Function at 0x4463d0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b332a
mov eax, dword fs:[0]
push eax
sub esp, 0x2d0
mov eax, dword [0x4e606c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 7
mov word [ebp - 0x64], ax
lea ecx, [ebp - 0x274]
mov dword [ebp - 4], eax
call fcn.00412080
xor eax, eax
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x68], 7
mov word [ebp - 0x7c], ax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x34]
mov al, byte [0x4eb9ff]
push 0x4e6d30
mov byte [ebp - 0x26f], al
call fcn.0040beb0
mov byte [ebp - 4], 3
lea eax, [ebp - 0x34]
cmp dword [ebp - 0x20], 8
lea ecx, [ebp - 0x254]
push dword [ebp - 0x24]
cmovae eax, dword [ebp - 0x34]
push eax
call fcn.00407920
mov edi, dword [ebp - 0x20]
lea ecx, [ebp - 0x34]
mov eax, dword [ebp - 0x34]
cmp edi, 8
cmovae ecx, eax
cmp dword [ebp - 0x24], 6
jne 0x44649a
push 6
mov edx, str.MDAM_B
call fcn.00419770
add esp, 4
test eax, eax
je 0x4464bc
mov eax, dword [ebp - 0x34]
cmp edi, 8
lea ecx, [ebp - 0x34]
cmovae ecx, eax
cmp dword [ebp - 0x24], 6
jne 0x4464c8
push 6
mov edx, str.MBRW_B
call fcn.00419770
add esp, 4
test eax, eax
jne 0x4464c5
push 8
push str.business
jmp 0x4464fa
mov eax, dword [ebp - 0x34]
cmp edi, 8
lea ecx, [ebp - 0x34]
cmovae ecx, eax
cmp dword [ebp - 0x24], 8
jne 0x4464f3
push 8
mov edx, str.NCEP_WIN
call fcn.00419770
add esp, 4
test eax, eax
jne 0x4464f3
push 6
push str.common
jmp 0x4464fa
push 8
push 0x4cfb30
lea ecx, [ebp - 0x64]
call fcn.00407920
lea eax, [ebp - 0x224]
cmp eax, esi
je 0x446525
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x446516
mov eax, dword [esi]
push dword [esi + 0x10]
lea ecx, [ebp - 0x224]
push eax
call fcn.00407920
cmp dword [ebp - 0x50], 8
lea eax, [ebp - 0x64]
push dword [ebp - 0x54]
cmovae eax, dword [ebp - 0x64]
lea ecx, [ebp - 0x23c]
push eax
call fcn.00407920
cmp dword [0x4e6c9c], 8
lea ecx, [ebp - 0x20c]
push dword [0x4e6c98]
mov eax, 0x4e6c88
cmovae eax, dword [0x4e6c88]
push eax
call fcn.00407920
cmp dword [0x4e6d44], 8
mov eax, 0x4e6d30
push str.MBRW_C
cmovae eax, dword [0x4e6d30]
push eax
call fcn.0048ca67
add esp, 8
test eax, eax
je 0x4465ae
cmp dword [0x4e6d44], 8
mov eax, 0x4e6d30
push str.MBRW_B
cmovae eax, dword [0x4e6d30]
push eax
call fcn.0048ca67
add esp, 8
test eax, eax
jne 0x44662b
push str.MalwarebytesMB3Service
mov edx, esi
lea ecx, [ebp - 0x94]
call fcn.0043b8a0
add esp, 4
mov byte [ebp - 4], 4
lea eax, [ebp - 0x94]
cmp dword [ebp - 0x80], 8
lea ecx, [ebp - 0x1f4]
push dword [ebp - 0x84]
cmovae eax, dword [ebp - 0x94]
push eax
call fcn.00407920
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x80]
cmp edx, 8
jb 0x44662b
mov ecx, dword [ebp - 0x94]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x446621
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x446fb7
push edx
push ecx
call fcn.0046e8d1
add esp, 8
cmp byte [0x4eb9ed], 0
je 0x446657
lea eax, [ebp - 0x1f4]
cmp eax, esi
je 0x446657
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x446648
mov eax, dword [esi]
push dword [esi + 0x10]
lea ecx, [ebp - 0x1f4]
push eax
call fcn.00407920
cmp dword [0x4e6d74], 8
lea ecx, [ebp - 0x1dc]
push dword [0x4e6d70]
mov eax, 0x4e6d60
cmovae eax, dword [0x4e6d60]
push eax
call fcn.00407920
cmp dword [0x4e6d8c], 8
lea ecx, [ebp - 0x1c4]
push dword [0x4e6d88]
mov eax, 0x4e6d78
cmovae eax, dword [0x4e6d78]
push eax
call fcn.00407920
mov ecx, dword [0x4e6da0]
test ecx, ecx
je 0x4466cb
cmp dword [0x4e6da4], 8
mov eax, 0x4e6d90
push ecx
cmovae eax, dword [0x4e6d90]
lea ecx, [ebp - 0x1ac]
push eax
call fcn.00407920
mov ecx, dword [0x4e6db8]
test ecx, ecx
je 0x4466f5
cmp dword [0x4e6dbc], 8
mov eax, 0x4e6da8
push ecx
cmovae eax, dword [0x4e6da8]
lea ecx, [ebp - 0x194]
push eax
call fcn.00407920
mov ecx, dword [0x4e6dd0]
test ecx, ecx
je 0x44671f
cmp dword [0x4e6dd4], 8
mov eax, 0x4e6dc0
push ecx
cmovae eax, dword [0x4e6dc0]
lea ecx, [ebp - 0x17c]
push eax
call fcn.00407920
mov ecx, dword [0x4e6de8]
test ecx, ecx
je 0x446749
cmp dword [0x4e6dec], 8
mov eax, 0x4e6dd8
push ecx
cmovae eax, dword [0x4e6dd8]
lea ecx, [ebp - 0x164]
push eax
call fcn.00407920
cmp dword [0x4e6e04], 8
lea ecx, [ebp - 0x14c]
push dword [0x4e6e00]
mov eax, 0x4e6df0
cmovae eax, dword [0x4e6df0]
push eax
call fcn.00407920
mov al, byte [0x4eb9f6]
mov byte [ebp - 0x11c], al
mov al, byte [0x4e6ac4]
mov byte [ebp - 0x11a], al
mov al, byte [0x4eba53]
mov byte [ebp - 0x11b], 1
push dword [0x4e6e60]
test al, al
lea ecx, [ebp - 0x110]
mov al, byte [0x4eb9f8]
mov byte [ebp - 0x117], al
setne byte [ebp - 0x118]
mov al, byte [0x4eb9f9]
cmp dword [0x4e6e64], 8
mov byte [ebp - 0x275], al
mov eax, 0x4e6e50
cmovae eax, dword [0x4e6e50]
push eax
call fcn.00407920
mov al, byte [ebp - 0x275]
cmp dword [0x4e6e34], 8
mov byte [ebp - 0x113], al
mov eax, 0x4e6e20
cmovae eax, dword [0x4e6e20]
push eax
call fcn.00490793
add esp, 4
cmp eax, 0x3e7
jle 0x44684d
cmp dword [0x4e6e34], 8
lea ecx, [ebp - 0xe0]
push dword [0x4e6e30]
mov eax, 0x4e6e20
cmovae eax, dword [0x4e6e20]
push eax
call fcn.00407920
cmp dword [0x4e6e1c], 8
lea ecx, [ebp - 0xf8]
push dword [0x4e6e18]
mov eax, 0x4e6e08
cmovae eax, dword [0x4e6e08]
push eax
call fcn.00407920
cmp dword [0x4e6e4c], 8
lea ecx, [ebp - 0xc8]
push dword [0x4e6e48]
mov eax, 0x4e6e38
cmovae eax, dword [0x4e6e38]
push eax
call fcn.00407920
mov al, byte [0x4eb9f7]
lea ecx, [ebp - 0x7c]
mov byte [ebp - 0x116], al
call fcn.0042e3c0
lea eax, [ebp - 0x2ac]
push eax
lea ecx, [ebp - 0x7c]
call fcn.0043e970
push eax
lea ecx, [ebp - 0x294]
mov byte [ebp - 4], 5
call fcn.0040beb0
mov byte [ebp - 4], 6
lea eax, [ebp - 0x294]
cmp dword [ebp - 0x280], 8
lea ecx, [ebp - 0x26c]
push dword [ebp - 0x284]
cmovae eax, dword [ebp - 0x294]
push eax
call fcn.00407920
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x280]
cmp edx, 8
jb 0x446912
mov ecx, dword [ebp - 0x294]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x446908
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x446fbc
push edx
push ecx
call fcn.0046e8d1
add esp, 8
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x298]
cmp edx, 8
jb 0x446956
mov ecx, dword [ebp - 0x2ac]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x44694c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x446fc1
push edx
push ecx
call fcn.0046e8d1
add esp, 8
mov al, byte [0x4eba02]
lea ecx, [ebp - 0x134]
mov byte [ebp - 0xb0], al
mov al, byte [0x4eb9fe]
mov byte [ebp - 0xaf], al
mov al, byte [0x4eb9fd]
mov byte [ebp - 0x115], al
mov al, byte [0x4eb9fc]
mov byte [ebp - 0x114], al
mov al, byte [0x4eb9fb]
mov byte [ebp - 0xae], al
mov al, byte [0x4eb9ed]
mov byte [ebp - 0xad], al
mov al, byte [0x4eb9ee]
mov byte [ebp - 0x112], al
lea eax, [esi + 0x1c]
cmp ecx, eax
je 0x4469c8
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x4469bb
mov eax, dword [eax]
push ecx
push eax
lea ecx, [ebp - 0x134]
call fcn.00407920
push 0x4e6c88
lea ecx, [ebp - 0x4c]
call fcn.0040beb0
mov byte [ebp - 4], 7
cmp byte [esi + 0x18], 0
je 0x446a5e
lea ecx, [ebp - 0x2c4]
call fcn.00447530
mov esi, eax
lea eax, [ebp - 0x4c]
cmp eax, esi
je 0x446a1e
mov ecx, eax
call fcn.00404cc0
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [ebp - 0x4c], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0x3c], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov edx, dword [ebp - 0x2b0]
cmp edx, 8
jb 0x446a5e
mov ecx, dword [ebp - 0x2c4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x446a54
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x446fc6
push edx
push ecx
call fcn.0046e8d1
add esp, 8
cmp byte [0x4eb9f0], 0
je 0x446a89
cmp dword [0x4e6e7c], 8
lea ecx, [ebp - 0x4c]
push dword [0x4e6e78]
mov eax, 0x4e6e68
cmovae eax, dword [0x4e6e68]
push eax
call fcn.00407920
sub esp, 0x1c
lea eax, [ebp - 0x4c]
lea ecx, [ebp - 0x274]
push eax
call fcn.00412900
mov ecx, 0x4eba54
xchg dword [ecx], eax
mov eax, dword [0x4eba54]
test eax, eax
je 0x446b2a
mov esi, dword [0x4eba54]
mov byte [ebp - 4], 8
call fcn.00403a40
mov ecx, eax
test ecx, ecx
je 0x446fcb
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x1c], eax
push esi
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 9
push str.Failed_to_install_Installer_Service__error:__d
push eax
call fcn.0040f680
mov esi, dword [ebp - 0x1c]
mov edx, 0x60a
push esi
mov ecx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbutils.cpp
call fcn.00441390
add esp, 0x10
mov al, 1
mov ecx, 0x4eba51
xchg byte [ecx], al
add esi, 0xfffffff0
mov byte [ebp - 4], 0xa
mov eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x446e85
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x446e85
push str.Waiting_for_InstallerService_to_start...
mov edx, 0x60f
mov ecx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbutils.cpp
call fcn.00441390
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 4
xor esi, esi
nop dword [eax]
push 0x3e8
call edi
call fcn.004175e0
mov ecx, esi
inc esi
cmp ecx, 0x1e
jge 0x446b68
test al, al
je 0x446b50
push str.Waiting_for_InstallerService_to_stop...
mov edx, 0x618
mov ecx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbutils.cpp
call fcn.00441390
add esp, 4
nop
push 0x3e8
call edi
call fcn.004175e0
test al, al
jne 0x446b80
push str.InstallerService_has_stopped
mov edx, 0x61f
mov ecx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbutils.cpp
call fcn.00441390
add esp, 4
call fcn.00417cc0
mov esi, eax
or edi, 0xffffffff
mov dword [ebp - 0x18], esi
cmp esi, edi
je 0x446cd9
call fcn.00417cc0
mov dword [0x4eb9e0], eax
lea eax, [ebp - 0x2dc]
push eax
call fcn.00417f90
mov edx, eax
mov byte [ebp - 4], 0xb
cmp dword [edx + 0x14], 0x10
jb 0x446be0
mov edx, dword [edx]
test edx, edx
jne 0x446be8
xor ecx, ecx
jmp 0x446bf9
mov ecx, edx
lea esi, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x446bf0
sub ecx, esi
push ecx
push edx
mov ecx, 0x4eba78
call fcn.004032a0
mov byte [ebp - 4], 7
mov edx, dword [ebp - 0x2c8]
cmp edx, 0x10
jb 0x446c43
mov ecx, dword [ebp - 0x2dc]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x446c39
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x446fd5
push edx
push ecx
call fcn.0046e8d1
add esp, 8
mov byte [ebp - 4], 0xc
call fcn.00403a40
mov ecx, eax
test ecx, ecx
je 0x446fda
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 0xd
lea eax, [ebp - 0x14]
push dword [0x4eb9e0]
push str._InstallerService_error_status___u
push eax
call fcn.0040f680
push dword [ebp - 0x14]
mov edx, 0x62a
mov ecx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbutils.cpp
call fcn.00441390
push dword [0x4eba78]
lea eax, [ebp - 0x14]
push str._InstallerService_error_detail____hs_
push eax
call fcn.0040f680
mov esi, dword [ebp - 0x14]
mov edx, 0x62c
push esi
mov ecx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbutils.cpp
call fcn.00441390
add esp, 0x20
add esi, 0xfffffff0
mov byte [ebp - 4], 0xe
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x446cd2
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 7
mov esi, dword [ebp - 0x18]
call fcn.004179f0
test al, al
je 0x446d0c
cmp esi, 0x5a
jne 0x446d0c
push str.setting_rebootRequired_to_true
mov edx, 0x631
mov ecx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbutils.cpp
call fcn.00441390
add esp, 4
mov al, 1
mov ecx, 0x4eba52
xchg byte [ecx], al
jmp 0x446e65
cmp dword [0x4eb9e0], 0
jbe 0x446e65
mov byte [ebp - 4], 0xf
call fcn.00403a40
mov ecx, eax
test ecx, ecx
je 0x446fe4
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x27c]
mov edx, dword [0x4eb9e0]
call fcn.00449740
mov byte [ebp - 4], 0x11
push dword [eax]
lea eax, [ebp - 0x18]
push dword [0x4eb9e0]
push str.Installer_Service_error_status__d___hs_
push eax
call fcn.0040f680
mov edx, dword [ebp - 0x27c]
add esp, 0x10
add edx, 0xfffffff0
mov byte [ebp - 4], 0x12
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x446d8c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x10
mov edx, 0x639
mov esi, dword [ebp - 0x18]
mov ecx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbutils.cpp
push esi
call fcn.00441390
add esp, 4
mov al, 1
mov ecx, 0x4eba58
xchg byte [ecx], al
cmp dword [0x4eb9e0], 0x4d
jne 0x446e43
mov al, 1
mov ecx, 0x4eba50
xchg byte [ecx], al
cmp byte [0x4eb9ed], 0
je 0x446e43
push str.https:__www.malwarebytes.com_jobs
lea ecx, [ebp - 0xac]
call fcn.00404c70
cmp dword [ebp - 0x98], 8
lea eax, [ebp - 0xac]
push 5
cmovae eax, dword [ebp - 0xac]
push 0
push 0
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edx, dword [ebp - 0x98]
cmp edx, 8
jb 0x446e43
mov ecx, dword [ebp - 0xac]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x446e39
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x446fee
push edx
push ecx
call fcn.0046e8d1
add esp, 8
call fcn.004182f0
add esi, 0xfffffff0
mov byte [ebp - 4], 0x13
lock xadd dword [esi + 0xc], edi
dec edi
test edi, edi
jg 0x446e61
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 7
mov al, 1
mov edx, 0x4eba51
xchg byte [edx], al
push str.Installer_service_has_completed
mov edx, 0x64c
mov ecx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbutils.cpp
call fcn.00441390
add esp, 4
mov edx, dword [ebp - 0x38]
cmp edx, 8
jb 0x446ebf
mov ecx, dword [ebp - 0x4c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x446eb5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x446ff3
push edx
push ecx
call fcn.0046e8d1
add esp, 8
mov edx, dword [ebp - 0x20]
xor eax, eax
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 7
mov word [ebp - 0x4c], ax
cmp edx, 8
jb 0x446f0d
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x446f03
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x446ff8
push edx
push ecx
call fcn.0046e8d1
add esp, 8
mov edx, dword [ebp - 0x68]
cmp edx, 8
jb 0x446f47
mov ecx, dword [ebp - 0x7c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x446f3d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x446ffd
push edx
push ecx
call fcn.0046e8d1
add esp, 8
xor eax, eax
mov dword [ebp - 0x6c], 0
lea ecx, [ebp - 0x274]
mov dword [ebp - 0x68], 7
mov word [ebp - 0x7c], ax
call fcn.004122b0
mov edx, dword [ebp - 0x50]
cmp edx, 8
jb 0x446f9c
mov ecx, dword [ebp - 0x64]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x446f92
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x447002
push edx
push ecx
call fcn.0046e8d1
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046e3b0
mov esp, ebp
pop ebp
ret
call fcn.0048981c
call fcn.0048981c
call fcn.0048981c
call fcn.0048981c
push 0x80004005
call fcn.00403bb0
call fcn.0048981c
push 0x80004005
call fcn.00403bb0
push 0x80004005
call fcn.00403bb0
call fcn.0048981c
call fcn.0048981c
call fcn.0048981c
call fcn.0048981c
call fcn.0048981c
int3