Function at 0x438f50
Capabilities:
Create process on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bea7a
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x2a8
mov eax, dword [0x50c080]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x2c]
call fcn.00467cf0
mov dword [ebp - 4], 0
cmp dword [eax + 0x14], 7
mov ecx, dword [eax + 0x10]
jbe 0x438fab
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x50f6d0
call fcn.00412550
add esp, 4
mov edx, str.C:JenkinsworkspaceMBAM_WindowsA_MB5_MBSetup_srcMBSetupMBSetup.cpp
mov ecx, eax
call fcn.00411050
mov edx, 0x4ec568
mov ecx, eax
call fcn.00411050
push 0xe20
mov ecx, eax
call fcn.0040f7e0
mov edx, str.:_Installing_BrowserGuard_extension_for_firefox
mov ecx, eax
call fcn.00411050
push eax
call fcn.004113d0
mov dword [ebp - 4], 0xffffffff
add esp, 4
mov ecx, dword [ebp - 0x18]
cmp ecx, 7
jbe 0x439035
mov edx, dword [ebp - 0x2c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x43902b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x439f62
push ecx
push edx
call fcn.00490f7d
add esp, 8
xorps xmm0, xmm0
mov dword [ebp - 0x64], 0
xor eax, eax
mov dword [ebp - 0x60], 7
movups xmmword [ebp - 0x74], xmm0
mov word [ebp - 0x74], ax
lea ecx, [ebp - 0x74]
mov dword [ebp - 4], 1
call fcn.00438e60
test al, al
je 0x439e5e
lea ecx, [ebp - 0x2c]
call fcn.00467cf0
mov byte [ebp - 4], 2
cmp dword [eax + 0x14], 7
mov ecx, dword [eax + 0x10]
jbe 0x43907e
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x50f6d0
call fcn.00412550
add esp, 4
mov edx, str.C:JenkinsworkspaceMBAM_WindowsA_MB5_MBSetup_srcMBSetupMBSetup.cpp
mov ecx, eax
call fcn.00411050
mov edx, 0x4ec568
mov ecx, eax
call fcn.00411050
push 0xe24
mov ecx, eax
call fcn.0040f7e0
mov edx, str.:_Found_firefox_installed
mov ecx, eax
call fcn.00411050
push eax
call fcn.004113d0
mov byte [ebp - 4], 1
add esp, 4
mov ecx, dword [ebp - 0x18]
cmp ecx, 7
jbe 0x439105
mov edx, dword [ebp - 0x2c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4390fb
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x439f67
push ecx
push edx
call fcn.00490f7d
add esp, 8
lea ecx, [ebp - 0x5c]
call fcn.00445b20
push 0x2a
push str.242af0bb_db11_4734_b7a0_61cb8a9b20fb.xpi
mov byte [ebp - 4], 3
call fcn.0048ecc0
mov edx, eax
lea ecx, [ebp - 0x2c]
call fcn.00442d30
add esp, 8
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x5c]
call fcn.0041c690
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x18]
cmp ecx, 7
jbe 0x439178
mov edx, dword [ebp - 0x2c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x43916e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x439f6c
push ecx
push edx
call fcn.00490f7d
add esp, 8
push 0x1c
xorps xmm0, xmm0
mov dword [ebp - 0x7c], 0
push str.https:__ark.mwbsys.com_bgext
lea ecx, [ebp - 0x8c]
mov dword [ebp - 0x78], 0
movups xmmword [ebp - 0x8c], xmm0
call fcn.0040df90
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x280]
push 7
xorps xmm0, xmm0
mov dword [ebp - 0x270], 0
push str.MBSetup
movups xmmword [ebp - 0x280], xmm0
mov dword [ebp - 0x26c], 0
call fcn.0040df90
lea eax, [ebp - 0x280]
mov byte [ebp - 4], 6
push eax
lea eax, [ebp - 0x8c]
push eax
lea ecx, [ebp - 0x268]
call fcn.00469770
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x26c]
cmp ecx, 7
jbe 0x439237
mov edx, dword [ebp - 0x280]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x43922d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x439fad
push ecx
push edx
call fcn.00490f7d
add esp, 8
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
xor dl, dl
mov eax, esi
inc esi
cmp eax, 3
jge 0x439373
cmp esi, 1
jle 0x439259
push 0x9c4
call edi
lea ecx, [ebp - 0x2c]
call fcn.00467cf0
mov byte [ebp - 4], 9
cmp dword [eax + 0x14], 7
mov ecx, dword [eax + 0x10]
jbe 0x439270
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x50f6d0
call fcn.00412550
add esp, 4
mov edx, str.C:JenkinsworkspaceMBAM_WindowsA_MB5_MBSetup_srcMBSetupMBSetup.cpp
mov ecx, eax
call fcn.00411050
mov edx, 0x4ec568
mov ecx, eax
call fcn.00411050
push 0xe32
mov ecx, eax
call fcn.0040f7e0
mov edx, str.:_Trying_to_download_BrowserGuard_extension
mov ecx, eax
call fcn.00411050
push eax
call fcn.004113d0
mov byte [ebp - 4], 8
add esp, 4
mov ecx, dword [ebp - 0x18]
cmp ecx, 7
jbe 0x4392f7
mov edx, dword [ebp - 0x2c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4392ed
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x439f62
push ecx
push edx
call fcn.00490f7d
add esp, 8
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040d620
lea eax, [ebp - 0x8c]
mov byte [ebp - 4], 0xa
push eax
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x268]
call fcn.0046c030
mov byte [ebp - 4], 8
mov dl, al
mov ecx, dword [ebp - 0x18]
mov byte [ebp - 0x281], dl
cmp ecx, 7
jbe 0x439369
mov edx, dword [ebp - 0x2c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x439359
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x439f62
push ecx
push edx
call fcn.00490f7d
mov dl, byte [ebp - 0x281]
add esp, 8
test dl, dl
je 0x439241
jmp 0x43937b
test dl, dl
je 0x439d6a
lea ecx, [ebp - 0x2c]
call fcn.00467cf0
mov byte [ebp - 4], 0xb
cmp dword [eax + 0x14], 7
mov ecx, dword [eax + 0x10]
jbe 0x439392
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x50f6d0
call fcn.00412550
add esp, 4
mov edx, str.C:JenkinsworkspaceMBAM_WindowsA_MB5_MBSetup_srcMBSetupMBSetup.cpp
mov ecx, eax
call fcn.00411050
mov edx, 0x4ec568
mov ecx, eax
call fcn.00411050
push 0xe38
mov ecx, eax
call fcn.0040f7e0
mov edx, str.:_Successfully_downloaded_BrowserGuard_extension
mov ecx, eax
call fcn.00411050
push eax
call fcn.004113d0
mov byte [ebp - 4], 8
add esp, 4
mov ecx, dword [ebp - 0x18]
cmp ecx, 7
jbe 0x439419
mov edx, dword [ebp - 0x2c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x43940f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x439f71
push ecx
push edx
call fcn.00490f7d
add esp, 8
lea eax, [ebp - 0x278]
mov byte [ebp - 0x282], 0
push eax
lea ecx, [ebp - 0x5c]
call fcn.0041cad0
add esp, 4
movq xmm0, qword [eax]
mov eax, dword [eax + 8]
movq qword [ebp - 0x38], xmm0
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x38]
test eax, eax
je 0x439c3e
cmp eax, 1
je 0x439c3e
lea ecx, [ebp - 0x29c]
call fcn.00467cf0
mov byte [ebp - 4], 0xd
cmp dword [eax + 0x14], 7
mov ecx, dword [eax + 0x10]
jbe 0x43946f
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x50f6d0
call fcn.00412550
add esp, 4
mov edx, str.C:JenkinsworkspaceMBAM_WindowsA_MB5_MBSetup_srcMBSetupMBSetup.cpp
mov ecx, eax
call fcn.00411050
mov edx, 0x4ec568
mov ecx, eax
call fcn.00411050
push 0xe44
mov ecx, eax
call fcn.0040f7e0
mov edx, str.:_Launching_firefox.exe_to_install_BrowserGuard_extension
mov ecx, eax
call fcn.00411050
push eax
call fcn.004113d0
mov byte [ebp - 4], 8
add esp, 4
mov ecx, dword [ebp - 0x288]
cmp ecx, 7
jbe 0x4394fc
mov edx, dword [ebp - 0x29c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4394f2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x439f76
push ecx
push edx
call fcn.00490f7d
add esp, 8
mov ecx, dword [ebp - 0x64]
mov esi, 0x7ffffffe
mov eax, esi
sub eax, ecx
cmp eax, 1
jb 0x439f7b
cmp dword [ebp - 0x60], 7
lea eax, [ebp - 0x74]
push ecx
cmova eax, dword [ebp - 0x74]
push eax
push 1
push 0x4ecd08
push ecx
push dword [ebp - 0x2a0]
lea ecx, [ebp - 0x2b8]
call fcn.00442400
push str.___install__extension__
lea edx, [ebp - 0x2b8]
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x2c]
call fcn.00441340
add esp, 4
mov byte [ebp - 4], 0x10
mov ecx, dword [ebp - 0x2a4]
cmp ecx, 7
jbe 0x439595
mov edx, dword [ebp - 0x2b8]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x43958b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x439f80
push ecx
push edx
call fcn.00490f7d
add esp, 8
mov edx, dword [ebp - 0x1c]
xor eax, eax
mov edi, dword [ebp - 0x4c]
sub esi, edx
mov dword [ebp - 0x2a8], 0
mov dword [ebp - 0x2a4], 7
mov word [ebp - 0x2b8], ax
cmp esi, edi
jb 0x439f85
cmp dword [ebp - 0x18], 7
lea ecx, [ebp - 0x2c]
push edi
cmova ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x5c]
cmp dword [ebp - 0x48], 7
cmova eax, dword [ebp - 0x5c]
push eax
push edx
push ecx
push ecx
push dword [ebp - 0x2a0]
lea ecx, [ebp - 0x29c]
call fcn.00442400
push 0x4ecd08
lea edx, [ebp - 0x29c]
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x44]
call fcn.00441340
add esp, 4
mov byte [ebp - 4], 0x13
mov ecx, dword [ebp - 0x288]
cmp ecx, 7
jbe 0x43964c
mov edx, dword [ebp - 0x29c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x439642
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x439f8a
push ecx
push edx
call fcn.00490f7d
add esp, 8
xor eax, eax
mov dword [ebp - 0x28c], 0
push 0xb0
push eax
mov word [ebp - 0x29c], ax
lea eax, [ebp - 0x188]
push eax
mov dword [ebp - 0x288], 7
call fcn.00493220
add esp, 8
lea ecx, [ebp - 0x188]
call fcn.0043cac0
mov edx, str.cmd.exe__C_timeout__t_1_
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x178]
call fcn.0041b9a0
cmp dword [ebp - 0x30], 7
lea edx, [ebp - 0x44]
push dword [ebp - 0x34]
cmova edx, dword [ebp - 0x44]
lea ecx, [ebp - 0x178]
call fcn.00412550
add esp, 4
push 0x50f6d0
call fcn.004113d0
xorps xmm0, xmm0
mov dword [ebp - 0xd8], 0x44
add esp, 4
movlpd qword [ebp - 0xd4], xmm0
xor eax, eax
movlpd qword [ebp - 0xcc], xmm0
lea ecx, [ebp - 0x2b8]
movlpd qword [ebp - 0xc4], xmm0
movlpd qword [ebp - 0xbc], xmm0
movlpd qword [ebp - 0xb4], xmm0
movlpd qword [ebp - 0xa6], xmm0
movlpd qword [ebp - 0x9e], xmm0
mov word [ebp - 0x96], ax
mov dword [ebp - 0xac], 1
mov word [ebp - 0xa8], ax
call fcn.00467cf0
mov byte [ebp - 4], 0x15
cmp dword [eax + 0x14], 7
mov ecx, dword [eax + 0x10]
jbe 0x43973f
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x50f6d0
call fcn.00412550
add esp, 4
mov edx, str.C:JenkinsworkspaceMBAM_WindowsA_MB5_MBSetup_srcMBSetupMBSetup.cpp
mov ecx, eax
call fcn.00411050
mov edx, 0x4ec568
mov ecx, eax
call fcn.00411050
push 0xe50
mov ecx, eax
call fcn.0040f7e0
mov edx, str.:_FF_Cmd:
mov ecx, eax
call fcn.00411050
mov esi, eax
lea ecx, [ebp - 0x188]
lea eax, [ebp - 0x29c]
push eax
call fcn.0043c9d0
mov byte [ebp - 4], 0x16
cmp dword [eax + 0x14], 7
jbe 0x43979f
mov eax, dword [eax]
mov edx, eax
mov ecx, esi
call fcn.0041b9a0
push eax
call fcn.004113d0
mov byte [ebp - 4], 0x15
add esp, 4
mov ecx, dword [ebp - 0x288]
cmp ecx, 7
jbe 0x4397f5
mov edx, dword [ebp - 0x29c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4397eb
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x439f8f
push ecx
push edx
call fcn.00490f7d
add esp, 8
xor eax, eax
mov byte [ebp - 4], 0x14
mov ecx, dword [ebp - 0x2a4]
mov dword [ebp - 0x28c], 0
mov dword [ebp - 0x288], 7
mov word [ebp - 0x29c], ax
cmp ecx, 7
jbe 0x439856
mov edx, dword [ebp - 0x2b8]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x43984c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x439f8f
push ecx
push edx
call fcn.00490f7d
add esp, 8
lea eax, [ebp - 0x2b8]
push eax
lea ecx, [ebp - 0x188]
call fcn.0043c9d0
mov byte [ebp - 4], 0x17
cmp dword [eax + 0x14], 7
jbe 0x439874
mov eax, dword [eax]
lea ecx, [ebp - 0x278]
push ecx
lea ecx, [ebp - 0xd8]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x43996b
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 0x29c]
mov esi, eax
call fcn.00467cf0
mov byte [ebp - 4], 0x18
cmp dword [eax + 0x14], 7
mov ecx, dword [eax + 0x10]
jbe 0x4398c1
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x50f6d0
call fcn.00412550
add esp, 4
mov edx, str.C:JenkinsworkspaceMBAM_WindowsA_MB5_MBSetup_srcMBSetupMBSetup.cpp
mov ecx, eax
call fcn.00411050
mov edx, 0x4ec568
mov ecx, eax
call fcn.00411050
push 0x767
mov ecx, eax
call fcn.0040f7e0
mov edx, 0x4ec7a8
mov ecx, eax
call fcn.00411050
mov edx, str.CreateProcess_failed:
mov ecx, eax
call fcn.0041b9a0
push esi
mov ecx, eax
call fcn.0041b590
push eax
call fcn.004113d0
mov byte [ebp - 4], 0x17
add esp, 4
mov ecx, dword [ebp - 0x288]
cmp ecx, 7
jbe 0x439962
mov edx, dword [ebp - 0x29c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x439958
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x439f94
push ecx
push edx
call fcn.00490f7d
add esp, 8
mov byte [ebp - 0x281], 0
jmp 0x439972
mov byte [ebp - 0x281], 1
mov byte [ebp - 4], 0x14
mov ecx, dword [ebp - 0x2a4]
cmp ecx, 7
jbe 0x4399b6
mov edx, dword [ebp - 0x2b8]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4399ac
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x439f99
push ecx
push edx
call fcn.00490f7d
add esp, 8
lea ecx, [ebp - 0x29c]
call fcn.00467cf0
cmp byte [ebp - 0x281], 0
je 0x439a72
mov byte [ebp - 4], 0x19
cmp dword [eax + 0x14], 7
mov esi, dword [eax + 0x10]
jbe 0x4399dd
mov eax, dword [eax]
push esi
mov edx, eax
mov ecx, 0x50f6d0
call fcn.00412550
add esp, 4
mov edx, str.C:JenkinsworkspaceMBAM_WindowsA_MB5_MBSetup_srcMBSetupMBSetup.cpp
mov ecx, eax
call fcn.00411050
mov edx, 0x4ec568
mov ecx, eax
call fcn.00411050
push 0xe53
mov ecx, eax
call fcn.0040f7e0
mov edx, str.:_Successfully_launched_firefox_to_install_BrowserGuard_extension.
mov ecx, eax
call fcn.00411050
push eax
call fcn.004113d0
mov ecx, dword [ebp - 0x288]
add esp, 4
cmp ecx, 7
jbe 0x439a66
mov edx, dword [ebp - 0x29c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x439a5c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x439f9e
push ecx
push edx
call fcn.00490f7d
add esp, 8
mov byte [ebp - 0x282], 1
jmp 0x439b0a
mov byte [ebp - 4], 0x1a
cmp dword [eax + 0x14], 7
mov ecx, dword [eax + 0x10]
jbe 0x439a81
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x50f6d0
call fcn.00412550
add esp, 4
mov edx, str.C:JenkinsworkspaceMBAM_WindowsA_MB5_MBSetup_srcMBSetupMBSetup.cpp
mov ecx, eax
call fcn.00411050
mov edx, 0x4ec568
mov ecx, eax
call fcn.00411050
push 0xe58
mov ecx, eax
call fcn.0040f7e0
mov edx, str.:_Failed_to_launch_firefox_to_install_BrowserGuard_extension.
mov ecx, eax
call fcn.00411050
push eax
call fcn.004113d0
mov ecx, dword [ebp - 0x288]
add esp, 4
cmp ecx, 7
jbe 0x439b0a
mov edx, dword [ebp - 0x29c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x439b00
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x439fa3
push ecx
push edx
call fcn.00490f7d
add esp, 8
push dword [ebp - 0x274]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x278]
call esi
lea ecx, [ebp - 0x188]
call fcn.00439fc0
mov ecx, dword [ebp - 0x30]
cmp ecx, 7
jbe 0x439b65
mov edx, dword [ebp - 0x44]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x439b5b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x439fa8
push ecx
push edx
call fcn.00490f7d
add esp, 8
mov ecx, dword [ebp - 0x18]
xor eax, eax
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 7
mov word [ebp - 0x44], ax
cmp ecx, 7
jbe 0x439bb3
mov edx, dword [ebp - 0x2c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x439ba9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x439fa8
push ecx
push edx
call fcn.00490f7d
add esp, 8
lea ecx, [ebp - 0x268]
call fcn.00469a90
mov ecx, dword [ebp - 0x78]
cmp ecx, 7
jbe 0x439bfb
mov edx, dword [ebp - 0x8c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x439bf1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x439fad
push ecx
push edx
call fcn.00490f7d
add esp, 8
mov ecx, dword [ebp - 0x48]
cmp ecx, 7
jbe 0x439f08
mov edx, dword [ebp - 0x5c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x439c2f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x439fad
push ecx
push edx
call fcn.00490f7d
add esp, 8
jmp 0x439f08
lea ecx, [ebp - 0x2c]
call fcn.00467cf0
mov byte [ebp - 4], 0x1b
cmp dword [eax + 0x14], 7
mov ecx, dword [eax + 0x10]
jbe 0x439c55
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x50f6d0
call fcn.00412550
add esp, 4
mov edx, str.C:JenkinsworkspaceMBAM_WindowsA_MB5_MBSetup_srcMBSetupMBSetup.cpp
mov ecx, eax
call fcn.00411050
mov edx, 0x4ec568
mov ecx, eax
call fcn.00411050
push 0xe5f
mov ecx, eax
call fcn.0040f7e0
mov edx, str.:_Could_not_find:
mov ecx, eax
call fcn.00411050
mov esi, eax
lea ecx, [ebp - 0x280]
lea eax, [ebp - 0x5c]
push eax
call fcn.0040d620
mov byte [ebp - 4], 0x1c
lea edx, [ebp - 0x280]
cmp dword [ebp - 0x26c], 7
mov ecx, esi
push dword [ebp - 0x270]
cmova edx, dword [ebp - 0x280]
call fcn.00412550
add esp, 4
push eax
call fcn.004113d0
mov ecx, dword [ebp - 0x26c]
add esp, 4
cmp ecx, 7
jbe 0x439d17
mov edx, dword [ebp - 0x280]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x439d0d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x439fad
push ecx
push edx
call fcn.00490f7d
add esp, 8
xor eax, eax
mov dword [ebp - 0x270], 0
mov dword [ebp - 0x26c], 7
mov word [ebp - 0x280], ax
mov ecx, dword [ebp - 0x18]
cmp ecx, 7
jbe 0x439dd9
mov edx, dword [ebp - 0x2c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x439dcf
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x439fad
jmp 0x439dcf
lea ecx, [ebp - 0x2c]
call fcn.00467cf0
mov byte [ebp - 4], 0xc
cmp dword [eax + 0x14], 7
mov ecx, dword [eax + 0x10]
jbe 0x439d81
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x50f6d0
call fcn.00412550
add esp, 4
mov edx, str.C:JenkinsworkspaceMBAM_WindowsA_MB5_MBSetup_srcMBSetupMBSetup.cpp
mov ecx, eax
call fcn.00411050
mov edx, 0x4ec568
mov ecx, eax
call fcn.00411050
push 0xe3c
mov ecx, eax
call fcn.0040f7e0
mov edx, str.:_Failed_to_download_BrowserGuard_extension
mov ecx, eax
call fcn.00411050
push eax
call fcn.004113d0
add esp, 4
jmp 0x439d34
push ecx
push edx
call fcn.00490f7d
add esp, 8
lea ecx, [ebp - 0x268]
call fcn.00469a90
mov ecx, dword [ebp - 0x78]
cmp ecx, 7
jbe 0x439e21
mov edx, dword [ebp - 0x8c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x439e17
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x439fad
push ecx
push edx
call fcn.00490f7d
add esp, 8
mov ecx, dword [ebp - 0x48]
cmp ecx, 7
jbe 0x439f01
mov edx, dword [ebp - 0x5c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x439ef7
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x439ef7
jmp 0x439fad
lea ecx, [ebp - 0x29c]
call fcn.00467cf0
mov byte [ebp - 4], 0x1d
cmp dword [eax + 0x14], 7
mov ecx, dword [eax + 0x10]
jbe 0x439e78
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x50f6d0
call fcn.00412550
add esp, 4
mov edx, str.C:JenkinsworkspaceMBAM_WindowsA_MB5_MBSetup_srcMBSetupMBSetup.cpp
mov ecx, eax
call fcn.00411050
mov edx, 0x4ec568
mov ecx, eax
call fcn.00411050
push 0xe65
mov ecx, eax
call fcn.0040f7e0
mov edx, str.:_Firefox_not_found__skipping_BrowserGuard_extension_for_firefox.
mov ecx, eax
call fcn.00411050
push eax
call fcn.004113d0
mov ecx, dword [ebp - 0x288]
add esp, 4
cmp ecx, 7
jbe 0x439f01
mov edx, dword [ebp - 0x29c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x439ef7
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x439fad
push ecx
push edx
call fcn.00490f7d
add esp, 8
mov byte [ebp - 0x282], 0
mov ecx, dword [ebp - 0x60]
cmp ecx, 7
jbe 0x439f3e
mov edx, dword [ebp - 0x74]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x439f34
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x439fad
push ecx
push edx
call fcn.00490f7d
add esp, 8
mov al, byte [ebp - 0x282]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00490c46
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.004961af
call fcn.004961af
call fcn.004961af
call fcn.004961af
call fcn.004961af
call fcn.0040ddc0
call fcn.004961af
call fcn.0040ddc0
call fcn.004961af
call fcn.004961af
call fcn.004961af
call fcn.004961af
call fcn.004961af
call fcn.004961af
call fcn.004961af
call fcn.004961af
int3