Function at 0x43b9b0
Capabilities:
Delete file

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b1152
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x2c0
mov eax, dword [0x4de080]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp byte [0x4e274d], 0
jne 0x43bfc0
lea ecx, [ebp - 0x54]
call fcn.00467c30
mov dword [ebp - 4], 0
cmp dword [eax + 0x14], 7
mov ecx, dword [eax + 0x10]
jbe 0x43ba18
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e14e8
call fcn.00412510
add esp, 4
mov edx, str.C:JenkinsworkspaceMBAM_WindowsA_MB5_MBSetup_srcMBSetupMBSetup.cpp
mov ecx, eax
call fcn.00411040
mov edx, 0x4c14f8
mov ecx, eax
call fcn.00411040
push 0xfbe
mov ecx, eax
call fcn.0040f7e0
mov edx, str.:_Looking_for_Privacy_VPN
mov ecx, eax
call fcn.00411040
push eax
call fcn.004113c0
mov dword [ebp - 4], 0xffffffff
add esp, 4
mov ecx, dword [ebp - 0x40]
cmp ecx, 7
jbe 0x43baa2
mov edx, dword [ebp - 0x54]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x43ba98
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43bfde
push ecx
push edx
call fcn.0048355d
add esp, 8
xorps xmm0, xmm0
movups xmmword [ebp - 0x3c], xmm0
mov dword [ebp - 0x3c], vtable.InstalledProducts.0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
push 0
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], 1
call fcn.0046c770
push 1
lea ecx, [ebp - 0x3c]
call fcn.0046c770
mov dword [ebp - 4], 2
cmp byte [0x4e2756], 0
jne 0x43bfb1
lea ecx, [ebp - 0x3c]
call fcn.0046db10
test al, al
je 0x43bfb1
lea ecx, [ebp - 0x2c]
xor esi, esi
call fcn.00467c30
mov byte [ebp - 4], 3
cmp dword [eax + 0x14], 7
mov ecx, dword [eax + 0x10]
jbe 0x43bb1d
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e14e8
call fcn.00412510
add esp, 4
mov edx, str.C:JenkinsworkspaceMBAM_WindowsA_MB5_MBSetup_srcMBSetupMBSetup.cpp
mov ecx, eax
call fcn.00411040
mov edx, 0x4c14f8
mov ecx, eax
call fcn.00411040
push 0xfc4
mov ecx, eax
call fcn.0040f7e0
mov edx, str.:_Found_Privacy_VPN._Redirecting_to_MB4_installer.
mov ecx, eax
call fcn.00411040
push eax
call fcn.004113c0
mov byte [ebp - 4], 2
add esp, 4
mov ecx, dword [ebp - 0x18]
cmp ecx, 7
jbe 0x43bba4
mov edx, dword [ebp - 0x2c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x43bb9a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43bfe3
push ecx
push edx
call fcn.0048355d
add esp, 8
lea ecx, [ebp - 0x2c]
call fcn.00445aa0
push eax
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 4
call fcn.0040d620
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x18]
cmp ecx, 7
jbe 0x43bbf7
mov edx, dword [ebp - 0x2c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x43bbed
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43bfe8
push ecx
push edx
call fcn.0048355d
add esp, 8
xor eax, eax
mov dword [ebp - 0x1c], 0
push str.mbsetup4.exe
lea ecx, [ebp - 0x6c]
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
call fcn.0040d6d0
cmp dword [ebp - 0x58], 7
lea eax, [ebp - 0x6c]
cmova eax, dword [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x19
xorps xmm0, xmm0
mov dword [ebp - 0x44], 0
push str.mbam_c.installer.consumer
lea ecx, [ebp - 0x54]
mov dword [ebp - 0x40], 0
movups xmmword [ebp - 0x54], xmm0
call fcn.0040df90
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x2c]
push 7
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
push str.MBSetup
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x18], 0
call fcn.0040df90
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x298]
push 0
xorps xmm0, xmm0
mov dword [ebp - 0x288], 0
push 0x4c0c34
movups xmmword [ebp - 0x298], xmm0
mov dword [ebp - 0x284], 0
call fcn.0040df90
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x2c8]
push 0
xorps xmm0, xmm0
mov dword [ebp - 0x2b8], 0
push 0x4c0c34
movups xmmword [ebp - 0x2c8], xmm0
mov dword [ebp - 0x2b4], 0
call fcn.0040df90
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x2b0]
push 8
xorps xmm0, xmm0
mov dword [ebp - 0x2a0], 0
push str._Release
movups xmmword [ebp - 0x2b0], xmm0
mov dword [ebp - 0x29c], 0
call fcn.0040df90
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 0xb
push eax
lea eax, [ebp - 0x298]
push eax
lea eax, [ebp - 0x2c8]
push eax
lea eax, [ebp - 0x2b0]
push eax
push ecx
push 0
lea ecx, [ebp - 0x280]
call fcn.00468b00
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x29c]
cmp ecx, 7
jbe 0x43bd81
mov edx, dword [ebp - 0x2b0]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x43bd77
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43bfed
push ecx
push edx
call fcn.0048355d
add esp, 8
mov byte [ebp - 4], 0xe
mov ecx, dword [ebp - 0x2b4]
cmp ecx, 7
jbe 0x43bdc5
mov edx, dword [ebp - 0x2c8]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x43bdbb
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43bfed
push ecx
push edx
call fcn.0048355d
add esp, 8
mov byte [ebp - 4], 0xf
mov ecx, dword [ebp - 0x284]
cmp ecx, 7
jbe 0x43be09
mov edx, dword [ebp - 0x298]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x43bdff
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43bfed
push ecx
push edx
call fcn.0048355d
add esp, 8
mov byte [ebp - 4], 0x10
mov ecx, dword [ebp - 0x18]
cmp ecx, 7
jbe 0x43be47
mov edx, dword [ebp - 0x2c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x43be3d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43bfed
push ecx
push edx
call fcn.0048355d
add esp, 8
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
nop dword [eax]
lea eax, [ebp - 0x54]
inc esi
push eax
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x280]
call fcn.0046b030
test al, al
jne 0x43be7a
push 0x7d0
call edi
cmp esi, 3
jge 0x43bff2
jmp 0x43be50
lea ecx, [ebp - 0x298]
call fcn.00467c30
mov byte [ebp - 4], 0x11
cmp dword [eax + 0x14], 7
mov ecx, dword [eax + 0x10]
jbe 0x43be94
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e14e8
call fcn.00412510
add esp, 4
mov edx, str.C:JenkinsworkspaceMBAM_WindowsA_MB5_MBSetup_srcMBSetupMBSetup.cpp
mov ecx, eax
call fcn.00411040
mov edx, 0x4c14f8
mov ecx, eax
call fcn.00411040
push 0xfdb
mov ecx, eax
call fcn.0040f7e0
mov edx, str.:_Successfully_downloaded_MB4_installer._Starting_it.
mov ecx, eax
call fcn.00411040
push eax
call fcn.004113c0
mov byte [ebp - 4], 0x10
add esp, 4
mov ecx, dword [ebp - 0x284]
cmp ecx, 7
jbe 0x43bf21
mov edx, dword [ebp - 0x298]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x43bf17
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43c08f
push ecx
push edx
call fcn.0048355d
add esp, 8
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
xor eax, eax
mov dword [ebp - 0x18], 7
movups xmmword [ebp - 0x2c], xmm0
mov word [ebp - 0x2c], ax
lea edx, [ebp - 0x2c]
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x6c]
call fcn.0043a010
lea ecx, [ebp - 0x298]
test al, al
jne 0x43c094
call fcn.00467c30
mov edx, eax
mov byte [ebp - 4], 0x14
mov ecx, 0x4e14e8
call fcn.00411020
mov edx, str.C:JenkinsworkspaceMBAM_WindowsA_MB5_MBSetup_srcMBSetupMBSetup.cpp
mov ecx, eax
call fcn.00411040
mov edx, 0x4c14f8
mov ecx, eax
call fcn.00411040
push 0xfe4
mov ecx, eax
call fcn.0040f7e0
mov edx, str.:_Error._Failed_to_start_MB4_installer.
mov ecx, eax
call fcn.00411040
push ecx
mov ecx, eax
call fcn.0040f9a0
lea ecx, [ebp - 0x298]
jmp 0x43c045
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x3c], vtable.InstalledProducts.0
call fcn.0045d4f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00483226
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.0048878f
call fcn.0048878f
call fcn.0048878f
call fcn.0048878f
lea ecx, [ebp - 0x2c]
call fcn.00467c30
mov edx, eax
mov byte [ebp - 4], 0x15
mov ecx, 0x4e14e8
call fcn.00411020
mov edx, str.C:JenkinsworkspaceMBAM_WindowsA_MB5_MBSetup_srcMBSetupMBSetup.cpp
mov ecx, eax
call fcn.00411040
mov edx, 0x4c14f8
mov ecx, eax
call fcn.00411040
push 0xfed
mov ecx, eax
call fcn.0040f7e0
mov edx, str.:_Error._Failed_to_download_MB4_installer.
mov ecx, eax
call fcn.00411040
push ecx
mov ecx, eax
call fcn.0040f9a0
lea ecx, [ebp - 0x2c]
call fcn.00406550
push ecx
lea ecx, [ebp - 0x1a0]
call fcn.0040f010
push ecx
push 0
push 0x6a6
push 0x5be
push 0x80
push 1
lea ecx, [ebp - 0x1a0]
call fcn.004237a0
push ecx
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [ebp - 0x1a0]
call fcn.0040f9b0
push 1
call fcn.0048e0d5
call fcn.0048878f
call fcn.00467c30
mov edx, eax
mov byte [ebp - 4], 0x13
mov ecx, 0x4e14e8
call fcn.00411020
mov edx, str.C:JenkinsworkspaceMBAM_WindowsA_MB5_MBSetup_srcMBSetupMBSetup.cpp
mov ecx, eax
call fcn.00411040
mov edx, 0x4c14f8
mov ecx, eax
call fcn.00411040
push 0xfdf
mov ecx, eax
call fcn.0040f7e0
mov edx, str.:_Started_MB4_installer._Exiting.
mov ecx, eax
call fcn.00411040
push ecx
mov ecx, eax
call fcn.0040f9a0
lea ecx, [ebp - 0x298]
call fcn.00406550
push 0
call fcn.0048e0d5
int3