Function at 0x448950
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b2738
mov eax, dword fs:[0]
push eax
sub esp, 0x340
mov eax, dword [0x4e506c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x288], ecx
push 0x4eab24
push 0x41a0d0
push 0x4eab2c
call fcn.00469f84
add esp, 0xc
test eax, eax
je 0x4492e3
xor eax, eax
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 7
mov word [ebp - 0x70], ax
lea ecx, [ebp - 0x280]
mov dword [ebp - 4], eax
call fcn.00412080
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1d0]
mov al, byte [0x4ea9ff]
cmp dword [0x4e5d8c], 8
push dword [0x4e5d88]
mov byte [ebp - 0x27b], al
mov eax, 0x4e5d78
cmovae eax, dword [0x4e5d78]
push eax
call fcn.00407920
mov ecx, dword [0x4e5da0]
test ecx, ecx
je 0x448a22
cmp dword [0x4e5da4], 8
mov eax, 0x4e5d90
push ecx
cmovae eax, dword [0x4e5d90]
lea ecx, [ebp - 0x1b8]
push eax
call fcn.00407920
cmp dword [0x4e5c9c], 8
lea ecx, [ebp - 0x218]
push dword [0x4e5c98]
mov eax, 0x4e5c88
cmovae eax, dword [0x4e5c88]
push eax
call fcn.00407920
push 0x4e5d30
lea ecx, [ebp - 0x58]
call fcn.0040beb0
mov byte [ebp - 4], 2
lea eax, [ebp - 0x58]
cmp dword [ebp - 0x44], 8
lea ecx, [ebp - 0x260]
push dword [ebp - 0x48]
cmovae eax, dword [ebp - 0x58]
push eax
call fcn.00407920
mov esi, dword [ebp - 0x44]
lea ecx, [ebp - 0x58]
mov edi, dword [ebp - 0x58]
cmp esi, 8
mov eax, dword [ebp - 0x48]
cmovae ecx, edi
cmp eax, 6
jne 0x448a9e
push eax
mov edx, str.MDAM_B
call fcn.004196e0
add esp, 4
test eax, eax
je 0x448abe
mov eax, dword [ebp - 0x48]
cmp esi, 8
lea ecx, [ebp - 0x58]
cmovae ecx, edi
cmp eax, 6
jne 0x448aca
push eax
mov edx, str.MBRW_B
call fcn.004196e0
add esp, 4
test eax, eax
jne 0x448ac7
push 8
push str.business
jmp 0x448afa
mov eax, dword [ebp - 0x48]
cmp esi, 8
lea ecx, [ebp - 0x58]
cmovae ecx, edi
cmp eax, 8
jne 0x448af3
push eax
mov edx, str.NCEP_WIN
call fcn.004196e0
add esp, 4
test eax, eax
jne 0x448af3
push 6
push str.common
jmp 0x448afa
push 8
push 0x4cead8
lea ecx, [ebp - 0x70]
call fcn.00407920
cmp dword [ebp - 0x5c], 8
lea eax, [ebp - 0x70]
push dword [ebp - 0x60]
cmovae eax, dword [ebp - 0x70]
lea ecx, [ebp - 0x248]
push eax
call fcn.00407920
cmp dword [0x4e5ef4], 8
lea ecx, [ebp - 0x230]
push dword [0x4e5ef0]
mov eax, 0x4e5ee0
cmovae eax, dword [0x4e5ee0]
push eax
call fcn.00407920
cmp dword [0x4e5d44], 8
mov eax, 0x4e5d30
push str.MBRW_C
cmovae eax, dword [0x4e5d30]
push eax
call fcn.0048bc09
add esp, 8
test eax, eax
je 0x448b8b
cmp dword [0x4e5d44], 8
mov eax, 0x4e5d30
push str.MBRW_B
cmovae eax, dword [0x4e5d30]
push eax
call fcn.0048bc09
add esp, 8
test eax, eax
jne 0x448c08
push str.MalwarebytesMB3Service
mov edx, 0x4e5ee0
lea ecx, [ebp - 0x88]
call fcn.0043b820
add esp, 4
mov byte [ebp - 4], 3
lea eax, [ebp - 0x88]
cmp dword [ebp - 0x74], 8
lea ecx, [ebp - 0x200]
push dword [ebp - 0x78]
cmovae eax, dword [ebp - 0x88]
push eax
call fcn.00407920
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x74]
cmp edx, 8
jb 0x448c08
mov ecx, dword [ebp - 0x88]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x448bfe
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4492e8
push edx
push ecx
call fcn.0046da67
add esp, 8
cmp dword [0x4e5d74], 8
lea ecx, [ebp - 0x1e8]
push dword [0x4e5d70]
mov eax, 0x4e5d60
cmovae eax, dword [0x4e5d60]
push eax
call fcn.00407920
cmp dword [0x4e5e04], 8
lea ecx, [ebp - 0x158]
push dword [0x4e5e00]
mov eax, 0x4e5df0
cmovae eax, dword [0x4e5df0]
push eax
call fcn.00407920
mov al, byte [0x4ea9f6]
mov byte [ebp - 0x128], al
xor eax, eax
mov byte [ebp - 0x125], 1
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
mov byte [ebp - 4], 5
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
cmp byte [0x4ea9f0], al
je 0x448d2d
mov edi, dword [0x4e5e7c]
mov ecx, 0x4e5e68
mov esi, dword [0x4e5e78]
cmp edi, 8
cmovae ecx, dword [0x4e5e68]
cmp esi, 2
jne 0x448d09
push esi
mov edx, 0x4cf16c
call fcn.004196e0
add esp, 4
test eax, eax
jne 0x448d09
push 0x4e5c88
lea ecx, [ebp - 0x2ec]
call fcn.0040beb0
lea ecx, [ebp - 0x28]
call fcn.00404cc0
movups xmm0, xmmword [ebp - 0x2ec]
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
movups xmmword [ebp - 0x28], xmm0
movq xmm0, qword [ebp - 0x2dc]
movq qword [ebp - 0x18], xmm0
jmp 0x448fe9
cmp edi, 8
lea ecx, [ebp - 0x28]
mov eax, 0x4e5e68
cmovae eax, dword [0x4e5e68]
push esi
push eax
call fcn.00407920
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x448fe9
mov esi, dword [ebp - 0x288]
lea ecx, [ebp - 0x2d4]
mov byte [ebp - 0x28c], 0
add esi, 0x18
push dword [ebp - 0x28c]
mov edx, esi
call fcn.00418e30
add esp, 4
lea ecx, [ebp - 0x2d4]
mov byte [ebp - 4], 6
call fcn.0044b8b0
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x2c0]
mov byte [ebp - 0x281], al
cmp edx, 8
jb 0x448db2
mov ecx, dword [ebp - 0x2d4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x448da2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4492ed
push edx
push ecx
call fcn.0046da67
mov al, byte [ebp - 0x281]
add esp, 8
test al, al
je 0x448f6a
push 0x4e5c88
lea ecx, [ebp - 0x304]
mov byte [0x4ea9f0], 1
call fcn.0040beb0
lea ecx, [ebp - 0x28]
call fcn.00404cc0
movups xmm0, xmmword [ebp - 0x304]
push str.Rename_local_ISvc_and_download_latest
mov edx, 0x7d7
mov ecx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbutils.cpp
movups xmmword [ebp - 0x28], xmm0
movq xmm0, qword [ebp - 0x2f4]
movq qword [ebp - 0x18], xmm0
call fcn.00441310
add esp, 4
lea ecx, [ebp - 0x31c]
push 0x4e5c88
call fcn.0040beb0
lea ecx, [ebp - 0x40]
call fcn.00404cc0
movups xmm0, xmmword [ebp - 0x31c]
push 0x1d
push str.MBAMInstallerService_old.exe
movups xmmword [ebp - 0x40], xmm0
lea ecx, [ebp - 0x40]
movq xmm0, qword [ebp - 0x30c]
movq qword [ebp - 0x30], xmm0
call fcn.0040c260
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
cmp dword [esi + 0x14], 8
jb 0x448e5a
mov esi, dword [esi]
push 1
push eax
push esi
call edi
test eax, eax
jne 0x448fe9
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
mov edx, eax
lea ecx, [ebp - 0x2a4]
call fcn.0044b7a0
push eax
mov edx, str.Error_calling_MoveFileEx:
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xa0]
call fcn.00418dc0
add esp, 4
mov byte [ebp - 4], 0xa
mov edx, dword [ebp - 0x290]
cmp edx, 8
jb 0x448ed9
mov ecx, dword [ebp - 0x2a4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x448ecf
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4492f2
push edx
push ecx
call fcn.0046da67
add esp, 8
xor eax, eax
mov dword [ebp - 0x294], 0
cmp dword [ebp - 0x8c], 8
mov edx, 0x7df
mov word [ebp - 0x2a4], ax
mov ecx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbutils.cpp
lea eax, [ebp - 0xa0]
mov dword [ebp - 0x290], 7
cmovae eax, dword [ebp - 0xa0]
push eax
call fcn.00441310
mov byte [ebp - 4], 5
add esp, 4
mov edx, dword [ebp - 0x8c]
cmp edx, 8
jb 0x448fef
mov ecx, dword [ebp - 0xa0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x448f5b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4492f7
push edx
push ecx
call fcn.0046da67
add esp, 8
jmp 0x448fef
lea ecx, [ebp - 0x34c]
call fcn.0043ff00
push eax
lea ecx, [ebp - 0x334]
mov byte [ebp - 4], 7
call fcn.0040beb0
lea ecx, [ebp - 0x28]
call fcn.00404cc0
movups xmm0, xmmword [ebp - 0x334]
movups xmmword [ebp - 0x28], xmm0
movq xmm0, qword [ebp - 0x324]
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x338]
movq qword [ebp - 0x18], xmm0
cmp edx, 8
jb 0x448fe9
mov ecx, dword [ebp - 0x34c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x448fdf
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4492fc
push edx
push ecx
call fcn.0046da67
add esp, 8
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
sub esp, 0x1c
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x280]
push eax
call fcn.00412900
mov ecx, 0x4eaa54
xchg dword [ecx], eax
mov eax, dword [0x4eaa54]
cmp eax, 9
jne 0x44916a
push str.Download_of_ISvc_failed._Using_local_ISvc
mov edx, 0x7e7
mov ecx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbutils.cpp
call fcn.00441310
mov ecx, dword [ebp - 0x288]
add esp, 4
add ecx, 0x18
mov byte [0x4ea9f0], 1
cmp dword [ecx + 0x14], 8
jb 0x449045
mov ecx, dword [ecx]
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
push 1
cmovae eax, dword [ebp - 0x40]
push ecx
push eax
call edi
test eax, eax
jne 0x449151
call esi
mov edx, eax
lea ecx, [ebp - 0x2bc]
call fcn.0044b7a0
push eax
mov edx, str.Error_calling_MoveFileEx:
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0xb8]
call fcn.00418dc0
add esp, 4
mov byte [ebp - 4], 0xd
mov edx, dword [ebp - 0x2a8]
cmp edx, 8
jb 0x4490c9
mov ecx, dword [ebp - 0x2bc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4490bf
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x449301
push edx
push ecx
call fcn.0046da67
add esp, 8
xor eax, eax
mov dword [ebp - 0x2ac], 0
cmp dword [ebp - 0xa4], 8
mov edx, 0x7ee
mov word [ebp - 0x2bc], ax
mov ecx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbutils.cpp
lea eax, [ebp - 0xb8]
mov dword [ebp - 0x2a8], 7
cmovae eax, dword [ebp - 0xb8]
push eax
call fcn.00441310
mov byte [ebp - 4], 5
add esp, 4
mov edx, dword [ebp - 0xa4]
cmp edx, 8
jb 0x449151
mov ecx, dword [ebp - 0xb8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x449147
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x449306
push edx
push ecx
call fcn.0046da67
add esp, 8
sub esp, 0x1c
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x280]
push eax
call fcn.00412900
mov ecx, 0x4eaa54
xchg dword [ecx], eax
mov eax, dword [0x4eaa54]
test eax, eax
jne 0x4491a8
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
nop dword [eax + eax]
push 0x64
call edi
call fcn.00417560
mov ecx, esi
inc esi
cmp ecx, 0x12c
jge 0x449198
test al, al
je 0x449180
push 0x3e8
call edi
call fcn.00417560
test al, al
jne 0x449198
mov ecx, 0x4eaa51
mov al, 1
xchg byte [ecx], al
mov edx, dword [ebp - 0x2c]
cmp edx, 8
jb 0x4491eb
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4491e1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44930b
push edx
push ecx
call fcn.0046da67
add esp, 8
mov edx, dword [ebp - 0x14]
xor eax, eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
cmp edx, 8
jb 0x449239
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x44922f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x449310
push edx
push ecx
call fcn.0046da67
add esp, 8
mov edx, dword [ebp - 0x44]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp edx, 8
jb 0x449287
mov ecx, dword [ebp - 0x58]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x44927d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x449315
push edx
push ecx
call fcn.0046da67
add esp, 8
lea ecx, [ebp - 0x280]
call fcn.004122b0
mov edx, dword [ebp - 0x5c]
cmp edx, 8
jb 0x4492c8
mov ecx, dword [ebp - 0x70]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4492be
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44931a
push edx
push ecx
call fcn.0046da67
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046d546
mov esp, ebp
pop ebp
ret
call fcn.0048c340
call fcn.004889bc
call fcn.004889bc
call fcn.004889bc
call fcn.004889bc
call fcn.004889bc
call fcn.004889bc
call fcn.004889bc
call fcn.004889bc
call fcn.004889bc
call fcn.004889bc
call fcn.004889bc
int3