Function at 0x448940
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b3008
mov eax, dword fs:[0]
push eax
sub esp, 0x340
mov eax, dword [0x4e506c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x288], ecx
push 0x4eab24
push 0x41af20
push 0x4eab2c
call fcn.0046a8b6
add esp, 0xc
test eax, eax
je 0x4492d3
xor eax, eax
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 7
mov word [ebp - 0x70], ax
lea ecx, [ebp - 0x280]
mov dword [ebp - 4], eax
call fcn.00412e00
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1d0]
mov al, byte [0x4eaa05]
cmp dword [0x4e5d8c], 8
push dword [0x4e5d88]
mov byte [ebp - 0x27b], al
mov eax, 0x4e5d78
cmovae eax, dword [0x4e5d78]
push eax
call fcn.004078c0
mov ecx, dword [0x4e5da0]
test ecx, ecx
je 0x448a12
cmp dword [0x4e5da4], 8
mov eax, 0x4e5d90
push ecx
cmovae eax, dword [0x4e5d90]
lea ecx, [ebp - 0x1b8]
push eax
call fcn.004078c0
cmp dword [0x4e5c9c], 8
lea ecx, [ebp - 0x218]
push dword [0x4e5c98]
mov eax, 0x4e5c88
cmovae eax, dword [0x4e5c88]
push eax
call fcn.004078c0
push 0x4e5d30
lea ecx, [ebp - 0x58]
call fcn.0040be50
mov byte [ebp - 4], 2
lea eax, [ebp - 0x58]
cmp dword [ebp - 0x44], 8
lea ecx, [ebp - 0x260]
push dword [ebp - 0x48]
cmovae eax, dword [ebp - 0x58]
push eax
call fcn.004078c0
mov esi, dword [ebp - 0x44]
lea ecx, [ebp - 0x58]
mov edi, dword [ebp - 0x58]
cmp esi, 8
mov eax, dword [ebp - 0x48]
cmovae ecx, edi
cmp eax, 6
jne 0x448a8e
push eax
mov edx, str.MDAM_B
call fcn.0041a530
add esp, 4
test eax, eax
je 0x448aae
mov eax, dword [ebp - 0x48]
cmp esi, 8
lea ecx, [ebp - 0x58]
cmovae ecx, edi
cmp eax, 6
jne 0x448aba
push eax
mov edx, str.MBRW_B
call fcn.0041a530
add esp, 4
test eax, eax
jne 0x448ab7
push 8
push str.business
jmp 0x448aea
mov eax, dword [ebp - 0x48]
cmp esi, 8
lea ecx, [ebp - 0x58]
cmovae ecx, edi
cmp eax, 8
jne 0x448ae3
push eax
mov edx, str.NCEP_WIN
call fcn.0041a530
add esp, 4
test eax, eax
jne 0x448ae3
push 6
push str.common
jmp 0x448aea
push 8
push 0x4ce8b8
lea ecx, [ebp - 0x70]
call fcn.004078c0
cmp dword [ebp - 0x5c], 8
lea eax, [ebp - 0x70]
push dword [ebp - 0x60]
cmovae eax, dword [ebp - 0x70]
lea ecx, [ebp - 0x248]
push eax
call fcn.004078c0
cmp dword [0x4e5ef4], 8
lea ecx, [ebp - 0x230]
push dword [0x4e5ef0]
mov eax, 0x4e5ee0
cmovae eax, dword [0x4e5ee0]
push eax
call fcn.004078c0
cmp dword [0x4e5d44], 8
mov eax, 0x4e5d30
push str.MBRW_C
cmovae eax, dword [0x4e5d30]
push eax
call fcn.0048c547
add esp, 8
test eax, eax
je 0x448b7b
cmp dword [0x4e5d44], 8
mov eax, 0x4e5d30
push str.MBRW_B
cmovae eax, dword [0x4e5d30]
push eax
call fcn.0048c547
add esp, 8
test eax, eax
jne 0x448bf8
push str.MalwarebytesMB3Service
mov edx, 0x4e5ee0
lea ecx, [ebp - 0x88]
call fcn.0043b7c0
add esp, 4
mov byte [ebp - 4], 3
lea eax, [ebp - 0x88]
cmp dword [ebp - 0x74], 8
lea ecx, [ebp - 0x200]
push dword [ebp - 0x78]
cmovae eax, dword [ebp - 0x88]
push eax
call fcn.004078c0
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x74]
cmp edx, 8
jb 0x448bf8
mov ecx, dword [ebp - 0x88]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x448bee
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4492d8
push edx
push ecx
call fcn.0046e3a3
add esp, 8
cmp dword [0x4e5d74], 8
lea ecx, [ebp - 0x1e8]
push dword [0x4e5d70]
mov eax, 0x4e5d60
cmovae eax, dword [0x4e5d60]
push eax
call fcn.004078c0
cmp dword [0x4e5e04], 8
lea ecx, [ebp - 0x158]
push dword [0x4e5e00]
mov eax, 0x4e5df0
cmovae eax, dword [0x4e5df0]
push eax
call fcn.004078c0
mov al, byte [0x4ea9fc]
mov byte [ebp - 0x128], al
xor eax, eax
mov byte [ebp - 0x125], 1
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
mov byte [ebp - 4], 5
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
cmp byte [0x4ea9f6], al
je 0x448d1d
mov edi, dword [0x4e5e7c]
mov ecx, 0x4e5e68
mov esi, dword [0x4e5e78]
cmp edi, 8
cmovae ecx, dword [0x4e5e68]
cmp esi, 2
jne 0x448cf9
push esi
mov edx, 0x4cef8c
call fcn.0041a530
add esp, 4
test eax, eax
jne 0x448cf9
push 0x4e5c88
lea ecx, [ebp - 0x2ec]
call fcn.0040be50
lea ecx, [ebp - 0x28]
call fcn.00404c50
movups xmm0, xmmword [ebp - 0x2ec]
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
movups xmmword [ebp - 0x28], xmm0
movq xmm0, qword [ebp - 0x2dc]
movq qword [ebp - 0x18], xmm0
jmp 0x448fd9
cmp edi, 8
lea ecx, [ebp - 0x28]
mov eax, 0x4e5e68
cmovae eax, dword [0x4e5e68]
push esi
push eax
call fcn.004078c0
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x448fd9
mov esi, dword [ebp - 0x288]
lea ecx, [ebp - 0x2d4]
mov byte [ebp - 0x28c], 0
add esi, 0x18
push dword [ebp - 0x28c]
mov edx, esi
call fcn.00419c80
add esp, 4
lea ecx, [ebp - 0x2d4]
mov byte [ebp - 4], 6
call fcn.0044b8a0
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x2c0]
mov byte [ebp - 0x281], al
cmp edx, 8
jb 0x448da2
mov ecx, dword [ebp - 0x2d4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x448d92
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4492dd
push edx
push ecx
call fcn.0046e3a3
mov al, byte [ebp - 0x281]
add esp, 8
test al, al
je 0x448f5a
push 0x4e5c88
lea ecx, [ebp - 0x304]
mov byte [0x4ea9f6], 1
call fcn.0040be50
lea ecx, [ebp - 0x28]
call fcn.00404c50
movups xmm0, xmmword [ebp - 0x304]
push str.Rename_local_ISvc_and_download_latest
mov edx, 0x7d7
mov ecx, str.c:jenkinsworkspacembam_windows_a_mb4_mbsetup_srcmbsetupmbutils.cpp
movups xmmword [ebp - 0x28], xmm0
movq xmm0, qword [ebp - 0x2f4]
movq qword [ebp - 0x18], xmm0
call fcn.004412b0
add esp, 4
lea ecx, [ebp - 0x31c]
push 0x4e5c88
call fcn.0040be50
lea ecx, [ebp - 0x40]
call fcn.00404c50
movups xmm0, xmmword [ebp - 0x31c]
push 0x1d
push str.MBAMInstallerService_old.exe
movups xmmword [ebp - 0x40], xmm0
lea ecx, [ebp - 0x40]
movq xmm0, qword [ebp - 0x30c]
movq qword [ebp - 0x30], xmm0
call fcn.0040c200
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
cmp dword [esi + 0x14], 8
jb 0x448e4a
mov esi, dword [esi]
push 1
push eax
push esi
call edi
test eax, eax
jne 0x448fd9
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
mov edx, eax
lea ecx, [ebp - 0x2a4]
call fcn.0044b790
push eax
mov edx, str.Error_calling_MoveFileEx:
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xa0]
call fcn.00419c10
add esp, 4
mov byte [ebp - 4], 0xa
mov edx, dword [ebp - 0x290]
cmp edx, 8
jb 0x448ec9
mov ecx, dword [ebp - 0x2a4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x448ebf
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4492e2
push edx
push ecx
call fcn.0046e3a3
add esp, 8
xor eax, eax
mov dword [ebp - 0x294], 0
cmp dword [ebp - 0x8c], 8
mov edx, 0x7df
mov word [ebp - 0x2a4], ax
mov ecx, str.c:jenkinsworkspacembam_windows_a_mb4_mbsetup_srcmbsetupmbutils.cpp
lea eax, [ebp - 0xa0]
mov dword [ebp - 0x290], 7
cmovae eax, dword [ebp - 0xa0]
push eax
call fcn.004412b0
mov byte [ebp - 4], 5
add esp, 4
mov edx, dword [ebp - 0x8c]
cmp edx, 8
jb 0x448fdf
mov ecx, dword [ebp - 0xa0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x448f4b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4492e7
push edx
push ecx
call fcn.0046e3a3
add esp, 8
jmp 0x448fdf
lea ecx, [ebp - 0x34c]
call fcn.0043fea0
push eax
lea ecx, [ebp - 0x334]
mov byte [ebp - 4], 7
call fcn.0040be50
lea ecx, [ebp - 0x28]
call fcn.00404c50
movups xmm0, xmmword [ebp - 0x334]
movups xmmword [ebp - 0x28], xmm0
movq xmm0, qword [ebp - 0x324]
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x338]
movq qword [ebp - 0x18], xmm0
cmp edx, 8
jb 0x448fd9
mov ecx, dword [ebp - 0x34c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x448fcf
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4492ec
push edx
push ecx
call fcn.0046e3a3
add esp, 8
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
sub esp, 0x1c
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x280]
push eax
call fcn.00413680
mov ecx, 0x4eaa58
xchg dword [ecx], eax
mov eax, dword [0x4eaa58]
cmp eax, 9
jne 0x44915a
push str.Download_of_ISvc_failed._Using_local_ISvc
mov edx, 0x7e7
mov ecx, str.c:jenkinsworkspacembam_windows_a_mb4_mbsetup_srcmbsetupmbutils.cpp
call fcn.004412b0
mov ecx, dword [ebp - 0x288]
add esp, 4
add ecx, 0x18
mov byte [0x4ea9f6], 1
cmp dword [ecx + 0x14], 8
jb 0x449035
mov ecx, dword [ecx]
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
push 1
cmovae eax, dword [ebp - 0x40]
push ecx
push eax
call edi
test eax, eax
jne 0x449141
call esi
mov edx, eax
lea ecx, [ebp - 0x2bc]
call fcn.0044b790
push eax
mov edx, str.Error_calling_MoveFileEx:
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0xb8]
call fcn.00419c10
add esp, 4
mov byte [ebp - 4], 0xd
mov edx, dword [ebp - 0x2a8]
cmp edx, 8
jb 0x4490b9
mov ecx, dword [ebp - 0x2bc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4490af
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4492f1
push edx
push ecx
call fcn.0046e3a3
add esp, 8
xor eax, eax
mov dword [ebp - 0x2ac], 0
cmp dword [ebp - 0xa4], 8
mov edx, 0x7ee
mov word [ebp - 0x2bc], ax
mov ecx, str.c:jenkinsworkspacembam_windows_a_mb4_mbsetup_srcmbsetupmbutils.cpp
lea eax, [ebp - 0xb8]
mov dword [ebp - 0x2a8], 7
cmovae eax, dword [ebp - 0xb8]
push eax
call fcn.004412b0
mov byte [ebp - 4], 5
add esp, 4
mov edx, dword [ebp - 0xa4]
cmp edx, 8
jb 0x449141
mov ecx, dword [ebp - 0xb8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x449137
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4492f6
push edx
push ecx
call fcn.0046e3a3
add esp, 8
sub esp, 0x1c
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x280]
push eax
call fcn.00413680
mov ecx, 0x4eaa58
xchg dword [ecx], eax
mov eax, dword [0x4eaa58]
test eax, eax
jne 0x449198
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
nop dword [eax + eax]
push 0x64
call edi
call fcn.004183f0
mov ecx, esi
inc esi
cmp ecx, 0x12c
jge 0x449188
test al, al
je 0x449170
push 0x3e8
call edi
call fcn.004183f0
test al, al
jne 0x449188
mov ecx, 0x4eaa55
mov al, 1
xchg byte [ecx], al
mov edx, dword [ebp - 0x2c]
cmp edx, 8
jb 0x4491db
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4491d1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4492fb
push edx
push ecx
call fcn.0046e3a3
add esp, 8
mov edx, dword [ebp - 0x14]
xor eax, eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
cmp edx, 8
jb 0x449229
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x44921f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x449300
push edx
push ecx
call fcn.0046e3a3
add esp, 8
mov edx, dword [ebp - 0x44]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp edx, 8
jb 0x449277
mov ecx, dword [ebp - 0x58]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x44926d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x449305
push edx
push ecx
call fcn.0046e3a3
add esp, 8
lea ecx, [ebp - 0x280]
call fcn.00413030
mov edx, dword [ebp - 0x5c]
cmp edx, 8
jb 0x4492b8
mov ecx, dword [ebp - 0x70]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4492ae
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44930a
push edx
push ecx
call fcn.0046e3a3
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046de82
mov esp, ebp
pop ebp
ret
call fcn.0048cc70
call fcn.004892fc
call fcn.004892fc
call fcn.004892fc
call fcn.004892fc
call fcn.004892fc
call fcn.004892fc
call fcn.004892fc
call fcn.004892fc
call fcn.004892fc
call fcn.004892fc
call fcn.004892fc
int3