Function at 0x431580
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b21fb
mov eax, dword fs:[0]
push eax
sub esp, 0x34c
mov eax, dword [0x4e706c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x314], 0
mov eax, 0x4e7d30
cmp dword [0x4e7d44], 8
push str.MBRW_B
cmovae eax, dword [0x4e7d30]
push eax
call fcn.0048cdc7
add esp, 8
test eax, eax
jne 0x4315e4
xor al, al
jmp 0x43279d
push 0x4ecb24
push 0x41a160
push 0x4ecb2c
call fcn.0046b143
add esp, 0xc
test eax, eax
je 0x4327b9
lea eax, [ebp - 0x318]
mov dword [ebp - 0x318], 0
push eax
push 0
push 0
push 0x4b956c
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
xor ecx, ecx
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x7c], 7
mov word [ebp - 0x90], cx
mov dword [ebp - 4], ecx
test eax, eax
js 0x43166c
mov edx, dword [ebp - 0x318]
test edx, edx
je 0x43167d
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x431650
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x90]
call fcn.00407920
mov eax, dword [ebp - 0x318]
test eax, eax
je 0x43167d
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
xor eax, eax
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0xac], 7
mov word [ebp - 0xc0], ax
lea ecx, [ebp - 0x338]
mov byte [ebp - 4], 1
call fcn.0045ef40
mov byte [ebp - 4], 2
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x4316b8
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4eb4d8
call fcn.00410550
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f730
mov edx, 0x4c9104
mov ecx, eax
call fcn.0040f730
push 0xd1f
mov ecx, eax
call fcn.0040dd30
mov edx, str.:_Checking_BG_for_Chrome:
mov ecx, eax
call fcn.0040f730
push eax
call fcn.0040faa0
mov byte [ebp - 4], 1
add esp, 4
mov edx, dword [ebp - 0x324]
cmp edx, 8
jb 0x431745
mov ecx, dword [ebp - 0x338]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x43173b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4327be
push edx
push ecx
call fcn.0046ec30
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 3
lea ecx, [eax + 1]
call fcn.00432820
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test al, al
je 0x431b96
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x28]
lea ecx, [ebp - 0xc0]
push eax
call fcn.00407920
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x4317d4
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4317ca
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4327c3
push edx
push ecx
call fcn.0046ec30
add esp, 8
lea eax, [ebp - 0x314]
mov dword [ebp - 0x314], 0
push eax
push 0x20119
push 0
push str.SOFTWAREGoogleChromeExtensionsihcjicgdanjaechkgeegckofjjedodee
push 0x80000002
call edi
test eax, eax
je 0x43181e
lea eax, [ebp - 0x314]
push eax
push 0x20219
push 0
push str.SOFTWAREGoogleChromeExtensionsihcjicgdanjaechkgeegckofjjedodee
push 0x80000002
call edi
test eax, eax
jne 0x4318d0
push dword [ebp - 0x314]
call esi
lea ecx, [ebp - 0x338]
call fcn.0045ef40
mov byte [ebp - 4], 8
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x431840
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4eb4d8
call fcn.00410550
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f730
mov edx, 0x4c9104
mov ecx, eax
call fcn.0040f730
push 0xd34
mov ecx, eax
call fcn.0040dd30
mov edx, str.:_BrowserGuard_extension_key_for_chrome_already_exists.
mov ecx, eax
call fcn.0040f730
push eax
call fcn.0040faa0
mov byte [ebp - 4], 1
add esp, 4
mov edx, dword [ebp - 0x324]
cmp edx, 8
jb 0x431bd4
mov ecx, dword [ebp - 0x338]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x431bca
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4327c8
jmp 0x431bca
push str.GoogleChromeUser_DataDefaultExtensionsihcjicgdanjaechkgeegckofjjedodee
lea edx, [ebp - 0x90]
lea ecx, [ebp - 0x28]
call fcn.0043b8e0
add esp, 4
lea ecx, [ebp - 0x338]
mov byte [ebp - 4], 4
call fcn.0045ef40
mov byte [ebp - 4], 5
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x431904
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4eb4d8
call fcn.00410550
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f730
mov edx, 0x4c9104
mov ecx, eax
call fcn.0040f730
push 0xd26
mov ecx, eax
call fcn.0040dd30
mov edx, str.:_Chrome_Ext_Folder:
mov ecx, eax
call fcn.0040f730
cmp dword [ebp - 0x14], 8
lea edx, [ebp - 0x28]
push dword [ebp - 0x18]
cmovae edx, dword [ebp - 0x28]
mov ecx, eax
call fcn.00410550
add esp, 4
push eax
call fcn.0040faa0
mov byte [ebp - 4], 4
add esp, 4
mov edx, dword [ebp - 0x324]
cmp edx, 8
jb 0x4319a9
mov ecx, dword [ebp - 0x338]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x43199f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4327cd
push edx
push ecx
call fcn.0046ec30
add esp, 8
mov byte [ebp - 0x314], 0
lea edx, [ebp - 0x28]
push dword [ebp - 0x314]
lea ecx, [ebp - 0x40]
call fcn.00418ec0
add esp, 4
lea edx, [ebp - 0x60]
lea ecx, [ebp - 0x40]
call fcn.0043e6f0
mov edx, dword [ebp - 0x2c]
test al, al
sete bl
cmp edx, 8
jb 0x431a0e
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x431a04
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4327d2
push edx
push ecx
call fcn.0046ec30
add esp, 8
lea ecx, [ebp - 0x338]
call fcn.0045ef40
test bl, bl
je 0x431afa
mov byte [ebp - 4], 6
cmp dword [eax + 0x14], 8
mov esi, dword [eax + 0x10]
jb 0x431a30
mov eax, dword [eax]
push esi
mov edx, eax
mov ecx, 0x4eb4d8
call fcn.00410550
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f730
mov edx, 0x4c9104
mov ecx, eax
call fcn.0040f730
push 0xd2a
mov ecx, eax
call fcn.0040dd30
mov edx, str.:_Chrome_Ext_Folder_not_found___prompt_to_install_BG
mov ecx, eax
call fcn.0040f730
push eax
call fcn.0040faa0
mov edx, dword [ebp - 0x324]
add esp, 4
cmp edx, 8
jb 0x431ab9
mov ecx, dword [ebp - 0x338]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x431aaf
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4327d7
push edx
push ecx
call fcn.0046ec30
add esp, 8
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x431af3
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x431ae9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4327dc
push edx
push ecx
call fcn.0046ec30
add esp, 8
mov bl, 1
jmp 0x432785
mov byte [ebp - 4], 7
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x431b09
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4eb4d8
call fcn.00410550
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f730
mov edx, 0x4c9104
mov ecx, eax
call fcn.0040f730
push 0xd2f
mov ecx, eax
call fcn.0040dd30
mov edx, str.:_Found_Chrome_Ext_Folder
mov ecx, eax
call fcn.0040f730
push eax
call fcn.0040faa0
mov byte [ebp - 4], 4
add esp, 4
mov edx, dword [ebp - 0x324]
cmp edx, 8
jb 0x431b96
mov ecx, dword [ebp - 0x338]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x431b8c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4327e1
push edx
push ecx
call fcn.0046ec30
add esp, 8
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x431bd4
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x431bca
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4327e6
push edx
push ecx
call fcn.0046ec30
add esp, 8
xor eax, eax
mov dword [ebp - 0x98], 0
mov dword [ebp - 0x94], 7
mov word [ebp - 0xa8], ax
lea ecx, [ebp - 0x338]
mov byte [ebp - 4], 9
call fcn.0045ef40
mov byte [ebp - 4], 0xa
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x431c0f
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4eb4d8
call fcn.00410550
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f730
mov edx, 0x4c9104
mov ecx, eax
call fcn.0040f730
push 0xd3a
mov ecx, eax
call fcn.0040dd30
mov edx, str.:_Checking_BG_for_Edge:
mov ecx, eax
call fcn.0040f730
push eax
call fcn.0040faa0
mov byte [ebp - 4], 9
add esp, 4
mov edx, dword [ebp - 0x324]
cmp edx, 8
jb 0x431c9c
mov ecx, dword [ebp - 0x338]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x431c92
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4327eb
push edx
push ecx
call fcn.0046ec30
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 0xb
xor ecx, ecx
call fcn.00432820
test al, al
je 0x4322a2
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x28]
lea ecx, [ebp - 0xa8]
push eax
call fcn.00407920
mov byte [ebp - 4], 9
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x431d1e
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x431d14
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4327f0
push edx
push ecx
call fcn.0046ec30
add esp, 8
lea eax, [ebp - 0x314]
mov dword [ebp - 0x314], 0
push eax
push 0x20119
push 0
push str.SOFTWAREMicrosoftEdgeExtensionsihcjicgdanjaechkgeegckofjjedodee
push 0x80000002
call edi
test eax, eax
je 0x431da4
lea eax, [ebp - 0x314]
push eax
push 0x20219
push 0
push str.SOFTWAREMicrosoftEdgeExtensionsihcjicgdanjaechkgeegckofjjedodee
push 0x80000002
call edi
test eax, eax
je 0x431da4
lea eax, [ebp - 0x314]
push eax
push 0x20119
push 0
push str.SOFTWAREMicrosoftEdgeExtensions_bojobppfploabceghnmlahpoonbcbacn
push 0x80000002
call edi
test eax, eax
je 0x431da4
lea eax, [ebp - 0x314]
push eax
push 0x20219
push 0
push str.SOFTWAREMicrosoftEdgeExtensions_bojobppfploabceghnmlahpoonbcbacn
push 0x80000002
call edi
test eax, eax
jne 0x431e23
push dword [ebp - 0x314]
call esi
lea ecx, [ebp - 0x338]
call fcn.0045ef40
mov byte [ebp - 4], 0x13
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x431dc6
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4eb4d8
call fcn.00410550
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f730
mov edx, 0x4c9104
mov ecx, eax
call fcn.0040f730
push 0xd53
mov ecx, eax
call fcn.0040dd30
mov edx, str.:_BrowserGuard_extension_key_for_Edge_already_exists.
mov ecx, eax
call fcn.0040f730
push eax
call fcn.0040faa0
add esp, 4
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x338]
call fcn.00404cc0
jmp 0x4322e0
push str.MicrosoftEdgeUser_DataDefaultExtensionsihcjicgdanjaechkgeegckofjjedodee
lea edx, [ebp - 0x90]
lea ecx, [ebp - 0x58]
call fcn.0043b8e0
add esp, 4
push str.MicrosoftEdgeUser_DataDefaultExtensions_bojobppfploabceghnmlahpoonbcbacn
lea edx, [ebp - 0x90]
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x28]
call fcn.0043b8e0
add esp, 4
lea ecx, [ebp - 0x338]
mov byte [ebp - 4], 0xd
call fcn.0045ef40
mov byte [ebp - 4], 0xe
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x431e71
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4eb4d8
call fcn.00410550
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f730
mov edx, 0x4c9104
mov ecx, eax
call fcn.0040f730
push 0xd44
mov ecx, eax
call fcn.0040dd30
mov edx, str.:_Edge_Ext_Folder:
mov ecx, eax
call fcn.0040f730
cmp dword [ebp - 0x44], 8
lea edx, [ebp - 0x58]
push dword [ebp - 0x48]
cmovae edx, dword [ebp - 0x58]
mov ecx, eax
call fcn.00410550
add esp, 4
push eax
call fcn.0040faa0
mov byte [ebp - 4], 0xd
add esp, 4
mov edx, dword [ebp - 0x324]
cmp edx, 8
jb 0x431f16
mov ecx, dword [ebp - 0x338]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x431f0c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4327f5
push edx
push ecx
call fcn.0046ec30
add esp, 8
lea ecx, [ebp - 0x338]
call fcn.0045ef40
mov byte [ebp - 4], 0xf
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x431f30
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4eb4d8
call fcn.00410550
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f730
mov edx, 0x4c9104
mov ecx, eax
call fcn.0040f730
push 0xd45
mov ecx, eax
call fcn.0040dd30
mov edx, str.:_Edge_Ext_Folder__2_:
mov ecx, eax
call fcn.0040f730
cmp dword [ebp - 0x14], 8
lea edx, [ebp - 0x28]
push dword [ebp - 0x18]
cmovae edx, dword [ebp - 0x28]
mov ecx, eax
call fcn.00410550
add esp, 4
push eax
call fcn.0040faa0
mov byte [ebp - 4], 0xd
add esp, 4
mov edx, dword [ebp - 0x324]
cmp edx, 8
jb 0x431fd5
mov ecx, dword [ebp - 0x338]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x431fcb
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4327fa
push edx
push ecx
call fcn.0046ec30
add esp, 8
mov byte [ebp - 0x314], 0
lea edx, [ebp - 0x58]
push dword [ebp - 0x314]
lea ecx, [ebp - 0x338]
call fcn.00418ec0
add esp, 4
mov byte [ebp - 4], 0x10
lea edx, [ebp - 0x60]
mov ebx, 1
lea ecx, [ebp - 0x338]
mov dword [ebp - 0x314], ebx
call fcn.0043e6f0
test al, al
jne 0x432049
mov byte [ebp - 0x33c], al
lea edx, [ebp - 0x28]
push dword [ebp - 0x33c]
lea ecx, [ebp - 0x40]
call fcn.00418ec0
add esp, 4
lea edx, [ebp - 0x60]
lea ecx, [ebp - 0x40]
mov ebx, 3
call fcn.0043e6f0
mov byte [ebp - 0x31d], 1
test al, al
je 0x432050
mov byte [ebp - 0x31d], 0
test bl, 2
je 0x4320a3
mov edx, dword [ebp - 0x2c]
cmp edx, 8
jb 0x43208f
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x432085
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4327ff
push edx
push ecx
call fcn.0046ec30
add esp, 8
xor eax, eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
mov dword [ebp - 4], 0xd
mov edx, dword [ebp - 0x324]
cmp edx, 8
jb 0x4320ea
mov ecx, dword [ebp - 0x338]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4320e0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x432804
push edx
push ecx
call fcn.0046ec30
add esp, 8
lea ecx, [ebp - 0x338]
call fcn.0045ef40
cmp byte [ebp - 0x31d], 0
je 0x432229
mov byte [ebp - 4], 0x11
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x432111
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4eb4d8
call fcn.00410550
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f730
mov edx, 0x4c9104
mov ecx, eax
call fcn.0040f730
push 0xd49
mov ecx, eax
call fcn.0040dd30
mov edx, str.:_Edge_Ext_Folder_not_found___prompt_to_install_BG
mov ecx, eax
call fcn.0040f730
push eax
call fcn.0040faa0
mov edx, dword [ebp - 0x324]
add esp, 4
cmp edx, 8
jb 0x43219a
mov ecx, dword [ebp - 0x338]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x432190
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x432809
push edx
push ecx
call fcn.0046ec30
add esp, 8
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x4321d4
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4321ca
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43280e
push edx
push ecx
call fcn.0046ec30
add esp, 8
mov edx, dword [ebp - 0x44]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp edx, 8
jb 0x432222
mov ecx, dword [ebp - 0x58]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x432218
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x432813
push edx
push ecx
call fcn.0046ec30
add esp, 8
mov bl, 1
jmp 0x43277a
mov byte [ebp - 4], 0x12
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x432238
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4eb4d8
call fcn.00410550
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f730
mov edx, 0x4c9104
mov ecx, eax
call fcn.0040f730
push 0xd4e
mov ecx, eax
call fcn.0040dd30
mov edx, str.:_Found_Edge_Ext_Folder
mov ecx, eax
call fcn.0040f730
push eax
call fcn.0040faa0
add esp, 4
lea ecx, [ebp - 0x338]
call fcn.00404cc0
lea ecx, [ebp - 0x28]
call fcn.00404cc0
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 9
call fcn.00404cc0
jmp 0x4322e0
mov byte [ebp - 4], 9
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x4322e0
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4322d6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x432818
push edx
push ecx
call fcn.0046ec30
add esp, 8
lea ecx, [ebp - 0x338]
call fcn.0045ef40
mov byte [ebp - 4], 0x14
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x4322fa
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4eb4d8
call fcn.00410550
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f730
mov edx, 0x4c9104
mov ecx, eax
call fcn.0040f730
push 0xd59
mov ecx, eax
call fcn.0040dd30
mov edx, str.:_Checking_BG_for_Firefox:
mov ecx, eax
call fcn.0040f730
push eax
call fcn.0040faa0
add esp, 4
lea ecx, [ebp - 0x338]
call fcn.00404cc0
lea eax, [ebp - 0x31c]
mov dword [ebp - 0x31c], 0
push eax
push 0
push 0
push 0x4b954c
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
xor ecx, ecx
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x64], 7
mov word [ebp - 0x78], cx
mov byte [ebp - 4], 0x15
test eax, eax
js 0x4323c8
mov edx, dword [ebp - 0x31c]
test edx, edx
je 0x4323d9
mov ecx, edx
lea esi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4323a0
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x78]
call fcn.00407920
push 0x10
push str.MozillaFirefox
lea ecx, [ebp - 0x78]
call fcn.0040c260
mov eax, dword [ebp - 0x31c]
test eax, eax
je 0x4323d9
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
xor eax, eax
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 7
mov word [ebp - 0x58], ax
mov byte [ebp - 4], 0x16
cmp dword [ebp - 0x68], eax
je 0x432768
lea ecx, [ebp - 0x58]
call fcn.00433270
test al, al
je 0x432768
push str.Profiles
lea edx, [ebp - 0x78]
lea ecx, [ebp - 0x40]
call fcn.0043b8e0
add esp, 4
push 0x250
lea eax, [ebp - 0x310]
mov byte [ebp - 4], 0x17
push 0
push eax
xor bh, bh
call fcn.00486d70
add esp, 0xc
lea ecx, [ebp - 0x310]
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x432678
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileW]
test byte [ebp - 0x310], 0x10
je 0x432656
mov ecx, 0x4ceb4c
lea eax, [ebp - 0x2e4]
nop dword [eax + eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4324a6
test dx, dx
je 0x4324a2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4324a6
add eax, 4
add ecx, 4
test dx, dx
jne 0x432480
xor eax, eax
jmp 0x4324ab
sbb eax, eax
or eax, 1
test eax, eax
je 0x432656
mov ecx, 0x4ceb50
lea eax, [ebp - 0x2e4]
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4324e6
test dx, dx
je 0x4324e2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4324e6
add eax, 4
add ecx, 4
test dx, dx
jne 0x4324c0
xor eax, eax
jmp 0x4324eb
sbb eax, eax
or eax, 1
test eax, eax
je 0x432656
push str.Profiles_
lea edx, [ebp - 0x78]
lea ecx, [ebp - 0x354]
call fcn.0043b8e0
add esp, 4
lea ecx, [ebp - 0x2e4]
mov byte [ebp - 4], 0x18
push ecx
mov edx, eax
lea ecx, [ebp - 0x28]
call fcn.0043b9b0
add esp, 4
lea ecx, [ebp - 0x354]
mov byte [ebp - 4], 0x1a
call fcn.00404cc0
push 0xc
push str.extensions_
lea ecx, [ebp - 0x28]
call fcn.0040c260
push 0x2a
push 0x4cdf48
lea ecx, [ebp - 0x28]
call fcn.0040c260
mov byte [ebp - 0x33c], 0
lea edx, [ebp - 0x28]
push dword [ebp - 0x33c]
lea ecx, [ebp - 0x338]
call fcn.00418ec0
add esp, 4
lea edx, [ebp - 0x60]
lea ecx, [ebp - 0x338]
call fcn.0043e6f0
mov edx, dword [ebp - 0x324]
mov bl, al
cmp edx, 8
jb 0x4325bc
mov ecx, dword [ebp - 0x338]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4325b2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4327be
push edx
push ecx
call fcn.0046ec30
add esp, 8
test bl, bl
jne 0x43266a
lea ecx, [ebp - 0x338]
call fcn.0045ef40
mov byte [ebp - 4], 0x1b
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x4325de
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4eb4d8
call fcn.00410550
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f730
mov edx, 0x4c9104
mov ecx, eax
call fcn.0040f730
push 0xd81
mov ecx, eax
call fcn.0040dd30
mov edx, str.:_profilePath:
mov ecx, eax
call fcn.0040f730
cmp dword [ebp - 0x14], 8
lea edx, [ebp - 0x28]
push dword [ebp - 0x18]
cmovae edx, dword [ebp - 0x28]
mov ecx, eax
call fcn.00410550
add esp, 4
push eax
call fcn.0040faa0
add esp, 4
lea ecx, [ebp - 0x338]
call fcn.00404cc0
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x17
call fcn.00404cc0
lea eax, [ebp - 0x310]
push eax
push esi
call edi
test eax, eax
jne 0x432463
jmp 0x432678
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x17
mov bh, 1
call fcn.00404cc0
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x354]
call fcn.0045ef40
test bh, bh
jne 0x4326fd
mov byte [ebp - 4], 0x1c
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x43269d
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4eb4d8
call fcn.00410550
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f730
mov edx, 0x4c9104
mov ecx, eax
call fcn.0040f730
push 0xd89
mov ecx, eax
call fcn.0040dd30
mov edx, str.:_Firefox_Ext_not_found___prompt_to_install_BG
mov ecx, eax
call fcn.0040f730
push eax
call fcn.0040faa0
add esp, 4
lea ecx, [ebp - 0x354]
call fcn.00404cc0
lea ecx, [ebp - 0x40]
call fcn.00404cc0
mov bl, 1
jmp 0x43276a
mov byte [ebp - 4], 0x1d
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x43270c
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4eb4d8
call fcn.00410550
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f730
mov edx, 0x4c9104
mov ecx, eax
call fcn.0040f730
push 0xd8e
mov ecx, eax
call fcn.0040dd30
mov edx, str.:_BrowserGuard_ext_for_Firefox_already_exists.
mov ecx, eax
call fcn.0040f730
push eax
call fcn.0040faa0
add esp, 4
lea ecx, [ebp - 0x354]
call fcn.00404cc0
lea ecx, [ebp - 0x40]
call fcn.00404cc0
xor bl, bl
lea ecx, [ebp - 0x58]
call fcn.00404cc0
lea ecx, [ebp - 0x78]
call fcn.00404cc0
lea ecx, [ebp - 0xa8]
call fcn.00404cc0
lea ecx, [ebp - 0xc0]
call fcn.00404cc0
lea ecx, [ebp - 0x90]
call fcn.00404cc0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046e70f
mov esp, ebp
pop ebp
ret
call fcn.0048d4f0
call fcn.00489b7c
call fcn.00489b7c
call fcn.00489b7c
call fcn.00489b7c
call fcn.00489b7c
call fcn.00489b7c
call fcn.00489b7c
call fcn.00489b7c
call fcn.00489b7c
call fcn.00489b7c
call fcn.00489b7c
call fcn.00489b7c
call fcn.00489b7c
call fcn.00489b7c
call fcn.00489b7c
call fcn.00489b7c
call fcn.00489b7c
call fcn.00489b7c
call fcn.00489b7c
int3