Function at 0x4464b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x10b8
call fcn.00491d40
cmp dword [ebp + 0x1c], 0
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, ecx
jne 0x4468a1
mov ecx, dword [ebp + 0xc]
cmp ecx, 0x110
jne 0x4464f8
sub esp, 0x10
mov ecx, esi
call fcn.00452430
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
cmp ecx, 0x138
jne 0x446544
push 1
push edi
call dword [sym.imp.GDI32.dll_SetBkMode]
mov eax, dword [ebp + 0x14]
cmp eax, dword [esi + 0x20]
jne 0x446518
push 0x191514
jmp 0x446525
cmp eax, dword [esi + 0x14c]
jne 0x44652c
push 0x7b706a
push edi
call dword [sym.imp.GDI32.dll_SetTextColor]
mov eax, dword [ebp + 0x18]
mov ecx, dword [esi + 0x150]
mov dword [eax], ecx
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
movzx edx, di
cmp ecx, 0x2b
jne 0x4465e2
lea eax, [edx - 0x4b1]
cmp eax, 3
ja case.default.0x44655b
jmp dword [eax*4 + 0x4468ac]
push dword [esi + 0x150]
lea ecx, [esi + 0x24]
push dword [ebp + 0x14]
call fcn.00425550
mov eax, dword [ebp + 0x18]
mov dword [eax], 1
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
push dword [esi + 0x150]
lea ecx, [esi + 0x7c]
push dword [ebp + 0x14]
call fcn.00425550
mov eax, dword [ebp + 0x18]
mov dword [eax], 1
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
lea ecx, [esi + 0xd4]
jmp 0x4465be
lea ecx, [esi + 0x110]
push dword [esi + 0x150]
push dword [ebp + 0x14]
call fcn.00421390
mov eax, dword [ebp + 0x18]
mov dword [eax], 1
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
mov eax, edx
cmp ecx, 0x14
jne 0x446605
sub esp, 0x10
mov ecx, esi
call fcn.00452ff0
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
cmp ecx, 0x4e
jne 0x4466af
mov ecx, dword [ebp + 0x14]
mov eax, dword [ecx + 8]
cmp eax, 0xfffffffe
je 0x446622
cmp eax, 0xfffffffc
jne 0x446710
mov eax, dword [ecx]
cmp eax, dword [esi + 0x14c]
jne 0x446710
lea eax, [ecx + 0xc]
push 0x10b8
push eax
lea eax, [esp + 0x10]
push eax
call fcn.00492c90
mov eax, dword [esp + 0x18]
add esp, 0xc
test eax, eax
jne 0x446679
push 1
push eax
push eax
push str.https:__www.malwarebytes.com_eula_
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
cmp eax, 1
jne 0x446710
push eax
push 0
push 0
push str.https:__www.malwarebytes.com_legal_privacy_policy
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
cmp ecx, 0x18
jne 0x446726
push str.Bifurcation
mov ecx, 0x510998
call fcn.004508e0
test edi, edi
je 0x446702
mov eax, dword [0x510ad8]
test eax, eax
jne 0x4466de
push 0x4b1
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 1
push eax
push 0x28
push dword [esi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetLastActivePopup]
mov dword [0x510ad8], eax
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
cmp ecx, 0x111
jne 0x4468a1
mov edi, 0x4b1
cmp di, dx
jne 0x4467a6
cmp byte [esi + 0xc0], 0
mov edi, dword [sym.imp.USER32.dll_InvalidateRect]
je 0x446763
mov eax, dword [esi + 0x80]
mov byte [esi + 0xc0], 0
test eax, eax
je 0x446763
push 1
push 0
push eax
call edi
cmp byte [esi + 0x68], 1
je 0x44677b
mov eax, dword [esi + 0x28]
mov byte [esi + 0x68], 1
test eax, eax
je 0x44677b
push 1
push 0
push eax
call edi
push 1
push dword [esi + 0x114]
call dword [sym.imp.USER32.dll_EnableWindow]
mov eax, dword [ebp + 0x18]
mov byte [0x510949], 0
mov dword [eax], 0
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
cmp ecx, 0x111
jne 0x4468a1
mov edi, 0x4b2
cmp di, dx
jne 0x446826
cmp byte [esi + 0x68], 0
mov edi, dword [sym.imp.USER32.dll_InvalidateRect]
je 0x4467da
mov eax, dword [esi + 0x28]
mov byte [esi + 0x68], 0
test eax, eax
je 0x4467da
push 1
push 0
push eax
call edi
cmp byte [esi + 0xc0], 1
je 0x4467fb
mov eax, dword [esi + 0x80]
mov byte [esi + 0xc0], 1
test eax, eax
je 0x4467fb
push 1
push 0
push eax
call edi
push 1
push dword [esi + 0x114]
call dword [sym.imp.USER32.dll_EnableWindow]
mov eax, dword [ebp + 0x18]
mov byte [0x510949], 1
mov dword [eax], 0
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
cmp ecx, 0x111
jne 0x4468a1
mov ecx, 0x4b3
cmp cx, dx
jne 0x44686a
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetParent]
push 0
push 0x4b3
push 0x111
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
mov ecx, 0x4b4
cmp cx, ax
jne 0x446886
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetParent]
push 0
push 0x4b4
jmp 0x446848
mov ecx, 2
cmp cx, ax
jne 0x4468a1
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetParent]
push 0
push 0
push 0x10
jmp 0x44684d
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x18