Function at 0x4285c0
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Encode data using base64

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b1c9c
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0xc68
mov eax, dword [0x4e706c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor esi, esi
xor eax, eax
mov dword [ebp - 0x9d4], esi
mov dword [ebp - 0xd0], esi
mov dword [ebp - 0xcc], 7
mov word [ebp - 0xe0], ax
lea edx, [ebp - 0xe0]
mov dword [ebp - 4], eax
call fcn.00424dd0
test al, al
jne 0x42878c
mov byte [ebp - 4], 1
call fcn.00403ab0
mov ecx, eax
test ecx, ecx
je 0x42a539
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x78], eax
lea edx, [esi + 3]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x9e0]
call fcn.0044f510
mov byte [ebp - 4], 3
push dword [eax]
lea eax, [ebp - 0x78]
push str._s___could_not_determine_install_and_or_data_directories
push eax
call fcn.0043bb60
mov edx, dword [ebp - 0x9e0]
add esp, 0xc
add edx, 0xfffffff0
or edi, 0xffffffff
mov byte [ebp - 4], 4
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4286a5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0xb10]
mov byte [ebp - 4], 2
call fcn.0045f3e0
mov byte [ebp - 4], 5
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x4286c3
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4eb558
call fcn.004105c0
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f7a0
mov edx, 0x4c9104
mov ecx, eax
call fcn.0040f7a0
push 0x59d
mov ecx, eax
call fcn.0040dda0
mov edx, 0x4c932c
mov ecx, eax
call fcn.0040f7a0
mov esi, dword [ebp - 0x78]
mov ecx, eax
mov edx, esi
call fcn.0040f7a0
push eax
call fcn.0040fb10
mov byte [ebp - 4], 2
add esp, 4
mov edx, dword [ebp - 0xafc]
cmp edx, 8
jb 0x42875c
mov ecx, dword [ebp - 0xb10]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x428752
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42a543
push edx
push ecx
call fcn.0046f0d0
add esp, 8
xor edx, edx
mov ecx, esi
call fcn.004511a0
add esi, 0xfffffff0
mov byte [ebp - 4], 6
lock xadd dword [esi + 0xc], edi
dec edi
test edi, edi
jg 0x428b23
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, 3
jmp 0x42a50e
cmp dword [ebp - 0xcc], 8
lea eax, [ebp - 0xe0]
push dword [ebp - 0xd0]
cmovae eax, dword [ebp - 0xe0]
mov ecx, 0x4e7c88
push eax
call fcn.00407990
cmp byte [0x4eca84], 0
mov edi, 0x4e7ee0
je 0x42884d
mov ecx, 0x4e7c88
cmp ecx, 0x4e7ca0
je 0x4287ef
cmp dword [0x4e7cb4], 8
mov eax, 0x4e7ca0
push dword [0x4e7cb0]
cmovae eax, dword [0x4e7ca0]
push eax
call fcn.00407990
cmp byte [0x4eca6d], 0
mov byte [0x4eca5f], 1
je 0x42884d
push 0x4e7c88
lea ecx, [ebp - 0xa80]
call fcn.0040bf20
mov esi, 4
mov ecx, edi
mov dword [ebp - 0x9d4], esi
call fcn.00404d30
movups xmm0, xmmword [ebp - 0xa80]
push 5
push str.data
movups xmmword [0x4e7ee0], xmm0
mov ecx, edi
movq xmm0, qword [ebp - 0xa70]
movq qword [0x4e7ef0], xmm0
call fcn.0040c2d0
cmp byte [0x4eca83], 0
je 0x42887f
cmp edi, 0x4e7cd0
je 0x42887f
cmp dword [0x4e7ce4], 8
mov eax, 0x4e7cd0
push dword [0x4e7ce0]
cmovae eax, dword [0x4e7cd0]
mov ecx, edi
push eax
call fcn.00407990
cmp byte [0x4eca6d], 0
je 0x428b2d
push 0x4ecba4
push 0x41a1b0
push 0x4ecbac
mov dword [ebp - 0x68], 0
call fcn.0046b5e3
add esp, 0xc
test eax, eax
je 0x42a548
cmp dword [0x4e7c9c], 8
mov eax, 0x4e7c88
mov edi, dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
cmovae eax, dword [0x4e7c88]
push eax
mov dword [ebp - 0x64], 0x4ecba4
call edi
test eax, eax
jne 0x4289af
lea edx, [ebp - 0x68]
mov ecx, 0x4e7c88
call fcn.0043e770
test al, al
jne 0x4289af
cmp dword [ebp - 0x68], 0xb7
je 0x4289af
lea ecx, [ebp - 0xa98]
call fcn.0045f3e0
mov byte [ebp - 4], 7
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x428919
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4eb558
call fcn.004105c0
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f7a0
mov edx, 0x4c9104
mov ecx, eax
call fcn.0040f7a0
push 0x5c2
mov ecx, eax
call fcn.0040dda0
mov edx, str.:_Error___could_not_create_install_directory._Error:
mov ecx, eax
call fcn.0040f7a0
push dword [ebp - 0x68]
mov ecx, eax
call fcn.0040dda0
push eax
call fcn.0040fb10
mov edx, dword [ebp - 0xa84]
add esp, 4
cmp edx, 8
jb 0x428b23
mov ecx, dword [ebp - 0xa98]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x428b19
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42a54d
jmp 0x428b19
cmp dword [0x4e7ef4], 8
mov eax, 0x4e7ee0
cmovae eax, dword [0x4e7ee0]
push eax
call edi
test eax, eax
jne 0x428b2d
mov byte [ebp - 0x9e0], al
lea ecx, [ebp - 0xa68]
push dword [ebp - 0x9e0]
mov edx, 0x4e7ee0
call fcn.00418f10
add esp, 4
mov byte [ebp - 4], 8
lea edx, [ebp - 0x68]
or esi, 1
lea ecx, [ebp - 0xa68]
mov dword [ebp - 0x9d4], esi
call fcn.0043e770
mov edi, dword [ebp - 0x68]
test al, al
jne 0x428a1a
mov byte [ebp - 0x15], 1
cmp edi, 0xb7
jne 0x428a1e
mov byte [ebp - 0x15], 0
mov dword [ebp - 4], 0
and esi, 0xfffffffe
mov edx, dword [ebp - 0xa54]
mov dword [ebp - 0x9d4], esi
cmp edx, 8
jb 0x428a6e
mov ecx, dword [ebp - 0xa68]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x428a64
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42a552
push edx
push ecx
call fcn.0046f0d0
add esp, 8
cmp byte [ebp - 0x15], 0
je 0x428b2d
lea ecx, [ebp - 0xab0]
call fcn.0045f3e0
mov byte [ebp - 4], 9
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x428a92
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4eb558
call fcn.004105c0
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f7a0
mov edx, 0x4c9104
mov ecx, eax
call fcn.0040f7a0
push 0x5cb
mov ecx, eax
call fcn.0040dda0
mov edx, str.:_Error___could_not_create_data_directory._Error:
mov ecx, eax
call fcn.0040f7a0
push edi
mov ecx, eax
call fcn.0040dda0
push eax
call fcn.0040fb10
mov edx, dword [ebp - 0xa9c]
add esp, 4
cmp edx, 8
jb 0x428b23
mov ecx, dword [ebp - 0xab0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x428b19
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42a557
push edx
push ecx
call fcn.0046f0d0
add esp, 8
mov esi, 3
jmp 0x42a50e
push 6
xor eax, eax
mov dword [ebp - 0xa28], 0
push str.MBAM_C
lea ecx, [ebp - 0xa38]
mov dword [ebp - 0xa24], 7
mov word [ebp - 0xa38], ax
call fcn.00407990
push ecx
mov edx, 1
call fcn.0040c040
mov edx, dword [ebp - 0xa24]
add esp, 4
cmp al, 1
setne al
mov byte [ebp - 0x15], al
cmp edx, 8
jb 0x428bb5
mov ecx, dword [ebp - 0xa38]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x428ba8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42a55c
push edx
push ecx
call fcn.0046f0d0
mov al, byte [ebp - 0x15]
add esp, 8
test al, al
je 0x428d6a
mov byte [ebp - 4], 0xa
call fcn.00403ab0
mov ecx, eax
test ecx, ecx
je 0x42a561
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x20], eax
mov edx, 0xc8
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0xa0c]
call fcn.0044f510
mov byte [ebp - 4], 0xc
push dword [eax]
lea eax, [ebp - 0x20]
push str._s___unsupported_operating_system
push eax
call fcn.0043bb60
mov edx, dword [ebp - 0xa0c]
add esp, 0xc
add edx, 0xfffffff0
or edi, 0xffffffff
mov byte [ebp - 4], 0xd
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x428c2c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0xac8]
mov byte [ebp - 4], 0xb
call fcn.0045f3e0
mov byte [ebp - 4], 0xe
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x428c4a
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4eb558
call fcn.004105c0
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f7a0
mov edx, 0x4c9104
mov ecx, eax
call fcn.0040f7a0
push 0x5d8
mov ecx, eax
call fcn.0040dda0
mov edx, 0x4c932c
mov ecx, eax
call fcn.0040f7a0
mov esi, dword [ebp - 0x20]
mov ecx, eax
mov edx, esi
call fcn.0040f7a0
push eax
call fcn.0040fb10
mov byte [ebp - 4], 0xb
add esp, 4
mov edx, dword [ebp - 0xab4]
cmp edx, 8
jb 0x428ce3
mov ecx, dword [ebp - 0xac8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x428cd9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42a56b
push edx
push ecx
call fcn.0046f0d0
add esp, 8
xor edx, edx
mov ecx, esi
call fcn.004511a0
cmp byte [0x4eca76], 0
jne 0x428d47
push 0x130
lea eax, [ebp - 0x510]
push 0
push eax
call fcn.00487250
add esp, 8
lea ecx, [ebp - 0x510]
push 0
push 0x6a6
push 0x235d
push 0x80
push 1
call fcn.0041fe20
push ecx
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [ebp - 0x510]
call fcn.0040dbe0
lea ecx, [ebp - 0x510]
call fcn.0040d290
add esi, 0xfffffff0
mov byte [ebp - 4], 0xf
lock xadd dword [esi + 0xc], edi
dec edi
test edi, edi
jg 0x428d60
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, 0xc8
jmp 0x42a50e
xorps xmm0, xmm0
mov dword [ebp - 0x6c], 0
movq qword [ebp - 0x74], xmm0
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x6c], 0
mov byte [ebp - 4], 0x10
call fcn.00423c50
test al, al
je 0x42906b
cmp byte [0x4eca76], 0
jne 0x42906b
call fcn.004312e0
test al, al
je 0x42906b
mov eax, dword [ebp - 0x74]
cmp eax, dword [ebp - 0x70]
je 0x42906b
push str.https:__links.malwarebytes.com_support_installer_AVBlocking
lea ecx, [ebp - 0xc8]
call fcn.00404ce0
mov byte [ebp - 4], 0x11
mov eax, dword [ebp - 0x74]
cmp dword [eax + 0x40], 0
lea ecx, [eax + 0x30]
je 0x428df4
push ecx
lea ecx, [ebp - 0xc8]
call fcn.0040c010
mov eax, dword [ebp - 0x74]
push eax
mov edx, str.We_have_detected
lea ecx, [ebp - 0xae0]
call fcn.0043bc00
add esp, 4
push str._installed_on_your_computer._This_product_may_interfere_with
mov edx, eax
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0xa50]
call fcn.0043bda0
add esp, 4
push str.the_installation_of_Malwarebytes._Please_click_Yes_to_find_out_how_to_safely_install_Malwarebytes._You_can_click_No_to_proceed_with_installation__or_Cancel_to_exit.
mov edx, eax
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x90]
call fcn.0043bda0
mov byte [ebp - 4], 0x12
add esp, 4
mov edx, dword [ebp - 0xa3c]
cmp edx, 8
jb 0x428e7e
mov ecx, dword [ebp - 0xa50]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x428e74
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42a570
push edx
push ecx
call fcn.0046f0d0
add esp, 8
xor eax, eax
mov byte [ebp - 4], 0x11
mov edx, dword [ebp - 0xacc]
mov dword [ebp - 0xa40], 0
mov dword [ebp - 0xa3c], 7
mov word [ebp - 0xa50], ax
cmp edx, 8
jb 0x428edf
mov ecx, dword [ebp - 0xae0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x428ed5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42a575
push edx
push ecx
call fcn.0046f0d0
add esp, 8
cmp dword [ebp - 0x7c], 8
lea eax, [ebp - 0x90]
push 3
cmovae eax, dword [ebp - 0x90]
push str.Malwarebytes_Installer
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x428f2c
cmp dword [ebp - 0xb4], 8
lea eax, [ebp - 0xc8]
push 5
cmovae eax, dword [ebp - 0xc8]
push 0
push 0
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x428f35
cmp eax, 2
jne 0x428fd3
mov edx, dword [ebp - 0x7c]
cmp edx, 8
jb 0x428f72
mov ecx, dword [ebp - 0x90]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x428f68
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42a57a
push edx
push ecx
call fcn.0046f0d0
add esp, 8
mov edx, dword [ebp - 0xb4]
xor eax, eax
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x7c], 7
mov word [ebp - 0x90], ax
cmp edx, 8
jb 0x428fc9
mov ecx, dword [ebp - 0xc8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x428fbf
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42a57f
push edx
push ecx
call fcn.0046f0d0
add esp, 8
mov esi, 0xcb
jmp 0x42a506
mov edx, dword [ebp - 0x7c]
cmp edx, 8
jb 0x429010
mov ecx, dword [ebp - 0x90]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x429006
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42a584
push edx
push ecx
call fcn.0046f0d0
add esp, 8
xor eax, eax
mov byte [ebp - 4], 0x10
mov edx, dword [ebp - 0xb4]
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x7c], 7
mov word [ebp - 0x90], ax
cmp edx, 8
jb 0x42906b
mov ecx, dword [ebp - 0xc8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x429061
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42a589
push edx
push ecx
call fcn.0046f0d0
add esp, 8
xorps xmm0, xmm0
movups xmmword [ebp - 0x34], xmm0
mov dword [ebp - 0x34], vtable.InstalledProducts.0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
push 0
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0x14
call fcn.00462450
push 1
lea ecx, [ebp - 0x34]
call fcn.00462450
mov byte [ebp - 4], 0x15
cmp byte [0x4eca5c], 0
jne 0x429437
push str.MBAM_C
lea ecx, [ebp - 0xaf8]
call fcn.00404ce0
mov byte [ebp - 4], 0x16
lea edx, [ebp - 0x34]
or esi, 2
lea ecx, [ebp - 0xaf8]
mov dword [ebp - 0x9d4], esi
call fcn.0045ee60
test al, al
je 0x4290fe
call fcn.00423ba0
test al, al
je 0x4290f8
call fcn.0045ece0
test al, al
jne 0x4290fe
mov byte [ebp - 0x15], 0
jmp 0x429102
mov byte [ebp - 0x15], 1
mov dword [ebp - 4], 0x15
lea ecx, [ebp - 0xaf8]
and esi, 0xfffffffd
mov dword [ebp - 0x9d4], esi
call fcn.00404d30
cmp byte [ebp - 0x15], 0
je 0x429321
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
call fcn.00403bb0
mov edx, 0xc9
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0xa10]
call fcn.0044f510
mov byte [ebp - 4], 0x18
push dword [eax]
lea eax, [ebp - 0x1c]
push str._s___cant_install_over_business_products
push eax
call fcn.0043bb60
mov edx, dword [ebp - 0xa10]
add esp, 0xc
add edx, 0xfffffff0
or edi, 0xffffffff
mov byte [ebp - 4], 0x19
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x429185
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0xc48]
mov byte [ebp - 4], 0x17
call fcn.0045f3e0
mov byte [ebp - 4], 0x1a
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x4291a3
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4eb558
call fcn.004105c0
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f7a0
mov edx, 0x4c9104
mov ecx, eax
call fcn.0040f7a0
push 0x60e
mov ecx, eax
call fcn.0040dda0
mov edx, 0x4c932c
mov ecx, eax
call fcn.0040f7a0
mov esi, dword [ebp - 0x1c]
mov ecx, eax
mov edx, esi
call fcn.0040f7a0
push eax
call fcn.0040fb10
add esp, 4
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0xc48]
call fcn.00404d30
xorps xmm0, xmm0
mov dword [ebp - 0x58], 0
lea edx, [ebp - 0x34]
movq qword [ebp - 0x60], xmm0
lea ecx, [ebp - 0x60]
call fcn.00453630
lea edx, [ebp - 0x60]
mov byte [ebp - 4], 0x1b
mov ecx, esi
call fcn.004511a0
cmp byte [0x4eca76], 0
jne 0x42928a
push 0x130
lea eax, [ebp - 0x640]
push 0
push eax
call fcn.00487250
add esp, 8
lea ecx, [ebp - 0x640]
push 0
push 0x6a6
push 0x235b
push 0x80
push 1
call fcn.0041fe20
push ecx
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [ebp - 0x640]
call fcn.0040dbe0
lea ecx, [ebp - 0x640]
call fcn.0040d290
mov byte [ebp - 4], 0x17
mov ecx, dword [ebp - 0x60]
test ecx, ecx
je 0x4292fe
mov edx, dword [ebp - 0x5c]
push ecx
call fcn.0043cc90
mov ecx, dword [ebp - 0x58]
mov eax, 0x2aaaaaab
sub ecx, dword [ebp - 0x60]
add esp, 4
imul ecx
mov ecx, dword [ebp - 0x60]
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
lea edx, [eax + eax*2]
mov eax, ecx
shl edx, 3
cmp edx, 0x1000
jb 0x4292df
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42a58e
push edx
push ecx
call fcn.0046f0d0
add esp, 8
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x58], 0
add esi, 0xfffffff0
mov byte [ebp - 4], 0x1c
lock xadd dword [esi + 0xc], edi
dec edi
test edi, edi
jg 0x429317
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, 0xc9
jmp 0x42a4f7
call fcn.00423bd0
test al, al
jne 0x429437
mov edi, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
cmp esi, edi
je 0x429437
add esi, 0x1c
nop
lea eax, [esi - 0x18]
mov dword [ebp - method.InstalledProducts::InstalledProduct.virtual_0], vtable.InstalledProducts::InstalledProduct.0
push eax
lea ecx, [ebp - 0x17c]
call fcn.0040bf20
push esi
lea ecx, [ebp - 0x164]
mov byte [ebp - 4], 0x1d
call fcn.0040bf20
lea eax, [esi + 0x18]
mov byte [ebp - 4], 0x1e
push eax
lea ecx, [ebp - 0x14c]
call fcn.0040bf20
lea eax, [esi + 0x30]
mov byte [ebp - 4], 0x1f
push eax
lea ecx, [ebp - 0x134]
call fcn.0040bf20
mov al, byte [esi + 0x48]
mov byte [ebp - 0x11c], al
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x164]
cmp dword [ebp - 0x150], 8
cmovae ecx, dword [ebp - 0x164]
cmp dword [ebp - 0x154], 0x19
jb 0x42941a
push 0x19
mov edx, str.Malwarebytes_Anti_Malware
call fcn.004197c0
add esp, 4
test eax, eax
jne 0x42941a
sub esp, 0x18
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x9c], eax
mov ecx, esp
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], eax
lea eax, [ebp - 0x14c]
push eax
call fcn.0040bf20
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 0x98]
push eax
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.00462c50
cmp dword [ebp - 0x24], 2
jbe 0x4295c0
lea ecx, [ebp - 0x180]
mov byte [ebp - 4], 0x15
call fcn.0045a7c0
add esi, 0x68
lea eax, [esi - 0x1c]
cmp eax, edi
jne 0x429340
lea ecx, [ebp - 0x34]
call fcn.00462f00
mov esi, 0x4e7ac5
test al, al
je 0x429899
call fcn.00423bd0
test al, al
je 0x4297ae
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x48], 0
call fcn.00403bb0
mov edx, 0xca
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0xa14]
call fcn.0044f510
mov byte [ebp - 4], 0x28
push dword [eax]
lea eax, [ebp - 0x48]
push str._s___cant_install_ARW_over_MBAM_3.0_or_newer
push eax
call fcn.0043bb60
mov edx, dword [ebp - 0xa14]
add esp, 0xc
add edx, 0xfffffff0
or edi, 0xffffffff
mov byte [ebp - 4], 0x29
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4294b7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0xbd0]
mov byte [ebp - 4], 0x27
call fcn.0045f3e0
mov byte [ebp - 4], 0x2a
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x4294d5
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4eb558
call fcn.004105c0
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f7a0
mov edx, 0x4c9104
mov ecx, eax
call fcn.0040f7a0
push 0x65d
mov ecx, eax
call fcn.0040dda0
mov edx, 0x4c932c
mov ecx, eax
call fcn.0040f7a0
mov esi, dword [ebp - 0x48]
mov ecx, eax
mov edx, esi
call fcn.0040f7a0
push eax
call fcn.0040fb10
add esp, 4
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0xbd0]
call fcn.00404d30
xor edx, edx
mov ecx, esi
call fcn.004511a0
cmp byte [0x4eca76], 0
jne 0x42959d
push 0x130
lea eax, [ebp - 0x8a0]
push 0
push eax
call fcn.00487250
add esp, 8
lea ecx, [ebp - 0x8a0]
push 0
push 0x6a6
push 0x2350
push 0x2351
push 1
call fcn.0041fe20
push ecx
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [ebp - 0x8a0]
call fcn.0040dbe0
lea ecx, [ebp - 0x8a0]
call fcn.0040d290
add esi, 0xfffffff0
mov byte [ebp - 4], 0x2b
lock xadd dword [esi + 0xc], edi
dec edi
test edi, edi
jg 0x4295b6
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, 0xca
jmp 0x42a4f7
lea ecx, [ebp - 0x180]
call fcn.0045a7c0
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x44], 0
call fcn.00403bb0
mov edx, 0xca
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0xa20]
call fcn.0044f510
mov byte [ebp - 4], 0x22
push dword [eax]
lea eax, [ebp - 0x44]
push str._s___cant_install_over_MBAM_2.x_or_earlier
push eax
call fcn.0043bb60
mov edx, dword [ebp - 0xa20]
add esp, 0xc
add edx, 0xfffffff0
or edi, 0xffffffff
mov byte [ebp - 4], 0x23
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x429629
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0xb58]
mov byte [ebp - 4], 0x21
call fcn.0045f3e0
mov byte [ebp - 4], 0x24
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x429647
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4eb558
call fcn.004105c0
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f7a0
mov edx, 0x4c9104
mov ecx, eax
call fcn.0040f7a0
push 0x627
mov ecx, eax
call fcn.0040dda0
mov edx, 0x4c932c
mov ecx, eax
call fcn.0040f7a0
mov esi, dword [ebp - 0x44]
mov ecx, eax
mov edx, esi
call fcn.0040f7a0
push eax
call fcn.0040fb10
add esp, 4
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0xb58]
call fcn.00404d30
xorps xmm0, xmm0
mov dword [ebp - 0x38], 0
lea edx, [ebp - 0x34]
movq qword [ebp - 0x40], xmm0
lea ecx, [ebp - 0x40]
call fcn.00453630
lea edx, [ebp - 0x40]
mov byte [ebp - 4], 0x25
mov ecx, esi
call fcn.004511a0
cmp byte [0x4eca76], 0
jne 0x42972e
push 0x130
lea eax, [ebp - 0x770]
push 0
push eax
call fcn.00487250
add esp, 8
lea ecx, [ebp - 0x770]
push 0
push 0x6a6
push 0x235a
push 0x80
push 1
call fcn.0041fe20
push ecx
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [ebp - 0x770]
call fcn.0040dbe0
lea ecx, [ebp - 0x770]
call fcn.0040d290
mov byte [ebp - 4], 0x21
mov ecx, dword [ebp - 0x40]
test ecx, ecx
je 0x4297a2
mov edx, dword [ebp - 0x3c]
push ecx
call fcn.0043cc90
mov ecx, dword [ebp - 0x38]
mov eax, 0x2aaaaaab
sub ecx, dword [ebp - 0x40]
add esp, 4
imul ecx
mov ecx, dword [ebp - 0x40]
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
lea edx, [eax + eax*2]
mov eax, ecx
shl edx, 3
cmp edx, 0x1000
jb 0x429783
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42a593
push edx
push ecx
call fcn.0046f0d0
add esp, 8
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
add esi, 0xfffffff0
mov byte [ebp - 4], 0x26
jmp 0x4295a4
mov byte [0x4eca6f], 1
call fcn.00423a90
xor al, al
xchg byte [esi], al
xor eax, eax
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x104], 7
mov word [ebp - 0x118], ax
lea eax, [ebp - 0x118]
mov byte [ebp - 4], 0x2c
push eax
lea ecx, [ebp - 0x34]
call fcn.00463e70
lea eax, [ebp - 0x118]
mov ecx, 0x4e7c88
push eax
call fcn.0043bed0
push 0x4e7c88
lea ecx, [ebp - 0x100]
call fcn.0040bf20
mov byte [ebp - 4], 0x2d
mov eax, dword [ebp - 0xf0]
test eax, eax
je 0x429874
dec eax
lea ecx, [ebp - 0x100]
push eax
call fcn.00436d20
cmp word [eax], 0x5c
jne 0x429874
mov eax, dword [ebp - 0xf0]
lea ecx, [ebp - 0x100]
dec eax
push eax
push 0
lea eax, [ebp - 0xc00]
push eax
call fcn.00419a70
push eax
lea ecx, [ebp - 0x100]
call fcn.0040c430
lea ecx, [ebp - 0xc00]
call fcn.00404d30
lea eax, [ebp - 0x100]
mov ecx, 0x4e7c88
push eax
call fcn.0043bed0
xor al, al
mov ecx, 0x4e7ac6
xchg byte [ecx], al
lea ecx, [ebp - 0x100]
call fcn.00404d30
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 0x15
call fcn.00404d30
jmp 0x4298a0
mov byte [0x4eca64], 1
lea ecx, [ebp - 0x34]
call fcn.00463190
cmp dword [0x4e7d44], 8
mov byte [0x4eca5e], al
mov eax, 0x4e7d30
cmovae eax, dword [0x4e7d30]
push str.NCEP_WIN
push eax
call fcn.0048d2a7
add esp, 8
test eax, eax
je 0x4298e3
call fcn.00423bd0
test al, al
jne 0x4298e3
cmp byte [0x4eca72], al
je 0x4298e7
xor al, al
xchg byte [esi], al
cmp byte [0x4eca74], 0
je 0x429966
lea ecx, [ebp - 0xc18]
call fcn.0045f3e0
mov byte [ebp - 4], 0x2e
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x42990a
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4eb558
call fcn.004105c0
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f7a0
mov edx, 0x4c9104
mov ecx, eax
call fcn.0040f7a0
push 0x687
mov ecx, eax
call fcn.0040dda0
mov edx, str.:_MB_Teams___MDAM_B_implied_by_filename_or_cmd_line_option
mov ecx, eax
call fcn.0040f7a0
push eax
call fcn.0040fb10
add esp, 4
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0xc18]
call fcn.00404d30
xor al, al
xchg byte [esi], al
call fcn.00427a70
or edi, 0xffffffff
mov dword [ebp - 0x24], eax
test eax, eax
je 0x429e54
cmp byte [0x4eca76], 0
je 0x4299ed
lea ecx, [ebp - 0xc30]
call fcn.0045f3e0
mov byte [ebp - 4], 0x2f
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x42999c
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4eb558
call fcn.004105c0
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f7a0
mov edx, 0x4c9104
mov ecx, eax
call fcn.0040f7a0
push 0x691
mov ecx, eax
call fcn.0040dda0
mov edx, str.:_Pre_check_s__failed_but_in_silent_mode___will_try_to_continue_the_installation
mov ecx, eax
call fcn.0040f7a0
push eax
call fcn.0040fb10
lea ecx, [ebp - 0xc30]
jmp 0x429eba
add eax, 0xfffffffe
cmp eax, 7
ja case.0x4299f5.5
jmp dword [eax*4 + 0x42a5a4]
mov dword [ebp - 0x1c], 0x2346
mov byte [ebp - 0x15], 0
jmp 0x429a2e
mov dword [ebp - 0x1c], 0x2347
mov byte [ebp - 0x15], 0
jmp 0x429a2e
mov dword [ebp - 0x1c], 0x2348
mov byte [ebp - 0x15], 0
jmp 0x429a2e
mov dword [ebp - 0x1c], 0x2349
mov byte [ebp - 0x15], 1
mov esi, 0x80
call fcn.00423bd0
test al, al
mov dword [ebp - 0x4c], 0
mov ecx, 0x2329
mov eax, 0x2328
cmovne esi, ecx
cmp byte [0x4eca74], 0
lea ecx, [ebp - 0x4c]
cmovne esi, eax
mov dword [ebp - 0x20], esi
call fcn.00403bb0
mov dword [ebp - 0x9d8], 0
mov byte [ebp - 4], 0x32
call fcn.00403ab0
mov ecx, eax
test ecx, ecx
je 0x42a598
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
mov byte [ebp - 4], 0x31
or dword [ebp - 0x9d4], 0x20
mov ecx, dword [ebp - 0x24]
lea esi, [eax + 0x10]
mov eax, 0x4ce9a0
mov dword [ebp - 0x9d8], esi
mov edx, dword [eax + 4]
cmp ecx, dword [eax]
je 0x429ab6
add eax, 8
cmp eax, 0x4cea00
jne 0x429aa3
jmp 0x429ae2
test edx, edx
jne 0x429abe
xor ecx, ecx
jmp 0x429acc
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x429ac3
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0x9d8]
call fcn.00403310
mov esi, dword [ebp - 0x9d8]
mov ecx, dword [ebp - 0x24]
cmp dword [esi - 0xc], 0
jne 0x429b03
push ecx
lea eax, [ebp - 0x9d8]
push str.undefined___d_
push eax
call fcn.0043bb60
mov esi, dword [ebp - 0x9d8]
add esp, 0xc
mov edx, 0xcc
lea ecx, [ebp - 0xa18]
call fcn.0044f510
push esi
mov byte [ebp - 4], 0x33
push dword [eax]
lea eax, [ebp - 0x4c]
push str._s___prerequisite_failure__s
push eax
call fcn.0043bb60
mov edx, dword [ebp - 0xa18]
add esp, 0x10
add edx, 0xfffffff0
mov byte [ebp - 4], 0x34
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x429b4c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 0xfffffff0
mov byte [ebp - 4], 0x35
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x429b67
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0xbb8]
mov byte [ebp - 4], 0x30
call fcn.0045f3e0
mov byte [ebp - 4], 0x36
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x429b85
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4eb558
call fcn.004105c0
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f7a0
mov edx, 0x4c9104
mov ecx, eax
call fcn.0040f7a0
push 0x6a3
mov ecx, eax
call fcn.0040dda0
mov edx, 0x4c932c
mov ecx, eax
call fcn.0040f7a0
mov esi, dword [ebp - 0x4c]
mov ecx, eax
mov edx, esi
call fcn.0040f7a0
push eax
call fcn.0040fb10
add esp, 4
lea ecx, [ebp - 0xbb8]
call fcn.00404d30
cmp byte [ebp - 0x15], 0
push 0x130
push 0
je 0x429d6b
lea eax, [ebp - 0x2b0]
push eax
call fcn.00487250
add esp, 8
lea ecx, [ebp - 0x2b0]
push 0x2333
push 0x2332
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push 0
call fcn.0041fe20
push ecx
mov byte [ebp - 4], 0x37
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [ebp - 0x2b0]
call fcn.0040dbe0
cmp eax, 0x644
jne 0x429cca
lea ecx, [ebp - 0xc60]
call fcn.0045f3e0
mov byte [ebp - 4], 0x38
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x429c5e
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4eb558
call fcn.004105c0
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f7a0
mov edx, 0x4c9104
mov ecx, eax
call fcn.0040f7a0
push 0x6aa
mov ecx, eax
call fcn.0040dda0
mov edx, str.:_User_chose_to_cancel_the_installation
mov ecx, eax
call fcn.0040f7a0
push eax
call fcn.0040fb10
add esp, 4
mov byte [ebp - 4], 0x37
lea ecx, [ebp - 0xc60]
call fcn.00404d30
xor edx, edx
mov ecx, esi
call fcn.004511a0
lea ecx, [ebp - 0x2b0]
jmp 0x429e2c
lea ecx, [ebp - 0x2b0]
mov byte [ebp - 4], 0x30
call fcn.0040d290
lea ecx, [ebp - 0xb28]
call fcn.0045f3e0
mov byte [ebp - 4], 0x3d
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x429cf3
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4eb558
call fcn.004105c0
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f7a0
mov edx, 0x4c9104
mov ecx, eax
call fcn.0040f7a0
push 0x6be
mov ecx, eax
call fcn.0040dda0
mov edx, str.:_User_chose_to_continue_the_installation
mov ecx, eax
call fcn.0040f7a0
push eax
call fcn.0040fb10
add esp, 4
lea ecx, [ebp - 0xb28]
call fcn.00404d30
add esi, 0xfffffff0
mov byte [ebp - 4], 0x3e
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x429d62
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x15
jmp 0x429ec6
lea eax, [ebp - 0x9d0]
push eax
call fcn.00487250
add esp, 8
lea ecx, [ebp - 0x9d0]
push 0
push 0x6a6
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push 0
call fcn.0041fe20
push ecx
mov byte [ebp - 4], 0x3a
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [ebp - 0x9d0]
call fcn.0040dbe0
lea ecx, [ebp - 0xb40]
call fcn.0045f3e0
mov byte [ebp - 4], 0x3b
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x429dc5
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4eb558
call fcn.004105c0
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f7a0
mov edx, 0x4c9104
mov ecx, eax
call fcn.0040f7a0
push 0x6b6
mov ecx, eax
call fcn.0040dda0
mov edx, str.:_User_chose_to_cancel_the_installation
mov ecx, eax
call fcn.0040f7a0
push eax
call fcn.0040fb10
add esp, 4
mov byte [ebp - 4], 0x3a
lea ecx, [ebp - 0xb40]
call fcn.00404d30
xor edx, edx
mov ecx, esi
call fcn.004511a0
lea ecx, [ebp - 0x9d0]
call fcn.0040d290
add esi, 0xfffffff0
mov byte [ebp - 4], 0x3c
lock xadd dword [esi + 0xc], edi
dec edi
test edi, edi
jg 0x429e4a
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, 0xcc
jmp 0x42a4f7
lea ecx, [ebp - 0xbe8]
call fcn.0045f3e0
mov byte [ebp - 4], 0x3f
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x429e6e
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4eb558
call fcn.004105c0
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f7a0
mov edx, 0x4c9104
mov ecx, eax
call fcn.0040f7a0
push 0x6c3
mov ecx, eax
call fcn.0040dda0
mov edx, str.:_All_installation_pre_checks_passed
mov ecx, eax
call fcn.0040f7a0
push eax
call fcn.0040fb10
lea ecx, [ebp - 0xbe8]
add esp, 4
mov byte [ebp - 4], 0x15
call fcn.00404d30
mov esi, 2
push ecx
mov edx, esi
call fcn.0040c040
add esp, 4
test al, al
jne 0x42a0bb
call fcn.0042e970
test al, al
jne 0x42a0bb
lea ecx, [ebp - 0xb70]
call fcn.0045f3e0
mov byte [ebp - 4], 0x40
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x429f05
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4eb558
call fcn.004105c0
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f7a0
mov edx, 0x4c9104
mov ecx, eax
call fcn.0040f7a0
push 0x6cb
mov ecx, eax
call fcn.0040dda0
mov edx, str.:_Warning___This_computer_appears_to_be_missing_patch_KB4474419
mov ecx, eax
call fcn.0040f7a0
push eax
call fcn.0040fb10
add esp, 4
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0xb70]
call fcn.00404d30
call fcn.00423bd0
test al, al
jne 0x429f73
call fcn.00423c50
test al, al
je 0x42a0bb
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x50], 0
call fcn.00403bb0
mov edx, 0xcc
mov byte [ebp - 4], 0x41
lea ecx, [ebp - 0xa1c]
call fcn.0044f510
mov byte [ebp - 4], 0x42
push dword [eax]
lea eax, [ebp - 0x50]
push str._s___prerequisite_failure_MissingSHA2CodeSigningSupportPatch
push eax
call fcn.0043bb60
mov edx, dword [ebp - 0xa1c]
add esp, 0xc
add edx, 0xfffffff0
mov byte [ebp - 4], 0x43
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x429fce
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x41
xor edx, edx
mov esi, dword [ebp - 0x50]
mov ecx, esi
call fcn.004511a0
cmp byte [0x4eca76], 0
jne 0x42a041
push 0x130
lea eax, [ebp - 0x3e0]
push 0
push eax
call fcn.00487250
add esp, 8
call fcn.00423b70
test al, al
mov edx, str.https:__links.malwarebytes.com_support_mb_windows_system_requirements
mov ecx, str.https:__links.malwarebytes.com_support_general_business_ms_2019_09_security_update
cmove ecx, edx
push ecx
push 0x236e
push ecx
lea ecx, [ebp - 0x3e0]
call fcn.004200c0
push ecx
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [ebp - 0x3e0]
call fcn.0040dbe0
lea ecx, [ebp - 0x3e0]
call fcn.0040d290
lea ecx, [ebp - 0xb88]
call fcn.0045f3e0
mov byte [ebp - 4], 0x44
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x42a05b
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4eb558
call fcn.004105c0
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f7a0
mov edx, 0x4c9104
mov ecx, eax
call fcn.0040f7a0
push 0x6dc
mov ecx, eax
call fcn.0040dda0
mov edx, str.:_Exit_due_to_missing_SHA_2_code_signing_support_patch__KB4474419_
mov ecx, eax
call fcn.0040f7a0
push eax
call fcn.0040fb10
add esp, 4
lea ecx, [ebp - 0xb88]
call fcn.00404d30
add esi, 0xfffffff0
mov byte [ebp - 4], 0x45
jmp 0x429e38
mov ecx, 0x4e7ec8
cmp ecx, 0x4e7c88
je 0x42a0e7
cmp dword [0x4e7c9c], 8
mov eax, 0x4e7c88
push dword [0x4e7c98]
cmovae eax, dword [0x4e7c88]
push eax
call fcn.00407990
cmp byte [0x4eca74], 0
setne byte [0x4eca80]
cmp byte [0x4eca76], 0
jne 0x42a415
lea ecx, [ebp - 0xba0]
call fcn.0045f3e0
mov byte [ebp - 4], 0x46
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x42a11c
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4eb558
call fcn.004105c0
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f7a0
mov edx, 0x4c9104
mov ecx, eax
call fcn.0040f7a0
push 0x6fa
mov ecx, eax
call fcn.0040dda0
mov edx, str.:_Displaying_User_Interface
mov ecx, eax
call fcn.0040f7a0
push eax
call fcn.0040fb10
add esp, 4
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0xba0]
call fcn.00404d30
cmp byte [0x4eca67], 0
jne 0x42a1ef
lea ecx, [ebp - 0xc78]
call fcn.0045f3e0
mov byte [ebp - 4], 0x47
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x42a197
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4eb558
call fcn.004105c0
add esp, 4
mov edx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbsetup.cpp
mov ecx, eax
call fcn.0040f7a0
mov edx, 0x4c9104
mov ecx, eax
call fcn.0040f7a0
push 0x6fe
mov ecx, eax
call fcn.0040dda0
mov edx, str.:_Not_showing_BrowserGuard_screen
mov ecx, eax
call fcn.0040f7a0
push eax
call fcn.0040fb10
add esp, 4
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0xc78]
call fcn.00404d30
mov eax, 0x4ecad4
xchg dword [eax], esi
call fcn.00444010
mov dword [ebp - 0x9dc], eax
test eax, eax
je 0x42a271
mov esi, dword [0x4ecad4]
lea ecx, [ebp - 0x54]
mov dword [ebp - 0x54], 0
call fcn.00403bb0
push dword [ebp - 0x9dc]
lea eax, [ebp - 0x54]
mov byte [ebp - 4], 0x48
push esi
push str.changing_service_install_status_code_from__u_to__d
push eax
call fcn.0040f6f0
mov esi, dword [ebp - 0x54]
mov edx, 0x712
push esi
mov ecx, 0x4cae88
call fcn.004417b0
mov eax, dword [ebp - 0x9dc]
add esp, 0x14
mov ecx, 0x4ecad4
xchg dword [ecx], eax
add esi, 0xfffffff0
mov byte [ebp - 4], 0x49
lock xadd dword [esi + 0xc], edi
dec edi
test edi, edi
jg 0x42a276
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x42a276
call fcn.00453480
mov byte [ebp - 4], 0x4a
lea ecx, [ebp - 0xa8]
push 0
mov byte [ebp - 0xb0], 0
call fcn.00456de0
mov byte [ebp - 4], 0x4b
lea ecx, [ebp - 0x9f0]
mov byte [ebp - 0x9f8], 0
xorps xmm0, xmm0
push dword [ebp - 0x9f8]
movq qword [ebp - 0x9f0], xmm0
call fcn.00455cc0
xorps xmm0, xmm0
mov byte [ebp - 0x9f8], 3
push 0x18
movlpd qword [ebp - 0xe8], xmm0
call fcn.0046f0de
mov edi, eax
add esp, 4
lea eax, [ebp - 0x15]
mov dword [ebp - 0xe4], edi
mov dword [ebp - 0xe8], eax
mov byte [ebp - 4], 0x4c
mov ecx, edi
push 0xf
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
push str.Close_Installer
mov byte [edi], 0
call fcn.0040c470
mov dword [ebp - 0x9f0], edi
push str.event_type
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 0x4d
call fcn.00457c10
mov esi, eax
mov al, byte [esi]
mov byte [esi], 3
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0xc]
mov dword [ebp - 0x9dc], eax
mov byte [ebp - 0x9f8], al
mov eax, dword [ebp - 0x9ec]
mov dword [esi + 8], edi
mov dword [esi + 0xc], eax
mov dword [ebp - 0x9f0], ecx
mov dword [ebp - 0x9ec], edx
push dword [ebp - 0x9dc]
lea ecx, [ebp - 0x9f0]
mov byte [ebp - 4], 0x4e
call fcn.00455cc0
push str.event_properties
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 0x4b
call fcn.00457c10
push 0x4ecadc
lea ecx, [ebp - 0xa08]
mov esi, eax
call fcn.00457d70
push str.lastScreenShown
mov ecx, esi
mov byte [ebp - 4], 0x4f
call fcn.00457c10
mov cl, byte [ebp - 0xa08]
mov esi, eax
mov dl, byte [esi]
mov byte [esi], cl
mov eax, dword [ebp - 0xa00]
mov byte [ebp - 0xa08], dl
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0xc]
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x9fc]
mov dword [esi + 0xc], eax
mov dword [ebp - 0xa00], ecx
mov dword [ebp - 0x9fc], edx
mov byte [ebp - 4], 0x50
lea ecx, [ebp - 0xa00]
push dword [ebp - 0xa08]
call fcn.00455cc0
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 0x4b
call fcn.00453d10
mov byte [ebp - 4], 0x51
lea ecx, [ebp - 0xa8]
push dword [ebp - 0xb0]
call fcn.00455cc0
mov esi, dword [0x4ecad4]
jmp 0x42a4f7
call fcn.00445d70
mov ecx, 0x4ecad1
call fcn.004120e0
test al, al
jne 0x42a445
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
nop
push 0x3e8
call esi
mov ecx, 0x4ecad1
call fcn.004120e0
test al, al
je 0x42a430
push 5
push 0x4ecad4
call fcn.00412020
add esp, 8
test eax, eax
je 0x42a493
push 5
push 0x4ecad4
call fcn.00412020
add esp, 8
lea ecx, [ebp - 0x9e4]
mov edx, eax
call fcn.00449b70
mov byte [ebp - 4], 0x52
xor edx, edx
mov ecx, dword [eax]
call fcn.004511a0
lea ecx, [ebp - 0x9e4]
call fcn.00403d80
mov esi, 3
jmp 0x42a4f7
mov ecx, 0x4ecad0
call fcn.004120e0
mov esi, 0x4ecad8
test al, al
je 0x42a4b3
call fcn.00424a10
test al, al
jne 0x42a4f0
mov al, 1
xchg byte [esi], al
mov ecx, 0x4ecad2
call fcn.004120e0
test al, al
je 0x42a4cd
call fcn.00450b70
call fcn.0042ece0
jmp 0x42a4f5
mov ecx, esi
call fcn.004120e0
test al, al
je 0x42a4eb
xor edx, edx
mov ecx, str.Failed_to_download_and_run_offline_installer
call fcn.004511a0
mov esi, 3
jmp 0x42a4f7
call fcn.00453480
call fcn.00450b70
xor esi, esi
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x34], vtable.InstalledProducts.0
call fcn.00456bb0
lea ecx, [ebp - 0x74]
call fcn.00436990
lea ecx, [ebp - 0xe0]
call fcn.00404d30
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0046ebaf
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push 0x80004005
call fcn.00403c20
call fcn.0048a05c
call fcn.0048d9d0
call fcn.0048a05c
call fcn.0048a05c
call fcn.0048a05c
call fcn.0048a05c
push 0x80004005
call fcn.00403c20
call fcn.0048a05c
call fcn.0048a05c
call fcn.0048a05c
call fcn.0048a05c
call fcn.0048a05c
call fcn.0048a05c
call fcn.0048a05c
call fcn.0048a05c
call fcn.0048a05c
push 0x80004005
call fcn.00403c20
nop
or dword [edx - 0x65e9ffbe], ebx
inc edx
add byte [esi], dl
lcall 0x42, 0x9a230042
push ss
lcall 66, 0x9a160042
and ebx, dword [edx - 0x6603ffbe]
inc edx
add ah, cl
int3