Function at 0x448310
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4af2ac
mov eax, dword fs:[0]
push eax
sub esp, 0x2b0
mov eax, dword [0x4e006c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 7
mov word [ebp - 0x60], ax
lea ecx, [ebp - 0x270]
mov dword [ebp - 4], eax
call fcn.004181f0
xor eax, eax
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x64], 7
mov word [ebp - 0x78], ax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x30]
mov al, byte [0x4e5a31]
push 0x4e0cf0
mov byte [ebp - 0x26b], al
call fcn.004154d0
mov byte [ebp - 4], 3
lea eax, [ebp - 0x30]
cmp dword [ebp - 0x1c], 8
lea ecx, [ebp - 0x250]
push dword [ebp - 0x20]
cmovae eax, dword [ebp - 0x30]
push eax
call fcn.00407d50
mov edi, dword [ebp - 0x1c]
lea ecx, [ebp - 0x30]
mov eax, dword [ebp - 0x30]
cmp edi, 8
cmovae ecx, eax
cmp dword [ebp - 0x20], 6
jne 0x4483da
push 6
mov edx, str.MDAM_B
call fcn.0041f3b0
add esp, 4
test eax, eax
je 0x4483fc
mov eax, dword [ebp - 0x30]
cmp edi, 8
lea ecx, [ebp - 0x30]
cmovae ecx, eax
cmp dword [ebp - 0x20], 6
jne 0x448408
push 6
mov edx, str.MBRW_B
call fcn.0041f3b0
add esp, 4
test eax, eax
jne 0x448405
push 8
push str.business
jmp 0x44843a
mov eax, dword [ebp - 0x30]
cmp edi, 8
lea ecx, [ebp - 0x30]
cmovae ecx, eax
cmp dword [ebp - 0x20], 8
jne 0x448433
push 8
mov edx, str.NCEP_WIN
call fcn.0041f3b0
add esp, 4
test eax, eax
jne 0x448433
push 6
push str.common
jmp 0x44843a
push 8
push str.consumer
lea ecx, [ebp - 0x60]
call fcn.00407d50
lea eax, [ebp - 0x220]
cmp eax, esi
je 0x448465
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x448456
mov eax, dword [esi]
push dword [esi + 0x10]
lea ecx, [ebp - 0x220]
push eax
call fcn.00407d50
cmp dword [ebp - 0x4c], 8
lea eax, [ebp - 0x60]
push dword [ebp - 0x50]
cmovae eax, dword [ebp - 0x60]
lea ecx, [ebp - 0x238]
push eax
call fcn.00407d50
cmp dword [0x4e0c5c], 8
lea ecx, [ebp - 0x208]
push dword [0x4e0c58]
mov eax, 0x4e0c48
cmovae eax, dword [0x4e0c48]
push eax
call fcn.00407d50
cmp dword [0x4e0d04], 8
mov eax, 0x4e0cf0
push str.MBRW_C
cmovae eax, dword [0x4e0cf0]
push eax
call fcn.0048e3fb
add esp, 8
test eax, eax
je 0x4484ee
cmp dword [0x4e0d04], 8
mov eax, 0x4e0cf0
push str.MBRW_B
cmovae eax, dword [0x4e0cf0]
push eax
call fcn.0048e3fb
add esp, 8
test eax, eax
jne 0x448568
push str.MalwarebytesMB3Service
mov edx, esi
lea ecx, [ebp - 0x90]
call fcn.0043e230
add esp, 4
mov byte [ebp - 4], 4
lea eax, [ebp - 0x90]
cmp dword [ebp - 0x7c], 8
lea ecx, [ebp - 0x1f0]
push dword [ebp - 0x80]
cmovae eax, dword [ebp - 0x90]
push eax
call fcn.00407d50
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x7c]
cmp edx, 8
jb 0x448568
mov ecx, dword [ebp - 0x90]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x44855e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x448d2f
push edx
push ecx
call fcn.0046a609
add esp, 8
cmp byte [0x4e5a1f], 0
je 0x448594
lea eax, [ebp - 0x1f0]
cmp eax, esi
je 0x448594
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x448585
mov eax, dword [esi]
push dword [esi + 0x10]
lea ecx, [ebp - 0x1f0]
push eax
call fcn.00407d50
cmp dword [0x4e0d4c], 8
lea ecx, [ebp - 0x1d8]
push dword [0x4e0d48]
mov eax, 0x4e0d38
cmovae eax, dword [0x4e0d38]
push eax
call fcn.00407d50
cmp dword [0x4e0d64], 8
lea ecx, [ebp - 0x1c0]
push dword [0x4e0d60]
mov eax, 0x4e0d50
cmovae eax, dword [0x4e0d50]
push eax
call fcn.00407d50
mov ecx, dword [0x4e0d78]
test ecx, ecx
je 0x448608
cmp dword [0x4e0d7c], 8
mov eax, 0x4e0d68
push ecx
cmovae eax, dword [0x4e0d68]
lea ecx, [ebp - 0x1a8]
push eax
call fcn.00407d50
mov ecx, dword [0x4e0d90]
test ecx, ecx
je 0x448632
cmp dword [0x4e0d94], 8
mov eax, 0x4e0d80
push ecx
cmovae eax, dword [0x4e0d80]
lea ecx, [ebp - 0x190]
push eax
call fcn.00407d50
mov ecx, dword [0x4e0da8]
test ecx, ecx
je 0x44865c
cmp dword [0x4e0dac], 8
mov eax, 0x4e0d98
push ecx
cmovae eax, dword [0x4e0d98]
lea ecx, [ebp - 0x178]
push eax
call fcn.00407d50
mov ecx, dword [0x4e0dc0]
test ecx, ecx
je 0x448686
cmp dword [0x4e0dc4], 8
mov eax, 0x4e0db0
push ecx
cmovae eax, dword [0x4e0db0]
lea ecx, [ebp - 0x160]
push eax
call fcn.00407d50
cmp dword [0x4e0ddc], 8
lea ecx, [ebp - 0x148]
push dword [0x4e0dd8]
mov eax, 0x4e0dc8
cmovae eax, dword [0x4e0dc8]
push eax
call fcn.00407d50
mov al, byte [0x4e5a28]
mov byte [ebp - 0x118], al
mov al, byte [0x4e0ab4]
mov byte [ebp - 0x116], al
mov al, byte [0x4e5a83]
mov byte [ebp - 0x117], 1
push dword [0x4e0e38]
test al, al
lea ecx, [ebp - 0x10c]
mov al, byte [0x4e5a2a]
mov byte [ebp - 0x113], al
setne byte [ebp - 0x114]
mov al, byte [0x4e5a2b]
cmp dword [0x4e0e3c], 8
mov byte [ebp - 0x271], al
mov eax, 0x4e0e28
cmovae eax, dword [0x4e0e28]
push eax
call fcn.00407d50
mov al, byte [ebp - 0x271]
lea ecx, [ebp - 0xdc]
cmp dword [0x4e0e0c], 8
push dword [0x4e0e08]
mov byte [ebp - 0x10f], al
mov eax, 0x4e0df8
cmovae eax, dword [0x4e0df8]
push eax
call fcn.00407d50
cmp dword [0x4e0df4], 8
lea ecx, [ebp - 0xf4]
push dword [0x4e0df0]
mov eax, 0x4e0de0
cmovae eax, dword [0x4e0de0]
push eax
call fcn.00407d50
cmp dword [0x4e0e24], 8
lea ecx, [ebp - 0xc4]
push dword [0x4e0e20]
mov eax, 0x4e0e10
cmovae eax, dword [0x4e0e10]
push eax
call fcn.00407d50
mov al, byte [0x4e5a29]
lea ecx, [ebp - 0x78]
mov byte [ebp - 0x112], al
call fcn.00433d20
lea eax, [ebp - 0x2a4]
push eax
lea ecx, [ebp - 0x78]
call fcn.00440930
push eax
lea ecx, [ebp - 0x28c]
mov byte [ebp - 4], 5
call fcn.004154d0
mov byte [ebp - 4], 6
lea eax, [ebp - 0x28c]
cmp dword [ebp - 0x278], 8
lea ecx, [ebp - 0x268]
push dword [ebp - 0x27c]
cmovae eax, dword [ebp - 0x28c]
push eax
call fcn.00407d50
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x278]
cmp edx, 8
jb 0x44882c
mov ecx, dword [ebp - 0x28c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x448822
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x448d34
push edx
push ecx
call fcn.0046a609
add esp, 8
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x290]
cmp edx, 8
jb 0x448870
mov ecx, dword [ebp - 0x2a4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x448866
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x448d39
push edx
push ecx
call fcn.0046a609
add esp, 8
mov al, byte [0x4e5a34]
lea ecx, [ebp - 0x130]
mov byte [ebp - 0xac], al
mov al, byte [0x4e5a30]
mov byte [ebp - 0xab], al
mov al, byte [0x4e5a2f]
mov byte [ebp - 0x111], al
mov al, byte [0x4e5a2e]
mov byte [ebp - 0x110], al
mov al, byte [0x4e5a2d]
mov byte [ebp - 0xaa], al
mov al, byte [0x4e5a1f]
mov byte [ebp - 0xa9], al
mov al, byte [0x4e5a20]
mov byte [ebp - 0x10e], al
lea eax, [esi + 0x1c]
cmp ecx, eax
je 0x4488e2
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x4488d5
mov eax, dword [eax]
push ecx
push eax
lea ecx, [ebp - 0x130]
call fcn.00407d50
push 0x4e0c48
lea ecx, [ebp - 0x48]
call fcn.004154d0
mov byte [ebp - 4], 7
cmp byte [esi + 0x18], 0
je 0x448978
lea ecx, [ebp - 0x2bc]
call fcn.004492e0
mov esi, eax
lea eax, [ebp - 0x48]
cmp eax, esi
je 0x448938
mov ecx, eax
call fcn.00405100
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [ebp - 0x48], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0x38], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov edx, dword [ebp - 0x2a8]
cmp edx, 8
jb 0x448978
mov ecx, dword [ebp - 0x2bc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x44896e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x448d3e
push edx
push ecx
call fcn.0046a609
add esp, 8
cmp byte [0x4e5a22], 0
je 0x4489a3
cmp dword [0x4e0e54], 8
lea ecx, [ebp - 0x48]
push dword [0x4e0e50]
mov eax, 0x4e0e40
cmovae eax, dword [0x4e0e40]
push eax
call fcn.00407d50
sub esp, 0x1c
lea eax, [ebp - 0x48]
lea ecx, [ebp - 0x270]
push eax
call fcn.00418a70
mov ecx, 0x4e5a84
xchg dword [ecx], eax
mov eax, dword [0x4e5a84]
test eax, eax
je 0x448a44
mov esi, dword [0x4e5a84]
mov byte [ebp - 4], 8
call fcn.00403b50
mov ecx, eax
test ecx, ecx
je 0x448d43
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x18], eax
push esi
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 9
push str.Failed_to_install_Installer_Service__error:__d
push eax
call fcn.00417100
mov esi, dword [ebp - 0x18]
mov edx, 0x667
push esi
mov ecx, str.d:jenkinsworkspace_a_mb4_mbsetup_srcmbsetupmbutils.cpp
call fcn.004433b0
add esp, 0x10
mov al, 1
mov ecx, 0x4e5a81
xchg byte [ecx], al
add esi, 0xfffffff0
mov byte [ebp - 4], 0xa
mov eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x448bfd
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x448bfd
push str.Waiting_for_InstallerService_to_start...
mov edx, 0x66c
mov ecx, str.d:jenkinsworkspace_a_mb4_mbsetup_srcmbsetupmbutils.cpp
call fcn.004433b0
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 4
xor esi, esi
push 0x3e8
call edi
call fcn.0041d780
mov ecx, esi
inc esi
cmp ecx, 0x1e
jge 0x448a7b
test al, al
je 0x448a63
push str.Waiting_for_InstallerService_to_stop...
mov edx, 0x675
mov ecx, str.d:jenkinsworkspace_a_mb4_mbsetup_srcmbsetupmbutils.cpp
call fcn.004433b0
add esp, 4
push 0x3e8
call edi
call fcn.0041d780
test al, al
jne 0x448a92
push str.InstallerService_has_stopped
mov edx, 0x67c
mov ecx, str.d:jenkinsworkspace_a_mb4_mbsetup_srcmbsetupmbutils.cpp
call fcn.004433b0
add esp, 4
call fcn.0041db90
test al, al
je 0x448ad0
mov al, 1
mov ecx, 0x4e5a82
xchg byte [ecx], al
jmp 0x448bdd
call fcn.0041de60
test eax, eax
jle 0x448bdd
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], 0
call fcn.00403c50
mov byte [ebp - 4], 0xb
call fcn.0041de60
push eax
lea eax, [ebp - 0x14]
push str.Installer_Service_status__d
push eax
call fcn.00417100
mov esi, dword [ebp - 0x14]
mov edx, 0x688
push esi
mov ecx, str.d:jenkinsworkspace_a_mb4_mbsetup_srcmbsetupmbutils.cpp
call fcn.004433b0
add esp, 0x10
mov al, 1
mov ecx, 0x4e5a88
xchg byte [ecx], al
call fcn.0041de60
cmp eax, 0x4d
jne 0x448bb8
mov al, 1
mov ecx, 0x4e5a80
xchg byte [ecx], al
cmp byte [0x4e5a1f], 0
je 0x448bb8
push str.https:__www.malwarebytes.com_jobs
lea ecx, [ebp - 0xa8]
call fcn.00404ed0
cmp dword [ebp - 0x94], 8
lea eax, [ebp - 0xa8]
push 5
cmovae eax, dword [ebp - 0xa8]
push 0
push 0
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edx, dword [ebp - 0x94]
cmp edx, 8
jb 0x448bb8
mov ecx, dword [ebp - 0xa8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x448bae
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x448d4d
push edx
push ecx
call fcn.0046a609
add esp, 8
call fcn.0041e120
add esi, 0xfffffff0
mov byte [ebp - 4], 0xc
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x448bd9
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 7
mov al, 1
mov edx, 0x4e5a81
xchg byte [edx], al
push str.Installer_service_has_completed
mov edx, 0x69b
mov ecx, str.d:jenkinsworkspace_a_mb4_mbsetup_srcmbsetupmbutils.cpp
call fcn.004433b0
add esp, 4
mov edx, dword [ebp - 0x34]
cmp edx, 8
jb 0x448c37
mov ecx, dword [ebp - 0x48]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x448c2d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x448d52
push edx
push ecx
call fcn.0046a609
add esp, 8
mov edx, dword [ebp - 0x1c]
xor eax, eax
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 7
mov word [ebp - 0x48], ax
cmp edx, 8
jb 0x448c85
mov ecx, dword [ebp - 0x30]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x448c7b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x448d57
push edx
push ecx
call fcn.0046a609
add esp, 8
mov edx, dword [ebp - 0x64]
cmp edx, 8
jb 0x448cbf
mov ecx, dword [ebp - 0x78]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x448cb5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x448d5c
push edx
push ecx
call fcn.0046a609
add esp, 8
xor eax, eax
mov dword [ebp - 0x68], 0
lea ecx, [ebp - 0x270]
mov dword [ebp - 0x64], 7
mov word [ebp - 0x78], ax
call fcn.00418420
mov edx, dword [ebp - 0x4c]
cmp edx, 8
jb 0x448d14
mov ecx, dword [ebp - 0x60]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x448d0a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x448d61
push edx
push ecx
call fcn.0046a609
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046a0e8
mov esp, ebp
pop ebp
ret
call fcn.0048552c
call fcn.0048552c
call fcn.0048552c
call fcn.0048552c
push 0x80004005
call fcn.00403cc0
call fcn.0048552c
call fcn.0048552c
call fcn.0048552c
call fcn.0048552c
call fcn.0048552c
int3