Function at 0x42cad0
Capabilities:
Create process on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bd440
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x278
mov eax, dword [0x50b080]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor esi, esi
xorps xmm0, xmm0
mov dword [ebp - 0x250], esi
xor eax, eax
movups xmmword [ebp - 0xac], xmm0
mov dword [ebp - 0x9c], esi
mov dword [ebp - 0x98], 7
mov word [ebp - 0xac], ax
lea edx, [ebp - 0xac]
mov dword [ebp - 4], eax
call fcn.00429180
test al, al
jne 0x42cc8f
mov byte [ebp - 4], 1
call fcn.00404d30
mov ecx, eax
test ecx, ecx
je 0x42ebbe
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x1c], eax
lea edx, [esi + 3]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x20]
call fcn.00455b60
mov byte [ebp - 4], 3
push dword [eax]
lea eax, [ebp - 0x1c]
push str._s___could_not_determine_install_and_or_data_directories
push eax
call fcn.00441620
mov byte [ebp - 4], 2
or edi, 0xffffffff
mov edx, dword [ebp - 0x20]
add esp, 0xc
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42cbb9
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x7c]
call fcn.00467d30
mov byte [ebp - 4], 4
cmp dword [eax + 0x14], 7
mov ecx, dword [eax + 0x10]
jbe 0x42cbd0
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x50e6d0
call fcn.00412550
add esp, 4
mov edx, str.C:JenkinsworkspaceMBAM_WindowsA_MB5_MBSetup_srcMBSetupMBSetup.cpp
mov ecx, eax
call fcn.00411050
mov edx, 0x4eb568
mov ecx, eax
call fcn.00411050
push 0x5a0
mov ecx, eax
call fcn.0040f7e0
mov edx, 0x4eb7a8
mov ecx, eax
call fcn.00411050
mov esi, dword [ebp - 0x1c]
mov ecx, eax
mov edx, esi
call fcn.00411050
push eax
call fcn.004113d0
mov byte [ebp - 4], 2
add esp, 4
mov ecx, dword [ebp - 0x68]
cmp ecx, 7
jbe 0x42cc63
mov edx, dword [ebp - 0x7c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x42cc59
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42ebaf
push ecx
push edx
call fcn.004906cd
add esp, 8
xor edx, edx
mov ecx, esi
call fcn.00457f30
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], edi
dec edi
test edi, edi
jg 0x42cffa
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, 3
jmp 0x42eb53
cmp dword [ebp - 0x98], 7
lea eax, [ebp - 0xac]
push dword [ebp - 0x9c]
cmova eax, dword [ebp - 0xac]
mov edi, 0x50bd18
push eax
mov ecx, edi
call fcn.0040db20
cmp byte [0x50f950], 0
je 0x42cd82
cmp edi, 0x50bd30
je 0x42ccec
cmp dword [0x50bd44], 7
mov eax, 0x50bd30
push dword [0x50bd40]
cmova eax, dword [0x50bd30]
mov ecx, edi
push eax
call fcn.0040db20
cmp byte [0x50f939], 0
mov byte [0x50f922], 1
je 0x42cd82
push 0x50bd18
lea ecx, [ebp - 0x7c]
call fcn.0040d620
mov ecx, dword [0x50bf84]
mov esi, 4
mov dword [ebp - 0x250], esi
cmp ecx, 7
jbe 0x42cd57
mov eax, dword [0x50bf70]
lea ecx, [ecx*2 + 2]
cmp ecx, 0x1000
jb 0x42cd4d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42ebb4
mov eax, edx
push ecx
push eax
call fcn.004906cd
add esp, 8
movups xmm0, xmmword [ebp - 0x7c]
mov edi, 0x50bf70
push str.data
movups xmmword [0x50bf70], xmm0
mov ecx, edi
movq xmm0, qword [ebp - 0x6c]
movq qword [0x50bf80], xmm0
call fcn.0040d6d0
jmp 0x42cd87
mov edi, 0x50bf70
cmp byte [0x50f94f], 0
je 0x42cdb9
cmp edi, 0x50bd60
je 0x42cdb9
cmp dword [0x50bd74], 7
mov eax, 0x50bd60
push dword [0x50bd70]
cmova eax, dword [0x50bd60]
mov ecx, edi
push eax
call fcn.0040db20
cmp byte [0x50f939], 0
je 0x42d004
cmp dword [0x50bd2c], 7
mov eax, 0x50bd18
mov edi, dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
cmova eax, dword [0x50bd18]
push eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0x50c4f0
call edi
test eax, eax
jne 0x42cec1
lea edx, [ebp - 0x28]
mov ecx, 0x50bd18
call fcn.00444120
test al, al
jne 0x42cec1
cmp dword [ebp - 0x28], 0xb7
je 0x42cec1
lea ecx, [ebp - 0x7c]
call fcn.00467d30
mov byte [ebp - 4], 5
cmp dword [eax + 0x14], 7
mov ecx, dword [eax + 0x10]
jbe 0x42ce31
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x50e6d0
call fcn.00412550
add esp, 4
mov edx, str.C:JenkinsworkspaceMBAM_WindowsA_MB5_MBSetup_srcMBSetupMBSetup.cpp
mov ecx, eax
call fcn.00411050
mov edx, 0x4eb568
mov ecx, eax
call fcn.00411050
push 0x5c5
mov ecx, eax
call fcn.0040f7e0
mov edx, str.:_Error___could_not_create_install_directory._Error:
mov ecx, eax
call fcn.00411050
push dword [ebp - 0x28]
mov ecx, eax
call fcn.0040f7e0
push eax
call fcn.004113d0
mov ecx, dword [ebp - 0x68]
add esp, 4
cmp ecx, 7
jbe 0x42cffa
mov edx, dword [ebp - 0x7c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x42cff0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42ebb4
jmp 0x42cff0
cmp dword [0x50bf84], 7
mov eax, 0x50bf70
cmova eax, dword [0x50bf70]
push eax
call edi
test eax, eax
jne 0x42d004
mov byte [ebp - 0x20], al
lea ecx, [ebp - 0x284]
push dword [ebp - 0x20]
mov edx, 0x50bf70
call fcn.0041bdd0
add esp, 4
mov byte [ebp - 4], 6
lea edx, [ebp - 0x28]
or esi, 1
lea ecx, [ebp - 0x284]
mov dword [ebp - 0x250], esi
call fcn.00444120
mov esi, dword [ebp - 0x28]
test al, al
jne 0x42cf29
mov byte [ebp - 0x249], 1
cmp esi, 0xb7
jne 0x42cf30
mov byte [ebp - 0x249], 0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x250]
test al, 1
je 0x42cf8a
mov ecx, dword [ebp - 0x270]
and eax, 0xfffffffe
mov dword [ebp - 0x250], eax
cmp ecx, 7
jbe 0x42cf8a
mov edx, dword [ebp - 0x284]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x42cf80
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42ebb9
push ecx
push edx
call fcn.004906cd
add esp, 8
cmp byte [ebp - 0x249], 0
je 0x42d004
lea ecx, [ebp - 0x7c]
call fcn.00467d30
mov byte [ebp - 4], 7
cmp dword [eax + 0x14], 7
mov ecx, dword [eax + 0x10]
jbe 0x42cfaa
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x50e6d0
call fcn.00412550
add esp, 4
mov edx, str.C:JenkinsworkspaceMBAM_WindowsA_MB5_MBSetup_srcMBSetupMBSetup.cpp
mov ecx, eax
call fcn.00411050
mov edx, 0x4eb568
mov ecx, eax
call fcn.00411050
push 0x5ce
mov ecx, eax
call fcn.0040f7e0
mov edx, str.:_Error___could_not_create_data_directory._Error:
mov ecx, eax
call fcn.00411050
push esi
jmp 0x42ce74
push ecx
push edx
call fcn.004906cd
add esp, 8
mov edi, 3
jmp 0x42eb53
push 6
xorps xmm0, xmm0
mov dword [ebp - 0x34], 0
push str.MBAM_C
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x30], 0
movups xmmword [ebp - 0x44], xmm0
call fcn.0040df90
push ecx
mov edx, 1
call fcn.0040d780
mov ecx, dword [ebp - 0x30]
add esp, 4
mov byte [ebp - 0x249], al
cmp ecx, 7
jbe 0x42d07c
mov edx, dword [ebp - 0x44]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x42d06c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42ebb4
push ecx
push edx
call fcn.004906cd
mov al, byte [ebp - 0x249]
add esp, 8
test al, al
jne 0x42d21a
mov byte [ebp - 4], 8
call fcn.00404d30
mov ecx, eax
test ecx, ecx
je 0x42ebbe
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x1c], eax
mov edx, 0xc8
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x20]
call fcn.00455b60
mov byte [ebp - 4], 0xa
push dword [eax]
lea eax, [ebp - 0x1c]
push str._s___unsupported_operating_system
push eax
call fcn.00441620
mov byte [ebp - 4], 9
or edi, 0xffffffff
mov edx, dword [ebp - 0x20]
add esp, 0xc
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42d0ed
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x7c]
call fcn.00467d30
mov byte [ebp - 4], 0xb
cmp dword [eax + 0x14], 7
mov ecx, dword [eax + 0x10]
jbe 0x42d104
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x50e6d0
call fcn.00412550
add esp, 4
mov edx, str.C:JenkinsworkspaceMBAM_WindowsA_MB5_MBSetup_srcMBSetupMBSetup.cpp
mov ecx, eax
call fcn.00411050
mov edx, 0x4eb568
mov ecx, eax
call fcn.00411050
push 0x5db
mov ecx, eax
call fcn.0040f7e0
mov edx, 0x4eb7a8
mov ecx, eax
call fcn.00411050
mov esi, dword [ebp - 0x1c]
mov ecx, eax
mov edx, esi
call fcn.00411050
push eax
call fcn.004113d0
mov byte [ebp - 4], 9
add esp, 4
mov ecx, dword [ebp - 0x68]
cmp ecx, 7
jbe 0x42d197
mov edx, dword [ebp - 0x7c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x42d18d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42ebb4
push ecx
push edx
call fcn.004906cd
add esp, 8
xor edx, edx
mov ecx, esi
call fcn.00457f30
cmp byte [0x50f942], 0
jne 0x42d1fb
push 0x130
lea eax, [ebp - 0x248]
push 0
push eax
call fcn.00492970
add esp, 8
lea ecx, [ebp - 0x248]
push 0
push 0x6a6
push 0x235d
push 0x80
push 1
call fcn.00423940
push ecx
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [ebp - 0x248]
call fcn.0040f9b0
lea ecx, [ebp - 0x248]
call fcn.0040ef30
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], edi
dec edi
test edi, edi
jg 0x42d210
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, 0xc8
jmp 0x42eb53
xorps xmm0, xmm0
mov dword [ebp - 0x48], 0
movq qword [ebp - 0x50], xmm0
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0
mov byte [ebp - 4], 0xc
mov eax, 0x50bdc0
cmp dword [0x50bdd4], 7
push str.MBAM_C
cmova eax, dword [0x50bdc0]
push eax
call fcn.0049a53c
add esp, 8
test eax, eax
je 0x42d290
cmp dword [0x50bdd4], 7
mov eax, 0x50bdc0
push str.MDAM_B
cmova eax, dword [0x50bdc0]
push eax
call fcn.0049a53c
add esp, 8
test eax, eax
jne 0x42d44d
cmp byte [0x50f942], 0
jne 0x42d44d
call fcn.00436600
test al, al
je 0x42d44d
mov eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 0x4c]
je 0x42d44d
push 0x3b
xorps xmm0, xmm0
mov dword [ebp - 0x34], 0
push str.https:__links.malwarebytes.com_support_installer_AVBlocking
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x30], 0
movups xmmword [ebp - 0x44], xmm0
call fcn.0040df90
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x50]
cmp dword [ecx + 0x40], 0
lea eax, [ecx + 0x30]
je 0x42d2f6
push eax
lea ecx, [ebp - 0x44]
call fcn.0040d750
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx + 0x10]
mov eax, 0x7ffffffe
sub eax, edx
cmp eax, 0x11
jb 0x42ebc8
cmp dword [ecx + 0x14], 7
jbe 0x42d311
mov ecx, dword [ecx]
push edx
push ecx
push 0x11
push str.We_have_detected
push ecx
push dword [ebp - 0x24]
lea ecx, [ebp - 0x26c]
call fcn.00442700
mov esi, dword [ebp - 0x250]
or esi, 0x400
mov dword [ebp - 0x250], esi
push str._installed_on_your_computer._This_product_may_interfere_with
lea edx, [ebp - 0x26c]
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x284]
call fcn.00441640
add esp, 4
push str.the_installation_of_Malwarebytes._Please_click_Yes_to_find_out_how_to_safely_install_Malwarebytes._You_can_click_No_to_proceed_with_installation__or_Cancel_to_exit.
mov edx, eax
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x7c]
call fcn.00441640
mov byte [ebp - 4], 0xe
add esp, 4
mov ecx, dword [ebp - 0x270]
cmp ecx, 7
jbe 0x42d3b2
mov edx, dword [ebp - 0x284]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x42d3a8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42ebb4
push ecx
push edx
call fcn.004906cd
add esp, 8
xor eax, eax
mov dword [ebp - 0x274], 0
lea ecx, [ebp - 0x26c]
mov dword [ebp - 0x270], 7
mov word [ebp - 0x284], ax
mov byte [ebp - 4], 0xd
call fcn.00406550
push 3
push str.Malwarebytes_Installer
lea ecx, [ebp - 0x7c]
call fcn.0040dcd0
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x42d416
push 5
push 0
push 0
lea ecx, [ebp - 0x44]
call fcn.0040dcd0
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x42d41b
cmp eax, 2
jne 0x42d43b
lea ecx, [ebp - 0x7c]
call fcn.00406550
lea ecx, [ebp - 0x44]
call fcn.00406550
mov edi, 0xcb
mov dword [ebp - 0x250], edi
jmp 0x42ead3
lea ecx, [ebp - 0x7c]
call fcn.00406550
lea ecx, [ebp - 0x44]
call fcn.00406550
jmp 0x42d453
mov esi, dword [ebp - 0x250]
xorps xmm0, xmm0
movups xmmword [ebp - 0x64], xmm0
mov dword [ebp - 0x64], vtable.InstalledProducts.0
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x58], 0
push 0
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0x10
call fcn.0046d690
push 1
lea ecx, [ebp - 0x64]
call fcn.0046d690
mov byte [ebp - 4], 0x11
cmp byte [0x50f91c], 0
jne 0x42d8ac
push 6
xorps xmm0, xmm0
mov dword [ebp - 0x34], 0
push str.MBAM_C
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x30], 0
movups xmmword [ebp - 0x44], xmm0
call fcn.0040df90
mov byte [ebp - 4], 0x12
lea edx, [ebp - 0x64]
or esi, 2
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x250], esi
call fcn.00467670
test al, al
je 0x42d516
cmp dword [0x50bdd4], 7
mov eax, 0x50bdc0
push str.MBRW_C
cmova eax, dword [0x50bdc0]
push eax
call fcn.0049a53c
add esp, 8
test eax, eax
jne 0x42d50d
call fcn.004674f0
test al, al
jne 0x42d516
mov byte [ebp - 0x249], 0
jmp 0x42d51d
mov byte [ebp - 0x249], 1
mov dword [ebp - 4], 0x11
mov eax, dword [ebp - 0x250]
test al, 2
je 0x42d571
mov ecx, dword [ebp - 0x30]
and eax, 0xfffffffd
mov dword [ebp - 0x250], eax
cmp ecx, 7
jbe 0x42d571
mov edx, dword [ebp - 0x44]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x42d567
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42ebb4
push ecx
push edx
call fcn.004906cd
add esp, 8
cmp byte [ebp - 0x249], 0
je 0x42d744
mov byte [ebp - 4], 0x13
call fcn.00404d30
mov ecx, eax
test ecx, ecx
je 0x42ebcd
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x1c], eax
mov edx, 0xc9
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x20]
call fcn.00455b60
mov byte [ebp - 4], 0x15
push dword [eax]
lea eax, [ebp - 0x1c]
push str._s___cant_install_over_business_products
push eax
call fcn.00441620
mov byte [ebp - 4], 0x14
or edi, 0xffffffff
mov edx, dword [ebp - 0x20]
add esp, 0xc
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42d5e7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x26c]
call fcn.00467d30
mov byte [ebp - 4], 0x16
cmp dword [eax + 0x14], 7
mov ecx, dword [eax + 0x10]
jbe 0x42d601
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x50e6d0
call fcn.00412550
add esp, 4
mov edx, str.C:JenkinsworkspaceMBAM_WindowsA_MB5_MBSetup_srcMBSetupMBSetup.cpp
mov ecx, eax
call fcn.00411050
mov edx, 0x4eb568
mov ecx, eax
call fcn.00411050
push 0x611
mov ecx, eax
call fcn.0040f7e0
mov edx, 0x4eb7a8
mov ecx, eax
call fcn.00411050
mov esi, dword [ebp - 0x1c]
mov ecx, eax
mov edx, esi
call fcn.00411050
push eax
call fcn.004113d0
mov byte [ebp - 4], 0x14
add esp, 4
mov ecx, dword [ebp - 0x258]
cmp ecx, 7
jbe 0x42d69a
mov edx, dword [ebp - 0x26c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x42d690
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42ebb4
push ecx
push edx
call fcn.004906cd
add esp, 8
xorps xmm0, xmm0
mov dword [ebp - 0x30], 0
lea edx, [ebp - 0x64]
movq qword [ebp - 0x38], xmm0
lea ecx, [ebp - 0x38]
call fcn.0045af60
lea edx, [ebp - 0x38]
mov byte [ebp - 4], 0x17
mov ecx, esi
call fcn.00457f30
cmp byte [0x50f942], 0
jne 0x42d71d
push 0x130
lea eax, [ebp - 0x248]
push 0
push eax
call fcn.00492970
add esp, 8
lea ecx, [ebp - 0x248]
push 0
push 0x6a6
push 0x235b
push 0x80
push 1
call fcn.00423940
push ecx
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [ebp - 0x248]
call fcn.0040f9b0
lea ecx, [ebp - 0x248]
call fcn.0040ef30
lea ecx, [ebp - 0x38]
call fcn.0043d0e0
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], edi
dec edi
test edi, edi
jg 0x42d73a
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, 0xc9
jmp 0x42eabe
cmp dword [0x50bdd4], 7
mov eax, 0x50bdc0
push str.MBRW_C
cmova eax, dword [0x50bdc0]
push eax
call fcn.0049a53c
add esp, 8
test eax, eax
je 0x42d8ac
cmp dword [0x50bdd4], 7
mov eax, 0x50bdc0
push str.MBRW_B
cmova eax, dword [0x50bdc0]
push eax
call fcn.0049a53c
add esp, 8
test eax, eax
je 0x42d8ac
mov eax, dword [ebp - 0x5c]
mov edi, dword [ebp - 0x60]
mov dword [ebp - 0x254], eax
cmp edi, eax
je 0x42d8ac
add edi, 0x1c
mov dword [ebp - 0x18], edi
lea eax, [edi - 0x18]
mov dword [ebp - 0x118], vtable.InstalledProducts::InstalledProduct.0
push eax
lea ecx, [ebp - 0x114]
call fcn.0040d620
push edi
lea ecx, [ebp - 0xfc]
mov byte [ebp - 4], 0x18
call fcn.0040d620
lea eax, [edi + 0x18]
mov byte [ebp - 4], 0x19
push eax
lea ecx, [ebp - 0xe4]
call fcn.0040d620
lea eax, [edi + 0x30]
mov byte [ebp - 4], 0x1a
push eax
lea ecx, [ebp - 0xcc]
call fcn.0040d620
mov al, byte [edi + 0x48]
mov byte [ebp - 0xb4], al
mov byte [ebp - 4], 0x1b
lea edi, [ebp - 0xfc]
cmp dword [ebp - 0xe8], 7
cmova edi, dword [ebp - 0xfc]
cmp dword [ebp - 0xec], 0x19
jb 0x42d885
mov edx, str.Malwarebytes_Anti_Malware
mov esi, 0x19
sub edi, edx
movzx ecx, word [edi + edx]
movzx eax, word [edx]
cmp cx, ax
jne 0x42d885
add edx, 2
sub esi, 1
jne 0x42d835
sub esp, 0x18
mov dword [ebp - 0x1c], esi
lea eax, [ebp - 0xe4]
mov dword [ebp - 0x2c], esi
mov ecx, esp
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x20], esi
push eax
call fcn.0040d620
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0046dee0
cmp dword [ebp - 0x1c], 2
jbe 0x42d9e9
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 0x11
call fcn.00462470
mov edi, dword [ebp - 0x18]
add edi, 0x68
mov dword [ebp - 0x18], edi
lea eax, [edi - 0x1c]
cmp eax, dword [ebp - 0x254]
jne 0x42d7b0
lea ecx, [ebp - 0x64]
call fcn.0046e120
mov esi, 0x50bb51
test al, al
je 0x42dded
cmp dword [0x50bdd4], 7
mov eax, 0x50bdc0
push str.MBRW_C
cmova eax, dword [0x50bdc0]
push eax
call fcn.0049a53c
add esp, 8
test eax, eax
je 0x42dc48
cmp dword [0x50bdd4], 7
mov eax, 0x50bdc0
push str.MBRW_B
cmova eax, dword [0x50bdc0]
push eax
call fcn.0049a53c
add esp, 8
test eax, eax
je 0x42dc48
mov byte [0x50f93b], 1
call fcn.00427dc0
xor al, al
xchg byte [esi], al
xorps xmm0, xmm0
mov dword [ebp - 0x34], 0
xor eax, eax
mov dword [ebp - 0x30], 7
movups xmmword [ebp - 0x44], xmm0
mov word [ebp - 0x44], ax
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 0x24
push eax
lea ecx, [ebp - 0x64]
call fcn.0046f0b0
mov byte [ebp - 0x254], 0
lea edx, [ebp - 0x44]
push dword [ebp - 0x254]
lea ecx, [ebp - 0x26c]
call fcn.0041bdd0
add esp, 4
mov ecx, 0x50bd18
push eax
call fcn.0040dce0
mov ecx, dword [ebp - 0x258]
cmp ecx, 7
jbe 0x42d9b7
mov edx, dword [ebp - 0x26c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x42d9ad
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42ebb4
push ecx
push edx
call fcn.004906cd
add esp, 8
push 0x50bd18
lea ecx, [ebp - 0x94]
call fcn.0040d620
mov byte [ebp - 4], 0x25
mov eax, dword [ebp - 0x84]
test eax, eax
je 0x42db9d
lea ecx, [eax - 1]
cmp eax, ecx
jbe 0x42ebd7
jmp 0x42db48
lea ecx, [ebp - 0x118]
call fcn.00462470
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0
call fcn.00404e30
mov edx, 0xca
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x254]
call fcn.00455b60
mov byte [ebp - 4], 0x1d
push dword [eax]
lea eax, [ebp - 0x18]
push str._s___cant_install_over_MBAM_2.x_or_earlier
push eax
call fcn.00441620
add esp, 0xc
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x254]
call fcn.00404fe0
lea ecx, [ebp - 0x26c]
call fcn.00467d30
mov edx, eax
mov byte [ebp - 4], 0x1e
mov ecx, 0x50e6d0
call fcn.00411030
mov edx, str.C:JenkinsworkspaceMBAM_WindowsA_MB5_MBSetup_srcMBSetupMBSetup.cpp
mov ecx, eax
call fcn.00411050
mov edx, 0x4eb568
mov ecx, eax
call fcn.00411050
push 0x62a
mov ecx, eax
call fcn.0040f7e0
mov edx, 0x4eb7a8
mov ecx, eax
call fcn.00411050
mov edx, dword [ebp - 0x18]
mov ecx, eax
call fcn.00411050
push eax
call fcn.004113d0
add esp, 4
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x26c]
call fcn.00406550
xorps xmm0, xmm0
mov dword [ebp - 0x30], 0
lea edx, [ebp - 0x64]
movq qword [ebp - 0x38], xmm0
lea ecx, [ebp - 0x38]
call fcn.0045af60
mov byte [ebp - 4], 0x1f
lea edx, [ebp - 0x38]
mov ecx, dword [ebp - 0x18]
call fcn.00457f30
cmp byte [0x50f942], 0
jne 0x42db2e
push 0x130
lea eax, [ebp - 0x248]
push 0
push eax
call fcn.00492970
add esp, 8
lea ecx, [ebp - 0x248]
push 0
push 0x6a6
push 0x235a
push 0x80
push 1
call fcn.00423940
push ecx
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [ebp - 0x248]
call fcn.0040f9b0
lea ecx, [ebp - 0x248]
call fcn.0040ef30
lea ecx, [ebp - 0x38]
call fcn.0043d0e0
lea ecx, [ebp - 0x18]
call fcn.00404fe0
mov edi, 0xca
jmp 0x42eabe
cmp dword [ebp - 0x80], 7
lea eax, [ebp - 0x94]
cmova eax, dword [ebp - 0x94]
cmp word [eax + ecx*2], 0x5c
jne 0x42db9d
push ecx
push 0
lea eax, [ebp - 0x26c]
push eax
lea ecx, [ebp - 0x94]
call fcn.0041b9f0
push eax
lea ecx, [ebp - 0x94]
call fcn.0040dce0
lea ecx, [ebp - 0x26c]
call fcn.00406550
lea eax, [ebp - 0x94]
mov ecx, 0x50bd18
push eax
call fcn.004417b0
xor al, al
mov ecx, 0x50bb50
xchg byte [ecx], al
mov byte [ebp - 4], 0x24
mov ecx, dword [ebp - 0x80]
cmp ecx, 7
jbe 0x42dbe7
mov edx, dword [ebp - 0x94]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x42dbdd
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42ebb4
push ecx
push edx
call fcn.004906cd
add esp, 8
xor eax, eax
mov byte [ebp - 4], 0x11
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x84], 0
mov dword [ebp - 0x80], 7
mov word [ebp - 0x94], ax
cmp ecx, 7
jbe 0x42ddf4
mov edx, dword [ebp - 0x44]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x42dc39
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42ebb4
push ecx
push edx
call fcn.004906cd
add esp, 8
jmp 0x42ddf4
mov byte [ebp - 4], 0x20
call fcn.00404d30
mov ecx, eax
test ecx, ecx
je 0x42ebdc
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x1c], eax
mov edx, 0xca
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x254]
call fcn.00455b60
mov byte [ebp - 4], 0x22
push dword [eax]
lea eax, [ebp - 0x1c]
push str._s___cant_install_ARW_over_MBAM_3.0_or_newer
push eax
call fcn.00441620
mov byte [ebp - 4], 0x21
or edi, 0xffffffff
mov edx, dword [ebp - 0x254]
add esp, 0xc
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42dcb7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x26c]
call fcn.00467d30
mov byte [ebp - 4], 0x23
cmp dword [eax + 0x14], 7
mov ecx, dword [eax + 0x10]
jbe 0x42dcd1
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x50e6d0
call fcn.00412550
add esp, 4
mov edx, str.C:JenkinsworkspaceMBAM_WindowsA_MB5_MBSetup_srcMBSetupMBSetup.cpp
mov ecx, eax
call fcn.00411050
mov edx, 0x4eb568
mov ecx, eax
call fcn.00411050
push 0x660
mov ecx, eax
call fcn.0040f7e0
mov edx, 0x4eb7a8
mov ecx, eax
call fcn.00411050
mov esi, dword [ebp - 0x1c]
mov ecx, eax
mov edx, esi
call fcn.00411050
push eax
call fcn.004113d0
mov byte [ebp - 4], 0x21
add esp, 4
mov ecx, dword [ebp - 0x258]
cmp ecx, 7
jbe 0x42dd6a
mov edx, dword [ebp - 0x26c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x42dd60
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42ebb4
push ecx
push edx
call fcn.004906cd
add esp, 8
xor edx, edx
mov ecx, esi
call fcn.00457f30
cmp byte [0x50f942], 0
jne 0x42ddce
push 0x130
lea eax, [ebp - 0x248]
push 0
push eax
call fcn.00492970
add esp, 8
lea ecx, [ebp - 0x248]
push 0
push 0x6a6
push 0x2350
push 0x2351
push 1
call fcn.00423940
push ecx
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [ebp - 0x248]
call fcn.0040f9b0
lea ecx, [ebp - 0x248]
call fcn.0040ef30
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], edi
dec edi
test edi, edi
jg 0x42dde3
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, 0xca
jmp 0x42eabe
mov byte [0x50f923], 1
lea ecx, [ebp - 0x64]
call fcn.0046e3a0
cmp dword [0x50bdd4], 7
mov byte [0x50f91f], al
mov eax, 0x50bdc0
cmova eax, dword [0x50bdc0]
push str.NCEP_WIN
push eax
call fcn.0049a53c
add esp, 8
test eax, eax
je 0x42de79
cmp dword [0x50bdd4], 7
mov eax, 0x50bdc0
push str.MBRW_C
cmova eax, dword [0x50bdc0]
push eax
call fcn.0049a53c
add esp, 8
test eax, eax
je 0x42de79
cmp dword [0x50bdd4], 7
mov eax, 0x50bdc0
push str.MBRW_B
cmova eax, dword [0x50bdc0]
push eax
call fcn.0049a53c
add esp, 8
test eax, eax
je 0x42de79
cmp byte [0x50f93e], 0
je 0x42de7d
xor al, al
xchg byte [esi], al
cmp byte [0x50f940], 0
je 0x42df35
lea ecx, [ebp - 0x26c]
call fcn.00467d30
mov byte [ebp - 4], 0x26
cmp dword [eax + 0x14], 7
mov ecx, dword [eax + 0x10]
jbe 0x42dea4
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x50e6d0
call fcn.00412550
add esp, 4
mov edx, str.C:JenkinsworkspaceMBAM_WindowsA_MB5_MBSetup_srcMBSetupMBSetup.cpp
mov ecx, eax
call fcn.00411050
mov edx, 0x4eb568
mov ecx, eax
call fcn.00411050
push 0x68a
mov ecx, eax
call fcn.0040f7e0
mov edx, str.:_MB_Teams___MDAM_B_implied_by_filename_or_cmd_line_option
mov ecx, eax
call fcn.00411050
push eax
call fcn.004113d0
mov byte [ebp - 4], 0x11
add esp, 4
mov ecx, dword [ebp - 0x258]
cmp ecx, 7
jbe 0x42df31
mov edx, dword [ebp - 0x26c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x42df27
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42ebb4
push ecx
push edx
call fcn.004906cd
add esp, 8
xor al, al
xchg byte [esi], al
mov ecx, 0x50bf70
call fcn.0042beb0
or edi, 0xffffffff
mov dword [ebp - 0x54], eax
test eax, eax
je 0x42e48b
cmp byte [0x50f942], 0
je 0x42e004
lea ecx, [ebp - 0x26c]
call fcn.00467d30
mov byte [ebp - 4], 0x27
cmp dword [eax + 0x14], 7
mov ecx, dword [eax + 0x10]
jbe 0x42df74
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x50e6d0
call fcn.00412550
add esp, 4
mov edx, str.C:JenkinsworkspaceMBAM_WindowsA_MB5_MBSetup_srcMBSetupMBSetup.cpp
mov ecx, eax
call fcn.00411050
mov edx, 0x4eb568
mov ecx, eax
call fcn.00411050
push 0x694
mov ecx, eax
call fcn.0040f7e0
mov edx, str.:_Pre_check_s__failed_but_in_silent_mode___will_try_to_continue_the_installation
mov ecx, eax
call fcn.00411050
push eax
call fcn.004113d0
mov byte [ebp - 4], 0x11
add esp, 4
mov ecx, dword [ebp - 0x258]
cmp ecx, 7
jbe 0x42e532
mov edx, dword [ebp - 0x26c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x42e528
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x42e528
jmp 0x42ebb4
add eax, 0xfffffffe
cmp eax, 7
ja case.0x42e00c.5
jmp dword [eax*4 + 0x42ebfc]
mov dword [ebp - 0x18], 0x2346
mov byte [ebp - 0x249], 0
jmp 0x42e051
mov dword [ebp - 0x18], 0x2347
mov byte [ebp - 0x249], 0
jmp 0x42e051
mov dword [ebp - 0x18], 0x2348
mov byte [ebp - 0x249], 0
jmp 0x42e051
mov dword [ebp - 0x18], 0x2349
mov byte [ebp - 0x249], 1
cmp dword [0x50bdd4], 7
mov eax, 0x50bdc0
push str.MBRW_C
cmova eax, dword [0x50bdc0]
push eax
call fcn.0049a53c
add esp, 8
test eax, eax
je 0x42e09f
cmp dword [0x50bdd4], 7
mov eax, 0x50bdc0
push str.MBRW_B
cmova eax, dword [0x50bdc0]
push eax
call fcn.0049a53c
add esp, 8
test eax, eax
je 0x42e09f
xor al, al
jmp 0x42e0a1
mov al, 1
test al, al
mov ecx, 0x2329
mov edx, 0x80
mov eax, 0x2328
cmove ecx, edx
cmp byte [0x50f940], 0
cmovne ecx, eax
mov dword [ebp - 0x20], ecx
mov byte [ebp - 4], 0x28
call fcn.00404d30
mov ecx, eax
test ecx, ecx
je 0x42ebf0
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0
mov byte [ebp - 4], 0x2b
call fcn.00404d30
mov ecx, eax
test ecx, ecx
je 0x42ebe6
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
mov byte [ebp - 4], 0x2a
mov ecx, 0x4f0f90
or dword [ebp - 0x250], 0x200
lea esi, [eax + 0x10]
mov dword [ebp - 0x2c], esi
nop dword [eax]
mov edx, dword [ecx + 4]
mov eax, dword [ecx]
mov dword [ebp - 0x254], edx
mov edx, dword [ebp - 0x54]
cmp edx, eax
je 0x42e13f
add ecx, 8
cmp ecx, 0x4f0ff0
jne 0x42e120
jmp 0x42e16b
mov edx, dword [ebp - 0x254]
test edx, edx
jne 0x42e14d
xor ecx, ecx
jmp 0x42e15b
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x42e152
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0x2c]
call fcn.00404630
mov esi, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x54]
cmp dword [esi - 0xc], 0
jne 0x42e186
push edx
lea eax, [ebp - 0x2c]
push str.undefined___d_
push eax
call fcn.00441620
mov esi, dword [ebp - 0x2c]
add esp, 0xc
mov edx, 0xcc
lea ecx, [ebp - 0x24]
call fcn.00455b60
push esi
mov byte [ebp - 4], 0x2c
push dword [eax]
lea eax, [ebp - 0x1c]
push str._s___prerequisite_failure__s
push eax
call fcn.00441620
mov edx, dword [ebp - 0x24]
add esp, 0x10
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42e1c5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x29
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x42e1e0
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x26c]
call fcn.00467d30
mov byte [ebp - 4], 0x2d
cmp dword [eax + 0x14], 7
mov ecx, dword [eax + 0x10]
jbe 0x42e1fa
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x50e6d0
call fcn.00412550
add esp, 4
mov edx, str.C:JenkinsworkspaceMBAM_WindowsA_MB5_MBSetup_srcMBSetupMBSetup.cpp
mov ecx, eax
call fcn.00411050
mov edx, 0x4eb568
mov ecx, eax
call fcn.00411050
push 0x6a6
mov ecx, eax
call fcn.0040f7e0
mov edx, 0x4eb7a8
mov ecx, eax
call fcn.00411050
mov esi, dword [ebp - 0x1c]
mov ecx, eax
mov edx, esi
call fcn.00411050
push eax
call fcn.004113d0
mov byte [ebp - 4], 0x29
add esp, 4
mov ecx, dword [ebp - 0x258]
cmp ecx, 7
jbe 0x42e293
mov edx, dword [ebp - 0x26c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x42e289
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42ebb4
push ecx
push edx
call fcn.004906cd
add esp, 8
push 0x130
lea eax, [ebp - 0x248]
push 0
push eax
call fcn.00492970
add esp, 8
lea ecx, [ebp - 0x248]
cmp byte [ebp - 0x249], 0
je 0x42e3ca
push 0x2333
push 0x2332
push dword [ebp - 0x18]
push dword [ebp - 0x20]
push 0
call fcn.00423940
push ecx
mov byte [ebp - 4], 0x2e
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [ebp - 0x248]
call fcn.0040f9b0
cmp eax, 0x644
jne 0x42e34b
lea ecx, [ebp - 0x26c]
call fcn.00467d30
mov edx, eax
mov byte [ebp - 4], 0x2f
mov ecx, 0x50e6d0
call fcn.00411030
mov edx, str.C:JenkinsworkspaceMBAM_WindowsA_MB5_MBSetup_srcMBSetupMBSetup.cpp
mov ecx, eax
call fcn.00411050
mov edx, 0x4eb568
mov ecx, eax
call fcn.00411050
push 0x6ad
mov ecx, eax
call fcn.0040f7e0
mov edx, str.:_User_chose_to_cancel_the_installation
mov ecx, eax
call fcn.00411050
push eax
call fcn.004113d0
mov byte [ebp - 4], 0x2e
jmp 0x42e44a
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 0x29
call fcn.0040ef30
lea ecx, [ebp - 0x26c]
call fcn.00467d30
mov edx, eax
mov byte [ebp - 4], 0x32
mov ecx, 0x50e6d0
call fcn.00411030
mov edx, str.C:JenkinsworkspaceMBAM_WindowsA_MB5_MBSetup_srcMBSetupMBSetup.cpp
mov ecx, eax
call fcn.00411050
mov edx, 0x4eb568
mov ecx, eax
call fcn.00411050
push 0x6c1
mov ecx, eax
call fcn.0040f7e0
mov edx, str.:_User_chose_to_continue_the_installation
mov ecx, eax
call fcn.00411050
push eax
call fcn.004113d0
add esp, 4
lea ecx, [ebp - 0x26c]
call fcn.00406550
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x11
call fcn.00404fe0
jmp 0x42e532
push 0
push 0x6a6
push dword [ebp - 0x18]
push dword [ebp - 0x20]
push 0
call fcn.00423940
push ecx
mov byte [ebp - 4], 0x30
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [ebp - 0x248]
call fcn.0040f9b0
lea ecx, [ebp - 0x26c]
call fcn.00467d30
mov edx, eax
mov byte [ebp - 4], 0x31
mov ecx, 0x50e6d0
call fcn.00411030
mov edx, str.C:JenkinsworkspaceMBAM_WindowsA_MB5_MBSetup_srcMBSetupMBSetup.cpp
mov ecx, eax
call fcn.00411050
mov edx, 0x4eb568
mov ecx, eax
call fcn.00411050
push 0x6b9
mov ecx, eax
call fcn.0040f7e0
mov edx, str.:_User_chose_to_cancel_the_installation
mov ecx, eax
call fcn.00411050
push eax
call fcn.004113d0
mov byte [ebp - 4], 0x30
add esp, 4
lea ecx, [ebp - 0x26c]
call fcn.00406550
xor edx, edx
mov ecx, esi
call fcn.00457f30
lea ecx, [ebp - 0x248]
call fcn.0040ef30
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], edi
dec edi
test edi, edi
jg 0x42e481
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, 0xcc
jmp 0x42eabe
lea ecx, [ebp - 0x26c]
call fcn.00467d30
mov byte [ebp - 4], 0x33
cmp dword [eax + 0x14], 7
mov ecx, dword [eax + 0x10]
jbe 0x42e4a5
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x50e6d0
call fcn.00412550
add esp, 4
mov edx, str.C:JenkinsworkspaceMBAM_WindowsA_MB5_MBSetup_srcMBSetupMBSetup.cpp
mov ecx, eax
call fcn.00411050
mov edx, 0x4eb568
mov ecx, eax
call fcn.00411050
push 0x6c6
mov ecx, eax
call fcn.0040f7e0
mov edx, str.:_All_installation_pre_checks_passed
mov ecx, eax
call fcn.00411050
push eax
call fcn.004113d0
mov byte [ebp - 4], 0x11
add esp, 4
mov ecx, dword [ebp - 0x258]
cmp ecx, 7
jbe 0x42e532
mov edx, dword [ebp - 0x26c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x42e528
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42ebb4
push ecx
push edx
call fcn.004906cd
add esp, 8
mov esi, 2
push ecx
mov edx, esi
call fcn.0040d780
add esp, 4
test al, al
jne 0x42e833
call fcn.00433b00
test al, al
jne 0x42e833
lea ecx, [ebp - 0x26c]
call fcn.00467d30
mov byte [ebp - 4], 0x34
cmp dword [eax + 0x14], 7
mov ecx, dword [eax + 0x10]
jbe 0x42e571
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x50e6d0
call fcn.00412550
add esp, 4
mov edx, str.C:JenkinsworkspaceMBAM_WindowsA_MB5_MBSetup_srcMBSetupMBSetup.cpp
mov ecx, eax
call fcn.00411050
mov edx, 0x4eb568
mov ecx, eax
call fcn.00411050
push 0x6ce
mov ecx, eax
call fcn.0040f7e0
mov edx, str.:_Warning___This_computer_appears_to_be_missing_patch_KB4474419
mov ecx, eax
call fcn.00411050
push eax
call fcn.004113d0
mov byte [ebp - 4], 0x11
add esp, 4
mov ecx, dword [ebp - 0x258]
cmp ecx, 7
jbe 0x42e5fe
mov edx, dword [ebp - 0x26c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x42e5f4
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42ebb4
push ecx
push edx
call fcn.004906cd
add esp, 8
cmp dword [0x50bdd4], 7
mov eax, 0x50bdc0
push str.MBRW_C
cmova eax, dword [0x50bdc0]
push eax
call fcn.0049a53c
add esp, 8
test eax, eax
je 0x42e696
cmp dword [0x50bdd4], 7
mov eax, 0x50bdc0
push str.MBRW_B
cmova eax, dword [0x50bdc0]
push eax
call fcn.0049a53c
add esp, 8
test eax, eax
je 0x42e696
cmp dword [0x50bdd4], 7
mov eax, 0x50bdc0
push str.MBAM_C
cmova eax, dword [0x50bdc0]
push eax
call fcn.0049a53c
add esp, 8
test eax, eax
je 0x42e696
cmp dword [0x50bdd4], 7
mov eax, 0x50bdc0
push str.MDAM_B
cmova eax, dword [0x50bdc0]
push eax
call fcn.0049a53c
add esp, 8
test eax, eax
jne 0x42e833
mov byte [ebp - 4], 0x35
call fcn.00404d30
mov ecx, eax
test ecx, ecx
je 0x42ebf0
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x20], eax
mov edx, 0xcc
mov byte [ebp - 4], 0x36
lea ecx, [ebp - 0x24]
call fcn.00455b60
mov byte [ebp - 4], 0x37
push dword [eax]
lea eax, [ebp - 0x20]
push str._s___prerequisite_failure_MissingSHA2CodeSigningSupportPatch
push eax
call fcn.00441620
mov byte [ebp - 4], 0x36
add esp, 0xc
mov edx, dword [ebp - 0x24]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42e6fc
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x20]
xor edx, edx
mov ecx, esi
call fcn.00457f30
cmp byte [0x50f942], 0
jne 0x42e787
push 0x130
lea eax, [ebp - 0x248]
push 0
push eax
call fcn.00492970
add esp, 0xc
mov eax, 0x50bdc0
cmp dword [0x50bdd4], 7
cmova eax, dword [0x50bdc0]
push str.MBRW_B
push eax
call fcn.0049a53c
add esp, 4
mov edx, str.https:__links.malwarebytes.com_support_mb_windows_system_requirements
test eax, eax
mov ecx, str.https:__links.malwarebytes.com_support_general_business_ms_2019_09_security_update
cmovne ecx, edx
push ecx
push 0x236e
push ecx
lea ecx, [ebp - 0x248]
call fcn.00423be0
push ecx
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [ebp - 0x248]
call fcn.0040f9b0
lea ecx, [ebp - 0x248]
call fcn.0040ef30
lea ecx, [ebp - 0x26c]
call fcn.00467d30
mov byte [ebp - 4], 0x38
cmp dword [eax + 0x14], 7
mov ecx, dword [eax + 0x10]
jbe 0x42e7a1
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x50e6d0
call fcn.00412550
add esp, 4
mov edx, str.C:JenkinsworkspaceMBAM_WindowsA_MB5_MBSetup_srcMBSetupMBSetup.cpp
mov ecx, eax
call fcn.00411050
mov edx, 0x4eb568
mov ecx, eax
call fcn.00411050
push 0x6df
mov ecx, eax
call fcn.0040f7e0
mov edx, str.:_Exit_due_to_missing_SHA_2_code_signing_support_patch__KB4474419_
mov ecx, eax
call fcn.00411050
push eax
call fcn.004113d0
mov ecx, dword [ebp - 0x258]
add esp, 4
cmp ecx, 7
jbe 0x42e46c
mov edx, dword [ebp - 0x26c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x42e824
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42ebb4
push ecx
push edx
call fcn.004906cd
add esp, 8
jmp 0x42e46c
cmp dword [0x50bd2c], 7
mov eax, 0x50bd18
push dword [0x50bd28]
cmova eax, dword [0x50bd18]
mov ecx, 0x50bf58
push eax
call fcn.0040db20
cmp byte [0x50f940], 0
setne byte [0x50f94c]
cmp byte [0x50f942], 0
jne 0x42ea05
lea ecx, [ebp - 0x26c]
call fcn.00467d30
mov byte [ebp - 4], 0x39
cmp dword [eax + 0x14], 7
mov ecx, dword [eax + 0x10]
jbe 0x42e88c
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x50e6d0
call fcn.00412550
add esp, 4
mov edx, str.C:JenkinsworkspaceMBAM_WindowsA_MB5_MBSetup_srcMBSetupMBSetup.cpp
mov ecx, eax
call fcn.00411050
mov edx, 0x4eb568
mov ecx, eax
call fcn.00411050
push 0x6fd
mov ecx, eax
call fcn.0040f7e0
mov edx, str.:_Displaying_User_Interface
mov ecx, eax
call fcn.00411050
push eax
call fcn.004113d0
mov byte [ebp - 4], 0x11
add esp, 4
mov ecx, dword [ebp - 0x258]
cmp ecx, 7
jbe 0x42e919
mov edx, dword [ebp - 0x26c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x42e90f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42ebb4
push ecx
push edx
call fcn.004906cd
add esp, 8
cmp byte [0x50f92e], 0
jne 0x42e985
lea ecx, [ebp - 0x26c]
call fcn.00467d30
mov edx, eax
mov byte [ebp - 4], 0x3a
mov ecx, 0x50e6d0
call fcn.00411030
mov edx, str.C:JenkinsworkspaceMBAM_WindowsA_MB5_MBSetup_srcMBSetupMBSetup.cpp
mov ecx, eax
call fcn.00411050
mov edx, 0x4eb568
mov ecx, eax
call fcn.00411050
push 0x701
mov ecx, eax
call fcn.0040f7e0
mov edx, str.:_Not_showing_BrowserGuard_screen
mov ecx, eax
call fcn.00411050
push eax
call fcn.004113d0
add esp, 4
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x26c]
call fcn.00406550
mov eax, 0x50f934
xchg dword [eax], esi
call fcn.00449cf0
mov edi, eax
test edi, edi
je 0x42e9ea
mov esi, dword [0x50f934]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0
call fcn.00404e30
push edi
push esi
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 0x3b
push str.changing_service_install_status_code_from__u_to__d
push eax
call fcn.00411010
push dword [ebp - 0x18]
mov edx, 0x715
mov ecx, 0x4ed3a8
call fcn.004474b0
add esp, 0x14
mov eax, 0x50f934
xchg dword [eax], edi
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x11
call fcn.00404fe0
jmp 0x42e9ef
call fcn.0045ad90
call fcn.00458800
mov edi, dword [0x50f934]
mov dword [ebp - 0x250], edi
jmp 0x42eac4
call fcn.0044bac0
mov al, byte [0x50f932]
test al, al
jne 0x42ea30
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
nop dword [eax]
push 0x3e8
call esi
mov al, byte [0x50f932]
test al, al
je 0x42ea20
mov eax, dword [0x50f934]
test eax, eax
je 0x42ea63
mov edx, dword [0x50f934]
lea ecx, [ebp - 0x24]
call fcn.00450190
mov byte [ebp - 4], 0x3c
xor edx, edx
mov ecx, dword [eax]
call fcn.00457f30
lea ecx, [ebp - 0x24]
call fcn.00404fe0
mov edi, 3
jmp 0x42eabe
mov al, byte [0x50f933]
test al, al
je 0x42ea81
call fcn.00428d10
test al, al
jne 0x42eab7
push 1
mov ecx, 0x50f92f
call fcn.0043d370
mov al, byte [0x50f931]
test al, al
je 0x42ea96
call fcn.00457660
call fcn.00433e80
jmp 0x42eabc
mov al, byte [0x50f92f]
test al, al
je 0x42eab2
xor edx, edx
mov ecx, str.Failed_to_download_and_run_offline_installer
call fcn.00457f30
mov edi, 3
jmp 0x42eabe
call fcn.0045ad90
call fcn.00457660
xor edi, edi
mov dword [ebp - 0x250], edi
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x64], vtable.InstalledProducts.0
call fcn.0045d760
mov esi, dword [ebp - 0x50]
test esi, esi
je 0x42eb53
mov eax, dword [ebp - 0x4c]
cmp esi, eax
je 0x42eafa
mov edi, eax
mov ecx, esi
call fcn.00436b60
add esi, 0x48
cmp esi, edi
jne 0x42eae3
mov esi, dword [ebp - 0x50]
mov edi, dword [ebp - 0x250]
mov ecx, dword [ebp - 0x48]
mov eax, 0x38e38e39
sub ecx, esi
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [eax + eax*8]
mov eax, esi
shl ecx, 3
cmp ecx, 0x1000
jb 0x42eb34
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42ebb4
push ecx
push esi
call fcn.004906cd
add esp, 8
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0
mov ecx, dword [ebp - 0x98]
cmp ecx, 7
jbe 0x42eb8f
mov edx, dword [ebp - 0xac]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x42eb85
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42ebb4
push ecx
push edx
call fcn.004906cd
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00490396
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.004958ff
call fcn.004958ff
call fcn.004958ff
push 0x80004005
call fcn.00404ea0
call fcn.0040ddc0
push 0x80004005
call fcn.00404ea0
call fcn.004131a0
push 0x80004005
call fcn.00404ea0
push 0x80004005
call fcn.00404ea0
push 0x80004005
call fcn.00404ea0
nop
and esp, eax
inc edx
add byte [ebx], dh
loopne 0x42ec45
add byte [ebx], dh
loopne 0x42ec49
add byte [ebx - 0x20], al
inc edx
add byte [ebx], dh
loopne 0x42ec51
add byte [ebx], dh
loopne 0x42ec55
add byte [ebx - 0x20], al
inc edx
add byte [ebx], dl
loopne 0x42ec5d
add ah, cl
int3
sub esp, 0x28
mov eax, dword [0x50b080]
xor eax, ebp
mov dword [ebp - 0x14], eax
xor byte [eax - 0x3accffb0], 0x89
inc ebp
in al, dx
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xorps xmm0, xmm0
mov dword [ebp - 0x24], 0
mov ecx, 7
hlt
push edi
rol bh, 0x45
fadd qword [eax]
add byte [eax], al
add byte [ecx + 7], bh
xor eax, eax
movups xmmword [ebp - 0x34], xmm0
mov dword [ebp - 0x20], ecx
mov word [ebp - 0x34], ax
mov dword [ebp - 4], eax
mov edx, dword [0x50bd28]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 0x50c4f0
test edx, edx
jne 0x42ec94
mov byte [ebp - 0x35], dl
jmp 0x42eccf
cmp dword [0x50bd2c], 7
lea ecx, [ebp - 0x34]
mov eax, 0x50bd18
cmova eax, dword [0x50bd18]
push edx
push eax
call fcn.0040db20
push str.MBAMService.exe
lea ecx, [ebp - 0x34]
call fcn.00441820
lea edx, [ebp - 0x1c]
lea ecx, [ebp - 0x34]
call fcn.0041cca0
mov ecx, dword [ebp - 0x20]
mov byte [ebp - 0x35], al
cmp ecx, 7
jbe 0x42ed02
mov edx, dword [ebp - 0x34]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x42ecf8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42ed21
push ecx
push edx
call fcn.004906cd
add esp, 8
mov al, byte [ebp - 0x35]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00490396
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.004958ff
int3