Function at 0x14002ab80
Capabilities:
Create process on windows
Set current directory

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0xb40
mov rax, qword [0x14008b5a0]
xor rax, rsp
mov qword [rsp + 0xb30], rax
movsxd rbp, ecx
lea rcx, str.advapi32
mov r12, rdx
mov qword [rsp + 0x98], rdx
mov dword [rsp + 0x5c], ebp
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
mov rdi, rax
mov ebx, 1
je 0x14002ac5e
lea rdx, str.TraceMessage
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor r15d, r15d
test rax, rax
mov qword [0x140080008], rax
jne 0x14002ac28
lea rcx, [fcn.140001010]
lea rax, [0x140001140]
mov dword [0x14008ccc0], r15d
mov qword [fcn.140001010], rcx
mov rcx, rdi
mov qword [0x140080008], rax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x14002ac84
lea rdx, str.TraceMessageVa
mov rcx, rdi
mov dword [0x14008ccc0], ebx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [fcn.140001010]
test rax, rax
cmove rax, rcx
mov rcx, rdi
mov qword [fcn.140001010], rax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x14002ac84
lea rax, [0x140001140]
lea rcx, [fcn.140001010]
xor r15d, r15d
mov qword [0x140080008], rax
mov qword [fcn.140001010], rcx
mov dword [0x14008ccc0], r15d
lea rax, [0x14008ce20]
lea rcx, str.McAfeemfehidin
mov qword [0x14008ce00], rax
lea rax, [0x1400607f8]
mov qword [0x14008ce10], r15
mov qword [0x14008ce40], rax
lea rax, [0x140060808]
mov byte [0x14008ce18], bl
mov qword [0x14008ce48], rax
lea rax, [0x14008ce00]
mov byte [0x14008ce19], 2
mov word [0x14008ce1a], 0
mov dword [0x14008ce1c], r15d
mov qword [0x14008ce30], r15
mov qword [0x140080018], rax
mov qword [0x14008ce20], r15
mov byte [0x14008ce38], bl
mov byte [0x14008ce39], 2
mov word [0x14008ce3a], 0
mov dword [0x14008ce3c], r15d
call fcn.14002a9f0
mov qword [0x14008ce50], r12
mov dword [0x14008ce58], ebp
mov r14, r15
mov qword [rsp + 0x78], r15
mov qword [rsp + 0x90], r15
mov rsi, r15
mov qword [rsp + 0x80], r15
mov dword [rsp + 0x70], 7
mov byte [0x14008cceb], 0
call fcn.140039be0
call fcn.140039c20
lea rcx, [rsp + 0x462]
xor edx, edx
mov r8d, 0x256
mov word [rsp + 0x460], 0
call fcn.14004c980
mov rcx, qword [r12]
lea rdx, [rsp + 0x460]
mov r8d, 0x12c
call fcn.14003f550
lea rcx, [rsp + 0x6c2]
xor edx, edx
mov r8d, 0x256
mov word [rsp + 0x6c0], 0
call fcn.14004c980
mov rcx, qword [r12]
lea rdx, [rsp + 0x6c0]
mov r8d, 0x12c
call fcn.14003a1f0
lea rcx, [rsp + 0x392]
xor edx, edx
mov r8d, 0xc6
mov word [rsp + 0x390], 0
call fcn.14004c980
lea rcx, [rsp + 0x6c0]
mov dx, 0x5c
call fcn.140038550
lea rcx, [0x14002aaf0]
mov edx, ebx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
xor ecx, ecx
call fcn.140045860
test rdi, rdi
je 0x14002ae2a
lea r8, [rdi + 2]
lea rcx, [rsp + 0x390]
mov edx, 0x64
call fcn.140038320
jmp 0x14002ae44
lea r8, [rsp + 0x6c0]
lea rcx, [rsp + 0x390]
mov edx, 0x64
call fcn.140038320
lea rcx, [rsp + 0x460]
mov qword [rsp + 0xb70], r13
call fcn.14003a110
lea rcx, [rsp + 0x8c]
xor edx, edx
call fcn.14003cb00
cmp dword [rsp + 0x8c], 9
lea rdi, [0x140066fd0]
cmovne rdi, r15
lea rcx, [0x140066fd0]
mov dword [rsp + 0x88], eax
mov rdx, rdi
call fcn.140038460
test eax, eax
sete cl
test cl, cl
jne 0x14002b199
lea r8, [rsp + 0x460]
lea rcx, [rsp + 0x130]
mov edx, 0x12c
call fcn.140038320
lea r8, [0x140063c7c]
lea rcx, [rsp + 0x130]
mov edx, 0x12c
call fcn.140038380
lea rcx, [rsp + 0x130]
mov r8, rdi
mov edx, 0x12c
call fcn.140038380
lea r8, [0x140063c7c]
lea rcx, [rsp + 0x130]
mov edx, 0x12c
call fcn.140038380
lea r8, [rsp + 0x390]
lea rcx, [rsp + 0x130]
mov edx, 0x12c
call fcn.140038380
lea rcx, [rsp + 0x130]
xor edx, edx
call fcn.14003a070
test al, al
je 0x14002b17c
lea rcx, [rsp + 0x130]
xor r14b, r14b
call fcn.140036f80
cmp rbx, rbp
mov rdi, rbx
lea rsi, [rax + rax + 2]
mov r13, rbp
jge 0x14002af66
mov rcx, qword [r12 + rdi*8]
call fcn.140036f80
add rdi, rbx
cmp rdi, rbp
lea rsi, [rsi + rax*2 + 2]
jl 0x14002af50
mov rcx, rsi
call fcn.14004c8b0
test rax, rax
mov r12, rax
je 0x14002b14e
mov r8, rsi
xor edx, edx
mov rcx, rax
call fcn.14004c980
lea rcx, [rsp + 0x130]
shr rsi, 1
call fcn.140036f80
lea r8, [rsp + 0x130]
mov rdx, rsi
mov r9, rax
mov rcx, r12
call fcn.140038350
lea rcx, [rsp + 0x130]
call fcn.140036f80
mov rcx, r12
lea rbx, [r12 + rax*2]
call fcn.140036f80
mov rdx, rsi
mov edi, 1
lea r8, [0x14006de20]
mov rcx, rbx
sub rdx, rax
mov r9, rdi
call fcn.140038350
add rbx, 2
cmp rdi, r13
mov rbp, rdi
jge 0x14002b060
mov r14, qword [rsp + 0x98]
mov rcx, qword [r14 + rbp*8]
call fcn.140036f80
mov rcx, r12
mov rdi, rax
call fcn.140036f80
mov r8, qword [r14 + rbp*8]
mov rdx, rsi
mov r9, rdi
mov rcx, rbx
sub rdx, rax
call fcn.140038350
mov rcx, qword [r14 + rbp*8]
call fcn.140036f80
mov rcx, r12
lea rbx, [rbx + rax*2]
call fcn.140036f80
mov rdx, rsi
lea r8, [0x14006de20]
mov r9d, 1
mov rcx, rbx
sub rdx, rax
call fcn.140038350
add rbp, 1
add rbx, 2
cmp rbp, r13
jl 0x14002aff7
xor r14b, r14b
xor eax, eax
lea rdi, [rsp + 0xc0]
mov ecx, 0x68
rep stosb byte [rdi], al
lea rdi, [rsp + 0xa0]
mov ecx, 0x18
rep stosb byte [rdi], al
lea rax, [rsp + 0xa0]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xc0]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov rdx, r12
xor ecx, ecx
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x20], 1
mov dword [rsp + 0xc0], 0x68
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14002b13d
mov rcx, qword [rsp + 0xa0]
or edx, 0xffffffff
mov r14b, 1
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0xa0]
lea rdx, [rsp + 0x70]
mov dword [rsp + 0x70], r15d
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov r8d, dword [rsp + 0x70]
test r8d, r8d
mov r15d, r8d
je 0x14002b121
lea rdx, [rsp + 0x130]
lea rcx, str.ERROR:_Native_installer__s_exited_with_return_code__d_n
call fcn.14004caac
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r12
call fcn.14004ca6c
test r14b, r14b
jne 0x14002c41d
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [rsp + 0x130]
lea rcx, str.ERROR:_Unable_to_launch_native_installer__s._GetLastError_d_n
mov r8d, eax
call fcn.14004caac
mov r14, qword [rsp + 0x78]
or r15d, 0xffffffff
mov rsi, r14
jmp 0x14002c425
lea rdx, [rsp + 0x130]
lea rcx, str.ERROR:_Cannot_find_native_version_of_this_installer_at__s_n
call fcn.14004caac
or r15d, 0xffffffff
jmp 0x14002c425
mov rcx, rdi
call fcn.1400382a0
test al, al
jne 0x14002b1bb
xor edx, edx
mov rcx, rdi
call fcn.14003a070
test al, al
je 0x14002b1bb
mov rcx, rdi
call fcn.14003a110
xor al, al
mov dword [rsp + 0x60], ebx
movzx r14d, bl
mov byte [rsp + 0x6d], 0
lea r13, [rsp + 0x6c0]
mov dword [rsp + 0x68], r15d
mov byte [rsp + 0x58], al
mov byte [rsp + 0x50], al
mov byte [rsp + 0x64], al
mov byte [rsp + 0x6c], al
or rbx, 0xffffffffffffffff
nop
nop
lea eax, [rsi + 1]
cmp eax, ebp
jge 0x14002bb42
movsxd rdx, eax
xor eax, eax
mov rcx, rbx
mov rbp, qword [r12 + rdx*8]
xor r14b, r14b
mov dword [rsp + 0x54], edx
mov rdi, rbp
mov rsi, rdx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
cmp rcx, 2
jb 0x14002b523
movzx eax, word [rbp]
cmp ax, 0x2d
je 0x14002b23c
cmp ax, 0x2f
jne 0x14002b523
movzx ecx, word [rbp + 2]
test cx, cx
je 0x14002b523
cmp word [rbp + 4], 0
jne 0x14002b523
mov r14b, 1
call fcn.140038390
movzx edx, ax
add edx, 0xffffffc1
cmp edx, 0x19
ja case.0x14002b280.64
lea r8, [0x140000000]
movsxd rax, edx
mov ecx, dword [r8 + rax*4 + 0x2c504]
add rcx, r8
jmp rcx
mov dword [rsp + 0x60], 2
jmp 0x14002b523
mov edx, esi
mov dword [rsp + 0x60], 3
mov dword [rsp + 0x68], 1
add edx, 1
cmp edx, dword [rsp + 0x5c]
jge 0x14002b523
mov rax, qword [r12 + rsi*8 + 8]
movzx ecx, word [rax]
cmp cx, 0x2d
je 0x14002b523
cmp cx, 0x2f
je 0x14002b523
movsxd rax, edx
lea rcx, str.Using_user_specified_install_ref__S_n
mov byte [rsp + 0x58], 1
mov r13, qword [r12 + rax*8]
mov dword [rsp + 0x54], eax
mov rsi, rax
mov rdx, r13
call fcn.1400154e0
lea rcx, str.Using_user_specified_install_ref__S_n
mov rdx, r13
call fcn.14004d888
jmp 0x14002b523
xor al, al
mov dword [rsp + 0x60], 5
mov byte [rsp + 0x64], al
jmp 0x14002b523
mov dword [rsp + 0x60], 5
mov byte [rsp + 0x64], 1
jmp 0x14002b523
mov byte [rsp + 0x6d], 1
jmp 0x14002b523
mov eax, esi
add eax, 1
cmp eax, dword [rsp + 0x5c]
jge 0x14002b523
xor r9d, r9d
movsxd rsi, eax
mov qword [rsp + 0x30], r15
mov rcx, qword [r12 + rsi*8]
lea edx, [r9 + 4]
lea r8d, [r9 + 1]
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x54], eax
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateFileW]
test rax, rax
mov qword [0x14008ccf0], rax
jne 0x14002b523
lea rcx, str.ERROR:_Failed_to_open_log_file_for_appending_n
call fcn.14004d888
jmp 0x14002b523
mov eax, esi
add eax, 1
cmp eax, dword [rsp + 0x5c]
jge 0x14002b435
movsxd rsi, eax
mov dword [rsp + 0x54], eax
mov rcx, qword [r12 + rsi*8]
call fcn.140036f70
mov dx, 0x5c
mov rcx, rax
mov rdi, rax
mov qword [rsp + 0x78], rax
call fcn.140038550
test rax, rax
je 0x14002b523
mov rcx, rdi
call fcn.140036f70
test rax, rax
mov rbx, rax
je 0x14002bb36
mov dx, 0x5c
mov rcx, rax
call fcn.140038550
mov rcx, qword [rsp + 0x78]
mov word [rax], 0
mov rdi, rax
call fcn.140038240
lea rcx, [rdi + 2]
call fcn.140036f70
lea rcx, str.Setting_CWD_to__S_n
mov rdx, rbx
mov qword [rsp + 0x78], rax
call fcn.1400154e0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov rcx, rbx
call fcn.140038240
or rbx, 0xffffffffffffffff
jmp 0x14002b523
lea rcx, str._x_cmd_switch_must_be_followed_by_a_feature
call fcn.14004d888
xor r14b, r14b
jmp 0x14002b523
mov edx, esi
add edx, 1
cmp edx, dword [rsp + 0x5c]
jge 0x14002b48b
mov rax, qword [r12 + rsi*8 + 8]
movzx ecx, word [rax]
cmp cx, 0x2d
je 0x14002b48b
cmp cx, 0x2f
je 0x14002b48b
movsxd rax, edx
mov dword [rsp + 0x60], 3
mov dword [rsp + 0x54], eax
mov rsi, rax
mov rax, qword [r12 + rax*8]
mov qword [rsp + 0x90], rax
jmp 0x14002b523
lea rcx, str._c_cmd_switch_must_be_followed_by_a_cab_file_name_n
call fcn.14004d888
xor r14b, r14b
jmp 0x14002b523
mov edx, esi
mov dword [rsp + 0x60], 4
add edx, 1
cmp edx, dword [rsp + 0x5c]
jge 0x14002b523
mov rax, qword [r12 + rsi*8 + 8]
movzx ecx, word [rax]
cmp cx, 0x2d
je 0x14002b523
cmp cx, 0x2f
je 0x14002b523
movsxd rax, edx
lea rcx, str.Using_user_specified_install_ref__S_n
mov byte [rsp + 0x58], 1
mov r13, qword [r12 + rax*8]
mov dword [rsp + 0x54], eax
mov rsi, rax
mov rdx, r13
call fcn.1400154e0
lea rcx, str.Using_user_specified_install_ref__S_n
mov rdx, r13
call fcn.14004d888
jmp 0x14002b523
mov eax, esi
add eax, 1
cmp eax, dword [rsp + 0x5c]
jge 0x14002b51b
movsxd rsi, eax
xor r8d, r8d
xor edx, edx
mov rcx, qword [r12 + rsi*8]
mov dword [rsp + 0x54], eax
call fcn.14004e0ec
jmp 0x14002b523
xor r14b, r14b
jmp 0x14002b523
xor r14b, r14b
xor eax, eax
mov rcx, rbx
mov rdi, rbp
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
cmp rcx, 3
jb 0x14002b86a
movzx eax, word [rbp]
cmp ax, 0x2d
je 0x14002b553
cmp ax, 0x2f
jne 0x14002b86a
cmp word [rbp + 2], 0
je 0x14002b86a
cmp word [rbp + 4], 0
je 0x14002b86a
cmp word [rbp + 6], 0
jne 0x14002b86a
lea rdx, [0x14006dbc8]
lea rcx, [rbp + 2]
call fcn.14004d5a4
test eax, eax
jne 0x14002b5a7
lea rcx, str.PACKAGE_HASH_n
call fcn.1400154e0
mov dword [rsp + 0x60], 6
mov dword [rsp + 0x68], 8
mov r14b, 1
lea rdx, [0x14006dbb0]
lea rcx, [rbp + 2]
call fcn.14004d5a4
test eax, eax
jne 0x14002b635
lea rcx, str.PACKAGE_SIGN_n
call fcn.1400154e0
mov edx, dword [rsp + 0x54]
mov dword [rsp + 0x60], 6
add edx, 1
mov dword [rsp + 0x68], 4
mov r14b, 1
cmp edx, dword [rsp + 0x5c]
jge 0x14002b626
mov rax, qword [r12 + rsi*8 + 8]
movzx ecx, word [rax]
cmp cx, 0x2d
je 0x14002b635
cmp cx, 0x2f
je 0x14002b635
movsxd rax, edx
mov dword [rsp + 0x54], eax
mov rsi, rax
mov rcx, qword [r12 + rax*8]
call fcn.140036f70
lea rcx, str.sha1_thumbprint_specified_on_cmd_line:__S_n
mov rdx, rax
mov qword [0x14008ce60], rax
call fcn.1400154e0
jmp 0x14002b635
lea rcx, str._ps_cmd_switch_must_be_followed_by_a_sha1_thumbprint
call fcn.14004d888
xor r14b, r14b
lea rdx, [0x14006db30]
lea rcx, [rbp + 2]
call fcn.14004d5a4
test eax, eax
jne 0x14002b668
lea rcx, str.PACKAGE_VERIFY_n
call fcn.1400154e0
mov dword [rsp + 0x60], 6
mov dword [rsp + 0x68], FDIDestroy
mov r14b, 1
lea rdx, [0x14006db18]
lea rcx, [rbp + 2]
call fcn.14004d5a4
test eax, eax
jne 0x14002b69b
lea rcx, str.PACKAGE_LIST_n
call fcn.1400154e0
mov dword [rsp + 0x60], 6
mov dword [rsp + 0x68], 0x800
mov r14b, 1
lea rdx, [0x14006dafc]
lea rcx, [rbp + 2]
call fcn.14004d5a4
test eax, eax
jne 0x14002b715
lea rcx, str.PACKAGE_PLATFORM_n
call fcn.1400154e0
mov edx, dword [rsp + 0x54]
mov dword [rsp + 0x60], 6
add edx, 1
mov dword [rsp + 0x68], 0x2000
mov r14b, 1
cmp edx, dword [rsp + 0x5c]
jge 0x14002b706
mov rax, qword [r12 + rsi*8 + 8]
movzx ecx, word [rax]
cmp cx, 0x2d
je 0x14002b706
cmp cx, 0x2f
je 0x14002b706
movsxd rax, edx
mov dword [rsp + 0x54], eax
mov rsi, rax
mov rax, qword [r12 + rax*8]
mov qword [0x14008cd08], rax
jmp 0x14002b715
lea rcx, str._pp_cmd_switch_must_be_followed_by_platform__x86_or_x64__n
call fcn.14004d888
xor r14b, r14b
lea rdx, [0x14006daa0]
lea rcx, [rbp + 2]
call fcn.14004d5a4
test eax, eax
jne 0x14002b78f
lea rcx, str.PACKAGE_CAB_n
call fcn.1400154e0
mov edx, dword [rsp + 0x54]
mov dword [rsp + 0x60], 6
add edx, 1
mov dword [rsp + 0x68], 0x2000
mov r14b, 1
cmp edx, dword [rsp + 0x5c]
jge 0x14002b780
mov rax, qword [r12 + rsi*8 + 8]
movzx ecx, word [rax]
cmp cx, 0x2d
je 0x14002b780
cmp cx, 0x2f
je 0x14002b780
movsxd rax, edx
mov dword [rsp + 0x54], eax
mov rsi, rax
mov rax, qword [r12 + rax*8]
mov qword [0x14008cd10], rax
jmp 0x14002b78f
lea rcx, str._pc_cmd_switch_must_be_followed_by_a_cabinet_file_name._n
call fcn.14004d888
xor r14b, r14b
lea rdx, [0x14006da44]
lea rcx, [rbp + 2]
call fcn.14004d5a4
test eax, eax
jne 0x14002b811
lea rcx, str.UPGRADE_n
call fcn.1400154e0
mov edx, dword [rsp + 0x54]
mov dword [rsp + 0x60], 3
add edx, 1
mov dword [rsp + 0x68], 0x4001
cmp edx, dword [rsp + 0x5c]
jge 0x14002b80e
mov rax, qword [r12 + rsi*8 + 8]
movzx ecx, word [rax]
cmp cx, 0x2d
je 0x14002b80e
cmp cx, 0x2f
je 0x14002b80e
movsxd rax, edx
lea rcx, str.Using_user_specified_install_ref__S_n
mov byte [rsp + 0x58], 1
mov r13, qword [r12 + rax*8]
mov dword [rsp + 0x54], eax
mov rdx, r13
call fcn.1400154e0
lea rcx, str.Using_user_specified_install_ref__S_n
mov rdx, r13
call fcn.14004d888
mov r14b, 1
lea rdx, [0x14006da30]
lea rcx, [rbp + 2]
call fcn.14004d5a4
test eax, eax
jne 0x14002b844
lea rcx, str.UPGRADE_n
call fcn.1400154e0
mov dword [rsp + 0x60], 3
mov dword [rsp + 0x68], pe_nt_image_headers64
mov r14b, 1
lea rdx, [0x14006da28]
lea rcx, [rbp + 2]
call fcn.14004d5a4
test eax, eax
jne 0x14002b86a
mov dword [rsp + 0x60], 4
mov byte [0x14008cce9], 1
mov r14b, 1
xor eax, eax
mov rcx, rbx
mov rdi, rbp
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
cmp rcx, 4
jne 0x14002b8eb
movzx eax, word [rbp]
cmp ax, 0x2d
je 0x14002b892
cmp ax, 0x2f
jne 0x14002b8e5
cmp word [rbp + 8], 0
jne 0x14002b8df
lea rcx, [rbp + 2]
lea rdx, [0x14006da20]
call fcn.14004d5a4
test eax, eax
jne 0x14002b8f1
mov eax, dword [rsp + 0x54]
mov esi, dword [rsp + 0x5c]
add eax, 1
cmp eax, esi
jge 0x14002b8f5
mov dword [rsp + 0x54], eax
cdqe
lea rcx, str.ETL_TRACING_ON_n
mov rax, qword [r12 + rax*8]
mov qword [rsp + 0x80], rax
call fcn.1400154e0
mov r14b, 1
jmp 0x14002b8f5
mov esi, dword [rsp + 0x5c]
jmp 0x14002b8f5
mov esi, dword [rsp + 0x5c]
jmp 0x14002b8f5
mov esi, dword [rsp + 0x5c]
jmp 0x14002b8f5
mov esi, dword [rsp + 0x5c]
xor eax, eax
mov rcx, rbx
mov rdi, rbp
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
cmp rcx, 8
jne 0x14002ba06
movzx eax, word [rbp]
cmp ax, 0x2d
je 0x14002b925
cmp ax, 0x2f
jne 0x14002ba00
cmp word [rbp + 0x10], 0
jne 0x14002b9fa
lea rcx, [rbp + 2]
lea rdx, str.ETLFILT
call fcn.14004d5a4
test eax, eax
jne 0x14002ba12
mov edi, dword [rsp + 0x54]
add edi, 1
cmp edi, esi
jge 0x14002ba0c
lea rcx, str.ETL_Filter_set_n
call fcn.1400154e0
movsxd rsi, edi
lea rdx, [0x14006d9e0]
mov rcx, qword [r12 + rsi*8]
mov r14b, 1
call fcn.14004d5a4
test eax, eax
jne 0x14002b98a
mov dword [rsp + 0x70], 1
jmp 0x14002ba16
mov rcx, qword [r12 + rsi*8]
lea rdx, str.VSCORE
call fcn.14004d5a4
test eax, eax
jne 0x14002b9a8
mov dword [rsp + 0x70], 2
jmp 0x14002ba16
mov rcx, qword [r12 + rsi*8]
lea rdx, str.FIRECORE
call fcn.14004d5a4
test eax, eax
jne 0x14002b9c6
mov dword [rsp + 0x70], 4
jmp 0x14002ba16
mov rcx, qword [r12 + rsi*8]
lea rdx, [0x14006d9b0]
call fcn.14004d5a4
test eax, eax
jne 0x14002b9e4
mov dword [rsp + 0x70], 7
jmp 0x14002ba16
lea rcx, str.Invalid_EtlFilt_value._Defaulting_to_All._n
call fcn.14004d888
mov dword [rsp + 0x70], 7
jmp 0x14002ba16
mov esi, dword [rsp + 0x54]
jmp 0x14002ba16
mov esi, dword [rsp + 0x54]
jmp 0x14002ba16
mov esi, dword [rsp + 0x54]
jmp 0x14002ba16
mov esi, dword [rsp + 0x54]
jmp 0x14002ba16
mov esi, dword [rsp + 0x54]
xor eax, eax
mov rcx, rbx
mov rdi, rbp
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
cmp rcx, 0x13
jne 0x14002ba6f
movzx eax, word [rbp]
cmp ax, 0x2d
je 0x14002ba3e
cmp ax, 0x2f
jne 0x14002ba6f
cmp word [rbp + 0x26], 0
jne 0x14002ba6f
lea rcx, [rbp + 2]
lea rdx, str.donotstartservices
call fcn.14004d5a4
test eax, eax
jne 0x14002ba6f
lea rcx, str.donotstartservices_argument_set_n
call fcn.1400154e0
mov byte [0x14008ccea], 1
mov r14b, 1
xor eax, eax
mov rcx, rbx
mov rdi, rbp
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
cmp rcx, 0x10
jne 0x14002bac8
movzx eax, word [rbp]
cmp ax, 0x2d
je 0x14002ba97
cmp ax, 0x2f
jne 0x14002bac8
cmp word [rbp + 0x20], 0
jne 0x14002bac8
lea rcx, [rbp + 2]
lea rdx, str.defeat_bullseye
call fcn.14004d5a4
test eax, eax
jne 0x14002bac8
lea rcx, str.defeat_bullseye_argument_set_n
call fcn.1400154e0
mov byte [0x14008ce5c], 1
mov r14b, 1
xor eax, eax
mov rcx, rbx
mov rdi, rbp
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
cmp rcx, 9
jne 0x14002bb28
movzx eax, word [rbp]
cmp ax, 0x2d
je 0x14002baf0
cmp ax, 0x2f
jne 0x14002bb28
cmp word [rbp + 0x12], 0
jne 0x14002bb28
lea rcx, [rbp + 2]
lea rdx, str.resetvtp
call fcn.14004d5a4
test eax, eax
jne 0x14002bb28
lea rcx, str.resetvtp_argument_set_n
call fcn.1400154e0
mov ebp, dword [rsp + 0x5c]
mov r14b, 1
mov byte [rsp + 0x6c], r14b
jmp 0x14002b1f0
test r14b, r14b
je 0x14002bb3e
mov ebp, dword [rsp + 0x5c]
jmp 0x14002b1f0
or eax, 0xffffffff
jmp 0x14002c4ce
mov ebp, dword [rsp + 0x5c]
movzx eax, byte [rsp + 0x6c]
test al, al
je 0x14002bb55
call fcn.14002a190
jmp 0x14002c4ce
mov r8, qword [rsp + 0x80]
test r8, r8
je 0x14002bb72
mov rdx, qword [str.MFEHIDIN]
mov ecx, dword [rsp + 0x70]
call fcn.140006120
mov edi, dword [rsp + 0x60]
movzx ebx, r14b
add ebx, esi
cmp edi, 1
jne 0x14002bb8b
cmp ebx, ebp
mov eax, 3
cmovl edi, eax
cmp byte [rsp + 0x6d], 0
jne 0x14002bba4
cmp dword [rsp + 0x88], 0x13ec
jl 0x14002bba4
xor sil, sil
jmp 0x14002bba7
mov sil, 1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.14003d050
mov byte [0x14008cce8], al
lea eax, [rdi - 1]
cmp eax, 5
ja case.default.0x14002bbdb
lea rdx, [0x140000000]
cdqe
mov ecx, dword [rdx + rax*4 + 0x2c56c]
add rcx, rdx
jmp rcx
lea rdx, section..bldvar
lea rcx, str.McAfee_System_Core_Installer_nCopyright_2005_2011_McAfee_Inc._All_Rights_Reserved_Version__hs__n
call fcn.14004d888
mov r14, qword [rsp + 0x78]
jmp 0x14002c3cf
mov r14, qword [rsp + 0x78]
test r14, r14
je 0x14002bc94
xor r8d, r8d
lea rax, [rsp + 0x50]
mov r9b, 1
lea edx, [r8 + 0x20]
mov rcx, r14
mov qword [rsp + 0x20], rax
call fcn.140023f80
test al, al
jne 0x14002bc39
lea rcx, str.Unable_to_parse__S_n
mov rdx, r14
call fcn.14004d888
jmp 0x14002bc4c
mov rdx, qword [0x14008cd00]
lea rcx, str.Product_ID__S_n
call fcn.14004d888
lea rax, [rsp + 0x50]
mov r9b, 1
xor r8d, r8d
mov edx, 0x80
mov rcx, r14
mov qword [rsp + 0x20], rax
call fcn.140023f80
test al, al
jne 0x14002bc7c
lea rcx, str.Unable_to_parse__S_n
mov rdx, r14
call fcn.14004d888
mov rdx, qword [0x14008cd48]
lea rcx, str.Features:__S
call fcn.14004d888
jmp 0x14002c3cf
lea rdx, [rsp + 0x390]
lea rcx, str._nsyntax:__ls___switch_...___x__xmlconfig___features_...__n_nvalid_switches:_n_n___h___Show_this_help_information__include__x_for_feature_info._n___x____filename__XML_file_to_install._Required_for_most_switches._n___i___Install_Upgrade_files__services_and_drivers._n_t___Upgrades_the_files_services_drivers_already_n_t___present_on_the_system._Installs_files_services_drivers_n_t___not_found_on_the_system._n___iu__Upgrade_files__services_and_drivers._n___ir__Repair_files__services_and_drivers._n___s___Enable_for_safe_mode__can_be_used_with__i_._n___d___Disable_for_safe_mode._n___q___Quiet._May_prevent_system_from_recognizing_signed_drivers._n___u___Uninstall._n___ph__Add_file_hash_values_to_XML_File._Writes_to_stdout._n_t___File_hash_values_must_be_present_in_an_XML_file_before_n_t___signing___ps__n___ps____sha1_thumbprint___Write_the_XML_file_signature_to_n_t___the_XML_file._Writes_to_stdout._n___pv__Validates_package._Returns_0_if_successful._n_t___Use_this_option_to_confirm_that_all_files_listed_n_t___in_the_XML_file_are_found_n___pl__Generate_package_file_list._Writes_to_stdout._n_t___Use_this_option_to_get_a_quick_enumeration_of_n_t___all_files_in_the_XML_file._n___pc___filename__Creates_a_cabinet_file._Requires__pp.__n_t___All_files__including_the_XML_file_specified_in__x___n_t___but_not_including_mfehidin.exe__are_added_to_the_cab._n___pp___platform__Either_x86_or_x64._n___c____filename__Installs_from_the_cabinet_file.__x_is_ignored._n___v____vtpoptions__Set_vtp_options._n___l____logfile__Log_file._n_n___etl_t__logfile__Turn_on_tracing_and_log_to_this_file._n___etlfilt__filter__One_of:_syscore__vscore__firecore__all._Defaultall_n_n_e.g._mfehidin__i__x_pp.xml__l_mfehidin.log_FeatureA_FeatureB_n_nFeatures__if_specified__must_be_last_on_the_command_line_and_nonly_apply_in_conjuction_with__i_and__u.__If_no_feature_is_nspecified_all_features_will_be_operated_upon._n
call fcn.14004d888
jmp 0x14002c3cf
mov r14, qword [rsp + 0x78]
test r14, r14
jne 0x14002bccc
lea rcx, str.Required__x_arguement_for_package_operations_missing__n
call fcn.14004d888
or r15d, 0xffffffff
jmp 0x14002c3cf
mov edx, dword [rsp + 0x68]
cmp edx, 0x2000
je 0x14002bd10
cmp edx, 8
je 0x14002bd10
cmp edx, 4
je 0x14002bd10
cmp edx, 0x800
je 0x14002bd10
cmp edx, 0x10
je 0x14002bd10
lea rcx, str._ph___ps_and__pc_must_be_used_exclusively_on_the_cmd_line_n
call fcn.1400154e0
lea rcx, str._ph___ps__and__pc_cannot_be_combined_on_the_cmd_line._Please_use_one_at_a_time_n
call fcn.14004d888
or r15d, 0xffffffff
jmp 0x14002c3cf
movsxd rax, ebx
sub ebp, ebx
movzx r9d, sil
lea rcx, [r12 + rax*8]
lea rax, [rsp + 0x50]
mov r8, r13
mov qword [0x14008ccf8], rcx
mov rcx, r14
mov dword [0x14008ccec], ebp
mov qword [rsp + 0x20], rax
call fcn.140023f80
test al, al
jne 0x14002c3cf
lea rcx, str.Package_error_n
call fcn.1400154e0
or r15d, 0xffffffff
jmp 0x14002c3cf
call fcn.14002ab10
mov rdi, qword [rsp + 0x90]
test rdi, rdi
je 0x14002bfbc
mov r14, qword [rsp + 0x78]
test r14, r14
je 0x14002bd94
lea rcx, str._x_argument_ignored_n
call fcn.14004d888
lea rcx, str._x_argument_ignored._Invalid_with__c_argument_n
call fcn.1400154e0
mov dx, 0x5c
mov rcx, rdi
call fcn.140038550
test rax, rax
je 0x14002bdd7
lea rcx, [0x140066d4c]
mov rdx, rdi
call fcn.140038160
test rax, rax
mov rbp, rax
je 0x14002bb36
mov dl, 0x5c
mov rcx, rax
call fcn.1400373e0
mov rcx, rbp
mov byte [rax], 0
call fcn.140037290
jmp 0x14002bdfb
lea rdx, [rsp + 0x460]
lea rcx, [0x140066d4c]
call fcn.140038160
lea rcx, [rsp + 0x460]
mov rbp, rax
call fcn.14003a110
lea rcx, [0x140066d4c]
mov rdx, rdi
call fcn.140038160
mov rdx, rbp
mov rcx, rax
mov rdi, rax
call fcn.140028ce0
mov rcx, rdi
movzx r12d, al
call fcn.140037290
test rbp, rbp
je 0x14002be31
mov rcx, rbp
call fcn.14004ca6c
test r12b, r12b
jne 0x14002be4f
lea rcx, str.ERROR:_Failed_to_extract_cabinet_file_n
call fcn.14004d888
mov rsi, qword [rsp + 0x80]
jmp 0x14002c425
lea rcx, [rsp + 0x130]
xor edx, edx
mov r8d, 0x250
call fcn.14004c980
lea rdx, [rsp + 0x130]
lea rcx, [0x140066fd0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
test rax, rax
mov rdi, rax
je 0x14002bea3
test byte [rsp + 0x130], 0x10
je 0x14002bea3
lea rcx, [0x140066fd0]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x14002bf06
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rcx, [rsp + 0x130]
xor edx, edx
mov r8d, 0x250
call fcn.14004c980
lea rdx, [rsp + 0x130]
lea rcx, [0x140067008]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
test rax, rax
mov rdi, rax
je 0x14002bf9a
test byte [rsp + 0x130], 0x10
je 0x14002bf9a
lea rcx, [0x140067008]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rcx, [rsp + 0x130]
xor edx, edx
mov r8d, 0x250
call fcn.14004c980
lea rdx, [rsp + 0x130]
lea rcx, str..xml
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
test rax, rax
mov rdi, rax
je 0x14002bf81
lea rdx, [rsp + 0x15c]
lea rcx, [0x140067910]
call fcn.140039300
mov rcx, rdi
mov r14, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rcx, str...x86
call fcn.140036f70
lea rcx, str.installing_from_cab_file..._n
mov qword [0x14008cd38], rax
call fcn.14004d888
mov r12, qword [rsp + 0x98]
jmp 0x14002bfc1
lea rcx, str.ERROR__XML_file_not_found_in_extracted_folder_n
call fcn.14004d888
mov rsi, qword [rsp + 0x80]
jmp 0x14002c425
lea rcx, str.ERROR__Could_not_find_a_valid_subdirectory__nwhere_the_cabinet_file_was_extracted_to._Missing__nx86_or_x64_n
call fcn.14004d888
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rsi, qword [rsp + 0x80]
jmp 0x14002c425
mov r14, qword [rsp + 0x78]
test r14, r14
je 0x14002c184
mov eax, dword [rsp + 0x5c]
mov rdx, r14
sub eax, ebx
mov dword [0x14008ccec], eax
movsxd rax, ebx
lea rcx, [r12 + rax*8]
mov qword [0x14008ccf8], rcx
lea rcx, str.Parsing_XML__S_n
call fcn.1400154e0
movzx eax, byte [rsp + 0x58]
mov rdi, r15
test al, al
jne 0x14002c04d
lea r8, [rsp + 0x920]
xor r9d, r9d
mov edx, 0x104
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
jne 0x14002c030
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.GetFullPathName_failed__u_n
mov edx, eax
call fcn.14004d888
lea r8, [rsp + 0x920]
lea rcx, str._s__s
mov rdx, r13
call fcn.140039300
mov rdi, rax
mov r13, rax
lea rax, [rsp + 0x50]
movzx r9d, sil
mov r8, r13
mov edx, FDICreate
mov rcx, r14
mov qword [rsp + 0x20], rax
call fcn.140023f80
test al, al
jne 0x14002c08c
lea rcx, str.Install_error:_failed_to_validate_n
or r15d, 0xffffffff
call fcn.1400154e0
mov rcx, rdi
call fcn.140038240
jmp 0x14002c3cf
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
test rax, rax
mov rbx, rax
jne 0x14002c0cb
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x45b
jne 0x14002c0cb
lea rcx, str.ERROR__Service_Control_Manager_reports:_ERROR_SHUTDOWN_IN_PROGRESS.Terminating_installation._n
call fcn.1400154e0
mov rcx, rdi
or r15d, 0xffffffff
call fcn.140038240
jmp 0x14002c3cf
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea r11, [rsp + 0x50]
movzx r9d, sil
mov r8, r13
mov edx, 0x200
mov rcx, r14
mov qword [rsp + 0x20], r11
call fcn.140023f80
mov ebp, dword [rsp + 0x68]
test al, al
lea rax, [rsp + 0x50]
mov rbx, 0xffffffffffffffff
movzx r9d, sil
mov r8, r13
mov edx, ebp
mov rcx, r14
mov qword [rsp + 0x20], rax
cmove r15d, ebx
call fcn.140023f80
test al, al
jne 0x14002c153
lea rcx, str.Install_error:_un_winding_install_n
call fcn.1400154e0
test bpl, 1
mov r15d, ebx
je 0x14002c153
lea rax, [rsp + 0x50]
lea edx, [rbx + 3]
movzx r9d, sil
mov r8, r13
mov rcx, r14
mov qword [rsp + 0x20], rax
call fcn.140023f80
lea rax, [rsp + 0x50]
movzx r9d, sil
mov r8, r13
mov edx, 0x400
mov rcx, r14
mov qword [rsp + 0x20], rax
call fcn.140023f80
mov rcx, rdi
test al, al
cmove r15d, ebx
call fcn.140038240
jmp 0x14002c3cf
lea rcx, str.ERROR:_XMLFile_not_a_cmd_arg
call fcn.14004d888
jmp 0x14002c3cf
call fcn.14002ab10
mov r14, qword [rsp + 0x78]
test r14, r14
je 0x14002c2a4
movsxd rax, ebx
sub ebp, ebx
mov rdx, r14
lea rcx, [r12 + rax*8]
mov dword [0x14008ccec], ebp
mov qword [0x14008ccf8], rcx
lea rcx, str.Parsing_XML__S_n
call fcn.1400154e0
mov al, byte [rsp + 0x58]
mov rdi, r15
test al, al
jne 0x14002c226
lea r8, [rsp + 0x920]
xor r9d, r9d
mov edx, 0x104
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
jne 0x14002c209
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.GetFullPathName_failed__u_n
mov edx, eax
call fcn.14004d888
lea r8, [rsp + 0x920]
lea rcx, str._s__s
mov rdx, r13
call fcn.140039300
mov rdi, rax
mov r13, rax
lea rax, [rsp + 0x50]
movzx r9d, sil
mov r8, r13
mov edx, 0x200
mov rcx, r14
mov qword [rsp + 0x20], rax
call fcn.140023f80
mov rbx, 0xffffffffffffffff
movzx r9d, sil
test al, al
lea rax, [rsp + 0x50]
lea edx, [rbx + 3]
mov r8, r13
mov rcx, r14
mov qword [rsp + 0x20], rax
cmove r15d, ebx
call fcn.140023f80
movzx r9d, sil
test al, al
lea rax, [rsp + 0x50]
mov r8, r13
mov edx, 0x400
mov rcx, r14
mov qword [rsp + 0x20], rax
cmove r15d, ebx
call fcn.140023f80
mov rcx, rdi
test al, al
cmove r15d, ebx
call fcn.140038240
jmp 0x14002c3cf
lea rcx, str.ERROR._no_xml_file_provided._n
call fcn.14004d888
or r15d, 0xffffffff
jmp 0x14002c3cf
call fcn.14002ab10
sub ebp, ebx
movsxd rax, ebx
cmp ebp, 1
lea rcx, [r12 + rax*8]
mov dword [0x14008ccec], ebp
mov qword [0x14008ccf8], rcx
jne 0x14002c3c3
movzx esi, byte [rsp + 0x64]
lea rax, str.default
test sil, sil
mov qword [0x14008cd48], rax
je 0x14002c2ff
mov rcx, r13
call fcn.140013530
jmp 0x14002c307
mov rcx, r13
call fcn.1400134a0
cmp dword [0x14008ccec], 0
mov ebx, r15d
jle 0x14002c3ca
mov rdi, r15
nop
nop
mov rcx, qword [0x14008ccf8]
mov rcx, qword [rcx + rdi]
call fcn.14000eba0
test al, al
je 0x14002c39b
test sil, sil
je 0x14002c36b
mov r8, qword [0x14008ccf8]
mov edx, 1
mov rcx, r13
mov r8, qword [r8 + rdi]
call fcn.140012fe0
mov r8, qword [0x14008ccf8]
mov edx, 2
mov r8, qword [r8 + rdi]
mov rcx, r13
call fcn.140012fe0
jmp 0x14002c39b
mov r8, qword [0x14008ccf8]
mov edx, 1
mov rcx, r13
mov r8, qword [r8 + rdi]
call fcn.140012ec0
mov r8, qword [0x14008ccf8]
mov edx, 2
mov r8, qword [r8 + rdi]
mov rcx, r13
call fcn.140012ec0
add ebx, 1
add rdi, 8
cmp ebx, dword [0x14008ccec]
jl 0x14002c320
mov r14, qword [rsp + 0x78]
jmp 0x14002c3cf
mov r14, qword [rsp + 0x78]
jmp 0x14002c3cf
mov r14, qword [rsp + 0x78]
jmp 0x14002c3cf
mov r14, qword [rsp + 0x78]
cmp byte [rsp + 0x50], 0
je 0x14002c3ee
lea rcx, str.WARNING:_Some_operations_were_deferred_until_the_next_reboot._n
call fcn.1400154e0
lea rcx, str.WARNING:_Some_operations_were_deferred_until_the_next_reboot._n
call fcn.14004d888
cmp byte [0x14008cceb], 0
je 0x14002c403
test r15d, r15d
mov eax, 1
cmove r15d, eax
cmp byte [0x14008cdf0], 0
mov rsi, qword [rsp + 0x80]
mov eax, 0xfffffffe
cmovne r15d, eax
jmp 0x14002c425
mov r14, qword [rsp + 0x78]
mov rsi, r14
lea rcx, str.Returning__u_n
mov edx, r15d
call fcn.1400154e0
lea rcx, [rsp + 0x460]
call fcn.14003a110
mov rcx, qword [0x14008ce60]
test rcx, rcx
je 0x14002c452
call fcn.140038240
test rsi, rsi
je 0x14002c463
mov rcx, qword [str.MFEHIDIN]
call fcn.1400016a0
test r14, r14
je 0x14002c470
mov rcx, r14
call fcn.140038240
mov rcx, qword [0x14008ccf0]
test rcx, rcx
je 0x14002c481
call fcn.140039c50
mov rcx, qword [0x14008cd00]
test rcx, rcx
je 0x14002c492
call fcn.140038240
mov rcx, qword [0x14008cd18]
test rcx, rcx
je 0x14002c4a3
call fcn.140038240
mov rcx, qword [0x14008cd20]
test rcx, rcx
je 0x14002c4b4
call fcn.140038240
mov rcx, qword [0x14008cd38]
test rcx, rcx
je 0x14002c4c5
call fcn.140038240
call fcn.14002aa80
movzx eax, r15b
mov r13, qword [rsp + 0xb70]
mov rcx, qword [rsp + 0xb30]
xor rcx, rsp
call fcn.14004c890
lea r11, [rsp + 0xb40]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret