Function at 0x4467b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x10b8
call fcn.00491490
cmp dword [ebp + 0x1c], 0
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, ecx
jne 0x446ba1
mov ecx, dword [ebp + 0xc]
cmp ecx, 0x110
jne 0x4467f8
sub esp, 0x10
mov ecx, esi
call fcn.00452750
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
cmp ecx, 0x138
jne 0x446844
push 1
push edi
call dword [sym.imp.GDI32.dll_SetBkMode]
mov eax, dword [ebp + 0x14]
cmp eax, dword [esi + 0x20]
jne 0x446818
push 0x191514
jmp 0x446825
cmp eax, dword [esi + 0x14c]
jne 0x44682c
push 0x7b706a
push edi
call dword [sym.imp.GDI32.dll_SetTextColor]
mov eax, dword [ebp + 0x18]
mov ecx, dword [esi + 0x150]
mov dword [eax], ecx
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
movzx edx, di
cmp ecx, 0x2b
jne 0x4468e2
lea eax, [edx - 0x4b1]
cmp eax, 3
ja case.default.0x44685b
jmp dword [eax*4 + 0x446bac]
push dword [esi + 0x150]
lea ecx, [esi + 0x24]
push dword [ebp + 0x14]
call fcn.00425650
mov eax, dword [ebp + 0x18]
mov dword [eax], 1
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
push dword [esi + 0x150]
lea ecx, [esi + 0x7c]
push dword [ebp + 0x14]
call fcn.00425650
mov eax, dword [ebp + 0x18]
mov dword [eax], 1
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
lea ecx, [esi + 0xd4]
jmp 0x4468be
lea ecx, [esi + 0x110]
push dword [esi + 0x150]
push dword [ebp + 0x14]
call fcn.00421490
mov eax, dword [ebp + 0x18]
mov dword [eax], 1
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
mov eax, edx
cmp ecx, 0x14
jne 0x446905
sub esp, 0x10
mov ecx, esi
call fcn.00453310
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
cmp ecx, 0x4e
jne 0x4469af
mov ecx, dword [ebp + 0x14]
mov eax, dword [ecx + 8]
cmp eax, 0xfffffffe
je 0x446922
cmp eax, 0xfffffffc
jne 0x446a10
mov eax, dword [ecx]
cmp eax, dword [esi + 0x14c]
jne 0x446a10
lea eax, [ecx + 0xc]
push 0x10b8
push eax
lea eax, [esp + 0x10]
push eax
call fcn.004923e0
mov eax, dword [esp + 0x18]
add esp, 0xc
test eax, eax
jne 0x446979
push 1
push eax
push eax
push str.https:__www.malwarebytes.com_eula_
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
cmp eax, 1
jne 0x446a10
push eax
push 0
push 0
push str.https:__www.malwarebytes.com_legal_privacy_policy
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
cmp ecx, 0x18
jne 0x446a26
push str.Bifurcation
mov ecx, 0x50f99c
call fcn.00450c00
test edi, edi
je 0x446a02
mov eax, dword [0x50fae0]
test eax, eax
jne 0x4469de
push 0x4b1
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 1
push eax
push 0x28
push dword [esi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetLastActivePopup]
mov dword [0x50fae0], eax
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
cmp ecx, 0x111
jne 0x446ba1
mov edi, 0x4b1
cmp di, dx
jne 0x446aa6
cmp byte [esi + 0xc0], 0
mov edi, dword [sym.imp.USER32.dll_InvalidateRect]
je 0x446a63
mov eax, dword [esi + 0x80]
mov byte [esi + 0xc0], 0
test eax, eax
je 0x446a63
push 1
push 0
push eax
call edi
cmp byte [esi + 0x68], 1
je 0x446a7b
mov eax, dword [esi + 0x28]
mov byte [esi + 0x68], 1
test eax, eax
je 0x446a7b
push 1
push 0
push eax
call edi
push 1
push dword [esi + 0x114]
call dword [sym.imp.USER32.dll_EnableWindow]
mov eax, dword [ebp + 0x18]
mov byte [0x50f94c], 0
mov dword [eax], 0
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
cmp ecx, 0x111
jne 0x446ba1
mov edi, 0x4b2
cmp di, dx
jne 0x446b26
cmp byte [esi + 0x68], 0
mov edi, dword [sym.imp.USER32.dll_InvalidateRect]
je 0x446ada
mov eax, dword [esi + 0x28]
mov byte [esi + 0x68], 0
test eax, eax
je 0x446ada
push 1
push 0
push eax
call edi
cmp byte [esi + 0xc0], 1
je 0x446afb
mov eax, dword [esi + 0x80]
mov byte [esi + 0xc0], 1
test eax, eax
je 0x446afb
push 1
push 0
push eax
call edi
push 1
push dword [esi + 0x114]
call dword [sym.imp.USER32.dll_EnableWindow]
mov eax, dword [ebp + 0x18]
mov byte [0x50f94c], 1
mov dword [eax], 0
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
cmp ecx, 0x111
jne 0x446ba1
mov ecx, 0x4b3
cmp cx, dx
jne 0x446b6a
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetParent]
push 0
push 0x4b3
push 0x111
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
mov ecx, 0x4b4
cmp cx, ax
jne 0x446b86
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetParent]
push 0
push 0x4b4
jmp 0x446b48
mov ecx, 2
cmp cx, ax
jne 0x446ba1
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetParent]
push 0
push 0
push 0x10
jmp 0x446b4d
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x18