Function at 0x422200
Capabilities:
Create process on windows
Get common file path
Set current directory

Disassembly:
push 0xa6c
mov eax, 0x47cbd2
call fcn.00437feb
push str.McInstrumentation.cpp
push str.McInstruCleanUp
push 0x15
xor ebx, ebx
lea ecx, [ebp - 0xa4c]
push 3
mov dword [ebp - 4], ebx
call fcn.00409a60
mov byte [ebp - 4], 1
mov edx, str.Entering_McInstruCleanUp
mov ecx, dword [eax]
call fcn.004112cc
lea ecx, [ebp - 0xa4c]
mov byte [ebp - 4], bl
call fcn.00409aa0
mov esi, dword [ebp + 8]
push 0x2001f
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xa54], esp
push str.UIID
call fcn.0040e4c4
sub esp, 0x18
mov byte [ebp - 4], 2
mov ecx, esp
mov edi, str.SOFTWAREMcAfeePartnerCustomization
push edi
call fcn.0040e4c4
mov eax, dword [esi]
xor ecx, ecx
mov ebx, reloc.OLEAUT32.dll_SysReAllocString
mov byte [ebp - 4], cl
push ebx
mov ecx, esi
call dword [eax + 0x20]
mov esi, dword [ebp + 8]
push 0x2001f
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xa54], esp
push str.InstallEventStatus
call fcn.0040e4c4
sub esp, 0x18
mov byte [ebp - 4], 3
mov ecx, esp
push edi
call fcn.0040e4c4
mov eax, dword [esi]
xor ecx, ecx
mov byte [ebp - 4], cl
mov ecx, esi
push ebx
call dword [eax + 0x20]
mov esi, dword [ebp + 8]
push 0x2001f
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xa54], esp
push str.InitialExpiryDate
call fcn.0040e4c4
sub esp, 0x18
mov byte [ebp - 4], 4
mov ecx, esp
push edi
call fcn.0040e4c4
mov eax, dword [esi]
xor ecx, ecx
mov byte [ebp - 4], cl
mov ecx, esi
push ebx
call dword [eax + 0x20]
mov esi, dword [ebp + 8]
push 0x2001f
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xa54], esp
push str.InstalledDate
call fcn.0040e4c4
sub esp, 0x18
mov byte [ebp - 4], 5
mov ecx, esp
push edi
call fcn.0040e4c4
mov eax, dword [esi]
xor ecx, ecx
mov byte [ebp - 4], cl
mov ecx, esi
push ebx
call dword [eax + 0x20]
mov esi, dword [ebp + 8]
push 0x2001f
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xa54], esp
push str.PollingTimeForPurchaseMonitoring
call fcn.0040e4c4
sub esp, 0x18
mov byte [ebp - 4], 6
mov ecx, esp
push edi
call fcn.0040e4c4
mov eax, dword [esi]
xor ecx, ecx
mov byte [ebp - 4], cl
mov ecx, esi
push ebx
call dword [eax + 0x20]
mov esi, dword [ebp + 8]
push 0x2001f
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xa54], esp
push str.BuildVersion
call fcn.0040e4c4
sub esp, 0x18
mov byte [ebp - 4], 7
mov ecx, esp
push edi
call fcn.0040e4c4
mov eax, dword [esi]
xor ecx, ecx
mov byte [ebp - 4], cl
mov ecx, esi
push ebx
call dword [eax + 0x20]
mov esi, dword [ebp + 8]
push 0x2001f
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xa54], esp
push str.PartnerCustomization
call fcn.0040e4c4
sub esp, 0x18
mov byte [ebp - 4], 8
mov ecx, esp
push str.SOFTWAREMcAfee
call fcn.0040e4c4
mov eax, dword [esi]
mov ecx, esi
push ebx
xor ebx, ebx
mov byte [ebp - 4], bl
call dword [eax + 0x1c]
mov esi, str.McInstrumentation.cpp
lea ecx, [ebp - 0xa4c]
push esi
mov edi, str.McInstruCleanUp
push edi
push 0x1e
push 3
call fcn.00409a60
mov byte [ebp - 4], 9
mov ecx, dword [eax]
mov edx, str.Self_protection_for_download_dir_to_be_released
call fcn.00411504
lea ecx, [ebp - 0xa4c]
call fcn.00409aa0
xorps xmm0, xmm0
mov dword [ebp - method.CMcSelfProtect.virtual_0], vtable.CMcSelfProtect.0
movups xmmword [ebp - 0xa74], xmm0
mov dword [ebp - 0xa64], ebx
mov dword [ebp - 0xa60], ebx
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0xa58]
call fcn.0040f621
lea eax, [ebp - 0xa58]
push eax
lea ecx, [ebp - 0xa74]
call fcn.0040e236
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0xa54]
test ecx, ecx
je 0x422472
call fcn.00406bbc
push 4
mov byte [ebp - 4], 0xa
call fcn.0044a832
pop ecx
test eax, eax
je 0x42248a
mov dword [eax], vtable.CMcNAPICoreWrapper.0
jmp 0x42248c
mov eax, ebx
push ecx
push ecx
mov ecx, esp
push eax
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
call fcn.00423e01
lea ecx, [ebp - 0xa78]
call fcn.0041b531
push 4
call fcn.0044a832
pop ecx
test eax, eax
je 0x4224ba
mov dword [eax], vtable.CMcWin32APIWrapper.0
jmp 0x4224bc
mov eax, ebx
push eax
lea ecx, [ebp - 0xa58]
mov dword [ebp - 0xa58], ebx
mov dword [ebp - 0xa54], ebx
call fcn.00416ddb
lea eax, [ebp - 0xa58]
push eax
lea ecx, [ebp - 0xa64]
call fcn.0040e2a4
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0xa54]
test ecx, ecx
je 0x4224f9
call fcn.00406bbc
push ecx
lea ecx, [ebp - 0xa78]
mov byte [ebp - 4], 0xa
call fcn.0041ba34
lea ecx, [ebp - 0xa78]
call fcn.0041b7a1
lea ecx, [ebp - 0xa78]
call fcn.0041b8b3
push esi
push edi
push 0x26
push 3
lea ecx, [ebp - 0xa4c]
call fcn.00409a60
mov byte [ebp - 4], 0xd
mov edx, str.Self_protection_for_download_dir_released
mov ecx, dword [eax]
call fcn.00411504
lea ecx, [ebp - 0xa4c]
mov byte [ebp - 4], 0xa
call fcn.00409aa0
push 0x208
lea eax, [ebp - 0x738]
push ebx
push eax
call fcn.0043d1d0
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x422913
mov edi, 0x104
lea ecx, [ebp - 0x738]
push edi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x422595
cmp eax, edi
jne 0x4225e0
call ebx
push str.McInstrumentation.cpp
push str.McInstruCleanUp
push 0x31
push 4
lea ecx, [ebp - 0xa54]
mov esi, eax
call fcn.00409a60
push esi
mov byte [ebp - 4], 0xe
mov edx, str.Failed_to_retrieve_the_path._The_actual_path_may_exceed_MAX_PATH._Error_code:
push ecx
mov ecx, dword [eax]
call fcn.00411504
pop ecx
mov ecx, eax
call fcn.0040eeaa
lea ecx, [ebp - 0xa54]
mov byte [ebp - 4], 0xa
call fcn.00409aa0
mov esi, str.McInstrumentation.cpp
lea eax, [ebp - 0x738]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
jne 0x422625
push esi
push str.McInstruCleanUp
push 0x35
push 4
lea ecx, [ebp - 0xa54]
call fcn.00409a60
mov byte [ebp - 4], 0xf
mov edx, str.Unable_to_remove_filename_from_path.
mov ecx, dword [eax]
call fcn.004112cc
lea ecx, [ebp - 0xa54]
mov byte [ebp - 4], 0xa
call fcn.00409aa0
xor eax, eax
push edi
push eax
lea eax, [ebp - 0x320]
push eax
call fcn.0043d1d0
xor eax, eax
lea ecx, [ebp - 0x738]
add esp, 0xc
mov dword [ebp - 0xa4c], eax
lea edx, [ecx + 2]
xor esi, esi
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x42264b
sub ecx, edx
sar ecx, 1
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x738]
push eax
push edi
lea eax, [ebp - 0x320]
push eax
lea eax, [ebp - 0xa4c]
push eax
call fcn.0044cf1c
add esp, 0x14
lea edi, [ebp - 0x940]
mov esi, str.selfdestruct.bat
xor eax, eax
push 8
pop ecx
rep movsd dword es:[edi], dword [esi]
push 0x1e6
push eax
lea eax, [ebp - 0x91e]
push eax
movsw word es:[edi], word [esi]
call fcn.0043d1d0
add esp, 0xc
lea edi, [ebp - 0x428]
mov esi, str.if_exist__s____n_rmdir___s___s__q__
xor eax, eax
push 8
pop ecx
rep movsd dword es:[edi], dword [esi]
push 0xe1
push eax
lea eax, [ebp - 0x405]
movsw word es:[edi], word [esi]
push eax
movsb byte es:[edi], byte [esi]
call fcn.0043d1d0
add esp, 0xc
lea eax, [ebp - 0x218]
mov esi, 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x422734
call ebx
push str.McInstrumentation.cpp
mov edi, str.McInstruCleanUp
lea ecx, [ebp - 0xa54]
push edi
push 0x40
push 2
mov esi, eax
call fcn.00409a60
push esi
mov byte [ebp - 4], 0x10
mov edx, str.Failed_to_retrieve_a_temp_path._Error:
push ecx
mov ecx, dword [eax]
call fcn.004112cc
pop ecx
mov ecx, eax
call fcn.0040eeaa
lea ecx, [ebp - 0xa54]
mov byte [ebp - 4], 0xa
call fcn.00409aa0
mov esi, 0x104
jmp 0x422739
mov edi, str.McInstruCleanUp
xor eax, eax
mov dword [ebp - 0xa5c], eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push 0x496560
lea eax, [ebp - 0x940]
push eax
lea eax, [ebp - 0xa5c]
push eax
call fcn.0044b39e
add esp, 0xc
cmp dword [ebp - 0xa5c], 0
je 0x422983
test eax, eax
jne 0x422983
push str.schtasks__Delete__TN_McInstruTrack__F
push dword [ebp - 0xa5c]
call fcn.00421821
push str._ntimeout__T_20_n
push dword [ebp - 0xa5c]
call fcn.00421821
lea eax, [ebp - 0x320]
push eax
push eax
lea eax, [ebp - 0x428]
push eax
push dword [ebp - 0xa5c]
call fcn.00421821
push esi
xor ebx, ebx
lea eax, [ebp - 0xa48]
push ebx
push eax
call fcn.0043d1d0
lea ecx, [ebp - 0x218]
add esp, 0x2c
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x4227d4
sub ecx, edx
sar ecx, 1
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x218]
push eax
push esi
lea eax, [ebp - 0xa48]
push eax
lea eax, [ebp - 0xa4c]
push eax
call fcn.0044cf1c
add esp, 0x14
lea eax, [ebp - 0x218]
push 0x48e794
push esi
push eax
call fcn.0044a3cd
add esp, 0xc
lea eax, [ebp - 0x940]
push eax
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.0044a3cd
add esp, 0xc
lea eax, [ebp - 0x530]
push esi
push ebx
push eax
call fcn.0043d1d0
lea ecx, [ebp - 0x218]
add esp, 0xc
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x42284b
sub ecx, edx
sar ecx, 1
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x218]
push eax
push esi
lea eax, [ebp - 0x530]
push eax
lea eax, [ebp - 0xa4c]
push eax
call fcn.0044cf1c
add esp, 0x14
lea eax, [ebp - 0x530]
push eax
push str._ndel___s_
push dword [ebp - 0xa5c]
call fcn.00421821
add esp, 0xc
cmp dword [ebp - 0xa5c], ebx
je 0x4228aa
push dword [ebp - 0xa5c]
call fcn.0044af0c
pop ecx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x218]
push eax
push str.runas
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0xa54]
mov esi, str.McInstrumentation.cpp
push esi
push edi
test eax, eax
jne 0x422963
push 0x5e
push 4
call fcn.00409a60
mov byte [ebp - 4], 0x13
mov edx, edi
mov ecx, dword [eax]
call fcn.00411504
mov edx, str._Fail_to_invoked
mov ecx, eax
call fcn.00411504
lea edx, [ebp - 0x218]
mov ecx, eax
call fcn.00411504
lea ecx, [ebp - 0xa54]
mov byte [ebp - 4], 0xa
call fcn.00409aa0
push esi
push edi
push 0x64
push 3
lea ecx, [ebp - 0xa54]
call fcn.00409a60
mov byte [ebp - 4], 0x15
mov edx, str.Leaving_McInstruCleanUp
mov ecx, dword [eax]
call fcn.004112cc
lea ecx, [ebp - 0xa54]
call fcn.00409aa0
lea ecx, [ebp - 0xa78]
call fcn.0041b4c0
mov dword [ebp - 4], 0x16
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x42295d
call fcn.00406bbc
call fcn.00437f95
ret
push 0x61
push 3
call fcn.00409a60
mov byte [ebp - 4], 0x14
mov edx, edi
mov ecx, dword [eax]
call fcn.00411504
mov edx, str._Successfully_invoked_self_destruct
jmp 0x4228f0
push str.McInstrumentation.cpp
push edi
push 0x47
push 4
lea ecx, [ebp - 0xa54]
call fcn.00409a60
mov byte [ebp - 4], 0x11
mov edx, str.McInstruCleanUp_Unable_to_open_file
mov ecx, dword [eax]
call fcn.004112cc
mov esi, eax
call ebx
push eax
push ecx
lea edx, [ebp - 0x940]
mov ecx, esi
call fcn.00411504
mov edx, str.._Error_:
mov ecx, eax
call fcn.004112cc
pop ecx
mov ecx, eax
call fcn.0040eeaa
jmp 0x422934