Function at 0x4314c0
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b103b
mov eax, dword fs:[0]
push eax
sub esp, 0x34c
mov eax, dword [0x4e506c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x314], 0
mov eax, 0x4e5d30
cmp dword [0x4e5d44], 8
push str.MBRW_B
cmovae eax, dword [0x4e5d30]
push eax
call fcn.0048bc09
add esp, 8
test eax, eax
jne 0x431524
xor al, al
jmp 0x4326dd
push 0x4eab24
push 0x41a0d0
push 0x4eab2c
call fcn.00469f84
add esp, 0xc
test eax, eax
je 0x4326f9
lea eax, [ebp - 0x318]
mov dword [ebp - 0x318], 0
push eax
push 0
push 0
push 0x4b856c
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
xor ecx, ecx
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x7c], 7
mov word [ebp - 0x90], cx
mov dword [ebp - 4], ecx
test eax, eax
js 0x4315ac
mov edx, dword [ebp - 0x318]
test edx, edx
je 0x4315bd
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x431590
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x90]
call fcn.00407920
mov eax, dword [ebp - 0x318]
test eax, eax
je 0x4315bd
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
xor eax, eax
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0xac], 7
mov word [ebp - 0xc0], ax
lea ecx, [ebp - 0x338]
mov byte [ebp - 4], 1
call fcn.0045dd60
mov byte [ebp - 4], 2
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x4315f8
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e94d8
call fcn.00410550
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f730
mov edx, 0x4c8104
mov ecx, eax
call fcn.0040f730
push 0xd0d
mov ecx, eax
call fcn.0040dd30
mov edx, str.:_Checking_BG_for_Chrome:
mov ecx, eax
call fcn.0040f730
push eax
call fcn.0040faa0
mov byte [ebp - 4], 1
add esp, 4
mov edx, dword [ebp - 0x324]
cmp edx, 8
jb 0x431685
mov ecx, dword [ebp - 0x338]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x43167b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4326fe
push edx
push ecx
call fcn.0046da67
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 3
lea ecx, [eax + 1]
call fcn.00432760
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test al, al
je 0x431ad6
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x28]
lea ecx, [ebp - 0xc0]
push eax
call fcn.00407920
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x431714
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x43170a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x432703
push edx
push ecx
call fcn.0046da67
add esp, 8
lea eax, [ebp - 0x314]
mov dword [ebp - 0x314], 0
push eax
push 0x20119
push 0
push str.SOFTWAREGoogleChromeExtensionsihcjicgdanjaechkgeegckofjjedodee
push 0x80000002
call edi
test eax, eax
je 0x43175e
lea eax, [ebp - 0x314]
push eax
push 0x20219
push 0
push str.SOFTWAREGoogleChromeExtensionsihcjicgdanjaechkgeegckofjjedodee
push 0x80000002
call edi
test eax, eax
jne 0x431810
push dword [ebp - 0x314]
call esi
lea ecx, [ebp - 0x338]
call fcn.0045dd60
mov byte [ebp - 4], 8
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x431780
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e94d8
call fcn.00410550
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f730
mov edx, 0x4c8104
mov ecx, eax
call fcn.0040f730
push 0xd22
mov ecx, eax
call fcn.0040dd30
mov edx, str.:_BrowserGuard_extension_key_for_chrome_already_exists.
mov ecx, eax
call fcn.0040f730
push eax
call fcn.0040faa0
mov byte [ebp - 4], 1
add esp, 4
mov edx, dword [ebp - 0x324]
cmp edx, 8
jb 0x431b14
mov ecx, dword [ebp - 0x338]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x431b0a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x432708
jmp 0x431b0a
push str.GoogleChromeUser_DataDefaultExtensionsihcjicgdanjaechkgeegckofjjedodee
lea edx, [ebp - 0x90]
lea ecx, [ebp - 0x28]
call fcn.0043b820
add esp, 4
lea ecx, [ebp - 0x338]
mov byte [ebp - 4], 4
call fcn.0045dd60
mov byte [ebp - 4], 5
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x431844
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e94d8
call fcn.00410550
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f730
mov edx, 0x4c8104
mov ecx, eax
call fcn.0040f730
push 0xd14
mov ecx, eax
call fcn.0040dd30
mov edx, str.:_Chrome_Ext_Folder:
mov ecx, eax
call fcn.0040f730
cmp dword [ebp - 0x14], 8
lea edx, [ebp - 0x28]
push dword [ebp - 0x18]
cmovae edx, dword [ebp - 0x28]
mov ecx, eax
call fcn.00410550
add esp, 4
push eax
call fcn.0040faa0
mov byte [ebp - 4], 4
add esp, 4
mov edx, dword [ebp - 0x324]
cmp edx, 8
jb 0x4318e9
mov ecx, dword [ebp - 0x338]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4318df
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43270d
push edx
push ecx
call fcn.0046da67
add esp, 8
mov byte [ebp - 0x314], 0
lea edx, [ebp - 0x28]
push dword [ebp - 0x314]
lea ecx, [ebp - 0x40]
call fcn.00418e30
add esp, 4
lea edx, [ebp - 0x60]
lea ecx, [ebp - 0x40]
call fcn.0043e630
mov edx, dword [ebp - 0x2c]
test al, al
sete bl
cmp edx, 8
jb 0x43194e
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x431944
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x432712
push edx
push ecx
call fcn.0046da67
add esp, 8
lea ecx, [ebp - 0x338]
call fcn.0045dd60
test bl, bl
je 0x431a3a
mov byte [ebp - 4], 6
cmp dword [eax + 0x14], 8
mov esi, dword [eax + 0x10]
jb 0x431970
mov eax, dword [eax]
push esi
mov edx, eax
mov ecx, 0x4e94d8
call fcn.00410550
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f730
mov edx, 0x4c8104
mov ecx, eax
call fcn.0040f730
push 0xd18
mov ecx, eax
call fcn.0040dd30
mov edx, str.:_Chrome_Ext_Folder_not_found___prompt_to_install_BG
mov ecx, eax
call fcn.0040f730
push eax
call fcn.0040faa0
mov edx, dword [ebp - 0x324]
add esp, 4
cmp edx, 8
jb 0x4319f9
mov ecx, dword [ebp - 0x338]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4319ef
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x432717
push edx
push ecx
call fcn.0046da67
add esp, 8
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x431a33
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x431a29
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43271c
push edx
push ecx
call fcn.0046da67
add esp, 8
mov bl, 1
jmp 0x4326c5
mov byte [ebp - 4], 7
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x431a49
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e94d8
call fcn.00410550
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f730
mov edx, 0x4c8104
mov ecx, eax
call fcn.0040f730
push 0xd1d
mov ecx, eax
call fcn.0040dd30
mov edx, str.:_Found_Chrome_Ext_Folder
mov ecx, eax
call fcn.0040f730
push eax
call fcn.0040faa0
mov byte [ebp - 4], 4
add esp, 4
mov edx, dword [ebp - 0x324]
cmp edx, 8
jb 0x431ad6
mov ecx, dword [ebp - 0x338]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x431acc
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x432721
push edx
push ecx
call fcn.0046da67
add esp, 8
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x431b14
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x431b0a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x432726
push edx
push ecx
call fcn.0046da67
add esp, 8
xor eax, eax
mov dword [ebp - 0x98], 0
mov dword [ebp - 0x94], 7
mov word [ebp - 0xa8], ax
lea ecx, [ebp - 0x338]
mov byte [ebp - 4], 9
call fcn.0045dd60
mov byte [ebp - 4], 0xa
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x431b4f
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e94d8
call fcn.00410550
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f730
mov edx, 0x4c8104
mov ecx, eax
call fcn.0040f730
push 0xd28
mov ecx, eax
call fcn.0040dd30
mov edx, str.:_Checking_BG_for_Edge:
mov ecx, eax
call fcn.0040f730
push eax
call fcn.0040faa0
mov byte [ebp - 4], 9
add esp, 4
mov edx, dword [ebp - 0x324]
cmp edx, 8
jb 0x431bdc
mov ecx, dword [ebp - 0x338]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x431bd2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43272b
push edx
push ecx
call fcn.0046da67
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 0xb
xor ecx, ecx
call fcn.00432760
test al, al
je 0x4321e2
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x28]
lea ecx, [ebp - 0xa8]
push eax
call fcn.00407920
mov byte [ebp - 4], 9
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x431c5e
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x431c54
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x432730
push edx
push ecx
call fcn.0046da67
add esp, 8
lea eax, [ebp - 0x314]
mov dword [ebp - 0x314], 0
push eax
push 0x20119
push 0
push str.SOFTWAREMicrosoftEdgeExtensionsihcjicgdanjaechkgeegckofjjedodee
push 0x80000002
call edi
test eax, eax
je 0x431ce4
lea eax, [ebp - 0x314]
push eax
push 0x20219
push 0
push str.SOFTWAREMicrosoftEdgeExtensionsihcjicgdanjaechkgeegckofjjedodee
push 0x80000002
call edi
test eax, eax
je 0x431ce4
lea eax, [ebp - 0x314]
push eax
push 0x20119
push 0
push str.SOFTWAREMicrosoftEdgeExtensions_bojobppfploabceghnmlahpoonbcbacn
push 0x80000002
call edi
test eax, eax
je 0x431ce4
lea eax, [ebp - 0x314]
push eax
push 0x20219
push 0
push str.SOFTWAREMicrosoftEdgeExtensions_bojobppfploabceghnmlahpoonbcbacn
push 0x80000002
call edi
test eax, eax
jne 0x431d63
push dword [ebp - 0x314]
call esi
lea ecx, [ebp - 0x338]
call fcn.0045dd60
mov byte [ebp - 4], 0x13
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x431d06
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e94d8
call fcn.00410550
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f730
mov edx, 0x4c8104
mov ecx, eax
call fcn.0040f730
push 0xd41
mov ecx, eax
call fcn.0040dd30
mov edx, str.:_BrowserGuard_extension_key_for_Edge_already_exists.
mov ecx, eax
call fcn.0040f730
push eax
call fcn.0040faa0
add esp, 4
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x338]
call fcn.00404cc0
jmp 0x432220
push str.MicrosoftEdgeUser_DataDefaultExtensionsihcjicgdanjaechkgeegckofjjedodee
lea edx, [ebp - 0x90]
lea ecx, [ebp - 0x58]
call fcn.0043b820
add esp, 4
push str.MicrosoftEdgeUser_DataDefaultExtensions_bojobppfploabceghnmlahpoonbcbacn
lea edx, [ebp - 0x90]
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x28]
call fcn.0043b820
add esp, 4
lea ecx, [ebp - 0x338]
mov byte [ebp - 4], 0xd
call fcn.0045dd60
mov byte [ebp - 4], 0xe
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x431db1
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e94d8
call fcn.00410550
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f730
mov edx, 0x4c8104
mov ecx, eax
call fcn.0040f730
push 0xd32
mov ecx, eax
call fcn.0040dd30
mov edx, str.:_Edge_Ext_Folder:
mov ecx, eax
call fcn.0040f730
cmp dword [ebp - 0x44], 8
lea edx, [ebp - 0x58]
push dword [ebp - 0x48]
cmovae edx, dword [ebp - 0x58]
mov ecx, eax
call fcn.00410550
add esp, 4
push eax
call fcn.0040faa0
mov byte [ebp - 4], 0xd
add esp, 4
mov edx, dword [ebp - 0x324]
cmp edx, 8
jb 0x431e56
mov ecx, dword [ebp - 0x338]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x431e4c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x432735
push edx
push ecx
call fcn.0046da67
add esp, 8
lea ecx, [ebp - 0x338]
call fcn.0045dd60
mov byte [ebp - 4], 0xf
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x431e70
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e94d8
call fcn.00410550
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f730
mov edx, 0x4c8104
mov ecx, eax
call fcn.0040f730
push 0xd33
mov ecx, eax
call fcn.0040dd30
mov edx, str.:_Edge_Ext_Folder__2_:
mov ecx, eax
call fcn.0040f730
cmp dword [ebp - 0x14], 8
lea edx, [ebp - 0x28]
push dword [ebp - 0x18]
cmovae edx, dword [ebp - 0x28]
mov ecx, eax
call fcn.00410550
add esp, 4
push eax
call fcn.0040faa0
mov byte [ebp - 4], 0xd
add esp, 4
mov edx, dword [ebp - 0x324]
cmp edx, 8
jb 0x431f15
mov ecx, dword [ebp - 0x338]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x431f0b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43273a
push edx
push ecx
call fcn.0046da67
add esp, 8
mov byte [ebp - 0x314], 0
lea edx, [ebp - 0x58]
push dword [ebp - 0x314]
lea ecx, [ebp - 0x338]
call fcn.00418e30
add esp, 4
mov byte [ebp - 4], 0x10
lea edx, [ebp - 0x60]
mov ebx, 1
lea ecx, [ebp - 0x338]
mov dword [ebp - 0x314], ebx
call fcn.0043e630
test al, al
jne 0x431f89
mov byte [ebp - 0x33c], al
lea edx, [ebp - 0x28]
push dword [ebp - 0x33c]
lea ecx, [ebp - 0x40]
call fcn.00418e30
add esp, 4
lea edx, [ebp - 0x60]
lea ecx, [ebp - 0x40]
mov ebx, 3
call fcn.0043e630
mov byte [ebp - 0x31d], 1
test al, al
je 0x431f90
mov byte [ebp - 0x31d], 0
test bl, 2
je 0x431fe3
mov edx, dword [ebp - 0x2c]
cmp edx, 8
jb 0x431fcf
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x431fc5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43273f
push edx
push ecx
call fcn.0046da67
add esp, 8
xor eax, eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
mov dword [ebp - 4], 0xd
mov edx, dword [ebp - 0x324]
cmp edx, 8
jb 0x43202a
mov ecx, dword [ebp - 0x338]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x432020
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x432744
push edx
push ecx
call fcn.0046da67
add esp, 8
lea ecx, [ebp - 0x338]
call fcn.0045dd60
cmp byte [ebp - 0x31d], 0
je 0x432169
mov byte [ebp - 4], 0x11
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x432051
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e94d8
call fcn.00410550
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f730
mov edx, 0x4c8104
mov ecx, eax
call fcn.0040f730
push 0xd37
mov ecx, eax
call fcn.0040dd30
mov edx, str.:_Edge_Ext_Folder_not_found___prompt_to_install_BG
mov ecx, eax
call fcn.0040f730
push eax
call fcn.0040faa0
mov edx, dword [ebp - 0x324]
add esp, 4
cmp edx, 8
jb 0x4320da
mov ecx, dword [ebp - 0x338]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4320d0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x432749
push edx
push ecx
call fcn.0046da67
add esp, 8
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x432114
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x43210a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43274e
push edx
push ecx
call fcn.0046da67
add esp, 8
mov edx, dword [ebp - 0x44]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp edx, 8
jb 0x432162
mov ecx, dword [ebp - 0x58]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x432158
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x432753
push edx
push ecx
call fcn.0046da67
add esp, 8
mov bl, 1
jmp 0x4326ba
mov byte [ebp - 4], 0x12
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x432178
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e94d8
call fcn.00410550
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f730
mov edx, 0x4c8104
mov ecx, eax
call fcn.0040f730
push 0xd3c
mov ecx, eax
call fcn.0040dd30
mov edx, str.:_Found_Edge_Ext_Folder
mov ecx, eax
call fcn.0040f730
push eax
call fcn.0040faa0
add esp, 4
lea ecx, [ebp - 0x338]
call fcn.00404cc0
lea ecx, [ebp - 0x28]
call fcn.00404cc0
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 9
call fcn.00404cc0
jmp 0x432220
mov byte [ebp - 4], 9
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x432220
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x432216
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x432758
push edx
push ecx
call fcn.0046da67
add esp, 8
lea ecx, [ebp - 0x338]
call fcn.0045dd60
mov byte [ebp - 4], 0x14
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x43223a
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e94d8
call fcn.00410550
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f730
mov edx, 0x4c8104
mov ecx, eax
call fcn.0040f730
push 0xd47
mov ecx, eax
call fcn.0040dd30
mov edx, str.:_Checking_BG_for_Firefox:
mov ecx, eax
call fcn.0040f730
push eax
call fcn.0040faa0
add esp, 4
lea ecx, [ebp - 0x338]
call fcn.00404cc0
lea eax, [ebp - 0x31c]
mov dword [ebp - 0x31c], 0
push eax
push 0
push 0
push 0x4b854c
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
xor ecx, ecx
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x64], 7
mov word [ebp - 0x78], cx
mov byte [ebp - 4], 0x15
test eax, eax
js 0x432308
mov edx, dword [ebp - 0x31c]
test edx, edx
je 0x432319
mov ecx, edx
lea esi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4322e0
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x78]
call fcn.00407920
push 0x10
push str.MozillaFirefox
lea ecx, [ebp - 0x78]
call fcn.0040c260
mov eax, dword [ebp - 0x31c]
test eax, eax
je 0x432319
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
xor eax, eax
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 7
mov word [ebp - 0x58], ax
mov byte [ebp - 4], 0x16
cmp dword [ebp - 0x68], eax
je 0x4326a8
lea ecx, [ebp - 0x58]
call fcn.004331b0
test al, al
je 0x4326a8
push str.Profiles
lea edx, [ebp - 0x78]
lea ecx, [ebp - 0x40]
call fcn.0043b820
add esp, 4
push 0x250
lea eax, [ebp - 0x310]
mov byte [ebp - 4], 0x17
push 0
push eax
xor bh, bh
call fcn.00485bb0
add esp, 0xc
lea ecx, [ebp - 0x310]
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4325b8
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileW]
test byte [ebp - 0x310], 0x10
je 0x432596
mov ecx, 0x4cdacc
lea eax, [ebp - 0x2e4]
nop dword [eax + eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4323e6
test dx, dx
je 0x4323e2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4323e6
add eax, 4
add ecx, 4
test dx, dx
jne 0x4323c0
xor eax, eax
jmp 0x4323eb
sbb eax, eax
or eax, 1
test eax, eax
je 0x432596
mov ecx, 0x4cdad0
lea eax, [ebp - 0x2e4]
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x432426
test dx, dx
je 0x432422
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x432426
add eax, 4
add ecx, 4
test dx, dx
jne 0x432400
xor eax, eax
jmp 0x43242b
sbb eax, eax
or eax, 1
test eax, eax
je 0x432596
push str.Profiles_
lea edx, [ebp - 0x78]
lea ecx, [ebp - 0x354]
call fcn.0043b820
add esp, 4
lea ecx, [ebp - 0x2e4]
mov byte [ebp - 4], 0x18
push ecx
mov edx, eax
lea ecx, [ebp - 0x28]
call fcn.0043b8f0
add esp, 4
lea ecx, [ebp - 0x354]
mov byte [ebp - 4], 0x1a
call fcn.00404cc0
push 0xc
push str.extensions_
lea ecx, [ebp - 0x28]
call fcn.0040c260
push 0x2a
push 0x4ccec8
lea ecx, [ebp - 0x28]
call fcn.0040c260
mov byte [ebp - 0x33c], 0
lea edx, [ebp - 0x28]
push dword [ebp - 0x33c]
lea ecx, [ebp - 0x338]
call fcn.00418e30
add esp, 4
lea edx, [ebp - 0x60]
lea ecx, [ebp - 0x338]
call fcn.0043e630
mov edx, dword [ebp - 0x324]
mov bl, al
cmp edx, 8
jb 0x4324fc
mov ecx, dword [ebp - 0x338]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4324f2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4326fe
push edx
push ecx
call fcn.0046da67
add esp, 8
test bl, bl
jne 0x4325aa
lea ecx, [ebp - 0x338]
call fcn.0045dd60
mov byte [ebp - 4], 0x1b
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x43251e
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e94d8
call fcn.00410550
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f730
mov edx, 0x4c8104
mov ecx, eax
call fcn.0040f730
push 0xd6f
mov ecx, eax
call fcn.0040dd30
mov edx, str.:_profilePath:
mov ecx, eax
call fcn.0040f730
cmp dword [ebp - 0x14], 8
lea edx, [ebp - 0x28]
push dword [ebp - 0x18]
cmovae edx, dword [ebp - 0x28]
mov ecx, eax
call fcn.00410550
add esp, 4
push eax
call fcn.0040faa0
add esp, 4
lea ecx, [ebp - 0x338]
call fcn.00404cc0
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x17
call fcn.00404cc0
lea eax, [ebp - 0x310]
push eax
push esi
call edi
test eax, eax
jne 0x4323a3
jmp 0x4325b8
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x17
mov bh, 1
call fcn.00404cc0
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x354]
call fcn.0045dd60
test bh, bh
jne 0x43263d
mov byte [ebp - 4], 0x1c
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x4325dd
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e94d8
call fcn.00410550
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f730
mov edx, 0x4c8104
mov ecx, eax
call fcn.0040f730
push 0xd77
mov ecx, eax
call fcn.0040dd30
mov edx, str.:_Firefox_Ext_not_found___prompt_to_install_BG
mov ecx, eax
call fcn.0040f730
push eax
call fcn.0040faa0
add esp, 4
lea ecx, [ebp - 0x354]
call fcn.00404cc0
lea ecx, [ebp - 0x40]
call fcn.00404cc0
mov bl, 1
jmp 0x4326aa
mov byte [ebp - 4], 0x1d
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x43264c
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e94d8
call fcn.00410550
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f730
mov edx, 0x4c8104
mov ecx, eax
call fcn.0040f730
push 0xd7c
mov ecx, eax
call fcn.0040dd30
mov edx, str.:_BrowserGuard_ext_for_Firefox_already_exists.
mov ecx, eax
call fcn.0040f730
push eax
call fcn.0040faa0
add esp, 4
lea ecx, [ebp - 0x354]
call fcn.00404cc0
lea ecx, [ebp - 0x40]
call fcn.00404cc0
xor bl, bl
lea ecx, [ebp - 0x58]
call fcn.00404cc0
lea ecx, [ebp - 0x78]
call fcn.00404cc0
lea ecx, [ebp - 0xa8]
call fcn.00404cc0
lea ecx, [ebp - 0xc0]
call fcn.00404cc0
lea ecx, [ebp - 0x90]
call fcn.00404cc0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046d546
mov esp, ebp
pop ebp
ret
call fcn.0048c340
call fcn.004889bc
call fcn.004889bc
call fcn.004889bc
call fcn.004889bc
call fcn.004889bc
call fcn.004889bc
call fcn.004889bc
call fcn.004889bc
call fcn.004889bc
call fcn.004889bc
call fcn.004889bc
call fcn.004889bc
call fcn.004889bc
call fcn.004889bc
call fcn.004889bc
call fcn.004889bc
call fcn.004889bc
call fcn.004889bc
call fcn.004889bc
int3