Function at 0x428100
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Encode data using base64

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b05dc
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0xc68
mov eax, dword [0x4e506c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor esi, esi
xor eax, eax
mov dword [ebp - 0x9d8], esi
mov dword [ebp - 0xd0], esi
mov dword [ebp - 0xcc], 7
mov word [ebp - 0xe0], ax
lea edx, [ebp - 0xe0]
mov dword [ebp - 4], eax
call fcn.00424910
test al, al
jne 0x4282cc
mov byte [ebp - 4], 1
call fcn.00403a40
mov ecx, eax
test ecx, ecx
je 0x42a079
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x78], eax
lea edx, [esi + 3]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x9e0]
call fcn.0044f060
mov byte [ebp - 4], 3
push dword [eax]
lea eax, [ebp - 0x78]
push str._s___could_not_determine_install_and_or_data_directories
push eax
call fcn.0043b6b0
mov edx, dword [ebp - 0x9e0]
add esp, 0xc
add edx, 0xfffffff0
or edi, 0xffffffff
mov byte [ebp - 4], 4
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4281e5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0xaf4]
mov byte [ebp - 4], 2
call fcn.0045dd60
mov byte [ebp - 4], 5
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x428203
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e94d8
call fcn.00410550
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f730
mov edx, 0x4c8104
mov ecx, eax
call fcn.0040f730
push 0x586
mov ecx, eax
call fcn.0040dd30
mov edx, 0x4c832c
mov ecx, eax
call fcn.0040f730
mov esi, dword [ebp - 0x78]
mov ecx, eax
mov edx, esi
call fcn.0040f730
push eax
call fcn.0040faa0
mov byte [ebp - 4], 2
add esp, 4
mov edx, dword [ebp - 0xae0]
cmp edx, 8
jb 0x42829c
mov ecx, dword [ebp - 0xaf4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x428292
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42a083
push edx
push ecx
call fcn.0046da67
add esp, 8
xor edx, edx
mov ecx, esi
call fcn.00450570
add esi, 0xfffffff0
mov byte [ebp - 4], 6
lock xadd dword [esi + 0xc], edi
dec edi
test edi, edi
jg 0x428657
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, 3
jmp 0x42a04e
cmp dword [ebp - 0xcc], 8
lea eax, [ebp - 0xe0]
push dword [ebp - 0xd0]
cmovae eax, dword [ebp - 0xe0]
mov ecx, 0x4e5c88
push eax
call fcn.00407920
cmp byte [0x4eaa04], 0
mov edi, 0x4e5ee0
je 0x428387
mov ecx, 0x4e5c88
cmp ecx, 0x4e5ca0
je 0x42832f
cmp dword [0x4e5cb4], 8
mov eax, 0x4e5ca0
push dword [0x4e5cb0]
cmovae eax, dword [0x4e5ca0]
push eax
call fcn.00407920
cmp byte [0x4ea9ed], 0
mov byte [0x4ea9df], 1
je 0x428387
push 0x4e5c88
lea ecx, [ebp - 0xb0c]
call fcn.0040beb0
mov ecx, edi
mov esi, 4
call fcn.00404cc0
movups xmm0, xmmword [ebp - 0xb0c]
push 5
push str.data
movups xmmword [0x4e5ee0], xmm0
mov ecx, edi
movq xmm0, qword [ebp - 0xafc]
movq qword [0x4e5ef0], xmm0
call fcn.0040c260
cmp byte [0x4eaa03], 0
je 0x4283b9
cmp edi, 0x4e5cd0
je 0x4283b9
cmp dword [0x4e5ce4], 8
mov eax, 0x4e5cd0
push dword [0x4e5ce0]
cmovae eax, dword [0x4e5cd0]
mov ecx, edi
push eax
call fcn.00407920
cmp byte [0x4ea9ed], 0
je 0x428661
push 0x4eab24
push 0x41a0d0
push 0x4eab2c
mov dword [ebp - 0x68], 0
call fcn.00469f84
add esp, 0xc
test eax, eax
je 0x42a088
cmp dword [0x4e5c9c], 8
mov eax, 0x4e5c88
mov edi, dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
cmovae eax, dword [0x4e5c88]
push eax
mov dword [ebp - 0x64], 0x4eab24
call edi
test eax, eax
jne 0x4284e9
lea edx, [ebp - 0x68]
mov ecx, 0x4e5c88
call fcn.0043e2d0
test al, al
jne 0x4284e9
cmp dword [ebp - 0x68], 0xb7
je 0x4284e9
lea ecx, [ebp - 0xa94]
call fcn.0045dd60
mov byte [ebp - 4], 7
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x428453
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e94d8
call fcn.00410550
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f730
mov edx, 0x4c8104
mov ecx, eax
call fcn.0040f730
push 0x5ab
mov ecx, eax
call fcn.0040dd30
mov edx, str.:_Error___could_not_create_install_directory._Error:
mov ecx, eax
call fcn.0040f730
push dword [ebp - 0x68]
mov ecx, eax
call fcn.0040dd30
push eax
call fcn.0040faa0
mov edx, dword [ebp - 0xa80]
add esp, 4
cmp edx, 8
jb 0x428657
mov ecx, dword [ebp - 0xa94]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42864d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42a08d
jmp 0x42864d
cmp dword [0x4e5ef4], 8
mov eax, 0x4e5ee0
cmovae eax, dword [0x4e5ee0]
push eax
call edi
test eax, eax
jne 0x428661
mov byte [ebp - 0x9e0], al
lea ecx, [ebp - 0xa7c]
push dword [ebp - 0x9e0]
mov edx, 0x4e5ee0
call fcn.00418e30
add esp, 4
mov byte [ebp - 4], 8
lea edx, [ebp - 0x68]
or esi, 1
lea ecx, [ebp - 0xa7c]
mov dword [ebp - 0x9d8], esi
call fcn.0043e2d0
mov edi, dword [ebp - 0x68]
test al, al
jne 0x428554
mov byte [ebp - 0x15], 1
cmp edi, 0xb7
jne 0x428558
mov byte [ebp - 0x15], 0
mov dword [ebp - 4], 0
and esi, 0xfffffffe
mov edx, dword [ebp - 0xa68]
cmp edx, 8
jb 0x4285a2
mov ecx, dword [ebp - 0xa7c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x428598
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42a092
push edx
push ecx
call fcn.0046da67
add esp, 8
cmp byte [ebp - 0x15], 0
je 0x428661
lea ecx, [ebp - 0xaac]
call fcn.0045dd60
mov byte [ebp - 4], 9
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x4285c6
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e94d8
call fcn.00410550
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f730
mov edx, 0x4c8104
mov ecx, eax
call fcn.0040f730
push 0x5b4
mov ecx, eax
call fcn.0040dd30
mov edx, str.:_Error___could_not_create_data_directory._Error:
mov ecx, eax
call fcn.0040f730
push edi
mov ecx, eax
call fcn.0040dd30
push eax
call fcn.0040faa0
mov edx, dword [ebp - 0xa98]
add esp, 4
cmp edx, 8
jb 0x428657
mov ecx, dword [ebp - 0xaac]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42864d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42a097
push edx
push ecx
call fcn.0046da67
add esp, 8
mov esi, 3
jmp 0x42a04e
push 6
xor eax, eax
mov dword [ebp - 0xa24], 0
push str.MBAM_C
lea ecx, [ebp - 0xa34]
mov dword [ebp - 0xa20], 7
mov word [ebp - 0xa34], ax
call fcn.00407920
push ecx
mov edx, 1
call fcn.0040bfd0
mov edx, dword [ebp - 0xa20]
add esp, 4
cmp al, 1
setne al
mov byte [ebp - 0x15], al
cmp edx, 8
jb 0x4286e9
mov ecx, dword [ebp - 0xa34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4286dc
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42a09c
push edx
push ecx
call fcn.0046da67
mov al, byte [ebp - 0x15]
add esp, 8
test al, al
je 0x42889e
mov byte [ebp - 4], 0xa
call fcn.00403a40
mov ecx, eax
test ecx, ecx
je 0x42a0a1
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x20], eax
mov edx, 0xc8
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0xa0c]
call fcn.0044f060
mov byte [ebp - 4], 0xc
push dword [eax]
lea eax, [ebp - 0x20]
push str._s___unsupported_operating_system
push eax
call fcn.0043b6b0
mov edx, dword [ebp - 0xa0c]
add esp, 0xc
add edx, 0xfffffff0
or edi, 0xffffffff
mov byte [ebp - 4], 0xd
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x428760
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0xac4]
mov byte [ebp - 4], 0xb
call fcn.0045dd60
mov byte [ebp - 4], 0xe
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x42877e
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e94d8
call fcn.00410550
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f730
mov edx, 0x4c8104
mov ecx, eax
call fcn.0040f730
push 0x5c1
mov ecx, eax
call fcn.0040dd30
mov edx, 0x4c832c
mov ecx, eax
call fcn.0040f730
mov esi, dword [ebp - 0x20]
mov ecx, eax
mov edx, esi
call fcn.0040f730
push eax
call fcn.0040faa0
mov byte [ebp - 4], 0xb
add esp, 4
mov edx, dword [ebp - 0xab0]
cmp edx, 8
jb 0x428817
mov ecx, dword [ebp - 0xac4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42880d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42a0ab
push edx
push ecx
call fcn.0046da67
add esp, 8
xor edx, edx
mov ecx, esi
call fcn.00450570
cmp byte [0x4ea9f6], 0
jne 0x42887b
push 0x130
lea eax, [ebp - 0x510]
push 0
push eax
call fcn.00485bb0
add esp, 8
lea ecx, [ebp - 0x510]
push 0
push 0x6a6
push 0x235d
push 0x80
push 1
call fcn.0041f980
push ecx
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [ebp - 0x510]
call fcn.0040db70
lea ecx, [ebp - 0x510]
call fcn.0040d220
add esi, 0xfffffff0
mov byte [ebp - 4], 0xf
lock xadd dword [esi + 0xc], edi
dec edi
test edi, edi
jg 0x428894
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, 0xc8
jmp 0x42a04e
xorps xmm0, xmm0
mov dword [ebp - 0x6c], 0
movq qword [ebp - 0x74], xmm0
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x6c], 0
mov byte [ebp - 4], 0x10
call fcn.00423790
test al, al
je 0x428b9f
cmp byte [0x4ea9f6], 0
jne 0x428b9f
call fcn.00430e30
test al, al
je 0x428b9f
mov eax, dword [ebp - 0x74]
cmp eax, dword [ebp - 0x70]
je 0x428b9f
push str.https:__links.malwarebytes.com_support_installer_AVBlocking
lea ecx, [ebp - 0xc8]
call fcn.00404c70
mov byte [ebp - 4], 0x11
mov eax, dword [ebp - 0x74]
cmp dword [eax + 0x40], 0
lea ecx, [eax + 0x30]
je 0x428928
push ecx
lea ecx, [ebp - 0xc8]
call fcn.0040bfa0
mov eax, dword [ebp - 0x74]
push eax
mov edx, str.We_have_detected
lea ecx, [ebp - 0xadc]
call fcn.0043b750
add esp, 4
push str._installed_on_your_computer._This_product_may_interfere_with
mov edx, eax
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0xa4c]
call fcn.0043b8f0
add esp, 4
push str.the_installation_of_Malwarebytes._Please_click_Yes_to_find_out_how_to_safely_install_Malwarebytes._You_can_click_No_to_proceed_with_installation__or_Cancel_to_exit.
mov edx, eax
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x90]
call fcn.0043b8f0
mov byte [ebp - 4], 0x12
add esp, 4
mov edx, dword [ebp - 0xa38]
cmp edx, 8
jb 0x4289b2
mov ecx, dword [ebp - 0xa4c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4289a8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42a0b0
push edx
push ecx
call fcn.0046da67
add esp, 8
xor eax, eax
mov byte [ebp - 4], 0x11
mov edx, dword [ebp - 0xac8]
mov dword [ebp - 0xa3c], 0
mov dword [ebp - 0xa38], 7
mov word [ebp - 0xa4c], ax
cmp edx, 8
jb 0x428a13
mov ecx, dword [ebp - 0xadc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x428a09
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42a0b5
push edx
push ecx
call fcn.0046da67
add esp, 8
cmp dword [ebp - 0x7c], 8
lea eax, [ebp - 0x90]
push 3
cmovae eax, dword [ebp - 0x90]
push str.Malwarebytes_Installer
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x428a60
cmp dword [ebp - 0xb4], 8
lea eax, [ebp - 0xc8]
push 5
cmovae eax, dword [ebp - 0xc8]
push 0
push 0
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x428a69
cmp eax, 2
jne 0x428b07
mov edx, dword [ebp - 0x7c]
cmp edx, 8
jb 0x428aa6
mov ecx, dword [ebp - 0x90]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x428a9c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42a0ba
push edx
push ecx
call fcn.0046da67
add esp, 8
mov edx, dword [ebp - 0xb4]
xor eax, eax
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x7c], 7
mov word [ebp - 0x90], ax
cmp edx, 8
jb 0x428afd
mov ecx, dword [ebp - 0xc8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x428af3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42a0bf
push edx
push ecx
call fcn.0046da67
add esp, 8
mov esi, 0xcb
jmp 0x42a046
mov edx, dword [ebp - 0x7c]
cmp edx, 8
jb 0x428b44
mov ecx, dword [ebp - 0x90]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x428b3a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42a0c4
push edx
push ecx
call fcn.0046da67
add esp, 8
xor eax, eax
mov byte [ebp - 4], 0x10
mov edx, dword [ebp - 0xb4]
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x7c], 7
mov word [ebp - 0x90], ax
cmp edx, 8
jb 0x428b9f
mov ecx, dword [ebp - 0xc8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x428b95
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42a0c9
push edx
push ecx
call fcn.0046da67
add esp, 8
xorps xmm0, xmm0
movups xmmword [ebp - 0x34], xmm0
mov dword [ebp - 0x34], vtable.InstalledProducts.0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
push 0
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0x14
call fcn.00460de0
push 1
lea ecx, [ebp - 0x34]
call fcn.00460de0
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0xa64]
push 6
xor eax, eax
mov dword [ebp - 0xa54], 0
push str.MBAM_C
mov dword [ebp - 0xa50], 7
mov word [ebp - 0xa64], ax
call fcn.00407920
mov byte [ebp - 4], 0x16
lea edx, [ebp - 0x34]
or esi, 2
lea ecx, [ebp - 0xa64]
mov dword [ebp - 0x9d8], esi
call fcn.0045d7e0
test al, al
je 0x428c44
call fcn.004236e0
test al, al
je 0x428c3e
call fcn.0045d660
test al, al
jne 0x428c44
mov byte [ebp - 0x15], 0
jmp 0x428c48
mov byte [ebp - 0x15], 1
mov dword [ebp - 4], 0x15
lea ecx, [ebp - 0xa64]
and esi, 0xfffffffd
mov dword [ebp - 0x9e4], esi
mov dword [ebp - 0x9d8], esi
call fcn.00404cc0
cmp byte [ebp - 0x15], 0
je 0x428e6d
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
call fcn.00403b40
mov edx, 0xc9
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0xa10]
call fcn.0044f060
mov byte [ebp - 4], 0x18
push dword [eax]
lea eax, [ebp - 0x1c]
push str._s___cant_install_over_business_products
push eax
call fcn.0043b6b0
mov edx, dword [ebp - 0xa10]
add esp, 0xc
add edx, 0xfffffff0
or edi, 0xffffffff
mov byte [ebp - 4], 0x19
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x428cd1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0xc44]
mov byte [ebp - 4], 0x17
call fcn.0045dd60
mov byte [ebp - 4], 0x1a
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x428cef
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e94d8
call fcn.00410550
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f730
mov edx, 0x4c8104
mov ecx, eax
call fcn.0040f730
push 0x5f4
mov ecx, eax
call fcn.0040dd30
mov edx, 0x4c832c
mov ecx, eax
call fcn.0040f730
mov esi, dword [ebp - 0x1c]
mov ecx, eax
mov edx, esi
call fcn.0040f730
push eax
call fcn.0040faa0
add esp, 4
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0xc44]
call fcn.00404cc0
xorps xmm0, xmm0
mov dword [ebp - 0x58], 0
lea edx, [ebp - 0x34]
movq qword [ebp - 0x60], xmm0
lea ecx, [ebp - 0x60]
call fcn.00452570
lea edx, [ebp - 0x60]
mov byte [ebp - 4], 0x1b
mov ecx, esi
call fcn.00450570
cmp byte [0x4ea9f6], 0
jne 0x428dd6
push 0x130
lea eax, [ebp - 0x640]
push 0
push eax
call fcn.00485bb0
add esp, 8
lea ecx, [ebp - 0x640]
push 0
push 0x6a6
push 0x235b
push 0x80
push 1
call fcn.0041f980
push ecx
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [ebp - 0x640]
call fcn.0040db70
lea ecx, [ebp - 0x640]
call fcn.0040d220
mov byte [ebp - 4], 0x17
mov ecx, dword [ebp - 0x60]
test ecx, ecx
je 0x428e4a
mov edx, dword [ebp - 0x5c]
push ecx
call fcn.0043c7e0
mov ecx, dword [ebp - 0x58]
mov eax, 0x2aaaaaab
sub ecx, dword [ebp - 0x60]
add esp, 4
imul ecx
mov ecx, dword [ebp - 0x60]
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
lea edx, [eax + eax*2]
mov eax, ecx
shl edx, 3
cmp edx, 0x1000
jb 0x428e2b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42a0ce
push edx
push ecx
call fcn.0046da67
add esp, 8
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x58], 0
add esi, 0xfffffff0
mov byte [ebp - 4], 0x1c
lock xadd dword [esi + 0xc], edi
dec edi
test edi, edi
jg 0x428e63
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, 0xc9
jmp 0x42a037
call fcn.00423710
test al, al
jne 0x428f87
mov edi, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
cmp esi, edi
je 0x428f87
add esi, 0x1c
nop dword [eax + eax]
lea eax, [esi - 0x18]
mov dword [ebp - method.InstalledProducts::InstalledProduct.virtual_0], vtable.InstalledProducts::InstalledProduct.0
push eax
lea ecx, [ebp - 0x17c]
call fcn.0040beb0
push esi
lea ecx, [ebp - 0x164]
mov byte [ebp - 4], 0x1d
call fcn.0040beb0
lea eax, [esi + 0x18]
mov byte [ebp - 4], 0x1e
push eax
lea ecx, [ebp - 0x14c]
call fcn.0040beb0
lea eax, [esi + 0x30]
mov byte [ebp - 4], 0x1f
push eax
lea ecx, [ebp - 0x134]
call fcn.0040beb0
mov al, byte [esi + 0x48]
mov byte [ebp - 0x11c], al
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x164]
cmp dword [ebp - 0x150], 8
cmovae ecx, dword [ebp - 0x164]
cmp dword [ebp - 0x154], 0x19
jb 0x428f6a
push 0x19
mov edx, str.Malwarebytes_Anti_Malware
call fcn.004196e0
add esp, 4
test eax, eax
jne 0x428f6a
sub esp, 0x18
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x9c], eax
mov ecx, esp
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], eax
lea eax, [ebp - 0x14c]
push eax
call fcn.0040beb0
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 0x98]
push eax
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.004615e0
cmp dword [ebp - 0x24], 2
jbe 0x429110
lea ecx, [ebp - 0x180]
mov byte [ebp - 4], 0x15
call fcn.00459140
add esi, 0x68
lea eax, [esi - 0x1c]
cmp eax, edi
jne 0x428e90
lea ecx, [ebp - 0x34]
call fcn.00461890
mov esi, 0x4e5ac5
test al, al
je 0x4293e9
call fcn.00423710
test al, al
je 0x4292fe
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x48], 0
call fcn.00403b40
mov edx, 0xca
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x9e4]
call fcn.0044f060
mov byte [ebp - 4], 0x28
push dword [eax]
lea eax, [ebp - 0x48]
push str._s___cant_install_ARW_over_MBAM_3.0_or_newer
push eax
call fcn.0043b6b0
mov edx, dword [ebp - 0x9e4]
add esp, 0xc
add edx, 0xfffffff0
or edi, 0xffffffff
mov byte [ebp - 4], 0x29
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x429007
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0xbcc]
mov byte [ebp - 4], 0x27
call fcn.0045dd60
mov byte [ebp - 4], 0x2a
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x429025
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e94d8
call fcn.00410550
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f730
mov edx, 0x4c8104
mov ecx, eax
call fcn.0040f730
push 0x640
mov ecx, eax
call fcn.0040dd30
mov edx, 0x4c832c
mov ecx, eax
call fcn.0040f730
mov esi, dword [ebp - 0x48]
mov ecx, eax
mov edx, esi
call fcn.0040f730
push eax
call fcn.0040faa0
add esp, 4
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0xbcc]
call fcn.00404cc0
xor edx, edx
mov ecx, esi
call fcn.00450570
cmp byte [0x4ea9f6], 0
jne 0x4290ed
push 0x130
lea eax, [ebp - 0x8a0]
push 0
push eax
call fcn.00485bb0
add esp, 8
lea ecx, [ebp - 0x8a0]
push 0
push 0x6a6
push 0x2350
push 0x2351
push 1
call fcn.0041f980
push ecx
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [ebp - 0x8a0]
call fcn.0040db70
lea ecx, [ebp - 0x8a0]
call fcn.0040d220
add esi, 0xfffffff0
mov byte [ebp - 4], 0x2b
lock xadd dword [esi + 0xc], edi
dec edi
test edi, edi
jg 0x429106
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, 0xca
jmp 0x42a037
lea ecx, [ebp - 0x180]
call fcn.00459140
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x44], 0
call fcn.00403b40
mov edx, 0xca
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0xa1c]
call fcn.0044f060
mov byte [ebp - 4], 0x22
push dword [eax]
lea eax, [ebp - 0x44]
push str._s___cant_install_over_MBAM_2.x_or_earlier
push eax
call fcn.0043b6b0
mov edx, dword [ebp - 0xa1c]
add esp, 0xc
add edx, 0xfffffff0
or edi, 0xffffffff
mov byte [ebp - 4], 0x23
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x429179
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0xb54]
mov byte [ebp - 4], 0x21
call fcn.0045dd60
mov byte [ebp - 4], 0x24
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x429197
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e94d8
call fcn.00410550
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f730
mov edx, 0x4c8104
mov ecx, eax
call fcn.0040f730
push 0x60c
mov ecx, eax
call fcn.0040dd30
mov edx, 0x4c832c
mov ecx, eax
call fcn.0040f730
mov esi, dword [ebp - 0x44]
mov ecx, eax
mov edx, esi
call fcn.0040f730
push eax
call fcn.0040faa0
add esp, 4
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0xb54]
call fcn.00404cc0
xorps xmm0, xmm0
mov dword [ebp - 0x38], 0
lea edx, [ebp - 0x34]
movq qword [ebp - 0x40], xmm0
lea ecx, [ebp - 0x40]
call fcn.00452570
lea edx, [ebp - 0x40]
mov byte [ebp - 4], 0x25
mov ecx, esi
call fcn.00450570
cmp byte [0x4ea9f6], 0
jne 0x42927e
push 0x130
lea eax, [ebp - 0x770]
push 0
push eax
call fcn.00485bb0
add esp, 8
lea ecx, [ebp - 0x770]
push 0
push 0x6a6
push 0x235a
push 0x80
push 1
call fcn.0041f980
push ecx
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [ebp - 0x770]
call fcn.0040db70
lea ecx, [ebp - 0x770]
call fcn.0040d220
mov byte [ebp - 4], 0x21
mov ecx, dword [ebp - 0x40]
test ecx, ecx
je 0x4292f2
mov edx, dword [ebp - 0x3c]
push ecx
call fcn.0043c7e0
mov ecx, dword [ebp - 0x38]
mov eax, 0x2aaaaaab
sub ecx, dword [ebp - 0x40]
add esp, 4
imul ecx
mov ecx, dword [ebp - 0x40]
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
lea edx, [eax + eax*2]
mov eax, ecx
shl edx, 3
cmp edx, 0x1000
jb 0x4292d3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42a0d3
push edx
push ecx
call fcn.0046da67
add esp, 8
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
add esi, 0xfffffff0
mov byte [ebp - 4], 0x26
jmp 0x4290f4
mov byte [0x4ea9ef], 1
call fcn.004235d0
xor al, al
xchg byte [esi], al
xor eax, eax
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x104], 7
mov word [ebp - 0x118], ax
lea eax, [ebp - 0x118]
mov byte [ebp - 4], 0x2c
push eax
lea ecx, [ebp - 0x34]
call fcn.00462800
lea eax, [ebp - 0x118]
mov ecx, 0x4e5c88
push eax
call fcn.0043ba20
push 0x4e5c88
lea ecx, [ebp - 0x100]
call fcn.0040beb0
mov byte [ebp - 4], 0x2d
mov eax, dword [ebp - 0xf0]
test eax, eax
je 0x4293c4
dec eax
lea ecx, [ebp - 0x100]
push eax
call fcn.00436870
cmp word [eax], 0x5c
jne 0x4293c4
mov eax, dword [ebp - 0xf0]
lea ecx, [ebp - 0x100]
dec eax
push eax
push 0
lea eax, [ebp - 0xbfc]
push eax
call fcn.00419990
push eax
lea ecx, [ebp - 0x100]
call fcn.0040c3c0
lea ecx, [ebp - 0xbfc]
call fcn.00404cc0
lea eax, [ebp - 0x100]
mov ecx, 0x4e5c88
push eax
call fcn.0043ba20
xor al, al
mov ecx, 0x4e5ac6
xchg byte [ecx], al
lea ecx, [ebp - 0x100]
call fcn.00404cc0
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 0x15
call fcn.00404cc0
jmp 0x4293f0
mov byte [0x4ea9e4], 1
lea ecx, [ebp - 0x34]
call fcn.00461b20
cmp dword [0x4e5d44], 8
mov byte [0x4ea9de], al
mov eax, 0x4e5d30
cmovae eax, dword [0x4e5d30]
push str.NCEP_WIN
push eax
call fcn.0048bc09
add esp, 8
test eax, eax
je 0x429433
call fcn.00423710
test al, al
jne 0x429433
cmp byte [0x4ea9f2], al
je 0x429437
xor al, al
xchg byte [esi], al
cmp byte [0x4ea9f4], 0
je 0x4294b6
lea ecx, [ebp - 0xc14]
call fcn.0045dd60
mov byte [ebp - 4], 0x2e
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x42945a
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e94d8
call fcn.00410550
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f730
mov edx, 0x4c8104
mov ecx, eax
call fcn.0040f730
push 0x66a
mov ecx, eax
call fcn.0040dd30
mov edx, str.:_MB_Teams___MDAM_B_implied_by_filename_or_cmd_line_option
mov ecx, eax
call fcn.0040f730
push eax
call fcn.0040faa0
add esp, 4
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0xc14]
call fcn.00404cc0
xor al, al
xchg byte [esi], al
call fcn.004275b0
or edi, 0xffffffff
mov dword [ebp - 0x24], eax
test eax, eax
je 0x4299b1
cmp byte [0x4ea9f6], 0
je 0x42953d
lea ecx, [ebp - 0xc2c]
call fcn.0045dd60
mov byte [ebp - 4], 0x2f
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x4294ec
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e94d8
call fcn.00410550
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f730
mov edx, 0x4c8104
mov ecx, eax
call fcn.0040f730
push 0x674
mov ecx, eax
call fcn.0040dd30
mov edx, str.:_Pre_check_s__failed_but_in_silent_mode___will_try_to_continue_the_installation
mov ecx, eax
call fcn.0040f730
push eax
call fcn.0040faa0
lea ecx, [ebp - 0xc2c]
jmp 0x429a17
add eax, 0xfffffffe
cmp eax, 7
ja case.0x429545.5
jmp dword [eax*4 + 0x42a0e4]
mov dword [ebp - 0x1c], 0x2346
mov byte [ebp - 0x15], 0
jmp 0x42957e
mov dword [ebp - 0x1c], 0x2347
mov byte [ebp - 0x15], 0
jmp 0x42957e
mov dword [ebp - 0x1c], 0x2348
mov byte [ebp - 0x15], 0
jmp 0x42957e
mov dword [ebp - 0x1c], 0x2349
mov byte [ebp - 0x15], 1
mov esi, 0x80
call fcn.00423710
test al, al
mov dword [ebp - 0x4c], 0
mov ecx, 0x2329
mov eax, 0x2328
cmovne esi, ecx
cmp byte [0x4ea9f4], 0
lea ecx, [ebp - 0x4c]
cmovne esi, eax
mov dword [ebp - 0x20], esi
call fcn.00403b40
mov dword [ebp - 0x9d4], 0
mov byte [ebp - 4], 0x32
call fcn.00403a40
mov ecx, eax
test ecx, ecx
je 0x42a0d8
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
mov byte [ebp - 4], 0x31
mov ecx, dword [ebp - 0x24]
lea esi, [eax + 0x10]
mov eax, dword [ebp - 0x9e4]
or eax, 0x20
mov dword [ebp - 0x9d4], esi
mov dword [ebp - 0x9d8], eax
mov eax, 0x4cda38
nop dword [eax + eax]
mov edx, dword [eax + 4]
cmp ecx, dword [eax]
je 0x429613
add eax, 8
cmp eax, str.Malwarebytes.exe
jne 0x429600
jmp 0x42963f
test edx, edx
jne 0x42961b
xor ecx, ecx
jmp 0x429629
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x429620
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0x9d4]
call fcn.004032a0
mov esi, dword [ebp - 0x9d4]
mov ecx, dword [ebp - 0x24]
cmp dword [esi - 0xc], 0
jne 0x429660
push ecx
lea eax, [ebp - 0x9d4]
push str.undefined___d_
push eax
call fcn.0043b6b0
mov esi, dword [ebp - 0x9d4]
add esp, 0xc
mov edx, 0xcc
lea ecx, [ebp - 0xa14]
call fcn.0044f060
push esi
mov byte [ebp - 4], 0x33
push dword [eax]
lea eax, [ebp - 0x4c]
push str._s___prerequisite_failure__s
push eax
call fcn.0043b6b0
mov edx, dword [ebp - 0xa14]
add esp, 0x10
add edx, 0xfffffff0
mov byte [ebp - 4], 0x34
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4296a9
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 0xfffffff0
mov byte [ebp - 4], 0x35
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4296c4
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0xbb4]
mov byte [ebp - 4], 0x30
call fcn.0045dd60
mov byte [ebp - 4], 0x36
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x4296e2
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e94d8
call fcn.00410550
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f730
mov edx, 0x4c8104
mov ecx, eax
call fcn.0040f730
push 0x686
mov ecx, eax
call fcn.0040dd30
mov edx, 0x4c832c
mov ecx, eax
call fcn.0040f730
mov esi, dword [ebp - 0x4c]
mov ecx, eax
mov edx, esi
call fcn.0040f730
push eax
call fcn.0040faa0
add esp, 4
lea ecx, [ebp - 0xbb4]
call fcn.00404cc0
cmp byte [ebp - 0x15], 0
push 0x130
push 0
je 0x4298c8
lea eax, [ebp - 0x2b0]
push eax
call fcn.00485bb0
add esp, 8
lea ecx, [ebp - 0x2b0]
push 0x2333
push 0x2332
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push 0
call fcn.0041f980
push ecx
mov byte [ebp - 4], 0x37
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [ebp - 0x2b0]
call fcn.0040db70
cmp eax, 0x644
jne 0x429827
lea ecx, [ebp - 0xc5c]
call fcn.0045dd60
mov byte [ebp - 4], 0x38
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x4297bb
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e94d8
call fcn.00410550
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f730
mov edx, 0x4c8104
mov ecx, eax
call fcn.0040f730
push 0x68d
mov ecx, eax
call fcn.0040dd30
mov edx, str.:_User_chose_to_cancel_the_installation
mov ecx, eax
call fcn.0040f730
push eax
call fcn.0040faa0
add esp, 4
mov byte [ebp - 4], 0x37
lea ecx, [ebp - 0xc5c]
call fcn.00404cc0
xor edx, edx
mov ecx, esi
call fcn.00450570
lea ecx, [ebp - 0x2b0]
jmp 0x429989
lea ecx, [ebp - 0x2b0]
mov byte [ebp - 4], 0x30
call fcn.0040d220
lea ecx, [ebp - 0xb24]
call fcn.0045dd60
mov byte [ebp - 4], 0x3d
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x429850
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e94d8
call fcn.00410550
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f730
mov edx, 0x4c8104
mov ecx, eax
call fcn.0040f730
push 0x6a1
mov ecx, eax
call fcn.0040dd30
mov edx, str.:_User_chose_to_continue_the_installation
mov ecx, eax
call fcn.0040f730
push eax
call fcn.0040faa0
add esp, 4
lea ecx, [ebp - 0xb24]
call fcn.00404cc0
add esi, 0xfffffff0
mov byte [ebp - 4], 0x3e
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4298bf
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x15
jmp 0x429a23
lea eax, [ebp - 0x9d0]
push eax
call fcn.00485bb0
add esp, 8
lea ecx, [ebp - 0x9d0]
push 0
push 0x6a6
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push 0
call fcn.0041f980
push ecx
mov byte [ebp - 4], 0x3a
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [ebp - 0x9d0]
call fcn.0040db70
lea ecx, [ebp - 0xb3c]
call fcn.0045dd60
mov byte [ebp - 4], 0x3b
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x429922
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e94d8
call fcn.00410550
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f730
mov edx, 0x4c8104
mov ecx, eax
call fcn.0040f730
push 0x699
mov ecx, eax
call fcn.0040dd30
mov edx, str.:_User_chose_to_cancel_the_installation
mov ecx, eax
call fcn.0040f730
push eax
call fcn.0040faa0
add esp, 4
mov byte [ebp - 4], 0x3a
lea ecx, [ebp - 0xb3c]
call fcn.00404cc0
xor edx, edx
mov ecx, esi
call fcn.00450570
lea ecx, [ebp - 0x9d0]
call fcn.0040d220
add esi, 0xfffffff0
mov byte [ebp - 4], 0x3c
lock xadd dword [esi + 0xc], edi
dec edi
test edi, edi
jg 0x4299a7
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, 0xcc
jmp 0x42a037
lea ecx, [ebp - 0xbe4]
call fcn.0045dd60
mov byte [ebp - 4], 0x3f
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x4299cb
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e94d8
call fcn.00410550
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f730
mov edx, 0x4c8104
mov ecx, eax
call fcn.0040f730
push 0x6a6
mov ecx, eax
call fcn.0040dd30
mov edx, str.:_All_installation_pre_checks_passed
mov ecx, eax
call fcn.0040f730
push eax
call fcn.0040faa0
lea ecx, [ebp - 0xbe4]
add esp, 4
mov byte [ebp - 4], 0x15
call fcn.00404cc0
mov esi, 2
push ecx
mov edx, esi
call fcn.0040bfd0
add esp, 4
test al, al
jne 0x429c18
call fcn.0042e4b0
test al, al
jne 0x429c18
lea ecx, [ebp - 0xb6c]
call fcn.0045dd60
mov byte [ebp - 4], 0x40
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x429a62
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e94d8
call fcn.00410550
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f730
mov edx, 0x4c8104
mov ecx, eax
call fcn.0040f730
push 0x6ae
mov ecx, eax
call fcn.0040dd30
mov edx, str.:_Warning___This_computer_appears_to_be_missing_patch_KB4474419
mov ecx, eax
call fcn.0040f730
push eax
call fcn.0040faa0
add esp, 4
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0xb6c]
call fcn.00404cc0
call fcn.00423710
test al, al
jne 0x429ad0
call fcn.00423790
test al, al
je 0x429c18
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x50], 0
call fcn.00403b40
mov edx, 0xcc
mov byte [ebp - 4], 0x41
lea ecx, [ebp - 0xa18]
call fcn.0044f060
mov byte [ebp - 4], 0x42
push dword [eax]
lea eax, [ebp - 0x50]
push str._s___prerequisite_failure_MissingSHA2CodeSigningSupportPatch
push eax
call fcn.0043b6b0
mov edx, dword [ebp - 0xa18]
add esp, 0xc
add edx, 0xfffffff0
mov byte [ebp - 4], 0x43
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x429b2b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x41
xor edx, edx
mov esi, dword [ebp - 0x50]
mov ecx, esi
call fcn.00450570
cmp byte [0x4ea9f6], 0
jne 0x429b9e
push 0x130
lea eax, [ebp - 0x3e0]
push 0
push eax
call fcn.00485bb0
add esp, 8
call fcn.004236b0
test al, al
mov edx, str.https:__links.malwarebytes.com_support_mb_windows_system_requirements
mov ecx, str.https:__links.malwarebytes.com_support_general_business_ms_2019_09_security_update
cmove ecx, edx
push ecx
push 0x236e
push ecx
lea ecx, [ebp - 0x3e0]
call fcn.0041fc20
push ecx
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [ebp - 0x3e0]
call fcn.0040db70
lea ecx, [ebp - 0x3e0]
call fcn.0040d220
lea ecx, [ebp - 0xb84]
call fcn.0045dd60
mov byte [ebp - 4], 0x44
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x429bb8
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e94d8
call fcn.00410550
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f730
mov edx, 0x4c8104
mov ecx, eax
call fcn.0040f730
push 0x6bf
mov ecx, eax
call fcn.0040dd30
mov edx, str.:_Exit_due_to_missing_SHA_2_code_signing_support_patch__KB4474419_
mov ecx, eax
call fcn.0040f730
push eax
call fcn.0040faa0
add esp, 4
lea ecx, [ebp - 0xb84]
call fcn.00404cc0
add esi, 0xfffffff0
mov byte [ebp - 4], 0x45
jmp 0x429995
push 0x4e5c88
mov ecx, 0x4e5ec8
call fcn.0040bfa0
cmp byte [0x4ea9f4], 0
setne byte [0x4eaa00]
cmp byte [0x4ea9f6], 0
jne 0x429f55
lea ecx, [ebp - 0xb9c]
call fcn.0045dd60
mov byte [ebp - 4], 0x46
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x429c5c
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e94d8
call fcn.00410550
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f730
mov edx, 0x4c8104
mov ecx, eax
call fcn.0040f730
push 0x6dd
mov ecx, eax
call fcn.0040dd30
mov edx, str.:_Displaying_User_Interface
mov ecx, eax
call fcn.0040f730
push eax
call fcn.0040faa0
add esp, 4
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0xb9c]
call fcn.00404cc0
cmp byte [0x4ea9e7], 0
jne 0x429d2f
lea ecx, [ebp - 0xc74]
call fcn.0045dd60
mov byte [ebp - 4], 0x47
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x429cd7
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e94d8
call fcn.00410550
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f730
mov edx, 0x4c8104
mov ecx, eax
call fcn.0040f730
push 0x6e1
mov ecx, eax
call fcn.0040dd30
mov edx, str.:_Not_showing_BrowserGuard_screen
mov ecx, eax
call fcn.0040f730
push eax
call fcn.0040faa0
add esp, 4
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0xc74]
call fcn.00404cc0
mov eax, 0x4eaa54
xchg dword [eax], esi
call fcn.00443b70
mov dword [ebp - 0x9dc], eax
test eax, eax
je 0x429db1
mov esi, dword [0x4eaa54]
lea ecx, [ebp - 0x54]
mov dword [ebp - 0x54], 0
call fcn.00403b40
push dword [ebp - 0x9dc]
lea eax, [ebp - 0x54]
mov byte [ebp - 4], 0x48
push esi
push str.changing_service_install_status_code_from__u_to__d
push eax
call fcn.0040f680
mov esi, dword [ebp - 0x54]
mov edx, 0x6f5
push esi
mov ecx, 0x4c9f48
call fcn.00441310
mov eax, dword [ebp - 0x9dc]
add esp, 0x14
mov ecx, 0x4eaa54
xchg dword [ecx], eax
add esi, 0xfffffff0
mov byte [ebp - 4], 0x49
lock xadd dword [esi + 0xc], edi
dec edi
test edi, edi
jg 0x429db6
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x429db6
call fcn.004523c0
mov byte [ebp - 4], 0x4a
lea ecx, [ebp - 0xa8]
push 0
mov byte [ebp - 0xb0], 0
call fcn.004559c0
mov byte [ebp - 4], 0x4b
lea ecx, [ebp - 0x9f0]
mov byte [ebp - 0x9f8], 0
xorps xmm0, xmm0
push dword [ebp - 0x9f8]
movq qword [ebp - 0x9f0], xmm0
call fcn.004548a0
xorps xmm0, xmm0
mov byte [ebp - 0x9f8], 3
push 0x18
movlpd qword [ebp - 0xe8], xmm0
call fcn.0046da75
mov edi, eax
add esp, 4
lea eax, [ebp - 0x15]
mov dword [ebp - 0xe4], edi
mov dword [ebp - 0xe8], eax
mov byte [ebp - 4], 0x4c
mov ecx, edi
push 0xf
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
push str.Close_Installer
mov byte [edi], 0
call fcn.0040c400
mov dword [ebp - 0x9f0], edi
push str.event_type
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 0x4d
call fcn.004567f0
mov esi, eax
mov al, byte [esi]
mov byte [esi], 3
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0xc]
mov dword [ebp - 0x9dc], eax
mov byte [ebp - 0x9f8], al
mov eax, dword [ebp - 0x9ec]
mov dword [esi + 8], edi
mov dword [esi + 0xc], eax
mov dword [ebp - 0x9f0], ecx
mov dword [ebp - 0x9ec], edx
push dword [ebp - 0x9dc]
lea ecx, [ebp - 0x9f0]
mov byte [ebp - 4], 0x4e
call fcn.004548a0
push str.event_properties
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 0x4b
call fcn.004567f0
push 0x4eaa5c
lea ecx, [ebp - 0xa08]
mov esi, eax
call fcn.00456950
push str.lastScreenShown
mov ecx, esi
mov byte [ebp - 4], 0x4f
call fcn.004567f0
mov cl, byte [ebp - 0xa08]
mov esi, eax
mov dl, byte [esi]
mov byte [esi], cl
mov eax, dword [ebp - 0xa00]
mov byte [ebp - 0xa08], dl
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0xc]
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x9fc]
mov dword [esi + 0xc], eax
mov dword [ebp - 0xa00], ecx
mov dword [ebp - 0x9fc], edx
mov byte [ebp - 4], 0x50
lea ecx, [ebp - 0xa00]
push dword [ebp - 0xa08]
call fcn.004548a0
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 0x4b
call fcn.004528a0
mov byte [ebp - 4], 0x51
lea ecx, [ebp - 0xa8]
push dword [ebp - 0xb0]
call fcn.004548a0
mov esi, dword [0x4eaa54]
jmp 0x42a037
call fcn.004458c0
mov ecx, 0x4eaa51
call fcn.00412070
test al, al
jne 0x429f85
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
nop
push 0x3e8
call esi
mov ecx, 0x4eaa51
call fcn.00412070
test al, al
je 0x429f70
push 5
push 0x4eaa54
call fcn.00411fb0
add esp, 8
test eax, eax
je 0x429fd3
push 5
push 0x4eaa54
call fcn.00411fb0
add esp, 8
lea ecx, [ebp - 0x9e8]
mov edx, eax
call fcn.004496b0
mov byte [ebp - 4], 0x52
xor edx, edx
mov ecx, dword [eax]
call fcn.00450570
lea ecx, [ebp - 0x9e8]
call fcn.00403d10
mov esi, 3
jmp 0x42a037
mov ecx, 0x4eaa50
call fcn.00412070
mov esi, 0x4eaa58
test al, al
je 0x429ff3
call fcn.00424550
test al, al
jne 0x42a030
mov al, 1
xchg byte [esi], al
mov ecx, 0x4eaa52
call fcn.00412070
test al, al
je 0x42a00d
call fcn.004500f0
call fcn.0042e820
jmp 0x42a035
mov ecx, esi
call fcn.00412070
test al, al
je 0x42a02b
xor edx, edx
mov ecx, str.Failed_to_download_and_run_offline_installer
call fcn.00450570
mov esi, 3
jmp 0x42a037
call fcn.004523c0
call fcn.004500f0
xor esi, esi
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x34], vtable.InstalledProducts.0
call fcn.00455790
lea ecx, [ebp - 0x74]
call fcn.004364e0
lea ecx, [ebp - 0xe0]
call fcn.00404cc0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0046d546
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push 0x80004005
call fcn.00403bb0
call fcn.004889bc
call fcn.0048c340
call fcn.004889bc
call fcn.004889bc
call fcn.004889bc
call fcn.004889bc
push 0x80004005
call fcn.00403bb0
call fcn.004889bc
call fcn.004889bc
call fcn.004889bc
call fcn.004889bc
call fcn.004889bc
call fcn.004889bc
call fcn.004889bc
call fcn.004889bc
call fcn.004889bc
push 0x80004005
call fcn.00403bb0
nop
pop ecx
xchg ebp, eax
inc edx
add byte [esi - 0x6b], ah
inc edx
add byte [esi - 0x6b], ah
inc edx
add byte [ebx - 0x6b], dh
inc edx
add byte [esi - 0x6b], ah
inc edx
add byte [esi - 0x6b], ah
inc edx
add byte [ebx - 0x6b], dh
inc edx
add byte [ebp + edx*4 + 0x42], cl
add ah, cl
int3