xc]
call fcn.00402300
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41cdf2
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041bca0
mov eax, dword [0x70f66c]
cmp eax, edi
jne 0x41ce08
mov eax, 0x70f670
push edi
push str.IDMGrHlp.exe
push eax
push 0x64ed70
lea ecx, [ebp + 0xc]
call fcn.00402300
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41ce26
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041bca0
mov eax, dword [0x70f66c]
cmp eax, edi
jne 0x41ce3c
mov eax, 0x70f670
push edi
push str.idmfsa.dll
push eax
push 0x64ed70
lea ecx, [ebp + 0xc]
call fcn.00402300
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41ce5a
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041bca0
mov eax, dword [0x70f66c]
cmp eax, edi
jne 0x41ce70
mov eax, 0x70f670
push edi
push str.IEMonitor.exe
push eax
push 0x64ed70
lea ecx, [ebp + 0xc]
call fcn.00402300
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41ce8e
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041bca0
mov eax, dword [0x70f66c]
cmp eax, edi
jne 0x41cea4
mov eax, 0x70f670
push edi
push str.idmftype.dll
push eax
push 0x64ed70
lea ecx, [ebp + 0xc]
call fcn.00402300
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41cec2
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041bca0
mov eax, dword [0x70f66c]
cmp eax, edi
jne 0x41ced8
mov eax, 0x70f670
push edi
push str.IDMGetAll64.dll
push eax
push 0x64ed70
lea ecx, [ebp + 0xc]
call fcn.00402300
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41cef6
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041bca0
mov eax, dword [0x70f66c]
cmp eax, edi
jne 0x41cf0c
mov eax, 0x70f670
push edi
push str.downlWithIDM64.dll
push eax
push 0x64ed70
lea ecx, [ebp + 0xc]
call fcn.00402300
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41cf2a
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041bca0
mov eax, dword [0x70f66c]
cmp eax, edi
jne 0x41cf40
mov eax, 0x70f670
push edi
push str.IDMIntegrator64.exe
push eax
push 0x64ed70
lea ecx, [ebp + 0xc]
call fcn.00402300
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41cf5e
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041bca0
mov eax, dword [0x70f66c]
cmp eax, edi
jne 0x41cf74
mov eax, 0x70f670
push edi
push str.IDMFType.dat
push eax
push 0x64ed70
lea ecx, [ebp + 0xc]
call fcn.00402300
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41cf92
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041bca0
mov eax, dword [0x70f66c]
cmp eax, edi
jne 0x41cfa8
mov eax, 0x70f670
push edi
push str.IDMFType64.dll
push eax
push 0x64ed70
lea ecx, [ebp + 0xc]
call fcn.00402300
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41cfc6
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041bca0
mov eax, dword [0x70f66c]
cmp eax, edi
jne 0x41cfdc
mov eax, 0x70f670
push edi
push str.IDMGCExt.crx
push eax
push 0x64ed70
lea ecx, [ebp + 0xc]
call fcn.00402300
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41cffa
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041bca0
mov eax, dword [0x70f66c]
cmp eax, edi
jne 0x41d010
mov eax, 0x70f670
push edi
push str.idmvs.dll
push eax
push 0x64ed70
lea ecx, [ebp + 0xc]
call fcn.00402300
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d02e
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041bca0
mov eax, dword [0x70f66c]
cmp eax, edi
jne 0x41d044
mov eax, 0x70f670
push edi
push str.idmBroker.exe
push eax
push 0x64ed70
lea ecx, [ebp + 0xc]
call fcn.00402300
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d062
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041bca0
mov eax, dword [0x70f66c]
cmp eax, edi
jne 0x41d078
mov eax, 0x70f670
push edi
push str.MediumILStart.exe
push eax
push 0x64ed70
lea ecx, [ebp + 0xc]
call fcn.00402300
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d096
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041bca0
mov eax, dword [0x70f66c]
cmp eax, edi
jne 0x41d0ac
mov eax, 0x70f670
push edi
push str.idmindex.dll
push eax
push 0x64ed70
lea ecx, [ebp + 0xc]
call fcn.00402300
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d0ca
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041bca0
mov eax, dword [0x70f66c]
cmp eax, edi
jne 0x41d0e0
mov eax, 0x70f670
push edi
push str.idmvconv.dll
push eax
push 0x64ed70
lea ecx, [ebp + 0xc]
call fcn.00402300
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d0fe
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041bca0
mov eax, dword [0x70f66c]
cmp eax, edi
jne 0x41d114
mov eax, 0x70f670
push edi
push str.IDMMsgHost.exe
push eax
push 0x64ed70
lea ecx, [ebp + 0xc]
call fcn.00402300
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d132
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041bca0
mov eax, dword [0x70f66c]
cmp eax, edi
jne 0x41d148
mov eax, 0x70f670
push edi
push str.IDMMsgHost.json
push eax
push 0x64ed70
lea ecx, [ebp + 0xc]
call fcn.00402300
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d166
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041bca0
mov eax, dword [0x70f66c]
cmp eax, edi
jne 0x41d17c
mov eax, 0x70f670
push edi
push str.IDMMsgHostMoz.json
push eax
push 0x64ed70
lea ecx, [ebp + 0xc]
call fcn.00402300
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d19a
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041bca0
mov eax, dword [0x70f66c]
cmp eax, edi
jne 0x41d1b0
mov eax, 0x70f670
push edi
push str.IDMOpExt.nex
push eax
push 0x64ed70
lea ecx, [ebp + 0xc]
call fcn.00402300
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d1ce
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041bca0
mov eax, dword [0x70f66c]
cmp eax, edi
jne 0x41d1e4
mov eax, 0x70f670
push edi
push str.IDMGCExt59.crx
push eax
push 0x64ed70
lea ecx, [ebp + 0xc]
call fcn.00402300
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d202
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041bca0
mov eax, dword [0x70f66c]
cmp eax, edi
jne 0x41d218
mov eax, 0x70f670
push edi
push str.idmfc.dat
push eax
push 0x64ed70
lea ecx, [ebp + 0xc]
call fcn.00402300
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d236
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041bca0
mov eax, dword [0x70f66c]
cmp eax, edi
jne 0x41d24c
mov eax, 0x70f670
push edi
push str.IDMVMPrs.dll
push eax
push 0x64ed70
lea ecx, [ebp + 0xc]
call fcn.00402300
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d26a
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041bca0
mov eax, dword [0x70f66c]
cmp eax, edi
jne 0x41d280
mov eax, 0x70f670
push edi
push str.IDMVMPrs64.dll
push eax
push 0x64ed70
lea ecx, [ebp + 0xc]
call fcn.00402300
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d29e
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041bca0
mov eax, dword [0x70f66c]
cmp eax, edi
jne 0x41d2b4
mov eax, 0x70f670
push edi
push str.libcrypto.dll
push eax
push 0x64ed70
lea ecx, [ebp + 0xc]
call fcn.00402300
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d2d2
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041bca0
mov eax, dword [0x70f66c]
cmp eax, edi
jne 0x41d2e8
mov eax, 0x70f670
push edi
push str.libssl.dll
push eax
push 0x64ed70
lea ecx, [ebp + 0xc]
call fcn.00402300
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d306
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041bca0
mov eax, dword [0x70f66c]
cmp eax, edi
jne 0x41d31c
mov eax, 0x70f670
push edi
push str.IDMEdgeExt.crx
push eax
push 0x64ed70
lea ecx, [ebp + 0xc]
call fcn.00402300
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d33a
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041bca0
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.004011f0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x220]
xor ecx, ebp
call fcn.005f85e7
add ebp, 0x224
mov esp, ebp
pop ebp
ret