Function at 0x4467f0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b3b9a
mov eax, dword fs:[0]
push eax
sub esp, 0x2d0
mov eax, dword [0x4e706c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 7
mov word [ebp - 0x64], ax
lea ecx, [ebp - 0x274]
mov dword [ebp - 4], eax
call fcn.004120f0
xor eax, eax
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x68], 7
mov word [ebp - 0x7c], ax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x34]
mov al, byte [0x4eca7f]
push 0x4e7d30
mov byte [ebp - 0x26f], al
call fcn.0040bf20
mov byte [ebp - 4], 3
lea eax, [ebp - 0x34]
cmp dword [ebp - 0x20], 8
lea ecx, [ebp - 0x254]
push dword [ebp - 0x24]
cmovae eax, dword [ebp - 0x34]
push eax
call fcn.00407990
mov edi, dword [ebp - 0x20]
lea ecx, [ebp - 0x34]
mov eax, dword [ebp - 0x34]
cmp edi, 8
cmovae ecx, eax
cmp dword [ebp - 0x24], 6
jne 0x4468ba
push 6
mov edx, str.MDAM_B
call fcn.004197c0
add esp, 4
test eax, eax
je 0x4468dc
mov eax, dword [ebp - 0x34]
cmp edi, 8
lea ecx, [ebp - 0x34]
cmovae ecx, eax
cmp dword [ebp - 0x24], 6
jne 0x4468e8
push 6
mov edx, str.MBRW_B
call fcn.004197c0
add esp, 4
test eax, eax
jne 0x4468e5
push 8
push str.business
jmp 0x44691a
mov eax, dword [ebp - 0x34]
cmp edi, 8
lea ecx, [ebp - 0x34]
cmovae ecx, eax
cmp dword [ebp - 0x24], 8
jne 0x446913
push 8
mov edx, str.NCEP_WIN
call fcn.004197c0
add esp, 4
test eax, eax
jne 0x446913
push 6
push str.common
jmp 0x44691a
push 8
push 0x4cfa40
lea ecx, [ebp - 0x64]
call fcn.00407990
lea eax, [ebp - 0x224]
cmp eax, esi
je 0x446945
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x446936
mov eax, dword [esi]
push dword [esi + 0x10]
lea ecx, [ebp - 0x224]
push eax
call fcn.00407990
cmp dword [ebp - 0x50], 8
lea eax, [ebp - 0x64]
push dword [ebp - 0x54]
cmovae eax, dword [ebp - 0x64]
lea ecx, [ebp - 0x23c]
push eax
call fcn.00407990
cmp dword [0x4e7c9c], 8
lea ecx, [ebp - 0x20c]
push dword [0x4e7c98]
mov eax, 0x4e7c88
cmovae eax, dword [0x4e7c88]
push eax
call fcn.00407990
cmp dword [0x4e7d44], 8
mov eax, 0x4e7d30
push str.MBRW_C
cmovae eax, dword [0x4e7d30]
push eax
call fcn.0048d2a7
add esp, 8
test eax, eax
je 0x4469ce
cmp dword [0x4e7d44], 8
mov eax, 0x4e7d30
push str.MBRW_B
cmovae eax, dword [0x4e7d30]
push eax
call fcn.0048d2a7
add esp, 8
test eax, eax
jne 0x446a4b
push str.MalwarebytesMB3Service
mov edx, esi
lea ecx, [ebp - 0x94]
call fcn.0043bcd0
add esp, 4
mov byte [ebp - 4], 4
lea eax, [ebp - 0x94]
cmp dword [ebp - 0x80], 8
lea ecx, [ebp - 0x1f4]
push dword [ebp - 0x84]
cmovae eax, dword [ebp - 0x94]
push eax
call fcn.00407990
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x80]
cmp edx, 8
jb 0x446a4b
mov ecx, dword [ebp - 0x94]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x446a41
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4473d7
push edx
push ecx
call fcn.0046f0d0
add esp, 8
cmp byte [0x4eca6d], 0
je 0x446a77
lea eax, [ebp - 0x1f4]
cmp eax, esi
je 0x446a77
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x446a68
mov eax, dword [esi]
push dword [esi + 0x10]
lea ecx, [ebp - 0x1f4]
push eax
call fcn.00407990
cmp dword [0x4e7d74], 8
lea ecx, [ebp - 0x1dc]
push dword [0x4e7d70]
mov eax, 0x4e7d60
cmovae eax, dword [0x4e7d60]
push eax
call fcn.00407990
cmp dword [0x4e7d8c], 8
lea ecx, [ebp - 0x1c4]
push dword [0x4e7d88]
mov eax, 0x4e7d78
cmovae eax, dword [0x4e7d78]
push eax
call fcn.00407990
mov ecx, dword [0x4e7da0]
test ecx, ecx
je 0x446aeb
cmp dword [0x4e7da4], 8
mov eax, 0x4e7d90
push ecx
cmovae eax, dword [0x4e7d90]
lea ecx, [ebp - 0x1ac]
push eax
call fcn.00407990
mov ecx, dword [0x4e7db8]
test ecx, ecx
je 0x446b15
cmp dword [0x4e7dbc], 8
mov eax, 0x4e7da8
push ecx
cmovae eax, dword [0x4e7da8]
lea ecx, [ebp - 0x194]
push eax
call fcn.00407990
mov ecx, dword [0x4e7dd0]
test ecx, ecx
je 0x446b3f
cmp dword [0x4e7dd4], 8
mov eax, 0x4e7dc0
push ecx
cmovae eax, dword [0x4e7dc0]
lea ecx, [ebp - 0x17c]
push eax
call fcn.00407990
mov ecx, dword [0x4e7de8]
test ecx, ecx
je 0x446b69
cmp dword [0x4e7dec], 8
mov eax, 0x4e7dd8
push ecx
cmovae eax, dword [0x4e7dd8]
lea ecx, [ebp - 0x164]
push eax
call fcn.00407990
cmp dword [0x4e7e04], 8
lea ecx, [ebp - 0x14c]
push dword [0x4e7e00]
mov eax, 0x4e7df0
cmovae eax, dword [0x4e7df0]
push eax
call fcn.00407990
mov al, byte [0x4eca76]
mov byte [ebp - 0x11c], al
mov al, byte [0x4e7ac4]
mov byte [ebp - 0x11a], al
mov al, byte [0x4ecad3]
mov byte [ebp - 0x11b], 1
push dword [0x4e7e60]
test al, al
lea ecx, [ebp - 0x110]
mov al, byte [0x4eca78]
mov byte [ebp - 0x117], al
setne byte [ebp - 0x118]
mov al, byte [0x4eca79]
cmp dword [0x4e7e64], 8
mov byte [ebp - 0x275], al
mov eax, 0x4e7e50
cmovae eax, dword [0x4e7e50]
push eax
call fcn.00407990
mov al, byte [ebp - 0x275]
cmp dword [0x4e7e34], 8
mov byte [ebp - 0x113], al
mov eax, 0x4e7e20
cmovae eax, dword [0x4e7e20]
push eax
call fcn.00490fd3
add esp, 4
cmp eax, 0x3e7
jle 0x446c6d
cmp dword [0x4e7e34], 8
lea ecx, [ebp - 0xe0]
push dword [0x4e7e30]
mov eax, 0x4e7e20
cmovae eax, dword [0x4e7e20]
push eax
call fcn.00407990
cmp dword [0x4e7e1c], 8
lea ecx, [ebp - 0xf8]
push dword [0x4e7e18]
mov eax, 0x4e7e08
cmovae eax, dword [0x4e7e08]
push eax
call fcn.00407990
cmp dword [0x4e7e4c], 8
lea ecx, [ebp - 0xc8]
push dword [0x4e7e48]
mov eax, 0x4e7e38
cmovae eax, dword [0x4e7e38]
push eax
call fcn.00407990
mov al, byte [0x4eca77]
lea ecx, [ebp - 0x7c]
mov byte [ebp - 0x116], al
call fcn.0042e7f0
lea eax, [ebp - 0x2ac]
push eax
lea ecx, [ebp - 0x7c]
call fcn.0043ed90
push eax
lea ecx, [ebp - 0x294]
mov byte [ebp - 4], 5
call fcn.0040bf20
mov byte [ebp - 4], 6
lea eax, [ebp - 0x294]
cmp dword [ebp - 0x280], 8
lea ecx, [ebp - 0x26c]
push dword [ebp - 0x284]
cmovae eax, dword [ebp - 0x294]
push eax
call fcn.00407990
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x280]
cmp edx, 8
jb 0x446d32
mov ecx, dword [ebp - 0x294]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x446d28
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4473dc
push edx
push ecx
call fcn.0046f0d0
add esp, 8
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x298]
cmp edx, 8
jb 0x446d76
mov ecx, dword [ebp - 0x2ac]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x446d6c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4473e1
push edx
push ecx
call fcn.0046f0d0
add esp, 8
mov al, byte [0x4eca82]
lea ecx, [ebp - 0x134]
mov byte [ebp - 0xb0], al
mov al, byte [0x4eca7e]
mov byte [ebp - 0xaf], al
mov al, byte [0x4eca7d]
mov byte [ebp - 0x115], al
mov al, byte [0x4eca7c]
mov byte [ebp - 0x114], al
mov al, byte [0x4eca7b]
mov byte [ebp - 0xae], al
mov al, byte [0x4eca6d]
mov byte [ebp - 0xad], al
mov al, byte [0x4eca6e]
mov byte [ebp - 0x112], al
lea eax, [esi + 0x1c]
cmp ecx, eax
je 0x446de8
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x446ddb
mov eax, dword [eax]
push ecx
push eax
lea ecx, [ebp - 0x134]
call fcn.00407990
push 0x4e7c88
lea ecx, [ebp - 0x4c]
call fcn.0040bf20
mov byte [ebp - 4], 7
cmp byte [esi + 0x18], 0
je 0x446e7e
lea ecx, [ebp - 0x2c4]
call fcn.00447950
mov esi, eax
lea eax, [ebp - 0x4c]
cmp eax, esi
je 0x446e3e
mov ecx, eax
call fcn.00404d30
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [ebp - 0x4c], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0x3c], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov edx, dword [ebp - 0x2b0]
cmp edx, 8
jb 0x446e7e
mov ecx, dword [ebp - 0x2c4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x446e74
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4473e6
push edx
push ecx
call fcn.0046f0d0
add esp, 8
cmp byte [0x4eca70], 0
je 0x446ea9
cmp dword [0x4e7e7c], 8
lea ecx, [ebp - 0x4c]
push dword [0x4e7e78]
mov eax, 0x4e7e68
cmovae eax, dword [0x4e7e68]
push eax
call fcn.00407990
sub esp, 0x1c
lea eax, [ebp - 0x4c]
lea ecx, [ebp - 0x274]
push eax
call fcn.00412970
mov ecx, 0x4ecad4
xchg dword [ecx], eax
mov eax, dword [0x4ecad4]
test eax, eax
je 0x446f4a
mov esi, dword [0x4ecad4]
mov byte [ebp - 4], 8
call fcn.00403ab0
mov ecx, eax
test ecx, ecx
je 0x4473eb
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x1c], eax
push esi
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 9
push str.Failed_to_install_Installer_Service__error:__d
push eax
call fcn.0040f6f0
mov esi, dword [ebp - 0x1c]
mov edx, 0x60a
push esi
mov ecx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbutils.cpp
call fcn.004417b0
add esp, 0x10
mov al, 1
mov ecx, 0x4ecad1
xchg byte [ecx], al
add esi, 0xfffffff0
mov byte [ebp - 4], 0xa
mov eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4472a5
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x4472a5
push str.Waiting_for_InstallerService_to_start...
mov edx, 0x60f
mov ecx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbutils.cpp
call fcn.004417b0
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 4
xor esi, esi
nop dword [eax]
push 0x3e8
call edi
call fcn.00417640
mov ecx, esi
inc esi
cmp ecx, 0x1e
jge 0x446f88
test al, al
je 0x446f70
push str.Waiting_for_InstallerService_to_stop...
mov edx, 0x618
mov ecx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbutils.cpp
call fcn.004417b0
add esp, 4
nop
push 0x3e8
call edi
call fcn.00417640
test al, al
jne 0x446fa0
push str.InstallerService_has_stopped
mov edx, 0x61f
mov ecx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbutils.cpp
call fcn.004417b0
add esp, 4
call fcn.00417d20
mov esi, eax
or edi, 0xffffffff
mov dword [ebp - 0x18], esi
cmp esi, edi
je 0x4470f9
call fcn.00417d20
mov dword [0x4eca60], eax
lea eax, [ebp - 0x2dc]
push eax
call fcn.00417fe0
mov edx, eax
mov byte [ebp - 4], 0xb
cmp dword [edx + 0x14], 0x10
jb 0x447000
mov edx, dword [edx]
test edx, edx
jne 0x447008
xor ecx, ecx
jmp 0x447019
mov ecx, edx
lea esi, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x447010
sub ecx, esi
push ecx
push edx
mov ecx, 0x4ecaf8
call fcn.00403310
mov byte [ebp - 4], 7
mov edx, dword [ebp - 0x2c8]
cmp edx, 0x10
jb 0x447063
mov ecx, dword [ebp - 0x2dc]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x447059
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4473f5
push edx
push ecx
call fcn.0046f0d0
add esp, 8
mov byte [ebp - 4], 0xc
call fcn.00403ab0
mov ecx, eax
test ecx, ecx
je 0x4473fa
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 0xd
lea eax, [ebp - 0x14]
push dword [0x4eca60]
push str._InstallerService_error_status___u
push eax
call fcn.0040f6f0
push dword [ebp - 0x14]
mov edx, 0x62a
mov ecx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbutils.cpp
call fcn.004417b0
push dword [0x4ecaf8]
lea eax, [ebp - 0x14]
push str._InstallerService_error_detail____hs_
push eax
call fcn.0040f6f0
mov esi, dword [ebp - 0x14]
mov edx, 0x62c
push esi
mov ecx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbutils.cpp
call fcn.004417b0
add esp, 0x20
add esi, 0xfffffff0
mov byte [ebp - 4], 0xe
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4470f2
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 7
mov esi, dword [ebp - 0x18]
call fcn.00417a50
test al, al
je 0x44712c
cmp esi, 0x5a
jne 0x44712c
push str.setting_rebootRequired_to_true
mov edx, 0x631
mov ecx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbutils.cpp
call fcn.004417b0
add esp, 4
mov al, 1
mov ecx, 0x4ecad2
xchg byte [ecx], al
jmp 0x447285
cmp dword [0x4eca60], 0
jbe 0x447285
mov byte [ebp - 4], 0xf
call fcn.00403ab0
mov ecx, eax
test ecx, ecx
je 0x447404
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x27c]
mov edx, dword [0x4eca60]
call fcn.00449b70
mov byte [ebp - 4], 0x11
push dword [eax]
lea eax, [ebp - 0x18]
push dword [0x4eca60]
push str.Installer_Service_error_status__d___hs_
push eax
call fcn.0040f6f0
mov edx, dword [ebp - 0x27c]
add esp, 0x10
add edx, 0xfffffff0
mov byte [ebp - 4], 0x12
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4471ac
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x10
mov edx, 0x639
mov esi, dword [ebp - 0x18]
mov ecx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbutils.cpp
push esi
call fcn.004417b0
add esp, 4
mov al, 1
mov ecx, 0x4ecad8
xchg byte [ecx], al
cmp dword [0x4eca60], 0x4d
jne 0x447263
mov al, 1
mov ecx, 0x4ecad0
xchg byte [ecx], al
cmp byte [0x4eca6d], 0
je 0x447263
push str.https:__www.malwarebytes.com_jobs
lea ecx, [ebp - 0xac]
call fcn.00404ce0
cmp dword [ebp - 0x98], 8
lea eax, [ebp - 0xac]
push 5
cmovae eax, dword [ebp - 0xac]
push 0
push 0
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edx, dword [ebp - 0x98]
cmp edx, 8
jb 0x447263
mov ecx, dword [ebp - 0xac]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x447259
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44740e
push edx
push ecx
call fcn.0046f0d0
add esp, 8
call fcn.00418340
add esi, 0xfffffff0
mov byte [ebp - 4], 0x13
lock xadd dword [esi + 0xc], edi
dec edi
test edi, edi
jg 0x447281
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 7
mov al, 1
mov edx, 0x4ecad1
xchg byte [edx], al
push str.Installer_service_has_completed
mov edx, 0x64c
mov ecx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbutils.cpp
call fcn.004417b0
add esp, 4
mov edx, dword [ebp - 0x38]
cmp edx, 8
jb 0x4472df
mov ecx, dword [ebp - 0x4c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4472d5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x447413
push edx
push ecx
call fcn.0046f0d0
add esp, 8
mov edx, dword [ebp - 0x20]
xor eax, eax
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 7
mov word [ebp - 0x4c], ax
cmp edx, 8
jb 0x44732d
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x447323
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x447418
push edx
push ecx
call fcn.0046f0d0
add esp, 8
mov edx, dword [ebp - 0x68]
cmp edx, 8
jb 0x447367
mov ecx, dword [ebp - 0x7c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x44735d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44741d
push edx
push ecx
call fcn.0046f0d0
add esp, 8
xor eax, eax
mov dword [ebp - 0x6c], 0
lea ecx, [ebp - 0x274]
mov dword [ebp - 0x68], 7
mov word [ebp - 0x7c], ax
call fcn.00412320
mov edx, dword [ebp - 0x50]
cmp edx, 8
jb 0x4473bc
mov ecx, dword [ebp - 0x64]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4473b2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x447422
push edx
push ecx
call fcn.0046f0d0
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046ebaf
mov esp, ebp
pop ebp
call fcn.0048a05c
call fcn.0048a05c
call fcn.0048a05c
call fcn.0048a05c
push 0x80004005
call fcn.00403c20
call fcn.0048a05c
push 0x80004005
call fcn.00403c20
push 0x80004005
call fcn.00403c20
call fcn.0048a05c
call fcn.0048a05c
call fcn.0048a05c
call fcn.0048a05c
call fcn.0048a05c
int3