Function at 0x431540
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b1e8b
mov eax, dword fs:[0]
push eax
sub esp, 0x34c
mov eax, dword [0x4e606c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x314], 0
mov eax, 0x4e6d30
cmp dword [0x4e6d44], 8
push str.MBRW_B
cmovae eax, dword [0x4e6d30]
push eax
call fcn.0048ca67
add esp, 8
test eax, eax
jne 0x4315a4
xor al, al
jmp 0x43275d
push 0x4ebb24
push 0x41a160
push 0x4ebb2c
call fcn.0046ade3
add esp, 0xc
test eax, eax
je 0x432779
lea eax, [ebp - 0x318]
mov dword [ebp - 0x318], 0
push eax
push 0
push 0
push 0x4b956c
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
xor ecx, ecx
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x7c], 7
mov word [ebp - 0x90], cx
mov dword [ebp - 4], ecx
test eax, eax
js 0x43162c
mov edx, dword [ebp - 0x318]
test edx, edx
je 0x43163d
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x431610
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x90]
call fcn.00407920
mov eax, dword [ebp - 0x318]
test eax, eax
je 0x43163d
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
xor eax, eax
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0xac], 7
mov word [ebp - 0xc0], ax
lea ecx, [ebp - 0x338]
mov byte [ebp - 4], 1
call fcn.0045ebe0
mov byte [ebp - 4], 2
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x431678
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4ea4d8
call fcn.00410550
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f730
mov edx, 0x4c9104
mov ecx, eax
call fcn.0040f730
push 0xd16
mov ecx, eax
call fcn.0040dd30
mov edx, str.:_Checking_BG_for_Chrome:
mov ecx, eax
call fcn.0040f730
push eax
call fcn.0040faa0
mov byte [ebp - 4], 1
add esp, 4
mov edx, dword [ebp - 0x324]
cmp edx, 8
jb 0x431705
mov ecx, dword [ebp - 0x338]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4316fb
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43277e
push edx
push ecx
call fcn.0046e8d1
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 3
lea ecx, [eax + 1]
call fcn.004327e0
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test al, al
je 0x431b56
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x28]
lea ecx, [ebp - 0xc0]
push eax
call fcn.00407920
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x431794
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x43178a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x432783
push edx
push ecx
call fcn.0046e8d1
add esp, 8
lea eax, [ebp - 0x314]
mov dword [ebp - 0x314], 0
push eax
push 0x20119
push 0
push str.SOFTWAREGoogleChromeExtensionsihcjicgdanjaechkgeegckofjjedodee
push 0x80000002
call edi
test eax, eax
je 0x4317de
lea eax, [ebp - 0x314]
push eax
push 0x20219
push 0
push str.SOFTWAREGoogleChromeExtensionsihcjicgdanjaechkgeegckofjjedodee
push 0x80000002
call edi
test eax, eax
jne 0x431890
push dword [ebp - 0x314]
call esi
lea ecx, [ebp - 0x338]
call fcn.0045ebe0
mov byte [ebp - 4], 8
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x431800
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4ea4d8
call fcn.00410550
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f730
mov edx, 0x4c9104
mov ecx, eax
call fcn.0040f730
push 0xd2b
mov ecx, eax
call fcn.0040dd30
mov edx, str.:_BrowserGuard_extension_key_for_chrome_already_exists.
mov ecx, eax
call fcn.0040f730
push eax
call fcn.0040faa0
mov byte [ebp - 4], 1
add esp, 4
mov edx, dword [ebp - 0x324]
cmp edx, 8
jb 0x431b94
mov ecx, dword [ebp - 0x338]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x431b8a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x432788
jmp 0x431b8a
push str.GoogleChromeUser_DataDefaultExtensionsihcjicgdanjaechkgeegckofjjedodee
lea edx, [ebp - 0x90]
lea ecx, [ebp - 0x28]
call fcn.0043b8a0
add esp, 4
lea ecx, [ebp - 0x338]
mov byte [ebp - 4], 4
call fcn.0045ebe0
mov byte [ebp - 4], 5
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x4318c4
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4ea4d8
call fcn.00410550
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f730
mov edx, 0x4c9104
mov ecx, eax
call fcn.0040f730
push 0xd1d
mov ecx, eax
call fcn.0040dd30
mov edx, str.:_Chrome_Ext_Folder:
mov ecx, eax
call fcn.0040f730
cmp dword [ebp - 0x14], 8
lea edx, [ebp - 0x28]
push dword [ebp - 0x18]
cmovae edx, dword [ebp - 0x28]
mov ecx, eax
call fcn.00410550
add esp, 4
push eax
call fcn.0040faa0
mov byte [ebp - 4], 4
add esp, 4
mov edx, dword [ebp - 0x324]
cmp edx, 8
jb 0x431969
mov ecx, dword [ebp - 0x338]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x43195f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43278d
push edx
push ecx
call fcn.0046e8d1
add esp, 8
mov byte [ebp - 0x314], 0
lea edx, [ebp - 0x28]
push dword [ebp - 0x314]
lea ecx, [ebp - 0x40]
call fcn.00418ec0
add esp, 4
lea edx, [ebp - 0x60]
lea ecx, [ebp - 0x40]
call fcn.0043e6b0
mov edx, dword [ebp - 0x2c]
test al, al
sete bl
cmp edx, 8
jb 0x4319ce
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4319c4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x432792
push edx
push ecx
call fcn.0046e8d1
add esp, 8
lea ecx, [ebp - 0x338]
call fcn.0045ebe0
test bl, bl
je 0x431aba
mov byte [ebp - 4], 6
cmp dword [eax + 0x14], 8
mov esi, dword [eax + 0x10]
jb 0x4319f0
mov eax, dword [eax]
push esi
mov edx, eax
mov ecx, 0x4ea4d8
call fcn.00410550
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f730
mov edx, 0x4c9104
mov ecx, eax
call fcn.0040f730
push 0xd21
mov ecx, eax
call fcn.0040dd30
mov edx, str.:_Chrome_Ext_Folder_not_found___prompt_to_install_BG
mov ecx, eax
call fcn.0040f730
push eax
call fcn.0040faa0
mov edx, dword [ebp - 0x324]
add esp, 4
cmp edx, 8
jb 0x431a79
mov ecx, dword [ebp - 0x338]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x431a6f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x432797
push edx
push ecx
call fcn.0046e8d1
add esp, 8
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x431ab3
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x431aa9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43279c
push edx
push ecx
call fcn.0046e8d1
add esp, 8
mov bl, 1
jmp 0x432745
mov byte [ebp - 4], 7
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x431ac9
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4ea4d8
call fcn.00410550
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f730
mov edx, 0x4c9104
mov ecx, eax
call fcn.0040f730
push 0xd26
mov ecx, eax
call fcn.0040dd30
mov edx, str.:_Found_Chrome_Ext_Folder
mov ecx, eax
call fcn.0040f730
push eax
call fcn.0040faa0
mov byte [ebp - 4], 4
add esp, 4
mov edx, dword [ebp - 0x324]
cmp edx, 8
jb 0x431b56
mov ecx, dword [ebp - 0x338]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x431b4c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4327a1
push edx
push ecx
call fcn.0046e8d1
add esp, 8
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x431b94
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x431b8a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4327a6
push edx
push ecx
call fcn.0046e8d1
add esp, 8
xor eax, eax
mov dword [ebp - 0x98], 0
mov dword [ebp - 0x94], 7
mov word [ebp - 0xa8], ax
lea ecx, [ebp - 0x338]
mov byte [ebp - 4], 9
call fcn.0045ebe0
mov byte [ebp - 4], 0xa
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x431bcf
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4ea4d8
call fcn.00410550
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f730
mov edx, 0x4c9104
mov ecx, eax
call fcn.0040f730
push 0xd31
mov ecx, eax
call fcn.0040dd30
mov edx, str.:_Checking_BG_for_Edge:
mov ecx, eax
call fcn.0040f730
push eax
call fcn.0040faa0
mov byte [ebp - 4], 9
add esp, 4
mov edx, dword [ebp - 0x324]
cmp edx, 8
jb 0x431c5c
mov ecx, dword [ebp - 0x338]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x431c52
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4327ab
push edx
push ecx
call fcn.0046e8d1
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 0xb
xor ecx, ecx
call fcn.004327e0
test al, al
je 0x432262
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x28]
lea ecx, [ebp - 0xa8]
push eax
call fcn.00407920
mov byte [ebp - 4], 9
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x431cde
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x431cd4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4327b0
push edx
push ecx
call fcn.0046e8d1
add esp, 8
lea eax, [ebp - 0x314]
mov dword [ebp - 0x314], 0
push eax
push 0x20119
push 0
push str.SOFTWAREMicrosoftEdgeExtensionsihcjicgdanjaechkgeegckofjjedodee
push 0x80000002
call edi
test eax, eax
je 0x431d64
lea eax, [ebp - 0x314]
push eax
push 0x20219
push 0
push str.SOFTWAREMicrosoftEdgeExtensionsihcjicgdanjaechkgeegckofjjedodee
push 0x80000002
call edi
test eax, eax
je 0x431d64
lea eax, [ebp - 0x314]
push eax
push 0x20119
push 0
push str.SOFTWAREMicrosoftEdgeExtensions_bojobppfploabceghnmlahpoonbcbacn
push 0x80000002
call edi
test eax, eax
je 0x431d64
lea eax, [ebp - 0x314]
push eax
push 0x20219
push 0
push str.SOFTWAREMicrosoftEdgeExtensions_bojobppfploabceghnmlahpoonbcbacn
push 0x80000002
call edi
test eax, eax
jne 0x431de3
push dword [ebp - 0x314]
call esi
lea ecx, [ebp - 0x338]
call fcn.0045ebe0
mov byte [ebp - 4], 0x13
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x431d86
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4ea4d8
call fcn.00410550
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f730
mov edx, 0x4c9104
mov ecx, eax
call fcn.0040f730
push 0xd4a
mov ecx, eax
call fcn.0040dd30
mov edx, str.:_BrowserGuard_extension_key_for_Edge_already_exists.
mov ecx, eax
call fcn.0040f730
push eax
call fcn.0040faa0
add esp, 4
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x338]
call fcn.00404cc0
jmp 0x4322a0
push str.MicrosoftEdgeUser_DataDefaultExtensionsihcjicgdanjaechkgeegckofjjedodee
lea edx, [ebp - 0x90]
lea ecx, [ebp - 0x58]
call fcn.0043b8a0
add esp, 4
push str.MicrosoftEdgeUser_DataDefaultExtensions_bojobppfploabceghnmlahpoonbcbacn
lea edx, [ebp - 0x90]
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x28]
call fcn.0043b8a0
add esp, 4
lea ecx, [ebp - 0x338]
mov byte [ebp - 4], 0xd
call fcn.0045ebe0
mov byte [ebp - 4], 0xe
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x431e31
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4ea4d8
call fcn.00410550
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f730
mov edx, 0x4c9104
mov ecx, eax
call fcn.0040f730
push 0xd3b
mov ecx, eax
call fcn.0040dd30
mov edx, str.:_Edge_Ext_Folder:
mov ecx, eax
call fcn.0040f730
cmp dword [ebp - 0x44], 8
lea edx, [ebp - 0x58]
push dword [ebp - 0x48]
cmovae edx, dword [ebp - 0x58]
mov ecx, eax
call fcn.00410550
add esp, 4
push eax
call fcn.0040faa0
mov byte [ebp - 4], 0xd
add esp, 4
mov edx, dword [ebp - 0x324]
cmp edx, 8
jb 0x431ed6
mov ecx, dword [ebp - 0x338]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x431ecc
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4327b5
push edx
push ecx
call fcn.0046e8d1
add esp, 8
lea ecx, [ebp - 0x338]
call fcn.0045ebe0
mov byte [ebp - 4], 0xf
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x431ef0
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4ea4d8
call fcn.00410550
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f730
mov edx, 0x4c9104
mov ecx, eax
call fcn.0040f730
push 0xd3c
mov ecx, eax
call fcn.0040dd30
mov edx, str.:_Edge_Ext_Folder__2_:
mov ecx, eax
call fcn.0040f730
cmp dword [ebp - 0x14], 8
lea edx, [ebp - 0x28]
push dword [ebp - 0x18]
cmovae edx, dword [ebp - 0x28]
mov ecx, eax
call fcn.00410550
add esp, 4
push eax
call fcn.0040faa0
mov byte [ebp - 4], 0xd
add esp, 4
mov edx, dword [ebp - 0x324]
cmp edx, 8
jb 0x431f95
mov ecx, dword [ebp - 0x338]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x431f8b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4327ba
push edx
push ecx
call fcn.0046e8d1
add esp, 8
mov byte [ebp - 0x314], 0
lea edx, [ebp - 0x58]
push dword [ebp - 0x314]
lea ecx, [ebp - 0x338]
call fcn.00418ec0
add esp, 4
mov byte [ebp - 4], 0x10
lea edx, [ebp - 0x60]
mov ebx, 1
lea ecx, [ebp - 0x338]
mov dword [ebp - 0x314], ebx
call fcn.0043e6b0
test al, al
jne 0x432009
mov byte [ebp - 0x33c], al
lea edx, [ebp - 0x28]
push dword [ebp - 0x33c]
lea ecx, [ebp - 0x40]
call fcn.00418ec0
add esp, 4
lea edx, [ebp - 0x60]
lea ecx, [ebp - 0x40]
mov ebx, 3
call fcn.0043e6b0
mov byte [ebp - 0x31d], 1
test al, al
je 0x432010
mov byte [ebp - 0x31d], 0
test bl, 2
je 0x432063
mov edx, dword [ebp - 0x2c]
cmp edx, 8
jb 0x43204f
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x432045
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4327bf
push edx
push ecx
call fcn.0046e8d1
add esp, 8
xor eax, eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
mov dword [ebp - 4], 0xd
mov edx, dword [ebp - 0x324]
cmp edx, 8
jb 0x4320aa
mov ecx, dword [ebp - 0x338]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4320a0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4327c4
push edx
push ecx
call fcn.0046e8d1
add esp, 8
lea ecx, [ebp - 0x338]
call fcn.0045ebe0
cmp byte [ebp - 0x31d], 0
je 0x4321e9
mov byte [ebp - 4], 0x11
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x4320d1
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4ea4d8
call fcn.00410550
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f730
mov edx, 0x4c9104
mov ecx, eax
call fcn.0040f730
push 0xd40
mov ecx, eax
call fcn.0040dd30
mov edx, str.:_Edge_Ext_Folder_not_found___prompt_to_install_BG
mov ecx, eax
call fcn.0040f730
push eax
call fcn.0040faa0
mov edx, dword [ebp - 0x324]
add esp, 4
cmp edx, 8
jb 0x43215a
mov ecx, dword [ebp - 0x338]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x432150
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4327c9
push edx
push ecx
call fcn.0046e8d1
add esp, 8
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x432194
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x43218a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4327ce
push edx
push ecx
call fcn.0046e8d1
add esp, 8
mov edx, dword [ebp - 0x44]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp edx, 8
jb 0x4321e2
mov ecx, dword [ebp - 0x58]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4321d8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4327d3
push edx
push ecx
call fcn.0046e8d1
add esp, 8
mov bl, 1
jmp 0x43273a
mov byte [ebp - 4], 0x12
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x4321f8
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4ea4d8
call fcn.00410550
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f730
mov edx, 0x4c9104
mov ecx, eax
call fcn.0040f730
push 0xd45
mov ecx, eax
call fcn.0040dd30
mov edx, str.:_Found_Edge_Ext_Folder
mov ecx, eax
call fcn.0040f730
push eax
call fcn.0040faa0
add esp, 4
lea ecx, [ebp - 0x338]
call fcn.00404cc0
lea ecx, [ebp - 0x28]
call fcn.00404cc0
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 9
call fcn.00404cc0
jmp 0x4322a0
mov byte [ebp - 4], 9
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x4322a0
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x432296
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4327d8
push edx
push ecx
call fcn.0046e8d1
add esp, 8
lea ecx, [ebp - 0x338]
call fcn.0045ebe0
mov byte [ebp - 4], 0x14
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x4322ba
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4ea4d8
call fcn.00410550
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f730
mov edx, 0x4c9104
mov ecx, eax
call fcn.0040f730
push 0xd50
mov ecx, eax
call fcn.0040dd30
mov edx, str.:_Checking_BG_for_Firefox:
mov ecx, eax
call fcn.0040f730
push eax
call fcn.0040faa0
add esp, 4
lea ecx, [ebp - 0x338]
call fcn.00404cc0
lea eax, [ebp - 0x31c]
mov dword [ebp - 0x31c], 0
push eax
push 0
push 0
push 0x4b954c
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
xor ecx, ecx
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x64], 7
mov word [ebp - 0x78], cx
mov byte [ebp - 4], 0x15
test eax, eax
js 0x432388
mov edx, dword [ebp - 0x31c]
test edx, edx
je 0x432399
mov ecx, edx
lea esi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x432360
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x78]
call fcn.00407920
push 0x10
push str.MozillaFirefox
lea ecx, [ebp - 0x78]
call fcn.0040c260
mov eax, dword [ebp - 0x31c]
test eax, eax
je 0x432399
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
xor eax, eax
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 7
mov word [ebp - 0x58], ax
mov byte [ebp - 4], 0x16
cmp dword [ebp - 0x68], eax
je 0x432728
lea ecx, [ebp - 0x58]
call fcn.00433230
test al, al
je 0x432728
push str.Profiles
lea edx, [ebp - 0x78]
lea ecx, [ebp - 0x40]
call fcn.0043b8a0
add esp, 4
push 0x250
lea eax, [ebp - 0x310]
mov byte [ebp - 4], 0x17
push 0
push eax
xor bh, bh
call fcn.00486a10
add esp, 0xc
lea ecx, [ebp - 0x310]
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x432638
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileW]
test byte [ebp - 0x310], 0x10
je 0x432616
mov ecx, 0x4ceb24
lea eax, [ebp - 0x2e4]
nop dword [eax + eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x432466
test dx, dx
je 0x432462
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x432466
add eax, 4
add ecx, 4
test dx, dx
jne 0x432440
xor eax, eax
jmp 0x43246b
sbb eax, eax
or eax, 1
test eax, eax
je 0x432616
mov ecx, 0x4ceb28
lea eax, [ebp - 0x2e4]
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4324a6
test dx, dx
je 0x4324a2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4324a6
add eax, 4
add ecx, 4
test dx, dx
jne 0x432480
xor eax, eax
jmp 0x4324ab
sbb eax, eax
or eax, 1
test eax, eax
je 0x432616
push str.Profiles_
lea edx, [ebp - 0x78]
lea ecx, [ebp - 0x354]
call fcn.0043b8a0
add esp, 4
lea ecx, [ebp - 0x2e4]
mov byte [ebp - 4], 0x18
push ecx
mov edx, eax
lea ecx, [ebp - 0x28]
call fcn.0043b970
add esp, 4
lea ecx, [ebp - 0x354]
mov byte [ebp - 4], 0x1a
call fcn.00404cc0
push 0xc
push str.extensions_
lea ecx, [ebp - 0x28]
call fcn.0040c260
push 0x2a
push 0x4cdf20
lea ecx, [ebp - 0x28]
call fcn.0040c260
mov byte [ebp - 0x33c], 0
lea edx, [ebp - 0x28]
push dword [ebp - 0x33c]
lea ecx, [ebp - 0x338]
call fcn.00418ec0
add esp, 4
lea edx, [ebp - 0x60]
lea ecx, [ebp - 0x338]
call fcn.0043e6b0
mov edx, dword [ebp - 0x324]
mov bl, al
cmp edx, 8
jb 0x43257c
mov ecx, dword [ebp - 0x338]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x432572
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43277e
push edx
push ecx
call fcn.0046e8d1
add esp, 8
test bl, bl
jne 0x43262a
lea ecx, [ebp - 0x338]
call fcn.0045ebe0
mov byte [ebp - 4], 0x1b
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x43259e
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4ea4d8
call fcn.00410550
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f730
mov edx, 0x4c9104
mov ecx, eax
call fcn.0040f730
push 0xd78
mov ecx, eax
call fcn.0040dd30
mov edx, str.:_profilePath:
mov ecx, eax
call fcn.0040f730
cmp dword [ebp - 0x14], 8
lea edx, [ebp - 0x28]
push dword [ebp - 0x18]
cmovae edx, dword [ebp - 0x28]
mov ecx, eax
call fcn.00410550
add esp, 4
push eax
call fcn.0040faa0
add esp, 4
lea ecx, [ebp - 0x338]
call fcn.00404cc0
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x17
call fcn.00404cc0
lea eax, [ebp - 0x310]
push eax
push esi
call edi
test eax, eax
jne 0x432423
jmp 0x432638
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x17
mov bh, 1
call fcn.00404cc0
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x354]
call fcn.0045ebe0
test bh, bh
jne 0x4326bd
mov byte [ebp - 4], 0x1c
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x43265d
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4ea4d8
call fcn.00410550
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f730
mov edx, 0x4c9104
mov ecx, eax
call fcn.0040f730
push 0xd80
mov ecx, eax
call fcn.0040dd30
mov edx, str.:_Firefox_Ext_not_found___prompt_to_install_BG
mov ecx, eax
call fcn.0040f730
push eax
call fcn.0040faa0
add esp, 4
lea ecx, [ebp - 0x354]
call fcn.00404cc0
lea ecx, [ebp - 0x40]
call fcn.00404cc0
mov bl, 1
jmp 0x43272a
mov byte [ebp - 4], 0x1d
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x4326cc
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4ea4d8
call fcn.00410550
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f730
mov edx, 0x4c9104
mov ecx, eax
call fcn.0040f730
push 0xd85
mov ecx, eax
call fcn.0040dd30
mov edx, str.:_BrowserGuard_ext_for_Firefox_already_exists.
mov ecx, eax
call fcn.0040f730
push eax
call fcn.0040faa0
add esp, 4
lea ecx, [ebp - 0x354]
call fcn.00404cc0
lea ecx, [ebp - 0x40]
call fcn.00404cc0
xor bl, bl
lea ecx, [ebp - 0x58]
call fcn.00404cc0
lea ecx, [ebp - 0x78]
call fcn.00404cc0
lea ecx, [ebp - 0xa8]
call fcn.00404cc0
lea ecx, [ebp - 0xc0]
call fcn.00404cc0
lea ecx, [ebp - 0x90]
call fcn.00404cc0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046e3b0
mov esp, ebp
pop ebp
ret
call fcn.0048d190
call fcn.0048981c
call fcn.0048981c
call fcn.0048981c
call fcn.0048981c
call fcn.0048981c
call fcn.0048981c
call fcn.0048981c
call fcn.0048981c
call fcn.0048981c
call fcn.0048981c
call fcn.0048981c
call fcn.0048981c
call fcn.0048981c
call fcn.0048981c
call fcn.0048981c
call fcn.0048981c
call fcn.0048981c
call fcn.0048981c
call fcn.0048981c
int3