Function at 0x413ab0
Capabilities:
Create process on windows
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a67d8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x65b0c8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
movzx edi, word [ebp + 0xc]
lea ecx, [ebp - 0x14]
mov edx, edi
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
call fcn.0042ecb0
mov dword [ebp - 4], 0
mov edx, 4
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ecx - 0xc]
cmp ecx, edx
mov eax, ecx
cmovge eax, edx
mov dword [ebp - 0x1c], eax
test eax, eax
jle 0x413b67
mov ebx, ecx
sub ebx, eax
mov eax, dword [ebp - 0x14]
cmp dword [eax - 4], 1
lea edx, [ebx + 1]
jle 0x413b35
push ecx
lea ecx, [ebp - 0x14]
call fcn.00416a10
lea edx, [ebx + 1]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1c]
push edx
add ecx, eax
push ecx
push edx
push eax
call fcn.00419020
add esp, 0x10
test ebx, ebx
js 0x414023
mov eax, dword [ebp - 0x14]
cmp ebx, dword [eax - 8]
jg 0x414023
mov dword [eax - 0xc], ebx
mov eax, dword [ebp - 0x14]
mov byte [ebx + eax], 0
mov ecx, dword [ebp - 0x14]
mov ebx, dword [0x664404]
add ecx, 0xfffffff0
add ebx, 0xfffffff0
cmp ecx, ebx
je 0x413bd2
mov eax, dword [ebx + 0xc]
shr eax, 0x1f
test al, al
jne 0x413bc2
mov eax, dword [ecx]
cmp eax, dword [ebx]
jne 0x413bc2
call fcn.004169b0
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
lea edx, [ebx + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x413bb4
mov edx, dword [ebx]
push ebx
mov ecx, dword [edx]
mov eax, dword [ecx + 4]
mov ecx, edx
call eax
mov eax, dword [ebp - 0x1c]
add eax, 0x10
mov byte [ebp - 4], 0
mov dword [0x664404], eax
jmp 0x413bd2
push dword [ecx + 4]
mov ecx, 0x664404
push dword [ebp - 0x14]
call fcn.00416ad0
cmp edi, 0x515
ja 0x413d1d
je case.0x413ea5.1904
sub edi, 0x3ea
cmp edi, 0xcf
ja case.0x413ea5.1808
movzx eax, byte [edi + 0x414054]
jmp dword [eax*4 + 0x414030]
push str.opening_the_KB_article_about_uninstalling_and_reinstalling_using_the_support_tool
mov edx, 0xe7
mov ecx, 0x63b2c8
call fcn.0042bb40
push str.support
mov edx, str.https:__support.malwarebytes.com_hc_en_us_articles_360038522234_Repair_Malwarebytes_for_Windows_with_the_Malwarebytes_Support_Tool
mov ecx, str.uninstall.retention.start.repair
call fcn.00433c00
add esp, 8
jmp 0x413fd8
call fcn.00434430
mov ecx, esi
test al, al
je 0x413c4b
push 2
call fcn.00414c20
jmp case.0x413ea5.1808
push 3
call fcn.00414c20
jmp case.0x413ea5.1808
call fcn.004342c0
mov ecx, 0x63b2c8
test al, al
je 0x413c90
push str.opening_the_support_team_page
mov edx, 0xfd
call fcn.0042bb40
push str.support
mov edx, str.https:__support.malwarebytes.com_hc_en_us_requests_new
mov ecx, str.uninstall.retention.start.gethelp
call fcn.00433c00
add esp, 8
jmp 0x413fd8
push str.opening_the_support_forum_page
mov edx, 0x104
call fcn.0042bb40
push str.support
mov edx, str.https:__forums.malwarebytes.com_forum_41_malwarebytes_for_windows_support_forum_
mov ecx, str.uninstall.retention.start.askquestion
call fcn.00433c00
add esp, 8
jmp 0x413fd8
push 0
mov ecx, esi
call fcn.00414c20
jmp case.0x413ea5.1808
push 5
mov ecx, esi
call fcn.00414c20
jmp case.0x413ea5.1808
push 8
mov ecx, esi
call fcn.00414c20
jmp case.0x413ea5.1808
push 4
mov ecx, esi
call fcn.00414c20
push 0x63ae4d
push 0x63ae4d
mov edx, 0x63ae4d
mov ecx, str.Show_UninstallRetentionSurvey
call fcn.00433e90
add esp, 8
jmp case.0x413ea5.1808
push 6
mov ecx, esi
call fcn.00414c20
jmp case.0x413ea5.1808
cmp edi, 0x6a6
ja 0x413e8c
je 0x413e82
cmp edi, 0x588
ja 0x413d87
je 0x413d78
sub edi, 0x51b
je 0x413d6a
sub edi, 1
je case.0x413bfd.1121
sub edi, 0x5d
jne case.0x413ea5.1808
call fcn.004342c0
test al, al
je 0x413c34
push 1
mov ecx, esi
call fcn.00414c20
jmp case.0x413ea5.1808
push 7
mov ecx, esi
call fcn.00414c20
jmp case.0x413ea5.1808
push str.skipping_the_survey_and_running_mbuns.exe__nosurvey__uninstall
mov edx, 0x146
jmp 0x413f9d
sub edi, 0x589
je 0x413de6
sub edi, 0x55
je 0x413ddf
sub edi, 0x64
jne case.0x413ea5.1808
mov edx, 0x17a
push str.running_assistant.exe___showdashboard
mov ecx, 0x63b2c8
call fcn.0042bb40
add esp, 4
push 1
push dword [0x6643c4]
push str.__showdashboard
push str.assistant.exe
push 0x63bdc0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov byte [0x66431c], 1
jmp 0x413fd8
mov edx, 0x172
jmp 0x413da2
movzx eax, word [esi + 0x852]
mov ecx, 0x57b
cmp ax, cx
jne 0x413e73
push str.trial
push dword [0x6643dc]
call fcn.00584f68
add esp, 8
test eax, eax
je 0x413e4e
push str.free
push dword [0x6643dc]
call fcn.00584f68
add esp, 8
test eax, eax
je 0x413e4e
push str.trialexpired
push dword [0x6643dc]
call fcn.00584f68
add esp, 8
test eax, eax
je 0x413e4e
call fcn.004190a0
test al, al
je 0x413e73
call fcn.004342c0
test al, al
jne 0x413e73
push str.showing_discount_offer__salvage__screen
mov edx, 0x15d
mov ecx, 0x63b2c8
call fcn.0042bb40
add esp, 4
mov ecx, esi
push 0xa
call fcn.00414c20
jmp case.0x413ea5.1808
push str.running_mbuns.exe__nosurvey__uninstall
mov edx, 0x163
jmp 0x413f9d
mov edx, 0x182
jmp 0x413da2
sub edi, 0x70e
cmp edi, 0xc7
ja case.0x413ea5.1808
movzx eax, byte [edi + 0x414140]
jmp dword [eax*4 + 0x414124]
push str.setting_license_to_Free
mov edx, 0x18a
mov ecx, 0x63b2c8
call fcn.0042bb40
add esp, 4
call fcn.00414d60
test al, al
jne 0x413edd
push 0x10
push 0x63b4d4
push str.Unable_to_connect_to_service
jmp 0x413fcf
mov edx, 0x195
jmp 0x413da2
push str.opening_the_KB_article_about_reactivating_a_license
mov edx, 0x19b
mov ecx, 0x63b2c8
call fcn.0042bb40
push 0x63b768
mov edx, str.https:__support.malwarebytes.com_hc_en_us_articles_360038479154_Activate_Premium_features_on_Malwarebytes_for_Windows
mov ecx, str.uninstall.retention.switchtofree.learn
call fcn.00433c00
add esp, 8
jmp 0x413fd8
push str.opening_the_KB_article_about_Malwarebytes_Security_and_other_antivirus_software
mov edx, 0x1a2
mov ecx, 0x63b2c8
call fcn.0042bb40
push 0x63b768
mov edx, str.https:__support.malwarebytes.com_hc_en_us_articles_5479973703571
mov ecx, str.uninstall.retention.rebuttal.keep
call fcn.00433c00
add esp, 8
jmp 0x413fd8
call fcn.004190a0
mov ecx, 0x63b2c8
test al, al
je 0x413f6b
push str.opening_the_link_for_the_Teams_discount_offer
mov edx, 0x1ae
call fcn.0042bb40
mov edx, str.https:__links.malwarebytes.com_uninstall_getoffer_teams
jmp 0x413f7f
push str.opening_the_link_for_the_consumer_discount_offer
mov edx, 0x1b3
call fcn.0042bb40
mov edx, str.https:__links.malwarebytes.com_uninstall_getoffer
push str.purchase
mov ecx, str.uninstall.retention.salvage.getoffer
call fcn.00433c00
add esp, 8
jmp 0x413fd8
push str.skipping_the_discount_offer_and_running_mbuns.exe__nosurvey__uninstall
mov edx, 0x1b9
mov ecx, 0x63b2c8
call fcn.0042bb40
add esp, 4
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
xor dl, dl
lea ecx, [ebp - 0x18]
call fcn.00432d70
test al, al
jne 0x413fd8
push 0x10
push 0x63b4d4
push str.Unable_to_continue_uninstall
push dword [esi + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
mov dword [ebp - 4], 2
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x414003
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0057374d
mov esp, ebp
pop ebp
ret 0x10
push 0x80070057
call fcn.004043d0
nop dword [eax]
add al, 0x3c
inc ecx
add byte [edi + 0x3d], cl
inc ecx
add byte [edi + 0x3c], dl
inc ecx
add byte [ebx - 0x36ffbec4], bh
cmp al, 0x41
add bh, dl
cmp al, 0x41
add ch, ah
cmp al, 0x41
add byte [edi], cl
cmp eax, 0x3fe10041
inc ecx
add byte [eax], al
add dword [eax], ecx
or byte [edx], al
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
add ecx, dword [eax]
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
add al, 5
push es
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [ebx], al
push es
or byte [eax], cl
or byte [eax], cl
or byte [edi], al
add eax, case.0x413ea5.1806
out 62, eax
inc ecx
add byte [edi], dl
aas
inc ecx
add byte [ebx + 0x4700413c], bh
aas
inc ecx
add byte [ebx - 0x1effbec1], dl
aas
inc ecx
add byte [eax], al
add dword [esi], eax
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
add al, byte [ebx]
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
add al, 5
int3