Function at 0x4462e0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b2daa
mov eax, dword fs:[0]
push eax
sub esp, 0x2d0
mov eax, dword [0x4e506c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 7
mov word [ebp - 0x64], ax
lea ecx, [ebp - 0x274]
mov dword [ebp - 4], eax
call fcn.00412e00
xor eax, eax
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x68], 7
mov word [ebp - 0x7c], ax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x34]
mov al, byte [0x4eaa05]
push 0x4e5d30
mov byte [ebp - 0x26f], al
call fcn.0040be50
mov byte [ebp - 4], 3
lea eax, [ebp - 0x34]
cmp dword [ebp - 0x20], 8
lea ecx, [ebp - 0x254]
push dword [ebp - 0x24]
cmovae eax, dword [ebp - 0x34]
push eax
call fcn.004078c0
mov edi, dword [ebp - 0x20]
lea ecx, [ebp - 0x34]
mov eax, dword [ebp - 0x34]
cmp edi, 8
cmovae ecx, eax
cmp dword [ebp - 0x24], 6
jne 0x4463aa
push 6
mov edx, str.MDAM_B
call fcn.0041a530
add esp, 4
test eax, eax
je 0x4463cc
mov eax, dword [ebp - 0x34]
cmp edi, 8
lea ecx, [ebp - 0x34]
cmovae ecx, eax
cmp dword [ebp - 0x24], 6
jne 0x4463d8
push 6
mov edx, str.MBRW_B
call fcn.0041a530
add esp, 4
test eax, eax
jne 0x4463d5
push 8
push str.business
jmp 0x44640a
mov eax, dword [ebp - 0x34]
cmp edi, 8
lea ecx, [ebp - 0x34]
cmovae ecx, eax
cmp dword [ebp - 0x24], 8
jne 0x446403
push 8
mov edx, str.NCEP_WIN
call fcn.0041a530
add esp, 4
test eax, eax
jne 0x446403
push 6
push str.common
jmp 0x44640a
push 8
push 0x4ce8b8
lea ecx, [ebp - 0x64]
call fcn.004078c0
lea eax, [ebp - 0x224]
cmp eax, esi
je 0x446435
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x446426
mov eax, dword [esi]
push dword [esi + 0x10]
lea ecx, [ebp - 0x224]
push eax
call fcn.004078c0
cmp dword [ebp - 0x50], 8
lea eax, [ebp - 0x64]
push dword [ebp - 0x54]
cmovae eax, dword [ebp - 0x64]
lea ecx, [ebp - 0x23c]
push eax
call fcn.004078c0
cmp dword [0x4e5c9c], 8
lea ecx, [ebp - 0x20c]
push dword [0x4e5c98]
mov eax, 0x4e5c88
cmovae eax, dword [0x4e5c88]
push eax
call fcn.004078c0
cmp dword [0x4e5d44], 8
mov eax, 0x4e5d30
push str.MBRW_C
cmovae eax, dword [0x4e5d30]
push eax
call fcn.0048c547
add esp, 8
test eax, eax
je 0x4464be
cmp dword [0x4e5d44], 8
mov eax, 0x4e5d30
push str.MBRW_B
cmovae eax, dword [0x4e5d30]
push eax
call fcn.0048c547
add esp, 8
test eax, eax
jne 0x44653b
push str.MalwarebytesMB3Service
mov edx, esi
lea ecx, [ebp - 0x94]
call fcn.0043b7c0
add esp, 4
mov byte [ebp - 4], 4
lea eax, [ebp - 0x94]
cmp dword [ebp - 0x80], 8
lea ecx, [ebp - 0x1f4]
push dword [ebp - 0x84]
cmovae eax, dword [ebp - 0x94]
push eax
call fcn.004078c0
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x80]
cmp edx, 8
jb 0x44653b
mov ecx, dword [ebp - 0x94]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x446531
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x446ec7
push edx
push ecx
call fcn.0046e3a3
add esp, 8
cmp byte [0x4ea9f3], 0
je 0x446567
lea eax, [ebp - 0x1f4]
cmp eax, esi
je 0x446567
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x446558
mov eax, dword [esi]
push dword [esi + 0x10]
lea ecx, [ebp - 0x1f4]
push eax
call fcn.004078c0
cmp dword [0x4e5d74], 8
lea ecx, [ebp - 0x1dc]
push dword [0x4e5d70]
mov eax, 0x4e5d60
cmovae eax, dword [0x4e5d60]
push eax
call fcn.004078c0
cmp dword [0x4e5d8c], 8
lea ecx, [ebp - 0x1c4]
push dword [0x4e5d88]
mov eax, 0x4e5d78
cmovae eax, dword [0x4e5d78]
push eax
call fcn.004078c0
mov ecx, dword [0x4e5da0]
test ecx, ecx
je 0x4465db
cmp dword [0x4e5da4], 8
mov eax, 0x4e5d90
push ecx
cmovae eax, dword [0x4e5d90]
lea ecx, [ebp - 0x1ac]
push eax
call fcn.004078c0
mov ecx, dword [0x4e5db8]
test ecx, ecx
je 0x446605
cmp dword [0x4e5dbc], 8
mov eax, 0x4e5da8
push ecx
cmovae eax, dword [0x4e5da8]
lea ecx, [ebp - 0x194]
push eax
call fcn.004078c0
mov ecx, dword [0x4e5dd0]
test ecx, ecx
je 0x44662f
cmp dword [0x4e5dd4], 8
mov eax, 0x4e5dc0
push ecx
cmovae eax, dword [0x4e5dc0]
lea ecx, [ebp - 0x17c]
push eax
call fcn.004078c0
mov ecx, dword [0x4e5de8]
test ecx, ecx
je 0x446659
cmp dword [0x4e5dec], 8
mov eax, 0x4e5dd8
push ecx
cmovae eax, dword [0x4e5dd8]
lea ecx, [ebp - 0x164]
push eax
call fcn.004078c0
cmp dword [0x4e5e04], 8
lea ecx, [ebp - 0x14c]
push dword [0x4e5e00]
mov eax, 0x4e5df0
cmovae eax, dword [0x4e5df0]
push eax
call fcn.004078c0
mov al, byte [0x4ea9fc]
mov byte [ebp - 0x11c], al
mov al, byte [0x4e5ac4]
mov byte [ebp - 0x11a], al
mov al, byte [0x4eaa57]
mov byte [ebp - 0x11b], 1
push dword [0x4e5e60]
test al, al
lea ecx, [ebp - 0x110]
mov al, byte [0x4ea9fe]
mov byte [ebp - 0x117], al
setne byte [ebp - 0x118]
mov al, byte [0x4ea9ff]
cmp dword [0x4e5e64], 8
mov byte [ebp - 0x275], al
mov eax, 0x4e5e50
cmovae eax, dword [0x4e5e50]
push eax
call fcn.004078c0
mov al, byte [ebp - 0x275]
cmp dword [0x4e5e34], 8
mov byte [ebp - 0x113], al
mov eax, 0x4e5e20
cmovae eax, dword [0x4e5e20]
push eax
call fcn.00490273
add esp, 4
cmp eax, 0x3e7
jle 0x44675d
cmp dword [0x4e5e34], 8
lea ecx, [ebp - 0xe0]
push dword [0x4e5e30]
mov eax, 0x4e5e20
cmovae eax, dword [0x4e5e20]
push eax
call fcn.004078c0
cmp dword [0x4e5e1c], 8
lea ecx, [ebp - 0xf8]
push dword [0x4e5e18]
mov eax, 0x4e5e08
cmovae eax, dword [0x4e5e08]
push eax
call fcn.004078c0
cmp dword [0x4e5e4c], 8
lea ecx, [ebp - 0xc8]
push dword [0x4e5e48]
mov eax, 0x4e5e38
cmovae eax, dword [0x4e5e38]
push eax
call fcn.004078c0
mov al, byte [0x4ea9fd]
lea ecx, [ebp - 0x7c]
mov byte [ebp - 0x116], al
call fcn.0042e280
lea eax, [ebp - 0x2ac]
push eax
lea ecx, [ebp - 0x7c]
call fcn.0043e890
push eax
lea ecx, [ebp - 0x294]
mov byte [ebp - 4], 5
call fcn.0040be50
mov byte [ebp - 4], 6
lea eax, [ebp - 0x294]
cmp dword [ebp - 0x280], 8
lea ecx, [ebp - 0x26c]
push dword [ebp - 0x284]
cmovae eax, dword [ebp - 0x294]
push eax
call fcn.004078c0
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x280]
cmp edx, 8
jb 0x446822
mov ecx, dword [ebp - 0x294]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x446818
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x446ecc
push edx
push ecx
call fcn.0046e3a3
add esp, 8
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x298]
cmp edx, 8
jb 0x446866
mov ecx, dword [ebp - 0x2ac]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x44685c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x446ed1
push edx
push ecx
call fcn.0046e3a3
add esp, 8
mov al, byte [0x4eaa08]
lea ecx, [ebp - 0x134]
mov byte [ebp - 0xb0], al
mov al, byte [0x4eaa04]
mov byte [ebp - 0xaf], al
mov al, byte [0x4eaa03]
mov byte [ebp - 0x115], al
mov al, byte [0x4eaa02]
mov byte [ebp - 0x114], al
mov al, byte [0x4eaa01]
mov byte [ebp - 0xae], al
mov al, byte [0x4ea9f3]
mov byte [ebp - 0xad], al
mov al, byte [0x4ea9f4]
mov byte [ebp - 0x112], al
lea eax, [esi + 0x1c]
cmp ecx, eax
je 0x4468d8
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x4468cb
mov eax, dword [eax]
push ecx
push eax
lea ecx, [ebp - 0x134]
call fcn.004078c0
push 0x4e5c88
lea ecx, [ebp - 0x4c]
call fcn.0040be50
mov byte [ebp - 4], 7
cmp byte [esi + 0x18], 0
je 0x44696e
lea ecx, [ebp - 0x2c4]
call fcn.00447480
mov esi, eax
lea eax, [ebp - 0x4c]
cmp eax, esi
je 0x44692e
mov ecx, eax
call fcn.00404c50
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [ebp - 0x4c], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0x3c], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov edx, dword [ebp - 0x2b0]
cmp edx, 8
jb 0x44696e
mov ecx, dword [ebp - 0x2c4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x446964
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x446ed6
push edx
push ecx
call fcn.0046e3a3
add esp, 8
cmp byte [0x4ea9f6], 0
je 0x446999
cmp dword [0x4e5e7c], 8
lea ecx, [ebp - 0x4c]
push dword [0x4e5e78]
mov eax, 0x4e5e68
cmovae eax, dword [0x4e5e68]
push eax
call fcn.004078c0
sub esp, 0x1c
lea eax, [ebp - 0x4c]
lea ecx, [ebp - 0x274]
push eax
call fcn.00413680
mov ecx, 0x4eaa58
xchg dword [ecx], eax
mov eax, dword [0x4eaa58]
test eax, eax
je 0x446a3a
mov esi, dword [0x4eaa58]
mov byte [ebp - 4], 8
call fcn.004039d0
mov ecx, eax
test ecx, ecx
je 0x446edb
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x1c], eax
push esi
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 9
push str.Failed_to_install_Installer_Service__error:__d
push eax
call fcn.0040f620
mov esi, dword [ebp - 0x1c]
mov edx, 0x60a
push esi
mov ecx, str.c:jenkinsworkspacembam_windows_a_mb4_mbsetup_srcmbsetupmbutils.cpp
call fcn.004412b0
add esp, 0x10
mov al, 1
mov ecx, 0x4eaa55
xchg byte [ecx], al
add esi, 0xfffffff0
mov byte [ebp - 4], 0xa
mov eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x446d95
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x446d95
push str.Waiting_for_InstallerService_to_start...
mov edx, 0x60f
mov ecx, str.c:jenkinsworkspacembam_windows_a_mb4_mbsetup_srcmbsetupmbutils.cpp
call fcn.004412b0
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 4
xor esi, esi
nop dword [eax]
push 0x3e8
call edi
call fcn.004183f0
mov ecx, esi
inc esi
cmp ecx, 0x1e
jge 0x446a78
test al, al
je 0x446a60
push str.Waiting_for_InstallerService_to_stop...
mov edx, 0x618
mov ecx, str.c:jenkinsworkspacembam_windows_a_mb4_mbsetup_srcmbsetupmbutils.cpp
call fcn.004412b0
add esp, 4
nop
push 0x3e8
call edi
call fcn.004183f0
test al, al
jne 0x446a90
push str.InstallerService_has_stopped
mov edx, 0x61f
mov ecx, str.c:jenkinsworkspacembam_windows_a_mb4_mbsetup_srcmbsetupmbutils.cpp
call fcn.004412b0
add esp, 4
call fcn.00418ad0
mov esi, eax
or edi, 0xffffffff
mov dword [ebp - 0x18], esi
cmp esi, edi
je 0x446be9
call fcn.00418ad0
mov dword [0x4ea9e4], eax
lea eax, [ebp - 0x2dc]
push eax
call fcn.00418d90
mov edx, eax
mov byte [ebp - 4], 0xb
cmp dword [edx + 0x14], 0x10
jb 0x446af0
mov edx, dword [edx]
test edx, edx
jne 0x446af8
xor ecx, ecx
jmp 0x446b09
mov ecx, edx
lea esi, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x446b00
sub ecx, esi
push ecx
push edx
mov ecx, 0x4eaa7c
call fcn.00403230
mov byte [ebp - 4], 7
mov edx, dword [ebp - 0x2c8]
cmp edx, 0x10
jb 0x446b53
mov ecx, dword [ebp - 0x2dc]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x446b49
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x446ee5
push edx
push ecx
call fcn.0046e3a3
add esp, 8
mov byte [ebp - 4], 0xc
call fcn.004039d0
mov ecx, eax
test ecx, ecx
je 0x446eea
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 0xd
lea eax, [ebp - 0x14]
push dword [0x4ea9e4]
push str._InstallerService_error_status___u
push eax
call fcn.0040f620
push dword [ebp - 0x14]
mov edx, 0x62a
mov ecx, str.c:jenkinsworkspacembam_windows_a_mb4_mbsetup_srcmbsetupmbutils.cpp
call fcn.004412b0
push dword [0x4eaa7c]
lea eax, [ebp - 0x14]
push str._InstallerService_error_detail____hs_
push eax
call fcn.0040f620
mov esi, dword [ebp - 0x14]
mov edx, 0x62c
push esi
mov ecx, str.c:jenkinsworkspacembam_windows_a_mb4_mbsetup_srcmbsetupmbutils.cpp
call fcn.004412b0
add esp, 0x20
add esi, 0xfffffff0
mov byte [ebp - 4], 0xe
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x446be2
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 7
mov esi, dword [ebp - 0x18]
call fcn.00418800
test al, al
je 0x446c1c
cmp esi, 0x5a
jne 0x446c1c
push str.setting_rebootRequired_to_true
mov edx, 0x631
mov ecx, str.c:jenkinsworkspacembam_windows_a_mb4_mbsetup_srcmbsetupmbutils.cpp
call fcn.004412b0
add esp, 4
mov al, 1
mov ecx, 0x4eaa56
xchg byte [ecx], al
jmp 0x446d75
cmp dword [0x4ea9e4], 0
jbe 0x446d75
mov byte [ebp - 4], 0xf
call fcn.004039d0
mov ecx, eax
test ecx, ecx
je 0x446ef4
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x27c]
mov edx, dword [0x4ea9e4]
call fcn.004496a0
mov byte [ebp - 4], 0x11
push dword [eax]
lea eax, [ebp - 0x18]
push dword [0x4ea9e4]
push str.Installer_Service_error_status__d___hs_
push eax
call fcn.0040f620
mov edx, dword [ebp - 0x27c]
add esp, 0x10
add edx, 0xfffffff0
mov byte [ebp - 4], 0x12
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x446c9c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x10
mov edx, 0x639
mov esi, dword [ebp - 0x18]
mov ecx, str.c:jenkinsworkspacembam_windows_a_mb4_mbsetup_srcmbsetupmbutils.cpp
push esi
call fcn.004412b0
add esp, 4
mov al, 1
mov ecx, 0x4eaa5c
xchg byte [ecx], al
cmp dword [0x4ea9e4], 0x4d
jne 0x446d53
mov al, 1
mov ecx, 0x4eaa54
xchg byte [ecx], al
cmp byte [0x4ea9f3], 0
je 0x446d53
push str.https:__www.malwarebytes.com_jobs
lea ecx, [ebp - 0xac]
call fcn.00404c00
cmp dword [ebp - 0x98], 8
lea eax, [ebp - 0xac]
push 5
cmovae eax, dword [ebp - 0xac]
push 0
push 0
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edx, dword [ebp - 0x98]
cmp edx, 8
jb 0x446d53
mov ecx, dword [ebp - 0xac]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x446d49
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x446efe
push edx
push ecx
call fcn.0046e3a3
add esp, 8
call fcn.004190f0
add esi, 0xfffffff0
mov byte [ebp - 4], 0x13
lock xadd dword [esi + 0xc], edi
dec edi
test edi, edi
jg 0x446d71
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 7
mov al, 1
mov edx, 0x4eaa55
xchg byte [edx], al
push str.Installer_service_has_completed
mov edx, 0x64c
mov ecx, str.c:jenkinsworkspacembam_windows_a_mb4_mbsetup_srcmbsetupmbutils.cpp
call fcn.004412b0
add esp, 4
mov edx, dword [ebp - 0x38]
cmp edx, 8
jb 0x446dcf
mov ecx, dword [ebp - 0x4c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x446dc5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x446f03
push edx
push ecx
call fcn.0046e3a3
add esp, 8
mov edx, dword [ebp - 0x20]
xor eax, eax
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 7
mov word [ebp - 0x4c], ax
cmp edx, 8
jb 0x446e1d
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x446e13
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x446f08
push edx
push ecx
call fcn.0046e3a3
add esp, 8
mov edx, dword [ebp - 0x68]
cmp edx, 8
jb 0x446e57
mov ecx, dword [ebp - 0x7c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x446e4d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x446f0d
push edx
push ecx
call fcn.0046e3a3
add esp, 8
xor eax, eax
mov dword [ebp - 0x6c], 0
lea ecx, [ebp - 0x274]
mov dword [ebp - 0x68], 7
mov word [ebp - 0x7c], ax
call fcn.00413030
mov edx, dword [ebp - 0x50]
cmp edx, 8
jb 0x446eac
mov ecx, dword [ebp - 0x64]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x446ea2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x446f12
push edx
push ecx
call fcn.0046e3a3
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046de82
mov esp, ebp
pop ebp
ret
call fcn.004892fc
call fcn.004892fc
call fcn.004892fc
call fcn.004892fc
push 0x80004005
call fcn.00403b40
call fcn.004892fc
push 0x80004005
call fcn.00403b40
push 0x80004005
call fcn.00403b40
call fcn.004892fc
call fcn.004892fc
call fcn.004892fc
call fcn.004892fc
call fcn.004892fc
int3