Function at 0x1400249d0
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 8], rbx
push rsi
push rdi
push r12
push r14
push r15
mov eax, 0x1aa0
call fcn.14008a660
sub rsp, rax
mov rax, qword [0x1400fc3f8]
xor rax, rsp
mov qword [rsp + 0x1a90], rax
mov r15, r9
mov rdi, r8
mov rbx, rdx
movzx eax, byte [0x1400fd080]
cmp al, 6
ja 0x140024a21
mov edx, 6
lea rcx, str.GetMcAfeeDeepProtectionStatusEx:_Enter
call fcn.140034b80
lea r8, str.MCWPSSECDASHBOARDSVC
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x140024a57
mov edx, 0x1388
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x80], rax
mov byte [rsp + 0x88], 0
xor r12d, r12d
mov qword [rsp + 0x60], r12
lea rax, [rsp + 0x60]
mov qword [rsp + 0x78], rax
lea ecx, [r12 + 0x18]
call fcn.140089c64
mov qword [rsp + 0x70], rax
test rax, rax
je 0x140024ab3
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], rcx
lea rdx, [rsp + 0x68]
mov rcx, rax
call fcn.14002c290
mov r14, rax
jmp 0x140024ab6
mov r14, r12
mov qword [rsp + 0x70], r14
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140024ad7
mov rax, qword [rcx]
mov edx, 1
mov rax, qword [rax]
call qword [case.0x14005f7f8.0]
nop
mov qword [rsp + 0xb0], r12
mov qword [rsp + 0xc0], r12
mov qword [rsp + 0xc8], 7
mov word [rsp + 0xb0], r12w
mov qword [rsp + 0xd0], r12
mov qword [rsp + 0xe0], r12
mov qword [rsp + 0xe8], 7
mov word [rsp + 0xd0], r12w
mov qword [rsp + 0x90], r12
mov qword [rsp + 0xa0], r12
mov qword [rsp + 0xa8], 7
mov word [rsp + 0x90], r12w
lea rcx, [rsp + 0xf0]
call fcn.14002b870
nop
lea rcx, [rsp + 0xf0]
call fcn.1400391c0
lea rcx, [rsp + 0xf0]
call fcn.14003b980
mov r8b, 1
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0xf0]
call fcn.140039c00
movzx eax, byte [0x1400fd080]
cmp al, 6
ja 0x140024bbc
lea r8, [rsp + 0xb0]
cmp qword [rsp + 0xc8], 8
cmovae r8, qword [rsp + 0xb0]
mov edx, 6
lea rcx, str.GetMcAfeeDeepProtectionStatusEx:__s
call fcn.140034b80
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0xf0]
call fcn.14003c6a0
lea rcx, [rsp + 0xb0]
cmp qword [rsp + 0xc8], 8
cmovae rcx, qword [rsp + 0xb0]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
lea rcx, [rsp + 0xd0]
cmp qword [rsp + 0xe8], 8
cmovae rcx, qword [rsp + 0xd0]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
xor edx, edx
mov r8d, 0x800
lea rcx, [rsp + 0x290]
call fcn.14008cc50
lea rbx, [rsp + 0x210]
cmp qword [rsp + 0x228], 8
cmovae rbx, qword [rsp + 0x210]
lea r11, [rsp + 0x1f0]
cmp qword [rsp + 0x208], 8
cmovae r11, qword [rsp + 0x1f0]
lea r10, [rsp + 0x1d0]
cmp qword [rsp + 0x1e8], 8
cmovae r10, qword [rsp + 0x1d0]
lea rdx, [rsp + 0x1b0]
cmp qword [rsp + 0x1c8], 8
cmovae rdx, qword [rsp + 0x1b0]
lea rcx, [rsp + 0x190]
cmp qword [rsp + 0x1a8], 8
cmovae rcx, qword [rsp + 0x190]
lea rax, [rsp + 0x170]
cmp qword [rsp + 0x188], 8
cmovae rax, qword [rsp + 0x170]
lea r9, [rsp + 0x150]
cmp qword [rsp + 0x168], 8
cmovae r9, qword [rsp + 0x150]
lea r8, [rsp + 0x130]
cmp qword [rsp + 0x148], 8
cmovae r8, qword [rsp + 0x130]
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], r11
mov qword [rsp + 0x38], r10
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea rdx, str._t_t_packagedetails_product_suite_name__s__Localized_product_suite_name__s__package_Id__s__Release_Version__s__rcode__s__Affid__s___culture__s__LCID__s____n
lea rcx, [rsp + 0x290]
call fcn.14002a2f0
movzx eax, byte [0x1400fd080]
cmp al, 6
ja 0x140024d52
lea r8, [rsp + 0x290]
mov edx, 6
lea rcx, str.packagedetails___s
call fcn.140034b80
lea rax, [rsp + 0x290]
mov rsi, 0xffffffffffffffff
mov rdx, rsi
inc rdx
cmp word [rax + rdx*2], 0
jne 0x140024d64
mov rcx, qword [rsp + 0xa0]
mov r8, qword [rsp + 0xa8]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x140024dc6
lea rdi, [rdx + rcx]
mov qword [rsp + 0xa0], rdi
lea rbx, [rsp + 0x90]
cmp r8, 8
cmovae rbx, qword [rsp + 0x90]
lea rcx, [rbx + rcx*2]
lea r8, [rdx + rdx]
lea rdx, [rsp + 0x290]
call fcn.14008c5a0
mov word [rbx + rdi*2], r12w
jmp 0x140024de6
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x290]
movzx r8d, byte [rsp + 0x50]
lea rcx, [rsp + 0x90]
call fcn.140004280
movzx eax, byte [0x1400fd080]
cmp al, 6
ja 0x140024e1c
lea r8, [rsp + 0x90]
cmp qword [rsp + 0xa8], 8
cmovae r8, qword [rsp + 0x90]
mov edx, 6
lea rcx, str.mcafeeSubscriptionXML___s
call fcn.140034b80
xor edx, edx
mov r8d, 0x800
lea rcx, [rsp + 0xa90]
call fcn.14008cc50
movzx r8d, byte [rsp + 0x128]
lea rdx, str._t_t_registrationdetails_registration_complete_status__u_____n
lea rcx, [rsp + 0xa90]
call fcn.14002a2f0
movzx eax, byte [0x1400fd080]
cmp al, 6
ja 0x140024e72
lea r8, [rsp + 0xa90]
mov edx, 6
lea rcx, str.registrationdetails___s
call fcn.140034b80
lea rax, [rsp + 0xa90]
mov rdx, rsi
nop dword [rax]
inc rdx
cmp word [rax + rdx*2], 0
jne 0x140024e80
mov rcx, qword [rsp + 0xa0]
mov r8, qword [rsp + 0xa8]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x140024ee2
lea rdi, [rdx + rcx]
mov qword [rsp + 0xa0], rdi
lea rbx, [rsp + 0x90]
cmp r8, 8
cmovae rbx, qword [rsp + 0x90]
lea rcx, [rbx + rcx*2]
lea r8, [rdx + rdx]
lea rdx, [rsp + 0xa90]
call fcn.14008c5a0
mov word [rbx + rdi*2], r12w
jmp 0x140024f02
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0xa90]
movzx r8d, byte [rsp + 0x50]
lea rcx, [rsp + 0x90]
call fcn.140004280
movzx eax, byte [0x1400fd080]
cmp al, 6
ja 0x140024f38
lea r8, [rsp + 0x90]
cmp qword [rsp + 0xa8], 8
cmovae r8, qword [rsp + 0x90]
mov edx, 6
lea rcx, str.mcafeeSubscriptionXML___s
call fcn.140034b80
xor edx, edx
mov r8d, 0x800
lea rcx, [rsp + 0x1290]
call fcn.14008cc50
lea r8, [rsp + 0x230]
cmp qword [rsp + 0x248], 8
cmovae r8, qword [rsp + 0x230]
mov eax, dword [rsp + 0x25c]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x258]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x254]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x250]
lea rdx, str._t_t_expirydetails_trial__s__expired__u__extended_expired__u__days_since_expiry__i__days_left__d_____n
lea rcx, [rsp + 0x1290]
call fcn.14002a2f0
movzx eax, byte [0x1400fd080]
cmp al, 6
ja 0x140024fc8
lea r8, [rsp + 0x1290]
mov edx, 6
lea rcx, str.expirydetails___s
call fcn.140034b80
lea rax, [rsp + 0x1290]
inc rsi
cmp word [rax + rsi*2], 0
jne 0x140024fd0
mov rcx, qword [rsp + 0xa0]
mov rdx, qword [rsp + 0xa8]
mov rax, rdx
sub rax, rcx
cmp rsi, rax
ja 0x140025032
lea rdi, [rsi + rcx]
mov qword [rsp + 0xa0], rdi
lea rbx, [rsp + 0x90]
cmp rdx, 8
cmovae rbx, qword [rsp + 0x90]
lea rcx, [rbx + rcx*2]
lea r8, [rsi + rsi]
lea rdx, [rsp + 0x1290]
call fcn.14008c5a0
mov word [rbx + rdi*2], r12w
jmp 0x140025055
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x1290]
movzx r8d, byte [rsp + 0x50]
mov rdx, rsi
lea rcx, [rsp + 0x90]
call fcn.140004280
lea rcx, [rsp + 0x90]
cmp qword [rsp + 0xa8], 8
cmovae rcx, qword [rsp + 0x90]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [r15], rax
lea rcx, [rsp + 0xf0]
call fcn.14002d700
nop
mov rdx, qword [rsp + 0xa8]
cmp rdx, 8
jb 0x1400250ce
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400250c9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002522c
call fcn.140089ca0
mov qword [rsp + 0xa0], r12
mov qword [rsp + 0xa8], 7
mov word [rsp + 0x90], r12w
mov rdx, qword [rsp + 0xe8]
cmp rdx, 8
jb 0x140025133
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002512e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140025232
call fcn.140089ca0
mov qword [rsp + 0xe0], r12
mov qword [rsp + 0xe8], 7
mov word [rsp + 0xd0], r12w
mov rdx, qword [rsp + 0xc8]
cmp rdx, 8
jb 0x140025198
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140025193
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140025238
call fcn.140089ca0
mov qword [rsp + 0xc0], r12
mov qword [rsp + 0xc8], 7
mov word [rsp + 0xb0], r12w
test r14, r14
je 0x1400251cf
mov rax, qword [r14]
mov edx, 1
mov rcx, r14
mov rax, qword [rax]
call qword [case.0x14005f7f8.0]
nop
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x140025204
mov rcx, qword [rsp + 0x1a90]
xor rcx, rsp
call fcn.14008a6c0
mov rbx, qword [rsp + 0x1ad0]
add rsp, 0x1aa0
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
call fcn.1400916c4
nop
call fcn.1400916c4
nop
call fcn.1400916c4
int3