Function at 0x4318c0
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b197b
mov eax, dword fs:[0]
push eax
sub esp, 0x34c
mov eax, dword [0x4e506c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x314], 0
mov eax, 0x4e5d30
cmp dword [0x4e5d44], 8
push str.MBRW_B
cmovae eax, dword [0x4e5d30]
push eax
call fcn.0048c547
add esp, 8
test eax, eax
jne 0x431924
xor al, al
jmp 0x432add
push 0x4eab24
push 0x41af20
push 0x4eab2c
call fcn.0046a8b6
add esp, 0xc
test eax, eax
je 0x432af9
lea eax, [ebp - 0x318]
mov dword [ebp - 0x318], 0
push eax
push 0
push 0
push 0x4b856c
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
xor ecx, ecx
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x7c], 7
mov word [ebp - 0x90], cx
mov dword [ebp - 4], ecx
test eax, eax
js 0x4319ac
mov edx, dword [ebp - 0x318]
test edx, edx
je 0x4319bd
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x431990
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x90]
call fcn.004078c0
mov eax, dword [ebp - 0x318]
test eax, eax
je 0x4319bd
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
xor eax, eax
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0xac], 7
mov word [ebp - 0xc0], ax
lea ecx, [ebp - 0x338]
mov byte [ebp - 4], 1
call fcn.0045e700
mov byte [ebp - 4], 2
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x4319f8
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e94e0
call fcn.004104f0
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb4_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f6d0
mov edx, 0x4c8124
mov ecx, eax
call fcn.0040f6d0
push 0xd1f
mov ecx, eax
call fcn.0040dcd0
mov edx, str.:_Checking_BG_for_Chrome:
mov ecx, eax
call fcn.0040f6d0
push eax
call fcn.0040fa40
mov byte [ebp - 4], 1
add esp, 4
mov edx, dword [ebp - 0x324]
cmp edx, 8
jb 0x431a85
mov ecx, dword [ebp - 0x338]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x431a7b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x432afe
push edx
push ecx
call fcn.0046e3a3
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 3
lea ecx, [eax + 1]
call fcn.00432b60
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test al, al
je 0x431ed6
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x28]
lea ecx, [ebp - 0xc0]
push eax
call fcn.004078c0
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x431b14
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x431b0a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x432b03
push edx
push ecx
call fcn.0046e3a3
add esp, 8
lea eax, [ebp - 0x314]
mov dword [ebp - 0x314], 0
push eax
push 0x20119
push 0
push str.SOFTWAREGoogleChromeExtensionsihcjicgdanjaechkgeegckofjjedodee
push 0x80000002
call edi
test eax, eax
je 0x431b5e
lea eax, [ebp - 0x314]
push eax
push 0x20219
push 0
push str.SOFTWAREGoogleChromeExtensionsihcjicgdanjaechkgeegckofjjedodee
push 0x80000002
call edi
test eax, eax
jne 0x431c10
push dword [ebp - 0x314]
call esi
lea ecx, [ebp - 0x338]
call fcn.0045e700
mov byte [ebp - 4], 8
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x431b80
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e94e0
call fcn.004104f0
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb4_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f6d0
mov edx, 0x4c8124
mov ecx, eax
call fcn.0040f6d0
push 0xd34
mov ecx, eax
call fcn.0040dcd0
mov edx, str.:_BrowserGuard_extension_key_for_chrome_already_exists.
mov ecx, eax
call fcn.0040f6d0
push eax
call fcn.0040fa40
mov byte [ebp - 4], 1
add esp, 4
mov edx, dword [ebp - 0x324]
cmp edx, 8
jb 0x431f14
mov ecx, dword [ebp - 0x338]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x431f0a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x432b08
jmp 0x431f0a
push str.GoogleChromeUser_DataDefaultExtensionsihcjicgdanjaechkgeegckofjjedodee
lea edx, [ebp - 0x90]
lea ecx, [ebp - 0x28]
call fcn.0043b7c0
add esp, 4
lea ecx, [ebp - 0x338]
mov byte [ebp - 4], 4
call fcn.0045e700
mov byte [ebp - 4], 5
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x431c44
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e94e0
call fcn.004104f0
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb4_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f6d0
mov edx, 0x4c8124
mov ecx, eax
call fcn.0040f6d0
push 0xd26
mov ecx, eax
call fcn.0040dcd0
mov edx, str.:_Chrome_Ext_Folder:
mov ecx, eax
call fcn.0040f6d0
cmp dword [ebp - 0x14], 8
lea edx, [ebp - 0x28]
push dword [ebp - 0x18]
cmovae edx, dword [ebp - 0x28]
mov ecx, eax
call fcn.004104f0
add esp, 4
push eax
call fcn.0040fa40
mov byte [ebp - 4], 4
add esp, 4
mov edx, dword [ebp - 0x324]
cmp edx, 8
jb 0x431ce9
mov ecx, dword [ebp - 0x338]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x431cdf
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x432b0d
push edx
push ecx
call fcn.0046e3a3
add esp, 8
mov byte [ebp - 0x314], 0
lea edx, [ebp - 0x28]
push dword [ebp - 0x314]
lea ecx, [ebp - 0x40]
call fcn.00419c80
add esp, 4
lea edx, [ebp - 0x60]
lea ecx, [ebp - 0x40]
call fcn.0043e5d0
mov edx, dword [ebp - 0x2c]
test al, al
sete bl
cmp edx, 8
jb 0x431d4e
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x431d44
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x432b12
push edx
push ecx
call fcn.0046e3a3
add esp, 8
lea ecx, [ebp - 0x338]
call fcn.0045e700
test bl, bl
je 0x431e3a
mov byte [ebp - 4], 6
cmp dword [eax + 0x14], 8
mov esi, dword [eax + 0x10]
jb 0x431d70
mov eax, dword [eax]
push esi
mov edx, eax
mov ecx, 0x4e94e0
call fcn.004104f0
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb4_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f6d0
mov edx, 0x4c8124
mov ecx, eax
call fcn.0040f6d0
push 0xd2a
mov ecx, eax
call fcn.0040dcd0
mov edx, str.:_Chrome_Ext_Folder_not_found___prompt_to_install_BG
mov ecx, eax
call fcn.0040f6d0
push eax
call fcn.0040fa40
mov edx, dword [ebp - 0x324]
add esp, 4
cmp edx, 8
jb 0x431df9
mov ecx, dword [ebp - 0x338]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x431def
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x432b17
push edx
push ecx
call fcn.0046e3a3
add esp, 8
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x431e33
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x431e29
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x432b1c
push edx
push ecx
call fcn.0046e3a3
add esp, 8
mov bl, 1
jmp 0x432ac5
mov byte [ebp - 4], 7
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x431e49
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e94e0
call fcn.004104f0
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb4_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f6d0
mov edx, 0x4c8124
mov ecx, eax
call fcn.0040f6d0
push 0xd2f
mov ecx, eax
call fcn.0040dcd0
mov edx, str.:_Found_Chrome_Ext_Folder
mov ecx, eax
call fcn.0040f6d0
push eax
call fcn.0040fa40
mov byte [ebp - 4], 4
add esp, 4
mov edx, dword [ebp - 0x324]
cmp edx, 8
jb 0x431ed6
mov ecx, dword [ebp - 0x338]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x431ecc
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x432b21
push edx
push ecx
call fcn.0046e3a3
add esp, 8
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x431f14
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x431f0a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x432b26
push edx
push ecx
call fcn.0046e3a3
add esp, 8
xor eax, eax
mov dword [ebp - 0x98], 0
mov dword [ebp - 0x94], 7
mov word [ebp - 0xa8], ax
lea ecx, [ebp - 0x338]
mov byte [ebp - 4], 9
call fcn.0045e700
mov byte [ebp - 4], 0xa
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x431f4f
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e94e0
call fcn.004104f0
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb4_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f6d0
mov edx, 0x4c8124
mov ecx, eax
call fcn.0040f6d0
push 0xd3a
mov ecx, eax
call fcn.0040dcd0
mov edx, str.:_Checking_BG_for_Edge:
mov ecx, eax
call fcn.0040f6d0
push eax
call fcn.0040fa40
mov byte [ebp - 4], 9
add esp, 4
mov edx, dword [ebp - 0x324]
cmp edx, 8
jb 0x431fdc
mov ecx, dword [ebp - 0x338]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x431fd2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x432b2b
push edx
push ecx
call fcn.0046e3a3
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 0xb
xor ecx, ecx
call fcn.00432b60
test al, al
je 0x4325e2
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x28]
lea ecx, [ebp - 0xa8]
push eax
call fcn.004078c0
mov byte [ebp - 4], 9
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x43205e
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x432054
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x432b30
push edx
push ecx
call fcn.0046e3a3
add esp, 8
lea eax, [ebp - 0x314]
mov dword [ebp - 0x314], 0
push eax
push 0x20119
push 0
push str.SOFTWAREMicrosoftEdgeExtensionsihcjicgdanjaechkgeegckofjjedodee
push 0x80000002
call edi
test eax, eax
je 0x4320e4
lea eax, [ebp - 0x314]
push eax
push 0x20219
push 0
push str.SOFTWAREMicrosoftEdgeExtensionsihcjicgdanjaechkgeegckofjjedodee
push 0x80000002
call edi
test eax, eax
je 0x4320e4
lea eax, [ebp - 0x314]
push eax
push 0x20119
push 0
push str.SOFTWAREMicrosoftEdgeExtensions_bojobppfploabceghnmlahpoonbcbacn
push 0x80000002
call edi
test eax, eax
je 0x4320e4
lea eax, [ebp - 0x314]
push eax
push 0x20219
push 0
push str.SOFTWAREMicrosoftEdgeExtensions_bojobppfploabceghnmlahpoonbcbacn
push 0x80000002
call edi
test eax, eax
jne 0x432163
push dword [ebp - 0x314]
call esi
lea ecx, [ebp - 0x338]
call fcn.0045e700
mov byte [ebp - 4], 0x13
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x432106
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e94e0
call fcn.004104f0
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb4_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f6d0
mov edx, 0x4c8124
mov ecx, eax
call fcn.0040f6d0
push 0xd53
mov ecx, eax
call fcn.0040dcd0
mov edx, str.:_BrowserGuard_extension_key_for_Edge_already_exists.
mov ecx, eax
call fcn.0040f6d0
push eax
call fcn.0040fa40
add esp, 4
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x338]
call fcn.00404c50
jmp 0x432620
push str.MicrosoftEdgeUser_DataDefaultExtensionsihcjicgdanjaechkgeegckofjjedodee
lea edx, [ebp - 0x90]
lea ecx, [ebp - 0x58]
call fcn.0043b7c0
add esp, 4
push str.MicrosoftEdgeUser_DataDefaultExtensions_bojobppfploabceghnmlahpoonbcbacn
lea edx, [ebp - 0x90]
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x28]
call fcn.0043b7c0
add esp, 4
lea ecx, [ebp - 0x338]
mov byte [ebp - 4], 0xd
call fcn.0045e700
mov byte [ebp - 4], 0xe
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x4321b1
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e94e0
call fcn.004104f0
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb4_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f6d0
mov edx, 0x4c8124
mov ecx, eax
call fcn.0040f6d0
push 0xd44
mov ecx, eax
call fcn.0040dcd0
mov edx, str.:_Edge_Ext_Folder:
mov ecx, eax
call fcn.0040f6d0
cmp dword [ebp - 0x44], 8
lea edx, [ebp - 0x58]
push dword [ebp - 0x48]
cmovae edx, dword [ebp - 0x58]
mov ecx, eax
call fcn.004104f0
add esp, 4
push eax
call fcn.0040fa40
mov byte [ebp - 4], 0xd
add esp, 4
mov edx, dword [ebp - 0x324]
cmp edx, 8
jb 0x432256
mov ecx, dword [ebp - 0x338]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x43224c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x432b35
push edx
push ecx
call fcn.0046e3a3
add esp, 8
lea ecx, [ebp - 0x338]
call fcn.0045e700
mov byte [ebp - 4], 0xf
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x432270
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e94e0
call fcn.004104f0
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb4_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f6d0
mov edx, 0x4c8124
mov ecx, eax
call fcn.0040f6d0
push 0xd45
mov ecx, eax
call fcn.0040dcd0
mov edx, str.:_Edge_Ext_Folder__2_:
mov ecx, eax
call fcn.0040f6d0
cmp dword [ebp - 0x14], 8
lea edx, [ebp - 0x28]
push dword [ebp - 0x18]
cmovae edx, dword [ebp - 0x28]
mov ecx, eax
call fcn.004104f0
add esp, 4
push eax
call fcn.0040fa40
mov byte [ebp - 4], 0xd
add esp, 4
mov edx, dword [ebp - 0x324]
cmp edx, 8
jb 0x432315
mov ecx, dword [ebp - 0x338]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x43230b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x432b3a
push edx
push ecx
call fcn.0046e3a3
add esp, 8
mov byte [ebp - 0x314], 0
lea edx, [ebp - 0x58]
push dword [ebp - 0x314]
lea ecx, [ebp - 0x338]
call fcn.00419c80
add esp, 4
mov byte [ebp - 4], 0x10
lea edx, [ebp - 0x60]
mov ebx, 1
lea ecx, [ebp - 0x338]
mov dword [ebp - 0x314], ebx
call fcn.0043e5d0
test al, al
jne 0x432389
mov byte [ebp - 0x33c], al
lea edx, [ebp - 0x28]
push dword [ebp - 0x33c]
lea ecx, [ebp - 0x40]
call fcn.00419c80
add esp, 4
lea edx, [ebp - 0x60]
lea ecx, [ebp - 0x40]
mov ebx, 3
call fcn.0043e5d0
mov byte [ebp - 0x31d], 1
test al, al
je 0x432390
mov byte [ebp - 0x31d], 0
test bl, 2
je 0x4323e3
mov edx, dword [ebp - 0x2c]
cmp edx, 8
jb 0x4323cf
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4323c5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x432b3f
push edx
push ecx
call fcn.0046e3a3
add esp, 8
xor eax, eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
mov dword [ebp - 4], 0xd
mov edx, dword [ebp - 0x324]
cmp edx, 8
jb 0x43242a
mov ecx, dword [ebp - 0x338]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x432420
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x432b44
push edx
push ecx
call fcn.0046e3a3
add esp, 8
lea ecx, [ebp - 0x338]
call fcn.0045e700
cmp byte [ebp - 0x31d], 0
je 0x432569
mov byte [ebp - 4], 0x11
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x432451
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e94e0
call fcn.004104f0
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb4_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f6d0
mov edx, 0x4c8124
mov ecx, eax
call fcn.0040f6d0
push 0xd49
mov ecx, eax
call fcn.0040dcd0
mov edx, str.:_Edge_Ext_Folder_not_found___prompt_to_install_BG
mov ecx, eax
call fcn.0040f6d0
push eax
call fcn.0040fa40
mov edx, dword [ebp - 0x324]
add esp, 4
cmp edx, 8
jb 0x4324da
mov ecx, dword [ebp - 0x338]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4324d0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x432b49
push edx
push ecx
call fcn.0046e3a3
add esp, 8
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x432514
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x43250a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x432b4e
push edx
push ecx
call fcn.0046e3a3
add esp, 8
mov edx, dword [ebp - 0x44]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp edx, 8
jb 0x432562
mov ecx, dword [ebp - 0x58]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x432558
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x432b53
push edx
push ecx
call fcn.0046e3a3
add esp, 8
mov bl, 1
jmp 0x432aba
mov byte [ebp - 4], 0x12
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x432578
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e94e0
call fcn.004104f0
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb4_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f6d0
mov edx, 0x4c8124
mov ecx, eax
call fcn.0040f6d0
push 0xd4e
mov ecx, eax
call fcn.0040dcd0
mov edx, str.:_Found_Edge_Ext_Folder
mov ecx, eax
call fcn.0040f6d0
push eax
call fcn.0040fa40
add esp, 4
lea ecx, [ebp - 0x338]
call fcn.00404c50
lea ecx, [ebp - 0x28]
call fcn.00404c50
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 9
call fcn.00404c50
jmp 0x432620
mov byte [ebp - 4], 9
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x432620
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x432616
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x432b58
push edx
push ecx
call fcn.0046e3a3
add esp, 8
lea ecx, [ebp - 0x338]
call fcn.0045e700
mov byte [ebp - 4], 0x14
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x43263a
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e94e0
call fcn.004104f0
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb4_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f6d0
mov edx, 0x4c8124
mov ecx, eax
call fcn.0040f6d0
push 0xd59
mov ecx, eax
call fcn.0040dcd0
mov edx, str.:_Checking_BG_for_Firefox:
mov ecx, eax
call fcn.0040f6d0
push eax
call fcn.0040fa40
add esp, 4
lea ecx, [ebp - 0x338]
call fcn.00404c50
lea eax, [ebp - 0x31c]
mov dword [ebp - 0x31c], 0
push eax
push 0
push 0
push 0x4b854c
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
xor ecx, ecx
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x64], 7
mov word [ebp - 0x78], cx
mov byte [ebp - 4], 0x15
test eax, eax
js 0x432708
mov edx, dword [ebp - 0x31c]
test edx, edx
je 0x432719
mov ecx, edx
lea esi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4326e0
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x78]
call fcn.004078c0
push 0x10
push str.MozillaFirefox
lea ecx, [ebp - 0x78]
call fcn.0040c200
mov eax, dword [ebp - 0x31c]
test eax, eax
je 0x432719
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
xor eax, eax
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 7
mov word [ebp - 0x58], ax
mov byte [ebp - 4], 0x16
cmp dword [ebp - 0x68], eax
je 0x432aa8
lea ecx, [ebp - 0x58]
call fcn.004335b0
test al, al
je 0x432aa8
push str.Profiles
lea edx, [ebp - 0x78]
lea ecx, [ebp - 0x40]
call fcn.0043b7c0
add esp, 4
push 0x250
lea eax, [ebp - 0x310]
mov byte [ebp - 4], 0x17
push 0
push eax
xor bh, bh
call fcn.004864f0
add esp, 0xc
lea ecx, [ebp - 0x310]
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4329b8
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileW]
test byte [ebp - 0x310], 0x10
je 0x432996
mov ecx, 0x4cd89c
lea eax, [ebp - 0x2e4]
nop dword [eax + eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4327e6
test dx, dx
je 0x4327e2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4327e6
add eax, 4
add ecx, 4
test dx, dx
jne 0x4327c0
xor eax, eax
jmp 0x4327eb
sbb eax, eax
or eax, 1
test eax, eax
je 0x432996
mov ecx, 0x4cd8a0
lea eax, [ebp - 0x2e4]
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x432826
test dx, dx
je 0x432822
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x432826
add eax, 4
add ecx, 4
test dx, dx
jne 0x432800
xor eax, eax
jmp 0x43282b
sbb eax, eax
or eax, 1
test eax, eax
je 0x432996
push str.Profiles_
lea edx, [ebp - 0x78]
lea ecx, [ebp - 0x354]
call fcn.0043b7c0
add esp, 4
lea ecx, [ebp - 0x2e4]
mov byte [ebp - 4], 0x18
push ecx
mov edx, eax
lea ecx, [ebp - 0x28]
call fcn.0043b890
add esp, 4
lea ecx, [ebp - 0x354]
mov byte [ebp - 4], 0x1a
call fcn.00404c50
push 0xc
push str.extensions_
lea ecx, [ebp - 0x28]
call fcn.0040c200
push 0x2a
push 0x4ccff8
lea ecx, [ebp - 0x28]
call fcn.0040c200
mov byte [ebp - 0x33c], 0
lea edx, [ebp - 0x28]
push dword [ebp - 0x33c]
lea ecx, [ebp - 0x338]
call fcn.00419c80
add esp, 4
lea edx, [ebp - 0x60]
lea ecx, [ebp - 0x338]
call fcn.0043e5d0
mov edx, dword [ebp - 0x324]
mov bl, al
cmp edx, 8
jb 0x4328fc
mov ecx, dword [ebp - 0x338]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4328f2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x432afe
push edx
push ecx
call fcn.0046e3a3
add esp, 8
test bl, bl
jne 0x4329aa
lea ecx, [ebp - 0x338]
call fcn.0045e700
mov byte [ebp - 4], 0x1b
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x43291e
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e94e0
call fcn.004104f0
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb4_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f6d0
mov edx, 0x4c8124
mov ecx, eax
call fcn.0040f6d0
push 0xd81
mov ecx, eax
call fcn.0040dcd0
mov edx, str.:_profilePath:
mov ecx, eax
call fcn.0040f6d0
cmp dword [ebp - 0x14], 8
lea edx, [ebp - 0x28]
push dword [ebp - 0x18]
cmovae edx, dword [ebp - 0x28]
mov ecx, eax
call fcn.004104f0
add esp, 4
push eax
call fcn.0040fa40
add esp, 4
lea ecx, [ebp - 0x338]
call fcn.00404c50
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x17
call fcn.00404c50
lea eax, [ebp - 0x310]
push eax
push esi
call edi
test eax, eax
jne 0x4327a3
jmp 0x4329b8
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x17
mov bh, 1
call fcn.00404c50
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x354]
call fcn.0045e700
test bh, bh
jne 0x432a3d
mov byte [ebp - 4], 0x1c
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x4329dd
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e94e0
call fcn.004104f0
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb4_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f6d0
mov edx, 0x4c8124
mov ecx, eax
call fcn.0040f6d0
push 0xd89
mov ecx, eax
call fcn.0040dcd0
mov edx, str.:_Firefox_Ext_not_found___prompt_to_install_BG
mov ecx, eax
call fcn.0040f6d0
push eax
call fcn.0040fa40
add esp, 4
lea ecx, [ebp - 0x354]
call fcn.00404c50
lea ecx, [ebp - 0x40]
call fcn.00404c50
mov bl, 1
jmp 0x432aaa
mov byte [ebp - 4], 0x1d
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x432a4c
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e94e0
call fcn.004104f0
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb4_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f6d0
mov edx, 0x4c8124
mov ecx, eax
call fcn.0040f6d0
push 0xd8e
mov ecx, eax
call fcn.0040dcd0
mov edx, str.:_BrowserGuard_ext_for_Firefox_already_exists.
mov ecx, eax
call fcn.0040f6d0
push eax
call fcn.0040fa40
add esp, 4
lea ecx, [ebp - 0x354]
call fcn.00404c50
lea ecx, [ebp - 0x40]
call fcn.00404c50
xor bl, bl
lea ecx, [ebp - 0x58]
call fcn.00404c50
lea ecx, [ebp - 0x78]
call fcn.00404c50
lea ecx, [ebp - 0xa8]
call fcn.00404c50
lea ecx, [ebp - 0xc0]
call fcn.00404c50
lea ecx, [ebp - 0x90]
call fcn.00404c50
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046de82
mov esp, ebp
pop ebp
ret
call fcn.0048cc70
call fcn.004892fc
call fcn.004892fc
call fcn.004892fc
call fcn.004892fc
call fcn.004892fc
call fcn.004892fc
call fcn.004892fc
call fcn.004892fc
call fcn.004892fc
call fcn.004892fc
call fcn.004892fc
call fcn.004892fc
call fcn.004892fc
call fcn.004892fc
call fcn.004892fc
call fcn.004892fc
call fcn.004892fc
call fcn.004892fc
call fcn.004892fc
int3