Function at 0x422d00
Capabilities:
Delete directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x583616
mov eax, dword fs:[0]
push eax
sub esp, 0x2cc
mov eax, dword [0x61094c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x2b4], esi
push 0xffffffffffffffff
push dword [0x620220]
mov dword [ebp - 0x2d8], 0x620220
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x2d4], 1
mov dword [ebp - 4], 0
xor eax, eax
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 7
mov word [ebp - 0x58], ax
mov byte [ebp - 4], 1
mov dword [ebp - 0x2c0], eax
lea eax, [ebp - 0x2c0]
push eax
push 0
push 0
push 0x5c2bf8
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
mov edi, eax
test edi, edi
js 0x422fa9
mov edx, dword [ebp - 0x2c0]
mov ecx, edx
lea edi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x422db0
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x58]
call fcn.00425810
push 0x1e
push str.McAfeeMSSPlusClientAnalytics
lea ecx, [ebp - 0x58]
call fcn.00425920
push str.E:BT4890157e_a198_48d8_a35b_8188c1003801Freetools_srcCommonMcALEEngineController.cpp
push str.CMcALEEngineController::Is_Symbolic_Link
push 0x13
push 3
lea ecx, [ebp - 0x2b8]
call fcn.00422770
mov byte [ebp - 4], 2
push str.Entering_CMcALEEngineController::Is_Symbolic_Link
push dword [eax]
call fcn.00426d40
add esp, 8
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x2b8]
call fcn.004241f0
mov eax, dword [ebp - 0x2b8]
mov ebx, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
add eax, 0x14
push eax
call ebx
push 0x250
lea eax, [ebp - 0x2a8]
mov byte [ebp - 4], 1
push 0
push eax
mov byte [ebp - 0x2ad], 0
call fcn.00556260
add esp, 0xc
cmp dword [ebp - 0x48], 0
je 0x422ea8
cmp dword [ebp - 0x44], 8
lea ecx, [ebp - 0x2a8]
lea eax, [ebp - 0x58]
cmovae eax, dword [ebp - 0x58]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x422ea8
test dword [ebp - 0x2a8], 0x400
je 0x422ea1
mov edx, dword [ebp - 0x284]
mov ecx, edx
and ecx, 0xa0000003
cmp ecx, 0xa0000003
je 0x422e9a
and edx, 0xa000000c
cmp edx, 0xa000000c
jne 0x422ea1
mov byte [ebp - 0x2ad], 1
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push str.E:BT4890157e_a198_48d8_a35b_8188c1003801Freetools_srcCommonMcALEEngineController.cpp
push str.CMcALEEngineController::Is_Symbolic_Link
push 0x2a
push 3
lea ecx, [ebp - 0x2ac]
call fcn.00422770
mov byte [ebp - 4], 4
push str.Leaving_CMcALEEngineController::Is_Symbolic_Link
push dword [eax]
call fcn.00426d40
add esp, 8
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x2ac]
call fcn.004241f0
mov eax, dword [ebp - 0x2ac]
add eax, 0x14
push eax
call ebx
cmp byte [ebp - 0x2ad], 0
lea ecx, [ebp - 0x2ac]
push str.E:BT4890157e_a198_48d8_a35b_8188c1003801Freetools_srcCommonMcALEEngineController.cpp
mov byte [ebp - 4], 1
push str.CMcALEEngineController::InitializeAndStartALEEngine
je 0x422f5b
push 0x3f
push 3
call fcn.00422770
mov byte [ebp - 4], 6
push str.Removing_directory_as_symbolic_link_has_been_found
push dword [eax]
call fcn.00426d40
add esp, 8
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x2ac]
call fcn.004241f0
mov eax, dword [ebp - 0x2ac]
add eax, 0x14
push eax
call ebx
mov byte [ebp - 4], 1
lea eax, [ebp - 0x58]
cmp dword [ebp - 0x44], 8
cmovae eax, dword [ebp - 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x422f96
push 0x44
push 3
call fcn.00422770
mov byte [ebp - 4], 8
push str.Symbolic_Link_Not_found
push dword [eax]
call fcn.00426d40
add esp, 8
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x2ac]
call fcn.004241f0
mov eax, dword [ebp - 0x2ac]
add eax, 0x14
push eax
call ebx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x2c0]
test eax, eax
je 0x423002
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x423002
push str.E:BT4890157e_a198_48d8_a35b_8188c1003801Freetools_srcCommonMcALEEngineController.cpp
push str.CMcALEEngineController::InitializeAndStartALEEngine
push 0x4c
push 4
lea ecx, [ebp - 0x2ac]
call fcn.00422770
mov byte [ebp - 4], 0xa
push str.Unable_to_get_Program_data_path_Error:
push dword [eax]
call fcn.00426d40
add esp, 8
mov ecx, eax
push edi
call fcn.004242b0
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x2ac]
call fcn.004241f0
mov eax, dword [ebp - 0x2ac]
mov ebx, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
add eax, 0x14
push eax
call ebx
mov byte [ebp - 4], 1
mov eax, 3
nop word [eax + eax]
dec eax
cmp dword [esi + 8], 0
mov dword [ebp - 0x2cc], eax
jne 0x423161
push 0xe0
call fcn.00553fc1
mov edi, eax
add esp, 4
mov dword [ebp - 0x2d0], edi
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x40]
xorps xmm0, xmm0
mov dword [ebp - 0x40], 0
movq qword [edi], xmm0
lea esi, [edi + 0xc]
mov dword [edi + 8], 0
xor eax, eax
push 0x25
push str.HKLMSOFTWAREMcAfeeMSSPlusAnalytics
mov dword [edi + 4], 1
mov dword [edi + 8], 1
mov dword [edi], vtable.std::_Ref_count_obj2_class_Intel::Analytics::CALEController_.0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
call fcn.00425810
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x28]
push 0x35
xor eax, eax
mov dword [ebp - 0x28], 0
push str.__FOLDERID_ProgramData_McAfeeMSSPlusClientAnalytics
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.00425810
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 0xe
push eax
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
call fcn.004a5500
lea ecx, [ebp - 0x28]
call fcn.004257b0
lea ecx, [ebp - 0x40]
call fcn.004257b0
mov eax, dword [ebp - 0x2b4]
mov byte [ebp - 4], 1
mov dword [eax + 8], esi
mov esi, dword [eax + 0xc]
mov dword [eax + 0xc], edi
test esi, esi
je 0x423112
or eax, 0xffffffff
lock xadd dword [esi + 4], eax
jne 0x423112
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
jne 0x423112
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
push str.E:BT4890157e_a198_48d8_a35b_8188c1003801Freetools_srcCommonMcALEEngineController.cpp
push str.CMcALEEngineController::InitializeAndStartALEEngine
push 0x55
push 3
lea ecx, [ebp - 0x2ac]
call fcn.00422770
mov byte [ebp - 4], 0xf
push str.Created_instance_for_controller
push dword [eax]
call fcn.00426d40
add esp, 8
mov byte [ebp - 4], 0x10
mov ecx, dword [ebp - 0x2ac]
call fcn.004241f0
mov eax, dword [ebp - 0x2ac]
add eax, 0x14
push eax
call ebx
mov esi, dword [ebp - 0x2b4]
jmp 0x4231a8
push str.E:BT4890157e_a198_48d8_a35b_8188c1003801Freetools_srcCommonMcALEEngineController.cpp
push str.CMcALEEngineController::InitializeAndStartALEEngine
push 0x59
push 3
lea ecx, [ebp - 0x2b8]
call fcn.00422770
mov byte [ebp - 4], 0x11
push str.Controller_is_already_created
push dword [eax]
call fcn.00426d40
add esp, 8
mov byte [ebp - 4], 0x12
mov ecx, dword [ebp - 0x2b8]
call fcn.004241f0
mov eax, dword [ebp - 0x2b8]
add eax, 0x14
push eax
call ebx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
mov edi, dword [esi + 8]
push 6
push str.legacy
mov eax, dword [edi]
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov esi, dword [eax + 0x14]
xor eax, eax
mov word [ebp - 0x28], ax
call fcn.00425810
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x40]
push 0x19
xor eax, eax
mov dword [ebp - 0x40], 0
push str.Analytics.ScriptHost.Type
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
call fcn.00425810
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x14
push eax
lea eax, [ebp - 0x40]
mov ecx, edi
push eax
call esi
lea ecx, [ebp - 0x40]
call fcn.004257b0
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.004257b0
mov edi, dword [ebp - 0x2b4]
lea ecx, [ebp - 0x28]
push 7
push str.mssplus
mov edi, dword [edi + 8]
mov eax, dword [edi]
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov esi, dword [eax + 0x14]
xor eax, eax
mov word [ebp - 0x28], ax
call fcn.00425810
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x40]
push 0xc
xor eax, eax
mov dword [ebp - 0x40], 0
push str.Product_Name
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
call fcn.00425810
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x16
push eax
lea eax, [ebp - 0x40]
mov ecx, edi
push eax
call esi
lea ecx, [ebp - 0x40]
call fcn.004257b0
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.004257b0
mov eax, dword [ebp - 0x2b4]
mov edi, dword [eax + 8]
mov eax, dword [edi]
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov esi, dword [eax + 0x14]
push 0x45
xor eax, eax
lea ecx, [ebp - 0x28]
push str.https:__sadownload.mcafee.com_products_mssplus_Win_update_product.xml
mov word [ebp - 0x28], ax
call fcn.00425810
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x40]
push 0x1a
xor eax, eax
mov dword [ebp - 0x40], 0
push str.product_content_update_url
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
call fcn.00425810
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x18
push eax
lea eax, [ebp - 0x40]
mov ecx, edi
push eax
call esi
lea ecx, [ebp - 0x40]
call fcn.004257b0
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.004257b0
mov esi, dword [ebp - 0x2b4]
mov ecx, dword [esi + 8]
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, eax
push str.E:BT4890157e_a198_48d8_a35b_8188c1003801Freetools_srcCommonMcALEEngineController.cpp
push str.CMcALEEngineController::InitializeAndStartALEEngine
test edi, edi
jne 0x42340c
push 0x64
push 3
lea ecx, [ebp - 0x2c4]
call fcn.00422770
mov byte [ebp - 4], 0x19
push str.ALE_Engine_Initialized_successfully
push dword [eax]
call fcn.00426d40
add esp, 8
mov byte [ebp - 4], 0x1a
mov ecx, dword [ebp - 0x2c4]
call fcn.004241f0
mov eax, dword [ebp - 0x2c4]
add eax, 0x14
push eax
call ebx
mov byte [ebp - 4], 1
mov ecx, dword [esi + 8]
mov eax, dword [ecx]
call dword [eax + 8]
mov edi, eax
test edi, edi
je 0x423470
push str.E:BT4890157e_a198_48d8_a35b_8188c1003801Freetools_srcCommonMcALEEngineController.cpp
push str.CMcALEEngineController::InitializeAndStartALEEngine
push 0x6f
push 4
lea ecx, [ebp - 0x2c8]
call fcn.00422770
mov byte [ebp - 4], 0x1f
push str.ALE_Engine_Start_got_failed__status_is:
push dword [eax]
call fcn.00426d40
mov ecx, edi
mov edx, eax
call fcn.004a5330
push eax
push edx
call fcn.004270d0
add esp, 0x10
mov byte [ebp - 4], 0x20
mov ecx, dword [ebp - 0x2c8]
call fcn.004241f0
mov eax, dword [ebp - 0x2c8]
jmp 0x423453
push 0x75
push 4
lea ecx, [ebp - 0x2bc]
call fcn.00422770
mov byte [ebp - 4], 0x21
push str.ALE_Engine_Intialization_got_failed__status_is:
push dword [eax]
call fcn.00426d40
mov ecx, edi
mov edx, eax
call fcn.004a5330
push eax
push edx
call fcn.004270d0
add esp, 0x10
mov byte [ebp - 4], 0x22
mov ecx, dword [ebp - 0x2bc]
call fcn.004241f0
mov eax, dword [ebp - 0x2bc]
add eax, 0x14
push eax
call ebx
mov eax, dword [ebp - 0x2cc]
mov byte [ebp - 4], 1
test eax, eax
jg 0x423010
jmp 0x42353f
mov edi, dword [esi + 8]
lea ecx, [ebp - 0x28]
mov byte [esi + 4], 1
push 2
push 0x5bac18
mov eax, dword [edi]
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov esi, dword [eax + 0x14]
xor eax, eax
mov word [ebp - 0x28], ax
call fcn.00425810
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x40]
push 0x24
xor eax, eax
mov dword [ebp - 0x40], 0
push str.Analytics.ScriptHost.Terminate.Delay
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
call fcn.00425810
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x1c
push eax
lea eax, [ebp - 0x40]
mov ecx, edi
push eax
call esi
lea ecx, [ebp - 0x40]
call fcn.004257b0
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.004257b0
push str.E:BT4890157e_a198_48d8_a35b_8188c1003801Freetools_srcCommonMcALEEngineController.cpp
push str.CMcALEEngineController::InitializeAndStartALEEngine
push 0x6a
push 3
lea ecx, [ebp - 0x2bc]
call fcn.00422770
mov byte [ebp - 4], 0x1d
push str.ALE_Engine_Started_successfully
push dword [eax]
call fcn.00426d40
add esp, 8
mov byte [ebp - 4], 0x1e
mov ecx, dword [ebp - 0x2bc]
call fcn.004241f0
mov eax, dword [ebp - 0x2bc]
add eax, 0x14
push eax
call ebx
lea ecx, [ebp - 0x58]
call fcn.004257b0
mov esi, dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov ebx, 1
test ebx, ebx
jle 0x423563
push dword [0x620220]
dec ebx
call esi
test ebx, ebx
jg 0x423556
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00553daa
mov esp, ebp
pop ebp
ret