Function at 0x41d330
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x224]
sub esp, 0x224
push 0xffffffffffffffff
push 0x641328
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x755898]
xor eax, ebp
mov dword [ebp + 0x220], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
xor edi, edi
mov dword [ebp - 4], edi
push 0x104
lea eax, [ebp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x41d40a
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x14], edi
xor ecx, ecx
mov word [ebp - 0x18], cx
mov bl, 1
mov byte [ebp - 4], bl
push edi
lea edx, [ebp + 0x18]
push edx
push str._sdriversidmtdi.sys
lea ecx, [ebp - 0x1c]
call fcn.004021b0
mov eax, dword [ebp - 0x1c]
cmp eax, edi
jne 0x41d3b7
lea eax, [ebp - 0x18]
push eax
mov ecx, esi
call fcn.0041c600
mov dword [ebp], edi
mov dword [ebp + 8], edi
xor eax, eax
mov word [ebp + 4], ax
mov byte [ebp - 4], 2
push edi
lea ecx, [ebp + 0x18]
push ecx
push str._sdriversidmwfp.sys
lea ecx, [ebp]
call fcn.004021b0
mov eax, dword [ebp]
cmp eax, edi
jne 0x41d3eb
lea eax, [ebp + 4]
push eax
mov ecx, esi
call fcn.0041c600
mov byte [ebp - 4], bl
lea ecx, [ebp]
call fcn.00401210
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.00401210
mov dword [ebp + 0xc], edi
mov dword [ebp + 0x14], edi
xor edx, edx
mov word [ebp + 0x10], dx
mov byte [ebp - 4], 3
mov eax, dword [0x75ac4c]
cmp eax, edi
jne 0x41d428
mov eax, 0x75ac50
push edi
push str.IDMIECC.dll
push eax
push 0x675de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d446
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c600
mov eax, dword [0x75ac4c]
cmp eax, edi
jne 0x41d45c
mov eax, 0x75ac50
push edi
push str.IDMIECC64.dll
push eax
push 0x675de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d47a
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c600
mov eax, dword [0x75ac4c]
cmp eax, edi
jne 0x41d490
mov eax, 0x75ac50
push edi
push str.IDMGetAll.dll
push eax
push 0x675de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d4ae
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c600
mov eax, dword [0x75ac4c]
cmp eax, edi
jne 0x41d4c4
mov eax, 0x75ac50
push edi
push str.idmmkb.dll
push eax
push 0x675de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d4e2
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c600
mov eax, dword [0x75ac4c]
cmp eax, edi
jne 0x41d4f8
mov eax, 0x75ac50
push edi
push 0x67a73c
push eax
push 0x675de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d516
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c600
mov eax, dword [0x75ac4c]
cmp eax, edi
jne 0x41d52c
mov eax, 0x75ac50
push edi
push str.IDManTypeInfo.tlb
push eax
push 0x675de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d54a
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c600
mov eax, dword [0x75ac4c]
cmp eax, edi
jne 0x41d560
mov eax, 0x75ac50
push edi
push str.Uninstall.exe
push eax
push 0x675de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d57e
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c600
mov eax, dword [0x75ac4c]
cmp eax, edi
jne 0x41d594
mov eax, 0x75ac50
push edi
push str.IEExt.htm
push eax
push 0x675de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d5b2
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c600
mov eax, dword [0x75ac4c]
cmp eax, edi
jne 0x41d5c8
mov eax, 0x75ac50
push edi
push str.IEGetAll.htm
push eax
push 0x675de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d5e6
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c600
mov eax, dword [0x75ac4c]
cmp eax, edi
jne 0x41d5fc
mov eax, 0x75ac50
push edi
push str.idmmzcc3.xpi
push eax
push 0x675de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d61a
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c600
mov eax, dword [0x75ac4c]
cmp eax, edi
jne 0x41d630
mov eax, 0x75ac50
push edi
push str.IDMShellExt.dll
push eax
push 0x675de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d64e
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c600
mov eax, dword [0x75ac4c]
cmp eax, edi
jne 0x41d664
mov eax, 0x75ac50
push edi
push str.IDMNetMon.dll
push eax
push 0x675de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d682
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c600
mov eax, dword [0x75ac4c]
cmp eax, edi
jne 0x41d698
mov eax, 0x75ac50
push edi
push str.IDMNetMon64.dll
push eax
push 0x675de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d6b6
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c600
mov eax, dword [0x75ac4c]
cmp eax, edi
jne 0x41d6cc
mov eax, 0x75ac50
push edi
push str.IDMShellExt64.dll
push eax
push 0x675de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d6ea
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c600
mov eax, dword [0x75ac4c]
cmp eax, edi
jne 0x41d700
mov eax, 0x75ac50
push edi
push 0x67a64c
push eax
push 0x675de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d71e
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c600
mov eax, dword [0x75ac4c]
cmp eax, edi
jne 0x41d734
mov eax, 0x75ac50
push edi
push str.idmbrbtn64.dll
push eax
push 0x675de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d752
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c600
mov eax, dword [0x75ac4c]
cmp eax, edi
jne 0x41d768
mov eax, 0x75ac50
push edi
push str.IDMGrHlp.exe
push eax
push 0x675de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d786
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c600
mov eax, dword [0x75ac4c]
cmp eax, edi
jne 0x41d79c
mov eax, 0x75ac50
push edi
push str.idmfsa.dll
push eax
push 0x675de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d7ba
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c600
mov eax, dword [0x75ac4c]
cmp eax, edi
jne 0x41d7d0
mov eax, 0x75ac50
push edi
push str.IEMonitor.exe
push eax
push 0x675de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d7ee
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c600
mov eax, dword [0x75ac4c]
cmp eax, edi
jne 0x41d804
mov eax, 0x75ac50
push edi
push str.idmftype.dll
push eax
push 0x675de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d822
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c600
mov eax, dword [0x75ac4c]
cmp eax, edi
jne 0x41d838
mov eax, 0x75ac50
push edi
push str.IDMGetAll64.dll
push eax
push 0x675de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d856
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c600
mov eax, dword [0x75ac4c]
cmp eax, edi
jne 0x41d86c
mov eax, 0x75ac50
push edi
push str.downlWithIDM64.dll
push eax
push 0x675de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d88a
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c600
mov eax, dword [0x75ac4c]
cmp eax, edi
jne 0x41d8a0
mov eax, 0x75ac50
push edi
push str.IDMIntegrator64.exe
push eax
push 0x675de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d8be
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c600
mov eax, dword [0x75ac4c]
cmp eax, edi
jne 0x41d8d4
mov eax, 0x75ac50
push edi
push str.IDMFType.dat
push eax
push 0x675de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d8f2
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c600
mov eax, dword [0x75ac4c]
cmp eax, edi
jne 0x41d908
mov eax, 0x75ac50
push edi
push str.IDMFType64.dll
push eax
push 0x675de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d926
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c600
mov eax, dword [0x75ac4c]
cmp eax, edi
jne 0x41d93c
mov eax, 0x75ac50
push edi
push str.IDMGCExt.crx
push eax
push 0x675de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d95a
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c600
mov eax, dword [0x75ac4c]
cmp eax, edi
jne 0x41d970
mov eax, 0x75ac50
push edi
push str.idmvs.dll
push eax
push 0x675de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d98e
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c600
mov eax, dword [0x75ac4c]
cmp eax, edi
jne 0x41d9a4
mov eax, 0x75ac50
push edi
push str.idmBroker.exe
push eax
push 0x675de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d9c2
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c600
mov eax, dword [0x75ac4c]
cmp eax, edi
jne 0x41d9d8
mov eax, 0x75ac50
push edi
push str.MediumILStart.exe
push eax
push 0x675de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41d9f6
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c600
mov eax, dword [0x75ac4c]
cmp eax, edi
jne 0x41da0c
mov eax, 0x75ac50
push edi
push str.idmindex.dll
push eax
push 0x675de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41da2a
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c600
mov eax, dword [0x75ac4c]
cmp eax, edi
jne 0x41da40
mov eax, 0x75ac50
push edi
push str.idmvconv.dll
push eax
push 0x675de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41da5e
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c600
mov eax, dword [0x75ac4c]
cmp eax, edi
jne 0x41da74
mov eax, 0x75ac50
push edi
push str.IDMMsgHost.exe
push eax
push 0x675de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41da92
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c600
mov eax, dword [0x75ac4c]
cmp eax, edi
jne 0x41daa8
mov eax, 0x75ac50
push edi
push str.IDMMsgHost.json
push eax
push 0x675de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41dac6
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c600
mov eax, dword [0x75ac4c]
cmp eax, edi
jne 0x41dadc
mov eax, 0x75ac50
push edi
push str.IDMMsgHostMoz.json
push eax
push 0x675de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41dafa
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c600
mov eax, dword [0x75ac4c]
cmp eax, edi
jne 0x41db10
mov eax, 0x75ac50
push edi
push str.IDMOpExt.nex
push eax
push 0x675de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41db2e
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c600
mov eax, dword [0x75ac4c]
cmp eax, edi
jne 0x41db44
mov eax, 0x75ac50
push edi
push str.IDMGCExt59.crx
push eax
push 0x675de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41db62
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c600
mov eax, dword [0x75ac4c]
cmp eax, edi
jne 0x41db78
mov eax, 0x75ac50
push edi
push str.idmfc.dat
push eax
push 0x675de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41db96
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c600
mov eax, dword [0x75ac4c]
cmp eax, edi
jne 0x41dbac
mov eax, 0x75ac50
push edi
push str.IDMVMPrs.dll
push eax
push 0x675de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41dbca
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c600
mov eax, dword [0x75ac4c]
cmp eax, edi
jne 0x41dbe0
mov eax, 0x75ac50
push edi
push str.IDMVMPrs64.dll
push eax
push 0x675de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41dbfe
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c600
mov eax, dword [0x75ac4c]
cmp eax, edi
jne 0x41dc14
mov eax, 0x75ac50
push edi
push str.libcrypto.dll
push eax
push 0x675de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41dc32
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c600
mov eax, dword [0x75ac4c]
cmp eax, edi
jne 0x41dc48
mov eax, 0x75ac50
push edi
push str.libssl.dll
push eax
push 0x675de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41dc66
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c600
mov eax, dword [0x75ac4c]
cmp eax, edi
jne 0x41dc7c
mov eax, 0x75ac50
push edi
push str.IDMEdgeExt.crx
push eax
push 0x675de0
lea ecx, [ebp + 0xc]
call fcn.00402320
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41dc9a
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0041c600
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.00401210
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x220]
xor ecx, ebp
call fcn.0061d2ff
add ebp, 0x224
mov esp, ebp
pop ebp
ret