Function at 0x431970
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b26fb
mov eax, dword fs:[0]
push eax
sub esp, 0x34c
mov eax, dword [0x4e706c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x314], 0
mov eax, 0x4e7d30
cmp dword [0x4e7d44], 8
push str.MBRW_B
cmovae eax, dword [0x4e7d30]
push eax
call fcn.0048d2a7
add esp, 8
test eax, eax
jne 0x4319d4
xor al, al
jmp 0x432b8d
push 0x4ecba4
push 0x41a1b0
push 0x4ecbac
call fcn.0046b5e3
add esp, 0xc
test eax, eax
je 0x432ba9
lea eax, [ebp - 0x318]
mov dword [ebp - 0x318], 0
push eax
push 0
push 0
push 0x4b956c
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
xor ecx, ecx
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x7c], 7
mov word [ebp - 0x90], cx
mov dword [ebp - 4], ecx
test eax, eax
js 0x431a5c
mov edx, dword [ebp - 0x318]
test edx, edx
je 0x431a6d
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x431a40
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x90]
call fcn.00407990
mov eax, dword [ebp - 0x318]
test eax, eax
je 0x431a6d
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
xor eax, eax
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0xac], 7
mov word [ebp - 0xc0], ax
lea ecx, [ebp - 0x338]
mov byte [ebp - 4], 1
call fcn.0045f3e0
mov byte [ebp - 4], 2
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x431aa8
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4eb558
call fcn.004105c0
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f7a0
mov edx, 0x4c9104
mov ecx, eax
call fcn.0040f7a0
push 0xd2a
mov ecx, eax
call fcn.0040dda0
mov edx, str.:_Checking_BG_for_Chrome:
mov ecx, eax
call fcn.0040f7a0
push eax
call fcn.0040fb10
mov byte [ebp - 4], 1
add esp, 4
mov edx, dword [ebp - 0x324]
cmp edx, 8
jb 0x431b35
mov ecx, dword [ebp - 0x338]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x431b2b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x432bae
push edx
push ecx
call fcn.0046f0d0
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 3
lea ecx, [eax + 1]
call fcn.00432c10
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test al, al
je 0x431f86
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x28]
lea ecx, [ebp - 0xc0]
push eax
call fcn.00407990
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x431bc4
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x431bba
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x432bb3
push edx
push ecx
call fcn.0046f0d0
add esp, 8
lea eax, [ebp - 0x314]
mov dword [ebp - 0x314], 0
push eax
push 0x20119
push 0
push str.SOFTWAREGoogleChromeExtensionsihcjicgdanjaechkgeegckofjjedodee
push 0x80000002
call edi
test eax, eax
je 0x431c0e
lea eax, [ebp - 0x314]
push eax
push 0x20219
push 0
push str.SOFTWAREGoogleChromeExtensionsihcjicgdanjaechkgeegckofjjedodee
push 0x80000002
call edi
test eax, eax
jne 0x431cc0
push dword [ebp - 0x314]
call esi
lea ecx, [ebp - 0x338]
call fcn.0045f3e0
mov byte [ebp - 4], 8
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x431c30
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4eb558
call fcn.004105c0
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f7a0
mov edx, 0x4c9104
mov ecx, eax
call fcn.0040f7a0
push 0xd3f
mov ecx, eax
call fcn.0040dda0
mov edx, str.:_BrowserGuard_extension_key_for_chrome_already_exists.
mov ecx, eax
call fcn.0040f7a0
push eax
call fcn.0040fb10
mov byte [ebp - 4], 1
add esp, 4
mov edx, dword [ebp - 0x324]
cmp edx, 8
jb 0x431fc4
mov ecx, dword [ebp - 0x338]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x431fba
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x432bb8
jmp 0x431fba
push str.GoogleChromeUser_DataDefaultExtensionsihcjicgdanjaechkgeegckofjjedodee
lea edx, [ebp - 0x90]
lea ecx, [ebp - 0x28]
call fcn.0043bcd0
add esp, 4
lea ecx, [ebp - 0x338]
mov byte [ebp - 4], 4
call fcn.0045f3e0
mov byte [ebp - 4], 5
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x431cf4
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4eb558
call fcn.004105c0
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f7a0
mov edx, 0x4c9104
mov ecx, eax
call fcn.0040f7a0
push 0xd31
mov ecx, eax
call fcn.0040dda0
mov edx, str.:_Chrome_Ext_Folder:
mov ecx, eax
call fcn.0040f7a0
cmp dword [ebp - 0x14], 8
lea edx, [ebp - 0x28]
push dword [ebp - 0x18]
cmovae edx, dword [ebp - 0x28]
mov ecx, eax
call fcn.004105c0
add esp, 4
push eax
call fcn.0040fb10
mov byte [ebp - 4], 4
add esp, 4
mov edx, dword [ebp - 0x324]
cmp edx, 8
jb 0x431d99
mov ecx, dword [ebp - 0x338]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x431d8f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x432bbd
push edx
push ecx
call fcn.0046f0d0
add esp, 8
mov byte [ebp - 0x314], 0
lea edx, [ebp - 0x28]
push dword [ebp - 0x314]
lea ecx, [ebp - 0x40]
call fcn.00418f10
add esp, 4
lea edx, [ebp - 0x60]
lea ecx, [ebp - 0x40]
call fcn.0043ead0
mov edx, dword [ebp - 0x2c]
test al, al
sete bl
cmp edx, 8
jb 0x431dfe
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x431df4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x432bc2
push edx
push ecx
call fcn.0046f0d0
add esp, 8
lea ecx, [ebp - 0x338]
call fcn.0045f3e0
test bl, bl
je 0x431eea
mov byte [ebp - 4], 6
cmp dword [eax + 0x14], 8
mov esi, dword [eax + 0x10]
jb 0x431e20
mov eax, dword [eax]
push esi
mov edx, eax
mov ecx, 0x4eb558
call fcn.004105c0
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f7a0
mov edx, 0x4c9104
mov ecx, eax
call fcn.0040f7a0
push 0xd35
mov ecx, eax
call fcn.0040dda0
mov edx, str.:_Chrome_Ext_Folder_not_found___prompt_to_install_BG
mov ecx, eax
call fcn.0040f7a0
push eax
call fcn.0040fb10
mov edx, dword [ebp - 0x324]
add esp, 4
cmp edx, 8
jb 0x431ea9
mov ecx, dword [ebp - 0x338]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x431e9f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x432bc7
push edx
push ecx
call fcn.0046f0d0
add esp, 8
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x431ee3
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x431ed9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x432bcc
push edx
push ecx
call fcn.0046f0d0
add esp, 8
mov bl, 1
jmp 0x432b75
mov byte [ebp - 4], 7
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x431ef9
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4eb558
call fcn.004105c0
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f7a0
mov edx, 0x4c9104
mov ecx, eax
call fcn.0040f7a0
push 0xd3a
mov ecx, eax
call fcn.0040dda0
mov edx, str.:_Found_Chrome_Ext_Folder
mov ecx, eax
call fcn.0040f7a0
push eax
call fcn.0040fb10
mov byte [ebp - 4], 4
add esp, 4
mov edx, dword [ebp - 0x324]
cmp edx, 8
jb 0x431f86
mov ecx, dword [ebp - 0x338]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x431f7c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x432bd1
push edx
push ecx
call fcn.0046f0d0
add esp, 8
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x431fc4
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x431fba
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x432bd6
push edx
push ecx
call fcn.0046f0d0
add esp, 8
xor eax, eax
mov dword [ebp - 0x98], 0
mov dword [ebp - 0x94], 7
mov word [ebp - 0xa8], ax
lea ecx, [ebp - 0x338]
mov byte [ebp - 4], 9
call fcn.0045f3e0
mov byte [ebp - 4], 0xa
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x431fff
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4eb558
call fcn.004105c0
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f7a0
mov edx, 0x4c9104
mov ecx, eax
call fcn.0040f7a0
push 0xd45
mov ecx, eax
call fcn.0040dda0
mov edx, str.:_Checking_BG_for_Edge:
mov ecx, eax
call fcn.0040f7a0
push eax
call fcn.0040fb10
mov byte [ebp - 4], 9
add esp, 4
mov edx, dword [ebp - 0x324]
cmp edx, 8
jb 0x43208c
mov ecx, dword [ebp - 0x338]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x432082
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x432bdb
push edx
push ecx
call fcn.0046f0d0
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 0xb
xor ecx, ecx
call fcn.00432c10
test al, al
je 0x432692
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x28]
lea ecx, [ebp - 0xa8]
push eax
call fcn.00407990
mov byte [ebp - 4], 9
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x43210e
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x432104
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x432be0
push edx
push ecx
call fcn.0046f0d0
add esp, 8
lea eax, [ebp - 0x314]
mov dword [ebp - 0x314], 0
push eax
push 0x20119
push 0
push str.SOFTWAREMicrosoftEdgeExtensionsihcjicgdanjaechkgeegckofjjedodee
push 0x80000002
call edi
test eax, eax
je 0x432194
lea eax, [ebp - 0x314]
push eax
push 0x20219
push 0
push str.SOFTWAREMicrosoftEdgeExtensionsihcjicgdanjaechkgeegckofjjedodee
push 0x80000002
call edi
test eax, eax
je 0x432194
lea eax, [ebp - 0x314]
push eax
push 0x20119
push 0
push str.SOFTWAREMicrosoftEdgeExtensions_bojobppfploabceghnmlahpoonbcbacn
push 0x80000002
call edi
test eax, eax
je 0x432194
lea eax, [ebp - 0x314]
push eax
push 0x20219
push 0
push str.SOFTWAREMicrosoftEdgeExtensions_bojobppfploabceghnmlahpoonbcbacn
push 0x80000002
call edi
test eax, eax
jne 0x432213
push dword [ebp - 0x314]
call esi
lea ecx, [ebp - 0x338]
call fcn.0045f3e0
mov byte [ebp - 4], 0x13
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x4321b6
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4eb558
call fcn.004105c0
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f7a0
mov edx, 0x4c9104
mov ecx, eax
call fcn.0040f7a0
push 0xd5e
mov ecx, eax
call fcn.0040dda0
mov edx, str.:_BrowserGuard_extension_key_for_Edge_already_exists.
mov ecx, eax
call fcn.0040f7a0
push eax
call fcn.0040fb10
add esp, 4
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x338]
call fcn.00404d30
jmp 0x4326d0
push str.MicrosoftEdgeUser_DataDefaultExtensionsihcjicgdanjaechkgeegckofjjedodee
lea edx, [ebp - 0x90]
lea ecx, [ebp - 0x58]
call fcn.0043bcd0
add esp, 4
push str.MicrosoftEdgeUser_DataDefaultExtensions_bojobppfploabceghnmlahpoonbcbacn
lea edx, [ebp - 0x90]
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x28]
call fcn.0043bcd0
add esp, 4
lea ecx, [ebp - 0x338]
mov byte [ebp - 4], 0xd
call fcn.0045f3e0
mov byte [ebp - 4], 0xe
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x432261
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4eb558
call fcn.004105c0
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f7a0
mov edx, 0x4c9104
mov ecx, eax
call fcn.0040f7a0
push 0xd4f
mov ecx, eax
call fcn.0040dda0
mov edx, str.:_Edge_Ext_Folder:
mov ecx, eax
call fcn.0040f7a0
cmp dword [ebp - 0x44], 8
lea edx, [ebp - 0x58]
push dword [ebp - 0x48]
cmovae edx, dword [ebp - 0x58]
mov ecx, eax
call fcn.004105c0
add esp, 4
push eax
call fcn.0040fb10
mov byte [ebp - 4], 0xd
add esp, 4
mov edx, dword [ebp - 0x324]
cmp edx, 8
jb 0x432306
mov ecx, dword [ebp - 0x338]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4322fc
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x432be5
push edx
push ecx
call fcn.0046f0d0
add esp, 8
lea ecx, [ebp - 0x338]
call fcn.0045f3e0
mov byte [ebp - 4], 0xf
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x432320
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4eb558
call fcn.004105c0
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f7a0
mov edx, 0x4c9104
mov ecx, eax
call fcn.0040f7a0
push 0xd50
mov ecx, eax
call fcn.0040dda0
mov edx, str.:_Edge_Ext_Folder__2_:
mov ecx, eax
call fcn.0040f7a0
cmp dword [ebp - 0x14], 8
lea edx, [ebp - 0x28]
push dword [ebp - 0x18]
cmovae edx, dword [ebp - 0x28]
mov ecx, eax
call fcn.004105c0
add esp, 4
push eax
call fcn.0040fb10
mov byte [ebp - 4], 0xd
add esp, 4
mov edx, dword [ebp - 0x324]
cmp edx, 8
jb 0x4323c5
mov ecx, dword [ebp - 0x338]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4323bb
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x432bea
push edx
push ecx
call fcn.0046f0d0
add esp, 8
mov byte [ebp - 0x314], 0
lea edx, [ebp - 0x58]
push dword [ebp - 0x314]
lea ecx, [ebp - 0x338]
call fcn.00418f10
add esp, 4
mov byte [ebp - 4], 0x10
lea edx, [ebp - 0x60]
mov ebx, 1
lea ecx, [ebp - 0x338]
mov dword [ebp - 0x314], ebx
call fcn.0043ead0
test al, al
jne 0x432439
mov byte [ebp - 0x33c], al
lea edx, [ebp - 0x28]
push dword [ebp - 0x33c]
lea ecx, [ebp - 0x40]
call fcn.00418f10
add esp, 4
lea edx, [ebp - 0x60]
lea ecx, [ebp - 0x40]
mov ebx, 3
call fcn.0043ead0
mov byte [ebp - 0x31d], 1
test al, al
je 0x432440
mov byte [ebp - 0x31d], 0
test bl, 2
je 0x432493
mov edx, dword [ebp - 0x2c]
cmp edx, 8
jb 0x43247f
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x432475
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x432bef
push edx
push ecx
call fcn.0046f0d0
add esp, 8
xor eax, eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
mov dword [ebp - 4], 0xd
mov edx, dword [ebp - 0x324]
cmp edx, 8
jb 0x4324da
mov ecx, dword [ebp - 0x338]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4324d0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x432bf4
push edx
push ecx
call fcn.0046f0d0
add esp, 8
lea ecx, [ebp - 0x338]
call fcn.0045f3e0
cmp byte [ebp - 0x31d], 0
je 0x432619
mov byte [ebp - 4], 0x11
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x432501
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4eb558
call fcn.004105c0
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f7a0
mov edx, 0x4c9104
mov ecx, eax
call fcn.0040f7a0
push 0xd54
mov ecx, eax
call fcn.0040dda0
mov edx, str.:_Edge_Ext_Folder_not_found___prompt_to_install_BG
mov ecx, eax
call fcn.0040f7a0
push eax
call fcn.0040fb10
mov edx, dword [ebp - 0x324]
add esp, 4
cmp edx, 8
jb 0x43258a
mov ecx, dword [ebp - 0x338]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x432580
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x432bf9
push edx
push ecx
call fcn.0046f0d0
add esp, 8
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x4325c4
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4325ba
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x432bfe
push edx
push ecx
call fcn.0046f0d0
add esp, 8
mov edx, dword [ebp - 0x44]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp edx, 8
jb 0x432612
mov ecx, dword [ebp - 0x58]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x432608
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x432c03
push edx
push ecx
call fcn.0046f0d0
add esp, 8
mov bl, 1
jmp 0x432b6a
mov byte [ebp - 4], 0x12
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x432628
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4eb558
call fcn.004105c0
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f7a0
mov edx, 0x4c9104
mov ecx, eax
call fcn.0040f7a0
push 0xd59
mov ecx, eax
call fcn.0040dda0
mov edx, str.:_Found_Edge_Ext_Folder
mov ecx, eax
call fcn.0040f7a0
push eax
call fcn.0040fb10
add esp, 4
lea ecx, [ebp - 0x338]
call fcn.00404d30
lea ecx, [ebp - 0x28]
call fcn.00404d30
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 9
call fcn.00404d30
jmp 0x4326d0
mov byte [ebp - 4], 9
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x4326d0
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4326c6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x432c08
push edx
push ecx
call fcn.0046f0d0
add esp, 8
lea ecx, [ebp - 0x338]
call fcn.0045f3e0
mov byte [ebp - 4], 0x14
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x4326ea
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4eb558
call fcn.004105c0
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f7a0
mov edx, 0x4c9104
mov ecx, eax
call fcn.0040f7a0
push 0xd64
mov ecx, eax
call fcn.0040dda0
mov edx, str.:_Checking_BG_for_Firefox:
mov ecx, eax
call fcn.0040f7a0
push eax
call fcn.0040fb10
add esp, 4
lea ecx, [ebp - 0x338]
call fcn.00404d30
lea eax, [ebp - 0x31c]
mov dword [ebp - 0x31c], 0
push eax
push 0
push 0
push 0x4b954c
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
xor ecx, ecx
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x64], 7
mov word [ebp - 0x78], cx
mov byte [ebp - 4], 0x15
test eax, eax
js 0x4327b8
mov edx, dword [ebp - 0x31c]
test edx, edx
je 0x4327c9
mov ecx, edx
lea esi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x432790
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x78]
call fcn.00407990
push 0x10
push str.MozillaFirefox
lea ecx, [ebp - 0x78]
call fcn.0040c2d0
mov eax, dword [ebp - 0x31c]
test eax, eax
je 0x4327c9
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
xor eax, eax
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 7
mov word [ebp - 0x58], ax
mov byte [ebp - 4], 0x16
cmp dword [ebp - 0x68], eax
je 0x432b58
lea ecx, [ebp - 0x58]
call fcn.00433660
test al, al
je 0x432b58
push str.Profiles
lea edx, [ebp - 0x78]
lea ecx, [ebp - 0x40]
call fcn.0043bcd0
add esp, 4
push 0x250
lea eax, [ebp - 0x310]
mov byte [ebp - 4], 0x17
push 0
push eax
xor bh, bh
call fcn.00487250
add esp, 0xc
lea ecx, [ebp - 0x310]
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x432a68
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileW]
test byte [ebp - 0x310], 0x10
je 0x432a46
mov ecx, 0x4cea34
lea eax, [ebp - 0x2e4]
nop dword [eax + eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x432896
test dx, dx
je 0x432892
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x432896
add eax, 4
add ecx, 4
test dx, dx
jne 0x432870
xor eax, eax
jmp 0x43289b
sbb eax, eax
or eax, 1
test eax, eax
je 0x432a46
mov ecx, 0x4cea38
lea eax, [ebp - 0x2e4]
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4328d6
test dx, dx
je 0x4328d2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4328d6
add eax, 4
add ecx, 4
test dx, dx
jne 0x4328b0
xor eax, eax
jmp 0x4328db
sbb eax, eax
or eax, 1
test eax, eax
je 0x432a46
push str.Profiles_
lea edx, [ebp - 0x78]
lea ecx, [ebp - 0x354]
call fcn.0043bcd0
add esp, 4
lea ecx, [ebp - 0x2e4]
mov byte [ebp - 4], 0x18
push ecx
mov edx, eax
lea ecx, [ebp - 0x28]
call fcn.0043bda0
add esp, 4
lea ecx, [ebp - 0x354]
mov byte [ebp - 4], 0x1a
call fcn.00404d30
push 0xc
push str.extensions_
lea ecx, [ebp - 0x28]
call fcn.0040c2d0
push 0x2a
push 0x4cde30
lea ecx, [ebp - 0x28]
call fcn.0040c2d0
mov byte [ebp - 0x33c], 0
lea edx, [ebp - 0x28]
push dword [ebp - 0x33c]
lea ecx, [ebp - 0x338]
call fcn.00418f10
add esp, 4
lea edx, [ebp - 0x60]
lea ecx, [ebp - 0x338]
call fcn.0043ead0
mov edx, dword [ebp - 0x324]
mov bl, al
cmp edx, 8
jb 0x4329ac
mov ecx, dword [ebp - 0x338]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4329a2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x432bae
push edx
push ecx
call fcn.0046f0d0
add esp, 8
test bl, bl
jne 0x432a5a
lea ecx, [ebp - 0x338]
call fcn.0045f3e0
mov byte [ebp - 4], 0x1b
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x4329ce
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4eb558
call fcn.004105c0
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f7a0
mov edx, 0x4c9104
mov ecx, eax
call fcn.0040f7a0
push 0xd8c
mov ecx, eax
call fcn.0040dda0
mov edx, str.:_profilePath:
mov ecx, eax
call fcn.0040f7a0
cmp dword [ebp - 0x14], 8
lea edx, [ebp - 0x28]
push dword [ebp - 0x18]
cmovae edx, dword [ebp - 0x28]
mov ecx, eax
call fcn.004105c0
add esp, 4
push eax
call fcn.0040fb10
add esp, 4
lea ecx, [ebp - 0x338]
call fcn.00404d30
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x17
call fcn.00404d30
lea eax, [ebp - 0x310]
push eax
push esi
call edi
test eax, eax
jne 0x432853
jmp 0x432a68
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x17
mov bh, 1
call fcn.00404d30
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x354]
call fcn.0045f3e0
test bh, bh
jne 0x432aed
mov byte [ebp - 4], 0x1c
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x432a8d
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4eb558
call fcn.004105c0
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f7a0
mov edx, 0x4c9104
mov ecx, eax
call fcn.0040f7a0
push 0xd94
mov ecx, eax
call fcn.0040dda0
mov edx, str.:_Firefox_Ext_not_found___prompt_to_install_BG
mov ecx, eax
call fcn.0040f7a0
push eax
call fcn.0040fb10
add esp, 4
lea ecx, [ebp - 0x354]
call fcn.00404d30
lea ecx, [ebp - 0x40]
call fcn.00404d30
mov bl, 1
jmp 0x432b5a
mov byte [ebp - 4], 0x1d
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x432afc
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4eb558
call fcn.004105c0
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f7a0
mov edx, 0x4c9104
mov ecx, eax
call fcn.0040f7a0
push 0xd99
mov ecx, eax
call fcn.0040dda0
mov edx, str.:_BrowserGuard_ext_for_Firefox_already_exists.
mov ecx, eax
call fcn.0040f7a0
push eax
call fcn.0040fb10
add esp, 4
lea ecx, [ebp - 0x354]
call fcn.00404d30
lea ecx, [ebp - 0x40]
call fcn.00404d30
xor bl, bl
lea ecx, [ebp - 0x58]
call fcn.00404d30
lea ecx, [ebp - 0x78]
call fcn.00404d30
lea ecx, [ebp - 0xa8]
call fcn.00404d30
lea ecx, [ebp - 0xc0]
call fcn.00404d30
lea ecx, [ebp - 0x90]
call fcn.00404d30
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046ebaf
mov esp, ebp
pop ebp
ret
call fcn.0048d9d0
call fcn.0048a05c
call fcn.0048a05c
call fcn.0048a05c
call fcn.0048a05c
call fcn.0048a05c
call fcn.0048a05c
call fcn.0048a05c
call fcn.0048a05c
call fcn.0048a05c
call fcn.0048a05c
call fcn.0048a05c
call fcn.0048a05c
call fcn.0048a05c
call fcn.0048a05c
call fcn.0048a05c
call fcn.0048a05c
call fcn.0048a05c
call fcn.0048a05c
call fcn.0048a05c
int3