Function at 0x447440
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b234a
mov eax, dword fs:[0]
push eax
sub esp, 0x2d0
mov eax, dword [0x4e406c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 7
mov word [ebp - 0x64], ax
lea ecx, [ebp - 0x274]
mov dword [ebp - 4], eax
call fcn.00413080
xor eax, eax
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x68], 7
mov word [ebp - 0x7c], ax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x34]
mov al, byte [0x4e995d]
push 0x4e4d30
mov byte [ebp - 0x26f], al
call fcn.0040c290
mov byte [ebp - 4], 3
lea eax, [ebp - 0x34]
cmp dword [ebp - 0x20], 8
lea ecx, [ebp - 0x254]
push dword [ebp - 0x24]
cmovae eax, dword [ebp - 0x34]
push eax
call fcn.00407cf0
mov edi, dword [ebp - 0x20]
lea ecx, [ebp - 0x34]
mov eax, dword [ebp - 0x34]
cmp edi, 8
cmovae ecx, eax
cmp dword [ebp - 0x24], 6
jne 0x44750a
push 6
mov edx, str.MDAM_B
call fcn.0041a740
add esp, 4
test eax, eax
je 0x44752c
mov eax, dword [ebp - 0x34]
cmp edi, 8
lea ecx, [ebp - 0x34]
cmovae ecx, eax
cmp dword [ebp - 0x24], 6
jne 0x447538
push 6
mov edx, str.MBRW_B
call fcn.0041a740
add esp, 4
test eax, eax
jne 0x447535
push 8
push str.business
jmp 0x44756a
mov eax, dword [ebp - 0x34]
cmp edi, 8
lea ecx, [ebp - 0x34]
cmovae ecx, eax
cmp dword [ebp - 0x24], 8
jne 0x447563
push 8
mov edx, str.NCEP_WIN
call fcn.0041a740
add esp, 4
test eax, eax
jne 0x447563
push 6
push str.common
jmp 0x44756a
push 8
push 0x4cd7b0
lea ecx, [ebp - 0x64]
call fcn.00407cf0
lea eax, [ebp - 0x224]
cmp eax, esi
je 0x447595
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x447586
mov eax, dword [esi]
push dword [esi + 0x10]
lea ecx, [ebp - 0x224]
push eax
call fcn.00407cf0
cmp dword [ebp - 0x50], 8
lea eax, [ebp - 0x64]
push dword [ebp - 0x54]
cmovae eax, dword [ebp - 0x64]
lea ecx, [ebp - 0x23c]
push eax
call fcn.00407cf0
cmp dword [0x4e4c9c], 8
lea ecx, [ebp - 0x20c]
push dword [0x4e4c98]
mov eax, 0x4e4c88
cmovae eax, dword [0x4e4c88]
push eax
call fcn.00407cf0
cmp dword [0x4e4d44], 8
mov eax, 0x4e4d30
push str.MBRW_C
cmovae eax, dword [0x4e4d30]
push eax
call fcn.0048b9e7
add esp, 8
test eax, eax
je 0x44761e
cmp dword [0x4e4d44], 8
mov eax, 0x4e4d30
push str.MBRW_B
cmovae eax, dword [0x4e4d30]
push eax
call fcn.0048b9e7
add esp, 8
test eax, eax
jne 0x44769b
push str.MalwarebytesMB3Service
mov edx, esi
lea ecx, [ebp - 0x94]
call fcn.0043bcc0
add esp, 4
mov byte [ebp - 4], 4
lea eax, [ebp - 0x94]
cmp dword [ebp - 0x80], 8
lea ecx, [ebp - 0x1f4]
push dword [ebp - 0x84]
cmovae eax, dword [ebp - 0x94]
push eax
call fcn.00407cf0
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x80]
cmp edx, 8
jb 0x44769b
mov ecx, dword [ebp - 0x94]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x447691
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x447ff9
push edx
push ecx
call fcn.0046d84e
add esp, 8
cmp byte [0x4e994b], 0
je 0x4476c7
lea eax, [ebp - 0x1f4]
cmp eax, esi
je 0x4476c7
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x4476b8
mov eax, dword [esi]
push dword [esi + 0x10]
lea ecx, [ebp - 0x1f4]
push eax
call fcn.00407cf0
cmp dword [0x4e4d8c], 8
lea ecx, [ebp - 0x1dc]
push dword [0x4e4d88]
mov eax, 0x4e4d78
cmovae eax, dword [0x4e4d78]
push eax
call fcn.00407cf0
cmp dword [0x4e4da4], 8
lea ecx, [ebp - 0x1c4]
push dword [0x4e4da0]
mov eax, 0x4e4d90
cmovae eax, dword [0x4e4d90]
push eax
call fcn.00407cf0
mov ecx, dword [0x4e4db8]
test ecx, ecx
je 0x44773b
cmp dword [0x4e4dbc], 8
mov eax, 0x4e4da8
push ecx
cmovae eax, dword [0x4e4da8]
lea ecx, [ebp - 0x1ac]
push eax
call fcn.00407cf0
mov ecx, dword [0x4e4dd0]
test ecx, ecx
je 0x447765
cmp dword [0x4e4dd4], 8
mov eax, 0x4e4dc0
push ecx
cmovae eax, dword [0x4e4dc0]
lea ecx, [ebp - 0x194]
push eax
call fcn.00407cf0
mov ecx, dword [0x4e4de8]
test ecx, ecx
je 0x44778f
cmp dword [0x4e4dec], 8
mov eax, 0x4e4dd8
push ecx
cmovae eax, dword [0x4e4dd8]
lea ecx, [ebp - 0x17c]
push eax
call fcn.00407cf0
mov ecx, dword [0x4e4e00]
test ecx, ecx
je 0x4477b9
cmp dword [0x4e4e04], 8
mov eax, 0x4e4df0
push ecx
cmovae eax, dword [0x4e4df0]
lea ecx, [ebp - 0x164]
push eax
call fcn.00407cf0
cmp dword [0x4e4e1c], 8
lea ecx, [ebp - 0x14c]
push dword [0x4e4e18]
mov eax, 0x4e4e08
cmovae eax, dword [0x4e4e08]
push eax
call fcn.00407cf0
mov al, byte [0x4e9954]
mov byte [ebp - 0x11c], al
mov al, byte [0x4e4ac4]
mov byte [ebp - 0x11a], al
mov al, byte [0x4e99af]
mov byte [ebp - 0x11b], 1
push dword [0x4e4e78]
test al, al
lea ecx, [ebp - 0x110]
mov al, byte [0x4e9956]
mov byte [ebp - 0x117], al
setne byte [ebp - 0x118]
mov al, byte [0x4e9957]
cmp dword [0x4e4e7c], 8
mov byte [ebp - 0x275], al
mov eax, 0x4e4e68
cmovae eax, dword [0x4e4e68]
push eax
call fcn.00407cf0
mov al, byte [ebp - 0x275]
lea ecx, [ebp - 0xe0]
cmp dword [0x4e4e4c], 8
push dword [0x4e4e48]
mov byte [ebp - 0x113], al
mov eax, 0x4e4e38
cmovae eax, dword [0x4e4e38]
push eax
call fcn.00407cf0
cmp dword [0x4e4e34], 8
lea ecx, [ebp - 0xf8]
push dword [0x4e4e30]
mov eax, 0x4e4e20
cmovae eax, dword [0x4e4e20]
push eax
call fcn.00407cf0
cmp dword [0x4e4e64], 8
lea ecx, [ebp - 0xc8]
push dword [0x4e4e60]
mov eax, 0x4e4e50
cmovae eax, dword [0x4e4e50]
push eax
call fcn.00407cf0
mov al, byte [0x4e9955]
lea ecx, [ebp - 0x7c]
mov byte [ebp - 0x116], al
call fcn.0042e9f0
lea eax, [ebp - 0x2ac]
push eax
lea ecx, [ebp - 0x7c]
call fcn.0043f9f0
push eax
lea ecx, [ebp - 0x294]
mov byte [ebp - 4], 5
call fcn.0040c290
mov byte [ebp - 4], 6
lea eax, [ebp - 0x294]
cmp dword [ebp - 0x280], 8
lea ecx, [ebp - 0x26c]
push dword [ebp - 0x284]
cmovae eax, dword [ebp - 0x294]
push eax
call fcn.00407cf0
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x280]
cmp edx, 8
jb 0x44795f
mov ecx, dword [ebp - 0x294]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x447955
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x447ffe
push edx
push ecx
call fcn.0046d84e
add esp, 8
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x298]
cmp edx, 8
jb 0x4479a3
mov ecx, dword [ebp - 0x2ac]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x447999
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x448003
push edx
push ecx
call fcn.0046d84e
add esp, 8
mov al, byte [0x4e9960]
lea ecx, [ebp - 0x134]
mov byte [ebp - 0xb0], al
mov al, byte [0x4e995c]
mov byte [ebp - 0xaf], al
mov al, byte [0x4e995b]
mov byte [ebp - 0x115], al
mov al, byte [0x4e995a]
mov byte [ebp - 0x114], al
mov al, byte [0x4e9959]
mov byte [ebp - 0xae], al
mov al, byte [0x4e994b]
mov byte [ebp - 0xad], al
mov al, byte [0x4e994c]
mov byte [ebp - 0x112], al
lea eax, [esi + 0x1c]
cmp ecx, eax
je 0x447a15
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x447a08
mov eax, dword [eax]
push ecx
push eax
lea ecx, [ebp - 0x134]
call fcn.00407cf0
push 0x4e4c88
lea ecx, [ebp - 0x4c]
call fcn.0040c290
mov byte [ebp - 4], 7
cmp byte [esi + 0x18], 0
je 0x447aab
lea ecx, [ebp - 0x2c4]
call fcn.004485b0
mov esi, eax
lea eax, [ebp - 0x4c]
cmp eax, esi
je 0x447a6b
mov ecx, eax
call fcn.00405090
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [ebp - 0x4c], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0x3c], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov edx, dword [ebp - 0x2b0]
cmp edx, 8
jb 0x447aab
mov ecx, dword [ebp - 0x2c4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x447aa1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x448008
push edx
push ecx
call fcn.0046d84e
add esp, 8
cmp byte [0x4e994e], 0
je 0x447ad6
cmp dword [0x4e4e94], 8
lea ecx, [ebp - 0x4c]
push dword [0x4e4e90]
mov eax, 0x4e4e80
cmovae eax, dword [0x4e4e80]
push eax
call fcn.00407cf0
sub esp, 0x1c
lea eax, [ebp - 0x4c]
lea ecx, [ebp - 0x274]
push eax
call fcn.00413900
mov ecx, 0x4e99b0
xchg dword [ecx], eax
mov eax, dword [0x4e99b0]
test eax, eax
je 0x447b77
mov esi, dword [0x4e99b0]
mov byte [ebp - 4], 8
call fcn.00403c20
mov ecx, eax
test ecx, ecx
je 0x44800d
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x1c], eax
push esi
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 9
push str.Failed_to_install_Installer_Service__error:__d
push eax
call fcn.0040f890
mov esi, dword [ebp - 0x1c]
mov edx, 0x602
push esi
mov ecx, str.d:jenkinsworkspace_a_mb4_mbsetup_srcmbsetupmbutils.cpp
call fcn.00442410
add esp, 0x10
mov al, 1
mov ecx, 0x4e99ad
xchg byte [ecx], al
add esi, 0xfffffff0
mov byte [ebp - 4], 0xa
mov eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x447ec7
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x447ec7
push str.Waiting_for_InstallerService_to_start...
mov edx, 0x607
mov ecx, str.d:jenkinsworkspace_a_mb4_mbsetup_srcmbsetupmbutils.cpp
call fcn.00442410
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 4
xor esi, esi
push 0x3e8
call edi
call fcn.00418600
mov ecx, esi
inc esi
cmp ecx, 0x1e
jge 0x447bae
test al, al
je 0x447b96
push str.Waiting_for_InstallerService_to_stop...
mov edx, 0x610
mov ecx, str.d:jenkinsworkspace_a_mb4_mbsetup_srcmbsetupmbutils.cpp
call fcn.00442410
add esp, 4
push 0x3e8
call edi
call fcn.00418600
test al, al
jne 0x447bc5
push str.InstallerService_has_stopped
mov edx, 0x617
mov ecx, str.d:jenkinsworkspace_a_mb4_mbsetup_srcmbsetupmbutils.cpp
call fcn.00442410
add esp, 4
call fcn.00418ce0
mov esi, eax
or edi, 0xffffffff
mov dword [ebp - 0x18], esi
cmp esi, edi
je 0x447d1b
call fcn.00418ce0
mov dword [0x4e993c], eax
lea eax, [ebp - 0x2dc]
push eax
call fcn.00418fa0
mov edx, eax
mov byte [ebp - 4], 0xb
cmp dword [edx + 0x14], 0x10
jb 0x447c25
mov edx, dword [edx]
test edx, edx
jne 0x447c2d
xor ecx, ecx
jmp 0x447c3b
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x447c32
sub ecx, esi
push ecx
push edx
mov ecx, 0x4e99d4
call fcn.00403480
mov byte [ebp - 4], 7
mov edx, dword [ebp - 0x2c8]
cmp edx, 0x10
jb 0x447c85
mov ecx, dword [ebp - 0x2dc]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x447c7b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x448017
push edx
push ecx
call fcn.0046d84e
add esp, 8
mov byte [ebp - 4], 0xc
call fcn.00403c20
mov ecx, eax
test ecx, ecx
je 0x44801c
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 0xd
lea eax, [ebp - 0x14]
push dword [0x4e993c]
push str._InstallerService_error_status___u
push eax
call fcn.0040f890
push dword [ebp - 0x14]
mov edx, 0x622
mov ecx, str.d:jenkinsworkspace_a_mb4_mbsetup_srcmbsetupmbutils.cpp
call fcn.00442410
push dword [0x4e99d4]
lea eax, [ebp - 0x14]
push str._InstallerService_error_detail____hs_
push eax
call fcn.0040f890
mov esi, dword [ebp - 0x14]
mov edx, 0x624
push esi
mov ecx, str.d:jenkinsworkspace_a_mb4_mbsetup_srcmbsetupmbutils.cpp
call fcn.00442410
add esp, 0x20
add esi, 0xfffffff0
mov byte [ebp - 4], 0xe
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x447d14
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 7
mov esi, dword [ebp - 0x18]
call fcn.00418a10
test al, al
je 0x447d4e
cmp esi, 0x5a
jne 0x447d4e
push str.setting_rebootRequired_to_true
mov edx, 0x629
mov ecx, str.d:jenkinsworkspace_a_mb4_mbsetup_srcmbsetupmbutils.cpp
call fcn.00442410
add esp, 4
mov al, 1
mov ecx, 0x4e99ae
xchg byte [ecx], al
jmp 0x447ea7
cmp dword [0x4e993c], 0
jbe 0x447ea7
mov byte [ebp - 4], 0xf
call fcn.00403c20
mov ecx, eax
test ecx, ecx
je 0x448026
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x27c]
mov edx, dword [0x4e993c]
call fcn.0044a450
mov byte [ebp - 4], 0x11
push dword [eax]
lea eax, [ebp - 0x18]
push dword [0x4e993c]
push str.Installer_Service_error_status__d___hs_
push eax
call fcn.0040f890
mov edx, dword [ebp - 0x27c]
add esp, 0x10
add edx, 0xfffffff0
mov byte [ebp - 4], 0x12
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x447dce
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x10
mov edx, 0x631
mov esi, dword [ebp - 0x18]
mov ecx, str.d:jenkinsworkspace_a_mb4_mbsetup_srcmbsetupmbutils.cpp
push esi
call fcn.00442410
add esp, 4
mov al, 1
mov ecx, 0x4e99b4
xchg byte [ecx], al
cmp dword [0x4e993c], 0x4d
jne 0x447e85
mov al, 1
mov ecx, 0x4e99ac
xchg byte [ecx], al
cmp byte [0x4e994b], 0
je 0x447e85
push str.https:__www.malwarebytes.com_jobs
lea ecx, [ebp - 0xac]
call fcn.00405040
cmp dword [ebp - 0x98], 8
lea eax, [ebp - 0xac]
push 5
cmovae eax, dword [ebp - 0xac]
push 0
push 0
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edx, dword [ebp - 0x98]
cmp edx, 8
jb 0x447e85
mov ecx, dword [ebp - 0xac]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x447e7b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x448030
push edx
push ecx
call fcn.0046d84e
add esp, 8
call fcn.00419300
add esi, 0xfffffff0
mov byte [ebp - 4], 0x13
lock xadd dword [esi + 0xc], edi
dec edi
test edi, edi
jg 0x447ea3
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 7
mov al, 1
mov edx, 0x4e99ad
xchg byte [edx], al
push str.Installer_service_has_completed
mov edx, 0x644
mov ecx, str.d:jenkinsworkspace_a_mb4_mbsetup_srcmbsetupmbutils.cpp
call fcn.00442410
add esp, 4
mov edx, dword [ebp - 0x38]
cmp edx, 8
jb 0x447f01
mov ecx, dword [ebp - 0x4c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x447ef7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x448035
push edx
push ecx
call fcn.0046d84e
add esp, 8
mov edx, dword [ebp - 0x20]
xor eax, eax
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 7
mov word [ebp - 0x4c], ax
cmp edx, 8
jb 0x447f4f
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x447f45
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44803a
push edx
push ecx
call fcn.0046d84e
add esp, 8
mov edx, dword [ebp - 0x68]
cmp edx, 8
jb 0x447f89
mov ecx, dword [ebp - 0x7c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x447f7f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44803f
push edx
push ecx
call fcn.0046d84e
add esp, 8
xor eax, eax
mov dword [ebp - 0x6c], 0
lea ecx, [ebp - 0x274]
mov dword [ebp - 0x68], 7
mov word [ebp - 0x7c], ax
call fcn.004132b0
mov edx, dword [ebp - 0x50]
cmp edx, 8
jb 0x447fde
mov ecx, dword [ebp - 0x64]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x447fd4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x448044
push edx
push ecx
call fcn.0046d84e
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046d32d
mov esp, ebp
pop ebp
ret
call fcn.0048879c
call fcn.0048879c
call fcn.0048879c
call fcn.0048879c
push 0x80004005
call fcn.00403d90
call fcn.0048879c
push 0x80004005
call fcn.00403d90
push 0x80004005
call fcn.00403d90
call fcn.0048879c
call fcn.0048879c
call fcn.0048879c
call fcn.0048879c
call fcn.0048879c
int3