Function at 0x421e10
Capabilities:
Create directory
Create thread
Delete directory
Get common file path
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x639cd0
mov eax, dword fs:[0]
push eax
mov eax, 0x15e0
call fcn.00609180
mov eax, dword [0x6d3438]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x15c8], eax
mov eax, dword [0x6e3a20]
mov dword [ebp - 0x15c4], 0x409
cmp eax, dword [0x6e3a24]
je 0x421e7a
mov dword [eax], 0x409
mov eax, dword [0x6e3a20]
add eax, 4
mov dword [0x6e3a20], eax
jmp 0x421e8c
lea ecx, [ebp - 0x15c4]
push ecx
push eax
call fcn.0042c270
mov eax, dword [0x6e3a20]
mov dword [ebp - 0x15c4], 0x411
cmp eax, dword [0x6e3a24]
je 0x421ead
mov dword [eax], 0x411
add dword [0x6e3a20], 4
jmp 0x421eba
lea ecx, [ebp - 0x15c4]
push ecx
push eax
call fcn.0042c270
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov ecx, dword [0x6e3a1c]
mov edx, dword [0x6e3a20]
cmp ecx, edx
je 0x421edb
cmp dword [ecx], eax
je 0x421edb
add ecx, 4
cmp ecx, edx
jne 0x421ed0
cmp ecx, edx
mov esi, 0x409
cmove eax, esi
mov dword [0x6e368c], eax
call fcn.00421ba0
cmp eax, 1
jne 0x421f28
push 0
push str.Error
push str.MCPR_is_not_supported_in_Audit_mode._Exiting.
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00608185
mov esp, ebp
pop ebp
ret 0x10
push 0x20a
lea eax, [ebp - 0x430]
push 0
push eax
call fcn.0060a8e0
add esp, 0xc
lea eax, [ebp - 0x430]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x421f08
push 0x800
lea eax, [ebp - 0xc30]
push 0
push eax
call fcn.0060a8e0
add esp, 0xc
lea eax, [ebp - 0xc30]
push 0x400
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x421f8a
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x421f0a
lea ecx, [ebp - 0xc30]
mov dword [ebp - 0x1468], 0
mov dword [ebp - 0x1458], 0
lea edx, [ecx + 2]
mov dword [ebp - 0x1454], 7
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x421fb1
sub ecx, edx
lea eax, [ebp - 0xc30]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x1468]
call fcn.0042e850
push dword [ebp - 0x15c8]
cmp dword [ebp - 0x1454], 8
lea ecx, [ebp - 0x1468]
mov edx, dword [ebp - 0x1458]
cmovae ecx, dword [ebp - 0x1468]
push 2
push 0x68ded4
push 0xffffffffffffffff
call fcn.0042c3f0
add esp, 0x10
lea ecx, [ebp - 0x1468]
mov esi, eax
call fcn.0042f900
lea ecx, [ebp - 0xc30]
mov dword [ebp - 0x1450], 0
mov dword [ebp - 0x1440], 0
lea edx, [ecx + 2]
mov dword [ebp - 0x143c], 7
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x422040
sub ecx, edx
lea eax, [ebp - 0xc30]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x1450]
call fcn.0042e850
cmp dword [ebp - 0x1440], esi
lea eax, [ebp - 0x1450]
lea ecx, [ebp - 0x1468]
mov dword [ebp - 0x1468], 0
cmovb esi, dword [ebp - 0x1440]
cmp dword [ebp - 0x143c], 8
push esi
cmovae eax, dword [ebp - 0x1450]
push eax
mov dword [ebp - 0x1458], 0
mov dword [ebp - 0x1454], 7
call fcn.0042e850
lea ecx, [ebp - 0x1450]
call fcn.0042f900
mov edx, dword [ebp - 0x1458]
mov edi, accept
mov esi, dword [0x6d4c10]
mov eax, edi
sub eax, edx
cmp eax, esi
jb 0x422a24
cmp dword [ebp - 0x1454], 8
lea ecx, [ebp - 0x1468]
push esi
cmovae ecx, dword [ebp - 0x1468]
mov eax, 0x6d4c00
cmp dword [0x6d4c14], 8
cmovae eax, dword [0x6d4c00]
push eax
push edx
push ecx
lea eax, [ebp - 0x1468]
push eax
push dword [ebp - 0x15c8]
lea ecx, [ebp - 0x1528]
call fcn.0042cf70
cmp dword [ebp - 0x1514], 8
lea eax, [ebp - 0x1528]
cmovae eax, dword [ebp - 0x1528]
push eax
call fcn.005ee305
mov esi, eax
add esp, 4
test esi, esi
jne 0x422a07
mov edx, dword [ebp - 0x1458]
mov eax, edi
mov esi, dword [0x6d4c28]
sub eax, edx
cmp eax, esi
jb 0x422a24
cmp dword [ebp - 0x1454], 8
lea ecx, [ebp - 0x1468]
push esi
cmovae ecx, dword [ebp - 0x1468]
mov eax, 0x6d4c18
cmp dword [0x6d4c2c], 8
cmovae eax, dword [0x6d4c18]
push eax
push edx
push ecx
lea eax, [ebp - 0x1468]
push eax
push dword [ebp - 0x15c8]
lea ecx, [ebp - 0x1510]
call fcn.0042cf70
cmp dword [ebp - 0x14fc], 8
lea eax, [ebp - 0x1510]
cmovae eax, dword [ebp - 0x1510]
push eax
call fcn.005ee305
mov esi, eax
add esp, 4
test esi, esi
jne 0x4229fc
call fcn.0048c140
push ebx
push 0x400
push 0x6d3ec8
call fcn.0060e249
add esp, 0xc
push str.__silent
push 0x400
push 0x6d3ec8
call fcn.0060e249
add esp, 0xc
push str.Shcore.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x42221d
push str.SetProcessDpiAwareness
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x422216
push 2
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
call fcn.00421600
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x68d90c
push 0
push 0
mov ebx, dword [sym.imp.GDI32.dll_CreateFontW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0x2bc
push 0
push 0
push 0
push 0xffffffffffffffed
call ebx
mov esi, eax
mov dword [ebp - 0x15c4], 1
lea eax, [ebp - 0x15c4]
push eax
lea ecx, [edi + 0x10]
call fcn.00429d60
push 0x68d90c
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xfffffffffffffff4
mov dword [eax], esi
call ebx
mov esi, eax
mov dword [ebp - 0x15c4], 2
lea eax, [ebp - 0x15c4]
push eax
lea ecx, [edi + 0x10]
call fcn.00429d60
mov dword [eax], esi
call fcn.00421600
mov esi, eax
mov dword [ebp - 0x15d0], 0x12d
lea eax, [ebp - 0x15c4]
mov dword [ebp - 0x15c4], 0x12d
push eax
lea eax, [ebp - 0x1444]
xor ebx, ebx
push eax
mov ecx, esi
mov dword [ebp - 0x15cc], ebx
call fcn.0042d290
mov eax, dword [ebp - 0x143c]
cmp byte [eax + 0xd], bl
jne 0x42230e
cmp dword [eax + 0x10], 0x12d
ja 0x42230e
cmp eax, dword [esi]
je 0x42230a
mov ebx, dword [eax + 0x14]
mov dword [ebp - 0x15cc], ebx
test ebx, ebx
jne 0x422341
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
movzx ecx, word [ebp - 0x15d0]
push ecx
push eax
call dword [sym.imp.USER32.dll_LoadBitmapW]
mov ebx, eax
mov dword [ebp - 0x15cc], ebx
test ebx, ebx
je 0x422341
lea eax, [ebp - 0x15d0]
mov ecx, esi
push eax
call fcn.00429e20
mov dword [eax], ebx
lea eax, [ebp - 0x1450]
push eax
push 0x18
push ebx
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 1
push 1
push dword [ebp - 0x1448]
push dword [ebp - 0x144c]
call dword [sym.imp.GDI32.dll_CreateBitmap]
mov esi, dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push 0
mov dword [ebp - 0x15c4], eax
call esi
push 0
mov edi, eax
call esi
push dword [ebp - 0x15cc]
mov esi, dword [sym.imp.GDI32.dll_SelectObject]
mov ebx, eax
push edi
call esi
push dword [ebp - 0x15c4]
push ebx
call esi
push 0xe5e6e5
push edi
call dword [sym.imp.GDI32.dll_SetBkColor]
mov esi, dword [sym.imp.GDI32.dll_BitBlt]
push 0xcc0020
push 0
push 0
push edi
push dword [ebp - 0x1448]
push dword [ebp - 0x144c]
push 0
push 0
push ebx
call esi
push 0x660046
push 0
push 0
push ebx
push dword [ebp - 0x1448]
push dword [ebp - 0x144c]
push 0
push 0
push edi
call esi
mov esi, dword [sym.imp.GDI32.dll_DeleteDC]
push edi
call esi
push ebx
call esi
mov eax, dword [ebp - 0x15c4]
mov ebx, dword [ebp - 0x15c8]
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
push 0x64
push 0x6e3770
push 3
push ebx
mov dword [0x6e3688], eax
call esi
push 0x64
push 0x6e36a8
push 0x1f5
push ebx
call esi
mov dword [ebp - 0x1498], 0x30
mov dword [ebp - 0x1494], 3
mov dword [ebp - 0x1490], 0x425ce0
mov dword [ebp - 0x148c], 0
mov dword [ebp - 0x1488], 0
mov dword [ebp - 0x1484], ebx
call fcn.00421600
push ecx
mov ecx, eax
call fcn.00421980
mov dword [ebp - 0x1480], eax
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
mov dword [ebp - 0x147c], eax
mov dword [ebp - 0x1478], 0x10
mov dword [ebp - 0x1474], 0
mov dword [ebp - 0x1470], 0x6e36a8
call fcn.00421600
push ecx
mov ecx, eax
call fcn.00421980
mov dword [ebp - 0x146c], eax
lea eax, [ebp - 0x1498]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExW]
test ax, ax
je 0x4229fa
lea eax, [ebp - 0x1448]
mov dword [0x6e3838], ebx
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 0x1440]
push 0
cdq
push ebx
sub eax, edx
mov ecx, eax
mov eax, dword [ebp - 0x143c]
push 0
push 0
cdq
push 0x208
sub eax, edx
sar ecx, 1
push 0x21d
sar eax, 1
sub ecx, 0x10e
sub eax, 0x104
mov dword [ebp - 0x1448], ecx
push eax
push ecx
push 0x80000048
push 0x6e3770
push 0x6e36a8
push 0x80000
mov dword [ebp - 0x1444], eax
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [0x6e36a4], eax
test eax, eax
je 0x4229fa
push dword [ebp + 0x14]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x6e36a4]
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0x1f5
push ebx
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
push 0
mov dword [ebp - 0x15c8], eax
call fcn.0060dd26
add esp, 4
push eax
call fcn.0060dd14
add esp, 4
call fcn.0060dcf3
push eax
push str.McAfeeCleanupUIMessagePipe
push str._s_d
push 0x6e3408
call fcn.0042c230
push 0x6e3408
push str..pipe_s_pipe
push 0x104
push 0x6d4798
call fcn.0042d0b0
add esp, 0x20
test eax, eax
jns 0x4225c7
mov edi, 0xb7
jmp 0x4225ef
push 0x6e3408
push str.Global_s_mutex
push 0x104
push 0x6d49a0
call fcn.0042d0b0
xor edi, edi
add esp, 0x10
test eax, eax
mov ecx, 0xb7
cmovs edi, ecx
push dword [0x6d4bac]
mov dword [0x6d4bb0], 0x428350
mov dword [0x6d4bb4], 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
cmp dword [0x6d4bb0], 0
je 0x4229fa
lea eax, [ebp - 0x15c4]
mov dword [ebp - 0x15c4], 0
push eax
push 0
push 0x6d4790
push 0x42d060
push 0
push 0
call fcn.0060e7ba
add esp, 0x18
mov dword [0x6d4ba8], eax
cmp dword [ebp - 0x15c4], 0
je 0x4229fa
cmp dword [0x6d4794], 0xffffffff
jne 0x422676
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x3e8
call esi
cmp dword [0x6d4794], 0xffffffff
je 0x422666
test edi, edi
jne 0x4229fa
lea eax, [ebp - 0x1438]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0x12
push str.HKLMSOFTWAREMCPR
lea ecx, [ebp - 0x1480]
mov dword [ebp - 0x1480], edi
mov dword [ebp - 0x1470], edi
mov dword [ebp - 0x146c], 7
call fcn.0042e850
lea ecx, [ebp - 0x1438]
mov dword [ebp - 0x1450], edi
mov dword [ebp - 0x1440], edi
lea edx, [ecx + 2]
mov dword [ebp - 0x143c], 7
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4226d7
sub ecx, edx
lea eax, [ebp - 0x1438]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x1450]
call fcn.0042e850
lea eax, [ebp - 0x1480]
push eax
lea eax, [ebp - 0x1450]
push eax
lea ecx, [ebp - 0x15c0]
call fcn.004322a0
lea ecx, [ebp - 0x1450]
call fcn.0042f900
lea ecx, [ebp - 0x1480]
call fcn.0042f900
lea ecx, [ebp - 0x15bc]
call fcn.00433d00
push 0x20a
lea eax, [ebp - 0x220]
push 0
push eax
call fcn.0060a8e0
add esp, 0xc
lea eax, [ebp - 0x220]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x422766
xor esi, esi
jmp 0x4229c6
lea ecx, [ebp - 0x220]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x422770
sub ecx, edx
mov ebx, accept
mov edx, dword [0x6d4be0]
mov eax, ebx
sar ecx, 1
sub eax, edx
cmp eax, ecx
jb 0x422a24
cmp dword [0x6d4be4], 8
mov eax, 0x6d4bd0
push edx
cmovae eax, dword [0x6d4bd0]
push eax
push ecx
lea eax, [ebp - 0x220]
push eax
push 0x6d4bd0
push dword [ebp - 0x15c8]
lea ecx, [ebp - 0x14f8]
call fcn.0042cf70
lea ecx, [ebp - 0x220]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4227d2
sub ecx, edx
mov edx, dword [0x6e3a38]
sar ecx, 1
sub ebx, edx
cmp ebx, ecx
jb 0x422a24
cmp dword [0x6e3a3c], 8
mov eax, 0x6e3a28
push edx
cmovae eax, dword [0x6e3a28]
push eax
push ecx
lea eax, [ebp - 0x220]
push eax
push 0x6e3a28
push dword [ebp - 0x15c8]
lea ecx, [ebp - 0x14e0]
call fcn.0042cf70
cmp dword [ebp - 0x14e4], 8
lea eax, [ebp - 0x14f8]
push 0
cmovae eax, dword [ebp - 0x14f8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 6
push str.legacy
lea ecx, [ebp - 0x14c8]
mov dword [ebp - 0x14c8], 0
mov dword [ebp - 0x14b8], 0
mov dword [ebp - 0x14b4], 7
call fcn.0042e850
push 0x19
push str.Analytics.ScriptHost.Type
lea ecx, [ebp - 0x14b0]
mov dword [ebp - 0x14b0], 0
mov dword [ebp - 0x14a0], 0
mov dword [ebp - 0x149c], 7
call fcn.0042e850
lea eax, [ebp - 0x14c8]
push eax
lea eax, [ebp - 0x14b0]
push eax
lea ecx, [ebp - 0x15bc]
call fcn.00434550
lea ecx, [ebp - 0x14b0]
call fcn.0042f900
lea ecx, [ebp - 0x14c8]
call fcn.0042f900
lea ecx, [ebp - 0x15c0]
call fcn.00432820
push 0
push 0
push 0
lea eax, [ebp - 0x15ec]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x42296d
mov ebx, dword [sym.imp.USER32.dll_TranslateAcceleratorW]
mov esi, dword [sym.imp.USER32.dll_TranslateMessage]
mov edi, dword [sym.imp.USER32.dll_DispatchMessageW]
nop dword [eax]
nop dword [eax + eax]
lea eax, [ebp - 0x15ec]
push eax
push dword [ebp - 0x15c8]
push dword [ebp - 0x15ec]
call ebx
test eax, eax
jne 0x422956
mov eax, dword [0x6e36a0]
test eax, eax
je 0x422944
lea ecx, [ebp - 0x15ec]
push ecx
push eax
call dword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
jne 0x422956
lea eax, [ebp - 0x15ec]
push eax
call esi
lea eax, [ebp - 0x15ec]
push eax
call edi
push 0
push 0
push 0
lea eax, [ebp - 0x15ec]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x422910
lea ecx, [ebp - 0x15c0]
call fcn.00432a20
lea ecx, [ebp - 0x15c0]
call fcn.00432b20
cmp dword [ebp - 0x14cc], 8
lea eax, [ebp - 0x14e0]
cmovae eax, dword [ebp - 0x14e0]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
call fcn.00421600
mov ecx, eax
call fcn.00421720
mov esi, dword [ebp - 0x15e4]
lea ecx, [ebp - 0x14e0]
call fcn.0042f900
lea ecx, [ebp - 0x14f8]
call fcn.0042f900
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x15c0]
mov dword [ebp - method.Intel::Analytics::CALEController.virtual_0], vtable.Intel::Analytics::CALEController.0
call fcn.00432a20
lea ecx, [ebp - 0x15c0]
call fcn.00432b20
lea ecx, [ebp - 0x15bc]
call fcn.00432600
jmp 0x4229fc
xor esi, esi
lea ecx, [ebp - 0x1510]
call fcn.0042f900
lea ecx, [ebp - 0x1528]
call fcn.0042f900
lea ecx, [ebp - 0x1468]
call fcn.0042f900
mov eax, esi
jmp 0x421f0a
call fcn.0042f3b0
int3