Function at 0x1400226f0
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 8], rbx
push rsi
push rdi
push r12
push r14
push r15
mov eax, 0x1a70
call fcn.140085600
sub rsp, rax
mov rax, qword [0x1400f63f8]
xor rax, rsp
mov qword [rsp + 0x1a60], rax
mov r15, r9
mov rdi, r8
mov rbx, rdx
movzx eax, byte [0x1400f7080]
cmp al, 6
ja 0x140022741
mov edx, 6
lea rcx, str.Pp_f_
call fcn.1400308d0
lea r8, str.MCWPSSECDASHBOARDSVC
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x140022777
mov edx, 0x1388
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x80], rax
mov byte [rsp + 0x88], 0
xor r12d, r12d
mov qword [rsp + 0x60], r12
lea rax, [rsp + 0x60]
mov qword [rsp + 0x78], rax
lea ecx, [r12 + 0x18]
call fcn.140084c04
mov qword [rsp + 0x70], rax
test rax, rax
je 0x1400227d3
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], rcx
lea rdx, [rsp + 0x68]
mov rcx, rax
call fcn.140028700
mov r14, rax
jmp 0x1400227d6
mov r14, r12
mov qword [rsp + 0x70], r14
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400227f7
mov rax, qword [rcx]
mov edx, 1
mov rax, qword [rax]
call qword [case.0x14005a798.0]
nop
mov qword [rsp + 0xb0], r12
mov qword [rsp + 0xc0], r12
mov qword [rsp + 0xc8], 7
mov word [rsp + 0xb0], r12w
mov qword [rsp + 0xd0], r12
mov qword [rsp + 0xe0], r12
mov qword [rsp + 0xe8], 7
mov word [rsp + 0xd0], r12w
mov qword [rsp + 0x90], r12
mov qword [rsp + 0xa0], r12
mov qword [rsp + 0xa8], 7
mov word [rsp + 0x90], r12w
lea rcx, [rsp + 0xf0]
call fcn.140028000
nop
lea rcx, [rsp + 0xf0]
call fcn.140034560
lea rcx, [rsp + 0xf0]
call fcn.140036b40
mov r8b, 1
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0xf0]
call fcn.140034f80
movzx eax, byte [0x1400f7080]
cmp al, 6
ja 0x1400228dc
lea r8, [rsp + 0xb0]
cmp qword [rsp + 0xc8], 8
cmovae r8, qword [rsp + 0xb0]
mov edx, 6
lea rcx, str.GetMcAfeeDeepProtectionStatusEx:__s
call fcn.1400308d0
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0xf0]
call fcn.140037860
lea rcx, [rsp + 0xb0]
cmp qword [rsp + 0xc8], 8
cmovae rcx, qword [rsp + 0xb0]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
lea rcx, [rsp + 0xd0]
cmp qword [rsp + 0xe8], 8
cmovae rcx, qword [rsp + 0xd0]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
xor edx, edx
mov r8d, 0x800
lea rcx, [rsp + 0x260]
call fcn.1400878c0
lea rbx, [rsp + 0x200]
cmp qword [rsp + 0x218], 8
cmovae rbx, qword [rsp + 0x200]
lea r11, [rsp + 0x1e0]
cmp qword [rsp + 0x1f8], 8
cmovae r11, qword [rsp + 0x1e0]
lea r10, [rsp + 0x1c0]
cmp qword [rsp + 0x1d8], 8
cmovae r10, qword [rsp + 0x1c0]
lea rdx, [rsp + 0x1a0]
cmp qword [rsp + 0x1b8], 8
cmovae rdx, qword [rsp + 0x1a0]
lea rcx, [rsp + 0x180]
cmp qword [rsp + 0x198], 8
cmovae rcx, qword [rsp + 0x180]
lea rax, [rsp + 0x160]
cmp qword [rsp + 0x178], 8
cmovae rax, qword [rsp + 0x160]
lea r9, [rsp + 0x140]
cmp qword [rsp + 0x158], 8
cmovae r9, qword [rsp + 0x140]
lea r8, [rsp + 0x120]
cmp qword [rsp + 0x138], 8
cmovae r8, qword [rsp + 0x120]
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], r11
mov qword [rsp + 0x38], r10
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea rdx, str._t_t_packagedetails_product_suite_name__s__Localized_product_suite_name__s__package_Id__s__Release_Version__s__rcode__s__Affid__s___culture__s__LCID__s____n
lea rcx, [rsp + 0x260]
call fcn.140027030
movzx eax, byte [0x1400f7080]
cmp al, 6
ja 0x140022a72
lea r8, [rsp + 0x260]
mov edx, 6
lea rcx, str.packagedetails___s
call fcn.1400308d0
lea rax, [rsp + 0x260]
mov rsi, 0xffffffffffffffff
mov rdx, rsi
inc rdx
cmp word [rax + rdx*2], 0
jne 0x140022a84
mov rcx, qword [rsp + 0xa0]
mov r8, qword [rsp + 0xa8]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x140022ae6
lea rdi, [rdx + rcx]
mov qword [rsp + 0xa0], rdi
lea rbx, [rsp + 0x90]
cmp r8, 8
cmovae rbx, qword [rsp + 0x90]
lea rcx, [rbx + rcx*2]
lea r8, [rdx + rdx]
lea rdx, [rsp + 0x260]
call fcn.140087210
mov word [rbx + rdi*2], r12w
jmp 0x140022b06
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x260]
movzx r8d, byte [rsp + 0x50]
lea rcx, [rsp + 0x90]
call fcn.1400041a0
movzx eax, byte [0x1400f7080]
cmp al, 6
ja 0x140022b3c
lea r8, [rsp + 0x90]
cmp qword [rsp + 0xa8], 8
cmovae r8, qword [rsp + 0x90]
mov edx, 6
lea rcx, str.mcafeeSubscriptionXML___s
call fcn.1400308d0
xor edx, edx
mov r8d, 0x800
lea rcx, [rsp + 0xa60]
call fcn.1400878c0
movzx r8d, byte [rsp + 0x118]
lea rdx, str._t_t_registrationdetails_registration_complete_status__u_____n
lea rcx, [rsp + 0xa60]
call fcn.140027030
movzx eax, byte [0x1400f7080]
cmp al, 6
ja 0x140022b92
lea r8, [rsp + 0xa60]
mov edx, 6
lea rcx, str.hk_f_
call fcn.1400308d0
lea rax, [rsp + 0xa60]
mov rdx, rsi
nop dword [rax]
inc rdx
cmp word [rax + rdx*2], 0
jne 0x140022ba0
mov rcx, qword [rsp + 0xa0]
mov r8, qword [rsp + 0xa8]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x140022c02
lea rdi, [rdx + rcx]
mov qword [rsp + 0xa0], rdi
lea rbx, [rsp + 0x90]
cmp r8, 8
cmovae rbx, qword [rsp + 0x90]
lea rcx, [rbx + rcx*2]
lea r8, [rdx + rdx]
lea rdx, [rsp + 0xa60]
call fcn.140087210
mov word [rbx + rdi*2], r12w
jmp 0x140022c22
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0xa60]
movzx r8d, byte [rsp + 0x50]
lea rcx, [rsp + 0x90]
call fcn.1400041a0
movzx eax, byte [0x1400f7080]
cmp al, 6
ja 0x140022c58
lea r8, [rsp + 0x90]
cmp qword [rsp + 0xa8], 8
cmovae r8, qword [rsp + 0x90]
mov edx, 6
lea rcx, str.Hq_f_
call fcn.1400308d0
xor edx, edx
mov r8d, 0x800
lea rcx, [rsp + 0x1260]
call fcn.1400878c0
lea r8, [rsp + 0x220]
cmp qword [rsp + 0x238], 8
cmovae r8, qword [rsp + 0x220]
mov eax, dword [rsp + 0x24c]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x248]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x244]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x240]
lea rdx, str._t_t_expirydetails_trial__s__expired__u__extended_expired__u__days_since_expiry__i__days_left__d_____n
lea rcx, [rsp + 0x1260]
call fcn.140027030
movzx eax, byte [0x1400f7080]
cmp al, 6
ja 0x140022ce8
lea r8, [rsp + 0x1260]
mov edx, 6
lea rcx, str.expirydetails___s
call fcn.1400308d0
lea rax, [rsp + 0x1260]
inc rsi
cmp word [rax + rsi*2], 0
jne 0x140022cf0
mov rcx, qword [rsp + 0xa0]
mov rdx, qword [rsp + 0xa8]
mov rax, rdx
sub rax, rcx
cmp rsi, rax
ja 0x140022d52
lea rdi, [rsi + rcx]
mov qword [rsp + 0xa0], rdi
lea rbx, [rsp + 0x90]
cmp rdx, 8
cmovae rbx, qword [rsp + 0x90]
lea rcx, [rbx + rcx*2]
lea r8, [rsi + rsi]
lea rdx, [rsp + 0x1260]
call fcn.140087210
mov word [rbx + rdi*2], r12w
jmp 0x140022d75
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x1260]
movzx r8d, byte [rsp + 0x50]
mov rdx, rsi
lea rcx, [rsp + 0x90]
call fcn.1400041a0
lea rcx, [rsp + 0x90]
cmp qword [rsp + 0xa8], 8
cmovae rcx, qword [rsp + 0x90]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [r15], rax
lea rcx, [rsp + 0xf0]
call fcn.140029950
nop
mov rdx, qword [rsp + 0xa8]
cmp rdx, 8
jb 0x140022dee
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140022de9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140022f4c
call fcn.140084c40
mov qword [rsp + 0xa0], r12
mov qword [rsp + 0xa8], 7
mov word [rsp + 0x90], r12w
mov rdx, qword [rsp + 0xe8]
cmp rdx, 8
jb 0x140022e53
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140022e4e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140022f52
call fcn.140084c40
mov qword [rsp + 0xe0], r12
mov qword [rsp + 0xe8], 7
mov word [rsp + 0xd0], r12w
mov rdx, qword [rsp + 0xc8]
cmp rdx, 8
jb 0x140022eb8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140022eb3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140022f58
call fcn.140084c40
mov qword [rsp + 0xc0], r12
mov qword [rsp + 0xc8], 7
mov word [rsp + 0xb0], r12w
test r14, r14
je 0x140022eef
mov rax, qword [r14]
mov edx, 1
mov rcx, r14
mov rax, qword [rax]
call qword [case.0x14005a798.0]
nop
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x140022f24
mov rcx, qword [rsp + 0x1a60]
xor rcx, rsp
call fcn.140085660
mov rbx, qword [rsp + 0x1aa0]
add rsp, 0x1a70
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
call fcn.14008c334
nop
call fcn.14008c334
nop
call fcn.14008c334
int3