Function at 0x43ba30
Capabilities:
Delete file

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4becc2
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x2c0
mov eax, dword [0x50c080]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp byte [0x510935], 0
jne 0x43c040
lea ecx, [ebp - 0x54]
call fcn.00467cf0
mov dword [ebp - 4], 0
cmp dword [eax + 0x14], 7
mov ecx, dword [eax + 0x10]
jbe 0x43ba98
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x50f6d0
call fcn.00412550
add esp, 4
mov edx, str.C:JenkinsworkspaceMBAM_WindowsA_MB5_MBSetup_srcMBSetupMBSetup.cpp
mov ecx, eax
call fcn.00411050
mov edx, 0x4ec568
mov ecx, eax
call fcn.00411050
push 0xfbe
mov ecx, eax
call fcn.0040f7e0
mov edx, str.:_Looking_for_Privacy_VPN
mov ecx, eax
call fcn.00411050
push eax
call fcn.004113d0
mov dword [ebp - 4], 0xffffffff
add esp, 4
mov ecx, dword [ebp - 0x40]
cmp ecx, 7
jbe 0x43bb22
mov edx, dword [ebp - 0x54]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x43bb18
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43c05e
push ecx
push edx
call fcn.00490f7d
add esp, 8
xorps xmm0, xmm0
movups xmmword [ebp - 0x3c], xmm0
mov dword [ebp - 0x3c], vtable.InstalledProducts.0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
push 0
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], 1
call fcn.0046d650
push 1
lea ecx, [ebp - 0x3c]
call fcn.0046d650
mov dword [ebp - 4], 2
cmp byte [0x51093e], 0
jne 0x43c031
lea ecx, [ebp - 0x3c]
call fcn.0046ea20
test al, al
je 0x43c031
lea ecx, [ebp - 0x2c]
xor esi, esi
call fcn.00467cf0
mov byte [ebp - 4], 3
cmp dword [eax + 0x14], 7
mov ecx, dword [eax + 0x10]
jbe 0x43bb9d
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x50f6d0
call fcn.00412550
add esp, 4
mov edx, str.C:JenkinsworkspaceMBAM_WindowsA_MB5_MBSetup_srcMBSetupMBSetup.cpp
mov ecx, eax
call fcn.00411050
mov edx, 0x4ec568
mov ecx, eax
call fcn.00411050
push 0xfc4
mov ecx, eax
call fcn.0040f7e0
mov edx, str.:_Found_Privacy_VPN._Redirecting_to_MB4_installer.
mov ecx, eax
call fcn.00411050
push eax
call fcn.004113d0
mov byte [ebp - 4], 2
add esp, 4
mov ecx, dword [ebp - 0x18]
cmp ecx, 7
jbe 0x43bc24
mov edx, dword [ebp - 0x2c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x43bc1a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43c063
push ecx
push edx
call fcn.00490f7d
add esp, 8
lea ecx, [ebp - 0x2c]
call fcn.00445b20
push eax
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 4
call fcn.0040d620
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x18]
cmp ecx, 7
jbe 0x43bc77
mov edx, dword [ebp - 0x2c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x43bc6d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43c068
push ecx
push edx
call fcn.00490f7d
add esp, 8
xor eax, eax
mov dword [ebp - 0x1c], 0
push str.mbsetup4.exe
lea ecx, [ebp - 0x6c]
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
call fcn.0040d6d0
cmp dword [ebp - 0x58], 7
lea eax, [ebp - 0x6c]
cmova eax, dword [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x19
xorps xmm0, xmm0
mov dword [ebp - 0x44], 0
push str.mbam_c.installer.consumer
lea ecx, [ebp - 0x54]
mov dword [ebp - 0x40], 0
movups xmmword [ebp - 0x54], xmm0
call fcn.0040df90
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x2c]
push 7
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
push str.MBSetup
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x18], 0
call fcn.0040df90
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x298]
push 0
xorps xmm0, xmm0
mov dword [ebp - 0x288], 0
push 0x4ebca4
movups xmmword [ebp - 0x298], xmm0
mov dword [ebp - 0x284], 0
call fcn.0040df90
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x2c8]
push 0
xorps xmm0, xmm0
mov dword [ebp - 0x2b8], 0
push 0x4ebca4
movups xmmword [ebp - 0x2c8], xmm0
mov dword [ebp - 0x2b4], 0
call fcn.0040df90
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x2b0]
push 8
xorps xmm0, xmm0
mov dword [ebp - 0x2a0], 0
push str._Release
movups xmmword [ebp - 0x2b0], xmm0
mov dword [ebp - 0x29c], 0
call fcn.0040df90
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 0xb
push eax
lea eax, [ebp - 0x298]
push eax
lea eax, [ebp - 0x2c8]
push eax
lea eax, [ebp - 0x2b0]
push eax
push ecx
push 0
lea ecx, [ebp - 0x280]
call fcn.00469920
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x29c]
cmp ecx, 7
jbe 0x43be01
mov edx, dword [ebp - 0x2b0]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x43bdf7
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43c06d
push ecx
push edx
call fcn.00490f7d
add esp, 8
mov byte [ebp - 4], 0xe
mov ecx, dword [ebp - 0x2b4]
cmp ecx, 7
jbe 0x43be45
mov edx, dword [ebp - 0x2c8]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x43be3b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43c06d
push ecx
push edx
call fcn.00490f7d
add esp, 8
mov byte [ebp - 4], 0xf
mov ecx, dword [ebp - 0x284]
cmp ecx, 7
jbe 0x43be89
mov edx, dword [ebp - 0x298]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x43be7f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43c06d
push ecx
push edx
call fcn.00490f7d
add esp, 8
mov byte [ebp - 4], 0x10
mov ecx, dword [ebp - 0x18]
cmp ecx, 7
jbe 0x43bec7
mov edx, dword [ebp - 0x2c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x43bebd
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43c06d
push ecx
push edx
call fcn.00490f7d
add esp, 8
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
nop dword [eax]
lea eax, [ebp - 0x54]
inc esi
push eax
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x280]
call fcn.0046be40
test al, al
jne 0x43befa
push 0x7d0
call edi
cmp esi, 3
jge 0x43c072
jmp 0x43bed0
lea ecx, [ebp - 0x298]
call fcn.00467cf0
mov byte [ebp - 4], 0x11
cmp dword [eax + 0x14], 7
mov ecx, dword [eax + 0x10]
jbe 0x43bf14
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x50f6d0
call fcn.00412550
add esp, 4
mov edx, str.C:JenkinsworkspaceMBAM_WindowsA_MB5_MBSetup_srcMBSetupMBSetup.cpp
mov ecx, eax
call fcn.00411050
mov edx, 0x4ec568
mov ecx, eax
call fcn.00411050
push 0xfdb
mov ecx, eax
call fcn.0040f7e0
mov edx, str.:_Successfully_downloaded_MB4_installer._Starting_it.
mov ecx, eax
call fcn.00411050
push eax
call fcn.004113d0
mov byte [ebp - 4], 0x10
add esp, 4
mov ecx, dword [ebp - 0x284]
cmp ecx, 7
jbe 0x43bfa1
mov edx, dword [ebp - 0x298]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x43bf97
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43c10f
push ecx
push edx
call fcn.00490f7d
add esp, 8
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
xor eax, eax
mov dword [ebp - 0x18], 7
movups xmmword [ebp - 0x2c], xmm0
mov word [ebp - 0x2c], ax
lea edx, [ebp - 0x2c]
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x6c]
call fcn.0043a090
lea ecx, [ebp - 0x298]
test al, al
jne 0x43c114
call fcn.00467cf0
mov edx, eax
mov byte [ebp - 4], 0x14
mov ecx, 0x50f6d0
call fcn.00411030
mov edx, str.C:JenkinsworkspaceMBAM_WindowsA_MB5_MBSetup_srcMBSetupMBSetup.cpp
mov ecx, eax
call fcn.00411050
mov edx, 0x4ec568
mov ecx, eax
call fcn.00411050
push 0xfe4
mov ecx, eax
call fcn.0040f7e0
mov edx, str.:_Error._Failed_to_start_MB4_installer.
mov ecx, eax
call fcn.00411050
push ecx
mov ecx, eax
call fcn.0040f9a0
lea ecx, [ebp - 0x298]
jmp 0x43c0c5
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x3c], vtable.InstalledProducts.0
call fcn.0045d580
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00490c46
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.004961af
call fcn.004961af
call fcn.004961af
call fcn.004961af
lea ecx, [ebp - 0x2c]
call fcn.00467cf0
mov edx, eax
mov byte [ebp - 4], 0x15
mov ecx, 0x50f6d0
call fcn.00411030
mov edx, str.C:JenkinsworkspaceMBAM_WindowsA_MB5_MBSetup_srcMBSetupMBSetup.cpp
mov ecx, eax
call fcn.00411050
mov edx, 0x4ec568
mov ecx, eax
call fcn.00411050
push 0xfed
mov ecx, eax
call fcn.0040f7e0
mov edx, str.:_Error._Failed_to_download_MB4_installer.
mov ecx, eax
call fcn.00411050
push ecx
mov ecx, eax
call fcn.0040f9a0
lea ecx, [ebp - 0x2c]
call fcn.00406550
push ecx
lea ecx, [ebp - 0x1a0]
call fcn.0040f010
push ecx
push 0
push 0x6a6
push 0x5be
push 0x80
push 1
lea ecx, [ebp - 0x1a0]
call fcn.00423840
push ecx
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [ebp - 0x1a0]
call fcn.0040f9b0
push 1
call fcn.0049baf4
call fcn.004961af
call fcn.00467cf0
mov edx, eax
mov byte [ebp - 4], 0x13
mov ecx, 0x50f6d0
call fcn.00411030
mov edx, str.C:JenkinsworkspaceMBAM_WindowsA_MB5_MBSetup_srcMBSetupMBSetup.cpp
mov ecx, eax
call fcn.00411050
mov edx, 0x4ec568
mov ecx, eax
call fcn.00411050
push 0xfdf
mov ecx, eax
call fcn.0040f7e0
mov edx, str.:_Started_MB4_installer._Exiting.
mov ecx, eax
call fcn.00411050
push ecx
mov ecx, eax
call fcn.0040f9a0
lea ecx, [ebp - 0x298]
call fcn.00406550
push 0
call fcn.0049baf4
int3