Function at 0x140081200
Capabilities:
Accept command line arguments

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x310
mov rax, qword [0x140150a10]
xor rax, rsp
mov qword [rsp + 0x300], rax
mov r14, rdx
mov r12, rcx
xor r13d, r13d
mov qword [r11 - 0xf8], r13
mov qword [r11 - 0xe8], r13
mov qword [r11 - 0xe0], 7
mov word [r11 - 0xf8], r13w
lea rax, vtable.Intel::RegistryAPI.0
mov qword [r11 - 0xb8], rax
mov qword [r11 - 0xd8], r13
mov qword [r11 - 0xc8], r13
mov qword [r11 - 0xc0], 7
mov word [r11 - 0xd8], r13w
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov r9, rax
lea r10, [rsp + 0x2fa]
movabs r11, 0xcccccccccccccccd
sub r10, 2
mov rax, r11
mul r9
mov r8, rdx
shr r8, 3
movzx ecx, r8w
shl cx, 2
lea edx, [rcx + r8]
add dx, dx
sub r9w, dx
add r9w, 0x30
mov word [r10], r9w
mov r9, r8
test r8, r8
jne 0x1400812a1
mov qword [rsp + 0x1a0], r13
mov qword [rsp + 0x1b0], r13
mov qword [rsp + 0x1b8], 7
lea rax, [rsp + 0x2fa]
cmp r10, rax
je 0x14008131d
lea r8, [rsp + 0x2fa]
sub r8, r10
sar r8, 1
mov rdx, r10
lea rcx, [rsp + 0x1a0]
call fcn.14000de60
lea rcx, [rsp + 0x240]
call fcn.140008bf0
movups xmm0, xmmword [rsp + 0x1a0]
movups xmmword [rsp + 0x240], xmm0
movups xmm1, xmmword [rsp + 0x1b0]
movups xmmword [rsp + 0x250], xmm1
mov qword [rsp + 0x120], r13
mov qword [rsp + 0x130], r13
mov qword [rsp + 0x138], 7
mov word [rsp + 0x120], r13w
mov r8d, 0xb
lea rdx, str.Install_Dir
lea rcx, [rsp + 0x120]
call fcn.14000de60
nop
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], r13w
mov r8d, 0x17
lea rdx, str.SOFTWAREMCAFEEMODCORE
lea rcx, [rsp + 0x60]
call fcn.14000de60
nop
lea r9, [rsp + 0x260]
lea r8, [rsp + 0x120]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x280]
call fcn.140083270
mov ebx, eax
mov rdx, qword [rsp + 0x78]
mov r15d, 0x1000
cmp rdx, 8
jb 0x140081423
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, r15
jb 0x14008141e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140081ef4
call fcn.1400ab6e0
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], r13w
mov rdx, qword [rsp + 0x138]
cmp rdx, 8
jb 0x14008147b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x120]
mov rax, rcx
cmp rdx, r15
jb 0x140081476
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140081efa
call fcn.1400ab6e0
test ebx, ebx
jne 0x140081587
mov r8, qword [rsp + 0x250]
mov r9, qword [rsp + 0x258]
mov rax, r9
sub rax, r8
lea rcx, [rsp + 0x240]
cmp rax, 1
jb 0x1400814d3
lea rdx, [r8 + 1]
mov qword [rsp + 0x250], rdx
cmp r9, 8
cmovae rcx, qword [rsp + 0x240]
movzx eax, word [0x140102870]
mov word [rcx + r8*2], ax
mov word [rcx + rdx*2], r13w
jmp 0x1400814f3
mov qword [rsp + 0x20], 1
lea r9, [0x140102870]
movzx r8d, byte [rsp + 0x30]
mov edx, 1
call fcn.14000fc90
mov rdi, qword [rsp + 0x270]
lea r9, [rsp + 0x260]
cmp qword [rsp + 0x278], 8
cmovae r9, qword [rsp + 0x260]
mov rsi, qword [rsp + 0x250]
mov rcx, qword [rsp + 0x258]
mov rax, rcx
sub rax, rsi
cmp rdi, rax
ja 0x14008156c
lea rax, [rdi + rsi]
mov qword [rsp + 0x250], rax
lea rbx, [rsp + 0x240]
cmp rcx, 8
cmovae rbx, qword [rsp + 0x240]
lea rcx, [rbx + rsi*2]
lea r8, [rdi + rdi]
mov rdx, r9
call fcn.1400ada20
lea rax, [rdi + rsi]
mov word [rbx + rax*2], r13w
jmp 0x140081587
mov qword [rsp + 0x20], rdi
movzx r8d, byte [rsp + 0x30]
mov rdx, rdi
lea rcx, [rsp + 0x240]
call fcn.14000fc90
mov qword [rsp + 0x140], r13
mov qword [rsp + 0x150], r13
mov qword [rsp + 0x158], 7
mov word [rsp + 0x140], r13w
mov r8d, 0xe
lea rdx, str.WSS_HardwareId
lea rcx, [rsp + 0x140]
call fcn.14000de60
nop
mov qword [rsp + 0x80], r13
mov qword [rsp + 0x90], r13
mov qword [rsp + 0x98], 7
mov word [rsp + 0x80], r13w
mov r8d, 0x21
lea rdx, str.SOFTWAREMcAfeeMcClientAnalytics
lea rcx, [rsp + 0x80]
call fcn.14000de60
nop
lea r9, [rsp + 0x260]
lea r8, [rsp + 0x140]
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x280]
call fcn.140083270
mov ebx, eax
mov rdx, qword [rsp + 0x98]
cmp rdx, 8
jb 0x140081672
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x80]
mov rax, rcx
cmp rdx, r15
jb 0x14008166d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140081f00
call fcn.1400ab6e0
mov qword [rsp + 0x90], r13
mov qword [rsp + 0x98], 7
mov word [rsp + 0x80], r13w
mov rdx, qword [rsp + 0x158]
cmp rdx, 8
jb 0x1400816d3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x140]
mov rax, rcx
cmp rdx, r15
jb 0x1400816ce
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140081f06
call fcn.1400ab6e0
test ebx, ebx
jne 0x1400817df
mov r8, qword [rsp + 0x250]
mov r9, qword [rsp + 0x258]
mov rax, r9
sub rax, r8
lea rcx, [rsp + 0x240]
cmp rax, 1
jb 0x14008172b
lea rdx, [r8 + 1]
mov qword [rsp + 0x250], rdx
cmp r9, 8
cmovae rcx, qword [rsp + 0x240]
movzx eax, word [0x140102870]
mov word [rcx + r8*2], ax
mov word [rcx + rdx*2], r13w
jmp 0x14008174b
mov qword [rsp + 0x20], 1
lea r9, [0x140102870]
movzx r8d, byte [rsp + 0x30]
mov edx, 1
call fcn.14000fc90
mov rdi, qword [rsp + 0x270]
lea r9, [rsp + 0x260]
cmp qword [rsp + 0x278], 8
cmovae r9, qword [rsp + 0x260]
mov rsi, qword [rsp + 0x250]
mov rcx, qword [rsp + 0x258]
mov rax, rcx
sub rax, rsi
cmp rdi, rax
ja 0x1400817c4
lea rax, [rdi + rsi]
mov qword [rsp + 0x250], rax
lea rbx, [rsp + 0x240]
cmp rcx, 8
cmovae rbx, qword [rsp + 0x240]
lea rcx, [rbx + rsi*2]
lea r8, [rdi + rdi]
mov rdx, r9
call fcn.1400ada20
lea rax, [rdi + rsi]
mov word [rbx + rax*2], r13w
jmp 0x1400817df
mov qword [rsp + 0x20], rdi
movzx r8d, byte [rsp + 0x30]
mov rdx, rdi
lea rcx, [rsp + 0x240]
call fcn.14000fc90
lea r8, str.Global834C46D9_6762_4FF9_8279_2C04C8B1162Cdefault
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenEventW]
mov rbx, rax
mov r8, qword [rsp + 0x250]
mov rax, qword [rsp + 0x258]
mov rcx, rax
sub rcx, r8
cmp rcx, 1
lea rcx, [rsp + 0x240]
jb 0x140081846
lea rdx, [r8 + 1]
mov qword [rsp + 0x250], rdx
cmp rax, 8
cmovae rcx, qword [rsp + 0x240]
movzx eax, word [0x140102870]
mov word [rcx + r8*2], ax
mov word [rcx + rdx*2], r13w
jmp 0x140081866
mov qword [rsp + 0x20], 1
lea r9, [0x140102870]
movzx r8d, byte [rsp + 0x30]
mov edx, 1
call fcn.14000fc90
test rbx, rbx
je 0x1400818fc
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x250]
mov rdx, qword [rsp + 0x258]
mov rax, rdx
sub rax, rcx
cmp rax, 0xe
jb 0x1400818d2
lea rdi, [rcx + 0xe]
mov qword [rsp + 0x250], rdi
lea rbx, [rsp + 0x240]
cmp rdx, 8
cmovae rbx, qword [rsp + 0x240]
lea rcx, [rbx + rcx*2]
mov r8d, 0x1c
lea rdx, str.UPDATE_RUNNING
call fcn.1400ada20
mov word [rbx + rdi*2], r13w
jmp 0x140081916
mov qword [rsp + 0x20], 0xe
lea r9, str.UPDATE_RUNNING
movzx r8d, byte [rsp + 0x30]
mov edx, 0xe
lea rcx, [rsp + 0x240]
call fcn.14000fc90
jmp 0x140081916
mov r8d, 0x12
lea rdx, str.UPDATE_NOT_RUNNING
lea rcx, [rsp + 0x240]
call fcn.14000f880
mov qword [rsp + 0xf0], r14
lea rax, [rsp + 0x240]
mov qword [rsp + 0xf8], rax
mov qword [rsp + 0xb0], r13
mov qword [rsp + 0xc0], r13
mov qword [rsp + 0xc8], 7
mov word [rsp + 0xb0], r13w
mov r8d, 0xe
lea rdx, str.MessageBus.dll
lea rcx, [rsp + 0xb0]
call fcn.14000de60
nop
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0xf0]
call fcn.140080960
nop
mov r8, qword [rsp + 0xc8]
cmp r8, 8
jb 0x1400819aa
inc r8
mov rdx, qword [rsp + 0xb0]
lea rcx, [rsp + 0xb0]
call fcn.14000e080
mov qword [rsp + 0xd0], r13
mov qword [rsp + 0xe0], r13
mov qword [rsp + 0xe8], 7
mov word [rsp + 0xd0], r13w
mov r8d, 0x11
lea rdx, str.ModuleManager.dll
lea rcx, [rsp + 0xd0]
call fcn.14000de60
nop
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0xf0]
call fcn.140080960
nop
mov r8, qword [rsp + 0xe8]
cmp r8, 8
jb 0x140081a26
inc r8
mov rdx, qword [rsp + 0xd0]
lea rcx, [rsp + 0xd0]
call fcn.14000e080
mov r8d, 1
lea rdx, [0x140102870]
lea rcx, [rsp + 0x240]
call fcn.14000f880
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], r13w
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140081a70
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.14000de60
nop
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rdx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x50]
lea rcx, [rsp + 0x240]
call fcn.14000f880
nop
mov r8, qword [rsp + 0x58]
cmp r8, 8
jb 0x140081aca
inc r8
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x40]
call fcn.14000e080
mov qword [rsp + 0xa0], r13
lea rax, [0x1401505f8]
mov qword [rsp + 0xa8], rax
mov rdx, r14
cmp qword [r14 + 0x18], 8
jb 0x140081aee
mov rdx, qword [r14]
mov qword [rsp + 0x160], r13
mov qword [rsp + 0x170], r13
mov qword [rsp + 0x178], 7
mov word [rsp + 0x160], r13w
mov r8, qword [r14 + 0x10]
lea rcx, [rsp + 0x160]
call fcn.14000de60
nop
lea r8, [rsp + 0xa0]
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x290]
call fcn.1400805b0
nop
lea rcx, [rsp + 0x160]
call fcn.140008bf0
xorps xmm0, xmm0
movups xmmword [rsp + 0x2b0], xmm0
mov rax, qword [rsp + 0x298]
test rax, rax
je 0x140081b74
lock inc dword [rax + 8]
mov rax, qword [rsp + 0x298]
movaps xmm1, xmmword [rsp + 0x290]
movdqa xmmword [rsp + 0x2b0], xmm1
movups xmmword [rsp + 0x100], xmm0
test rax, rax
je 0x140081b9e
lock inc dword [rax + 8]
movaps xmm1, xmmword [rsp + 0x290]
movdqa xmmword [rsp + 0x180], xmm1
lea rdx, [rsp + 0x180]
lea rcx, [rsp + 0x100]
call fcn.140082c10
nop
mov rdi, qword [rsp + 0x100]
nop word [rax + rax]
mov rbx, qword [rsp + 0x2b0]
cmp rbx, rdi
je 0x140081c3f
mov r8d, 1
lea rdx, [0x140102870]
lea rcx, [rsp + 0x240]
call fcn.14000f880
lea rdx, [rbx + 0x20]
cmp qword [rdx + 0x18], 8
jb 0x140081c05
mov rdx, qword [rdx]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x140081c10
lea rcx, [rsp + 0x240]
call fcn.14000f880
lea rcx, [rsp + 0x2b0]
call fcn.140082490
test eax, eax
jne 0x140081f0c
jmp 0x140081bd0
lea rcx, [rsp + 0x100]
call fcn.140009740
nop
mov rcx, qword [rsp + 0x2b8]
test rcx, rcx
je 0x140081c60
call fcn.14000da40
nop
lea rcx, [rsp + 0x290]
call fcn.140009740
mov qword [rsp + 0x1c0], r13
movdqa xmm0, xmmword [0x14012bae0]
movdqu xmmword [rsp + 0x1d0], xmm0
mov word [rsp + 0x1c0], r13w
mov r8d, 8
lea rdx, str.Modules
lea rcx, [rsp + 0x1c0]
call fcn.14000de60
nop
mov r9, qword [r14 + 0x10]
cmp qword [r14 + 0x18], 8
jb 0x140081cb8
mov r14, qword [r14]
mov r8, r14
xor edx, edx
lea rcx, [rsp + 0x1c0]
call fcn.14001f9b0
movups xmm1, xmmword [rax]
movups xmmword [rsp + 0x200], xmm1
movups xmm0, xmmword [rax + 0x10]
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
movups xmmword [rsp + 0x1e0], xmm1
movups xmmword [rsp + 0x1f0], xmm0
movdqa xmm0, xmmword [0x14012bae0]
movdqu xmmword [rsp + 0x210], xmm0
mov word [rsp + 0x200], r13w
lea r8, [rsp + 0xa0]
lea rdx, [rsp + 0x1e0]
lea rcx, [rsp + 0x2a0]
call fcn.1400805b0
nop
lea rcx, [rsp + 0x1e0]
call fcn.140008bf0
nop
lea rcx, [rsp + 0x200]
call fcn.140008bf0
nop
lea rcx, [rsp + 0x1c0]
call fcn.140008bf0
xorps xmm0, xmm0
movups xmmword [rsp + 0x2c0], xmm0
mov rax, qword [rsp + 0x2a8]
test rax, rax
je 0x140081d7e
lock inc dword [rax + 8]
mov rax, qword [rsp + 0x2a8]
movaps xmm1, xmmword [rsp + 0x2a0]
movdqa xmmword [rsp + 0x2c0], xmm1
movups xmmword [rsp + 0x110], xmm0
test rax, rax
je 0x140081da8
lock inc dword [rax + 8]
movaps xmm1, xmmword [rsp + 0x2a0]
movdqa xmmword [rsp + 0x190], xmm1
lea rdx, [rsp + 0x190]
lea rcx, [rsp + 0x110]
call fcn.140082c10
nop
mov rdi, qword [rsp + 0x110]
nop
mov rbx, qword [rsp + 0x2c0]
cmp rbx, rdi
je 0x140081e3f
mov r8d, 1
lea rdx, [0x140102870]
lea rcx, [rsp + 0x240]
call fcn.14000f880
lea rdx, [rbx + 0x20]
cmp qword [rdx + 0x18], 8
jb 0x140081e05
mov rdx, qword [rdx]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x140081e10
lea rcx, [rsp + 0x240]
call fcn.14000f880
lea rcx, [rsp + 0x2c0]
call fcn.140082490
test eax, eax
jne 0x140081f1b
jmp 0x140081dd0
lea rcx, [rsp + 0x110]
call fcn.140009740
nop
mov rcx, qword [rsp + 0x2c8]
test rcx, rcx
je 0x140081e60
call fcn.14000da40
nop
lea rcx, [rsp + 0x2a0]
call fcn.140009740
mov r8, qword [rsp + 0x250]
cmp r8, r15
cmova r8, r15
lea rdx, [rsp + 0x240]
cmp qword [rsp + 0x258], 8
cmovae rdx, qword [rsp + 0x240]
lea rcx, [0x14015d7b0]
call fcn.1400c08a8
mov rcx, r12
call fcn.140081f30
nop
lea rcx, [rsp + 0x260]
call fcn.140008bf0
nop
lea rcx, [rsp + 0x240]
call fcn.140008bf0
nop
mov rcx, qword [rsp + 0x300]
xor rcx, rsp
call fcn.1400ab6c0
lea r11, [rsp + 0x310]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call fcn.1400b2bb8
nop
call fcn.1400b2bb8
nop
call fcn.1400b2bb8
nop
call fcn.1400b2bb8
nop
mov edx, eax
lea rcx, str.directory_iterator::operator
call fcn.140082ae0
nop
mov edx, eax
lea rcx, str.directory_iterator::operator
call fcn.140082ae0
int3