Function at 0x411c10
Capabilities:
Hide graphical window
Print debug messages
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x42bb38
push 0x4179a0
mov eax, dword fs:[0]
push eax
sub esp, 0x220
mov eax, dword [section..data]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x230], 1
mov dword [ebp - 4], 0
mov dword [ebp - 4], 1
cmp dword [0x42f3e4], 1
ja 0x411d13
mov dword [0x42e1d4], str.Malwarebytes_Anti_Exploit_Premium
cmp dword [0x42f3d8], 1
mov eax, str.Running
je 0x411c9f
mov eax, str.Stopped
push eax
push str.Malwarebytes_Anti_Exploit_Premium
push str._s____s
push 0x4348b0
call fcn.00412960
add esp, 0x10
push 1
push 0x8026
push 0x801b
push dword [0x433624]
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
call esi
push eax
call esi
push eax
mov ebx, dword [sym.imp.USER32.dll_EnableWindow]
call ebx
push 1
push 0x8027
push 0x801b
push dword [0x433624]
call esi
push eax
call esi
push eax
call ebx
push 1
push 0x8028
push 0x801b
push dword [0x433624]
call esi
push eax
call esi
push eax
call ebx
jmp 0x411d1f
mov ebx, dword [sym.imp.USER32.dll_EnableWindow]
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push dword [0x42e1d4]
push dword [0x43361c]
mov edi, dword [sym.imp.USER32.dll_SetWindowTextW]
call edi
mov eax, dword [0x433618]
test eax, eax
je 0x411d45
push dword [0x42e1d4]
push eax
call edi
cmp dword [0x434898], 0x3a8
jne 0x411d5e
push 0x434898
push 1
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
xor eax, eax
cmp dword [0x434888], eax
setne al
push eax
push 0x8012
push 0x800e
push dword [0x433624]
call esi
push eax
call esi
push eax
call ebx
cmp dword [0x42f3e4], 0
jne 0x411e03
push str.beta_version
lea eax, [ebp - 0x224]
push eax
call fcn.004029c0
add esp, 8
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
lea eax, [ebp - 0x224]
push eax
push 0
push 0xc
push 0x802f
push 0x802c
push dword [0x433624]
call esi
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 5
push 0x802c
push dword [0x433624]
call esi
push eax
call edi
mov dword [ebp - 4], 0
call fcn.00411fdf
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
jmp 0x412093
lea eax, [ebp - 0x228]
push eax
push 1
push 0
push str.SOFTWAREMalwarebytes_Anti_Exploit
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x411ecc
lea edi, [eax + 0x1e]
push 0x1000a
call fcn.00412ac8
add esp, 4
mov esi, eax
test esi, esi
jne 0x411e56
push str.Memory_allocation_error_in_log_file_n
call fcn.00412f3c
add esp, 4
push str.Memory_allocation_error_in_log_file_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x411eb2
push 0x4283c8
push 0xffff
push esi
call fcn.00412a74
add esp, 0xc
push edi
test eax, eax
jle 0x411e91
mov byte [esi + 0xffff], 0
push esi
push str.SetLicenseUI
push 1
mov edx, 0x3a2
mov ecx, str...MainGui.cpp
call fcn.00401280
add esp, 0x10
jmp 0x411ea9
push str.Error__d_in_swprintf_s_n
call fcn.00412f3c
add esp, 8
push str.Error_in_swprintf_s_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push esi
call fcn.00412a90
add esp, 4
push 0xfffffffffffffffe
lea eax, [ebp - 0x10]
push eax
push section..data
call fcn.0041dd90
add esp, 0xc
mov eax, edi
jmp 0x412093
mov dword [ebp - 0x22c], 0x208
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x230]
push eax
push 0
push 0x42aef4
push dword [ebp - 0x228]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x411f5e
lea edi, [eax + 0x1e]
push 0x1000a
call fcn.00412ac8
add esp, 4
mov esi, eax
test esi, esi
je 0x411e3c
push 0x4283c8
push 0xffff
push esi
call fcn.00412a74
add esp, 0xc
push edi
test eax, eax
jle 0x411e91
mov byte [esi + 0xffff], 0
push esi
push str.SetLicenseUI
push 1
mov edx, 0x3a7
mov ecx, str...MainGui.cpp
call fcn.00401280
add esp, 0x10
jmp 0x411ea9
cmp dword [0x42f3e4], 1
jne 0x411d9f
push 0
push 0x8007
push dword [0x43361c]
call esi
push eax
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
call edi
push 0
push 0x8007
push dword [0x43361c]
call esi
push eax
call ebx
push 0
push 0x8008
push dword [0x43361c]
call esi
push eax
call edi
push 0
push 0x8008
push dword [0x43361c]
call esi
push eax
call ebx
push 0x4002
push 0x17c
push 0x1f4
push 0
push 0
push 0
push dword [0x43361c]
call dword [sym.imp.USER32.dll_SetWindowPos]
jmp 0x411da5
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0041297c
mov esp, ebp
pop ebp
ret