Function at 0x41ce80
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x224]
sub esp, 0x224
push 0xffffffffffffffff
push 0x639748
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x74d890]
xor eax, ebp
mov dword [ebp + 0x220], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
xor edi, edi
mov dword [ebp - 4], edi
push 0x104
lea eax, [ebp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x41cf5a
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x14], edi
xor ecx, ecx
mov word [ebp - 0x18], cx
mov bl, 1
mov byte [ebp - 4], bl
push edi
lea edx, [ebp + 0x18]
push edx
push str._sdriversidmtdi.sys
lea ecx, [ebp - 0x1c]
call fcn.004021b0
mov eax, dword [ebp - 0x1c]
cmp eax, edi
jne 0x41cf07
lea eax, [ebp - 0x18]
push eax
mov ecx, esi
call fcn.0041c150
mov dword [ebp], edi
mov dword [ebp + 8], edi
xor eax, eax
mov word [ebp + 4], ax
mov byte [ebp - 4], 2
push edi
lea ecx, [ebp + 0x18]
push ecx
push str._sdriversidmwfp.sys
lea ecx, [ebp]
call fcn.004021b0
mov eax, dword [ebp]
cmp eax, edi
jne 0x41cf3b
lea eax, [ebp + 4]
push eax
mov ecx, esi
call fcn.0041c150
mov byte [ebp - 4], bl
lea ecx, [ebp]
call fcn.00401210
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.00401210
mov dword [ebp + 0xc], edi
mov dword [ebp + 0x14], edi
xor edx, edx
mov word [ebp + 0x10], dx
mov byte [ebp - 4], 3
mov eax, dword [0x752c3c]
cmp eax, edi
jne 0x41cf78
mov eax, 0x752c40
push edi
push str.IDMIECC.dll
push eax
push 0x66dde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41cf96
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c150
mov eax, dword [0x752c3c]
cmp eax, edi
jne 0x41cfac
mov eax, 0x752c40
push edi
push str.IDMIECC64.dll
push eax
push 0x66dde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41cfca
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c150
mov eax, dword [0x752c3c]
cmp eax, edi
jne 0x41cfe0
mov eax, 0x752c40
push edi
push str.IDMGetAll.dll
push eax
push 0x66dde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41cffe
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c150
mov eax, dword [0x752c3c]
cmp eax, edi
jne 0x41d014
mov eax, 0x752c40
push edi
push str.idmmkb.dll
push eax
push 0x66dde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d032
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c150
mov eax, dword [0x752c3c]
cmp eax, edi
jne 0x41d048
mov eax, 0x752c40
push edi
push 0x6726d4
push eax
push 0x66dde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d066
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c150
mov eax, dword [0x752c3c]
cmp eax, edi
jne 0x41d07c
mov eax, 0x752c40
push edi
push str.IDManTypeInfo.tlb
push eax
push 0x66dde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d09a
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c150
mov eax, dword [0x752c3c]
cmp eax, edi
jne 0x41d0b0
mov eax, 0x752c40
push edi
push str.Uninstall.exe
push eax
push 0x66dde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d0ce
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c150
mov eax, dword [0x752c3c]
cmp eax, edi
jne 0x41d0e4
mov eax, 0x752c40
push edi
push str.IEExt.htm
push eax
push 0x66dde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d102
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c150
mov eax, dword [0x752c3c]
cmp eax, edi
jne 0x41d118
mov eax, 0x752c40
push edi
push str.IEGetAll.htm
push eax
push 0x66dde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d136
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c150
mov eax, dword [0x752c3c]
cmp eax, edi
jne 0x41d14c
mov eax, 0x752c40
push edi
push str.idmmzcc3.xpi
push eax
push 0x66dde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d16a
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c150
mov eax, dword [0x752c3c]
cmp eax, edi
jne 0x41d180
mov eax, 0x752c40
push edi
push str.IDMShellExt.dll
push eax
push 0x66dde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d19e
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c150
mov eax, dword [0x752c3c]
cmp eax, edi
jne 0x41d1b4
mov eax, 0x752c40
push edi
push str.IDMNetMon.dll
push eax
push 0x66dde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d1d2
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c150
mov eax, dword [0x752c3c]
cmp eax, edi
jne 0x41d1e8
mov eax, 0x752c40
push edi
push str.IDMNetMon64.dll
push eax
push 0x66dde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d206
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c150
mov eax, dword [0x752c3c]
cmp eax, edi
jne 0x41d21c
mov eax, 0x752c40
push edi
push str.IDMShellExt64.dll
push eax
push 0x66dde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d23a
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c150
mov eax, dword [0x752c3c]
cmp eax, edi
jne 0x41d250
mov eax, 0x752c40
push edi
push 0x6725e4
push eax
push 0x66dde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d26e
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c150
mov eax, dword [0x752c3c]
cmp eax, edi
jne 0x41d284
mov eax, 0x752c40
push edi
push str.idmbrbtn64.dll
push eax
push 0x66dde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d2a2
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c150
mov eax, dword [0x752c3c]
cmp eax, edi
jne 0x41d2b8
mov eax, 0x752c40
push edi
push str.IDMGrHlp.exe
push eax
push 0x66dde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d2d6
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c150
mov eax, dword [0x752c3c]
cmp eax, edi
jne 0x41d2ec
mov eax, 0x752c40
push edi
push str.idmfsa.dll
push eax
push 0x66dde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d30a
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c150
mov eax, dword [0x752c3c]
cmp eax, edi
jne 0x41d320
mov eax, 0x752c40
push edi
push str.IEMonitor.exe
push eax
push 0x66dde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d33e
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c150
mov eax, dword [0x752c3c]
cmp eax, edi
jne 0x41d354
mov eax, 0x752c40
push edi
push str.idmftype.dll
push eax
push 0x66dde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d372
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c150
mov eax, dword [0x752c3c]
cmp eax, edi
jne 0x41d388
mov eax, 0x752c40
push edi
push str.IDMGetAll64.dll
push eax
push 0x66dde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d3a6
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c150
mov eax, dword [0x752c3c]
cmp eax, edi
jne 0x41d3bc
mov eax, 0x752c40
push edi
push str.downlWithIDM64.dll
push eax
push 0x66dde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d3da
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c150
mov eax, dword [0x752c3c]
cmp eax, edi
jne 0x41d3f0
mov eax, 0x752c40
push edi
push str.IDMIntegrator64.exe
push eax
push 0x66dde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d40e
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c150
mov eax, dword [0x752c3c]
cmp eax, edi
jne 0x41d424
mov eax, 0x752c40
push edi
push str.IDMFType.dat
push eax
push 0x66dde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d442
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c150
mov eax, dword [0x752c3c]
cmp eax, edi
jne 0x41d458
mov eax, 0x752c40
push edi
push str.IDMFType64.dll
push eax
push 0x66dde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d476
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c150
mov eax, dword [0x752c3c]
cmp eax, edi
jne 0x41d48c
mov eax, 0x752c40
push edi
push str.IDMGCExt.crx
push eax
push 0x66dde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d4aa
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c150
mov eax, dword [0x752c3c]
cmp eax, edi
jne 0x41d4c0
mov eax, 0x752c40
push edi
push str.idmvs.dll
push eax
push 0x66dde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d4de
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c150
mov eax, dword [0x752c3c]
cmp eax, edi
jne 0x41d4f4
mov eax, 0x752c40
push edi
push str.idmBroker.exe
push eax
push 0x66dde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d512
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c150
mov eax, dword [0x752c3c]
cmp eax, edi
jne 0x41d528
mov eax, 0x752c40
push edi
push str.MediumILStart.exe
push eax
push 0x66dde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d546
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c150
mov eax, dword [0x752c3c]
cmp eax, edi
jne 0x41d55c
mov eax, 0x752c40
push edi
push str.idmindex.dll
push eax
push 0x66dde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d57a
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c150
mov eax, dword [0x752c3c]
cmp eax, edi
jne 0x41d590
mov eax, 0x752c40
push edi
push str.idmvconv.dll
push eax
push 0x66dde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d5ae
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c150
mov eax, dword [0x752c3c]
cmp eax, edi
jne 0x41d5c4
mov eax, 0x752c40
push edi
push str.IDMMsgHost.exe
push eax
push 0x66dde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d5e2
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c150
mov eax, dword [0x752c3c]
cmp eax, edi
jne 0x41d5f8
mov eax, 0x752c40
push edi
push str.IDMMsgHost.json
push eax
push 0x66dde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d616
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c150
mov eax, dword [0x752c3c]
cmp eax, edi
jne 0x41d62c
mov eax, 0x752c40
push edi
push str.IDMMsgHostMoz.json
push eax
push 0x66dde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d64a
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c150
mov eax, dword [0x752c3c]
cmp eax, edi
jne 0x41d660
mov eax, 0x752c40
push edi
push str.IDMOpExt.nex
push eax
push 0x66dde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d67e
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c150
mov eax, dword [0x752c3c]
cmp eax, edi
jne 0x41d694
mov eax, 0x752c40
push edi
push str.IDMGCExt59.crx
push eax
push 0x66dde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d6b2
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c150
mov eax, dword [0x752c3c]
cmp eax, edi
jne 0x41d6c8
mov eax, 0x752c40
push edi
push str.idmfc.dat
push eax
push 0x66dde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d6e6
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c150
mov eax, dword [0x752c3c]
cmp eax, edi
jne 0x41d6fc
mov eax, 0x752c40
push edi
push str.IDMVMPrs.dll
push eax
push 0x66dde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d71a
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c150
mov eax, dword [0x752c3c]
cmp eax, edi
jne 0x41d730
mov eax, 0x752c40
push edi
push str.IDMVMPrs64.dll
push eax
push 0x66dde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d74e
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c150
mov eax, dword [0x752c3c]
cmp eax, edi
jne 0x41d764
mov eax, 0x752c40
push edi
push str.libcrypto.dll
push eax
push 0x66dde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d782
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c150
mov eax, dword [0x752c3c]
cmp eax, edi
jne 0x41d798
mov eax, 0x752c40
push edi
push str.libssl.dll
push eax
push 0x66dde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d7b6
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c150
mov eax, dword [0x752c3c]
cmp eax, edi
jne 0x41d7cc
mov eax, 0x752c40
push edi
push str.IDMEdgeExt.crx
push eax
push 0x66dde0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d7ea
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c150
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.00401210
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x220]
xor ecx, ebp
call fcn.006157d3
add ebp, 0x224
mov esp, ebp
pop ebp
ret