Function at 0x432030
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b0eab
mov eax, dword fs:[0]
push eax
sub esp, 0x34c
mov eax, dword [0x4e406c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x314], 0
mov eax, 0x4e4d30
cmp dword [0x4e4d44], 8
push str.MBRW_B
cmovae eax, dword [0x4e4d30]
push eax
call fcn.0048b9e7
add esp, 8
test eax, eax
jne 0x432094
xor al, al
jmp 0x43324d
push 0x4e9a7c
push 0x41b130
push 0x4e9a84
call fcn.00469d9a
add esp, 0xc
test eax, eax
je 0x433269
lea eax, [ebp - 0x318]
mov dword [ebp - 0x318], 0
push eax
push 0
push 0
push 0x4b755c
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
xor ecx, ecx
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x7c], 7
mov word [ebp - 0x90], cx
mov dword [ebp - 4], ecx
test eax, eax
js 0x43211c
mov edx, dword [ebp - 0x318]
test edx, edx
je 0x43212d
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x432100
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x90]
call fcn.00407cf0
mov eax, dword [ebp - 0x318]
test eax, eax
je 0x43212d
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
xor eax, eax
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0xac], 7
mov word [ebp - 0xc0], ax
lea ecx, [ebp - 0x338]
mov byte [ebp - 4], 1
call fcn.0045e3b0
mov byte [ebp - 4], 2
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x432168
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e84e8
call fcn.00410760
add esp, 4
mov edx, str.d:jenkinsworkspace_a_mb4_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f940
mov edx, 0x4c7114
mov ecx, eax
call fcn.0040f940
push 0xd2d
mov ecx, eax
call fcn.0040df40
mov edx, str.:_Checking_BG_for_Chrome:
mov ecx, eax
call fcn.0040f940
push eax
call fcn.0040fcb0
mov byte [ebp - 4], 1
add esp, 4
mov edx, dword [ebp - 0x324]
cmp edx, 8
jb 0x4321f5
mov ecx, dword [ebp - 0x338]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4321eb
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43326e
push edx
push ecx
call fcn.0046d84e
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 3
lea ecx, [eax + 1]
call fcn.004332d0
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test al, al
je 0x432646
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x28]
lea ecx, [ebp - 0xc0]
push eax
call fcn.00407cf0
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x432284
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x43227a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x433273
push edx
push ecx
call fcn.0046d84e
add esp, 8
lea eax, [ebp - 0x314]
mov dword [ebp - 0x314], 0
push eax
push 0x20119
push 0
push str.SOFTWAREGoogleChromeExtensionsihcjicgdanjaechkgeegckofjjedodee
push 0x80000002
call edi
test eax, eax
je 0x4322ce
lea eax, [ebp - 0x314]
push eax
push 0x20219
push 0
push str.SOFTWAREGoogleChromeExtensionsihcjicgdanjaechkgeegckofjjedodee
push 0x80000002
call edi
test eax, eax
jne 0x432380
push dword [ebp - 0x314]
call esi
lea ecx, [ebp - 0x338]
call fcn.0045e3b0
mov byte [ebp - 4], 8
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x4322f0
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e84e8
call fcn.00410760
add esp, 4
mov edx, str.d:jenkinsworkspace_a_mb4_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f940
mov edx, 0x4c7114
mov ecx, eax
call fcn.0040f940
push 0xd42
mov ecx, eax
call fcn.0040df40
mov edx, str.:_BrowserGuard_extension_key_for_chrome_already_exists.
mov ecx, eax
call fcn.0040f940
push eax
call fcn.0040fcb0
mov byte [ebp - 4], 1
add esp, 4
mov edx, dword [ebp - 0x324]
cmp edx, 8
jb 0x432684
mov ecx, dword [ebp - 0x338]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x43267a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x433278
jmp 0x43267a
push str.GoogleChromeUser_DataDefaultExtensionsihcjicgdanjaechkgeegckofjjedodee
lea edx, [ebp - 0x90]
lea ecx, [ebp - 0x28]
call fcn.0043bcc0
add esp, 4
lea ecx, [ebp - 0x338]
mov byte [ebp - 4], 4
call fcn.0045e3b0
mov byte [ebp - 4], 5
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x4323b4
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e84e8
call fcn.00410760
add esp, 4
mov edx, str.d:jenkinsworkspace_a_mb4_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f940
mov edx, 0x4c7114
mov ecx, eax
call fcn.0040f940
push 0xd34
mov ecx, eax
call fcn.0040df40
mov edx, str.:_Chrome_Ext_Folder:
mov ecx, eax
call fcn.0040f940
cmp dword [ebp - 0x14], 8
lea edx, [ebp - 0x28]
push dword [ebp - 0x18]
cmovae edx, dword [ebp - 0x28]
mov ecx, eax
call fcn.00410760
add esp, 4
push eax
call fcn.0040fcb0
mov byte [ebp - 4], 4
add esp, 4
mov edx, dword [ebp - 0x324]
cmp edx, 8
jb 0x432459
mov ecx, dword [ebp - 0x338]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x43244f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43327d
push edx
push ecx
call fcn.0046d84e
add esp, 8
mov byte [ebp - 0x314], 0
lea edx, [ebp - 0x28]
push dword [ebp - 0x314]
lea ecx, [ebp - 0x40]
call fcn.00419e90
add esp, 4
lea edx, [ebp - 0x60]
lea ecx, [ebp - 0x40]
call fcn.0043f730
mov edx, dword [ebp - 0x2c]
test al, al
sete bl
cmp edx, 8
jb 0x4324be
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4324b4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x433282
push edx
push ecx
call fcn.0046d84e
add esp, 8
lea ecx, [ebp - 0x338]
call fcn.0045e3b0
test bl, bl
je 0x4325aa
mov byte [ebp - 4], 6
cmp dword [eax + 0x14], 8
mov esi, dword [eax + 0x10]
jb 0x4324e0
mov eax, dword [eax]
push esi
mov edx, eax
mov ecx, 0x4e84e8
call fcn.00410760
add esp, 4
mov edx, str.d:jenkinsworkspace_a_mb4_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f940
mov edx, 0x4c7114
mov ecx, eax
call fcn.0040f940
push 0xd38
mov ecx, eax
call fcn.0040df40
mov edx, str.:_Chrome_Ext_Folder_not_found___prompt_to_install_BG
mov ecx, eax
call fcn.0040f940
push eax
call fcn.0040fcb0
mov edx, dword [ebp - 0x324]
add esp, 4
cmp edx, 8
jb 0x432569
mov ecx, dword [ebp - 0x338]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x43255f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x433287
push edx
push ecx
call fcn.0046d84e
add esp, 8
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x4325a3
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x432599
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43328c
push edx
push ecx
call fcn.0046d84e
add esp, 8
mov bl, 1
jmp 0x433235
mov byte [ebp - 4], 7
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x4325b9
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e84e8
call fcn.00410760
add esp, 4
mov edx, str.d:jenkinsworkspace_a_mb4_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f940
mov edx, 0x4c7114
mov ecx, eax
call fcn.0040f940
push 0xd3d
mov ecx, eax
call fcn.0040df40
mov edx, str.:_Found_Chrome_Ext_Folder
mov ecx, eax
call fcn.0040f940
push eax
call fcn.0040fcb0
mov byte [ebp - 4], 4
add esp, 4
mov edx, dword [ebp - 0x324]
cmp edx, 8
jb 0x432646
mov ecx, dword [ebp - 0x338]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x43263c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x433291
push edx
push ecx
call fcn.0046d84e
add esp, 8
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x432684
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x43267a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x433296
push edx
push ecx
call fcn.0046d84e
add esp, 8
xor eax, eax
mov dword [ebp - 0x98], 0
mov dword [ebp - 0x94], 7
mov word [ebp - 0xa8], ax
lea ecx, [ebp - 0x338]
mov byte [ebp - 4], 9
call fcn.0045e3b0
mov byte [ebp - 4], 0xa
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x4326bf
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e84e8
call fcn.00410760
add esp, 4
mov edx, str.d:jenkinsworkspace_a_mb4_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f940
mov edx, 0x4c7114
mov ecx, eax
call fcn.0040f940
push 0xd48
mov ecx, eax
call fcn.0040df40
mov edx, str.:_Checking_BG_for_Edge:
mov ecx, eax
call fcn.0040f940
push eax
call fcn.0040fcb0
mov byte [ebp - 4], 9
add esp, 4
mov edx, dword [ebp - 0x324]
cmp edx, 8
jb 0x43274c
mov ecx, dword [ebp - 0x338]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x432742
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43329b
push edx
push ecx
call fcn.0046d84e
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 0xb
xor ecx, ecx
call fcn.004332d0
test al, al
je 0x432d52
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x28]
lea ecx, [ebp - 0xa8]
push eax
call fcn.00407cf0
mov byte [ebp - 4], 9
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x4327ce
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4327c4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4332a0
push edx
push ecx
call fcn.0046d84e
add esp, 8
lea eax, [ebp - 0x314]
mov dword [ebp - 0x314], 0
push eax
push 0x20119
push 0
push str.SOFTWAREMicrosoftEdgeExtensionsihcjicgdanjaechkgeegckofjjedodee
push 0x80000002
call edi
test eax, eax
je 0x432854
lea eax, [ebp - 0x314]
push eax
push 0x20219
push 0
push str.SOFTWAREMicrosoftEdgeExtensionsihcjicgdanjaechkgeegckofjjedodee
push 0x80000002
call edi
test eax, eax
je 0x432854
lea eax, [ebp - 0x314]
push eax
push 0x20119
push 0
push str.SOFTWAREMicrosoftEdgeExtensions_bojobppfploabceghnmlahpoonbcbacn
push 0x80000002
call edi
test eax, eax
je 0x432854
lea eax, [ebp - 0x314]
push eax
push 0x20219
push 0
push str.SOFTWAREMicrosoftEdgeExtensions_bojobppfploabceghnmlahpoonbcbacn
push 0x80000002
call edi
test eax, eax
jne 0x4328d3
push dword [ebp - 0x314]
call esi
lea ecx, [ebp - 0x338]
call fcn.0045e3b0
mov byte [ebp - 4], 0x13
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x432876
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e84e8
call fcn.00410760
add esp, 4
mov edx, str.d:jenkinsworkspace_a_mb4_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f940
mov edx, 0x4c7114
mov ecx, eax
call fcn.0040f940
push 0xd61
mov ecx, eax
call fcn.0040df40
mov edx, str.:_BrowserGuard_extension_key_for_Edge_already_exists.
mov ecx, eax
call fcn.0040f940
push eax
call fcn.0040fcb0
add esp, 4
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x338]
call fcn.00405090
jmp 0x432d90
push str.MicrosoftEdgeUser_DataDefaultExtensionsihcjicgdanjaechkgeegckofjjedodee
lea edx, [ebp - 0x90]
lea ecx, [ebp - 0x58]
call fcn.0043bcc0
add esp, 4
push str.MicrosoftEdgeUser_DataDefaultExtensions_bojobppfploabceghnmlahpoonbcbacn
lea edx, [ebp - 0x90]
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x28]
call fcn.0043bcc0
add esp, 4
lea ecx, [ebp - 0x338]
mov byte [ebp - 4], 0xd
call fcn.0045e3b0
mov byte [ebp - 4], 0xe
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x432921
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e84e8
call fcn.00410760
add esp, 4
mov edx, str.d:jenkinsworkspace_a_mb4_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f940
mov edx, 0x4c7114
mov ecx, eax
call fcn.0040f940
push 0xd52
mov ecx, eax
call fcn.0040df40
mov edx, str.:_Edge_Ext_Folder:
mov ecx, eax
call fcn.0040f940
cmp dword [ebp - 0x44], 8
lea edx, [ebp - 0x58]
push dword [ebp - 0x48]
cmovae edx, dword [ebp - 0x58]
mov ecx, eax
call fcn.00410760
add esp, 4
push eax
call fcn.0040fcb0
mov byte [ebp - 4], 0xd
add esp, 4
mov edx, dword [ebp - 0x324]
cmp edx, 8
jb 0x4329c6
mov ecx, dword [ebp - 0x338]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4329bc
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4332a5
push edx
push ecx
call fcn.0046d84e
add esp, 8
lea ecx, [ebp - 0x338]
call fcn.0045e3b0
mov byte [ebp - 4], 0xf
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x4329e0
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e84e8
call fcn.00410760
add esp, 4
mov edx, str.d:jenkinsworkspace_a_mb4_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f940
mov edx, 0x4c7114
mov ecx, eax
call fcn.0040f940
push 0xd53
mov ecx, eax
call fcn.0040df40
mov edx, str.:_Edge_Ext_Folder__2_:
mov ecx, eax
call fcn.0040f940
cmp dword [ebp - 0x14], 8
lea edx, [ebp - 0x28]
push dword [ebp - 0x18]
cmovae edx, dword [ebp - 0x28]
mov ecx, eax
call fcn.00410760
add esp, 4
push eax
call fcn.0040fcb0
mov byte [ebp - 4], 0xd
add esp, 4
mov edx, dword [ebp - 0x324]
cmp edx, 8
jb 0x432a85
mov ecx, dword [ebp - 0x338]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x432a7b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4332aa
push edx
push ecx
call fcn.0046d84e
add esp, 8
mov byte [ebp - 0x314], 0
lea edx, [ebp - 0x58]
push dword [ebp - 0x314]
lea ecx, [ebp - 0x338]
call fcn.00419e90
add esp, 4
mov byte [ebp - 4], 0x10
lea edx, [ebp - 0x60]
mov ebx, 1
lea ecx, [ebp - 0x338]
mov dword [ebp - 0x314], ebx
call fcn.0043f730
test al, al
jne 0x432af9
mov byte [ebp - 0x33c], al
lea edx, [ebp - 0x28]
push dword [ebp - 0x33c]
lea ecx, [ebp - 0x40]
call fcn.00419e90
add esp, 4
lea edx, [ebp - 0x60]
lea ecx, [ebp - 0x40]
mov ebx, 3
call fcn.0043f730
mov byte [ebp - 0x31d], 1
test al, al
je 0x432b00
mov byte [ebp - 0x31d], 0
test bl, 2
je 0x432b53
mov edx, dword [ebp - 0x2c]
cmp edx, 8
jb 0x432b3f
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x432b35
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4332af
push edx
push ecx
call fcn.0046d84e
add esp, 8
xor eax, eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
mov dword [ebp - 4], 0xd
mov edx, dword [ebp - 0x324]
cmp edx, 8
jb 0x432b9a
mov ecx, dword [ebp - 0x338]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x432b90
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4332b4
push edx
push ecx
call fcn.0046d84e
add esp, 8
lea ecx, [ebp - 0x338]
call fcn.0045e3b0
cmp byte [ebp - 0x31d], 0
je 0x432cd9
mov byte [ebp - 4], 0x11
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x432bc1
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e84e8
call fcn.00410760
add esp, 4
mov edx, str.d:jenkinsworkspace_a_mb4_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f940
mov edx, 0x4c7114
mov ecx, eax
call fcn.0040f940
push 0xd57
mov ecx, eax
call fcn.0040df40
mov edx, str.:_Edge_Ext_Folder_not_found___prompt_to_install_BG
mov ecx, eax
call fcn.0040f940
push eax
call fcn.0040fcb0
mov edx, dword [ebp - 0x324]
add esp, 4
cmp edx, 8
jb 0x432c4a
mov ecx, dword [ebp - 0x338]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x432c40
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4332b9
push edx
push ecx
call fcn.0046d84e
add esp, 8
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x432c84
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x432c7a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4332be
push edx
push ecx
call fcn.0046d84e
add esp, 8
mov edx, dword [ebp - 0x44]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp edx, 8
jb 0x432cd2
mov ecx, dword [ebp - 0x58]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x432cc8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4332c3
push edx
push ecx
call fcn.0046d84e
add esp, 8
mov bl, 1
jmp 0x43322a
mov byte [ebp - 4], 0x12
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x432ce8
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e84e8
call fcn.00410760
add esp, 4
mov edx, str.d:jenkinsworkspace_a_mb4_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f940
mov edx, 0x4c7114
mov ecx, eax
call fcn.0040f940
push 0xd5c
mov ecx, eax
call fcn.0040df40
mov edx, str.:_Found_Edge_Ext_Folder
mov ecx, eax
call fcn.0040f940
push eax
call fcn.0040fcb0
add esp, 4
lea ecx, [ebp - 0x338]
call fcn.00405090
lea ecx, [ebp - 0x28]
call fcn.00405090
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 9
call fcn.00405090
jmp 0x432d90
mov byte [ebp - 4], 9
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x432d90
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x432d86
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4332c8
push edx
push ecx
call fcn.0046d84e
add esp, 8
lea ecx, [ebp - 0x338]
call fcn.0045e3b0
mov byte [ebp - 4], 0x14
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x432daa
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e84e8
call fcn.00410760
add esp, 4
mov edx, str.d:jenkinsworkspace_a_mb4_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f940
mov edx, 0x4c7114
mov ecx, eax
call fcn.0040f940
push 0xd67
mov ecx, eax
call fcn.0040df40
mov edx, str.:_Checking_BG_for_Firefox:
mov ecx, eax
call fcn.0040f940
push eax
call fcn.0040fcb0
add esp, 4
lea ecx, [ebp - 0x338]
call fcn.00405090
lea eax, [ebp - 0x31c]
mov dword [ebp - 0x31c], 0
push eax
push 0
push 0
push 0x4b753c
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
xor ecx, ecx
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x64], 7
mov word [ebp - 0x78], cx
mov byte [ebp - 4], 0x15
test eax, eax
js 0x432e78
mov edx, dword [ebp - 0x31c]
test edx, edx
je 0x432e89
mov ecx, edx
lea esi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x432e50
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x78]
call fcn.00407cf0
push 0x10
push str.MozillaFirefox
lea ecx, [ebp - 0x78]
call fcn.0040c600
mov eax, dword [ebp - 0x31c]
test eax, eax
je 0x432e89
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
xor eax, eax
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 7
mov word [ebp - 0x58], ax
mov byte [ebp - 4], 0x16
cmp dword [ebp - 0x68], eax
je 0x433218
lea ecx, [ebp - 0x58]
call fcn.00433d20
test al, al
je 0x433218
push str.Profiles
lea edx, [ebp - 0x78]
lea ecx, [ebp - 0x40]
call fcn.0043bcc0
add esp, 4
push 0x250
lea eax, [ebp - 0x310]
mov byte [ebp - 4], 0x17
push 0
push eax
xor bh, bh
call fcn.00485990
add esp, 0xc
lea ecx, [ebp - 0x310]
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x433128
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileW]
test byte [ebp - 0x310], 0x10
je 0x433106
mov ecx, 0x4cc7b8
lea eax, [ebp - 0x2e4]
nop dword [eax + eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x432f56
test dx, dx
je 0x432f52
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x432f56
add eax, 4
add ecx, 4
test dx, dx
jne 0x432f30
xor eax, eax
jmp 0x432f5b
sbb eax, eax
or eax, 1
test eax, eax
je 0x433106
mov ecx, 0x4cc7bc
lea eax, [ebp - 0x2e4]
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x432f96
test dx, dx
je 0x432f92
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x432f96
add eax, 4
add ecx, 4
test dx, dx
jne 0x432f70
xor eax, eax
jmp 0x432f9b
sbb eax, eax
or eax, 1
test eax, eax
je 0x433106
push str.Profiles_
lea edx, [ebp - 0x78]
lea ecx, [ebp - 0x354]
call fcn.0043bcc0
add esp, 4
lea ecx, [ebp - 0x2e4]
mov byte [ebp - 4], 0x18
push ecx
mov edx, eax
lea ecx, [ebp - 0x28]
call fcn.0043bd90
add esp, 4
lea ecx, [ebp - 0x354]
mov byte [ebp - 4], 0x1a
call fcn.00405090
push 0xc
push str.extensions_
lea ecx, [ebp - 0x28]
call fcn.0040c600
push 0x2a
push 0x4cbf08
lea ecx, [ebp - 0x28]
call fcn.0040c600
mov byte [ebp - 0x33c], 0
lea edx, [ebp - 0x28]
push dword [ebp - 0x33c]
lea ecx, [ebp - 0x338]
call fcn.00419e90
add esp, 4
lea edx, [ebp - 0x60]
lea ecx, [ebp - 0x338]
call fcn.0043f730
mov edx, dword [ebp - 0x324]
mov bl, al
cmp edx, 8
jb 0x43306c
mov ecx, dword [ebp - 0x338]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x433062
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43326e
push edx
push ecx
call fcn.0046d84e
add esp, 8
test bl, bl
jne 0x43311a
lea ecx, [ebp - 0x338]
call fcn.0045e3b0
mov byte [ebp - 4], 0x1b
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x43308e
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e84e8
call fcn.00410760
add esp, 4
mov edx, str.d:jenkinsworkspace_a_mb4_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f940
mov edx, 0x4c7114
mov ecx, eax
call fcn.0040f940
push 0xd8f
mov ecx, eax
call fcn.0040df40
mov edx, str.:_profilePath:
mov ecx, eax
call fcn.0040f940
cmp dword [ebp - 0x14], 8
lea edx, [ebp - 0x28]
push dword [ebp - 0x18]
cmovae edx, dword [ebp - 0x28]
mov ecx, eax
call fcn.00410760
add esp, 4
push eax
call fcn.0040fcb0
add esp, 4
lea ecx, [ebp - 0x338]
call fcn.00405090
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x17
call fcn.00405090
lea eax, [ebp - 0x310]
push eax
push esi
call edi
test eax, eax
jne 0x432f13
jmp 0x433128
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x17
mov bh, 1
call fcn.00405090
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x354]
call fcn.0045e3b0
test bh, bh
jne 0x4331ad
mov byte [ebp - 4], 0x1c
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x43314d
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e84e8
call fcn.00410760
add esp, 4
mov edx, str.d:jenkinsworkspace_a_mb4_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f940
mov edx, 0x4c7114
mov ecx, eax
call fcn.0040f940
push 0xd97
mov ecx, eax
call fcn.0040df40
mov edx, str.:_Firefox_Ext_not_found___prompt_to_install_BG
mov ecx, eax
call fcn.0040f940
push eax
call fcn.0040fcb0
add esp, 4
lea ecx, [ebp - 0x354]
call fcn.00405090
lea ecx, [ebp - 0x40]
call fcn.00405090
mov bl, 1
jmp 0x43321a
mov byte [ebp - 4], 0x1d
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x4331bc
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e84e8
call fcn.00410760
add esp, 4
mov edx, str.d:jenkinsworkspace_a_mb4_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f940
mov edx, 0x4c7114
mov ecx, eax
call fcn.0040f940
push 0xd9c
mov ecx, eax
call fcn.0040df40
mov edx, str.:_BrowserGuard_ext_for_Firefox_already_exists.
mov ecx, eax
call fcn.0040f940
push eax
call fcn.0040fcb0
add esp, 4
lea ecx, [ebp - 0x354]
call fcn.00405090
lea ecx, [ebp - 0x40]
call fcn.00405090
xor bl, bl
lea ecx, [ebp - 0x58]
call fcn.00405090
lea ecx, [ebp - 0x78]
call fcn.00405090
lea ecx, [ebp - 0xa8]
call fcn.00405090
lea ecx, [ebp - 0xc0]
call fcn.00405090
lea ecx, [ebp - 0x90]
call fcn.00405090
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046d32d
mov esp, ebp
pop ebp
ret
call fcn.0048c110
call fcn.0048879c
call fcn.0048879c
call fcn.0048879c
call fcn.0048879c
call fcn.0048879c
call fcn.0048879c
call fcn.0048879c
call fcn.0048879c
call fcn.0048879c
call fcn.0048879c
call fcn.0048879c
call fcn.0048879c
call fcn.0048879c
call fcn.0048879c
call fcn.0048879c
call fcn.0048879c
call fcn.0048879c
call fcn.0048879c
call fcn.0048879c
int3