Function at 0x446400
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b369a
mov eax, dword fs:[0]
push eax
sub esp, 0x2d0
mov eax, dword [0x4e706c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 7
mov word [ebp - 0x64], ax
lea ecx, [ebp - 0x274]
mov dword [ebp - 4], eax
call fcn.00412080
xor eax, eax
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x68], 7
mov word [ebp - 0x7c], ax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x34]
mov al, byte [0x4ec9ff]
push 0x4e7d30
mov byte [ebp - 0x26f], al
call fcn.0040beb0
mov byte [ebp - 4], 3
lea eax, [ebp - 0x34]
cmp dword [ebp - 0x20], 8
lea ecx, [ebp - 0x254]
push dword [ebp - 0x24]
cmovae eax, dword [ebp - 0x34]
push eax
call fcn.00407920
mov edi, dword [ebp - 0x20]
lea ecx, [ebp - 0x34]
mov eax, dword [ebp - 0x34]
cmp edi, 8
cmovae ecx, eax
cmp dword [ebp - 0x24], 6
jne 0x4464ca
push 6
mov edx, str.MDAM_B
call fcn.00419770
add esp, 4
test eax, eax
je 0x4464ec
mov eax, dword [ebp - 0x34]
cmp edi, 8
lea ecx, [ebp - 0x34]
cmovae ecx, eax
cmp dword [ebp - 0x24], 6
jne 0x4464f8
push 6
mov edx, str.MBRW_B
call fcn.00419770
add esp, 4
test eax, eax
jne 0x4464f5
push 8
push str.business
jmp 0x44652a
mov eax, dword [ebp - 0x34]
cmp edi, 8
lea ecx, [ebp - 0x34]
cmovae ecx, eax
cmp dword [ebp - 0x24], 8
jne 0x446523
push 8
mov edx, str.NCEP_WIN
call fcn.00419770
add esp, 4
test eax, eax
jne 0x446523
push 6
push str.common
jmp 0x44652a
push 8
push 0x4cfb58
lea ecx, [ebp - 0x64]
call fcn.00407920
lea eax, [ebp - 0x224]
cmp eax, esi
je 0x446555
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x446546
mov eax, dword [esi]
push dword [esi + 0x10]
lea ecx, [ebp - 0x224]
push eax
call fcn.00407920
cmp dword [ebp - 0x50], 8
lea eax, [ebp - 0x64]
push dword [ebp - 0x54]
cmovae eax, dword [ebp - 0x64]
lea ecx, [ebp - 0x23c]
push eax
call fcn.00407920
cmp dword [0x4e7c9c], 8
lea ecx, [ebp - 0x20c]
push dword [0x4e7c98]
mov eax, 0x4e7c88
cmovae eax, dword [0x4e7c88]
push eax
call fcn.00407920
cmp dword [0x4e7d44], 8
mov eax, 0x4e7d30
push str.MBRW_C
cmovae eax, dword [0x4e7d30]
push eax
call fcn.0048cdc7
add esp, 8
test eax, eax
je 0x4465de
cmp dword [0x4e7d44], 8
mov eax, 0x4e7d30
push str.MBRW_B
cmovae eax, dword [0x4e7d30]
push eax
call fcn.0048cdc7
add esp, 8
test eax, eax
jne 0x44665b
push str.MalwarebytesMB3Service
mov edx, esi
lea ecx, [ebp - 0x94]
call fcn.0043b8e0
add esp, 4
mov byte [ebp - 4], 4
lea eax, [ebp - 0x94]
cmp dword [ebp - 0x80], 8
lea ecx, [ebp - 0x1f4]
push dword [ebp - 0x84]
cmovae eax, dword [ebp - 0x94]
push eax
call fcn.00407920
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x80]
cmp edx, 8
jb 0x44665b
mov ecx, dword [ebp - 0x94]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x446651
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x446fe7
push edx
push ecx
call fcn.0046ec30
add esp, 8
cmp byte [0x4ec9ed], 0
je 0x446687
lea eax, [ebp - 0x1f4]
cmp eax, esi
je 0x446687
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x446678
mov eax, dword [esi]
push dword [esi + 0x10]
lea ecx, [ebp - 0x1f4]
push eax
call fcn.00407920
cmp dword [0x4e7d74], 8
lea ecx, [ebp - 0x1dc]
push dword [0x4e7d70]
mov eax, 0x4e7d60
cmovae eax, dword [0x4e7d60]
push eax
call fcn.00407920
cmp dword [0x4e7d8c], 8
lea ecx, [ebp - 0x1c4]
push dword [0x4e7d88]
mov eax, 0x4e7d78
cmovae eax, dword [0x4e7d78]
push eax
call fcn.00407920
mov ecx, dword [0x4e7da0]
test ecx, ecx
je 0x4466fb
cmp dword [0x4e7da4], 8
mov eax, 0x4e7d90
push ecx
cmovae eax, dword [0x4e7d90]
lea ecx, [ebp - 0x1ac]
push eax
call fcn.00407920
mov ecx, dword [0x4e7db8]
test ecx, ecx
je 0x446725
cmp dword [0x4e7dbc], 8
mov eax, 0x4e7da8
push ecx
cmovae eax, dword [0x4e7da8]
lea ecx, [ebp - 0x194]
push eax
call fcn.00407920
mov ecx, dword [0x4e7dd0]
test ecx, ecx
je 0x44674f
cmp dword [0x4e7dd4], 8
mov eax, 0x4e7dc0
push ecx
cmovae eax, dword [0x4e7dc0]
lea ecx, [ebp - 0x17c]
push eax
call fcn.00407920
mov ecx, dword [0x4e7de8]
test ecx, ecx
je 0x446779
cmp dword [0x4e7dec], 8
mov eax, 0x4e7dd8
push ecx
cmovae eax, dword [0x4e7dd8]
lea ecx, [ebp - 0x164]
push eax
call fcn.00407920
cmp dword [0x4e7e04], 8
lea ecx, [ebp - 0x14c]
push dword [0x4e7e00]
mov eax, 0x4e7df0
cmovae eax, dword [0x4e7df0]
push eax
call fcn.00407920
mov al, byte [0x4ec9f6]
mov byte [ebp - 0x11c], al
mov al, byte [0x4e7ac4]
mov byte [ebp - 0x11a], al
mov al, byte [0x4eca53]
mov byte [ebp - 0x11b], 1
push dword [0x4e7e60]
test al, al
lea ecx, [ebp - 0x110]
mov al, byte [0x4ec9f8]
mov byte [ebp - 0x117], al
setne byte [ebp - 0x118]
mov al, byte [0x4ec9f9]
cmp dword [0x4e7e64], 8
mov byte [ebp - 0x275], al
mov eax, 0x4e7e50
cmovae eax, dword [0x4e7e50]
push eax
call fcn.00407920
mov al, byte [ebp - 0x275]
cmp dword [0x4e7e34], 8
mov byte [ebp - 0x113], al
mov eax, 0x4e7e20
cmovae eax, dword [0x4e7e20]
push eax
call fcn.00490af3
add esp, 4
cmp eax, 0x3e7
jle 0x44687d
cmp dword [0x4e7e34], 8
lea ecx, [ebp - 0xe0]
push dword [0x4e7e30]
mov eax, 0x4e7e20
cmovae eax, dword [0x4e7e20]
push eax
call fcn.00407920
cmp dword [0x4e7e1c], 8
lea ecx, [ebp - 0xf8]
push dword [0x4e7e18]
mov eax, 0x4e7e08
cmovae eax, dword [0x4e7e08]
push eax
call fcn.00407920
cmp dword [0x4e7e4c], 8
lea ecx, [ebp - 0xc8]
push dword [0x4e7e48]
mov eax, 0x4e7e38
cmovae eax, dword [0x4e7e38]
push eax
call fcn.00407920
mov al, byte [0x4ec9f7]
lea ecx, [ebp - 0x7c]
mov byte [ebp - 0x116], al
call fcn.0042e400
lea eax, [ebp - 0x2ac]
push eax
lea ecx, [ebp - 0x7c]
call fcn.0043e9b0
push eax
lea ecx, [ebp - 0x294]
mov byte [ebp - 4], 5
call fcn.0040beb0
mov byte [ebp - 4], 6
lea eax, [ebp - 0x294]
cmp dword [ebp - 0x280], 8
lea ecx, [ebp - 0x26c]
push dword [ebp - 0x284]
cmovae eax, dword [ebp - 0x294]
push eax
call fcn.00407920
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x280]
cmp edx, 8
jb 0x446942
mov ecx, dword [ebp - 0x294]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x446938
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x446fec
push edx
push ecx
call fcn.0046ec30
add esp, 8
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x298]
cmp edx, 8
jb 0x446986
mov ecx, dword [ebp - 0x2ac]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x44697c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x446ff1
push edx
push ecx
call fcn.0046ec30
add esp, 8
mov al, byte [0x4eca02]
lea ecx, [ebp - 0x134]
mov byte [ebp - 0xb0], al
mov al, byte [0x4ec9fe]
mov byte [ebp - 0xaf], al
mov al, byte [0x4ec9fd]
mov byte [ebp - 0x115], al
mov al, byte [0x4ec9fc]
mov byte [ebp - 0x114], al
mov al, byte [0x4ec9fb]
mov byte [ebp - 0xae], al
mov al, byte [0x4ec9ed]
mov byte [ebp - 0xad], al
mov al, byte [0x4ec9ee]
mov byte [ebp - 0x112], al
lea eax, [esi + 0x1c]
cmp ecx, eax
je 0x4469f8
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x4469eb
mov eax, dword [eax]
push ecx
push eax
lea ecx, [ebp - 0x134]
call fcn.00407920
push 0x4e7c88
lea ecx, [ebp - 0x4c]
call fcn.0040beb0
mov byte [ebp - 4], 7
cmp byte [esi + 0x18], 0
je 0x446a8e
lea ecx, [ebp - 0x2c4]
call fcn.00447560
mov esi, eax
lea eax, [ebp - 0x4c]
cmp eax, esi
je 0x446a4e
mov ecx, eax
call fcn.00404cc0
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [ebp - 0x4c], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0x3c], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov edx, dword [ebp - 0x2b0]
cmp edx, 8
jb 0x446a8e
mov ecx, dword [ebp - 0x2c4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x446a84
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x446ff6
push edx
push ecx
call fcn.0046ec30
add esp, 8
cmp byte [0x4ec9f0], 0
je 0x446ab9
cmp dword [0x4e7e7c], 8
lea ecx, [ebp - 0x4c]
push dword [0x4e7e78]
mov eax, 0x4e7e68
cmovae eax, dword [0x4e7e68]
push eax
call fcn.00407920
sub esp, 0x1c
lea eax, [ebp - 0x4c]
lea ecx, [ebp - 0x274]
push eax
call fcn.00412900
mov ecx, 0x4eca54
xchg dword [ecx], eax
mov eax, dword [0x4eca54]
test eax, eax
je 0x446b5a
mov esi, dword [0x4eca54]
mov byte [ebp - 4], 8
call fcn.00403a40
mov ecx, eax
test ecx, ecx
je 0x446ffb
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x1c], eax
push esi
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 9
push str.Failed_to_install_Installer_Service__error:__d
push eax
call fcn.0040f680
mov esi, dword [ebp - 0x1c]
mov edx, 0x60a
push esi
mov ecx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbutils.cpp
call fcn.004413d0
add esp, 0x10
mov al, 1
mov ecx, 0x4eca51
xchg byte [ecx], al
add esi, 0xfffffff0
mov byte [ebp - 4], 0xa
mov eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x446eb5
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x446eb5
push str.Waiting_for_InstallerService_to_start...
mov edx, 0x60f
mov ecx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbutils.cpp
call fcn.004413d0
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 4
xor esi, esi
nop dword [eax]
push 0x3e8
call edi
call fcn.004175e0
mov ecx, esi
inc esi
cmp ecx, 0x1e
jge 0x446b98
test al, al
je 0x446b80
push str.Waiting_for_InstallerService_to_stop...
mov edx, 0x618
mov ecx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbutils.cpp
call fcn.004413d0
add esp, 4
nop
push 0x3e8
call edi
call fcn.004175e0
test al, al
jne 0x446bb0
push str.InstallerService_has_stopped
mov edx, 0x61f
mov ecx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbutils.cpp
call fcn.004413d0
add esp, 4
call fcn.00417cc0
mov esi, eax
or edi, 0xffffffff
mov dword [ebp - 0x18], esi
cmp esi, edi
je 0x446d09
call fcn.00417cc0
mov dword [0x4ec9e0], eax
lea eax, [ebp - 0x2dc]
push eax
call fcn.00417f90
mov edx, eax
mov byte [ebp - 4], 0xb
cmp dword [edx + 0x14], 0x10
jb 0x446c10
mov edx, dword [edx]
test edx, edx
jne 0x446c18
xor ecx, ecx
jmp 0x446c29
mov ecx, edx
lea esi, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x446c20
sub ecx, esi
push ecx
push edx
mov ecx, 0x4eca78
call fcn.004032a0
mov byte [ebp - 4], 7
mov edx, dword [ebp - 0x2c8]
cmp edx, 0x10
jb 0x446c73
mov ecx, dword [ebp - 0x2dc]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x446c69
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x447005
push edx
push ecx
call fcn.0046ec30
add esp, 8
mov byte [ebp - 4], 0xc
call fcn.00403a40
mov ecx, eax
test ecx, ecx
je 0x44700a
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 0xd
lea eax, [ebp - 0x14]
push dword [0x4ec9e0]
push str._InstallerService_error_status___u
push eax
call fcn.0040f680
push dword [ebp - 0x14]
mov edx, 0x62a
mov ecx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbutils.cpp
call fcn.004413d0
push dword [0x4eca78]
lea eax, [ebp - 0x14]
push str._InstallerService_error_detail____hs_
push eax
call fcn.0040f680
mov esi, dword [ebp - 0x14]
mov edx, 0x62c
push esi
mov ecx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbutils.cpp
call fcn.004413d0
add esp, 0x20
add esi, 0xfffffff0
mov byte [ebp - 4], 0xe
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x446d02
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 7
mov esi, dword [ebp - 0x18]
call fcn.004179f0
test al, al
je 0x446d3c
cmp esi, 0x5a
jne 0x446d3c
push str.setting_rebootRequired_to_true
mov edx, 0x631
mov ecx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbutils.cpp
call fcn.004413d0
add esp, 4
mov al, 1
mov ecx, 0x4eca52
xchg byte [ecx], al
jmp 0x446e95
cmp dword [0x4ec9e0], 0
jbe 0x446e95
mov byte [ebp - 4], 0xf
call fcn.00403a40
mov ecx, eax
test ecx, ecx
je 0x447014
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x27c]
mov edx, dword [0x4ec9e0]
call fcn.00449770
mov byte [ebp - 4], 0x11
push dword [eax]
lea eax, [ebp - 0x18]
push dword [0x4ec9e0]
push str.Installer_Service_error_status__d___hs_
push eax
call fcn.0040f680
mov edx, dword [ebp - 0x27c]
add esp, 0x10
add edx, 0xfffffff0
mov byte [ebp - 4], 0x12
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x446dbc
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x10
mov edx, 0x639
mov esi, dword [ebp - 0x18]
mov ecx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbutils.cpp
push esi
call fcn.004413d0
add esp, 4
mov al, 1
mov ecx, 0x4eca58
xchg byte [ecx], al
cmp dword [0x4ec9e0], 0x4d
jne 0x446e73
mov al, 1
mov ecx, 0x4eca50
xchg byte [ecx], al
cmp byte [0x4ec9ed], 0
je 0x446e73
push str.https:__www.malwarebytes.com_jobs
lea ecx, [ebp - 0xac]
call fcn.00404c70
cmp dword [ebp - 0x98], 8
lea eax, [ebp - 0xac]
push 5
cmovae eax, dword [ebp - 0xac]
push 0
push 0
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edx, dword [ebp - 0x98]
cmp edx, 8
jb 0x446e73
mov ecx, dword [ebp - 0xac]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x446e69
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44701e
push edx
push ecx
call fcn.0046ec30
add esp, 8
call fcn.004182f0
add esi, 0xfffffff0
mov byte [ebp - 4], 0x13
lock xadd dword [esi + 0xc], edi
dec edi
test edi, edi
jg 0x446e91
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 7
mov al, 1
mov edx, 0x4eca51
xchg byte [edx], al
push str.Installer_service_has_completed
mov edx, 0x64c
mov ecx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbutils.cpp
call fcn.004413d0
add esp, 4
mov edx, dword [ebp - 0x38]
cmp edx, 8
jb 0x446eef
mov ecx, dword [ebp - 0x4c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x446ee5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x447023
push edx
push ecx
call fcn.0046ec30
add esp, 8
mov edx, dword [ebp - 0x20]
xor eax, eax
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 7
mov word [ebp - 0x4c], ax
cmp edx, 8
jb 0x446f3d
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x446f33
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x447028
push edx
push ecx
call fcn.0046ec30
add esp, 8
mov edx, dword [ebp - 0x68]
cmp edx, 8
jb 0x446f77
mov ecx, dword [ebp - 0x7c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x446f6d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44702d
push edx
push ecx
call fcn.0046ec30
add esp, 8
xor eax, eax
mov dword [ebp - 0x6c], 0
lea ecx, [ebp - 0x274]
mov dword [ebp - 0x68], 7
mov word [ebp - 0x7c], ax
call fcn.004122b0
mov edx, dword [ebp - 0x50]
cmp edx, 8
jb 0x446fcc
mov ecx, dword [ebp - 0x64]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x446fc2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x447032
push edx
push ecx
call fcn.0046ec30
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046e70f
mov esp, ebp
pop ebp
ret
call fcn.00489b7c
call fcn.00489b7c
call fcn.00489b7c
call fcn.00489b7c
push 0x80004005
call fcn.00403bb0
call fcn.00489b7c
push 0x80004005
call fcn.00403bb0
push 0x80004005
call fcn.00403bb0
call fcn.00489b7c
call fcn.00489b7c
call fcn.00489b7c
call fcn.00489b7c
call fcn.00489b7c
int3