Function at 0x4134e0
Capabilities:
Create process on windows
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5af4a8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x6670c8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
movzx edi, word [ebp + 0xc]
lea ecx, [ebp - 0x14]
mov edx, edi
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
call fcn.0043bfd0
mov dword [ebp - 4], 0
mov edx, 4
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ecx - 0xc]
cmp ecx, edx
mov eax, ecx
cmovge eax, edx
mov dword [ebp - 0x1c], eax
test eax, eax
jle 0x413597
mov ebx, ecx
sub ebx, eax
mov eax, dword [ebp - 0x14]
cmp dword [eax - 4], 1
lea edx, [ebx + 1]
jle 0x413565
push ecx
lea ecx, [ebp - 0x14]
call fcn.00416320
lea edx, [ebx + 1]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1c]
push edx
add ecx, eax
push ecx
push edx
push eax
call fcn.00417fa0
add esp, 0x10
test ebx, ebx
js 0x413a3c
mov eax, dword [ebp - 0x14]
cmp ebx, dword [eax - 8]
jg 0x413a3c
mov dword [eax - 0xc], ebx
mov eax, dword [ebp - 0x14]
mov byte [ebx + eax], 0
mov ecx, dword [ebp - 0x14]
mov ebx, dword [0x6705d0]
add ecx, 0xfffffff0
add ebx, 0xfffffff0
cmp ecx, ebx
je 0x413602
mov eax, dword [ebx + 0xc]
shr eax, 0x1f
test al, al
jne 0x4135f2
mov eax, dword [ecx]
cmp eax, dword [ebx]
jne 0x4135f2
call fcn.004162c0
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
lea edx, [ebx + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4135e4
mov edx, dword [ebx]
push ebx
mov ecx, dword [edx]
mov eax, dword [ecx + 4]
mov ecx, edx
call eax
mov eax, dword [ebp - 0x1c]
add eax, 0x10
mov byte [ebp - 4], 0
mov dword [0x6705d0], eax
jmp 0x413602
push dword [ecx + 4]
mov ecx, 0x6705d0
push dword [ebp - 0x14]
call fcn.004163e0
cmp edi, 0x515
ja 0x413736
je case.0x4138be.1904
sub edi, 0x3ea
cmp edi, 0xcf
ja case.0x4138be.1808
movzx eax, byte [edi + 0x413a6c]
jmp dword [eax*4 + 0x413a48]
push str.opening_the_KB_article_about_uninstalling_and_reinstalling_using_the_support_tool
mov edx, 0xe7
mov ecx, 0x643358
call fcn.00439030
push str.support
mov edx, str.https:__support.malwarebytes.com_hc_en_us_articles_360038522234_Repair_Malwarebytes_for_Windows_with_the_Malwarebytes_Support_Tool
mov ecx, str.uninstall.retention.start.repair
call fcn.00440500
add esp, 8
jmp 0x4139f1
call fcn.004407f0
mov ecx, esi
test al, al
je 0x41367b
push 2
call fcn.00414630
jmp case.0x4138be.1808
push 3
call fcn.00414630
jmp case.0x4138be.1808
call fcn.004406b0
mov ecx, 0x643358
test al, al
je 0x4136c0
push str.opening_the_support_team_page
mov edx, 0xfd
call fcn.00439030
push str.support
mov edx, str.https:__support.malwarebytes.com_hc_en_us_requests_new
mov ecx, str.uninstall.retention.start.gethelp
call fcn.00440500
add esp, 8
jmp 0x4139f1
push str.opening_the_support_forum_page
mov edx, 0x104
call fcn.00439030
push str.support
mov edx, str.https:__forums.malwarebytes.com_forum_41_malwarebytes_for_windows_support_forum_
mov ecx, str.uninstall.retention.start.askquestion
call fcn.00440500
add esp, 8
jmp 0x4139f1
push 0
mov ecx, esi
call fcn.00414630
jmp case.0x4138be.1808
push 5
mov ecx, esi
call fcn.00414630
jmp case.0x4138be.1808
push 8
mov ecx, esi
call fcn.00414630
jmp case.0x4138be.1808
push 4
mov ecx, esi
call fcn.00414630
call fcn.004401b0
jmp case.0x4138be.1808
push 6
mov ecx, esi
call fcn.00414630
jmp case.0x4138be.1808
cmp edi, 0x6a6
ja 0x4138a5
je 0x41389b
cmp edi, 0x588
ja 0x4137a0
je 0x413791
sub edi, 0x51b
je 0x413783
sub edi, 1
je case.0x41362d.1121
sub edi, 0x5d
jne case.0x4138be.1808
call fcn.004406b0
test al, al
je 0x413664
push 1
mov ecx, esi
call fcn.00414630
jmp case.0x4138be.1808
push 7
mov ecx, esi
call fcn.00414630
jmp case.0x4138be.1808
push str.skipping_the_survey_and_running_mbuns.exe__nosurvey__uninstall
mov edx, 0x146
jmp 0x4139b6
sub edi, 0x589
je 0x4137ff
sub edi, 0x55
je 0x4137f8
sub edi, 0x64
jne case.0x4138be.1808
mov edx, 0x17a
push str.running_assistant.exe___showdashboard
mov ecx, 0x643358
call fcn.00439030
add esp, 4
push 1
push dword [0x67058c]
push str.__showdashboard
push str.assistant.exe
push 0x643dd0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov byte [0x6704ed], 1
jmp 0x4139f1
mov edx, 0x172
jmp 0x4137bb
movzx eax, word [esi + 0x852]
mov ecx, 0x57b
cmp ax, cx
jne 0x41388c
push str.trial
push dword [0x6705a4]
call fcn.0058de24
add esp, 8
test eax, eax
je 0x413867
push str.free
push dword [0x6705a4]
call fcn.0058de24
add esp, 8
test eax, eax
je 0x413867
push str.trial_expired
push dword [0x6705a4]
call fcn.0058de24
add esp, 8
test eax, eax
je 0x413867
call fcn.00418020
test al, al
je 0x41388c
call fcn.004406b0
test al, al
jne 0x41388c
push str.showing_discount_offer__salvage__screen
mov edx, 0x15d
mov ecx, 0x643358
call fcn.00439030
add esp, 4
mov ecx, esi
push 0xa
call fcn.00414630
jmp case.0x4138be.1808
push str.running_mbuns.exe__nosurvey__uninstall
mov edx, 0x163
jmp 0x4139b6
mov edx, 0x182
jmp 0x4137bb
sub edi, 0x70e
cmp edi, 0xc7
ja case.0x4138be.1808
movzx eax, byte [edi + 0x413b58]
jmp dword [eax*4 + 0x413b3c]
push str.setting_license_to_Free
mov edx, 0x18a
mov ecx, 0x643358
call fcn.00439030
add esp, 4
call fcn.00414770
test al, al
jne 0x4138f6
push 0x10
push 0x64355c
push str.Unable_to_connect_to_service
jmp 0x4139e8
mov edx, 0x195
jmp 0x4137bb
push str.opening_the_KB_article_about_reactivating_a_license
mov edx, 0x19b
mov ecx, 0x643358
call fcn.00439030
push 0x6437f0
mov edx, str.https:__support.malwarebytes.com_hc_en_us_articles_360038479154_Activate_Premium_features_on_Malwarebytes_for_Windows
mov ecx, str.uninstall.retention.switchtofree.learn
call fcn.00440500
add esp, 8
jmp 0x4139f1
push str.opening_the_KB_article_about_Malwarebytes_Security_and_other_antivirus_software
mov edx, 0x1a2
mov ecx, 0x643358
call fcn.00439030
push 0x6437f0
mov edx, str.https:__support.malwarebytes.com_hc_en_us_articles_5479973703571
mov ecx, str.uninstall.retention.rebuttal.keep
call fcn.00440500
add esp, 8
jmp 0x4139f1
call fcn.00418020
mov ecx, 0x643358
test al, al
je 0x413984
push str.opening_the_link_for_the_Teams_discount_offer
mov edx, 0x1ae
call fcn.00439030
mov edx, str.https:__links.malwarebytes.com_uninstall_getoffer_teams
jmp 0x413998
push str.opening_the_link_for_the_consumer_discount_offer
mov edx, 0x1b3
call fcn.00439030
mov edx, str.https:__links.malwarebytes.com_uninstall_getoffer
push str.purchase
mov ecx, str.uninstall.retention.salvage.getoffer
call fcn.00440500
add esp, 8
jmp 0x4139f1
push str.skipping_the_discount_offer_and_running_mbuns.exe__nosurvey__uninstall
mov edx, 0x1b9
mov ecx, 0x643358
call fcn.00439030
add esp, 4
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
xor dl, dl
lea ecx, [ebp - 0x18]
call fcn.0043f5d0
test al, al
jne 0x4139f1
push 0x10
push 0x64355c
push str.Unable_to_continue_uninstall
push dword [esi + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
mov dword [ebp - 4], 2
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x413a1c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0057c5eb
mov esp, ebp
pop ebp
ret 0x10
push 0x80070057
call fcn.00403f50
nop
xor al, 0x36
inc ecx
add byte [eax + 0x37], ch
inc ecx
add byte [edi - 0x14ffbeca], al
inc ecx
add cl, bh
inc ecx
add byte [edi], al
aaa
inc ecx
add byte [0x28004137], dl
aaa
inc ecx
add dl, bh
cmp dword [ecx], eax
add byte [ecx], al
or byte [eax], cl
add cl, byte [eax]
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [ebx], al
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax + 134744070], al
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
add eax, dword [esi]
or byte [eax], cl
or byte [eax], cl
or byte [edi], al
add eax, case.0x4138be.1806
add byte [ecx], bh
inc ecx
add byte [eax], dh
cmp dword [ecx], eax
jmp 0x413b80
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
add al, byte [ebx]
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
add al, 5