Function at 0x406120
Capabilities:
Create process on windows
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47f92d
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x4a1500]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
movzx edi, word [ebp + 0xc]
lea ecx, [ebp - 0x14]
mov edx, edi
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
call fcn.00431ef0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x14]
mov ebx, dword [eax - 0xc]
mov eax, 4
mov dword [ebp - 0x1c], eax
cmp ebx, eax
jge 0x40618b
mov eax, ebx
mov dword [ebp - 0x1c], eax
test eax, eax
jle 0x406208
sub ebx, eax
mov eax, dword [ebp - 0x14]
cmp dword [eax - 4], 1
lea edx, [ebx + 1]
jle 0x4061a7
push dword [eax - 0xc]
lea ecx, [ebp - 0x14]
call fcn.004093b0
lea edx, [ebx + 1]
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x1c]
test edx, edx
je 0x4061df
cmp dword [ebp - 0x14], 0
jne 0x4061ce
call fcn.0045e66f
mov dword [eax], 0x16
call fcn.0045e571
mov eax, 0x16
jmp 0x4061e1
test eax, eax
je 0x4061b7
push edx
push eax
push dword [ebp - 0x14]
call fcn.00454290
add esp, 0xc
xor eax, eax
push eax
call fcn.00404bf0
add esp, 4
test ebx, ebx
js 0x406798
mov eax, dword [ebp - 0x14]
cmp ebx, dword [eax - 8]
jg 0x406798
mov dword [eax - 0xc], ebx
mov eax, dword [ebp - 0x14]
mov byte [ebx + eax], 0
mov ecx, dword [ebp - 0x14]
mov ebx, dword [0x4a5c84]
add ecx, 0xfffffff0
add ebx, 0xfffffff0
cmp ecx, ebx
je 0x406264
cmp dword [ebx + 0xc], 0
jl 0x406253
mov eax, dword [ecx]
cmp eax, dword [ebx]
jne 0x406253
call fcn.004092e0
mov dword [ebp - 0x1c], eax
lea edx, [ebx + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x406249
mov ecx, dword [ebx]
push ebx
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x1c]
add eax, 0x10
mov dword [0x4a5c84], eax
jmp 0x406264
mov eax, dword [ebp - 0x14]
mov ecx, 0x4a5c84
push dword [eax - 0xc]
push eax
call fcn.00409460
cmp edi, 0x515
ja 0x4063d6
je case.0x406584.1904
sub edi, 0x3ea
cmp edi, 0xcf
ja case.0x406584.1808
movzx eax, byte [edi + 0x4067c8]
jmp dword [eax*4 + 0x4067a4]
push 0x48e858
mov edx, 0xe7
mov ecx, 0x48e900
call fcn.0042ed60
add esp, 4
push 1
push 0
push 0
push str.https:__support.malwarebytes.com_hc_en_us_articles_360038522234_Repair_Malwarebytes_for_Windows_with_the_Malwarebytes_Support_Tool
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push str.support
mov edx, str.https:__support.malwarebytes.com_hc_en_us_articles_360038522234_Repair_Malwarebytes_for_Windows_with_the_Malwarebytes_Support_Tool
mov byte [0x4a5ba0], 1
mov ecx, str.uninstall.retention.start.repair
call fcn.004361f0
add esp, 4
jmp 0x406754
call fcn.00436d90
movzx eax, al
mov ecx, esi
neg eax
sbb eax, eax
add eax, 3
push eax
call fcn.00407380
jmp case.0x406584.1808
call fcn.00436c20
mov ecx, 0x48e900
test al, al
je 0x40635f
push str.opening_the_support_team_page
mov edx, 0xfd
call fcn.0042ed60
add esp, 4
push 1
push 0
push 0
push str.https:__support.malwarebytes.com_hc_en_us_requests_new
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push str.support
mov edx, str.https:__support.malwarebytes.com_hc_en_us_requests_new
mov byte [0x4a5ba0], 1
mov ecx, str.uninstall.retention.start.gethelp
call fcn.004361f0
add esp, 4
jmp 0x406754
push str.opening_the_support_forum_page
mov edx, 0x104
call fcn.0042ed60
add esp, 4
push 1
push 0
push 0
push str.https:__forums.malwarebytes.com_forum_41_malwarebytes_for_windows_support_forum_
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push str.support
mov edx, str.https:__forums.malwarebytes.com_forum_41_malwarebytes_for_windows_support_forum_
mov byte [0x4a5ba0], 1
mov ecx, str.uninstall.retention.start.askquestion
call fcn.004361f0
add esp, 4
jmp 0x406754
push 5
mov ecx, esi
call fcn.00407380
jmp case.0x406584.1808
push 6
mov ecx, esi
call fcn.00407380
jmp case.0x406584.1808
push 8
mov ecx, esi
call fcn.00407380
jmp case.0x406584.1808
cmp edi, 0x6a6
ja 0x40656b
je 0x406561
cmp edi, 0x588
ja 0x406457
je 0x406448
sub edi, 0x51b
je 0x40643a
sub edi, 1
je case.0x40628f.1121
sub edi, 0x5d
jne case.0x406584.1808
call fcn.00436c20
test al, al
je 0x4062e8
mov eax, 1
mov ecx, esi
push eax
call fcn.00407380
jmp case.0x406584.1808
push 4
mov ecx, esi
call fcn.00407380
call fcn.00436760
jmp case.0x406584.1808
push 7
mov ecx, esi
call fcn.00407380
jmp case.0x406584.1808
push str.skipping_the_survey_and_running_mbuns.exe__nosurvey__uninstall
mov edx, 0x146
jmp 0x406719
sub edi, 0x589
je 0x4064b6
sub edi, 0x55
je 0x4064af
sub edi, 0x64
jne case.0x406584.1808
mov edx, 0x17a
push str.running_assistant.exe___showdashboard
mov ecx, 0x48e900
call fcn.0042ed60
add esp, 4
push 1
push dword [0x4a5c40]
push str.__showdashboard
push str.assistant.exe
push 0x48f438
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov byte [0x4a5ba0], 1
jmp 0x406754
mov edx, 0x172
jmp 0x406472
mov eax, 0x57b
cmp word [esi + 0x852], ax
jne 0x406552
push str.trial
push dword [0x4a5c58]
call fcn.0045e800
add esp, 8
test eax, eax
je 0x40652d
push str.free
push dword [0x4a5c58]
call fcn.0045e800
add esp, 8
test eax, eax
je 0x40652d
push str.trial_expired
push dword [0x4a5c58]
call fcn.0045e800
add esp, 8
test eax, eax
je 0x40652d
push str.MDAM_B
push dword [0x4a5c78]
call fcn.0045e800
add esp, 8
test eax, eax
jne 0x406552
call fcn.00436c20
test al, al
jne 0x406552
push str.showing_discount_offer__salvage__screen
mov edx, 0x15d
mov ecx, 0x48e900
call fcn.0042ed60
add esp, 4
mov ecx, esi
push 0xa
call fcn.00407380
jmp case.0x406584.1808
push str.running_mbuns.exe__nosurvey__uninstall
mov edx, 0x163
jmp 0x406719
mov edx, 0x182
jmp 0x406472
sub edi, 0x70e
cmp edi, 0xc7
ja case.0x406584.1808
movzx eax, byte [edi + 0x4068b4]
jmp dword [eax*4 + 0x406898]
push str.setting_license_to_Free
mov edx, 0x18a
mov ecx, 0x48e900
call fcn.0042ed60
add esp, 4
call fcn.004074c0
test al, al
jne 0x4065bc
push 0x10
push 0x48eb04
push str.Unable_to_connect_to_service
jmp 0x40674b
mov edx, 0x195
jmp 0x406472
push str.opening_the_KB_article_about_reactivating_a_license
mov edx, 0x19b
mov ecx, 0x48e900
call fcn.0042ed60
add esp, 4
push 1
push 0
push 0
push str.https:__support.malwarebytes.com_hc_en_us_articles_360038479154_Activate_Premium_features_on_Malwarebytes_for_Windows
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0x48ed98
mov edx, str.https:__support.malwarebytes.com_hc_en_us_articles_360038479154_Activate_Premium_features_on_Malwarebytes_for_Windows
mov byte [0x4a5ba0], 1
mov ecx, str.uninstall.retention.switchtofree.learn
call fcn.004361f0
add esp, 4
jmp 0x406754
push str.opening_the_KB_article_about_Malwarebytes_Security_and_other_antivirus_software
mov edx, 0x1a2
mov ecx, 0x48e900
call fcn.0042ed60
add esp, 4
push 1
push 0
push 0
push str.https:__support.malwarebytes.com_hc_en_us_articles_5479973703571
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0x48ed98
mov edx, str.https:__support.malwarebytes.com_hc_en_us_articles_5479973703571
mov byte [0x4a5ba0], 1
mov ecx, str.uninstall.retention.rebuttal.keep
call fcn.004361f0
add esp, 4
jmp 0x406754
push 0
mov ecx, esi
call fcn.00407380
jmp case.0x406584.1808
push str.MDAM_B
push dword [0x4a5c78]
call fcn.0045e800
add esp, 8
mov ecx, 0x48e900
test eax, eax
jne 0x4066c5
push str.opening_the_link_for_the_Teams_discount_offer
mov edx, 0x1ae
call fcn.0042ed60
add esp, 4
push 1
push 0
push 0
push str.https:__links.malwarebytes.com_uninstall_getoffer_teams
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov edx, str.https:__links.malwarebytes.com_uninstall_getoffer_teams
jmp 0x4066f4
push str.opening_the_link_for_the_consumer_discount_offer
mov edx, 0x1b3
call fcn.0042ed60
add esp, 4
push 1
push 0
push 0
push str.https:__links.malwarebytes.com_uninstall_getoffer
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov edx, str.https:__links.malwarebytes.com_uninstall_getoffer
push str.purchase
mov ecx, str.uninstall.retention.salvage.getoffer
mov byte [0x4a5ba0], 1
call fcn.004361f0
add esp, 4
jmp 0x406754
push str.skipping_the_discount_offer_and_running_mbuns.exe__nosurvey__uninstall
mov edx, 0x1b9
mov ecx, 0x48e900
call fcn.0042ed60
add esp, 4
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
xor dl, dl
lea ecx, [ebp - 0x18]
call fcn.00435af0
test al, al
jne 0x406754
push 0x10
push 0x48eb04
push str.Unable_to_continue_uninstall
push dword [esi + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov edx, dword [ebp - 0x14]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x406778
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004523b6
mov esp, ebp
pop ebp
ret 0x10
push 0x80070057
call fcn.00403a50
nop
xchg esi, eax
bound eax, qword [eax]
or byte [eax + eax*2], ah
add al, 99
inc eax
add byte [edx + 0x66], ch
inc eax
add byte [ebx + 0x63c80040], ch
inc eax
add byte [edi], ah
inc eax
add byte [edx + 0x5d004063], bh
inc eax
add byte [eax], al
add dword [eax], ecx
or byte [edx], al
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
add ecx, dword [eax]
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
add al, 5
push es
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [ebx], al
push es
or byte [eax], cl
or byte [eax], cl
or byte [edi], al
add eax, case.0x406584.1806
invalid