Function at 0x4489e0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b2858
mov eax, dword fs:[0]
push eax
sub esp, 0x340
mov eax, dword [0x4e506c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x288], ecx
push 0x4eab24
push 0x41a160
push 0x4eab2c
call fcn.0046a0b3
add esp, 0xc
test eax, eax
je 0x449373
xor eax, eax
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 7
mov word [ebp - 0x70], ax
lea ecx, [ebp - 0x280]
mov dword [ebp - 4], eax
call fcn.00412080
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1d0]
mov al, byte [0x4ea9ff]
cmp dword [0x4e5d8c], 8
push dword [0x4e5d88]
mov byte [ebp - 0x27b], al
mov eax, 0x4e5d78
cmovae eax, dword [0x4e5d78]
push eax
call fcn.00407920
mov ecx, dword [0x4e5da0]
test ecx, ecx
je 0x448ab2
cmp dword [0x4e5da4], 8
mov eax, 0x4e5d90
push ecx
cmovae eax, dword [0x4e5d90]
lea ecx, [ebp - 0x1b8]
push eax
call fcn.00407920
cmp dword [0x4e5c9c], 8
lea ecx, [ebp - 0x218]
push dword [0x4e5c98]
mov eax, 0x4e5c88
cmovae eax, dword [0x4e5c88]
push eax
call fcn.00407920
push 0x4e5d30
lea ecx, [ebp - 0x58]
call fcn.0040beb0
mov byte [ebp - 4], 2
lea eax, [ebp - 0x58]
cmp dword [ebp - 0x44], 8
lea ecx, [ebp - 0x260]
push dword [ebp - 0x48]
cmovae eax, dword [ebp - 0x58]
push eax
call fcn.00407920
mov esi, dword [ebp - 0x44]
lea ecx, [ebp - 0x58]
mov edi, dword [ebp - 0x58]
cmp esi, 8
mov eax, dword [ebp - 0x48]
cmovae ecx, edi
cmp eax, 6
jne 0x448b2e
push eax
mov edx, str.MDAM_B
call fcn.00419770
add esp, 4
test eax, eax
je 0x448b4e
mov eax, dword [ebp - 0x48]
cmp esi, 8
lea ecx, [ebp - 0x58]
cmovae ecx, edi
cmp eax, 6
jne 0x448b5a
push eax
mov edx, str.MBRW_B
call fcn.00419770
add esp, 4
test eax, eax
jne 0x448b57
push 8
push str.business
jmp 0x448b8a
mov eax, dword [ebp - 0x48]
cmp esi, 8
lea ecx, [ebp - 0x58]
cmovae ecx, edi
cmp eax, 8
jne 0x448b83
push eax
mov edx, str.NCEP_WIN
call fcn.00419770
add esp, 4
test eax, eax
jne 0x448b83
push 6
push str.common
jmp 0x448b8a
push 8
push 0x4ceb30
lea ecx, [ebp - 0x70]
call fcn.00407920
cmp dword [ebp - 0x5c], 8
lea eax, [ebp - 0x70]
push dword [ebp - 0x60]
cmovae eax, dword [ebp - 0x70]
lea ecx, [ebp - 0x248]
push eax
call fcn.00407920
cmp dword [0x4e5ef4], 8
lea ecx, [ebp - 0x230]
push dword [0x4e5ef0]
mov eax, 0x4e5ee0
cmovae eax, dword [0x4e5ee0]
push eax
call fcn.00407920
cmp dword [0x4e5d44], 8
mov eax, 0x4e5d30
push str.MBRW_C
cmovae eax, dword [0x4e5d30]
push eax
call fcn.0048bd37
add esp, 8
test eax, eax
je 0x448c1b
cmp dword [0x4e5d44], 8
mov eax, 0x4e5d30
push str.MBRW_B
cmovae eax, dword [0x4e5d30]
push eax
call fcn.0048bd37
add esp, 8
test eax, eax
jne 0x448c98
push str.MalwarebytesMB3Service
mov edx, 0x4e5ee0
lea ecx, [ebp - 0x88]
call fcn.0043b8a0
add esp, 4
mov byte [ebp - 4], 3
lea eax, [ebp - 0x88]
cmp dword [ebp - 0x74], 8
lea ecx, [ebp - 0x200]
push dword [ebp - 0x78]
cmovae eax, dword [ebp - 0x88]
push eax
call fcn.00407920
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x74]
cmp edx, 8
jb 0x448c98
mov ecx, dword [ebp - 0x88]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x448c8e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x449378
push edx
push ecx
call fcn.0046db96
add esp, 8
cmp dword [0x4e5d74], 8
lea ecx, [ebp - 0x1e8]
push dword [0x4e5d70]
mov eax, 0x4e5d60
cmovae eax, dword [0x4e5d60]
push eax
call fcn.00407920
cmp dword [0x4e5e04], 8
lea ecx, [ebp - 0x158]
push dword [0x4e5e00]
mov eax, 0x4e5df0
cmovae eax, dword [0x4e5df0]
push eax
call fcn.00407920
mov al, byte [0x4ea9f6]
mov byte [ebp - 0x128], al
xor eax, eax
mov byte [ebp - 0x125], 1
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
mov byte [ebp - 4], 5
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
cmp byte [0x4ea9f0], al
je 0x448dbd
mov edi, dword [0x4e5e7c]
mov ecx, 0x4e5e68
mov esi, dword [0x4e5e78]
cmp edi, 8
cmovae ecx, dword [0x4e5e68]
cmp esi, 2
jne 0x448d99
push esi
mov edx, 0x4cf1c4
call fcn.00419770
add esp, 4
test eax, eax
jne 0x448d99
push 0x4e5c88
lea ecx, [ebp - 0x2ec]
call fcn.0040beb0
lea ecx, [ebp - 0x28]
call fcn.00404cc0
movups xmm0, xmmword [ebp - 0x2ec]
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
movups xmmword [ebp - 0x28], xmm0
movq xmm0, qword [ebp - 0x2dc]
movq qword [ebp - 0x18], xmm0
jmp 0x449079
cmp edi, 8
lea ecx, [ebp - 0x28]
mov eax, 0x4e5e68
cmovae eax, dword [0x4e5e68]
push esi
push eax
call fcn.00407920
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x449079
mov esi, dword [ebp - 0x288]
lea ecx, [ebp - 0x2d4]
mov byte [ebp - 0x28c], 0
add esi, 0x18
push dword [ebp - 0x28c]
mov edx, esi
call fcn.00418ec0
add esp, 4
lea ecx, [ebp - 0x2d4]
mov byte [ebp - 4], 6
call fcn.0044b940
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x2c0]
mov byte [ebp - 0x281], al
cmp edx, 8
jb 0x448e42
mov ecx, dword [ebp - 0x2d4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x448e32
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44937d
push edx
push ecx
call fcn.0046db96
mov al, byte [ebp - 0x281]
add esp, 8
test al, al
je 0x448ffa
push 0x4e5c88
lea ecx, [ebp - 0x304]
mov byte [0x4ea9f0], 1
call fcn.0040beb0
lea ecx, [ebp - 0x28]
call fcn.00404cc0
movups xmm0, xmmword [ebp - 0x304]
push str.Rename_local_ISvc_and_download_latest
mov edx, 0x7d7
mov ecx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbutils.cpp
movups xmmword [ebp - 0x28], xmm0
movq xmm0, qword [ebp - 0x2f4]
movq qword [ebp - 0x18], xmm0
call fcn.00441390
add esp, 4
lea ecx, [ebp - 0x31c]
push 0x4e5c88
call fcn.0040beb0
lea ecx, [ebp - 0x40]
call fcn.00404cc0
movups xmm0, xmmword [ebp - 0x31c]
push 0x1d
push str.MBAMInstallerService_old.exe
movups xmmword [ebp - 0x40], xmm0
lea ecx, [ebp - 0x40]
movq xmm0, qword [ebp - 0x30c]
movq qword [ebp - 0x30], xmm0
call fcn.0040c260
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
cmp dword [esi + 0x14], 8
jb 0x448eea
mov esi, dword [esi]
push 1
push eax
push esi
call edi
test eax, eax
jne 0x449079
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
mov edx, eax
lea ecx, [ebp - 0x2a4]
call fcn.0044b830
push eax
mov edx, str.Error_calling_MoveFileEx:
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xa0]
call fcn.00418e50
add esp, 4
mov byte [ebp - 4], 0xa
mov edx, dword [ebp - 0x290]
cmp edx, 8
jb 0x448f69
mov ecx, dword [ebp - 0x2a4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x448f5f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x449382
push edx
push ecx
call fcn.0046db96
add esp, 8
xor eax, eax
mov dword [ebp - 0x294], 0
cmp dword [ebp - 0x8c], 8
mov edx, 0x7df
mov word [ebp - 0x2a4], ax
mov ecx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbutils.cpp
lea eax, [ebp - 0xa0]
mov dword [ebp - 0x290], 7
cmovae eax, dword [ebp - 0xa0]
push eax
call fcn.00441390
mov byte [ebp - 4], 5
add esp, 4
mov edx, dword [ebp - 0x8c]
cmp edx, 8
jb 0x44907f
mov ecx, dword [ebp - 0xa0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x448feb
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x449387
push edx
push ecx
call fcn.0046db96
add esp, 8
jmp 0x44907f
lea ecx, [ebp - 0x34c]
call fcn.0043ff80
push eax
lea ecx, [ebp - 0x334]
mov byte [ebp - 4], 7
call fcn.0040beb0
lea ecx, [ebp - 0x28]
call fcn.00404cc0
movups xmm0, xmmword [ebp - 0x334]
movups xmmword [ebp - 0x28], xmm0
movq xmm0, qword [ebp - 0x324]
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x338]
movq qword [ebp - 0x18], xmm0
cmp edx, 8
jb 0x449079
mov ecx, dword [ebp - 0x34c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x44906f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44938c
push edx
push ecx
call fcn.0046db96
add esp, 8
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
sub esp, 0x1c
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x280]
push eax
call fcn.00412900
mov ecx, 0x4eaa54
xchg dword [ecx], eax
mov eax, dword [0x4eaa54]
cmp eax, 9
jne 0x4491fa
push str.Download_of_ISvc_failed._Using_local_ISvc
mov edx, 0x7e7
mov ecx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbutils.cpp
call fcn.00441390
mov ecx, dword [ebp - 0x288]
add esp, 4
add ecx, 0x18
mov byte [0x4ea9f0], 1
cmp dword [ecx + 0x14], 8
jb 0x4490d5
mov ecx, dword [ecx]
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
push 1
cmovae eax, dword [ebp - 0x40]
push ecx
push eax
call edi
test eax, eax
jne 0x4491e1
call esi
mov edx, eax
lea ecx, [ebp - 0x2bc]
call fcn.0044b830
push eax
mov edx, str.Error_calling_MoveFileEx:
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0xb8]
call fcn.00418e50
add esp, 4
mov byte [ebp - 4], 0xd
mov edx, dword [ebp - 0x2a8]
cmp edx, 8
jb 0x449159
mov ecx, dword [ebp - 0x2bc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x44914f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x449391
push edx
push ecx
call fcn.0046db96
add esp, 8
xor eax, eax
mov dword [ebp - 0x2ac], 0
cmp dword [ebp - 0xa4], 8
mov edx, 0x7ee
mov word [ebp - 0x2bc], ax
mov ecx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbutils.cpp
lea eax, [ebp - 0xb8]
mov dword [ebp - 0x2a8], 7
cmovae eax, dword [ebp - 0xb8]
push eax
call fcn.00441390
mov byte [ebp - 4], 5
add esp, 4
mov edx, dword [ebp - 0xa4]
cmp edx, 8
jb 0x4491e1
mov ecx, dword [ebp - 0xb8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4491d7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x449396
push edx
push ecx
call fcn.0046db96
add esp, 8
sub esp, 0x1c
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x280]
push eax
call fcn.00412900
mov ecx, 0x4eaa54
xchg dword [ecx], eax
mov eax, dword [0x4eaa54]
test eax, eax
jne 0x449238
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
nop dword [eax + eax]
push 0x64
call edi
call fcn.004175e0
mov ecx, esi
inc esi
cmp ecx, 0x12c
jge 0x449228
test al, al
je 0x449210
push 0x3e8
call edi
call fcn.004175e0
test al, al
jne 0x449228
mov ecx, 0x4eaa51
mov al, 1
xchg byte [ecx], al
mov edx, dword [ebp - 0x2c]
cmp edx, 8
jb 0x44927b
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x449271
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44939b
push edx
push ecx
call fcn.0046db96
add esp, 8
mov edx, dword [ebp - 0x14]
xor eax, eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
cmp edx, 8
jb 0x4492c9
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4492bf
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4493a0
push edx
push ecx
call fcn.0046db96
add esp, 8
mov edx, dword [ebp - 0x44]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp edx, 8
jb 0x449317
mov ecx, dword [ebp - 0x58]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x44930d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4493a5
push edx
push ecx
call fcn.0046db96
add esp, 8
lea ecx, [ebp - 0x280]
call fcn.004122b0
mov edx, dword [ebp - 0x5c]
cmp edx, 8
jb 0x449358
mov ecx, dword [ebp - 0x70]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x44934e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4493aa
push edx
push ecx
call fcn.0046db96
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046d675
mov esp, ebp
pop ebp
ret
call fcn.0048c460
call fcn.00488aec
call fcn.00488aec
call fcn.00488aec
call fcn.00488aec
call fcn.00488aec
call fcn.00488aec
call fcn.00488aec
call fcn.00488aec
call fcn.00488aec
call fcn.00488aec
call fcn.00488aec
int3