Function at 0xe1bb80
Capabilities:
Check http status code
Check mutex and terminate process on windows
Check mutex on windows
Read file via mapping
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x164
push str.injected_
call fcn.00e232d0
add esp, 4
mov dword [ebp - 0x120], 0x114
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov ecx, 5
cmp ecx, dword [ebp - 0x11c]
sbb edx, edx
add edx, 1
mov byte [0xe28a36], dl
call fcn.00e1c080
mov dword [0xe28cb8], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [0xe28ccc], eax
mov eax, dword [0xe28ccc]
push eax
call fcn.00e11bf0
add esp, 4
test eax, eax
jne 0xe1bc22
push 0x7b1c204b
push 0x1a
push 0xe249a4
call fcn.00e117f0
add esp, 0xc
push eax
push 1
push 0x170
push str.injlib_remote_thread.cpp
push str.RemoteThread
call fcn.00e11920
add esp, 0x14
jmp 0xe1c002
push 0xe290d8
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [0xe28cbc], eax
cmp dword [0xe28cbc], 0
jne 0xe1bc75
push 0x7cea3366
push 0x12
push 0xe249dc
call fcn.00e117f0
add esp, 0xc
push eax
push 2
push 0x179
push str.injlib_remote_thread.cpp
push str.RemoteThread
call fcn.00e11920
add esp, 0x14
jmp 0xe1c002
push 0xe28cd8
push 0
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov dword [0xe28cc4], eax
cmp dword [0xe28cc4], 0
jne 0xe1bcc5
push 0x8020c824
push 0x14
push 0xe249f0
call fcn.00e117f0
add esp, 0xc
push eax
push 2
push 0x182
push str.injlib_remote_thread.cpp
push str.RemoteThread
call fcn.00e11920
add esp, 0x14
jmp 0xe1c002
push 0
push 0
push 0
push 4
mov ecx, dword [0xe28cc4]
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [0xe28cc8], eax
cmp dword [0xe28cc8], 0
jne 0xe1bd1b
push 0xde81f2b5
push 0x15
push 0xe24a08
call fcn.00e117f0
add esp, 0xc
push eax
push 2
push 0x18b
push str.injlib_remote_thread.cpp
push str.RemoteThread
call fcn.00e11920
add esp, 0x14
jmp 0xe1c002
push 0xe292d8
push 0
push 6
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov dword [0xe28cd0], eax
cmp dword [0xe28cd0], 0
jne 0xe1bd6b
push 0xc34af627
push 0x13
push str.Ikm_a
call fcn.00e117f0
add esp, 0xc
push eax
push 2
push 0x194
push str.injlib_remote_thread.cpp
push str.RemoteThread
call fcn.00e11920
add esp, 0x14
jmp 0xe1c002
push 0
push 0
push 0
push 6
mov edx, dword [0xe28cd0]
push edx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [0xe29568], eax
cmp dword [0xe29568], 0
jne 0xe1bdc1
push 0xae381e4f
push 0x14
push 0xe24a34
call fcn.00e117f0
add esp, 0xc
push eax
push 2
push 0x19d
push str.injlib_remote_thread.cpp
push str.RemoteThread
call fcn.00e11920
add esp, 0x14
jmp 0xe1c002
call fcn.00e1dfb0
push 0
push 0
push 0
push 0xffffffffffffffff
lea eax, [ebp - 0x13c]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
lea ecx, [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_GetThreadDesktop]
push eax
call fcn.00e1ae30
add esp, 8
movzx edx, al
test edx, edx
je 0xe1be1b
mov eax, dword [ebp - 4]
push eax
push str.IsVNC___x
call fcn.00e232d0
add esp, 8
mov ecx, dword [ebp - 4]
push ecx
call fcn.00e1b280
jmp 0xe1bffa
push 0xe28ed8
push 0
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov dword [0xe28cc0], eax
cmp dword [0xe28cc0], 0
jne 0xe1be6e
push 0x5b7f9aa6
push 0xf
push 0xe24a60
call fcn.00e117f0
add esp, 0xc
push eax
push 2
push 0x1b2
push str.injlib_remote_thread.cpp
push str.RemoteThread
call fcn.00e11920
add esp, 0x14
jmp 0xe1c002
call fcn.00e1c3b0
mov edx, dword [0xe29568]
push edx
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0
jne 0xe1bec9
push 0xb0cdb1bf
push 0x1f
push 0xe24a70
call fcn.00e117f0
add esp, 0xc
push eax
push 2
push 0x1bd
push str.injlib_remote_thread.cpp
push str.RemoteThread
call fcn.00e11920
add esp, 0x14
jmp 0xe1c002
push 0xffffffffffffffff
mov eax, dword [ebp - 0x140]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [0xe29568]
add ecx, 0x78
mov dword [ebp - 0x144], ecx
mov dword [ebp - 0x148], 0
jmp 0xe1bf02
mov edx, dword [ebp - 0x148]
add edx, 1
mov dword [ebp - 0x148], edx
cmp dword [ebp - 0x148], 0x190
jae 0xe1bf59
mov eax, dword [ebp - 0x148]
imul eax, eax, 0x18
mov ecx, dword [ebp - 0x144]
cmp dword [ecx + eax + 8], 0
jne 0xe1bf57
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, dword [ebp - 0x148]
imul edx, edx, 0x18
mov ecx, dword [ebp - 0x144]
mov dword [ecx + edx], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, dword [ebp - 0x148]
imul edx, edx, 0x18
mov ecx, dword [ebp - 0x144]
mov dword [ecx + edx + 8], eax
jmp 0xe1bf59
jmp 0xe1bef3
mov edx, dword [ebp - 0x140]
push edx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push 1
mov eax, dword [0xe28cc0]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0xe1bfde
lea ecx, [ebp - 0x164]
push ecx
call fcn.00e22e20
add esp, 4
test eax, eax
je 0xe1bfdc
push 0
lea edx, [ebp - 0x164]
push edx
call fcn.00e23020
add esp, 8
cmp dword [ebp - 0x160], 1
jne 0xe1bfdc
mov byte [0xe295d0], 1
mov eax, dword [ebp - 0x15c]
push eax
push str.enter__X
call fcn.00e232d0
add esp, 8
mov ecx, dword [ebp - 0x15c]
push ecx
call fcn.00e1b280
push str.leave
call fcn.00e232d0
add esp, 4
jmp 0xe1bf66
mov edx, dword [ebp - 0x140]
push edx
call fcn.00e11ba0
add esp, 4
call fcn.00e1c440
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
jne 0xe1bb96
call fcn.00e1dfe0
cmp dword [0xe28cb8], 0
je 0xe1c018
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [0xe29568]
push ecx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov edx, dword [0xe28cd0]
push edx
call fcn.00e11ba0
add esp, 4
mov eax, dword [0xe28cc0]
push eax
call fcn.00e11ba0
add esp, 4
mov ecx, dword [0xe28cbc]
push ecx
call fcn.00e11ba0
add esp, 4
mov edx, dword [0xe28cc8]
push edx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [0xe28cc4]
push eax
call fcn.00e11ba0
add esp, 4
mov esp, ebp
pop ebp
ret 4