Function at 0x475560
Capabilities:
Accept command line arguments
Check mutex on windows
Copy file
Get common file path
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e22ca
mov eax, dword fs:[0]
push eax
sub esp, 0x23c
mov eax, dword [0x527064]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor edi, edi
mov dword [ebp - 0x1c8], edi
call fcn.0048fb70
test al, al
jne 0x475607
push str.McDefaultProdReg.cpp
push str.wWinMain
push 0x44
push 4
lea ecx, [ebp - 0x1d0]
call fcn.00431610
mov dword [ebp - 4], edi
mov edx, str.Failed_to_Initialize_Secure_DLL_loading._Error:
mov ecx, dword [eax]
call fcn.004333c0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, esi
call fcn.0043a5d0
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x1d0]
call fcn.004327d0
mov eax, dword [ebp - 0x1d0]
mov ebx, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
add eax, 0x14
push eax
call ebx
mov dword [ebp - 4], 0xffffffff
jmp 0x47560d
mov ebx, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push str.McDefaultProdReg.cpp
push str.wWinMain
push 0x46
push 3
lea ecx, [ebp - 0x1d0]
call fcn.00431610
mov dword [ebp - 4], 2
mov edx, str.WinMain___START
mov ecx, dword [eax]
call fcn.004333c0
mov dword [ebp - 4], 3
mov ecx, dword [ebp - 0x1d0]
call fcn.004327d0
mov eax, dword [ebp - 0x1d0]
add eax, 0x14
push eax
call ebx
lea eax, [ebp - 0x1e4]
mov dword [ebp - 4], 0xffffffff
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0x1cc], eax
test eax, eax
je 0x475c2a
mov esi, dword [0x52d524]
test esi, esi
jne 0x4756c5
push 0x6c
call fcn.004a3e8e
mov esi, eax
add esp, 4
mov dword [ebp - 0x1c8], esi
mov dword [ebp - 4], 4
test esi, esi
je 0x4756b6
mov ecx, esi
call fcn.004635c0
mov dword [esi], vtable.CMcSingleton_class_CMcSecurityHelperClass_.0
jmp 0x4756b8
xor esi, esi
mov dword [ebp - 4], 0xffffffff
mov dword [0x52d524], esi
inc dword [0x52d528]
push 4
call fcn.004a3e8e
add esp, 4
test eax, eax
je 0x4756e1
mov dword [eax], vtable.CMcWin32APIWrapper.0
jmp 0x4756e3
xor eax, eax
sub esp, 8
mov ecx, esp
push eax
mov dword [ecx], 0
mov dword [ecx + 4], 0
call fcn.0044ac80
mov ecx, esi
call fcn.00434740
lea eax, [ebp - 0x98]
mov ecx, esi
push eax
call fcn.00464ed0
lea eax, [ebp - 0xcc]
mov dword [ebp - 0xcc], vtable.std::_Func_impl_class__lambda_6b23bd749dbc56e246f14071a38a597b___class_std::allocator_int___void___.0
mov dword [ebp - 0xc8], esi
mov dword [ebp - 0xa8], eax
mov dword [ebp - 4], 5
lea eax, [ebp - 0x154]
mov dword [ebp - 0x1c8], eax
mov dword [ebp - 0x130], 0
push eax
lea ecx, [ebp - 0xcc]
mov byte [ebp - 4], 6
call fcn.0047e320
mov dword [ebp - 0x130], eax
mov dword [ebp - 4], 7
mov ecx, dword [ebp - 0xa8]
test ecx, ecx
je 0x475784
mov edx, dword [ecx]
lea eax, [ebp - 0xcc]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [ebp - 4], 8
mov eax, dword [ebp - 0x1cc]
mov dword [ebp - 0xc8], eax
lea eax, [ebp - 0xcc]
mov dword [ebp - 0xcc], vtable.std::_Func_impl_class__lambda_d57fde91e3a819d30d61611b99e23471___class_std::allocator_int___void___.0
mov dword [ebp - 0xa8], eax
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x1c8], eax
push eax
lea ecx, [ebp - 0xcc]
mov byte [ebp - 4], 0xa
call fcn.0047e2c0
mov dword [ebp - 0x108], eax
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0xa8]
test ecx, ecx
je 0x4757fb
mov edx, dword [ecx]
lea eax, [ebp - 0xcc]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
xor eax, eax
mov dword [ebp - 0x60], 7
mov dword [ebp - 0x64], 0
mov word [ebp - 0x74], ax
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 0xd
call fcn.00434330
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 0xe
push eax
lea ecx, [ebp - 0x248]
call fcn.00437c60
lea ecx, [ebp - 0x1ec]
mov dword [ebp - method.CMcSingletonSharedPtr_class_CMcJsonUtils_.virtual_0], vtable.CMcSingletonSharedPtr_class_CMcJsonUtils_.0
call fcn.0043a9a0
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x74]
mov esi, dword [ebp - 0x1ec]
push ecx
lea ecx, [ebp - 0x20c]
push ecx
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
cmp byte [ebp - 0x20c], 0
push str.McDefaultProdReg.cpp
push str.wWinMain
je 0x47661e
push 0x5c
push 3
lea ecx, [ebp - 0x1d0]
call fcn.00431610
mov byte [ebp - 4], 0x10
mov edx, str.JsonFile_is_loaded_successfully_in_McDireg
mov ecx, dword [eax]
call fcn.004333c0
mov byte [ebp - 4], 0x11
mov ecx, dword [ebp - 0x1d0]
call fcn.004327d0
mov eax, dword [ebp - 0x1d0]
add eax, 0x14
push eax
call ebx
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0xec]
push str.DEFAULT
mov dword [ebp - 0x1dc], 0x52f
mov dword [ebp - 0x1d8], 0x1af
call fcn.00432050
push str.PACKAGE
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 0x12
call fcn.00432050
push str.AFFID
lea ecx, [ebp - 0xbc]
mov byte [ebp - 4], 0x13
call fcn.00432050
mov byte [ebp - 4], 0x14
lea eax, [ebp - 0xa4]
mov byte [ebp - 0x1c8], 0
lea ecx, [ebp - 0x50]
push dword [ebp - 0x1c8]
mov dword [ebp - 0x50], 0
push eax
lea eax, [ebp - 0xec]
mov dword [ebp - 0x4c], 0
push eax
mov dword [ebp - 0x48], 0
call fcn.0043dc50
push fcn.00408d60
push 3
push 0x18
lea eax, [ebp - 0xec]
mov byte [ebp - 4], 0x16
push eax
call fcn.00490fab
mov eax, dword [esi]
lea ecx, [ebp - 0x1dc]
push ecx
lea ecx, [ebp - 0x50]
push ecx
lea ecx, [ebp - 0x98]
push ecx
mov ecx, esi
call dword [eax + 0x18]
push str.DEFAULT
lea ecx, [ebp - 0x19c]
call fcn.00432050
push str.PACKAGE
lea ecx, [ebp - 0x184]
mov byte [ebp - 4], 0x17
call fcn.00432050
push str.PACKAGEID
lea ecx, [ebp - 0x16c]
mov byte [ebp - 4], 0x18
call fcn.00432050
mov byte [ebp - 4], 0x19
push dword [ebp - 0x1e4]
push ecx
mov edx, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x50]
call fcn.0043de50
mov eax, dword [ebp - 0x50]
lea ecx, [ebp - 0x50]
add esp, 8
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x1c8], 0
lea eax, [ebp - 0x154]
push dword [ebp - 0x1c8]
push eax
lea eax, [ebp - 0x19c]
push eax
call fcn.0043dbc0
push fcn.00408d60
push 3
push 0x18
lea eax, [ebp - 0x19c]
mov byte [ebp - 4], 0x16
push eax
call fcn.00490fab
mov eax, dword [esi]
lea ecx, [ebp - 0x1d8]
push ecx
lea ecx, [ebp - 0x50]
push ecx
lea ecx, [ebp - 0x98]
push ecx
mov ecx, esi
call dword [eax + 0x18]
push str.PACKAGEID
lea ecx, [ebp - 0x19c]
call fcn.00432050
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x2c]
mov edx, dword [ebp - 0x1d8]
call fcn.00457590
push eax
lea ecx, [ebp - 0x184]
mov byte [ebp - 4], 0x1b
call fcn.00444ed0
mov byte [ebp - 4], 0x1d
mov eax, dword [ebp - 0x18]
cmp eax, 8
jb 0x475a6a
inc eax
push 2
push eax
push dword [ebp - 0x2c]
call fcn.00402ff0
add esp, 0xc
mov edx, dword [ebp - 0x1dc]
lea ecx, [ebp - 0x44]
xor eax, eax
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], ax
call fcn.00457590
push eax
lea ecx, [ebp - 0x16c]
mov byte [ebp - 4], 0x1e
call fcn.00444ed0
mov eax, dword [ebp - 0x30]
cmp eax, 8
jb 0x475ab3
inc eax
push 2
push eax
push dword [ebp - 0x44]
call fcn.00402ff0
add esp, 0xc
xor eax, eax
mov dword [ebp - 0x30], 7
mov dword [ebp - 0x34], 0
mov word [ebp - 0x44], ax
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x80]
mov byte [ebp - 0x1c8], al
push dword [ebp - 0x1c8]
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0x19c]
push eax
call fcn.0043dc50
push fcn.00408d60
push 3
push 0x18
lea eax, [ebp - 0x19c]
mov byte [ebp - 4], 0x21
push eax
call fcn.00490fab
lea eax, [ebp - 0x80]
mov ecx, esi
push eax
lea eax, [ebp - 0x98]
push eax
call fcn.0045a450
lea ecx, [ebp - 0x80]
call fcn.0043a080
lea ecx, [ebp - 0x50]
call fcn.0043a080
mov dword [ebp - method.CMcRegistryOps.virtual_0], vtable.CMcRegistryOps.0
mov byte [ebp - 4], 0x25
cmp dword [ebp - 0x1e4], 3
jne 0x475ed7
push str.McDefaultProdReg.cpp
push str.wWinMain
push 0x71
push 3
lea ecx, [ebp - 0x1dc]
call fcn.00431610
mov byte [ebp - 4], 0x26
mov edx, str.DiReg_Starting_to_monitor_PI2
mov ecx, dword [eax]
call fcn.00433720
mov byte [ebp - 4], 0x27
mov ecx, dword [ebp - 0x1dc]
call fcn.004327d0
mov eax, dword [ebp - 0x1dc]
add eax, 0x14
push eax
call ebx
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x2c]
mov edi, dword [ebp - 0x1cc]
push dword [edi + 4]
call fcn.00408dd0
mov byte [ebp - 4], 0x28
lea eax, [ebp - 0x2c]
cmp dword [ebp - 0x18], 8
push 0xc
cmovae eax, dword [ebp - 0x2c]
push str._MONITOR_PI2
push dword [ebp - 0x1c]
push eax
call fcn.0043b2f0
add esp, 0x10
test eax, eax
jne 0x475cbb
push dword [edi + 8]
call fcn.004a3e3a
add esp, 4
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
jne 0x475c32
lea ecx, [ebp - 0x2c]
call fcn.00408d60
lea ecx, [ebp - 0x1f0]
call fcn.0043a010
lea ecx, [ebp - 0x248]
call fcn.00434490
lea ecx, [ebp - 0x74]
call fcn.00408d60
lea ecx, [ebp - 0x12c]
call fcn.00433f80
lea ecx, [ebp - 0x154]
call fcn.00433f80
or eax, 0xffffffff
jmp 0x4766e8
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x1cc]
mov dword [ebp - 0x1cc], 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [ebp - 0x1cc], 1
jne 0x475cbb
push str.EVENT_DI2_INSTALLATION_ABORTED_BY_TASK_MANAGER
lea ecx, [ebp - 0xa4]
call fcn.00408dd0
sub esp, 0x18
mov byte [ebp - 4], 0x29
mov ecx, esp
mov dword [ebp - 0x1dc], esp
push 0x4f7ee0
call fcn.00408dd0
sub esp, 0x18
mov byte [ebp - 4], 0x2a
mov ecx, esp
push 0x4f7ee0
call fcn.00408dd0
xor edx, edx
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0xa4]
call fcn.00454040
add esp, 0x30
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0xa4]
call fcn.00408d60
push str.INSTALLMODE
lea ecx, [ebp - 0x8c]
mov dword [ebp - 0x1d8], 0
call fcn.00432050
push 0x4fc7e0
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 0x2b
call fcn.00432050
lea ecx, [ebp - 0x1d8]
mov byte [ebp - 4], 0x2c
mov eax, dword [esi]
push ecx
lea ecx, [ebp - 0x8c]
push ecx
lea ecx, [ebp - 0x5c]
push ecx
lea ecx, [ebp - 0x98]
push ecx
mov ecx, esi
call dword [eax + 0x14]
lea ecx, [ebp - 0x5c]
call fcn.00408d60
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 0x28
call fcn.00408d60
cmp dword [ebp - 0x1d8], 0
jne 0x475d75
push str.McDefaultProdReg.cpp
push str.wWinMain
push 0x87
push 3
lea ecx, [ebp - 0x1cc]
call fcn.00431610
mov byte [ebp - 4], 0x2d
mov edx, str.PI2_is_silent__mode
mov ecx, dword [eax]
call fcn.00433720
mov byte [ebp - 4], 0x2e
mov ecx, dword [ebp - 0x1cc]
call fcn.004327d0
mov eax, dword [ebp - 0x1cc]
add eax, 0x14
push eax
call ebx
mov byte [ebp - 4], 0x28
push 0x20019
lea eax, [ebp - 0x1c8]
mov dword [ebp - 0x1c8], 0
push eax
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x1e0], esp
push str.ExitCode
call fcn.00408dd0
sub esp, 0x18
mov byte [ebp - 4], 0x2f
mov ecx, esp
push str.SOFTWAREMcAfeeInstallIntegrator
call fcn.00408dd0
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x1d0]
mov byte [ebp - 4], 0x28
call fcn.004611f0
xor eax, eax
mov dword [ebp - 0x30], 7
mov dword [ebp - 0x34], 0
mov word [ebp - 0x44], ax
mov byte [ebp - 4], 0x30
cmp dword [ebp - 0x1c8], 0xa
jne 0x475e8c
push 0x20019
lea eax, [ebp - 0x44]
push eax
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x1e0], esp
push str.VI2_IntermediatReboot
call fcn.00408dd0
sub esp, 0x18
mov byte [ebp - 4], 0x31
mov ecx, esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
call fcn.00408dd0
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x1d0]
mov byte [ebp - 4], 0x30
call fcn.00461440
test eax, eax
je 0x475e8c
push str.McDefaultProdReg.cpp
push str.wWinMain
push 0x90
push 3
lea ecx, [ebp - 0x1cc]
call fcn.00431610
mov byte [ebp - 4], 0x32
mov edx, str.Clearing_the_PI2_cache_in_programdata
mov ecx, dword [eax]
call fcn.00433720
mov byte [ebp - 4], 0x33
mov ecx, dword [ebp - 0x1cc]
call fcn.004327d0
mov eax, dword [ebp - 0x1cc]
add eax, 0x14
push eax
call ebx
mov byte [ebp - 4], 0x30
call fcn.0046ff80
push 0
call fcn.004a8888
lea ecx, [ebp - 0x44]
call fcn.00408d60
lea ecx, [ebp - 0x2c]
call fcn.00408d60
lea ecx, [ebp - 0x1f0]
call fcn.0043a010
lea ecx, [ebp - 0x248]
call fcn.00434490
lea ecx, [ebp - 0x74]
call fcn.00408d60
lea ecx, [ebp - 0x12c]
call fcn.00433f80
lea ecx, [ebp - 0x154]
call fcn.00433f80
xor eax, eax
jmp 0x4766e8
call fcn.0047c4c0
sub esp, 0x28
mov ecx, esp
mov dword [ecx], vtable.std::_Func_impl_class__lambda_cebf8da573ca25b09ea95f8748690825___class_std::allocator_int___void___.0
mov dword [ecx + 4], eax
mov dword [ecx + 0x24], ecx
lea ecx, [ebp - 0x1c4]
call fcn.00433ef0
push str.McDiReg_Singleton
push 0
push 0x1f0001
mov byte [ebp - 4], 0x35
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
test eax, eax
jne 0x476576
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], eax
mov word [ebp - 0x2c], ax
mov byte [ebp - 4], 0x36
mov dword [ebp - 0x1d8], eax
lea eax, [ebp - 0x1d8]
push eax
push 0
push 0
push 0x50da74
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
mov dword [ebp - 0x1cc], eax
test eax, eax
js 0x475fbd
lea eax, [ebp - 0x1d8]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00445930
push str.McAfeeMCLOGSlog.ini
lea ecx, [ebp - 0x2c]
call fcn.00444da0
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
push 1
cmovae eax, dword [ebp - 0x2c]
push eax
push str.log.ini
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x476015
push str.McDefaultProdReg.cpp
push str.wWinMain
push 0xad
push 2
lea ecx, [ebp - 0x1c8]
call fcn.00431610
mov byte [ebp - 4], 0x37
mov edx, str._log.ini_file_is_copied_in_MCLOG_folder
mov ecx, dword [eax]
call fcn.00433720
mov byte [ebp - 4], 0x38
jmp 0x475ffa
push str.McDefaultProdReg.cpp
push str.wWinMain
push 0xb2
push 2
lea ecx, [ebp - 0x1c8]
call fcn.00431610
mov byte [ebp - 4], 0x39
mov edx, str.Not_able_to_get_App_data_path
mov ecx, dword [eax]
call fcn.00433720
push dword [ebp - 0x1cc]
mov ecx, eax
call fcn.0043a770
mov byte [ebp - 4], 0x3a
mov ecx, dword [ebp - 0x1c8]
call fcn.004327d0
mov eax, dword [ebp - 0x1c8]
add eax, 0x14
push eax
call ebx
mov byte [ebp - 4], 0x36
push dword [ebp - 0x1d8]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push str.McDefaultProdReg.cpp
push str.wWinMain
push 0xb6
push 3
lea ecx, [ebp - 0x1c8]
call fcn.00431610
mov byte [ebp - 4], 0x3b
mov edx, str.McDiReg_is_singleton
mov ecx, dword [eax]
call fcn.004333c0
mov byte [ebp - 4], 0x3c
mov ecx, dword [ebp - 0x1c8]
call fcn.004327d0
mov eax, dword [ebp - 0x1c8]
add eax, 0x14
push eax
call ebx
push str.McDiReg_Singleton
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x35
call fcn.00408d60
lea ecx, [ebp - 0x98]
call fcn.00476710
mov byte [ebp - 4], 0x3f
call fcn.00476950
lea ecx, [ebp - 0x200]
call fcn.00471780
lea ecx, [ebp - 0x200]
mov byte [ebp - 4], 0x40
call fcn.00471950
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x1c8], eax
call fcn.00471780
lea ecx, [ebp - 0xc8]
mov byte [ebp - 4], 0x41
call fcn.00473590
mov byte [ebp - 4], 0x42
cmp dword [ebp - 0x1c8], 0
je 0x476448
lea ecx, [ebp - 0x7c]
call fcn.00471780
mov byte [ebp - 4], 0x43
call fcn.00472270
test eax, eax
jne 0x47643c
push 4
call fcn.004a3e8e
add esp, 4
mov dword [ebp - 0x1e0], eax
test eax, eax
je 0x476114
mov dword [eax], vtable.CMcRegistryOps.0
jmp 0x476116
xor eax, eax
push eax
lea ecx, [ebp - 0x1f8]
mov dword [ebp - 0x1f8], 0
mov dword [ebp - 0x1f4], 0
call fcn.0047d0b0
mov byte [ebp - 4], 0x44
call fcn.004726d0
mov dword [ebp - 0x1d8], eax
test eax, eax
jne 0x4762fd
lea ecx, [ebp - 0x214]
call fcn.00471780
sub esp, 0x18
mov byte [ebp - 4], 0x45
mov ecx, esp
push str.Install.exe
call fcn.00408dd0
call fcn.00471840
test eax, eax
jne 0x4762e7
push str.DYNAMIC_AFFID
lea ecx, [ebp - 0x104]
mov dword [ebp - 0x1cc], eax
call fcn.00432050
mov byte [ebp - 4], 0x46
lea ecx, [ebp - 0x44]
or edi, 1
push 0x4fc7e0
mov dword [ebp - 0x1c8], edi
call fcn.00432050
lea ecx, [ebp - 0x1cc]
mov dword [ebp - 4], 0x47
mov eax, dword [esi]
or edi, 6
push ecx
lea ecx, [ebp - 0x104]
mov dword [ebp - 0x1c8], edi
push ecx
lea ecx, [ebp - 0x44]
push ecx
lea ecx, [ebp - 0x20]
push ecx
mov ecx, esi
call dword [eax + 0x14]
mov al, byte [eax]
test al, al
je 0x4761eb
cmp dword [ebp - 0x1cc], 1
mov byte [ebp - 0x1d1], 1
je 0x4761f2
mov byte [ebp - 0x1d1], 0
lea ecx, [ebp - 0x44]
and edi, 0xfffffff9
call fcn.00408d60
lea ecx, [ebp - 0x104]
mov dword [ebp - 4], 0x45
and edi, 0xfffffffe
call fcn.00408d60
cmp byte [ebp - 0x1d1], 0
je 0x47626b
push str.McDefaultProdReg.cpp
push str.wWinMain
push 0xe3
push 3
lea ecx, [ebp - 0x1dc]
call fcn.00431610
mov byte [ebp - 4], 0x48
mov edx, str.Dynamic_Affid_is_enabled
mov ecx, dword [eax]
call fcn.00433720
mov byte [ebp - 4], 0x49
mov ecx, dword [ebp - 0x1dc]
call fcn.004327d0
mov eax, dword [ebp - 0x1dc]
add eax, 0x14
push eax
call ebx
mov byte [ebp - 4], 0x45
call fcn.0047b290
call fcn.004728d0
test eax, eax
jne 0x475e80
push 0x4f7ee2
lea ecx, [ebp - 0x44]
call fcn.0042fce0
lea ecx, [ebp - 0x104]
mov byte [ebp - 4], 0x4a
call fcn.00478f70
push eax
lea ecx, [ebp - 0x44]
call fcn.0047c5d0
lea ecx, [ebp - 0x104]
call fcn.0042fca0
lea edx, [ebp - 0x44]
call fcn.0047cea0
test al, al
je 0x4762df
lea ecx, [ebp - 0xc8]
call fcn.004742e0
call fcn.004728d0
test eax, eax
je 0x4762df
push 0x1d4c0
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.0046ff80
push 0
call fcn.004a8888
lea ecx, [ebp - 0x44]
call fcn.0042fca0
push 0x3a98
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x214]
call fcn.004717d0
mov byte [ebp - 4], 0x4b
mov esi, dword [ebp - 0x1f4]
test esi, esi
je 0x47632c
or eax, 0xffffffff
lock xadd dword [esi + 4], eax
jne 0x47632c
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
jne 0x47632c
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov byte [ebp - 4], 0x43
cmp dword [ebp - 0x1d8], 0
mov esi, dword [ebp - 0x1ec]
je 0x4760f8
push str.McDefaultProdReg.cpp
push str.wWinMain
push 0x10e
push 3
lea ecx, [ebp - 0x1c8]
call fcn.00431610
mov byte [ebp - 4], 0x4c
mov edx, str.LiveSafe_is_uninstalled..._set_ProductInstallStatus_to_Zero
mov ecx, dword [eax]
call fcn.004333c0
mov byte [ebp - 4], 0x4d
mov ecx, dword [ebp - 0x1c8]
call fcn.004327d0
mov eax, dword [ebp - 0x1c8]
add eax, 0x14
push eax
call ebx
push 0x2001f
push 0
sub esp, 0x18
mov byte [ebp - 4], 0x43
mov ecx, esp
mov dword [ebp - 0x1e0], esp
push str.null
call fcn.00408dd0
sub esp, 0x18
mov byte [ebp - 4], 0x4e
mov ecx, esp
mov dword [ebp - 0x1c8], esp
push str.ProductInstallStatus
call fcn.00408dd0
sub esp, 0x18
mov byte [ebp - 4], 0x4f
mov ecx, esp
push str.SOFTWAREMcDiReg
call fcn.00408dd0
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x1d0]
mov byte [ebp - 4], 0x43
call fcn.00460be0
test eax, eax
je 0x476435
push str.McDefaultProdReg.cpp
push str.wWinMain
push 0x112
push 4
lea ecx, [ebp - 0x1c8]
call fcn.00431610
mov byte [ebp - 4], 0x50
mov edx, str.SetRegValue_HKML_DWORD_failed.
mov ecx, dword [eax]
call fcn.00433720
mov byte [ebp - 4], 0x51
mov ecx, dword [ebp - 0x1c8]
call fcn.004327d0
mov eax, dword [ebp - 0x1c8]
add eax, 0x14
push eax
call ebx
push 0
call fcn.004a8888
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 0x42
call fcn.004717d0
push str.McDefaultProdReg.cpp
push str.wWinMain
push 0x119
push 3
lea ecx, [ebp - 0x1c8]
call fcn.00431610
mov byte [ebp - 4], 0x52
mov edx, str.Starting_LiveSafe_Fresh_Install
mov ecx, dword [eax]
call fcn.004333c0
mov byte [ebp - 4], 0x53
mov ecx, dword [ebp - 0x1c8]
call fcn.004327d0
mov eax, dword [ebp - 0x1c8]
add eax, 0x14
push eax
call ebx
push ecx
mov byte [ebp - 4], 0x42
call fcn.00478330
test eax, eax
je 0x4764e6
push 0x4f7ee2
lea ecx, [ebp - 0x44]
call fcn.0042fce0
lea ecx, [ebp - 0x104]
mov byte [ebp - 4], 0x54
call fcn.00478f70
push eax
lea ecx, [ebp - 0x44]
call fcn.0047c5d0
lea ecx, [ebp - 0x104]
call fcn.0042fca0
lea edx, [ebp - 0x44]
call fcn.0047cea0
test al, al
je 0x47651f
call fcn.00478ae0
lea ecx, [ebp - 0x44]
call fcn.0042fca0
lea ecx, [ebp - 0xc8]
call fcn.00474a90
lea ecx, [ebp - 0x4c]
call fcn.004717d0
lea ecx, [ebp - 0x200]
call fcn.004717d0
lea ecx, [ebp - 0x98]
call fcn.004767a0
lea ecx, [ebp - 0x1c4]
call fcn.00433f80
jmp 0x475e9c
push str.McDefaultProdReg.cpp
push str.wWinMain
push 0x129
push 3
lea ecx, [ebp - 0x1c8]
call fcn.00431610
mov byte [ebp - 4], 0x55
mov edx, str.Self_delete_as_Email_is_not_mandatory..
mov ecx, dword [eax]
call fcn.004333c0
mov byte [ebp - 4], 0x56
mov ecx, dword [ebp - 0x1c8]
call fcn.004327d0
mov eax, dword [ebp - 0x1c8]
add eax, 0x14
push eax
call ebx
mov byte [ebp - 4], 0x54
call fcn.0046ff80
push 0
call fcn.004a8888
push str.McDefaultProdReg.cpp
push str.wWinMain
push 0xbb
push 1
lea ecx, [ebp - 0x1c8]
call fcn.00431610
mov byte [ebp - 4], 0x3d
mov edx, str.McDiReg_is_singleton
mov ecx, dword [eax]
call fcn.004333c0
mov byte [ebp - 4], 0x3e
mov ecx, dword [ebp - 0x1c8]
call fcn.004327d0
mov eax, dword [ebp - 0x1c8]
add eax, 0x14
push eax
call ebx
lea ecx, [ebp - 0x1c4]
call fcn.00433f80
jmp 0x475e9c
push 0x68
push 4
lea ecx, [ebp - 0x1c8]
call fcn.00431610
mov byte [ebp - 4], 0x22
mov edx, str.JsonFile_loading_is_failed__error_code_is:
push dword [ebp - 0x204]
mov ecx, dword [eax]
call fcn.004333c0
mov ecx, eax
call fcn.0043a5d0
mov byte [ebp - 4], 0x23
mov ecx, dword [ebp - 0x1c8]
call fcn.004327d0
mov eax, dword [ebp - 0x1c8]
add eax, 0x14
push eax
call ebx
mov edi, dword [ebp - 0x204]
mov byte [ebp - 4], 0x24
mov esi, dword [ebp - 0x1e8]
test esi, esi
je 0x47669a
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [esi + 4], eax
jne 0x47669a
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], ebx
dec ebx
jne 0x47669a
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
lea ecx, [ebp - 0x248]
call fcn.00434490
mov eax, dword [ebp - 0x60]
cmp eax, 8
jb 0x4766bc
push 2
inc eax
push eax
push dword [ebp - 0x74]
call fcn.00402ff0
add esp, 0xc
xor eax, eax
mov dword [ebp - 0x60], 7
lea ecx, [ebp - 0x12c]
mov dword [ebp - 0x64], 0
mov word [ebp - 0x74], ax
call fcn.00433f80
lea ecx, [ebp - 0x154]
call fcn.00433f80
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004908ad
mov esp, ebp
pop ebp
ret 0x10