Function at 0x446340
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b24da
mov eax, dword fs:[0]
push eax
sub esp, 0x2d0
mov eax, dword [0x4e506c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 7
mov word [ebp - 0x64], ax
lea ecx, [ebp - 0x274]
mov dword [ebp - 4], eax
call fcn.00412080
xor eax, eax
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x68], 7
mov word [ebp - 0x7c], ax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x34]
mov al, byte [0x4ea9ff]
push 0x4e5d30
mov byte [ebp - 0x26f], al
call fcn.0040beb0
mov byte [ebp - 4], 3
lea eax, [ebp - 0x34]
cmp dword [ebp - 0x20], 8
lea ecx, [ebp - 0x254]
push dword [ebp - 0x24]
cmovae eax, dword [ebp - 0x34]
push eax
call fcn.00407920
mov edi, dword [ebp - 0x20]
lea ecx, [ebp - 0x34]
mov eax, dword [ebp - 0x34]
cmp edi, 8
cmovae ecx, eax
cmp dword [ebp - 0x24], 6
jne 0x44640a
push 6
mov edx, str.MDAM_B
call fcn.004196e0
add esp, 4
test eax, eax
je 0x44642c
mov eax, dword [ebp - 0x34]
cmp edi, 8
lea ecx, [ebp - 0x34]
cmovae ecx, eax
cmp dword [ebp - 0x24], 6
jne 0x446438
push 6
mov edx, str.MBRW_B
call fcn.004196e0
add esp, 4
test eax, eax
jne 0x446435
push 8
push str.business
jmp 0x44646a
mov eax, dword [ebp - 0x34]
cmp edi, 8
lea ecx, [ebp - 0x34]
cmovae ecx, eax
cmp dword [ebp - 0x24], 8
jne 0x446463
push 8
mov edx, str.NCEP_WIN
call fcn.004196e0
add esp, 4
test eax, eax
jne 0x446463
push 6
push str.common
jmp 0x44646a
push 8
push 0x4cead8
lea ecx, [ebp - 0x64]
call fcn.00407920
lea eax, [ebp - 0x224]
cmp eax, esi
je 0x446495
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x446486
mov eax, dword [esi]
push dword [esi + 0x10]
lea ecx, [ebp - 0x224]
push eax
call fcn.00407920
cmp dword [ebp - 0x50], 8
lea eax, [ebp - 0x64]
push dword [ebp - 0x54]
cmovae eax, dword [ebp - 0x64]
lea ecx, [ebp - 0x23c]
push eax
call fcn.00407920
cmp dword [0x4e5c9c], 8
lea ecx, [ebp - 0x20c]
push dword [0x4e5c98]
mov eax, 0x4e5c88
cmovae eax, dword [0x4e5c88]
push eax
call fcn.00407920
cmp dword [0x4e5d44], 8
mov eax, 0x4e5d30
push str.MBRW_C
cmovae eax, dword [0x4e5d30]
push eax
call fcn.0048bc09
add esp, 8
test eax, eax
je 0x44651e
cmp dword [0x4e5d44], 8
mov eax, 0x4e5d30
push str.MBRW_B
cmovae eax, dword [0x4e5d30]
push eax
call fcn.0048bc09
add esp, 8
test eax, eax
jne 0x44659b
push str.MalwarebytesMB3Service
mov edx, esi
lea ecx, [ebp - 0x94]
call fcn.0043b820
add esp, 4
mov byte [ebp - 4], 4
lea eax, [ebp - 0x94]
cmp dword [ebp - 0x80], 8
lea ecx, [ebp - 0x1f4]
push dword [ebp - 0x84]
cmovae eax, dword [ebp - 0x94]
push eax
call fcn.00407920
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x80]
cmp edx, 8
jb 0x44659b
mov ecx, dword [ebp - 0x94]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x446591
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x446f27
push edx
push ecx
call fcn.0046da67
add esp, 8
cmp byte [0x4ea9ed], 0
je 0x4465c7
lea eax, [ebp - 0x1f4]
cmp eax, esi
je 0x4465c7
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x4465b8
mov eax, dword [esi]
push dword [esi + 0x10]
lea ecx, [ebp - 0x1f4]
push eax
call fcn.00407920
cmp dword [0x4e5d74], 8
lea ecx, [ebp - 0x1dc]
push dword [0x4e5d70]
mov eax, 0x4e5d60
cmovae eax, dword [0x4e5d60]
push eax
call fcn.00407920
cmp dword [0x4e5d8c], 8
lea ecx, [ebp - 0x1c4]
push dword [0x4e5d88]
mov eax, 0x4e5d78
cmovae eax, dword [0x4e5d78]
push eax
call fcn.00407920
mov ecx, dword [0x4e5da0]
test ecx, ecx
je 0x44663b
cmp dword [0x4e5da4], 8
mov eax, 0x4e5d90
push ecx
cmovae eax, dword [0x4e5d90]
lea ecx, [ebp - 0x1ac]
push eax
call fcn.00407920
mov ecx, dword [0x4e5db8]
test ecx, ecx
je 0x446665
cmp dword [0x4e5dbc], 8
mov eax, 0x4e5da8
push ecx
cmovae eax, dword [0x4e5da8]
lea ecx, [ebp - 0x194]
push eax
call fcn.00407920
mov ecx, dword [0x4e5dd0]
test ecx, ecx
je 0x44668f
cmp dword [0x4e5dd4], 8
mov eax, 0x4e5dc0
push ecx
cmovae eax, dword [0x4e5dc0]
lea ecx, [ebp - 0x17c]
push eax
call fcn.00407920
mov ecx, dword [0x4e5de8]
test ecx, ecx
je 0x4466b9
cmp dword [0x4e5dec], 8
mov eax, 0x4e5dd8
push ecx
cmovae eax, dword [0x4e5dd8]
lea ecx, [ebp - 0x164]
push eax
call fcn.00407920
cmp dword [0x4e5e04], 8
lea ecx, [ebp - 0x14c]
push dword [0x4e5e00]
mov eax, 0x4e5df0
cmovae eax, dword [0x4e5df0]
push eax
call fcn.00407920
mov al, byte [0x4ea9f6]
mov byte [ebp - 0x11c], al
mov al, byte [0x4e5ac4]
mov byte [ebp - 0x11a], al
mov al, byte [0x4eaa53]
mov byte [ebp - 0x11b], 1
push dword [0x4e5e60]
test al, al
lea ecx, [ebp - 0x110]
mov al, byte [0x4ea9f8]
mov byte [ebp - 0x117], al
setne byte [ebp - 0x118]
mov al, byte [0x4ea9f9]
cmp dword [0x4e5e64], 8
mov byte [ebp - 0x275], al
mov eax, 0x4e5e50
cmovae eax, dword [0x4e5e50]
push eax
call fcn.00407920
mov al, byte [ebp - 0x275]
cmp dword [0x4e5e34], 8
mov byte [ebp - 0x113], al
mov eax, 0x4e5e20
cmovae eax, dword [0x4e5e20]
push eax
call fcn.0048f943
add esp, 4
cmp eax, 0x3e7
jle 0x4467bd
cmp dword [0x4e5e34], 8
lea ecx, [ebp - 0xe0]
push dword [0x4e5e30]
mov eax, 0x4e5e20
cmovae eax, dword [0x4e5e20]
push eax
call fcn.00407920
cmp dword [0x4e5e1c], 8
lea ecx, [ebp - 0xf8]
push dword [0x4e5e18]
mov eax, 0x4e5e08
cmovae eax, dword [0x4e5e08]
push eax
call fcn.00407920
cmp dword [0x4e5e4c], 8
lea ecx, [ebp - 0xc8]
push dword [0x4e5e48]
mov eax, 0x4e5e38
cmovae eax, dword [0x4e5e38]
push eax
call fcn.00407920
mov al, byte [0x4ea9f7]
lea ecx, [ebp - 0x7c]
mov byte [ebp - 0x116], al
call fcn.0042e330
lea eax, [ebp - 0x2ac]
push eax
lea ecx, [ebp - 0x7c]
call fcn.0043e8f0
push eax
lea ecx, [ebp - 0x294]
mov byte [ebp - 4], 5
call fcn.0040beb0
mov byte [ebp - 4], 6
lea eax, [ebp - 0x294]
cmp dword [ebp - 0x280], 8
lea ecx, [ebp - 0x26c]
push dword [ebp - 0x284]
cmovae eax, dword [ebp - 0x294]
push eax
call fcn.00407920
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x280]
cmp edx, 8
jb 0x446882
mov ecx, dword [ebp - 0x294]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x446878
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x446f2c
push edx
push ecx
call fcn.0046da67
add esp, 8
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x298]
cmp edx, 8
jb 0x4468c6
mov ecx, dword [ebp - 0x2ac]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4468bc
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x446f31
push edx
push ecx
call fcn.0046da67
add esp, 8
mov al, byte [0x4eaa02]
lea ecx, [ebp - 0x134]
mov byte [ebp - 0xb0], al
mov al, byte [0x4ea9fe]
mov byte [ebp - 0xaf], al
mov al, byte [0x4ea9fd]
mov byte [ebp - 0x115], al
mov al, byte [0x4ea9fc]
mov byte [ebp - 0x114], al
mov al, byte [0x4ea9fb]
mov byte [ebp - 0xae], al
mov al, byte [0x4ea9ed]
mov byte [ebp - 0xad], al
mov al, byte [0x4ea9ee]
mov byte [ebp - 0x112], al
lea eax, [esi + 0x1c]
cmp ecx, eax
je 0x446938
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x44692b
mov eax, dword [eax]
push ecx
push eax
lea ecx, [ebp - 0x134]
call fcn.00407920
push 0x4e5c88
lea ecx, [ebp - 0x4c]
call fcn.0040beb0
mov byte [ebp - 4], 7
cmp byte [esi + 0x18], 0
je 0x4469ce
lea ecx, [ebp - 0x2c4]
call fcn.004474a0
mov esi, eax
lea eax, [ebp - 0x4c]
cmp eax, esi
je 0x44698e
mov ecx, eax
call fcn.00404cc0
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [ebp - 0x4c], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0x3c], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov edx, dword [ebp - 0x2b0]
cmp edx, 8
jb 0x4469ce
mov ecx, dword [ebp - 0x2c4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4469c4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x446f36
push edx
push ecx
call fcn.0046da67
add esp, 8
cmp byte [0x4ea9f0], 0
je 0x4469f9
cmp dword [0x4e5e7c], 8
lea ecx, [ebp - 0x4c]
push dword [0x4e5e78]
mov eax, 0x4e5e68
cmovae eax, dword [0x4e5e68]
push eax
call fcn.00407920
sub esp, 0x1c
lea eax, [ebp - 0x4c]
lea ecx, [ebp - 0x274]
push eax
call fcn.00412900
mov ecx, 0x4eaa54
xchg dword [ecx], eax
mov eax, dword [0x4eaa54]
test eax, eax
je 0x446a9a
mov esi, dword [0x4eaa54]
mov byte [ebp - 4], 8
call fcn.00403a40
mov ecx, eax
test ecx, ecx
je 0x446f3b
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x1c], eax
push esi
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 9
push str.Failed_to_install_Installer_Service__error:__d
push eax
call fcn.0040f680
mov esi, dword [ebp - 0x1c]
mov edx, 0x60a
push esi
mov ecx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbutils.cpp
call fcn.00441310
add esp, 0x10
mov al, 1
mov ecx, 0x4eaa51
xchg byte [ecx], al
add esi, 0xfffffff0
mov byte [ebp - 4], 0xa
mov eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x446df5
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x446df5
push str.Waiting_for_InstallerService_to_start...
mov edx, 0x60f
mov ecx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbutils.cpp
call fcn.00441310
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 4
xor esi, esi
nop dword [eax]
push 0x3e8
call edi
call fcn.00417560
mov ecx, esi
inc esi
cmp ecx, 0x1e
jge 0x446ad8
test al, al
je 0x446ac0
push str.Waiting_for_InstallerService_to_stop...
mov edx, 0x618
mov ecx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbutils.cpp
call fcn.00441310
add esp, 4
nop
push 0x3e8
call edi
call fcn.00417560
test al, al
jne 0x446af0
push str.InstallerService_has_stopped
mov edx, 0x61f
mov ecx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbutils.cpp
call fcn.00441310
add esp, 4
call fcn.00417c40
mov esi, eax
or edi, 0xffffffff
mov dword [ebp - 0x18], esi
cmp esi, edi
je 0x446c49
call fcn.00417c40
mov dword [0x4ea9e0], eax
lea eax, [ebp - 0x2dc]
push eax
call fcn.00417f00
mov edx, eax
mov byte [ebp - 4], 0xb
cmp dword [edx + 0x14], 0x10
jb 0x446b50
mov edx, dword [edx]
test edx, edx
jne 0x446b58
xor ecx, ecx
jmp 0x446b69
mov ecx, edx
lea esi, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x446b60
sub ecx, esi
push ecx
push edx
mov ecx, 0x4eaa78
call fcn.004032a0
mov byte [ebp - 4], 7
mov edx, dword [ebp - 0x2c8]
cmp edx, 0x10
jb 0x446bb3
mov ecx, dword [ebp - 0x2dc]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x446ba9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x446f45
push edx
push ecx
call fcn.0046da67
add esp, 8
mov byte [ebp - 4], 0xc
call fcn.00403a40
mov ecx, eax
test ecx, ecx
je 0x446f4a
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 0xd
lea eax, [ebp - 0x14]
push dword [0x4ea9e0]
push str._InstallerService_error_status___u
push eax
call fcn.0040f680
push dword [ebp - 0x14]
mov edx, 0x62a
mov ecx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbutils.cpp
call fcn.00441310
push dword [0x4eaa78]
lea eax, [ebp - 0x14]
push str._InstallerService_error_detail____hs_
push eax
call fcn.0040f680
mov esi, dword [ebp - 0x14]
mov edx, 0x62c
push esi
mov ecx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbutils.cpp
call fcn.00441310
add esp, 0x20
add esi, 0xfffffff0
mov byte [ebp - 4], 0xe
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x446c42
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 7
mov esi, dword [ebp - 0x18]
call fcn.00417970
test al, al
je 0x446c7c
cmp esi, 0x5a
jne 0x446c7c
push str.setting_rebootRequired_to_true
mov edx, 0x631
mov ecx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbutils.cpp
call fcn.00441310
add esp, 4
mov al, 1
mov ecx, 0x4eaa52
xchg byte [ecx], al
jmp 0x446dd5
cmp dword [0x4ea9e0], 0
jbe 0x446dd5
mov byte [ebp - 4], 0xf
call fcn.00403a40
mov ecx, eax
test ecx, ecx
je 0x446f54
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x27c]
mov edx, dword [0x4ea9e0]
call fcn.004496b0
mov byte [ebp - 4], 0x11
push dword [eax]
lea eax, [ebp - 0x18]
push dword [0x4ea9e0]
push str.Installer_Service_error_status__d___hs_
push eax
call fcn.0040f680
mov edx, dword [ebp - 0x27c]
add esp, 0x10
add edx, 0xfffffff0
mov byte [ebp - 4], 0x12
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x446cfc
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x10
mov edx, 0x639
mov esi, dword [ebp - 0x18]
mov ecx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbutils.cpp
push esi
call fcn.00441310
add esp, 4
mov al, 1
mov ecx, 0x4eaa58
xchg byte [ecx], al
cmp dword [0x4ea9e0], 0x4d
jne 0x446db3
mov al, 1
mov ecx, 0x4eaa50
xchg byte [ecx], al
cmp byte [0x4ea9ed], 0
je 0x446db3
push str.https:__www.malwarebytes.com_jobs
lea ecx, [ebp - 0xac]
call fcn.00404c70
cmp dword [ebp - 0x98], 8
lea eax, [ebp - 0xac]
push 5
cmovae eax, dword [ebp - 0xac]
push 0
push 0
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edx, dword [ebp - 0x98]
cmp edx, 8
jb 0x446db3
mov ecx, dword [ebp - 0xac]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x446da9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x446f5e
push edx
push ecx
call fcn.0046da67
add esp, 8
call fcn.00418260
add esi, 0xfffffff0
mov byte [ebp - 4], 0x13
lock xadd dword [esi + 0xc], edi
dec edi
test edi, edi
jg 0x446dd1
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 7
mov al, 1
mov edx, 0x4eaa51
xchg byte [edx], al
push str.Installer_service_has_completed
mov edx, 0x64c
mov ecx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbutils.cpp
call fcn.00441310
add esp, 4
mov edx, dword [ebp - 0x38]
cmp edx, 8
jb 0x446e2f
mov ecx, dword [ebp - 0x4c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x446e25
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x446f63
push edx
push ecx
call fcn.0046da67
add esp, 8
mov edx, dword [ebp - 0x20]
xor eax, eax
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 7
mov word [ebp - 0x4c], ax
cmp edx, 8
jb 0x446e7d
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x446e73
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x446f68
push edx
push ecx
call fcn.0046da67
add esp, 8
mov edx, dword [ebp - 0x68]
cmp edx, 8
jb 0x446eb7
mov ecx, dword [ebp - 0x7c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x446ead
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x446f6d
push edx
push ecx
call fcn.0046da67
add esp, 8
xor eax, eax
mov dword [ebp - 0x6c], 0
lea ecx, [ebp - 0x274]
mov dword [ebp - 0x68], 7
mov word [ebp - 0x7c], ax
call fcn.004122b0
mov edx, dword [ebp - 0x50]
cmp edx, 8
jb 0x446f0c
mov ecx, dword [ebp - 0x64]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x446f02
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x446f72
push edx
push ecx
call fcn.0046da67
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046d546
mov esp, ebp
pop ebp
ret
call fcn.004889bc
call fcn.004889bc
call fcn.004889bc
call fcn.004889bc
push 0x80004005
call fcn.00403bb0
call fcn.004889bc
push 0x80004005
call fcn.00403bb0
push 0x80004005
call fcn.00403bb0
call fcn.004889bc
call fcn.004889bc
call fcn.004889bc
call fcn.004889bc
call fcn.004889bc
int3