Function at 0x196bbb80
Capabilities:
Check http status code
Check mutex and terminate process on windows
Check mutex on windows
Read file via mapping
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x164
push str.injected_
call fcn.196c32d0
add esp, 4
mov dword [ebp - 0x120], 0x114
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov ecx, 5
cmp ecx, dword [ebp - 0x11c]
sbb edx, edx
add edx, 1
mov byte [0x196c8a36], dl
call fcn.196bc080
mov dword [0x196c8cb8], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [0x196c8ccc], eax
mov eax, dword [0x196c8ccc]
push eax
call fcn.196b1bf0
add esp, 4
test eax, eax
jne 0x196bbc22
push 0x7b1c204b
push 0x1a
push 0x196c49a4
call fcn.196b17f0
add esp, 0xc
push eax
push 1
push 0x170
push str.injlib_remote_thread.cpp
push str.RemoteThread
call fcn.196b1920
add esp, 0x14
jmp 0x196bc002
push 0x196c90d8
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [0x196c8cbc], eax
cmp dword [0x196c8cbc], 0
jne 0x196bbc75
push 0x7cea3366
push 0x12
push 0x196c49dc
call fcn.196b17f0
add esp, 0xc
push eax
push 2
push 0x179
push str.injlib_remote_thread.cpp
push str.RemoteThread
call fcn.196b1920
add esp, 0x14
jmp 0x196bc002
push 0x196c8cd8
push 0
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov dword [0x196c8cc4], eax
cmp dword [0x196c8cc4], 0
jne 0x196bbcc5
push 0x8020c824
push 0x14
push 0x196c49f0
call fcn.196b17f0
add esp, 0xc
push eax
push 2
push 0x182
push str.injlib_remote_thread.cpp
push str.RemoteThread
call fcn.196b1920
add esp, 0x14
jmp 0x196bc002
push 0
push 0
push 0
push 4
mov ecx, dword [0x196c8cc4]
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [0x196c8cc8], eax
cmp dword [0x196c8cc8], 0
jne 0x196bbd1b
push 0xde81f2b5
push 0x15
push 0x196c4a08
call fcn.196b17f0
add esp, 0xc
push eax
push 2
push 0x18b
push str.injlib_remote_thread.cpp
push str.RemoteThread
call fcn.196b1920
add esp, 0x14
jmp 0x196bc002
push 0x196c92d8
push 0
push 6
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov dword [0x196c8cd0], eax
cmp dword [0x196c8cd0], 0
jne 0x196bbd6b
push 0xc34af627
push 0x13
push str.Ikm_a
call fcn.196b17f0
add esp, 0xc
push eax
push 2
push 0x194
push str.injlib_remote_thread.cpp
push str.RemoteThread
call fcn.196b1920
add esp, 0x14
jmp 0x196bc002
push 0
push 0
push 0
push 6
mov edx, dword [0x196c8cd0]
push edx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [0x196c9568], eax
cmp dword [0x196c9568], 0
jne 0x196bbdc1
push 0xae381e4f
push 0x14
push 0x196c4a34
call fcn.196b17f0
add esp, 0xc
push eax
push 2
push 0x19d
push str.injlib_remote_thread.cpp
push str.RemoteThread
call fcn.196b1920
add esp, 0x14
jmp 0x196bc002
call fcn.196bdfb0
push 0
push 0
push 0
push 0xffffffffffffffff
lea eax, [ebp - 0x13c]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
lea ecx, [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_GetThreadDesktop]
push eax
call fcn.196bae30
add esp, 8
movzx edx, al
test edx, edx
je 0x196bbe1b
mov eax, dword [ebp - 4]
push eax
push str.IsVNC___x
call fcn.196c32d0
add esp, 8
mov ecx, dword [ebp - 4]
push ecx
call fcn.196bb280
jmp 0x196bbffa
push 0x196c8ed8
push 0
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov dword [0x196c8cc0], eax
cmp dword [0x196c8cc0], 0
jne 0x196bbe6e
push 0x5b7f9aa6
push 0xf
push 0x196c4a60
call fcn.196b17f0
add esp, 0xc
push eax
push 2
push 0x1b2
push str.injlib_remote_thread.cpp
push str.RemoteThread
call fcn.196b1920
add esp, 0x14
jmp 0x196bc002
call fcn.196bc3b0
mov edx, dword [0x196c9568]
push edx
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0
jne 0x196bbec9
push 0xb0cdb1bf
push 0x1f
push 0x196c4a70
call fcn.196b17f0
add esp, 0xc
push eax
push 2
push 0x1bd
push str.injlib_remote_thread.cpp
push str.RemoteThread
call fcn.196b1920
add esp, 0x14
jmp 0x196bc002
push 0xffffffffffffffff
mov eax, dword [ebp - 0x140]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [0x196c9568]
add ecx, 0x78
mov dword [ebp - 0x144], ecx
mov dword [ebp - 0x148], 0
jmp 0x196bbf02
mov edx, dword [ebp - 0x148]
add edx, 1
mov dword [ebp - 0x148], edx
cmp dword [ebp - 0x148], 0x190
jae 0x196bbf59
mov eax, dword [ebp - 0x148]
imul eax, eax, 0x18
mov ecx, dword [ebp - 0x144]
cmp dword [ecx + eax + 8], 0
jne 0x196bbf57
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, dword [ebp - 0x148]
imul edx, edx, 0x18
mov ecx, dword [ebp - 0x144]
mov dword [ecx + edx], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, dword [ebp - 0x148]
imul edx, edx, 0x18
mov ecx, dword [ebp - 0x144]
mov dword [ecx + edx + 8], eax
jmp 0x196bbf59
jmp 0x196bbef3
mov edx, dword [ebp - 0x140]
push edx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push 1
mov eax, dword [0x196c8cc0]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x196bbfde
lea ecx, [ebp - 0x164]
push ecx
call fcn.196c2e20
add esp, 4
test eax, eax
je 0x196bbfdc
push 0
lea edx, [ebp - 0x164]
push edx
call fcn.196c3020
add esp, 8
cmp dword [ebp - 0x160], 1
jne 0x196bbfdc
mov byte [0x196c95d0], 1
mov eax, dword [ebp - 0x15c]
push eax
push str.enter__X
call fcn.196c32d0
add esp, 8
mov ecx, dword [ebp - 0x15c]
push ecx
call fcn.196bb280
push str.leave
call fcn.196c32d0
add esp, 4
jmp 0x196bbf66
mov edx, dword [ebp - 0x140]
push edx
call fcn.196b1ba0
add esp, 4
call fcn.196bc440
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
jne 0x196bbb96
call fcn.196bdfe0
cmp dword [0x196c8cb8], 0
je 0x196bc018
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [0x196c9568]
push ecx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov edx, dword [0x196c8cd0]
push edx
call fcn.196b1ba0
add esp, 4
mov eax, dword [0x196c8cc0]
push eax
call fcn.196b1ba0
add esp, 4
mov ecx, dword [0x196c8cbc]
push ecx
call fcn.196b1ba0
add esp, 4
mov edx, dword [0x196c8cc8]
push edx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [0x196c8cc4]
push eax
call fcn.196b1ba0
add esp, 4
mov esp, ebp
pop ebp
ret 4