Function at 0x1400e8e40
Capabilities:
Check mutex on windows
Create process on windows
Self delete

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x2e0
mov rax, qword [0x1402e0068]
xor rax, rsp
mov qword [rsp + 0x2d0], rax
xor ebx, ebx
mov r12d, r9d
mov rdi, r8
mov r13, rcx
test r8, r8
je 0x1400e90f1
lea rdx, str.service
mov rcx, r8
call fcn.1401e8298
test eax, eax
jne 0x1400e8ea5
xor ecx, ecx
call fcn.1400e7c50
call fcn.1401017a0
jmp 0x1400e95b4
lea rdx, str.update
mov rcx, rdi
call fcn.140001410
cmp rax, rdi
jne 0x1400e8fd4
cmp dword [0x1402e4b54], 3
jl 0x1400e95b4
mov rax, qword [0x1402e4b60]
cmp qword [rax + 0x10], rbx
je 0x1400e95b4
mov rcx, qword [rax + 0x10]
mov rsi, rbx
test rcx, rcx
je 0x1400e8eef
call fcn.140001ad0
mov rsi, rax
lea rdx, [rsp + 0x1c0]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
or rcx, 0xffffffffffffffff
movabs rdx, 0x22206e61656c63
mov qword [rsp + 0xb0], rdx
xor eax, eax
lea rdi, [rsp + 0xb0]
repne scasb al, byte [rdi]
mov r8d, 0xfa
not rcx
lea rdx, [rsp + rcx + 0xaf]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor eax, eax
lea rdi, [rsp + 0xb0]
or rcx, 0xffffffffffffffff
mov ebp, ebx
repne scasb al, byte [rdi]
movzx eax, word [0x14023d828]
mov word [rdi - 1], ax
mov edi, 0x1e
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
test ebp, ebp
jne 0x1400e8f85
lea rcx, [rsp + 0x1c0]
mov rdx, rsi
call fcn.140004780
test eax, eax
je 0x1400e8fb6
lea r9, [rsp + 0xb0]
lea rdx, str.open
mov r8, rsi
xor ecx, ecx
mov dword [rsp + 0x28], 0xa
mov ebp, 1
mov qword [rsp + 0x20], rbx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
ja 0x1400e8fbe
mov eax, edi
dec edi
test eax, eax
jg 0x1400e8f62
test rsi, rsi
je 0x1400e95b4
mov rcx, rsi
call fcn.1401e64f8
jmp 0x1400e95b4
lea rdx, str.clean
mov rcx, rdi
call fcn.140001410
cmp rax, rdi
jne 0x1400e90dd
cmp dword [0x1402e4b54], 3
jne 0x1400e9054
mov rax, qword [0x1402e4b60]
cmp qword [rax + 0x10], rbx
je 0x1400e9054
mov ecx, 0x81
call fcn.140100990
mov esi, 5
mov ebp, eax
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x1402e4b60]
mov rcx, qword [rcx + 0x10]
call fcn.1401e8154
mov rcx, qword [0x1402e4b60]
xor edx, edx
mov rcx, qword [rcx + 0x10]
call fcn.1401e8140
test eax, eax
jne 0x1400e904c
mov eax, esi
dec esi
test eax, eax
jg 0x1400e9013
test ebp, ebp
jne 0x1400e95b4
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DefWindowProcW]
lea rcx, [0x1402e4710]
xor r9d, r9d
mov r8, r13
xor edx, edx
call fcn.1400e3fe0
mov edx, r12d
mov rcx, rdi
call fcn.1400e8bc0
lea rcx, [0x1402e4710]
mov esi, eax
call fcn.1400e7480
mov rdi, qword [0x1402e4768]
test rdi, rdi
je 0x1400e90ca
mov rcx, qword [rdi]
test rcx, rcx
je 0x1400e90ad
call fcn.1401e64f8
mov qword [rdi], rbx
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x1400e90bf
call fcn.1401e64f8
mov qword [rdi + 8], rbx
mov rcx, rdi
mov dword [rdi + 0x10], ebx
call fcn.1401e60f0
lea rcx, [0x1402e4710]
call fcn.1400e3dd0
mov eax, esi
jmp 0x1400e95b6
lea rdx, [0x14023d620]
mov rcx, rdi
call fcn.1401e6ea4
test rax, rax
jne 0x1400e90fa
call fcn.140100560
test eax, eax
jne 0x1400e9169
mov r8, rdi
test rdi, rdi
je 0x1400e9107
cmp word [rdi], bx
jne 0x1400e9114
lea r8, [0x14023d620]
mov dword [reloc.WS2_32.dll_accept], ebx
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
test rax, rax
je 0x1400e9054
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1400e9054
cmp dword [reloc.WS2_32.dll_accept], 3
jg 0x1400e95b4
lea r9, str.Already_opened_
lea r8d, [rax + 0x3f]
lea rdx, str..GotoHttp.cpp
mov ecx, 3
call fcn.1400045f0
jmp 0x1400e95b4
test rdi, rdi
je 0x1400e918c
lea rdx, str.delete
mov rcx, rdi
call fcn.140001410
cmp rax, rdi
jne 0x1400e918c
call fcn.1401008a0
jmp 0x1400e95b4
mov ecx, 1
call fcn.1400e7c50
lea rdx, [rsp + 0x30]
lea rcx, str.SM_GotoHTTP_x64
mov r8d, 8
mov qword [rsp + 0x30], rbx
call fcn.1400e4620
test eax, eax
je 0x1400e9208
mov rsi, qword [rsp + 0x30]
test rsi, rsi
je 0x1400e9208
mov ebx, 0x64
test rdi, rdi
je 0x1400e91e3
lea rdx, str.exit
mov rcx, rdi
call fcn.1401e8298
mov ecx, 0x65
test eax, eax
cmove ebx, ecx
movzx r8d, bx
xor r9d, r9d
mov edx, VarUI4FromDisp
shl r8d, 0x10
mov rcx, rsi
or r8, 0x800f
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x1400e95b4
lea rcx, [rsp + 0x40]
call fcn.1401005a0
test eax, eax
jne 0x1400e9270
call fcn.1401008a0
mov r9d, dword [rsp + 0x40]
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0xa1
call fcn.1400e46d0
lea rdx, [0x14023ce88]
lea r8, [0x14023d620]
mov rcx, qword [rax]
mov r9d, reloc.WS2_32.dll_recv
test rcx, rcx
cmovne rdx, rcx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400e95b4
call fcn.1401e6538
jmp 0x1400e95b4
lea rcx, [rsp + 0x48]
call fcn.140100ac0
mov rdx, qword [rsp + 0x50]
test rdx, rdx
je 0x1400e928a
call rdx
mov edi, eax
jmp 0x1400e928c
mov edi, ebx
cmp qword [rsp + 0x58], rbx
je 0x1400e92ac
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, [rsp + 0x30]
mov ecx, eax
call qword [rsp + 0x58]
test eax, eax
mov eax, dword [rsp + 0x30]
jne 0x1400e92ae
mov eax, ebx
cmp edi, eax
je 0x1400e95aa
nop word [rax + rax]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x60]
call fcn.1400e7a60
lea rdx, str.general
lea rcx, [rsp + 0x60]
xor r8d, r8d
call fcn.140002bc0
mov rdi, rax
test rax, rax
je 0x1400e931c
lea rdx, str.name
mov rcx, rax
call fcn.140001f40
test eax, eax
js 0x1400e931c
movsxd rcx, eax
mov rax, qword [rdi + 8]
add rcx, rcx
mov rsi, qword [rax + rcx*8 + 8]
test rsi, rsi
jne 0x1400e941f
cmp dword [rsp + 0xa4], ebx
je 0x1400e9410
lea rdx, str.general
lea rcx, [rsp + 0x60]
xor r8d, r8d
mov dword [rsp + 0xa4], ebx
call fcn.140002bc0
mov rdi, rax
test rax, rax
je 0x1400e93b8
lea rdx, [0x14023cfd0]
mov rcx, rax
call fcn.140001f40
test eax, eax
js 0x1400e93b8
movsxd rcx, eax
mov rax, qword [rdi + 8]
add rcx, rcx
mov rcx, qword [rax + rcx*8 + 8]
test rcx, rcx
je 0x1400e93b8
movzx eax, byte [rcx]
cmp al, 0x23
jne 0x1400e938a
xor edx, edx
inc rcx
lea r8d, [rdx + 0x10]
call fcn.1401e7480
jmp 0x1400e93ba
cmp al, 0x30
jne 0x1400e93ab
movzx eax, byte [rcx + 1]
cmp al, 0x78
je 0x1400e939a
cmp al, 0x58
jne 0x1400e93ab
xor edx, edx
add rcx, 2
lea r8d, [rdx + 0x10]
call fcn.1401e7480
jmp 0x1400e93ba
xor edx, edx
lea r8d, [rdx + 0xa]
call fcn.1401e7480
jmp 0x1400e93ba
mov eax, ebx
and al, 9
cmp al, 1
mov rax, qword [0x1402e4808]
jne 0x1400e93f6
test rax, rax
je 0x1400e93d4
mov rdx, qword [rax]
test rdx, rdx
jne 0x1400e93d7
mov rdx, rbx
lea rcx, [rsp + 0x60]
mov r8d, 1
call fcn.140002830
lea rcx, [rsp + 0x60]
call fcn.1400026d0
jmp 0x1400e92c0
test rax, rax
je 0x1400e9403
mov rdx, qword [rax]
test rdx, rdx
jne 0x1400e9406
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.1400027b0
lea rcx, [rsp + 0x60]
call fcn.1400026d0
jmp 0x1400e92c0
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x30], rbx
call fcn.1400e7b40
mov rdi, qword [rsp + 0x30]
test rdi, rdi
je 0x1400e9445
mov rax, qword [rdi]
test rax, rax
jne 0x1400e9448
mov rax, rbx
lea rcx, [rsp + 0x30]
mov r9, rsi
xor edx, edx
mov r8d, __WSAFDIsSet
mov qword [rsp + 0x20], rax
call fcn.1400e46d0
lea rdx, [0x14023ce88]
lea r8, str.gotohttp.com
mov rcx, qword [rax]
mov r9d, 0x40
test rcx, rcx
cmovne rdx, rcx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400e9497
call fcn.1401e6538
test rdi, rdi
je 0x1400e94b9
dec dword [rdi + 0x10]
cmp dword [rdi + 0x10], ebx
jg 0x1400e94b9
mov rcx, qword [rdi]
test rcx, rcx
je 0x1400e94b1
call fcn.1401e64f8
mov rcx, rdi
call fcn.1401e60f0
cmp dword [rsp + 0xa4], ebx
je 0x1400e95a0
lea rdx, str.general
lea rcx, [rsp + 0x60]
xor r8d, r8d
mov dword [rsp + 0xa4], ebx
call fcn.140002bc0
mov rdi, rax
test rax, rax
je 0x1400e9555
lea rdx, [0x14023cfd0]
mov rcx, rax
call fcn.140001f40
test eax, eax
js 0x1400e9555
movsxd rcx, eax
mov rax, qword [rdi + 8]
add rcx, rcx
mov rcx, qword [rax + rcx*8 + 8]
test rcx, rcx
je 0x1400e9555
movzx eax, byte [rcx]
cmp al, 0x23
jne 0x1400e9527
xor edx, edx
inc rcx
lea r8d, [rdx + 0x10]
call fcn.1401e7480
jmp 0x1400e9557
cmp al, 0x30
jne 0x1400e9548
movzx eax, byte [rcx + 1]
cmp al, 0x78
je 0x1400e9537
cmp al, 0x58
jne 0x1400e9548
xor edx, edx
add rcx, 2
lea r8d, [rdx + 0x10]
call fcn.1401e7480
jmp 0x1400e9557
xor edx, edx
lea r8d, [rdx + 0xa]
call fcn.1401e7480
jmp 0x1400e9557
mov eax, ebx
and al, 9
cmp al, 1
mov rax, qword [0x1402e4808]
jne 0x1400e9586
test rax, rax
je 0x1400e9571
mov rdx, qword [rax]
test rdx, rdx
jne 0x1400e9574
mov rdx, rbx
lea rcx, [rsp + 0x60]
mov r8d, 1
call fcn.140002830
jmp 0x1400e95a0
test rax, rax
je 0x1400e9593
mov rdx, qword [rax]
test rdx, rdx
jne 0x1400e9596
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.1400027b0
lea rcx, [rsp + 0x60]
call fcn.1400026d0
lea rcx, [rsp + 0x48]
call fcn.140100aa0
xor eax, eax
mov rcx, qword [rsp + 0x2d0]
xor rcx, rsp
call fcn.1401e6720
lea r11, [rsp + 0x2e0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret