Function at 0x446430
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x10b8
call fcn.00484320
cmp dword [ebp + 0x1c], 0
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, ecx
jne 0x446821
mov ecx, dword [ebp + 0xc]
cmp ecx, 0x110
jne 0x446478
sub esp, 0x10
mov ecx, esi
call fcn.004523b0
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
cmp ecx, 0x138
jne 0x4464c4
push 1
push edi
call dword [sym.imp.GDI32.dll_SetBkMode]
mov eax, dword [ebp + 0x14]
cmp eax, dword [esi + 0x20]
jne 0x446498
push 0x191514
jmp 0x4464a5
cmp eax, dword [esi + 0x14c]
jne 0x4464ac
push 0x7b706a
push edi
call dword [sym.imp.GDI32.dll_SetTextColor]
mov eax, dword [ebp + 0x18]
mov ecx, dword [esi + 0x150]
mov dword [eax], ecx
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
movzx edx, di
cmp ecx, 0x2b
jne 0x446562
lea eax, [edx - 0x4b1]
cmp eax, 3
ja case.default.0x4464db
jmp dword [eax*4 + 0x44682c]
push dword [esi + 0x150]
lea ecx, [esi + 0x24]
push dword [ebp + 0x14]
call fcn.004254b0
mov eax, dword [ebp + 0x18]
mov dword [eax], 1
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
push dword [esi + 0x150]
lea ecx, [esi + 0x7c]
push dword [ebp + 0x14]
call fcn.004254b0
mov eax, dword [ebp + 0x18]
mov dword [eax], 1
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
lea ecx, [esi + 0xd4]
jmp 0x44653e
lea ecx, [esi + 0x110]
push dword [esi + 0x150]
push dword [ebp + 0x14]
call fcn.004212f0
mov eax, dword [ebp + 0x18]
mov dword [eax], 1
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
mov eax, edx
cmp ecx, 0x14
jne 0x446585
sub esp, 0x10
mov ecx, esi
call fcn.00452f70
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
cmp ecx, 0x4e
jne 0x44662f
mov ecx, dword [ebp + 0x14]
mov eax, dword [ecx + 8]
cmp eax, 0xfffffffe
je 0x4465a2
cmp eax, 0xfffffffc
jne 0x446690
mov eax, dword [ecx]
cmp eax, dword [esi + 0x14c]
jne 0x446690
lea eax, [ecx + 0xc]
push 0x10b8
push eax
lea eax, [esp + 0x10]
push eax
call fcn.00485270
mov eax, dword [esp + 0x18]
add esp, 0xc
test eax, eax
jne 0x4465f9
push 1
push eax
push eax
push str.https:__www.malwarebytes.com_eula_
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
cmp eax, 1
jne 0x446690
push eax
push 0
push 0
push str.https:__www.malwarebytes.com_legal_privacy_policy
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
cmp ecx, 0x18
jne 0x4466a6
push str.Bifurcation
mov ecx, 0x4e27b0
call fcn.00450860
test edi, edi
je 0x446682
mov eax, dword [0x4e28f0]
test eax, eax
jne 0x44665e
push 0x4b1
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 1
push eax
push 0x28
push dword [esi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetLastActivePopup]
mov dword [0x4e28f0], eax
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
cmp ecx, 0x111
jne 0x446821
mov edi, 0x4b1
cmp di, dx
jne 0x446726
cmp byte [esi + 0xc0], 0
mov edi, dword [sym.imp.USER32.dll_InvalidateRect]
je 0x4466e3
mov eax, dword [esi + 0x80]
mov byte [esi + 0xc0], 0
test eax, eax
je 0x4466e3
push 1
push 0
push eax
call edi
cmp byte [esi + 0x68], 1
je 0x4466fb
mov eax, dword [esi + 0x28]
mov byte [esi + 0x68], 1
test eax, eax
je 0x4466fb
push 1
push 0
push eax
call edi
push 1
push dword [esi + 0x114]
call dword [sym.imp.USER32.dll_EnableWindow]
mov eax, dword [ebp + 0x18]
mov byte [0x4e2761], 0
mov dword [eax], 0
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
cmp ecx, 0x111
jne 0x446821
mov edi, 0x4b2
cmp di, dx
jne 0x4467a6
cmp byte [esi + 0x68], 0
mov edi, dword [sym.imp.USER32.dll_InvalidateRect]
je 0x44675a
mov eax, dword [esi + 0x28]
mov byte [esi + 0x68], 0
test eax, eax
je 0x44675a
push 1
push 0
push eax
call edi
cmp byte [esi + 0xc0], 1
je 0x44677b
mov eax, dword [esi + 0x80]
mov byte [esi + 0xc0], 1
test eax, eax
je 0x44677b
push 1
push 0
push eax
call edi
push 1
push dword [esi + 0x114]
call dword [sym.imp.USER32.dll_EnableWindow]
mov eax, dword [ebp + 0x18]
mov byte [0x4e2761], 1
mov dword [eax], 0
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
cmp ecx, 0x111
jne 0x446821
mov ecx, 0x4b3
cmp cx, dx
jne 0x4467ea
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetParent]
push 0
push 0x4b3
push 0x111
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
mov ecx, 0x4b4
cmp cx, ax
jne 0x446806
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetParent]
push 0
push 0x4b4
jmp 0x4467c8
mov ecx, 2
cmp cx, ax
jne 0x446821
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetParent]
push 0
push 0
push 0x10
jmp 0x4467cd
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x18