Function at 0x413640
Capabilities:
Create process on windows
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a6678
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x65d0c8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
movzx edi, word [ebp + 0xc]
lea ecx, [ebp - 0x14]
mov edx, edi
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
call fcn.0042dd50
mov dword [ebp - 4], 0
mov edx, 4
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ecx - 0xc]
cmp ecx, edx
mov eax, ecx
cmovge eax, edx
mov dword [ebp - 0x1c], eax
test eax, eax
jle 0x4136f7
mov ebx, ecx
sub ebx, eax
mov eax, dword [ebp - 0x14]
cmp dword [eax - 4], 1
lea edx, [ebx + 1]
jle 0x4136c5
push ecx
lea ecx, [ebp - 0x14]
call fcn.00416560
lea edx, [ebx + 1]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1c]
push edx
add ecx, eax
push ecx
push edx
push eax
call fcn.004181b0
add esp, 0x10
test ebx, ebx
js 0x413b9c
mov eax, dword [ebp - 0x14]
cmp ebx, dword [eax - 8]
jg 0x413b9c
mov dword [eax - 0xc], ebx
mov eax, dword [ebp - 0x14]
mov byte [ebx + eax], 0
mov ecx, dword [ebp - 0x14]
mov ebx, dword [0x6664ac]
add ecx, 0xfffffff0
add ebx, 0xfffffff0
cmp ecx, ebx
je 0x413762
mov eax, dword [ebx + 0xc]
shr eax, 0x1f
test al, al
jne 0x413752
mov eax, dword [ecx]
cmp eax, dword [ebx]
jne 0x413752
call fcn.00416500
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
lea edx, [ebx + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x413744
mov edx, dword [ebx]
push ebx
mov ecx, dword [edx]
mov eax, dword [ecx + 4]
mov ecx, edx
call eax
mov eax, dword [ebp - 0x1c]
add eax, 0x10
mov byte [ebp - 4], 0
mov dword [0x6664ac], eax
jmp 0x413762
push dword [ecx + 4]
mov ecx, 0x6664ac
push dword [ebp - 0x14]
call fcn.00416620
cmp edi, 0x515
ja 0x413896
je case.0x413a1e.1904
sub edi, 0x3ea
cmp edi, 0xcf
ja case.0x413a1e.1808
movzx eax, byte [edi + 0x413bcc]
jmp dword [eax*4 + 0x413ba8]
push str.opening_the_KB_article_about_uninstalling_and_reinstalling_using_the_support_tool
mov edx, 0xe7
mov ecx, 0x63b358
call fcn.0042abe0
push str.support
mov edx, str.https:__support.malwarebytes.com_hc_en_us_articles_360038522234_Repair_Malwarebytes_for_Windows_with_the_Malwarebytes_Support_Tool
mov ecx, str.uninstall.retention.start.repair
call fcn.00432550
add esp, 8
jmp 0x413b51
call fcn.00432870
mov ecx, esi
test al, al
je 0x4137db
push 2
call fcn.004147a0
jmp case.0x413a1e.1808
push 3
call fcn.004147a0
jmp case.0x413a1e.1808
call fcn.00432700
mov ecx, 0x63b358
test al, al
je 0x413820
push str.opening_the_support_team_page
mov edx, 0xfd
call fcn.0042abe0
push str.support
mov edx, str.https:__support.malwarebytes.com_hc_en_us_requests_new
mov ecx, str.uninstall.retention.start.gethelp
call fcn.00432550
add esp, 8
jmp 0x413b51
push str.opening_the_support_forum_page
mov edx, 0x104
call fcn.0042abe0
push str.support
mov edx, str.https:__forums.malwarebytes.com_forum_41_malwarebytes_for_windows_support_forum_
mov ecx, str.uninstall.retention.start.askquestion
call fcn.00432550
add esp, 8
jmp 0x413b51
push 0
mov ecx, esi
call fcn.004147a0
jmp case.0x413a1e.1808
push 5
mov ecx, esi
call fcn.004147a0
jmp case.0x413a1e.1808
push 8
mov ecx, esi
call fcn.004147a0
jmp case.0x413a1e.1808
push 4
mov ecx, esi
call fcn.004147a0
call fcn.00432200
jmp case.0x413a1e.1808
push 6
mov ecx, esi
call fcn.004147a0
jmp case.0x413a1e.1808
cmp edi, 0x6a6
ja 0x413a05
je 0x4139fb
cmp edi, 0x588
ja 0x413900
je 0x4138f1
sub edi, 0x51b
je 0x4138e3
sub edi, 1
je case.0x41378d.1121
sub edi, 0x5d
jne case.0x413a1e.1808
call fcn.00432700
test al, al
je 0x4137c4
push 1
mov ecx, esi
call fcn.004147a0
jmp case.0x413a1e.1808
push 7
mov ecx, esi
call fcn.004147a0
jmp case.0x413a1e.1808
push str.skipping_the_survey_and_running_mbuns.exe__nosurvey__uninstall
mov edx, 0x146
jmp 0x413b16
sub edi, 0x589
je 0x41395f
sub edi, 0x55
je 0x413958
sub edi, 0x64
jne case.0x413a1e.1808
mov edx, 0x17a
push str.running_assistant.exe___showdashboard
mov ecx, 0x63b358
call fcn.0042abe0
add esp, 4
push 1
push dword [0x66646c]
push str.__showdashboard
push str.assistant.exe
push 0x63bdd0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov byte [0x6663c4], 1
jmp 0x413b51
mov edx, 0x172
jmp 0x41391b
movzx eax, word [esi + 0x852]
mov ecx, 0x57b
cmp ax, cx
jne 0x4139ec
push str.trial
push dword [0x666484]
call fcn.00585018
add esp, 8
test eax, eax
je 0x4139c7
push str.free
push dword [0x666484]
call fcn.00585018
add esp, 8
test eax, eax
je 0x4139c7
push str.trial_expired
push dword [0x666484]
call fcn.00585018
add esp, 8
test eax, eax
je 0x4139c7
call fcn.00418230
test al, al
je 0x4139ec
call fcn.00432700
test al, al
jne 0x4139ec
push str.showing_discount_offer__salvage__screen
mov edx, 0x15d
mov ecx, 0x63b358
call fcn.0042abe0
add esp, 4
mov ecx, esi
push 0xa
call fcn.004147a0
jmp case.0x413a1e.1808
push str.running_mbuns.exe__nosurvey__uninstall
mov edx, 0x163
jmp 0x413b16
mov edx, 0x182
jmp 0x41391b
sub edi, 0x70e
cmp edi, 0xc7
ja case.0x413a1e.1808
movzx eax, byte [edi + 0x413cb8]
jmp dword [eax*4 + 0x413c9c]
push str.setting_license_to_Free
mov edx, 0x18a
mov ecx, 0x63b358
call fcn.0042abe0
add esp, 4
call fcn.004148e0
test al, al
jne 0x413a56
push 0x10
push 0x63b55c
push str.Unable_to_connect_to_service
jmp 0x413b48
mov edx, 0x195
jmp 0x41391b
push str.opening_the_KB_article_about_reactivating_a_license
mov edx, 0x19b
mov ecx, 0x63b358
call fcn.0042abe0
push 0x63b7f0
mov edx, str.https:__support.malwarebytes.com_hc_en_us_articles_360038479154_Activate_Premium_features_on_Malwarebytes_for_Windows
mov ecx, str.uninstall.retention.switchtofree.learn
call fcn.00432550
add esp, 8
jmp 0x413b51
push str.opening_the_KB_article_about_Malwarebytes_Security_and_other_antivirus_software
mov edx, 0x1a2
mov ecx, 0x63b358
call fcn.0042abe0
push 0x63b7f0
mov edx, str.https:__support.malwarebytes.com_hc_en_us_articles_5479973703571
mov ecx, str.uninstall.retention.rebuttal.keep
call fcn.00432550
add esp, 8
jmp 0x413b51
call fcn.00418230
mov ecx, 0x63b358
test al, al
je 0x413ae4
push str.opening_the_link_for_the_Teams_discount_offer
mov edx, 0x1ae
call fcn.0042abe0
mov edx, str.https:__links.malwarebytes.com_uninstall_getoffer_teams
jmp 0x413af8
push str.opening_the_link_for_the_consumer_discount_offer
mov edx, 0x1b3
call fcn.0042abe0
mov edx, str.https:__links.malwarebytes.com_uninstall_getoffer
push str.purchase
mov ecx, str.uninstall.retention.salvage.getoffer
call fcn.00432550
add esp, 8
jmp 0x413b51
push str.skipping_the_discount_offer_and_running_mbuns.exe__nosurvey__uninstall
mov edx, 0x1b9
mov ecx, 0x63b358
call fcn.0042abe0
add esp, 4
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
xor dl, dl
lea ecx, [ebp - 0x18]
call fcn.00431680
test al, al
jne 0x413b51
push 0x10
push 0x63b55c
push str.Unable_to_continue_uninstall
push dword [esi + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
mov dword [ebp - 4], 2
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x413b7c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0057380b
mov esp, ebp
pop ebp
ret 0x10
push 0x80070057
call fcn.00403f80
nop
xchg esp, eax
aaa
inc ecx
add al, cl
cmp byte [ecx], al
out 0x37, eax
inc ecx
add byte [ebx + 0x38], cl
inc ecx
add byte [ecx + 0x38], bl
inc ecx
add byte [edi + 0x38], ah
inc ecx
add byte [ebp + 0x38], dh
inc ecx
add byte [eax + 0x5a004138], cl
cmp eax, dword [ecx]
add byte [ecx], al
or byte [eax], cl
add cl, byte [eax]
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [ebx], al
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax + 134744070], al
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
add eax, dword [esi]
or byte [eax], cl
or byte [eax], cl
or byte [edi], al
add eax, case.0x413a1e.1806
pushal
cmp al, byte [ecx]
nop
cmp al, byte [ecx]
dec ebx
cmp byte [ecx], al
sar byte [edx], 0x41
add byte [ebx + edi], cl
inc ecx
add byte [edx + 0x3b], bl
inc ecx
add byte [eax], al
add dword [esi], eax
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
add al, byte [ebx]
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
add al, 5