Function at 0x448a10
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b38f8
mov eax, dword fs:[0]
push eax
sub esp, 0x340
mov eax, dword [0x4e706c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x288], ecx
push 0x4ecb24
push 0x41a160
push 0x4ecb2c
call fcn.0046b143
add esp, 0xc
test eax, eax
je 0x4493a3
xor eax, eax
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 7
mov word [ebp - 0x70], ax
lea ecx, [ebp - 0x280]
mov dword [ebp - 4], eax
call fcn.00412080
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1d0]
mov al, byte [0x4ec9ff]
cmp dword [0x4e7d8c], 8
push dword [0x4e7d88]
mov byte [ebp - 0x27b], al
mov eax, 0x4e7d78
cmovae eax, dword [0x4e7d78]
push eax
call fcn.00407920
mov ecx, dword [0x4e7da0]
test ecx, ecx
je 0x448ae2
cmp dword [0x4e7da4], 8
mov eax, 0x4e7d90
push ecx
cmovae eax, dword [0x4e7d90]
lea ecx, [ebp - 0x1b8]
push eax
call fcn.00407920
cmp dword [0x4e7c9c], 8
lea ecx, [ebp - 0x218]
push dword [0x4e7c98]
mov eax, 0x4e7c88
cmovae eax, dword [0x4e7c88]
push eax
call fcn.00407920
push 0x4e7d30
lea ecx, [ebp - 0x58]
call fcn.0040beb0
mov byte [ebp - 4], 2
lea eax, [ebp - 0x58]
cmp dword [ebp - 0x44], 8
lea ecx, [ebp - 0x260]
push dword [ebp - 0x48]
cmovae eax, dword [ebp - 0x58]
push eax
call fcn.00407920
mov esi, dword [ebp - 0x44]
lea ecx, [ebp - 0x58]
mov edi, dword [ebp - 0x58]
cmp esi, 8
mov eax, dword [ebp - 0x48]
cmovae ecx, edi
cmp eax, 6
jne 0x448b5e
push eax
mov edx, str.MDAM_B
call fcn.00419770
add esp, 4
test eax, eax
je 0x448b7e
mov eax, dword [ebp - 0x48]
cmp esi, 8
lea ecx, [ebp - 0x58]
cmovae ecx, edi
cmp eax, 6
jne 0x448b8a
push eax
mov edx, str.MBRW_B
call fcn.00419770
add esp, 4
test eax, eax
jne 0x448b87
push 8
push str.business
jmp 0x448bba
mov eax, dword [ebp - 0x48]
cmp esi, 8
lea ecx, [ebp - 0x58]
cmovae ecx, edi
cmp eax, 8
jne 0x448bb3
push eax
mov edx, str.NCEP_WIN
call fcn.00419770
add esp, 4
test eax, eax
jne 0x448bb3
push 6
push str.common
jmp 0x448bba
push 8
push 0x4cfb58
lea ecx, [ebp - 0x70]
call fcn.00407920
cmp dword [ebp - 0x5c], 8
lea eax, [ebp - 0x70]
push dword [ebp - 0x60]
cmovae eax, dword [ebp - 0x70]
lea ecx, [ebp - 0x248]
push eax
call fcn.00407920
cmp dword [0x4e7ef4], 8
lea ecx, [ebp - 0x230]
push dword [0x4e7ef0]
mov eax, 0x4e7ee0
cmovae eax, dword [0x4e7ee0]
push eax
call fcn.00407920
cmp dword [0x4e7d44], 8
mov eax, 0x4e7d30
push str.MBRW_C
cmovae eax, dword [0x4e7d30]
push eax
call fcn.0048cdc7
add esp, 8
test eax, eax
je 0x448c4b
cmp dword [0x4e7d44], 8
mov eax, 0x4e7d30
push str.MBRW_B
cmovae eax, dword [0x4e7d30]
push eax
call fcn.0048cdc7
add esp, 8
test eax, eax
jne 0x448cc8
push str.MalwarebytesMB3Service
mov edx, 0x4e7ee0
lea ecx, [ebp - 0x88]
call fcn.0043b8e0
add esp, 4
mov byte [ebp - 4], 3
lea eax, [ebp - 0x88]
cmp dword [ebp - 0x74], 8
lea ecx, [ebp - 0x200]
push dword [ebp - 0x78]
cmovae eax, dword [ebp - 0x88]
push eax
call fcn.00407920
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x74]
cmp edx, 8
jb 0x448cc8
mov ecx, dword [ebp - 0x88]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x448cbe
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4493a8
push edx
push ecx
call fcn.0046ec30
add esp, 8
cmp dword [0x4e7d74], 8
lea ecx, [ebp - 0x1e8]
push dword [0x4e7d70]
mov eax, 0x4e7d60
cmovae eax, dword [0x4e7d60]
push eax
call fcn.00407920
cmp dword [0x4e7e04], 8
lea ecx, [ebp - 0x158]
push dword [0x4e7e00]
mov eax, 0x4e7df0
cmovae eax, dword [0x4e7df0]
push eax
call fcn.00407920
mov al, byte [0x4ec9f6]
mov byte [ebp - 0x128], al
xor eax, eax
mov byte [ebp - 0x125], 1
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
mov byte [ebp - 4], 5
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
cmp byte [0x4ec9f0], al
je 0x448ded
mov edi, dword [0x4e7e7c]
mov ecx, 0x4e7e68
mov esi, dword [0x4e7e78]
cmp edi, 8
cmovae ecx, dword [0x4e7e68]
cmp esi, 2
jne 0x448dc9
push esi
mov edx, 0x4d01ec
call fcn.00419770
add esp, 4
test eax, eax
jne 0x448dc9
push 0x4e7c88
lea ecx, [ebp - 0x2ec]
call fcn.0040beb0
lea ecx, [ebp - 0x28]
call fcn.00404cc0
movups xmm0, xmmword [ebp - 0x2ec]
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
movups xmmword [ebp - 0x28], xmm0
movq xmm0, qword [ebp - 0x2dc]
movq qword [ebp - 0x18], xmm0
jmp 0x4490a9
cmp edi, 8
lea ecx, [ebp - 0x28]
mov eax, 0x4e7e68
cmovae eax, dword [0x4e7e68]
push esi
push eax
call fcn.00407920
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x4490a9
mov esi, dword [ebp - 0x288]
lea ecx, [ebp - 0x2d4]
mov byte [ebp - 0x28c], 0
add esi, 0x18
push dword [ebp - 0x28c]
mov edx, esi
call fcn.00418ec0
add esp, 4
lea ecx, [ebp - 0x2d4]
mov byte [ebp - 4], 6
call fcn.0044b980
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x2c0]
mov byte [ebp - 0x281], al
cmp edx, 8
jb 0x448e72
mov ecx, dword [ebp - 0x2d4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x448e62
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4493ad
push edx
push ecx
call fcn.0046ec30
mov al, byte [ebp - 0x281]
add esp, 8
test al, al
je 0x44902a
push 0x4e7c88
lea ecx, [ebp - 0x304]
mov byte [0x4ec9f0], 1
call fcn.0040beb0
lea ecx, [ebp - 0x28]
call fcn.00404cc0
movups xmm0, xmmword [ebp - 0x304]
push str.Rename_local_ISvc_and_download_latest
mov edx, 0x7d7
mov ecx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbutils.cpp
movups xmmword [ebp - 0x28], xmm0
movq xmm0, qword [ebp - 0x2f4]
movq qword [ebp - 0x18], xmm0
call fcn.004413d0
add esp, 4
lea ecx, [ebp - 0x31c]
push 0x4e7c88
call fcn.0040beb0
lea ecx, [ebp - 0x40]
call fcn.00404cc0
movups xmm0, xmmword [ebp - 0x31c]
push 0x1d
push str.MBAMInstallerService_old.exe
movups xmmword [ebp - 0x40], xmm0
lea ecx, [ebp - 0x40]
movq xmm0, qword [ebp - 0x30c]
movq qword [ebp - 0x30], xmm0
call fcn.0040c260
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
cmp dword [esi + 0x14], 8
jb 0x448f1a
mov esi, dword [esi]
push 1
push eax
push esi
call edi
test eax, eax
jne 0x4490a9
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
mov edx, eax
lea ecx, [ebp - 0x2a4]
call fcn.0044b870
push eax
mov edx, str.Error_calling_MoveFileEx:
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xa0]
call fcn.00418e50
add esp, 4
mov byte [ebp - 4], 0xa
mov edx, dword [ebp - 0x290]
cmp edx, 8
jb 0x448f99
mov ecx, dword [ebp - 0x2a4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x448f8f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4493b2
push edx
push ecx
call fcn.0046ec30
add esp, 8
xor eax, eax
mov dword [ebp - 0x294], 0
cmp dword [ebp - 0x8c], 8
mov edx, 0x7df
mov word [ebp - 0x2a4], ax
mov ecx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbutils.cpp
lea eax, [ebp - 0xa0]
mov dword [ebp - 0x290], 7
cmovae eax, dword [ebp - 0xa0]
push eax
call fcn.004413d0
mov byte [ebp - 4], 5
add esp, 4
mov edx, dword [ebp - 0x8c]
cmp edx, 8
jb 0x4490af
mov ecx, dword [ebp - 0xa0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x44901b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4493b7
push edx
push ecx
call fcn.0046ec30
add esp, 8
jmp 0x4490af
lea ecx, [ebp - 0x34c]
call fcn.0043ffc0
push eax
lea ecx, [ebp - 0x334]
mov byte [ebp - 4], 7
call fcn.0040beb0
lea ecx, [ebp - 0x28]
call fcn.00404cc0
movups xmm0, xmmword [ebp - 0x334]
movups xmmword [ebp - 0x28], xmm0
movq xmm0, qword [ebp - 0x324]
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x338]
movq qword [ebp - 0x18], xmm0
cmp edx, 8
jb 0x4490a9
mov ecx, dword [ebp - 0x34c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x44909f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4493bc
push edx
push ecx
call fcn.0046ec30
add esp, 8
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
sub esp, 0x1c
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x280]
push eax
call fcn.00412900
mov ecx, 0x4eca54
xchg dword [ecx], eax
mov eax, dword [0x4eca54]
cmp eax, 9
jne 0x44922a
push str.Download_of_ISvc_failed._Using_local_ISvc
mov edx, 0x7e7
mov ecx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbutils.cpp
call fcn.004413d0
mov ecx, dword [ebp - 0x288]
add esp, 4
add ecx, 0x18
mov byte [0x4ec9f0], 1
cmp dword [ecx + 0x14], 8
jb 0x449105
mov ecx, dword [ecx]
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
push 1
cmovae eax, dword [ebp - 0x40]
push ecx
push eax
call edi
test eax, eax
jne 0x449211
call esi
mov edx, eax
lea ecx, [ebp - 0x2bc]
call fcn.0044b870
push eax
mov edx, str.Error_calling_MoveFileEx:
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0xb8]
call fcn.00418e50
add esp, 4
mov byte [ebp - 4], 0xd
mov edx, dword [ebp - 0x2a8]
cmp edx, 8
jb 0x449189
mov ecx, dword [ebp - 0x2bc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x44917f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4493c1
push edx
push ecx
call fcn.0046ec30
add esp, 8
xor eax, eax
mov dword [ebp - 0x2ac], 0
cmp dword [ebp - 0xa4], 8
mov edx, 0x7ee
mov word [ebp - 0x2bc], ax
mov ecx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbutils.cpp
lea eax, [ebp - 0xb8]
mov dword [ebp - 0x2a8], 7
cmovae eax, dword [ebp - 0xb8]
push eax
call fcn.004413d0
mov byte [ebp - 4], 5
add esp, 4
mov edx, dword [ebp - 0xa4]
cmp edx, 8
jb 0x449211
mov ecx, dword [ebp - 0xb8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x449207
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4493c6
push edx
push ecx
call fcn.0046ec30
add esp, 8
sub esp, 0x1c
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x280]
push eax
call fcn.00412900
mov ecx, 0x4eca54
xchg dword [ecx], eax
mov eax, dword [0x4eca54]
test eax, eax
jne 0x449268
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
nop dword [eax + eax]
push 0x64
call edi
call fcn.004175e0
mov ecx, esi
inc esi
cmp ecx, 0x12c
jge 0x449258
test al, al
je 0x449240
push 0x3e8
call edi
call fcn.004175e0
test al, al
jne 0x449258
mov ecx, 0x4eca51
mov al, 1
xchg byte [ecx], al
mov edx, dword [ebp - 0x2c]
cmp edx, 8
jb 0x4492ab
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4492a1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4493cb
push edx
push ecx
call fcn.0046ec30
add esp, 8
mov edx, dword [ebp - 0x14]
xor eax, eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
cmp edx, 8
jb 0x4492f9
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4492ef
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4493d0
push edx
push ecx
call fcn.0046ec30
add esp, 8
mov edx, dword [ebp - 0x44]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp edx, 8
jb 0x449347
mov ecx, dword [ebp - 0x58]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x44933d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4493d5
push edx
push ecx
call fcn.0046ec30
add esp, 8
lea ecx, [ebp - 0x280]
call fcn.004122b0
mov edx, dword [ebp - 0x5c]
cmp edx, 8
jb 0x449388
mov ecx, dword [ebp - 0x70]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x44937e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4493da
push edx
push ecx
call fcn.0046ec30
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046e70f
mov esp, ebp
pop ebp
ret
call fcn.0048d4f0
call fcn.00489b7c
call fcn.00489b7c
call fcn.00489b7c
call fcn.00489b7c
call fcn.00489b7c
call fcn.00489b7c
call fcn.00489b7c
call fcn.00489b7c
call fcn.00489b7c
call fcn.00489b7c
call fcn.00489b7c
int3