Function at 0x436c50
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bdff0
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x360
mov eax, dword [0x50b080]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 0x314], eax
cmp dword [0x50bdd4], 7
mov dword [ebp - 0x324], eax
mov eax, 0x50bdc0
cmova eax, dword [0x50bdc0]
push str.MBRW_B
push eax
call fcn.0049a53c
add esp, 8
test eax, eax
jne 0x436ccb
xor al, al
jmp 0x4384bd
lea eax, [ebp - 0x31c]
mov dword [ebp - 0x31c], 0
push eax
push 0
push 0
push 0x4c55ec
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
xorps xmm0, xmm0
mov dword [ebp - 0x48], 7
xor esi, esi
xor ecx, ecx
movups xmmword [ebp - 0x5c], xmm0
mov dword [ebp - 0x4c], esi
mov word [ebp - 0x5c], cx
mov dword [ebp - 4], ecx
test eax, eax
js 0x436d3c
mov edx, dword [ebp - 0x31c]
test edx, edx
je 0x436d4d
mov ecx, edx
lea esi, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x436d20
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x5c]
call fcn.0040db20
mov esi, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x31c]
test eax, eax
je 0x436d4d
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
xorps xmm0, xmm0
mov dword [ebp - 0xac], 0
xor eax, eax
mov dword [ebp - 0xa8], 7
movups xmmword [ebp - 0xbc], xmm0
mov word [ebp - 0xbc], ax
lea ecx, [ebp - 0x33c]
mov byte [ebp - 4], 1
call fcn.00467d30
mov byte [ebp - 4], 2
cmp dword [eax + 0x14], 7
mov ecx, dword [eax + 0x10]
jbe 0x436d92
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x50e6d0
call fcn.00412550
add esp, 4
mov edx, str.C:JenkinsworkspaceMBAM_WindowsA_MB5_MBSetup_srcMBSetupMBSetup.cpp
mov ecx, eax
call fcn.00411050
mov edx, 0x4eb568
mov ecx, eax
call fcn.00411050
push 0xd3e
mov ecx, eax
call fcn.0040f7e0
mov edx, str.:_Checking_BG_for_Chrome:
mov ecx, eax
call fcn.00411050
push eax
call fcn.004113d0
mov byte [ebp - 4], 1
add esp, 4
mov ecx, dword [ebp - 0x328]
cmp ecx, 7
jbe 0x436e1f
mov edx, dword [ebp - 0x33c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x436e15
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4384db
push ecx
push edx
call fcn.004906cd
add esp, 8
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
xor eax, eax
mov dword [ebp - 0x18], 7
movups xmmword [ebp - 0x2c], xmm0
mov word [ebp - 0x2c], ax
lea edx, [ebp - 0x2c]
mov byte [ebp - 4], 3
lea ecx, [eax + 1]
call fcn.00438550
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test al, al
je 0x437326
cmp dword [ebp - 0x18], 7
lea eax, [ebp - 0x2c]
push dword [ebp - 0x1c]
cmova eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0xbc]
push eax
call fcn.0040db20
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x18]
cmp ecx, 7
jbe 0x436eaf
mov edx, dword [ebp - 0x2c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x436ea5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x438549
push ecx
push edx
call fcn.004906cd
add esp, 8
lea eax, [ebp - 0x314]
mov dword [ebp - 0x314], 0
push eax
push 0x20119
push 0
push str.SOFTWAREGoogleChromeExtensionsihcjicgdanjaechkgeegckofjjedodee
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x436f01
lea eax, [ebp - 0x314]
push eax
push 0x20219
push 0
push str.SOFTWAREGoogleChromeExtensionsihcjicgdanjaechkgeegckofjjedodee
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x436fb3
push dword [ebp - 0x314]
call edi
lea ecx, [ebp - 0x33c]
call fcn.00467d30
mov byte [ebp - 4], 8
cmp dword [eax + 0x14], 7
mov ecx, dword [eax + 0x10]
jbe 0x436f23
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x50e6d0
call fcn.00412550
add esp, 4
mov edx, str.C:JenkinsworkspaceMBAM_WindowsA_MB5_MBSetup_srcMBSetupMBSetup.cpp
mov ecx, eax
call fcn.00411050
mov edx, 0x4eb568
mov ecx, eax
call fcn.00411050
push 0xd53
mov ecx, eax
call fcn.0040f7e0
mov edx, str.:_BrowserGuard_extension_key_for_chrome_already_exists.
mov ecx, eax
call fcn.00411050
push eax
call fcn.004113d0
mov byte [ebp - 4], 1
add esp, 4
mov ecx, dword [ebp - 0x328]
cmp ecx, 7
jbe 0x437364
mov edx, dword [ebp - 0x33c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x43735a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4384e0
jmp 0x43735a
mov eax, 0x7ffffffe
sub eax, esi
cmp eax, 0x4c
jb 0x4384e5
cmp dword [ebp - 0x48], 7
lea eax, [ebp - 0x5c]
push 0x4c
cmova eax, dword [ebp - 0x5c]
push str.GoogleChromeUser_DataDefaultExtensionsihcjicgdanjaechkgeegckofjjedodee
push esi
push eax
push ecx
push dword [ebp - 0x318]
lea ecx, [ebp - 0x2c]
call fcn.00442700
mov eax, 4
mov dword [ebp - 0x324], eax
lea ecx, [ebp - 0x33c]
mov byte [ebp - 4], al
call fcn.00467d30
mov byte [ebp - 4], 5
cmp dword [eax + 0x14], 7
mov ecx, dword [eax + 0x10]
jbe 0x43700e
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x50e6d0
call fcn.00412550
add esp, 4
mov edx, str.C:JenkinsworkspaceMBAM_WindowsA_MB5_MBSetup_srcMBSetupMBSetup.cpp
mov ecx, eax
call fcn.00411050
mov edx, 0x4eb568
mov ecx, eax
call fcn.00411050
push 0xd45
mov ecx, eax
call fcn.0040f7e0
mov edx, str.:_Chrome_Ext_Folder:
mov ecx, eax
call fcn.00411050
cmp dword [ebp - 0x18], 7
lea edx, [ebp - 0x2c]
push dword [ebp - 0x1c]
cmova edx, dword [ebp - 0x2c]
mov ecx, eax
call fcn.00412550
add esp, 4
push eax
call fcn.004113d0
mov byte [ebp - 4], 4
add esp, 4
mov ecx, dword [ebp - 0x328]
cmp ecx, 7
jbe 0x4370b3
mov edx, dword [ebp - 0x33c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4370a9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4384ea
push ecx
push edx
call fcn.004906cd
add esp, 8
mov byte [ebp - 0x314], 0
lea edx, [ebp - 0x2c]
push dword [ebp - 0x314]
lea ecx, [ebp - 0x360]
call fcn.0041bdd0
add esp, 4
lea eax, [ebp - 0x370]
lea ecx, [ebp - 0x360]
push eax
call fcn.0041cbb0
add esp, 4
movq xmm0, qword [eax]
movq qword [ebp - 0x348], xmm0
mov eax, dword [ebp - 0x348]
test eax, eax
je 0x437108
cmp eax, 1
sete byte [ebp - 0x31d]
jmp 0x43710f
mov byte [ebp - 0x31d], 1
mov ecx, dword [ebp - 0x34c]
cmp ecx, 7
jbe 0x43714f
mov edx, dword [ebp - 0x360]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x437145
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4384ef
push ecx
push edx
call fcn.004906cd
add esp, 8
lea ecx, [ebp - 0x33c]
call fcn.00467d30
cmp byte [ebp - 0x31d], 0
je 0x437245
mov byte [ebp - 4], 6
cmp dword [eax + 0x14], 7
mov esi, dword [eax + 0x10]
jbe 0x437176
mov eax, dword [eax]
push esi
mov edx, eax
mov ecx, 0x50e6d0
call fcn.00412550
add esp, 4
mov edx, str.C:JenkinsworkspaceMBAM_WindowsA_MB5_MBSetup_srcMBSetupMBSetup.cpp
mov ecx, eax
call fcn.00411050
mov edx, 0x4eb568
mov ecx, eax
call fcn.00411050
push 0xd49
mov ecx, eax
call fcn.0040f7e0
mov edx, str.:_Chrome_Ext_Folder_not_found___prompt_to_install_BG
mov ecx, eax
call fcn.00411050
push eax
call fcn.004113d0
mov ecx, dword [ebp - 0x328]
add esp, 4
cmp ecx, 7
jbe 0x4371ff
mov edx, dword [ebp - 0x33c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4371f5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4384f4
push ecx
push edx
call fcn.004906cd
add esp, 8
mov ecx, dword [ebp - 0x18]
cmp ecx, 7
jbe 0x437239
mov edx, dword [ebp - 0x2c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x43722f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4384fe
push ecx
push edx
call fcn.004906cd
add esp, 8
mov byte [ebp - 0x31d], 1
jmp 0x43843d
mov byte [ebp - 4], 7
cmp dword [eax + 0x14], 7
mov ecx, dword [eax + 0x10]
jbe 0x437254
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x50e6d0
call fcn.00412550
add esp, 4
mov edx, str.C:JenkinsworkspaceMBAM_WindowsA_MB5_MBSetup_srcMBSetupMBSetup.cpp
mov ecx, eax
call fcn.00411050
mov edx, 0x4eb568
mov ecx, eax
call fcn.00411050
push 0xd4e
mov ecx, eax
call fcn.0040f7e0
mov edx, str.:_Found_Chrome_Ext_Folder
mov ecx, eax
call fcn.00411050
push eax
call fcn.004113d0
mov byte [ebp - 4], 4
add esp, 4
mov ecx, dword [ebp - 0x328]
cmp ecx, 7
jbe 0x4372e1
mov edx, dword [ebp - 0x33c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4372d7
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4384f9
push ecx
push edx
call fcn.004906cd
add esp, 8
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x18]
cmp ecx, 7
jbe 0x437321
mov edx, dword [ebp - 0x2c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x437315
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4384fe
push ecx
push edx
call fcn.004906cd
mov esi, dword [ebp - 0x4c]
jmp 0x437361
mov esi, dword [ebp - 0x4c]
jmp 0x437364
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x18]
cmp ecx, 7
jbe 0x437364
mov edx, dword [ebp - 0x2c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x43735a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x438549
push ecx
push edx
call fcn.004906cd
add esp, 8
xorps xmm0, xmm0
mov dword [ebp - 0x94], 0
xor eax, eax
mov dword [ebp - 0x90], 7
movups xmmword [ebp - 0xa4], xmm0
mov word [ebp - 0xa4], ax
lea ecx, [ebp - 0x33c]
mov byte [ebp - 4], 9
call fcn.00467d30
mov byte [ebp - 4], 0xa
cmp dword [eax + 0x14], 7
mov ecx, dword [eax + 0x10]
jbe 0x4373a9
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x50e6d0
call fcn.00412550
add esp, 4
mov edx, str.C:JenkinsworkspaceMBAM_WindowsA_MB5_MBSetup_srcMBSetupMBSetup.cpp
mov ecx, eax
call fcn.00411050
mov edx, 0x4eb568
mov ecx, eax
call fcn.00411050
push 0xd59
mov ecx, eax
call fcn.0040f7e0
mov edx, str.:_Checking_BG_for_Edge:
mov ecx, eax
call fcn.00411050
push eax
call fcn.004113d0
mov byte [ebp - 4], 9
add esp, 4
mov ecx, dword [ebp - 0x328]
cmp ecx, 7
jbe 0x437436
mov edx, dword [ebp - 0x33c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x43742c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x438503
push ecx
push edx
call fcn.004906cd
add esp, 8
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
xor eax, eax
mov dword [ebp - 0x18], 7
movups xmmword [ebp - 0x2c], xmm0
mov word [ebp - 0x2c], ax
lea edx, [ebp - 0x2c]
mov byte [ebp - 4], 0xb
xor ecx, ecx
call fcn.00438550
test al, al
je 0x437bfc
cmp dword [ebp - 0x18], 7
lea eax, [ebp - 0x2c]
push dword [ebp - 0x1c]
cmova eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0xa4]
push eax
call fcn.0040db20
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x18]
cmp ecx, 7
jbe 0x4374bf
mov edx, dword [ebp - 0x2c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4374b5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x438549
push ecx
push edx
call fcn.004906cd
add esp, 8
lea eax, [ebp - 0x314]
mov dword [ebp - 0x314], 0
push eax
push 0x20119
push 0
push str.SOFTWAREMicrosoftEdgeExtensionsihcjicgdanjaechkgeegckofjjedodee
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x437555
lea eax, [ebp - 0x314]
push eax
push 0x20219
push 0
push str.SOFTWAREMicrosoftEdgeExtensionsihcjicgdanjaechkgeegckofjjedodee
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x437555
lea eax, [ebp - 0x314]
push eax
push 0x20119
push 0
push str.SOFTWAREMicrosoftEdgeExtensions_bojobppfploabceghnmlahpoonbcbacn
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x437555
lea eax, [ebp - 0x314]
push eax
push 0x20219
push 0
push str.SOFTWAREMicrosoftEdgeExtensions_bojobppfploabceghnmlahpoonbcbacn
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x437607
push dword [ebp - 0x314]
call edi
lea ecx, [ebp - 0x33c]
call fcn.00467d30
mov byte [ebp - 4], 0x13
cmp dword [eax + 0x14], 7
mov ecx, dword [eax + 0x10]
jbe 0x437577
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x50e6d0
call fcn.00412550
add esp, 4
mov edx, str.C:JenkinsworkspaceMBAM_WindowsA_MB5_MBSetup_srcMBSetupMBSetup.cpp
mov ecx, eax
call fcn.00411050
mov edx, 0x4eb568
mov ecx, eax
call fcn.00411050
push 0xd72
mov ecx, eax
call fcn.0040f7e0
mov edx, str.:_BrowserGuard_extension_key_for_Edge_already_exists.
mov ecx, eax
call fcn.00411050
push eax
call fcn.004113d0
mov byte [ebp - 4], 9
add esp, 4
mov ecx, dword [ebp - 0x328]
cmp ecx, 7
jbe 0x437c3a
mov edx, dword [ebp - 0x33c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x437c30
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x438508
jmp 0x437c30
mov eax, 0x7ffffffe
sub eax, esi
cmp eax, 0x4d
jb 0x4384e5
cmp dword [ebp - 0x48], 7
lea eax, [ebp - 0x5c]
push 0x4d
cmova eax, dword [ebp - 0x5c]
push str.MicrosoftEdgeUser_DataDefaultExtensionsihcjicgdanjaechkgeegckofjjedodee
push esi
push eax
push ecx
push dword [ebp - 0x318]
lea ecx, [ebp - 0x74]
call fcn.00442700
mov esi, dword [ebp - 0x324]
or esi, 0x20
mov byte [ebp - 4], 0xc
mov eax, 0x7ffffffe
mov ecx, dword [ebp - 0x4c]
sub eax, ecx
cmp eax, 0x4d
jb 0x4384e5
cmp dword [ebp - 0x48], 7
lea eax, [ebp - 0x5c]
push 0x4d
cmova eax, dword [ebp - 0x5c]
push str.MicrosoftEdgeUser_DataDefaultExtensions_bojobppfploabceghnmlahpoonbcbacn
push ecx
push eax
push ecx
push dword [ebp - 0x318]
lea ecx, [ebp - 0x2c]
call fcn.00442700
or esi, 0x40
lea ecx, [ebp - 0x33c]
mov byte [ebp - 4], 0xd
call fcn.00467d30
mov byte [ebp - 4], 0xe
cmp dword [eax + 0x14], 7
mov ecx, dword [eax + 0x10]
jbe 0x43769e
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x50e6d0
call fcn.00412550
add esp, 4
mov edx, str.C:JenkinsworkspaceMBAM_WindowsA_MB5_MBSetup_srcMBSetupMBSetup.cpp
mov ecx, eax
call fcn.00411050
mov edx, 0x4eb568
mov ecx, eax
call fcn.00411050
push 0xd63
mov ecx, eax
call fcn.0040f7e0
mov edx, str.:_Edge_Ext_Folder:
mov ecx, eax
call fcn.00411050
cmp dword [ebp - 0x60], 7
lea edx, [ebp - 0x74]
push dword [ebp - 0x64]
cmova edx, dword [ebp - 0x74]
mov ecx, eax
call fcn.00412550
add esp, 4
push eax
call fcn.004113d0
mov byte [ebp - 4], 0xd
add esp, 4
mov ecx, dword [ebp - 0x328]
cmp ecx, 7
jbe 0x437743
mov edx, dword [ebp - 0x33c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x437739
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43850d
push ecx
push edx
call fcn.004906cd
add esp, 8
lea ecx, [ebp - 0x33c]
call fcn.00467d30
mov byte [ebp - 4], 0xf
cmp dword [eax + 0x14], 7
mov ecx, dword [eax + 0x10]
jbe 0x43775d
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x50e6d0
call fcn.00412550
add esp, 4
mov edx, str.C:JenkinsworkspaceMBAM_WindowsA_MB5_MBSetup_srcMBSetupMBSetup.cpp
mov ecx, eax
call fcn.00411050
mov edx, 0x4eb568
mov ecx, eax
call fcn.00411050
push 0xd64
mov ecx, eax
call fcn.0040f7e0
mov edx, str.:_Edge_Ext_Folder__2_:
mov ecx, eax
call fcn.00411050
cmp dword [ebp - 0x18], 7
lea edx, [ebp - 0x2c]
push dword [ebp - 0x1c]
cmova edx, dword [ebp - 0x2c]
mov ecx, eax
call fcn.00412550
add esp, 4
push eax
call fcn.004113d0
mov byte [ebp - 4], 0xd
add esp, 4
mov ecx, dword [ebp - 0x328]
cmp ecx, 7
jbe 0x437802
mov edx, dword [ebp - 0x33c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4377f8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x438512
push ecx
push edx
call fcn.004906cd
add esp, 8
mov byte [ebp - 0x314], 0
lea edx, [ebp - 0x74]
push dword [ebp - 0x314]
lea ecx, [ebp - 0x33c]
call fcn.0041bdd0
add esp, 4
lea eax, [ebp - 0x370]
mov byte [ebp - 4], 0x10
or esi, 1
lea ecx, [ebp - 0x33c]
push eax
mov dword [ebp - 0x324], esi
mov dword [ebp - 0x314], esi
call fcn.0041cbb0
add esp, 4
movq xmm0, qword [eax]
movq qword [ebp - 0x348], xmm0
mov eax, dword [ebp - 0x348]
test eax, eax
je 0x437863
cmp eax, 1
jne 0x4378ba
mov byte [ebp - 0x324], 0
lea edx, [ebp - 0x2c]
push dword [ebp - 0x324]
lea ecx, [ebp - 0x360]
call fcn.0041bdd0
add esp, 4
lea eax, [ebp - 0x370]
or esi, 2
lea ecx, [ebp - 0x360]
mov dword [ebp - 0x324], esi
push eax
call fcn.0041cbb0
add esp, 4
movq xmm0, qword [eax]
movq qword [ebp - 0x348], xmm0
mov eax, dword [ebp - 0x348]
test eax, eax
je 0x4378c3
cmp eax, 1
je 0x4378c3
mov byte [ebp - 0x31d], 0
jmp 0x4378ca
mov byte [ebp - 0x31d], 1
mov eax, dword [ebp - 0x324]
test al, 2
je 0x437940
mov ecx, dword [ebp - 0x34c]
and eax, 0xfffffffd
mov dword [ebp - 0x324], eax
cmp ecx, 7
jbe 0x437923
mov edx, dword [ebp - 0x360]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x437913
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x438517
push ecx
push edx
call fcn.004906cd
mov eax, dword [ebp - 0x324]
add esp, 8
xor ecx, ecx
mov dword [ebp - 0x350], 0
mov dword [ebp - 0x34c], 7
mov word [ebp - 0x360], cx
mov dword [ebp - 4], 0xd
test al, 1
je 0x437994
mov ecx, dword [ebp - 0x328]
and eax, 0xfffffffe
mov dword [ebp - 0x324], eax
cmp ecx, 7
jbe 0x437994
mov edx, dword [ebp - 0x33c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x43798a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x438517
push ecx
push edx
call fcn.004906cd
add esp, 8
lea ecx, [ebp - 0x33c]
call fcn.00467d30
cmp byte [ebp - 0x31d], 0
je 0x437ad8
mov byte [ebp - 4], 0x11
cmp dword [eax + 0x14], 7
mov ecx, dword [eax + 0x10]
jbe 0x4379bb
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x50e6d0
call fcn.00412550
add esp, 4
mov edx, str.C:JenkinsworkspaceMBAM_WindowsA_MB5_MBSetup_srcMBSetupMBSetup.cpp
mov ecx, eax
call fcn.00411050
mov edx, 0x4eb568
mov ecx, eax
call fcn.00411050
push 0xd68
mov ecx, eax
call fcn.0040f7e0
mov edx, str.:_Edge_Ext_Folder_not_found___prompt_to_install_BG
mov ecx, eax
call fcn.00411050
push eax
call fcn.004113d0
mov ecx, dword [ebp - 0x328]
add esp, 4
cmp ecx, 7
jbe 0x437a44
mov edx, dword [ebp - 0x33c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x437a3a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43851c
push ecx
push edx
call fcn.004906cd
add esp, 8
mov ecx, dword [ebp - 0x18]
cmp ecx, 7
jbe 0x437a7e
mov edx, dword [ebp - 0x2c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x437a74
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x438526
push ecx
push edx
call fcn.004906cd
add esp, 8
mov ecx, dword [ebp - 0x60]
xor eax, eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
cmp ecx, 7
jbe 0x437acc
mov edx, dword [ebp - 0x74]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x437ac2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x438526
push ecx
push edx
call fcn.004906cd
add esp, 8
mov byte [ebp - 0x31d], 1
jmp 0x4383fd
mov byte [ebp - 4], 0x12
cmp dword [eax + 0x14], 7
mov ecx, dword [eax + 0x10]
jbe 0x437ae7
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x50e6d0
call fcn.00412550
add esp, 4
mov edx, str.C:JenkinsworkspaceMBAM_WindowsA_MB5_MBSetup_srcMBSetupMBSetup.cpp
mov ecx, eax
call fcn.00411050
mov edx, 0x4eb568
mov ecx, eax
call fcn.00411050
push 0xd6d
mov ecx, eax
call fcn.0040f7e0
mov edx, str.:_Found_Edge_Ext_Folder
mov ecx, eax
call fcn.00411050
push eax
call fcn.004113d0
mov byte [ebp - 4], 0xd
add esp, 4
mov ecx, dword [ebp - 0x328]
cmp ecx, 7
jbe 0x437b74
mov edx, dword [ebp - 0x33c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x437b6a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x438521
push ecx
push edx
call fcn.004906cd
add esp, 8
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x18]
cmp ecx, 7
jbe 0x437bb2
mov edx, dword [ebp - 0x2c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x437ba8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x438526
push ecx
push edx
call fcn.004906cd
add esp, 8
xor eax, eax
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x60]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
cmp ecx, 7
jbe 0x437c3a
mov edx, dword [ebp - 0x74]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x437c30
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x438526
jmp 0x437c30
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x18]
cmp ecx, 7
jbe 0x437c3a
mov edx, dword [ebp - 0x2c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x437c30
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x438549
push ecx
push edx
call fcn.004906cd
add esp, 8
lea ecx, [ebp - 0x33c]
call fcn.00467d30
mov byte [ebp - 4], 0x14
cmp dword [eax + 0x14], 7
mov ecx, dword [eax + 0x10]
jbe 0x437c54
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x50e6d0
call fcn.00412550
add esp, 4
mov edx, str.C:JenkinsworkspaceMBAM_WindowsA_MB5_MBSetup_srcMBSetupMBSetup.cpp
mov ecx, eax
call fcn.00411050
mov edx, 0x4eb568
mov ecx, eax
call fcn.00411050
push 0xd78
mov ecx, eax
call fcn.0040f7e0
mov edx, str.:_Checking_BG_for_Firefox:
mov ecx, eax
call fcn.00411050
push eax
call fcn.004113d0
mov byte [ebp - 4], 9
add esp, 4
mov ecx, dword [ebp - 0x328]
cmp ecx, 7
jbe 0x437ce1
mov edx, dword [ebp - 0x33c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x437cd7
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43852b
push ecx
push edx
call fcn.004906cd
add esp, 8
lea eax, [ebp - 0x318]
mov dword [ebp - 0x318], 0
push eax
push 0
push 0
push 0x4c55cc
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
xorps xmm0, xmm0
mov dword [ebp - 0x34], 0
xor ecx, ecx
mov dword [ebp - 0x30], 7
movups xmmword [ebp - 0x44], xmm0
mov word [ebp - 0x44], cx
mov byte [ebp - 4], 0x15
test eax, eax
js 0x437d59
mov edx, dword [ebp - 0x318]
test edx, edx
je 0x437d6a
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x437d33
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x44]
call fcn.0040db20
push str.MozillaFirefox
lea ecx, [ebp - 0x44]
call fcn.0040d6d0
mov eax, dword [ebp - 0x318]
test eax, eax
je 0x437d6a
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
xorps xmm0, xmm0
mov dword [ebp - 0x7c], 0
xor eax, eax
mov dword [ebp - 0x78], 7
movups xmmword [ebp - 0x8c], xmm0
mov word [ebp - 0x8c], ax
mov byte [ebp - 4], 0x16
cmp dword [ebp - 0x34], eax
je 0x43836b
lea ecx, [ebp - 0x8c]
call fcn.00439160
test al, al
je 0x43836b
mov ecx, dword [ebp - 0x34]
mov eax, 0x7ffffffe
sub eax, ecx
cmp eax, 0xb
jb 0x438530
cmp dword [ebp - 0x30], 7
lea eax, [ebp - 0x44]
push 0xb
cmova eax, dword [ebp - 0x44]
push str.Profiles
push ecx
push eax
push ecx
push dword [ebp - 0x318]
lea ecx, [ebp - 0x74]
call fcn.00442700
mov esi, dword [ebp - 0x324]
or esi, 0x200
push 0x250
lea eax, [ebp - 0x310]
mov byte [ebp - 4], 0x17
push 0
push eax
mov byte [ebp - 0x31e], 0
call fcn.00492970
add esp, 0xc
lea ecx, [ebp - 0x310]
cmp dword [ebp - 0x60], 7
lea eax, [ebp - 0x74]
cmova eax, dword [ebp - 0x74]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x43819c
test byte [ebp - 0x310], 0x10
je 0x43813f
mov ecx, 0x4f1024
lea eax, [ebp - 0x2e4]
nop word [eax + eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x437e76
test dx, dx
je 0x437e72
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x437e76
add eax, 4
add ecx, 4
test dx, dx
jne 0x437e50
xor eax, eax
jmp 0x437e7b
sbb eax, eax
or eax, 1
test eax, eax
je 0x43813f
mov ecx, 0x4f1028
lea eax, [ebp - 0x2e4]
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x437eb6
test dx, dx
je 0x437eb2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x437eb6
add eax, 4
add ecx, 4
test dx, dx
jne 0x437e90
xor eax, eax
jmp 0x437ebb
sbb eax, eax
or eax, 1
test eax, eax
je 0x43813f
mov ecx, dword [ebp - 0x34]
mov eax, 0x7ffffffe
sub eax, ecx
cmp eax, 0xa
jb 0x4384e5
cmp dword [ebp - 0x30], 7
lea eax, [ebp - 0x44]
push 0xa
cmova eax, dword [ebp - 0x44]
push str.Profiles_
push ecx
push eax
push ecx
push dword [ebp - 0x318]
lea ecx, [ebp - 0x360]
call fcn.00442700
or esi, 0x400
lea eax, [ebp - 0x2e4]
mov byte [ebp - 4], 0x18
push eax
lea edx, [ebp - 0x360]
lea ecx, [ebp - 0x2c]
call fcn.00441640
add esp, 4
mov byte [ebp - 4], 0x1a
mov ecx, dword [ebp - 0x34c]
cmp ecx, 7
jbe 0x437f62
mov edx, dword [ebp - 0x360]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x437f58
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4384db
push ecx
push edx
call fcn.004906cd
add esp, 8
xor eax, eax
mov dword [ebp - 0x350], 0
push str.extensions_
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x34c], 7
mov word [ebp - 0x360], ax
call fcn.0040d6d0
push 0x4f0420
lea ecx, [ebp - 0x2c]
call fcn.0040d6d0
mov byte [ebp - 0x314], 0
lea edx, [ebp - 0x2c]
push dword [ebp - 0x314]
lea ecx, [ebp - 0x33c]
call fcn.0041bdd0
add esp, 4
lea eax, [ebp - 0x370]
lea ecx, [ebp - 0x33c]
push eax
call fcn.0041cbb0
add esp, 4
movq xmm0, qword [eax]
movq qword [ebp - 0x348], xmm0
mov eax, dword [ebp - 0x348]
test eax, eax
je 0x437fee
cmp eax, 1
setne byte [ebp - 0x31d]
jmp 0x437ff5
mov byte [ebp - 0x31d], 0
mov ecx, dword [ebp - 0x328]
cmp ecx, 7
jbe 0x438035
mov edx, dword [ebp - 0x33c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x43802b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4384db
push ecx
push edx
call fcn.004906cd
add esp, 8
cmp byte [ebp - 0x31d], 0
jne 0x438157
lea ecx, [ebp - 0x33c]
call fcn.00467d30
mov byte [ebp - 4], 0x1b
cmp dword [eax + 0x14], 7
mov ecx, dword [eax + 0x10]
jbe 0x43805c
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x50e6d0
call fcn.00412550
add esp, 4
mov edx, str.C:JenkinsworkspaceMBAM_WindowsA_MB5_MBSetup_srcMBSetupMBSetup.cpp
mov ecx, eax
call fcn.00411050
mov edx, 0x4eb568
mov ecx, eax
call fcn.00411050
push 0xda0
mov ecx, eax
call fcn.0040f7e0
mov edx, str.:_profilePath:
mov ecx, eax
call fcn.00411050
cmp dword [ebp - 0x18], 7
lea edx, [ebp - 0x2c]
push dword [ebp - 0x1c]
cmova edx, dword [ebp - 0x2c]
mov ecx, eax
call fcn.00412550
add esp, 4
push eax
call fcn.004113d0
mov byte [ebp - 4], 0x1a
add esp, 4
mov ecx, dword [ebp - 0x328]
cmp ecx, 7
jbe 0x438101
mov edx, dword [ebp - 0x33c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4380f7
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4384db
push ecx
push edx
call fcn.004906cd
add esp, 8
mov byte [ebp - 4], 0x17
mov ecx, dword [ebp - 0x18]
cmp ecx, 7
jbe 0x43813f
mov edx, dword [ebp - 0x2c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x438135
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x438535
push ecx
push edx
call fcn.004906cd
add esp, 8
lea eax, [ebp - 0x310]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x437e32
jmp 0x43819c
mov byte [ebp - 4], 0x17
mov ecx, dword [ebp - 0x18]
mov byte [ebp - 0x31e], 1
cmp ecx, 7
jbe 0x43819c
mov edx, dword [ebp - 0x2c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x438192
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x438535
push ecx
push edx
call fcn.004906cd
add esp, 8
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x33c]
call fcn.00467d30
cmp byte [ebp - 0x31e], 0
jne 0x438299
mov byte [ebp - 4], 0x1c
cmp dword [eax + 0x14], 7
mov ecx, dword [eax + 0x10]
jbe 0x4381ca
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x50e6d0
call fcn.00412550
add esp, 4
mov edx, str.C:JenkinsworkspaceMBAM_WindowsA_MB5_MBSetup_srcMBSetupMBSetup.cpp
mov ecx, eax
call fcn.00411050
mov edx, 0x4eb568
mov ecx, eax
call fcn.00411050
push 0xda8
mov ecx, eax
call fcn.0040f7e0
mov edx, str.:_Firefox_Ext_not_found___prompt_to_install_BG
mov ecx, eax
call fcn.00411050
push eax
call fcn.004113d0
mov ecx, dword [ebp - 0x328]
add esp, 4
cmp ecx, 7
jbe 0x438253
mov edx, dword [ebp - 0x33c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x438249
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43853a
push ecx
push edx
call fcn.004906cd
add esp, 8
mov ecx, dword [ebp - 0x60]
cmp ecx, 7
jbe 0x43828d
mov edx, dword [ebp - 0x74]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x438283
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x438544
push ecx
push edx
call fcn.004906cd
add esp, 8
mov byte [ebp - 0x31d], 1
jmp 0x438372
mov byte [ebp - 4], 0x1d
cmp dword [eax + 0x14], 7
mov ecx, dword [eax + 0x10]
jbe 0x4382a8
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x50e6d0
call fcn.00412550
add esp, 4
mov edx, str.C:JenkinsworkspaceMBAM_WindowsA_MB5_MBSetup_srcMBSetupMBSetup.cpp
mov ecx, eax
call fcn.00411050
mov edx, 0x4eb568
mov ecx, eax
call fcn.00411050
push 0xdad
mov ecx, eax
call fcn.0040f7e0
mov edx, str.:_BrowserGuard_ext_for_Firefox_already_exists.
mov ecx, eax
call fcn.00411050
push eax
call fcn.004113d0
mov ecx, dword [ebp - 0x328]
add esp, 4
cmp ecx, 7
jbe 0x438331
mov edx, dword [ebp - 0x33c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x438327
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43853f
push ecx
push edx
call fcn.004906cd
add esp, 8
mov ecx, dword [ebp - 0x60]
cmp ecx, 7
jbe 0x43836b
mov edx, dword [ebp - 0x74]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x438361
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x438544
push ecx
push edx
call fcn.004906cd
add esp, 8
mov byte [ebp - 0x31d], 0
mov ecx, dword [ebp - 0x78]
cmp ecx, 7
jbe 0x4383af
mov edx, dword [ebp - 0x8c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4383a5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x438549
push ecx
push edx
call fcn.004906cd
add esp, 8
mov ecx, dword [ebp - 0x30]
cmp ecx, 7
jbe 0x4383e9
mov edx, dword [ebp - 0x44]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4383df
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x438549
push ecx
push edx
call fcn.004906cd
add esp, 8
xor eax, eax
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 7
mov word [ebp - 0x44], ax
mov ecx, dword [ebp - 0x90]
cmp ecx, 7
jbe 0x43843d
mov edx, dword [ebp - 0xa4]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x438433
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x438549
push ecx
push edx
call fcn.004906cd
add esp, 8
mov ecx, dword [ebp - 0xa8]
cmp ecx, 7
jbe 0x43847d
mov edx, dword [ebp - 0xbc]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x438473
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x438549
push ecx
push edx
call fcn.004906cd
add esp, 8
mov ecx, dword [ebp - 0x48]
cmp ecx, 7
jbe 0x4384b7
mov edx, dword [ebp - 0x5c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4384ad
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x438549
push ecx
push edx
call fcn.004906cd
add esp, 8
mov al, byte [ebp - 0x31d]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00490396
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.004958ff
call fcn.004958ff
call fcn.0040ddc0
call fcn.004958ff
call fcn.004958ff
call fcn.004958ff
call fcn.004958ff
call fcn.004958ff
call fcn.004958ff
call fcn.004958ff
call fcn.004958ff
call fcn.004958ff
call fcn.004958ff
call fcn.004958ff
call fcn.004958ff
call fcn.004958ff
call fcn.004958ff
call fcn.0040ddc0
call fcn.004958ff
call fcn.004958ff
call fcn.004958ff
call fcn.004958ff
call fcn.004958ff
int3