Function at 0x1402c4040
Capabilities:
Accept command line arguments

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x310
mov rax, qword [0x14039bc30]
xor rax, rsp
mov qword [rsp + 0x300], rax
mov r14, rdx
mov r12, rcx
xor r13d, r13d
mov qword [r11 - 0xf8], r13
mov qword [r11 - 0xe8], r13
mov qword [r11 - 0xe0], 7
mov word [r11 - 0xf8], r13w
lea rax, vtable.Intel::RegistryAPI.0
mov qword [r11 - 0xb8], rax
mov qword [r11 - 0xd8], r13
mov qword [r11 - 0xc8], r13
mov qword [r11 - 0xc0], 7
mov word [r11 - 0xd8], r13w
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov r9, rax
lea r10, [rsp + 0x2fa]
movabs r11, 0xcccccccccccccccd
sub r10, 2
mov rax, r11
mul r9
mov r8, rdx
shr r8, 3
movzx ecx, r8w
shl cx, 2
lea edx, [rcx + r8]
add dx, dx
sub r9w, dx
add r9w, 0x30
mov word [r10], r9w
mov r9, r8
test r8, r8
jne 0x1402c40e1
mov qword [rsp + 0x1a0], r13
mov qword [rsp + 0x1b0], r13
mov qword [rsp + 0x1b8], 7
lea rax, [rsp + 0x2fa]
cmp r10, rax
je 0x1402c415d
lea r8, [rsp + 0x2fa]
sub r8, r10
sar r8, 1
mov rdx, r10
lea rcx, [rsp + 0x1a0]
call fcn.140032810
lea rcx, [rsp + 0x240]
call fcn.140033a90
movups xmm0, xmmword [rsp + 0x1a0]
movups xmmword [rsp + 0x240], xmm0
movups xmm1, xmmword [rsp + 0x1b0]
movups xmmword [rsp + 0x250], xmm1
mov qword [rsp + 0x120], r13
mov qword [rsp + 0x130], r13
mov qword [rsp + 0x138], 7
mov word [rsp + 0x120], r13w
mov r8d, 0xb
lea rdx, str.Install_Dir
lea rcx, [rsp + 0x120]
call fcn.140032810
nop
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], r13w
mov r8d, 0x17
lea rdx, str.SOFTWAREMCAFEEMODCORE
lea rcx, [rsp + 0x60]
call fcn.140032810
nop
lea r9, [rsp + 0x260]
lea r8, [rsp + 0x120]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x280]
call fcn.1402c5f00
mov ebx, eax
mov rdx, qword [rsp + 0x78]
mov r15d, 0x1000
cmp rdx, 8
jb 0x1402c4263
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, r15
jb 0x1402c425e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1402c4d34
call fcn.14013afa0
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], r13w
mov rdx, qword [rsp + 0x138]
cmp rdx, 8
jb 0x1402c42bb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x120]
mov rax, rcx
cmp rdx, r15
jb 0x1402c42b6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1402c4d3a
call fcn.14013afa0
test ebx, ebx
jne 0x1402c43c7
mov r8, qword [rsp + 0x250]
mov r9, qword [rsp + 0x258]
mov rax, r9
sub rax, r8
lea rcx, [rsp + 0x240]
cmp rax, 1
jb 0x1402c4313
lea rdx, [r8 + 1]
mov qword [rsp + 0x250], rdx
cmp r9, 8
cmovae rcx, qword [rsp + 0x240]
movzx eax, word [0x140329f60]
mov word [rcx + r8*2], ax
mov word [rcx + rdx*2], r13w
jmp 0x1402c4333
mov qword [rsp + 0x20], 1
lea r9, [0x140329f60]
movzx r8d, byte [rsp + 0x30]
mov edx, 1
call fcn.1400affe0
mov rdi, qword [rsp + 0x270]
lea r9, [rsp + 0x260]
cmp qword [rsp + 0x278], 8
cmovae r9, qword [rsp + 0x260]
mov rsi, qword [rsp + 0x250]
mov rcx, qword [rsp + 0x258]
mov rax, rcx
sub rax, rsi
cmp rdi, rax
ja 0x1402c43ac
lea rax, [rdi + rsi]
mov qword [rsp + 0x250], rax
lea rbx, [rsp + 0x240]
cmp rcx, 8
cmovae rbx, qword [rsp + 0x240]
lea rcx, [rbx + rsi*2]
lea r8, [rdi + rdi]
mov rdx, r9
call fcn.14013d0f0
lea rax, [rdi + rsi]
mov word [rbx + rax*2], r13w
jmp 0x1402c43c7
mov qword [rsp + 0x20], rdi
movzx r8d, byte [rsp + 0x30]
mov rdx, rdi
lea rcx, [rsp + 0x240]
call fcn.1400affe0
mov qword [rsp + 0x140], r13
mov qword [rsp + 0x150], r13
mov qword [rsp + 0x158], 7
mov word [rsp + 0x140], r13w
mov r8d, 0xe
lea rdx, str.WSS_HardwareId
lea rcx, [rsp + 0x140]
call fcn.140032810
nop
mov qword [rsp + 0x80], r13
mov qword [rsp + 0x90], r13
mov qword [rsp + 0x98], 7
mov word [rsp + 0x80], r13w
mov r8d, 0x21
lea rdx, str.SOFTWAREMcAfeeMcClientAnalytics
lea rcx, [rsp + 0x80]
call fcn.140032810
nop
lea r9, [rsp + 0x260]
lea r8, [rsp + 0x140]
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x280]
call fcn.1402c5f00
mov ebx, eax
mov rdx, qword [rsp + 0x98]
cmp rdx, 8
jb 0x1402c44b2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x80]
mov rax, rcx
cmp rdx, r15
jb 0x1402c44ad
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1402c4d40
call fcn.14013afa0
mov qword [rsp + 0x90], r13
mov qword [rsp + 0x98], 7
mov word [rsp + 0x80], r13w
mov rdx, qword [rsp + 0x158]
cmp rdx, 8
jb 0x1402c4513
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x140]
mov rax, rcx
cmp rdx, r15
jb 0x1402c450e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1402c4d46
call fcn.14013afa0
test ebx, ebx
jne 0x1402c461f
mov r8, qword [rsp + 0x250]
mov r9, qword [rsp + 0x258]
mov rax, r9
sub rax, r8
lea rcx, [rsp + 0x240]
cmp rax, 1
jb 0x1402c456b
lea rdx, [r8 + 1]
mov qword [rsp + 0x250], rdx
cmp r9, 8
cmovae rcx, qword [rsp + 0x240]
movzx eax, word [0x140329f60]
mov word [rcx + r8*2], ax
mov word [rcx + rdx*2], r13w
jmp 0x1402c458b
mov qword [rsp + 0x20], 1
lea r9, [0x140329f60]
movzx r8d, byte [rsp + 0x30]
mov edx, 1
call fcn.1400affe0
mov rdi, qword [rsp + 0x270]
lea r9, [rsp + 0x260]
cmp qword [rsp + 0x278], 8
cmovae r9, qword [rsp + 0x260]
mov rsi, qword [rsp + 0x250]
mov rcx, qword [rsp + 0x258]
mov rax, rcx
sub rax, rsi
cmp rdi, rax
ja 0x1402c4604
lea rax, [rdi + rsi]
mov qword [rsp + 0x250], rax
lea rbx, [rsp + 0x240]
cmp rcx, 8
cmovae rbx, qword [rsp + 0x240]
lea rcx, [rbx + rsi*2]
lea r8, [rdi + rdi]
mov rdx, r9
call fcn.14013d0f0
lea rax, [rdi + rsi]
mov word [rbx + rax*2], r13w
jmp 0x1402c461f
mov qword [rsp + 0x20], rdi
movzx r8d, byte [rsp + 0x30]
mov rdx, rdi
lea rcx, [rsp + 0x240]
call fcn.1400affe0
lea r8, str.Global834C46D9_6762_4FF9_8279_2C04C8B1162Cdefault
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenEventW]
mov rbx, rax
mov r8, qword [rsp + 0x250]
mov rax, qword [rsp + 0x258]
mov rcx, rax
sub rcx, r8
cmp rcx, 1
lea rcx, [rsp + 0x240]
jb 0x1402c4686
lea rdx, [r8 + 1]
mov qword [rsp + 0x250], rdx
cmp rax, 8
cmovae rcx, qword [rsp + 0x240]
movzx eax, word [0x140329f60]
mov word [rcx + r8*2], ax
mov word [rcx + rdx*2], r13w
jmp 0x1402c46a6
mov qword [rsp + 0x20], 1
lea r9, [0x140329f60]
movzx r8d, byte [rsp + 0x30]
mov edx, 1
call fcn.1400affe0
test rbx, rbx
je 0x1402c473c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x250]
mov rdx, qword [rsp + 0x258]
mov rax, rdx
sub rax, rcx
cmp rax, 0xe
jb 0x1402c4712
lea rdi, [rcx + 0xe]
mov qword [rsp + 0x250], rdi
lea rbx, [rsp + 0x240]
cmp rdx, 8
cmovae rbx, qword [rsp + 0x240]
lea rcx, [rbx + rcx*2]
mov r8d, 0x1c
lea rdx, str.UPDATE_RUNNING
call fcn.14013d0f0
mov word [rbx + rdi*2], r13w
jmp 0x1402c4756
mov qword [rsp + 0x20], 0xe
lea r9, str.UPDATE_RUNNING
movzx r8d, byte [rsp + 0x30]
mov edx, 0xe
lea rcx, [rsp + 0x240]
call fcn.1400affe0
jmp 0x1402c4756
mov r8d, 0x12
lea rdx, str.UPDATE_NOT_RUNNING
lea rcx, [rsp + 0x240]
call fcn.140032440
mov qword [rsp + 0xf0], r14
lea rax, [rsp + 0x240]
mov qword [rsp + 0xf8], rax
mov qword [rsp + 0xb0], r13
mov qword [rsp + 0xc0], r13
mov qword [rsp + 0xc8], 7
mov word [rsp + 0xb0], r13w
mov r8d, 0xe
lea rdx, str.MessageBus.dll
lea rcx, [rsp + 0xb0]
call fcn.140032810
nop
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0xf0]
call fcn.1402c3850
nop
mov r8, qword [rsp + 0xc8]
cmp r8, 8
jb 0x1402c47ea
inc r8
mov rdx, qword [rsp + 0xb0]
lea rcx, [rsp + 0xb0]
call fcn.140033a50
mov qword [rsp + 0xd0], r13
mov qword [rsp + 0xe0], r13
mov qword [rsp + 0xe8], 7
mov word [rsp + 0xd0], r13w
mov r8d, 0x11
lea rdx, str.ModuleManager.dll
lea rcx, [rsp + 0xd0]
call fcn.140032810
nop
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0xf0]
call fcn.1402c3850
nop
mov r8, qword [rsp + 0xe8]
cmp r8, 8
jb 0x1402c4866
inc r8
mov rdx, qword [rsp + 0xd0]
lea rcx, [rsp + 0xd0]
call fcn.140033a50
mov r8d, 1
lea rdx, [0x140329f60]
lea rcx, [rsp + 0x240]
call fcn.140032440
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], r13w
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1402c48b0
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140032810
nop
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rdx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x50]
lea rcx, [rsp + 0x240]
call fcn.140032440
nop
mov r8, qword [rsp + 0x58]
cmp r8, 8
jb 0x1402c490a
inc r8
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x40]
call fcn.140033a50
mov qword [rsp + 0xa0], r13
lea rax, [0x14039fc68]
mov qword [rsp + 0xa8], rax
mov rdx, r14
cmp qword [r14 + 0x18], 8
jb 0x1402c492e
mov rdx, qword [r14]
mov qword [rsp + 0x160], r13
mov qword [rsp + 0x170], r13
mov qword [rsp + 0x178], 7
mov word [rsp + 0x160], r13w
mov r8, qword [r14 + 0x10]
lea rcx, [rsp + 0x160]
call fcn.140032810
nop
lea r8, [rsp + 0xa0]
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x290]
call fcn.1402c3540
nop
lea rcx, [rsp + 0x160]
call fcn.140033a90
xorps xmm0, xmm0
movups xmmword [rsp + 0x2b0], xmm0
mov rax, qword [rsp + 0x298]
test rax, rax
je 0x1402c49b4
lock inc dword [rax + 8]
mov rax, qword [rsp + 0x298]
movaps xmm1, xmmword [rsp + 0x290]
movdqa xmmword [rsp + 0x2b0], xmm1
movups xmmword [rsp + 0x100], xmm0
test rax, rax
je 0x1402c49de
lock inc dword [rax + 8]
movaps xmm1, xmmword [rsp + 0x290]
movdqa xmmword [rsp + 0x180], xmm1
lea rdx, [rsp + 0x180]
lea rcx, [rsp + 0x100]
call fcn.1402c59d0
nop
mov rdi, qword [rsp + 0x100]
nop word [rax + rax]
mov rbx, qword [rsp + 0x2b0]
cmp rbx, rdi
je 0x1402c4a7f
mov r8d, 1
lea rdx, [0x140329f60]
lea rcx, [rsp + 0x240]
call fcn.140032440
lea rdx, [rbx + 0x20]
cmp qword [rdx + 0x18], 8
jb 0x1402c4a45
mov rdx, qword [rdx]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x1402c4a50
lea rcx, [rsp + 0x240]
call fcn.140032440
lea rcx, [rsp + 0x2b0]
call fcn.1402c52d0
test eax, eax
jne 0x1402c4d4c
jmp 0x1402c4a10
lea rcx, [rsp + 0x100]
call fcn.140028ca0
nop
mov rcx, qword [rsp + 0x2b8]
test rcx, rcx
je 0x1402c4aa0
call fcn.140031ec0
nop
lea rcx, [rsp + 0x290]
call fcn.140028ca0
mov qword [rsp + 0x1c0], r13
movdqa xmm0, xmmword [0x14034cea0]
movdqu xmmword [rsp + 0x1d0], xmm0
mov word [rsp + 0x1c0], r13w
mov r8d, 8
lea rdx, str.Modules
lea rcx, [rsp + 0x1c0]
call fcn.140032810
nop
mov r9, qword [r14 + 0x10]
cmp qword [r14 + 0x18], 8
jb 0x1402c4af8
mov r14, qword [r14]
mov r8, r14
xor edx, edx
lea rcx, [rsp + 0x1c0]
call fcn.1400420c0
movups xmm1, xmmword [rax]
movups xmmword [rsp + 0x200], xmm1
movups xmm0, xmmword [rax + 0x10]
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
movups xmmword [rsp + 0x1e0], xmm1
movups xmmword [rsp + 0x1f0], xmm0
movdqa xmm0, xmmword [0x14034cea0]
movdqu xmmword [rsp + 0x210], xmm0
mov word [rsp + 0x200], r13w
lea r8, [rsp + 0xa0]
lea rdx, [rsp + 0x1e0]
lea rcx, [rsp + 0x2a0]
call fcn.1402c3540
nop
lea rcx, [rsp + 0x1e0]
call fcn.140033a90
nop
lea rcx, [rsp + 0x200]
call fcn.140033a90
nop
lea rcx, [rsp + 0x1c0]
call fcn.140033a90
xorps xmm0, xmm0
movups xmmword [rsp + 0x2c0], xmm0
mov rax, qword [rsp + 0x2a8]
test rax, rax
je 0x1402c4bbe
lock inc dword [rax + 8]
mov rax, qword [rsp + 0x2a8]
movaps xmm1, xmmword [rsp + 0x2a0]
movdqa xmmword [rsp + 0x2c0], xmm1
movups xmmword [rsp + 0x110], xmm0
test rax, rax
je 0x1402c4be8
lock inc dword [rax + 8]
movaps xmm1, xmmword [rsp + 0x2a0]
movdqa xmmword [rsp + 0x190], xmm1
lea rdx, [rsp + 0x190]
lea rcx, [rsp + 0x110]
call fcn.1402c59d0
nop
mov rdi, qword [rsp + 0x110]
nop
mov rbx, qword [rsp + 0x2c0]
cmp rbx, rdi
je 0x1402c4c7f
mov r8d, 1
lea rdx, [0x140329f60]
lea rcx, [rsp + 0x240]
call fcn.140032440
lea rdx, [rbx + 0x20]
cmp qword [rdx + 0x18], 8
jb 0x1402c4c45
mov rdx, qword [rdx]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x1402c4c50
lea rcx, [rsp + 0x240]
call fcn.140032440
lea rcx, [rsp + 0x2c0]
call fcn.1402c52d0
test eax, eax
jne 0x1402c4d5b
jmp 0x1402c4c10
lea rcx, [rsp + 0x110]
call fcn.140028ca0
nop
mov rcx, qword [rsp + 0x2c8]
test rcx, rcx
je 0x1402c4ca0
call fcn.140031ec0
nop
lea rcx, [rsp + 0x2a0]
call fcn.140028ca0
mov r8, qword [rsp + 0x250]
cmp r8, r15
cmova r8, r15
lea rdx, [rsp + 0x240]
cmp qword [rsp + 0x258], 8
cmovae rdx, qword [rsp + 0x240]
lea rcx, [0x1403b3ce0]
call fcn.1402cc71c
mov rcx, r12
call fcn.1402c4d70
nop
lea rcx, [rsp + 0x260]
call fcn.140033a90
nop
lea rcx, [rsp + 0x240]
call fcn.140033a90
nop
mov rcx, qword [rsp + 0x300]
xor rcx, rsp
call fcn.14013af80
lea r11, [rsp + 0x310]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call fcn.1401421d8
nop
call fcn.1401421d8
nop
call fcn.1401421d8
nop
call fcn.1401421d8
nop
mov edx, eax
lea rcx, str.directory_iterator::operator
call fcn.1402c5900
nop
mov edx, eax
lea rcx, str.directory_iterator::operator
call fcn.1402c5900
int3