Function at 0x4249e0
Capabilities:
Create process on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49c4b1
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0xcc8
mov eax, dword [0x4cb06c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xac8], 0
xor eax, eax
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 7
mov word [ebp - 0x68], ax
lea edx, [ebp - 0x68]
mov dword [ebp - 4], eax
call fcn.00421670
test al, al
jne 0x424aff
lea ecx, [ebp - 0xb28]
call fcn.0044e680
mov byte [ebp - 4], 1
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x424a6c
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4cf1e0
call fcn.0040bda0
add esp, 4
mov edx, str.d:jenkinsworkspace_a_mb4_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040ab10
mov edx, str.:.
mov ecx, eax
call fcn.0040ab10
push 0x4fb
mov ecx, eax
call fcn.00407be0
mov edx, str.:_Error___could_not_determine_install_and_or_data_directories
mov ecx, eax
call fcn.0040ab10
push eax
call fcn.0040ae80
mov edx, dword [ebp - 0xb14]
add esp, 4
cmp edx, 8
jb 0x424af5
mov ecx, dword [ebp - 0xb28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x424aeb
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4260b8
push edx
push ecx
call fcn.0045d989
add esp, 8
mov edi, 3
jmp 0x426062
cmp dword [ebp - 0x54], 8
lea eax, [ebp - 0x68]
push dword [ebp - 0x58]
cmovae eax, dword [ebp - 0x68]
mov esi, 0x4cbc38
push eax
mov ecx, esi
call fcn.00407780
cmp byte [0x4d0662], 0
je 0x424b53
cmp esi, 0x4cbc50
je 0x424b4c
cmp dword [0x4cbc64], 8
mov eax, 0x4cbc50
push dword [0x4cbc60]
cmovae eax, dword [0x4cbc50]
mov ecx, esi
push eax
call fcn.00407780
mov byte [0x4d0645], 1
push 6
xor eax, eax
mov dword [ebp - 0xae8], 0
push 0x4b15a8
lea ecx, [ebp - 0xaf8]
mov dword [ebp - 0xae4], 7
mov word [ebp - 0xaf8], ax
call fcn.00407780
push ecx
mov edx, 1
call fcn.004379b0
mov edx, dword [ebp - 0xae4]
add esp, 4
cmp al, 1
setne al
mov byte [ebp - 0xac1], al
cmp edx, 8
jb 0x424be1
mov ecx, dword [ebp - 0xaf8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x424bd1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4260bd
push edx
push ecx
call fcn.0045d989
mov al, byte [ebp - 0xac1]
add esp, 8
test al, al
je 0x424d01
cmp byte [0x4d0655], 0
jne 0x424cf7
lea ecx, [ebp - 0xb40]
call fcn.0044e680
mov byte [ebp - 4], 2
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x424c10
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4cf1e0
call fcn.0040bda0
add esp, 4
mov edx, str.d:jenkinsworkspace_a_mb4_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040ab10
mov edx, str.:.
mov ecx, eax
call fcn.0040ab10
push 0x50b
mov ecx, eax
call fcn.00407be0
mov edx, 0x4b1c08
mov ecx, eax
call fcn.0040ab10
mov edx, str.Exit_due_to_invalid_operating_system_version
mov ecx, eax
call fcn.0040ab10
push eax
call fcn.0040ae80
mov edx, dword [ebp - 0xb2c]
add esp, 4
cmp edx, 8
jb 0x424ca5
mov ecx, dword [ebp - 0xb40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x424c9b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4260c2
push edx
push ecx
call fcn.0045d989
add esp, 8
push 0x12c
lea eax, [ebp - 0x730]
push 0
push eax
call fcn.00475700
add esp, 8
lea ecx, [ebp - 0x730]
push 0
push 0xff
push 0x100
push 0x101
push 1
call fcn.0041d130
push ecx
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [ebp - 0x730]
call fcn.0040f450
lea ecx, [ebp - 0x730]
call fcn.0040ec00
mov edi, 0xc8
jmp 0x426062
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
movq qword [ebp - 0x24], xmm0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov byte [ebp - 4], 3
call fcn.00420560
test al, al
je 0x424fd5
cmp byte [0x4d0655], 0
jne 0x424fd5
call fcn.0042c880
test al, al
je 0x424fd5
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x20]
je 0x424fd5
push str.https:__links.malwarebytes.com_support_installer_AVBlocking
lea ecx, [ebp - 0x80]
call fcn.004048f0
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x24]
cmp dword [eax + 0x40], 0
je 0x424d85
add eax, 0x30
lea ecx, [ebp - 0x80]
push eax
call fcn.00417430
mov eax, dword [ebp - 0x24]
push eax
mov edx, str.We_have_detected
lea ecx, [ebp - 0xb58]
call fcn.00435ac0
add esp, 4
push str._installed_on_your_computer._This_product_may_interfere_with
mov edx, eax
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xb10]
call fcn.00435780
add esp, 4
push str.the_installation_of_Malwarebytes._Please_click_Yes_to_find_out_how_to_safely_install_Malwarebytes._You_can_click_No_to_proceed_with_installation__or_Cancel_to_exit.
mov edx, eax
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x50]
call fcn.00435780
mov byte [ebp - 4], 5
add esp, 4
mov edx, dword [ebp - 0xafc]
cmp edx, 8
jb 0x424e0c
mov ecx, dword [ebp - 0xb10]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x424e02
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4260c7
push edx
push ecx
call fcn.0045d989
add esp, 8
xor eax, eax
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0xb44]
mov dword [ebp - 0xb00], 0
mov dword [ebp - 0xafc], 7
mov word [ebp - 0xb10], ax
cmp edx, 8
jb 0x424e6d
mov ecx, dword [ebp - 0xb58]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x424e63
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4260cc
push edx
push ecx
call fcn.0045d989
add esp, 8
cmp dword [ebp - 0x3c], 8
lea eax, [ebp - 0x50]
push 3
cmovae eax, dword [ebp - 0x50]
push str.Malwarebytes_Installer
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x424eab
cmp dword [ebp - 0x6c], 8
lea eax, [ebp - 0x80]
push 5
cmovae eax, dword [ebp - 0x80]
push 0
push 0
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x424eb4
cmp eax, 2
jne 0x424f49
mov edx, dword [ebp - 0x3c]
cmp edx, 8
jb 0x424eee
mov ecx, dword [ebp - 0x50]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x424ee4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4260d1
push edx
push ecx
call fcn.0045d989
add esp, 8
mov edx, dword [ebp - 0x6c]
xor eax, eax
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 7
mov word [ebp - 0x50], ax
cmp edx, 8
jb 0x424f3c
mov ecx, dword [ebp - 0x80]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x424f32
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4260d6
push edx
push ecx
call fcn.0045d989
add esp, 8
mov edi, 0xcb
mov dword [ebp - 0x18], edi
jmp 0x425fcf
mov edx, dword [ebp - 0x3c]
cmp edx, 8
jb 0x424f83
mov ecx, dword [ebp - 0x50]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x424f79
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4260db
push edx
push ecx
call fcn.0045d989
add esp, 8
xor eax, eax
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x6c]
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 7
mov word [ebp - 0x50], ax
cmp edx, 8
jb 0x424fd5
mov ecx, dword [ebp - 0x80]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x424fcb
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4260e0
push edx
push ecx
call fcn.0045d989
add esp, 8
xorps xmm0, xmm0
movups xmmword [ebp - 0x38], xmm0
mov dword [ebp - 0x38], vtable.InstalledProducts.0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
push 0
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 7
call fcn.00451950
push 1
lea ecx, [ebp - 0x38]
call fcn.00451950
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xae0]
push 6
xor eax, eax
mov dword [ebp - 0xad0], 0
push 0x4b15a8
mov dword [ebp - 0xacc], 7
mov word [ebp - 0xae0], ax
call fcn.00407780
mov byte [ebp - 4], 9
lea edx, [ebp - 0x38]
lea ecx, [ebp - 0xae0]
mov dword [ebp - 0xac8], 1
call fcn.0044e110
test al, al
je 0x42509a
cmp dword [0x4cbcdc], 8
mov eax, 0x4cbcc8
push str.MBRW_C
cmovae eax, dword [0x4cbcc8]
push eax
call fcn.004816eb
add esp, 8
test eax, eax
jne 0x425091
call fcn.0044df90
test al, al
jne 0x42509a
mov byte [ebp - 0xac1], 0
jmp 0x4250a1
mov byte [ebp - 0xac1], 1
mov dword [ebp - 4], 8
mov edx, dword [ebp - 0xacc]
cmp edx, 8
jb 0x4250e8
mov ecx, dword [ebp - 0xae0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4250de
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4260e5
push edx
push ecx
call fcn.0045d989
add esp, 8
cmp byte [ebp - 0xac1], 0
je 0x425201
cmp byte [0x4d0655], 0
jne 0x4251f7
lea ecx, [ebp - 0xb88]
call fcn.0044e680
mov byte [ebp - 4], 0xa
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x42511c
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4cf1e0
call fcn.0040bda0
add esp, 4
mov edx, str.d:jenkinsworkspace_a_mb4_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040ab10
mov edx, str.:.
mov ecx, eax
call fcn.0040ab10
push 0x535
mov ecx, eax
call fcn.00407be0
mov edx, str.:_Exit_due_to_other_products_installed
mov ecx, eax
call fcn.0040ab10
push eax
call fcn.0040ae80
mov edx, dword [ebp - 0xb74]
add esp, 4
cmp edx, 8
jb 0x4251a5
mov ecx, dword [ebp - 0xb88]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42519b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4260ea
push edx
push ecx
call fcn.0045d989
add esp, 8
push 0x12c
lea eax, [ebp - 0x600]
push 0
push eax
call fcn.00475700
add esp, 8
lea ecx, [ebp - 0x600]
push 0
push 0xff
push 0xfc
push 0xfd
push 1
call fcn.0041d130
push ecx
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [ebp - 0x600]
call fcn.0040f450
lea ecx, [ebp - 0x600]
call fcn.0040ec00
mov edi, 0xc9
jmp 0x425fc4
call fcn.004204e0
test al, al
jne 0x42530a
mov edi, dword [ebp - 0x30]
mov esi, dword [ebp - 0x34]
cmp esi, edi
je 0x425305
add esi, 0x1c
nop
lea eax, [esi - 0x18]
mov dword [ebp - method.InstalledProducts::InstalledProduct.virtual_0], vtable.InstalledProducts::InstalledProduct.0
push eax
lea ecx, [ebp - 0x13c]
call fcn.00417ca0
push esi
lea ecx, [ebp - 0x124]
mov byte [ebp - 4], 0xb
call fcn.00417ca0
lea eax, [esi + 0x18]
mov byte [ebp - 4], 0xc
push eax
lea ecx, [ebp - 0x10c]
call fcn.00417ca0
lea eax, [esi + 0x30]
mov byte [ebp - 4], 0xd
push eax
lea ecx, [ebp - 0xf4]
call fcn.00417ca0
mov al, byte [esi + 0x48]
mov byte [ebp - 0xdc], al
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x124]
cmp dword [ebp - 0x110], 8
cmovae ecx, dword [ebp - 0x124]
cmp dword [ebp - 0x114], 0x19
jb 0x4252e8
push 0x19
mov edx, str.Malwarebytes_Anti_Malware
call fcn.004173d0
add esp, 4
test eax, eax
jne 0x4252e8
sub esp, 0x18
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x10c]
mov ecx, esp
push eax
call fcn.00417ca0
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0xa0]
push eax
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00452150
cmp dword [ebp - 0x18], 2
jbe 0x4253da
lea ecx, [ebp - 0x140]
mov byte [ebp - 4], 8
call fcn.00451710
add esi, 0x68
lea eax, [esi - 0x1c]
cmp eax, edi
jne 0x425220
mov esi, 0x4cbc38
call fcn.004204e0
test al, al
jne 0x42555b
lea ecx, [ebp - 0x38]
call fcn.00452920
test al, al
je 0x42555b
cmp byte [0x4d0655], 0
jne 0x4254eb
lea ecx, [ebp - 0xba0]
call fcn.0044e680
mov byte [ebp - 4], 0x10
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x42534e
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4cf1e0
call fcn.0040bda0
add esp, 4
mov edx, str.d:jenkinsworkspace_a_mb4_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040ab10
mov edx, str.:.
mov ecx, eax
call fcn.0040ab10
push 0x54e
mov ecx, eax
call fcn.00407be0
mov edx, str.:_Exit_due_to_newer__5.0_or_later__version_of_MBAM_installed
mov ecx, eax
call fcn.0040ab10
push eax
call fcn.0040ae80
mov edx, dword [ebp - 0xb8c]
add esp, 4
cmp edx, 8
jb 0x4254ff
mov ecx, dword [ebp - 0xba0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4254f5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4260ef
jmp 0x4254f5
lea ecx, [ebp - 0x140]
mov byte [ebp - 4], 8
call fcn.00451710
cmp byte [0x4d0655], 0
jne 0x4254eb
lea ecx, [ebp - 0xb70]
call fcn.0044e680
mov byte [ebp - 4], 0xf
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x425410
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4cf1e0
call fcn.0040bda0
add esp, 4
mov edx, str.d:jenkinsworkspace_a_mb4_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040ab10
mov edx, str.:.
mov ecx, eax
call fcn.0040ab10
push 0x541
mov ecx, eax
call fcn.00407be0
mov edx, str.:_Exit_due_to_old_version_of_MBAM_installed
mov ecx, eax
call fcn.0040ab10
push eax
call fcn.0040ae80
mov edx, dword [ebp - 0xb5c]
add esp, 4
cmp edx, 8
jb 0x425499
mov ecx, dword [ebp - 0xb70]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42548f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4260f4
push edx
push ecx
call fcn.0045d989
add esp, 8
push 0x12c
lea eax, [ebp - 0x860]
push 0
push eax
call fcn.00475700
add esp, 8
lea ecx, [ebp - 0x860]
push 0
push 0xff
push 0xfa
push 0xfb
push 1
call fcn.0041d130
push ecx
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [ebp - 0x860]
call fcn.0040f450
lea ecx, [ebp - 0x860]
call fcn.0040ec00
mov edi, 0xca
jmp 0x425fc4
push edx
push ecx
call fcn.0045d989
add esp, 8
push 0x12c
lea eax, [ebp - 0x990]
push 0
push eax
call fcn.00475700
add esp, 8
lea ecx, [ebp - 0x990]
push 0
push 0xff
push 0x10a
push 0xfd
push 1
call fcn.0041d130
push ecx
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [ebp - 0x990]
call fcn.0040f450
lea ecx, [ebp - 0x990]
call fcn.0040ec00
mov edi, 0xca
jmp 0x425fc4
lea ecx, [ebp - 0x38]
call fcn.00452400
mov edi, 0x4cbaa5
test al, al
je 0x4256c7
call fcn.004204e0
test al, al
je 0x4255e2
cmp byte [0x4d0655], 0
jne 0x4254eb
push 0x12c
lea eax, [ebp - 0xac0]
push 0
push eax
call fcn.00475700
add esp, 8
lea ecx, [ebp - 0xac0]
push 0
push 0xff
push 0xdd
push 0xde
push 1
call fcn.0041d130
push ecx
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [ebp - 0xac0]
call fcn.0040f450
lea ecx, [ebp - 0xac0]
call fcn.0040ec00
mov edi, 0xca
jmp 0x425fc4
mov byte [0x4d064e], 1
call fcn.004203d0
xor al, al
xchg byte [edi], al
xor eax, eax
mov dword [ebp - 0xac], 0
mov dword [ebp - 0xa8], 7
mov word [ebp - 0xbc], ax
lea eax, [ebp - 0xbc]
mov byte [ebp - 4], 0x11
push eax
lea ecx, [ebp - 0x38]
call fcn.004531f0
lea eax, [ebp - 0xbc]
mov ecx, esi
push eax
call fcn.004358b0
push 0x4cbc38
lea ecx, [ebp - 0x98]
call fcn.00417ca0
mov byte [ebp - 4], 0x12
mov eax, dword [ebp - 0x88]
test eax, eax
je 0x4256a2
dec eax
lea ecx, [ebp - 0x98]
push eax
call fcn.00431aa0
cmp word [eax], 0x5c
jne 0x4256a2
mov eax, dword [ebp - 0x88]
lea ecx, [ebp - 0x98]
dec eax
push eax
push 0
lea eax, [ebp - 0xc30]
push eax
call fcn.00417800
push eax
lea ecx, [ebp - 0x98]
call fcn.0040d090
lea ecx, [ebp - 0xc30]
call fcn.00404b20
lea eax, [ebp - 0x98]
mov ecx, esi
push eax
call fcn.004358b0
xor al, al
mov ecx, 0x4cbaa6
xchg byte [ecx], al
lea ecx, [ebp - 0x98]
call fcn.00404b20
lea ecx, [ebp - 0xbc]
mov byte [ebp - 4], 8
call fcn.00404b20
jmp 0x4256ce
mov byte [0x4d0646], 1
lea ecx, [ebp - 0x38]
call fcn.00452690
cmp dword [0x4cbcdc], 8
mov byte [0x4d0644], al
mov eax, 0x4cbcc8
cmovae eax, dword [0x4cbcc8]
push str.NCEP_WIN
push eax
call fcn.004816eb
add esp, 8
test eax, eax
je 0x425711
call fcn.004204e0
test al, al
jne 0x425711
cmp byte [0x4d0651], al
je 0x425715
xor al, al
xchg byte [edi], al
cmp byte [0x4d0653], 0
je 0x425794
lea ecx, [ebp - 0xc60]
call fcn.0044e680
mov byte [ebp - 4], 0x13
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x425738
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4cf1e0
call fcn.0040bda0
add esp, 4
mov edx, str.d:jenkinsworkspace_a_mb4_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040ab10
mov edx, str.:.
mov ecx, eax
call fcn.0040ab10
push 0x57e
mov ecx, eax
call fcn.00407be0
mov edx, str.:_MB_Teams___MDAM_B_implied_by_filename_or_cmd_line_option
mov ecx, eax
call fcn.0040ab10
push eax
call fcn.0040ae80
add esp, 4
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xc60]
call fcn.00404b20
xor al, al
xchg byte [edi], al
call fcn.00423f20
mov esi, dword [sym.imp.USER32.dll_GetActiveWindow]
test eax, eax
je 0x425a9f
cmp byte [0x4d0655], 0
je 0x42581b
lea ecx, [ebp - 0xc78]
call fcn.0044e680
mov byte [ebp - 4], 0x14
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x4257ca
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4cf1e0
call fcn.0040bda0
add esp, 4
mov edx, str.d:jenkinsworkspace_a_mb4_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040ab10
mov edx, str.:.
mov ecx, eax
call fcn.0040ab10
push 0x588
mov ecx, eax
call fcn.00407be0
mov edx, str.:_Pre_check_s__failed_but_in_silent_mode___will_try_to_continue_the_installation
mov ecx, eax
call fcn.0040ab10
push eax
call fcn.0040ae80
lea ecx, [ebp - 0xc78]
jmp 0x425b05
add eax, 0xfffffffe
cmp eax, 7
ja case.0x425823.5
jmp dword [eax*4 + 0x426104]
mov esi, 0xfe
mov byte [ebp - 0xac1], 0
jmp 0x425860
mov esi, 0xf5
mov byte [ebp - 0xac1], 0
jmp 0x425860
mov esi, 0xf6
mov byte [ebp - 0xac1], 0
jmp 0x425860
mov esi, 0xf7
mov byte [ebp - 0xac1], 1
mov edi, 0x80
call fcn.004204e0
test al, al
mov ecx, 0xf1
mov eax, 0x103
cmovne edi, ecx
cmp byte [0x4d0653], 0
push 0x12c
cmovne edi, eax
cmp byte [ebp - 0xac1], 0
push 0
je 0x4259e0
lea eax, [ebp - 0x270]
push eax
call fcn.00475700
add esp, 8
lea ecx, [ebp - 0x270]
push 0xf8
push 0x109
push esi
push edi
push 0
call fcn.0041d130
mov byte [ebp - 4], 0x15
mov esi, dword [sym.imp.USER32.dll_GetActiveWindow]
push ecx
call esi
push eax
lea ecx, [ebp - 0x270]
call fcn.0040f450
cmp eax, 0x6a8
jne 0x425966
lea ecx, [ebp - 0xc90]
call fcn.0044e680
mov byte [ebp - 4], 0x16
cmp dword [eax + 0x14], 8
mov esi, dword [eax + 0x10]
jb 0x4258fd
mov eax, dword [eax]
push esi
mov edx, eax
mov ecx, 0x4cf1e0
call fcn.0040bda0
add esp, 4
mov edx, str.d:jenkinsworkspace_a_mb4_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040ab10
mov edx, str.:.
mov ecx, eax
call fcn.0040ab10
push 0x59a
mov ecx, eax
call fcn.00407be0
mov edx, str.:_User_chose_to_cancel_the_installation
mov ecx, eax
call fcn.0040ab10
push eax
call fcn.0040ae80
add esp, 4
lea ecx, [ebp - 0xc90]
call fcn.00404b20
lea ecx, [ebp - 0x270]
call fcn.0040ec00
mov edi, 0xcc
jmp 0x425fc4
lea ecx, [ebp - 0x270]
mov byte [ebp - 4], 8
call fcn.0040ec00
lea ecx, [ebp - 0xca8]
call fcn.0044e680
mov byte [ebp - 4], 0x19
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x42598f
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4cf1e0
call fcn.0040bda0
add esp, 4
mov edx, str.d:jenkinsworkspace_a_mb4_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040ab10
mov edx, str.:.
mov ecx, eax
call fcn.0040ab10
push 0x5a6
mov ecx, eax
call fcn.00407be0
mov edx, str.:_User_chose_to_continue_the_installation
mov ecx, eax
call fcn.0040ab10
push eax
call fcn.0040ae80
lea ecx, [ebp - 0xca8]
jmp 0x425b05
lea eax, [ebp - 0x3a0]
push eax
call fcn.00475700
add esp, 8
lea ecx, [ebp - 0x3a0]
push 0
push 0xff
push esi
push edi
push 0
call fcn.0041d130
push ecx
mov byte [ebp - 4], 0x17
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [ebp - 0x3a0]
call fcn.0040f450
lea ecx, [ebp - 0xcc0]
call fcn.0044e680
mov byte [ebp - 4], 0x18
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x425a36
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4cf1e0
call fcn.0040bda0
add esp, 4
mov edx, str.d:jenkinsworkspace_a_mb4_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040ab10
mov edx, str.:.
mov ecx, eax
call fcn.0040ab10
push 0x5a2
mov ecx, eax
call fcn.00407be0
mov edx, str.:_User_chose_to_cancel_the_installation
mov ecx, eax
call fcn.0040ab10
push eax
call fcn.0040ae80
add esp, 4
lea ecx, [ebp - 0xcc0]
call fcn.00404b20
lea ecx, [ebp - 0x3a0]
call fcn.0040ec00
mov edi, 0xcc
jmp 0x425fc4
lea ecx, [ebp - 0xbb8]
call fcn.0044e680
mov byte [ebp - 4], 0x1a
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x425ab9
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4cf1e0
call fcn.0040bda0
add esp, 4
mov edx, str.d:jenkinsworkspace_a_mb4_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040ab10
mov edx, str.:.
mov ecx, eax
call fcn.0040ab10
push 0x5ab
mov ecx, eax
call fcn.00407be0
mov edx, str.:_All_installation_pre_checks_passed
mov ecx, eax
call fcn.0040ab10
push eax
call fcn.0040ae80
lea ecx, [ebp - 0xbb8]
add esp, 4
mov byte [ebp - 4], 8
call fcn.00404b20
push ecx
mov edx, 2
call fcn.004379b0
add esp, 4
test al, al
jne 0x425de3
call fcn.00429ae0
test al, al
jne 0x425de3
lea ecx, [ebp - 0xbd0]
call fcn.0044e680
mov byte [ebp - 4], 0x1b
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x425b4e
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4cf1e0
call fcn.0040bda0
add esp, 4
mov edx, str.d:jenkinsworkspace_a_mb4_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040ab10
mov edx, str.:.
mov ecx, eax
call fcn.0040ab10
push 0x5b3
mov ecx, eax
call fcn.00407be0
mov edx, str.:_Warning___This_computer_appears_to_be_missing_patch_KB4474419
mov ecx, eax
call fcn.0040ab10
push eax
call fcn.0040ae80
add esp, 4
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xbd0]
call fcn.00404b20
call fcn.004204e0
test al, al
jne 0x425bbc
call fcn.00420560
test al, al
je 0x425de3
call fcn.00447c30
test al, al
je 0x425c2d
lea ecx, [ebp - 0xbe8]
call fcn.0044e680
mov byte [ebp - 4], 0x1c
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x425bdf
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4cf1e0
call fcn.0040bda0
add esp, 4
mov edx, str.d:jenkinsworkspace_a_mb4_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040ab10
mov edx, str.:.
mov ecx, eax
call fcn.0040ab10
push 0x5b8
mov ecx, eax
call fcn.00407be0
mov edx, str.:_Successfully_sent_SHA_2_code_signing_patch_telemetry
mov ecx, eax
call fcn.0040ab10
push eax
call fcn.0040ae80
lea ecx, [ebp - 0xbe8]
jmp 0x425c93
lea ecx, [ebp - 0xc00]
call fcn.0044e680
mov byte [ebp - 4], 0x1d
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x425c47
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4cf1e0
call fcn.0040bda0
add esp, 4
mov edx, str.d:jenkinsworkspace_a_mb4_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040ab10
mov edx, str.:.
mov ecx, eax
call fcn.0040ab10
push 0x5bc
mov ecx, eax
call fcn.00407be0
mov edx, str.:_ERROR:_Failed_to_send_SHA_2_code_signing_patch_telemetry
mov ecx, eax
call fcn.0040ab10
push eax
call fcn.0040ae80
lea ecx, [ebp - 0xc00]
add esp, 4
mov byte [ebp - 4], 8
call fcn.00404b20
cmp byte [0x4d0655], 0
jne 0x425d6b
push 0x12c
lea eax, [ebp - 0x4d0]
push 0
push eax
call fcn.00475700
add esp, 8
lea ecx, [ebp - 0x4d0]
push 0xf8
push 0x109
push 0xf9
push 0x80
push 1
call fcn.0041d130
push ecx
mov byte [ebp - 4], 0x1e
call esi
push eax
lea ecx, [ebp - 0x4d0]
call fcn.0040f450
cmp eax, 0x6a7
jne 0x425d5c
push str.https:__links.malwarebytes.com_support_mb_windows_system_requirements
lea ecx, [ebp - 0xd4]
call fcn.004048f0
mov byte [ebp - 4], 0x1f
call fcn.004204b0
test al, al
je 0x425d2c
push 0x52
push str.https:__links.malwarebytes.com_support_general_business_ms_2019_09_security_update
lea ecx, [ebp - 0xd4]
call fcn.00407780
cmp dword [ebp - 0xc0], 8
lea eax, [ebp - 0xd4]
push 5
cmovae eax, dword [ebp - 0xd4]
push 0
push 0
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0xd4]
call fcn.00404b20
lea ecx, [ebp - 0x4d0]
mov byte [ebp - 4], 8
call fcn.0040ec00
lea ecx, [ebp - 0xc18]
call fcn.0044e680
mov byte [ebp - 4], 0x20
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x425d85
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4cf1e0
call fcn.0040bda0
add esp, 4
mov edx, str.d:jenkinsworkspace_a_mb4_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040ab10
mov edx, str.:.
mov ecx, eax
call fcn.0040ab10
push 0x5ce
mov ecx, eax
call fcn.00407be0
mov edx, str.:_Exit_due_to_missing_SHA_2_code_signing_support_patch__KB4474419_
mov ecx, eax
call fcn.0040ab10
push eax
call fcn.0040ae80
add esp, 4
lea ecx, [ebp - 0xc18]
call fcn.00404b20
mov edi, 0xcc
jmp 0x425fc4
push 0x4cbc38
mov ecx, 0x4cbe78
call fcn.00417430
cmp byte [0x4d0653], 0
setne byte [0x4d065f]
cmp byte [0x4d0655], 0
jne 0x425f6c
lea ecx, [ebp - 0xcd8]
call fcn.0044e680
mov byte [ebp - 4], 0x21
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x425e27
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4cf1e0
call fcn.0040bda0
add esp, 4
mov edx, str.d:jenkinsworkspace_a_mb4_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040ab10
mov edx, str.:.
mov ecx, eax
call fcn.0040ab10
push 0x5e4
mov ecx, eax
call fcn.00407be0
mov edx, str.:_Displaying_User_Interface
mov ecx, eax
call fcn.0040ab10
push eax
call fcn.0040ae80
add esp, 4
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xcd8]
call fcn.00404b20
cmp byte [0x4d064c], 0
jne 0x425efa
lea ecx, [ebp - 0xc48]
call fcn.0044e680
mov byte [ebp - 4], 0x22
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x425ea2
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4cf1e0
call fcn.0040bda0
add esp, 4
mov edx, str.d:jenkinsworkspace_a_mb4_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040ab10
mov edx, str.:.
mov ecx, eax
call fcn.0040ab10
push 0x5e8
mov ecx, eax
call fcn.00407be0
mov edx, str.:_Not_showing_BrowserGuard_option_dialog_box
mov ecx, eax
call fcn.0040ab10
push eax
call fcn.0040ae80
add esp, 4
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xc48]
call fcn.00404b20
call fcn.0043de90
push dword [0x4d06b8]
lea ecx, [ebp - 0x28]
mov byte [ebp - 0xac1], al
mov dword [ebp - 0x28], 0
call fcn.004318d0
mov byte [ebp - 4], 0x23
mov ecx, 0x4cbce0
cmp dword [0x4cbcf4], 0x10
mov edx, str.SendShutdownTelemetry
push dword [ebp - 0x28]
cmovae ecx, dword [0x4cbce0]
call fcn.004496c0
movzx edi, byte [ebp - 0xac1]
add esp, 4
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x18], edi
add edx, 0xfffffff0
mov byte [ebp - 4], 0x24
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x425fc7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x425fc7
call fcn.0043f820
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
mov al, byte [0x4d06ad]
test al, al
jne 0x425f89
push 0x3e8
call esi
jmp 0x425f77
mov eax, dword [0x4d06b0]
test eax, eax
je 0x425f99
mov edi, 3
jmp 0x425fc4
mov al, byte [0x4d06ac]
test al, al
je 0x425fb4
call fcn.004212b0
test al, al
jne 0x425fc2
mov al, 1
mov ecx, 0x4d06b4
xchg byte [ecx], al
mov al, byte [0x4d06ae]
test al, al
je 0x426033
call fcn.00429e50
xor edi, edi
mov dword [ebp - 0x18], edi
lea ecx, [ebp - 0x38]
call fcn.004518c0
mov esi, dword [ebp - 0x24]
test esi, esi
je 0x426062
mov eax, dword [ebp - 0x20]
cmp esi, eax
je 0x425ff7
mov edi, eax
mov ecx, esi
call fcn.0042ce00
add esi, 0x48
cmp esi, edi
jne 0x425fe3
mov esi, dword [ebp - 0x24]
mov edi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov eax, 0x38e38e39
sub ecx, esi
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [eax + eax*8]
mov eax, esi
shl ecx, 3
cmp ecx, 0x1000
jb 0x426043
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4260f9
jmp 0x426043
mov al, byte [0x4d06b4]
test al, al
je 0x425fc2
mov edi, 3
jmp 0x425fc4
push ecx
push esi
call fcn.0045d989
add esp, 8
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov edx, dword [ebp - 0x54]
cmp edx, 8
jb 0x426098
mov ecx, dword [ebp - 0x68]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42608e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4260fe
push edx
push ecx
call fcn.0045d989
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0045d468
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.004786bc
call fcn.004786bc
call fcn.004786bc
call fcn.004786bc
call fcn.004786bc
call fcn.004786bc
call fcn.004786bc
call fcn.004786bc
call fcn.004786bc
call fcn.004786bc
call fcn.004786bc
call fcn.004786bc
call fcn.004786bc
call fcn.004786bc
call fcn.004786bc
nop
cmp byte [eax + 0x42], bl
add byte [esi + 88], al
inc edx
add byte [esi + 0x58], al
inc edx
add byte [eax + ebx*2 + 0x42], dl
add byte [esi + 0x58], al
inc edx
add byte [esi + 0x58], al
inc edx
add byte [eax + ebx*2 + 0x42], dl
add byte [edx], ch
pop eax
inc edx
add ah, cl
int3