Function at 0x448e10
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b3df8
mov eax, dword fs:[0]
push eax
sub esp, 0x340
mov eax, dword [0x4e706c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x288], ecx
push 0x4ecba4
push 0x41a1b0
push 0x4ecbac
call fcn.0046b5e3
add esp, 0xc
test eax, eax
je 0x4497a3
xor eax, eax
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 7
mov word [ebp - 0x70], ax
lea ecx, [ebp - 0x280]
mov dword [ebp - 4], eax
call fcn.004120f0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1d0]
mov al, byte [0x4eca7f]
cmp dword [0x4e7d8c], 8
push dword [0x4e7d88]
mov byte [ebp - 0x27b], al
mov eax, 0x4e7d78
cmovae eax, dword [0x4e7d78]
push eax
call fcn.00407990
mov ecx, dword [0x4e7da0]
test ecx, ecx
je 0x448ee2
cmp dword [0x4e7da4], 8
mov eax, 0x4e7d90
push ecx
cmovae eax, dword [0x4e7d90]
lea ecx, [ebp - 0x1b8]
push eax
call fcn.00407990
cmp dword [0x4e7c9c], 8
lea ecx, [ebp - 0x218]
push dword [0x4e7c98]
mov eax, 0x4e7c88
cmovae eax, dword [0x4e7c88]
push eax
call fcn.00407990
push 0x4e7d30
lea ecx, [ebp - 0x58]
call fcn.0040bf20
mov byte [ebp - 4], 2
lea eax, [ebp - 0x58]
cmp dword [ebp - 0x44], 8
lea ecx, [ebp - 0x260]
push dword [ebp - 0x48]
cmovae eax, dword [ebp - 0x58]
push eax
call fcn.00407990
mov esi, dword [ebp - 0x44]
lea ecx, [ebp - 0x58]
mov edi, dword [ebp - 0x58]
cmp esi, 8
mov eax, dword [ebp - 0x48]
cmovae ecx, edi
cmp eax, 6
jne 0x448f5e
push eax
mov edx, str.MDAM_B
call fcn.004197c0
add esp, 4
test eax, eax
je 0x448f7e
mov eax, dword [ebp - 0x48]
cmp esi, 8
lea ecx, [ebp - 0x58]
cmovae ecx, edi
cmp eax, 6
jne 0x448f8a
push eax
mov edx, str.MBRW_B
call fcn.004197c0
add esp, 4
test eax, eax
jne 0x448f87
push 8
push str.business
jmp 0x448fba
mov eax, dword [ebp - 0x48]
cmp esi, 8
lea ecx, [ebp - 0x58]
cmovae ecx, edi
cmp eax, 8
jne 0x448fb3
push eax
mov edx, str.NCEP_WIN
call fcn.004197c0
add esp, 4
test eax, eax
jne 0x448fb3
push 6
push str.common
jmp 0x448fba
push 8
push 0x4cfa40
lea ecx, [ebp - 0x70]
call fcn.00407990
cmp dword [ebp - 0x5c], 8
lea eax, [ebp - 0x70]
push dword [ebp - 0x60]
cmovae eax, dword [ebp - 0x70]
lea ecx, [ebp - 0x248]
push eax
call fcn.00407990
cmp dword [0x4e7ef4], 8
lea ecx, [ebp - 0x230]
push dword [0x4e7ef0]
mov eax, 0x4e7ee0
cmovae eax, dword [0x4e7ee0]
push eax
call fcn.00407990
cmp dword [0x4e7d44], 8
mov eax, 0x4e7d30
push str.MBRW_C
cmovae eax, dword [0x4e7d30]
push eax
call fcn.0048d2a7
add esp, 8
test eax, eax
je 0x44904b
cmp dword [0x4e7d44], 8
mov eax, 0x4e7d30
push str.MBRW_B
cmovae eax, dword [0x4e7d30]
push eax
call fcn.0048d2a7
add esp, 8
test eax, eax
jne 0x4490c8
push str.MalwarebytesMB3Service
mov edx, 0x4e7ee0
lea ecx, [ebp - 0x88]
call fcn.0043bcd0
add esp, 4
mov byte [ebp - 4], 3
lea eax, [ebp - 0x88]
cmp dword [ebp - 0x74], 8
lea ecx, [ebp - 0x200]
push dword [ebp - 0x78]
cmovae eax, dword [ebp - 0x88]
push eax
call fcn.00407990
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x74]
cmp edx, 8
jb 0x4490c8
mov ecx, dword [ebp - 0x88]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4490be
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4497a8
push edx
push ecx
call fcn.0046f0d0
add esp, 8
cmp dword [0x4e7d74], 8
lea ecx, [ebp - 0x1e8]
push dword [0x4e7d70]
mov eax, 0x4e7d60
cmovae eax, dword [0x4e7d60]
push eax
call fcn.00407990
cmp dword [0x4e7e04], 8
lea ecx, [ebp - 0x158]
push dword [0x4e7e00]
mov eax, 0x4e7df0
cmovae eax, dword [0x4e7df0]
push eax
call fcn.00407990
mov al, byte [0x4eca76]
mov byte [ebp - 0x128], al
xor eax, eax
mov byte [ebp - 0x125], 1
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
mov byte [ebp - 4], 5
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
cmp byte [0x4eca70], al
je 0x4491ed
mov edi, dword [0x4e7e7c]
mov ecx, 0x4e7e68
mov esi, dword [0x4e7e78]
cmp edi, 8
cmovae ecx, dword [0x4e7e68]
cmp esi, 2
jne 0x4491c9
push esi
mov edx, 0x4d00d4
call fcn.004197c0
add esp, 4
test eax, eax
jne 0x4491c9
push 0x4e7c88
lea ecx, [ebp - 0x2ec]
call fcn.0040bf20
lea ecx, [ebp - 0x28]
call fcn.00404d30
movups xmm0, xmmword [ebp - 0x2ec]
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
movups xmmword [ebp - 0x28], xmm0
movq xmm0, qword [ebp - 0x2dc]
movq qword [ebp - 0x18], xmm0
jmp 0x4494a9
cmp edi, 8
lea ecx, [ebp - 0x28]
mov eax, 0x4e7e68
cmovae eax, dword [0x4e7e68]
push esi
push eax
call fcn.00407990
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x4494a9
mov esi, dword [ebp - 0x288]
lea ecx, [ebp - 0x2d4]
mov byte [ebp - 0x28c], 0
add esi, 0x18
push dword [ebp - 0x28c]
mov edx, esi
call fcn.00418f10
add esp, 4
lea ecx, [ebp - 0x2d4]
mov byte [ebp - 4], 6
call fcn.0044bd70
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x2c0]
mov byte [ebp - 0x281], al
cmp edx, 8
jb 0x449272
mov ecx, dword [ebp - 0x2d4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x449262
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4497ad
push edx
push ecx
call fcn.0046f0d0
mov al, byte [ebp - 0x281]
add esp, 8
test al, al
je 0x44942a
push 0x4e7c88
lea ecx, [ebp - 0x304]
mov byte [0x4eca70], 1
call fcn.0040bf20
lea ecx, [ebp - 0x28]
call fcn.00404d30
movups xmm0, xmmword [ebp - 0x304]
push str.Rename_local_ISvc_and_download_latest
mov edx, 0x7d7
mov ecx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbutils.cpp
movups xmmword [ebp - 0x28], xmm0
movq xmm0, qword [ebp - 0x2f4]
movq qword [ebp - 0x18], xmm0
call fcn.004417b0
add esp, 4
lea ecx, [ebp - 0x31c]
push 0x4e7c88
call fcn.0040bf20
lea ecx, [ebp - 0x40]
call fcn.00404d30
movups xmm0, xmmword [ebp - 0x31c]
push 0x1d
push str.MBAMInstallerService_old.exe
movups xmmword [ebp - 0x40], xmm0
lea ecx, [ebp - 0x40]
movq xmm0, qword [ebp - 0x30c]
movq qword [ebp - 0x30], xmm0
call fcn.0040c2d0
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
cmp dword [esi + 0x14], 8
jb 0x44931a
mov esi, dword [esi]
push 1
push eax
push esi
call edi
test eax, eax
jne 0x4494a9
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
mov edx, eax
lea ecx, [ebp - 0x2a4]
call fcn.0044bc60
push eax
mov edx, str.Error_calling_MoveFileEx:
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xa0]
call fcn.00418ea0
add esp, 4
mov byte [ebp - 4], 0xa
mov edx, dword [ebp - 0x290]
cmp edx, 8
jb 0x449399
mov ecx, dword [ebp - 0x2a4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x44938f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4497b2
push edx
push ecx
call fcn.0046f0d0
add esp, 8
xor eax, eax
mov dword [ebp - 0x294], 0
cmp dword [ebp - 0x8c], 8
mov edx, 0x7df
mov word [ebp - 0x2a4], ax
mov ecx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbutils.cpp
lea eax, [ebp - 0xa0]
mov dword [ebp - 0x290], 7
cmovae eax, dword [ebp - 0xa0]
push eax
call fcn.004417b0
mov byte [ebp - 4], 5
add esp, 4
mov edx, dword [ebp - 0x8c]
cmp edx, 8
jb 0x4494af
mov ecx, dword [ebp - 0xa0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x44941b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4497b7
push edx
push ecx
call fcn.0046f0d0
add esp, 8
jmp 0x4494af
lea ecx, [ebp - 0x34c]
call fcn.004403a0
push eax
lea ecx, [ebp - 0x334]
mov byte [ebp - 4], 7
call fcn.0040bf20
lea ecx, [ebp - 0x28]
call fcn.00404d30
movups xmm0, xmmword [ebp - 0x334]
movups xmmword [ebp - 0x28], xmm0
movq xmm0, qword [ebp - 0x324]
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x338]
movq qword [ebp - 0x18], xmm0
cmp edx, 8
jb 0x4494a9
mov ecx, dword [ebp - 0x34c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x44949f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4497bc
push edx
push ecx
call fcn.0046f0d0
add esp, 8
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
sub esp, 0x1c
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x280]
push eax
call fcn.00412970
mov ecx, 0x4ecad4
xchg dword [ecx], eax
mov eax, dword [0x4ecad4]
cmp eax, 9
jne 0x44962a
push str.Download_of_ISvc_failed._Using_local_ISvc
mov edx, 0x7e7
mov ecx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbutils.cpp
call fcn.004417b0
mov ecx, dword [ebp - 0x288]
add esp, 4
add ecx, 0x18
mov byte [0x4eca70], 1
cmp dword [ecx + 0x14], 8
jb 0x449505
mov ecx, dword [ecx]
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
push 1
cmovae eax, dword [ebp - 0x40]
push ecx
push eax
call edi
test eax, eax
jne 0x449611
call esi
mov edx, eax
lea ecx, [ebp - 0x2bc]
call fcn.0044bc60
push eax
mov edx, str.Error_calling_MoveFileEx:
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0xb8]
call fcn.00418ea0
add esp, 4
mov byte [ebp - 4], 0xd
mov edx, dword [ebp - 0x2a8]
cmp edx, 8
jb 0x449589
mov ecx, dword [ebp - 0x2bc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x44957f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4497c1
push edx
push ecx
call fcn.0046f0d0
add esp, 8
xor eax, eax
mov dword [ebp - 0x2ac], 0
cmp dword [ebp - 0xa4], 8
mov edx, 0x7ee
mov word [ebp - 0x2bc], ax
mov ecx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetupmbutils.cpp
lea eax, [ebp - 0xb8]
mov dword [ebp - 0x2a8], 7
cmovae eax, dword [ebp - 0xb8]
push eax
call fcn.004417b0
mov byte [ebp - 4], 5
add esp, 4
mov edx, dword [ebp - 0xa4]
cmp edx, 8
jb 0x449611
mov ecx, dword [ebp - 0xb8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x449607
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4497c6
push edx
push ecx
call fcn.0046f0d0
add esp, 8
sub esp, 0x1c
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x280]
push eax
call fcn.00412970
mov ecx, 0x4ecad4
xchg dword [ecx], eax
mov eax, dword [0x4ecad4]
test eax, eax
jne 0x449668
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
nop dword [eax + eax]
push 0x64
call edi
call fcn.00417640
mov ecx, esi
inc esi
cmp ecx, 0x12c
jge 0x449658
test al, al
je 0x449640
push 0x3e8
call edi
call fcn.00417640
test al, al
jne 0x449658
mov ecx, 0x4ecad1
mov al, 1
xchg byte [ecx], al
mov edx, dword [ebp - 0x2c]
cmp edx, 8
jb 0x4496ab
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4496a1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4497cb
push edx
push ecx
call fcn.0046f0d0
add esp, 8
mov edx, dword [ebp - 0x14]
xor eax, eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
cmp edx, 8
jb 0x4496f9
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4496ef
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4497d0
push edx
push ecx
call fcn.0046f0d0
add esp, 8
mov edx, dword [ebp - 0x44]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp edx, 8
jb 0x449747
mov ecx, dword [ebp - 0x58]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x44973d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4497d5
push edx
push ecx
call fcn.0046f0d0
add esp, 8
lea ecx, [ebp - 0x280]
call fcn.00412320
mov edx, dword [ebp - 0x5c]
cmp edx, 8
jb 0x449788
mov ecx, dword [ebp - 0x70]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x44977e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4497da
push edx
push ecx
call fcn.0046f0d0
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046ebaf
mov esp, ebp
pop ebp
ret
call fcn.0048d9d0
call fcn.0048a05c
call fcn.0048a05c
call fcn.0048a05c
call fcn.0048a05c
call fcn.0048a05c
call fcn.0048a05c
call fcn.0048a05c
call fcn.0048a05c
call fcn.0048a05c
call fcn.0048a05c
call fcn.0048a05c
int3