Function at 0x431540
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b115b
mov eax, dword fs:[0]
push eax
sub esp, 0x34c
mov eax, dword [0x4e506c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x314], 0
mov eax, 0x4e5d30
cmp dword [0x4e5d44], 8
push str.MBRW_B
cmovae eax, dword [0x4e5d30]
push eax
call fcn.0048bd37
add esp, 8
test eax, eax
jne 0x4315a4
xor al, al
jmp 0x43275d
push 0x4eab24
push 0x41a160
push 0x4eab2c
call fcn.0046a0b3
add esp, 0xc
test eax, eax
je 0x432779
lea eax, [ebp - 0x318]
mov dword [ebp - 0x318], 0
push eax
push 0
push 0
push 0x4b856c
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
xor ecx, ecx
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x7c], 7
mov word [ebp - 0x90], cx
mov dword [ebp - 4], ecx
test eax, eax
js 0x43162c
mov edx, dword [ebp - 0x318]
test edx, edx
je 0x43163d
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x431610
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x90]
call fcn.00407920
mov eax, dword [ebp - 0x318]
test eax, eax
je 0x43163d
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
xor eax, eax
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0xac], 7
mov word [ebp - 0xc0], ax
lea ecx, [ebp - 0x338]
mov byte [ebp - 4], 1
call fcn.0045deb0
mov byte [ebp - 4], 2
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x431678
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e94d8
call fcn.00410550
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f730
mov edx, 0x4c8104
mov ecx, eax
call fcn.0040f730
push 0xd0d
mov ecx, eax
call fcn.0040dd30
mov edx, str.:_Checking_BG_for_Chrome:
mov ecx, eax
call fcn.0040f730
push eax
call fcn.0040faa0
mov byte [ebp - 4], 1
add esp, 4
mov edx, dword [ebp - 0x324]
cmp edx, 8
jb 0x431705
mov ecx, dword [ebp - 0x338]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4316fb
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43277e
push edx
push ecx
call fcn.0046db96
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 3
lea ecx, [eax + 1]
call fcn.004327e0
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test al, al
je 0x431b56
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x28]
lea ecx, [ebp - 0xc0]
push eax
call fcn.00407920
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x431794
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x43178a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x432783
push edx
push ecx
call fcn.0046db96
add esp, 8
lea eax, [ebp - 0x314]
mov dword [ebp - 0x314], 0
push eax
push 0x20119
push 0
push str.SOFTWAREGoogleChromeExtensionsihcjicgdanjaechkgeegckofjjedodee
push 0x80000002
call edi
test eax, eax
je 0x4317de
lea eax, [ebp - 0x314]
push eax
push 0x20219
push 0
push str.SOFTWAREGoogleChromeExtensionsihcjicgdanjaechkgeegckofjjedodee
push 0x80000002
call edi
test eax, eax
jne 0x431890
push dword [ebp - 0x314]
call esi
lea ecx, [ebp - 0x338]
call fcn.0045deb0
mov byte [ebp - 4], 8
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x431800
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e94d8
call fcn.00410550
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f730
mov edx, 0x4c8104
mov ecx, eax
call fcn.0040f730
push 0xd22
mov ecx, eax
call fcn.0040dd30
mov edx, str.:_BrowserGuard_extension_key_for_chrome_already_exists.
mov ecx, eax
call fcn.0040f730
push eax
call fcn.0040faa0
mov byte [ebp - 4], 1
add esp, 4
mov edx, dword [ebp - 0x324]
cmp edx, 8
jb 0x431b94
mov ecx, dword [ebp - 0x338]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x431b8a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x432788
jmp 0x431b8a
push str.GoogleChromeUser_DataDefaultExtensionsihcjicgdanjaechkgeegckofjjedodee
lea edx, [ebp - 0x90]
lea ecx, [ebp - 0x28]
call fcn.0043b8a0
add esp, 4
lea ecx, [ebp - 0x338]
mov byte [ebp - 4], 4
call fcn.0045deb0
mov byte [ebp - 4], 5
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x4318c4
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e94d8
call fcn.00410550
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f730
mov edx, 0x4c8104
mov ecx, eax
call fcn.0040f730
push 0xd14
mov ecx, eax
call fcn.0040dd30
mov edx, str.:_Chrome_Ext_Folder:
mov ecx, eax
call fcn.0040f730
cmp dword [ebp - 0x14], 8
lea edx, [ebp - 0x28]
push dword [ebp - 0x18]
cmovae edx, dword [ebp - 0x28]
mov ecx, eax
call fcn.00410550
add esp, 4
push eax
call fcn.0040faa0
mov byte [ebp - 4], 4
add esp, 4
mov edx, dword [ebp - 0x324]
cmp edx, 8
jb 0x431969
mov ecx, dword [ebp - 0x338]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x43195f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43278d
push edx
push ecx
call fcn.0046db96
add esp, 8
mov byte [ebp - 0x314], 0
lea edx, [ebp - 0x28]
push dword [ebp - 0x314]
lea ecx, [ebp - 0x40]
call fcn.00418ec0
add esp, 4
lea edx, [ebp - 0x60]
lea ecx, [ebp - 0x40]
call fcn.0043e6b0
mov edx, dword [ebp - 0x2c]
test al, al
sete bl
cmp edx, 8
jb 0x4319ce
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4319c4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x432792
push edx
push ecx
call fcn.0046db96
add esp, 8
lea ecx, [ebp - 0x338]
call fcn.0045deb0
test bl, bl
je 0x431aba
mov byte [ebp - 4], 6
cmp dword [eax + 0x14], 8
mov esi, dword [eax + 0x10]
jb 0x4319f0
mov eax, dword [eax]
push esi
mov edx, eax
mov ecx, 0x4e94d8
call fcn.00410550
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f730
mov edx, 0x4c8104
mov ecx, eax
call fcn.0040f730
push 0xd18
mov ecx, eax
call fcn.0040dd30
mov edx, str.:_Chrome_Ext_Folder_not_found___prompt_to_install_BG
mov ecx, eax
call fcn.0040f730
push eax
call fcn.0040faa0
mov edx, dword [ebp - 0x324]
add esp, 4
cmp edx, 8
jb 0x431a79
mov ecx, dword [ebp - 0x338]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x431a6f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x432797
push edx
push ecx
call fcn.0046db96
add esp, 8
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x431ab3
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x431aa9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43279c
push edx
push ecx
call fcn.0046db96
add esp, 8
mov bl, 1
jmp 0x432745
mov byte [ebp - 4], 7
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x431ac9
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e94d8
call fcn.00410550
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f730
mov edx, 0x4c8104
mov ecx, eax
call fcn.0040f730
push 0xd1d
mov ecx, eax
call fcn.0040dd30
mov edx, str.:_Found_Chrome_Ext_Folder
mov ecx, eax
call fcn.0040f730
push eax
call fcn.0040faa0
mov byte [ebp - 4], 4
add esp, 4
mov edx, dword [ebp - 0x324]
cmp edx, 8
jb 0x431b56
mov ecx, dword [ebp - 0x338]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x431b4c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4327a1
push edx
push ecx
call fcn.0046db96
add esp, 8
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x431b94
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x431b8a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4327a6
push edx
push ecx
call fcn.0046db96
add esp, 8
xor eax, eax
mov dword [ebp - 0x98], 0
mov dword [ebp - 0x94], 7
mov word [ebp - 0xa8], ax
lea ecx, [ebp - 0x338]
mov byte [ebp - 4], 9
call fcn.0045deb0
mov byte [ebp - 4], 0xa
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x431bcf
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e94d8
call fcn.00410550
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f730
mov edx, 0x4c8104
mov ecx, eax
call fcn.0040f730
push 0xd28
mov ecx, eax
call fcn.0040dd30
mov edx, str.:_Checking_BG_for_Edge:
mov ecx, eax
call fcn.0040f730
push eax
call fcn.0040faa0
mov byte [ebp - 4], 9
add esp, 4
mov edx, dword [ebp - 0x324]
cmp edx, 8
jb 0x431c5c
mov ecx, dword [ebp - 0x338]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x431c52
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4327ab
push edx
push ecx
call fcn.0046db96
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 0xb
xor ecx, ecx
call fcn.004327e0
test al, al
je 0x432262
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x28]
lea ecx, [ebp - 0xa8]
push eax
call fcn.00407920
mov byte [ebp - 4], 9
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x431cde
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x431cd4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4327b0
push edx
push ecx
call fcn.0046db96
add esp, 8
lea eax, [ebp - 0x314]
mov dword [ebp - 0x314], 0
push eax
push 0x20119
push 0
push str.SOFTWAREMicrosoftEdgeExtensionsihcjicgdanjaechkgeegckofjjedodee
push 0x80000002
call edi
test eax, eax
je 0x431d64
lea eax, [ebp - 0x314]
push eax
push 0x20219
push 0
push str.SOFTWAREMicrosoftEdgeExtensionsihcjicgdanjaechkgeegckofjjedodee
push 0x80000002
call edi
test eax, eax
je 0x431d64
lea eax, [ebp - 0x314]
push eax
push 0x20119
push 0
push str.SOFTWAREMicrosoftEdgeExtensions_bojobppfploabceghnmlahpoonbcbacn
push 0x80000002
call edi
test eax, eax
je 0x431d64
lea eax, [ebp - 0x314]
push eax
push 0x20219
push 0
push str.SOFTWAREMicrosoftEdgeExtensions_bojobppfploabceghnmlahpoonbcbacn
push 0x80000002
call edi
test eax, eax
jne 0x431de3
push dword [ebp - 0x314]
call esi
lea ecx, [ebp - 0x338]
call fcn.0045deb0
mov byte [ebp - 4], 0x13
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x431d86
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e94d8
call fcn.00410550
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f730
mov edx, 0x4c8104
mov ecx, eax
call fcn.0040f730
push 0xd41
mov ecx, eax
call fcn.0040dd30
mov edx, str.:_BrowserGuard_extension_key_for_Edge_already_exists.
mov ecx, eax
call fcn.0040f730
push eax
call fcn.0040faa0
add esp, 4
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x338]
call fcn.00404cc0
jmp 0x4322a0
push str.MicrosoftEdgeUser_DataDefaultExtensionsihcjicgdanjaechkgeegckofjjedodee
lea edx, [ebp - 0x90]
lea ecx, [ebp - 0x58]
call fcn.0043b8a0
add esp, 4
push str.MicrosoftEdgeUser_DataDefaultExtensions_bojobppfploabceghnmlahpoonbcbacn
lea edx, [ebp - 0x90]
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x28]
call fcn.0043b8a0
add esp, 4
lea ecx, [ebp - 0x338]
mov byte [ebp - 4], 0xd
call fcn.0045deb0
mov byte [ebp - 4], 0xe
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x431e31
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e94d8
call fcn.00410550
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f730
mov edx, 0x4c8104
mov ecx, eax
call fcn.0040f730
push 0xd32
mov ecx, eax
call fcn.0040dd30
mov edx, str.:_Edge_Ext_Folder:
mov ecx, eax
call fcn.0040f730
cmp dword [ebp - 0x44], 8
lea edx, [ebp - 0x58]
push dword [ebp - 0x48]
cmovae edx, dword [ebp - 0x58]
mov ecx, eax
call fcn.00410550
add esp, 4
push eax
call fcn.0040faa0
mov byte [ebp - 4], 0xd
add esp, 4
mov edx, dword [ebp - 0x324]
cmp edx, 8
jb 0x431ed6
mov ecx, dword [ebp - 0x338]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x431ecc
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4327b5
push edx
push ecx
call fcn.0046db96
add esp, 8
lea ecx, [ebp - 0x338]
call fcn.0045deb0
mov byte [ebp - 4], 0xf
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x431ef0
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e94d8
call fcn.00410550
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f730
mov edx, 0x4c8104
mov ecx, eax
call fcn.0040f730
push 0xd33
mov ecx, eax
call fcn.0040dd30
mov edx, str.:_Edge_Ext_Folder__2_:
mov ecx, eax
call fcn.0040f730
cmp dword [ebp - 0x14], 8
lea edx, [ebp - 0x28]
push dword [ebp - 0x18]
cmovae edx, dword [ebp - 0x28]
mov ecx, eax
call fcn.00410550
add esp, 4
push eax
call fcn.0040faa0
mov byte [ebp - 4], 0xd
add esp, 4
mov edx, dword [ebp - 0x324]
cmp edx, 8
jb 0x431f95
mov ecx, dword [ebp - 0x338]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x431f8b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4327ba
push edx
push ecx
call fcn.0046db96
add esp, 8
mov byte [ebp - 0x314], 0
lea edx, [ebp - 0x58]
push dword [ebp - 0x314]
lea ecx, [ebp - 0x338]
call fcn.00418ec0
add esp, 4
mov byte [ebp - 4], 0x10
lea edx, [ebp - 0x60]
mov ebx, 1
lea ecx, [ebp - 0x338]
mov dword [ebp - 0x314], ebx
call fcn.0043e6b0
test al, al
jne 0x432009
mov byte [ebp - 0x33c], al
lea edx, [ebp - 0x28]
push dword [ebp - 0x33c]
lea ecx, [ebp - 0x40]
call fcn.00418ec0
add esp, 4
lea edx, [ebp - 0x60]
lea ecx, [ebp - 0x40]
mov ebx, 3
call fcn.0043e6b0
mov byte [ebp - 0x31d], 1
test al, al
je 0x432010
mov byte [ebp - 0x31d], 0
test bl, 2
je 0x432063
mov edx, dword [ebp - 0x2c]
cmp edx, 8
jb 0x43204f
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x432045
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4327bf
push edx
push ecx
call fcn.0046db96
add esp, 8
xor eax, eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
mov dword [ebp - 4], 0xd
mov edx, dword [ebp - 0x324]
cmp edx, 8
jb 0x4320aa
mov ecx, dword [ebp - 0x338]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4320a0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4327c4
push edx
push ecx
call fcn.0046db96
add esp, 8
lea ecx, [ebp - 0x338]
call fcn.0045deb0
cmp byte [ebp - 0x31d], 0
je 0x4321e9
mov byte [ebp - 4], 0x11
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x4320d1
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e94d8
call fcn.00410550
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f730
mov edx, 0x4c8104
mov ecx, eax
call fcn.0040f730
push 0xd37
mov ecx, eax
call fcn.0040dd30
mov edx, str.:_Edge_Ext_Folder_not_found___prompt_to_install_BG
mov ecx, eax
call fcn.0040f730
push eax
call fcn.0040faa0
mov edx, dword [ebp - 0x324]
add esp, 4
cmp edx, 8
jb 0x43215a
mov ecx, dword [ebp - 0x338]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x432150
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4327c9
push edx
push ecx
call fcn.0046db96
add esp, 8
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x432194
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x43218a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4327ce
push edx
push ecx
call fcn.0046db96
add esp, 8
mov edx, dword [ebp - 0x44]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp edx, 8
jb 0x4321e2
mov ecx, dword [ebp - 0x58]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4321d8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4327d3
push edx
push ecx
call fcn.0046db96
add esp, 8
mov bl, 1
jmp 0x43273a
mov byte [ebp - 4], 0x12
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x4321f8
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e94d8
call fcn.00410550
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f730
mov edx, 0x4c8104
mov ecx, eax
call fcn.0040f730
push 0xd3c
mov ecx, eax
call fcn.0040dd30
mov edx, str.:_Found_Edge_Ext_Folder
mov ecx, eax
call fcn.0040f730
push eax
call fcn.0040faa0
add esp, 4
lea ecx, [ebp - 0x338]
call fcn.00404cc0
lea ecx, [ebp - 0x28]
call fcn.00404cc0
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 9
call fcn.00404cc0
jmp 0x4322a0
mov byte [ebp - 4], 9
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x4322a0
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x432296
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4327d8
push edx
push ecx
call fcn.0046db96
add esp, 8
lea ecx, [ebp - 0x338]
call fcn.0045deb0
mov byte [ebp - 4], 0x14
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x4322ba
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e94d8
call fcn.00410550
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f730
mov edx, 0x4c8104
mov ecx, eax
call fcn.0040f730
push 0xd47
mov ecx, eax
call fcn.0040dd30
mov edx, str.:_Checking_BG_for_Firefox:
mov ecx, eax
call fcn.0040f730
push eax
call fcn.0040faa0
add esp, 4
lea ecx, [ebp - 0x338]
call fcn.00404cc0
lea eax, [ebp - 0x31c]
mov dword [ebp - 0x31c], 0
push eax
push 0
push 0
push 0x4b854c
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
xor ecx, ecx
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x64], 7
mov word [ebp - 0x78], cx
mov byte [ebp - 4], 0x15
test eax, eax
js 0x432388
mov edx, dword [ebp - 0x31c]
test edx, edx
je 0x432399
mov ecx, edx
lea esi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x432360
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x78]
call fcn.00407920
push 0x10
push str.MozillaFirefox
lea ecx, [ebp - 0x78]
call fcn.0040c260
mov eax, dword [ebp - 0x31c]
test eax, eax
je 0x432399
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
xor eax, eax
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 7
mov word [ebp - 0x58], ax
mov byte [ebp - 4], 0x16
cmp dword [ebp - 0x68], eax
je 0x432728
lea ecx, [ebp - 0x58]
call fcn.00433230
test al, al
je 0x432728
push str.Profiles
lea edx, [ebp - 0x78]
lea ecx, [ebp - 0x40]
call fcn.0043b8a0
add esp, 4
push 0x250
lea eax, [ebp - 0x310]
mov byte [ebp - 4], 0x17
push 0
push eax
xor bh, bh
call fcn.00485ce0
add esp, 0xc
lea ecx, [ebp - 0x310]
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x432638
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileW]
test byte [ebp - 0x310], 0x10
je 0x432616
mov ecx, 0x4cdb24
lea eax, [ebp - 0x2e4]
nop dword [eax + eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x432466
test dx, dx
je 0x432462
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x432466
add eax, 4
add ecx, 4
test dx, dx
jne 0x432440
xor eax, eax
jmp 0x43246b
sbb eax, eax
or eax, 1
test eax, eax
je 0x432616
mov ecx, 0x4cdb28
lea eax, [ebp - 0x2e4]
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4324a6
test dx, dx
je 0x4324a2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4324a6
add eax, 4
add ecx, 4
test dx, dx
jne 0x432480
xor eax, eax
jmp 0x4324ab
sbb eax, eax
or eax, 1
test eax, eax
je 0x432616
push str.Profiles_
lea edx, [ebp - 0x78]
lea ecx, [ebp - 0x354]
call fcn.0043b8a0
add esp, 4
lea ecx, [ebp - 0x2e4]
mov byte [ebp - 4], 0x18
push ecx
mov edx, eax
lea ecx, [ebp - 0x28]
call fcn.0043b970
add esp, 4
lea ecx, [ebp - 0x354]
mov byte [ebp - 4], 0x1a
call fcn.00404cc0
push 0xc
push str.extensions_
lea ecx, [ebp - 0x28]
call fcn.0040c260
push 0x2a
push 0x4ccf20
lea ecx, [ebp - 0x28]
call fcn.0040c260
mov byte [ebp - 0x33c], 0
lea edx, [ebp - 0x28]
push dword [ebp - 0x33c]
lea ecx, [ebp - 0x338]
call fcn.00418ec0
add esp, 4
lea edx, [ebp - 0x60]
lea ecx, [ebp - 0x338]
call fcn.0043e6b0
mov edx, dword [ebp - 0x324]
mov bl, al
cmp edx, 8
jb 0x43257c
mov ecx, dword [ebp - 0x338]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x432572
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43277e
push edx
push ecx
call fcn.0046db96
add esp, 8
test bl, bl
jne 0x43262a
lea ecx, [ebp - 0x338]
call fcn.0045deb0
mov byte [ebp - 4], 0x1b
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x43259e
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e94d8
call fcn.00410550
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f730
mov edx, 0x4c8104
mov ecx, eax
call fcn.0040f730
push 0xd6f
mov ecx, eax
call fcn.0040dd30
mov edx, str.:_profilePath:
mov ecx, eax
call fcn.0040f730
cmp dword [ebp - 0x14], 8
lea edx, [ebp - 0x28]
push dword [ebp - 0x18]
cmovae edx, dword [ebp - 0x28]
mov ecx, eax
call fcn.00410550
add esp, 4
push eax
call fcn.0040faa0
add esp, 4
lea ecx, [ebp - 0x338]
call fcn.00404cc0
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x17
call fcn.00404cc0
lea eax, [ebp - 0x310]
push eax
push esi
call edi
test eax, eax
jne 0x432423
jmp 0x432638
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x17
mov bh, 1
call fcn.00404cc0
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x354]
call fcn.0045deb0
test bh, bh
jne 0x4326bd
mov byte [ebp - 4], 0x1c
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x43265d
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e94d8
call fcn.00410550
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f730
mov edx, 0x4c8104
mov ecx, eax
call fcn.0040f730
push 0xd77
mov ecx, eax
call fcn.0040dd30
mov edx, str.:_Firefox_Ext_not_found___prompt_to_install_BG
mov ecx, eax
call fcn.0040f730
push eax
call fcn.0040faa0
add esp, 4
lea ecx, [ebp - 0x354]
call fcn.00404cc0
lea ecx, [ebp - 0x40]
call fcn.00404cc0
mov bl, 1
jmp 0x43272a
mov byte [ebp - 4], 0x1d
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x4326cc
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e94d8
call fcn.00410550
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f730
mov edx, 0x4c8104
mov ecx, eax
call fcn.0040f730
push 0xd7c
mov ecx, eax
call fcn.0040dd30
mov edx, str.:_BrowserGuard_ext_for_Firefox_already_exists.
mov ecx, eax
call fcn.0040f730
push eax
call fcn.0040faa0
add esp, 4
lea ecx, [ebp - 0x354]
call fcn.00404cc0
lea ecx, [ebp - 0x40]
call fcn.00404cc0
xor bl, bl
lea ecx, [ebp - 0x58]
call fcn.00404cc0
lea ecx, [ebp - 0x78]
call fcn.00404cc0
lea ecx, [ebp - 0xa8]
call fcn.00404cc0
lea ecx, [ebp - 0xc0]
call fcn.00404cc0
lea ecx, [ebp - 0x90]
call fcn.00404cc0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046d675
mov esp, ebp
pop ebp
ret
call fcn.0048c460
call fcn.00488aec
call fcn.00488aec
call fcn.00488aec
call fcn.00488aec
call fcn.00488aec
call fcn.00488aec
call fcn.00488aec
call fcn.00488aec
call fcn.00488aec
call fcn.00488aec
call fcn.00488aec
call fcn.00488aec
call fcn.00488aec
call fcn.00488aec
call fcn.00488aec
call fcn.00488aec
call fcn.00488aec
call fcn.00488aec
call fcn.00488aec
int3