Function at 0x43bd30
Capabilities:
Delete file

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4be432
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x2c0
mov eax, dword [0x50b080]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp byte [0x50f938], 0
jne 0x43c340
lea ecx, [ebp - 0x54]
call fcn.00467d30
mov dword [ebp - 4], 0
cmp dword [eax + 0x14], 7
mov ecx, dword [eax + 0x10]
jbe 0x43bd98
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x50e6d0
call fcn.00412550
add esp, 4
mov edx, str.C:JenkinsworkspaceMBAM_WindowsA_MB5_MBSetup_srcMBSetupMBSetup.cpp
mov ecx, eax
call fcn.00411050
mov edx, 0x4eb568
mov ecx, eax
call fcn.00411050
push 0xfd2
mov ecx, eax
call fcn.0040f7e0
mov edx, str.:_Looking_for_Privacy_VPN
mov ecx, eax
call fcn.00411050
push eax
call fcn.004113d0
mov dword [ebp - 4], 0xffffffff
add esp, 4
mov ecx, dword [ebp - 0x40]
cmp ecx, 7
jbe 0x43be22
mov edx, dword [ebp - 0x54]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x43be18
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43c35e
push ecx
push edx
call fcn.004906cd
add esp, 8
xorps xmm0, xmm0
movups xmmword [ebp - 0x3c], xmm0
mov dword [ebp - 0x3c], vtable.InstalledProducts.0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
push 0
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], 1
call fcn.0046d690
push 1
lea ecx, [ebp - 0x3c]
call fcn.0046d690
mov dword [ebp - 4], 2
cmp byte [0x50f941], 0
jne 0x43c331
lea ecx, [ebp - 0x3c]
call fcn.0046ea70
test al, al
je 0x43c331
lea ecx, [ebp - 0x2c]
xor esi, esi
call fcn.00467d30
mov byte [ebp - 4], 3
cmp dword [eax + 0x14], 7
mov ecx, dword [eax + 0x10]
jbe 0x43be9d
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x50e6d0
call fcn.00412550
add esp, 4
mov edx, str.C:JenkinsworkspaceMBAM_WindowsA_MB5_MBSetup_srcMBSetupMBSetup.cpp
mov ecx, eax
call fcn.00411050
mov edx, 0x4eb568
mov ecx, eax
call fcn.00411050
push 0xfd8
mov ecx, eax
call fcn.0040f7e0
mov edx, str.:_Found_Privacy_VPN._Redirecting_to_MB4_installer.
mov ecx, eax
call fcn.00411050
push eax
call fcn.004113d0
mov byte [ebp - 4], 2
add esp, 4
mov ecx, dword [ebp - 0x18]
cmp ecx, 7
jbe 0x43bf24
mov edx, dword [ebp - 0x2c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x43bf1a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43c363
push ecx
push edx
call fcn.004906cd
add esp, 8
lea ecx, [ebp - 0x2c]
call fcn.00445e20
push eax
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 4
call fcn.0040d620
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x18]
cmp ecx, 7
jbe 0x43bf77
mov edx, dword [ebp - 0x2c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x43bf6d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43c368
push ecx
push edx
call fcn.004906cd
add esp, 8
xor eax, eax
mov dword [ebp - 0x1c], 0
push str.mbsetup4.exe
lea ecx, [ebp - 0x6c]
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
call fcn.0040d6d0
cmp dword [ebp - 0x58], 7
lea eax, [ebp - 0x6c]
cmova eax, dword [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x19
xorps xmm0, xmm0
mov dword [ebp - 0x44], 0
push str.mbam_c.installer.consumer
lea ecx, [ebp - 0x54]
mov dword [ebp - 0x40], 0
movups xmmword [ebp - 0x54], xmm0
call fcn.0040df90
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x2c]
push 7
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
push str.MBSetup
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x18], 0
call fcn.0040df90
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x298]
push 0
xorps xmm0, xmm0
mov dword [ebp - 0x288], 0
push 0x4eaca4
movups xmmword [ebp - 0x298], xmm0
mov dword [ebp - 0x284], 0
call fcn.0040df90
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x2c8]
push 0
xorps xmm0, xmm0
mov dword [ebp - 0x2b8], 0
push 0x4eaca4
movups xmmword [ebp - 0x2c8], xmm0
mov dword [ebp - 0x2b4], 0
call fcn.0040df90
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x2b0]
push 8
xorps xmm0, xmm0
mov dword [ebp - 0x2a0], 0
push str._Release
movups xmmword [ebp - 0x2b0], xmm0
mov dword [ebp - 0x29c], 0
call fcn.0040df90
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 0xb
push eax
lea eax, [ebp - 0x298]
push eax
lea eax, [ebp - 0x2c8]
push eax
lea eax, [ebp - 0x2b0]
push eax
push ecx
push 0
lea ecx, [ebp - 0x280]
call fcn.00469960
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x29c]
cmp ecx, 7
jbe 0x43c101
mov edx, dword [ebp - 0x2b0]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x43c0f7
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43c36d
push ecx
push edx
call fcn.004906cd
add esp, 8
mov byte [ebp - 4], 0xe
mov ecx, dword [ebp - 0x2b4]
cmp ecx, 7
jbe 0x43c145
mov edx, dword [ebp - 0x2c8]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x43c13b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43c36d
push ecx
push edx
call fcn.004906cd
add esp, 8
mov byte [ebp - 4], 0xf
mov ecx, dword [ebp - 0x284]
cmp ecx, 7
jbe 0x43c189
mov edx, dword [ebp - 0x298]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x43c17f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43c36d
push ecx
push edx
call fcn.004906cd
add esp, 8
mov byte [ebp - 4], 0x10
mov ecx, dword [ebp - 0x18]
cmp ecx, 7
jbe 0x43c1c7
mov edx, dword [ebp - 0x2c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x43c1bd
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43c36d
push ecx
push edx
call fcn.004906cd
add esp, 8
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
nop dword [eax]
lea eax, [ebp - 0x54]
inc esi
push eax
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x280]
call fcn.0046be80
test al, al
jne 0x43c1fa
push 0x7d0
call edi
cmp esi, 3
jge 0x43c372
jmp 0x43c1d0
lea ecx, [ebp - 0x298]
call fcn.00467d30
mov byte [ebp - 4], 0x11
cmp dword [eax + 0x14], 7
mov ecx, dword [eax + 0x10]
jbe 0x43c214
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x50e6d0
call fcn.00412550
add esp, 4
mov edx, str.C:JenkinsworkspaceMBAM_WindowsA_MB5_MBSetup_srcMBSetupMBSetup.cpp
mov ecx, eax
call fcn.00411050
mov edx, 0x4eb568
mov ecx, eax
call fcn.00411050
push 0xfef
mov ecx, eax
call fcn.0040f7e0
mov edx, str.:_Successfully_downloaded_MB4_installer._Starting_it.
mov ecx, eax
call fcn.00411050
push eax
call fcn.004113d0
mov byte [ebp - 4], 0x10
add esp, 4
mov ecx, dword [ebp - 0x284]
cmp ecx, 7
jbe 0x43c2a1
mov edx, dword [ebp - 0x298]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x43c297
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43c40f
push ecx
push edx
call fcn.004906cd
add esp, 8
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
xor eax, eax
mov dword [ebp - 0x18], 7
movups xmmword [ebp - 0x2c], xmm0
mov word [ebp - 0x2c], ax
lea edx, [ebp - 0x2c]
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x6c]
call fcn.0043a390
lea ecx, [ebp - 0x298]
test al, al
jne 0x43c414
call fcn.00467d30
mov edx, eax
mov byte [ebp - 4], 0x14
mov ecx, 0x50e6d0
call fcn.00411030
mov edx, str.C:JenkinsworkspaceMBAM_WindowsA_MB5_MBSetup_srcMBSetupMBSetup.cpp
mov ecx, eax
call fcn.00411050
mov edx, 0x4eb568
mov ecx, eax
call fcn.00411050
push 0xff8
mov ecx, eax
call fcn.0040f7e0
mov edx, str.:_Error._Failed_to_start_MB4_installer.
mov ecx, eax
call fcn.00411050
push ecx
mov ecx, eax
call fcn.0040f9a0
lea ecx, [ebp - 0x298]
jmp 0x43c3c5
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x3c], vtable.InstalledProducts.0
call fcn.0045d760
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00490396
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.004958ff
call fcn.004958ff
call fcn.004958ff
call fcn.004958ff
lea ecx, [ebp - 0x2c]
call fcn.00467d30
mov edx, eax
mov byte [ebp - 4], 0x15
mov ecx, 0x50e6d0
call fcn.00411030
mov edx, str.C:JenkinsworkspaceMBAM_WindowsA_MB5_MBSetup_srcMBSetupMBSetup.cpp
mov ecx, eax
call fcn.00411050
mov edx, 0x4eb568
mov ecx, eax
call fcn.00411050
push 0x1001
mov ecx, eax
call fcn.0040f7e0
mov edx, str.:_Error._Failed_to_download_MB4_installer.
mov ecx, eax
call fcn.00411050
push ecx
mov ecx, eax
call fcn.0040f9a0
lea ecx, [ebp - 0x2c]
call fcn.00406550
push ecx
lea ecx, [ebp - 0x1a0]
call fcn.0040f010
push ecx
push 0
push 0x6a6
push 0x5be
push 0x80
push 1
lea ecx, [ebp - 0x1a0]
call fcn.00423940
push ecx
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [ebp - 0x1a0]
call fcn.0040f9b0
push 1
call fcn.0049b244
call fcn.004958ff
call fcn.00467d30
mov edx, eax
mov byte [ebp - 4], 0x13
mov ecx, 0x50e6d0
call fcn.00411030
mov edx, str.C:JenkinsworkspaceMBAM_WindowsA_MB5_MBSetup_srcMBSetupMBSetup.cpp
mov ecx, eax
call fcn.00411050
mov edx, 0x4eb568
mov ecx, eax
call fcn.00411050
push 0xff3
mov ecx, eax
call fcn.0040f7e0
mov edx, str.:_Started_MB4_installer._Exiting.
mov ecx, eax
call fcn.00411050
push ecx
mov ecx, eax
call fcn.0040f9a0
lea ecx, [ebp - 0x298]
call fcn.00406550
push 0
call fcn.0049b244
int3