Function at 0x417e1b
Capabilities:
Get common file path
Get program files directory

Disassembly:
mov eax, 0x433496
call fcn.004269c8
sub esp, 0x5bc
mov eax, dword [0x44de90]
push ebx
push esi
push edi
mov esi, 0x105
push esi
mov dword [ebp - 0x10], eax
xor ebx, ebx
lea eax, [ebp - 0x52c]
push ebx
push eax
call fcn.00425190
push esi
lea eax, [ebp - 0x388]
push ebx
push eax
call fcn.00425190
push esi
lea eax, [ebp - 0x284]
push ebx
push eax
call fcn.00425190
push esi
lea eax, [ebp - 0x118]
push ebx
push eax
call fcn.00425190
add esp, 0x30
push 0x28
pop ecx
mov eax, 0xe6e6e6e6
mov edi, 0x447118
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x52c]
push eax
push ebx
push ebx
push 0x26
push ebx
call dword [sym.imp.SHFOLDER.dll_SHGetFolderPathA]
test eax, eax
je 0x417eaa
push str._Cannot_get_program_files_folder_path___n
call fcn.00419ab0
pop ecx
jmp 0x417ec4
push 0x104
lea eax, [ebp - 0x284]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp byte [ebp - 0x284], bl
jne 0x417ecb
xor eax, eax
jmp 0x41819b
lea eax, [ebp - 0x284]
push eax
call fcn.00425700
pop ecx
lea ecx, [ebp - 0x284]
dec ecx
cmp byte [eax + ecx], 0x5c
je 0x417efa
lea eax, [ebp - 0x284]
push eax
call fcn.00425700
pop ecx
mov byte [ebp + eax - 0x284], 0x5c
lea eax, [ebp - 0x52c]
push eax
lea eax, [ebp - 0x118]
push eax
call fcn.00425600
lea eax, [ebp - 0x118]
push eax
call fcn.00425700
add esp, 0xc
lea ecx, [ebp - 0x118]
dec ecx
cmp byte [eax + ecx], 0x5c
je 0x417f3e
lea eax, [ebp - 0x118]
push eax
call fcn.00425700
pop ecx
mov byte [ebp + eax - 0x118], 0x5c
lea eax, [ebp - 0x118]
push str.Microsoft_CommonSVCHOST.EXE
push eax
call fcn.00425610
pop ecx
pop ecx
push 1
lea ecx, [ebp - 0x5c8]
call fcn.00417d36
mov esi, 0x1b6
push esi
push 0x21
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x5c8]
mov dword [ebp - 4], ebx
call fcn.00417645
mov eax, dword [ebp - 0x5c8]
mov eax, dword [eax + 4]
cmp dword [ebp + eax - 0x5c0], ebx
jne 0x4180c3
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x530], esp
push 0x15c0
call fcn.004162d9
lea ecx, [ebp - 0x5c8]
call fcn.00416912
mov edi, 0xa0
push edi
lea eax, [ebp - 0x428]
push eax
lea ecx, [ebp - 0x5c8]
call fcn.0041746e
lea ecx, [ebp - 0x5c8]
call fcn.00417cac
push edi
lea eax, [ebp - 0x428]
push 0x447118
push eax
call fcn.00425540
add esp, 0xc
test eax, eax
jne 0x4180c3
lea eax, [ebp - 0x118]
push eax
push str.Detected_:_Worm.Win32.Bezopi.CW_in_file__s__n
call fcn.00419ab0
push str.Cure_is_in_progress
call fcn.00419ab0
lea eax, [ebp - 0x118]
push eax
call fcn.00402774
lea eax, [ebp - 0x118]
push eax
call fcn.0041b113
push str.Done__n
call fcn.00419ab0
push str.Searching_for_malicious_driver
call fcn.00419ab0
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x388]
push eax
call fcn.00425600
lea eax, [ebp - 0x388]
push str.driversip6fw.sys
push eax
call fcn.00425610
add esp, 0x2c
lea ecx, [ebp - 0x5c8]
call fcn.00417cac
mov eax, dword [ebp - 0x5c8]
mov ecx, dword [eax + 4]
lea ecx, [ebp + ecx - 0x5c8]
mov eax, dword [ecx + 0x28]
neg eax
sbb eax, eax
and eax, 0xfffffffc
add eax, 4
push ebx
push eax
call fcn.004308d5
push esi
push 0x21
lea eax, [ebp - 0x388]
push eax
lea ecx, [ebp - 0x5c8]
call fcn.00417645
mov eax, dword [ebp - 0x5c8]
mov eax, dword [eax + 4]
cmp dword [ebp + eax - 0x5c0], ebx
je 0x4180ee
push str.not_found__n
call fcn.00419ab0
xor ebx, ebx
pop ecx
inc ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x564]
call fcn.00417da3
lea ecx, [ebp - 0x564]
mov dword [ebp - method.std::basic_ios_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
call fcn.004307eb
mov eax, ebx
jmp 0x41819b
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x530], esp
push 0xc58
call fcn.004162d9
lea ecx, [ebp - 0x5c8]
call fcn.00416912
push 0x64
lea eax, [ebp - 0x17c]
push ebx
push eax
call fcn.00425190
mov esi, str.KeServiceDescriptorTable
push esi
call fcn.00425700
add esp, 0x10
push eax
lea eax, [ebp - 0x17c]
push eax
lea ecx, [ebp - 0x5c8]
call fcn.0041746e
lea ecx, [ebp - 0x5c8]
call fcn.00417cac
lea eax, [ebp - 0x17c]
push esi
push eax
call fcn.00425100
test eax, eax
pop ecx
pop ecx
jne 0x418174
push str.Detected___Removed__n
call fcn.00419ab0
lea eax, [ebp - 0x388]
push eax
call fcn.0041b113
pop ecx
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x564]
call fcn.00417da3
lea ecx, [ebp - 0x564]
mov dword [ebp - method.std::basic_ios_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
call fcn.004307eb
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
call fcn.00425221
pop edi
pop esi
pop ebx
leave
ret