Function at 0x1400e48c0
Capabilities:
Check mutex on windows
Create process on windows
Self delete

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x2e0
mov rax, qword [0x1402de400]
xor rax, rsp
mov qword [rsp + 0x2d0], rax
xor ebx, ebx
mov r12d, r9d
mov rdi, r8
mov r13, rcx
test r8, r8
je 0x1400e4b71
lea rdx, str.service
mov rcx, r8
call fcn.1401e5458
test eax, eax
jne 0x1400e4925
xor ecx, ecx
call fcn.1400e36d0
call fcn.1400fd5c0
jmp 0x1400e5034
lea rdx, str.update
mov rcx, rdi
call fcn.1400013c0
cmp rax, rdi
jne 0x1400e4a54
cmp dword [0x1402e2f14], 3
jl 0x1400e5034
mov rax, qword [0x1402e2f20]
cmp qword [rax + 0x10], rbx
je 0x1400e5034
mov rcx, qword [rax + 0x10]
mov rsi, rbx
test rcx, rcx
je 0x1400e496f
call fcn.140001a80
mov rsi, rax
lea rdx, [rsp + 0x1c0]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
or rcx, 0xffffffffffffffff
movabs rdx, 0x22206e61656c63
mov qword [rsp + 0xb0], rdx
xor eax, eax
lea rdi, [rsp + 0xb0]
repne scasb al, byte [rdi]
mov r8d, 0xfa
not rcx
lea rdx, [rsp + rcx + 0xaf]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor eax, eax
lea rdi, [rsp + 0xb0]
or rcx, 0xffffffffffffffff
mov ebp, ebx
repne scasb al, byte [rdi]
movzx eax, word [0x14023a968]
mov word [rdi - 1], ax
mov edi, 0x1e
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
test ebp, ebp
jne 0x1400e4a05
lea rcx, [rsp + 0x1c0]
mov rdx, rsi
call fcn.140004730
test eax, eax
je 0x1400e4a36
lea r9, [rsp + 0xb0]
lea rdx, str.open
mov r8, rsi
xor ecx, ecx
mov dword [rsp + 0x28], 0xa
mov ebp, 1
mov qword [rsp + 0x20], rbx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
ja 0x1400e4a3e
mov eax, edi
dec edi
test eax, eax
jg 0x1400e49e2
test rsi, rsi
je 0x1400e5034
mov rcx, rsi
call fcn.1401e36c8
jmp 0x1400e5034
lea rdx, str.clean
mov rcx, rdi
call fcn.1400013c0
cmp rax, rdi
jne 0x1400e4b5d
cmp dword [0x1402e2f14], 3
jne 0x1400e4ad4
mov rax, qword [0x1402e2f20]
cmp qword [rax + 0x10], rbx
je 0x1400e4ad4
mov ecx, 0x81
call fcn.1400fc780
mov esi, 5
mov ebp, eax
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x1402e2f20]
mov rcx, qword [rcx + 0x10]
call fcn.1401e5314
mov rcx, qword [0x1402e2f20]
xor edx, edx
mov rcx, qword [rcx + 0x10]
call fcn.1401e5300
test eax, eax
jne 0x1400e4acc
mov eax, esi
dec esi
test eax, eax
jg 0x1400e4a93
test ebp, ebp
jne 0x1400e5034
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DefWindowProcW]
lea rcx, [0x1402e2a90]
xor r9d, r9d
mov r8, r13
xor edx, edx
call fcn.1400dfa70
mov edx, r12d
mov rcx, rdi
call fcn.1400e4640
lea rcx, [0x1402e2a90]
mov esi, eax
call fcn.1400e2f00
mov rdi, qword [0x1402e2ae8]
test rdi, rdi
je 0x1400e4b4a
mov rcx, qword [rdi]
test rcx, rcx
je 0x1400e4b2d
call fcn.1401e36c8
mov qword [rdi], rbx
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x1400e4b3f
call fcn.1401e36c8
mov qword [rdi + 8], rbx
mov rcx, rdi
mov dword [rdi + 0x10], ebx
call fcn.1401e32b0
lea rcx, [0x1402e2a90]
call fcn.1400df860
mov eax, esi
jmp 0x1400e5036
lea rdx, [0x14023a760]
mov rcx, rdi
call fcn.1401e43bc
test rax, rax
jne 0x1400e4b7a
call fcn.1400fc350
test eax, eax
jne 0x1400e4be9
mov r8, rdi
test rdi, rdi
je 0x1400e4b87
cmp word [rdi], bx
jne 0x1400e4b94
lea r8, [0x14023a760]
mov dword [reloc.WS2_32.dll_accept], ebx
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
test rax, rax
je 0x1400e4ad4
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1400e4ad4
cmp dword [reloc.WS2_32.dll_accept], 3
jg 0x1400e5034
lea r9, str.Already_opened_
lea r8d, [rax + 0x3f]
lea rdx, str..GotoHttp.cpp
mov ecx, 3
call fcn.1400045a0
jmp 0x1400e5034
test rdi, rdi
je 0x1400e4c0c
lea rdx, str.delete
mov rcx, rdi
call fcn.1400013c0
cmp rax, rdi
jne 0x1400e4c0c
call fcn.1400fc690
jmp 0x1400e5034
mov ecx, 1
call fcn.1400e36d0
lea rdx, [rsp + 0x30]
lea rcx, str.SM_GotoHTTP_x64
mov r8d, 8
mov qword [rsp + 0x30], rbx
call fcn.1400e00b0
test eax, eax
je 0x1400e4c88
mov rsi, qword [rsp + 0x30]
test rsi, rsi
je 0x1400e4c88
mov ebx, 0x64
test rdi, rdi
je 0x1400e4c63
lea rdx, str.exit
mov rcx, rdi
call fcn.1401e5458
mov ecx, 0x65
test eax, eax
cmove ebx, ecx
movzx r8d, bx
xor r9d, r9d
mov edx, VarUI4FromDisp
shl r8d, 0x10
mov rcx, rsi
or r8, 0x800f
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x1400e5034
lea rcx, [rsp + 0x40]
call fcn.1400fc390
test eax, eax
jne 0x1400e4cf0
call fcn.1400fc690
mov r9d, dword [rsp + 0x40]
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0xa1
call fcn.1400e0160
lea rdx, [0x140239da0]
lea r8, [0x14023a760]
mov rcx, qword [rax]
mov r9d, reloc.WS2_32.dll_recv
test rcx, rcx
cmovne rdx, rcx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400e5034
call fcn.1401e3600
jmp 0x1400e5034
lea rcx, [rsp + 0x48]
call fcn.1400fc8b0
mov rdx, qword [rsp + 0x50]
test rdx, rdx
je 0x1400e4d0a
call rdx
mov edi, eax
jmp 0x1400e4d0c
mov edi, ebx
cmp qword [rsp + 0x58], rbx
je 0x1400e4d2c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, [rsp + 0x30]
mov ecx, eax
call qword [rsp + 0x58]
test eax, eax
mov eax, dword [rsp + 0x30]
jne 0x1400e4d2e
mov eax, ebx
cmp edi, eax
je 0x1400e502a
nop word [rax + rax]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x60]
call fcn.1400e34e0
lea rdx, str.general
lea rcx, [rsp + 0x60]
xor r8d, r8d
call fcn.140002b70
mov rdi, rax
test rax, rax
je 0x1400e4d9c
lea rdx, str.name
mov rcx, rax
call fcn.140001ef0
test eax, eax
js 0x1400e4d9c
movsxd rcx, eax
mov rax, qword [rdi + 8]
add rcx, rcx
mov rsi, qword [rax + rcx*8 + 8]
test rsi, rsi
jne 0x1400e4e9f
cmp dword [rsp + 0xa4], ebx
je 0x1400e4e90
lea rdx, str.general
lea rcx, [rsp + 0x60]
xor r8d, r8d
mov dword [rsp + 0xa4], ebx
call fcn.140002b70
mov rdi, rax
test rax, rax
je 0x1400e4e38
lea rdx, [0x14023a110]
mov rcx, rax
call fcn.140001ef0
test eax, eax
js 0x1400e4e38
movsxd rcx, eax
mov rax, qword [rdi + 8]
add rcx, rcx
mov rcx, qword [rax + rcx*8 + 8]
test rcx, rcx
je 0x1400e4e38
movzx eax, byte [rcx]
cmp al, 0x23
jne 0x1400e4e0a
xor edx, edx
inc rcx
lea r8d, [rdx + 0x10]
call fcn.1401e4998
jmp 0x1400e4e3a
cmp al, 0x30
jne 0x1400e4e2b
movzx eax, byte [rcx + 1]
cmp al, 0x78
je 0x1400e4e1a
cmp al, 0x58
jne 0x1400e4e2b
xor edx, edx
add rcx, 2
lea r8d, [rdx + 0x10]
call fcn.1401e4998
jmp 0x1400e4e3a
xor edx, edx
lea r8d, [rdx + 0xa]
call fcn.1401e4998
jmp 0x1400e4e3a
mov eax, ebx
and al, 9
cmp al, 1
mov rax, qword [0x1402e2b88]
jne 0x1400e4e76
test rax, rax
je 0x1400e4e54
mov rdx, qword [rax]
test rdx, rdx
jne 0x1400e4e57
mov rdx, rbx
lea rcx, [rsp + 0x60]
mov r8d, 1
call fcn.1400027e0
lea rcx, [rsp + 0x60]
call fcn.140002680
jmp 0x1400e4d40
test rax, rax
je 0x1400e4e83
mov rdx, qword [rax]
test rdx, rdx
jne 0x1400e4e86
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.140002760
lea rcx, [rsp + 0x60]
call fcn.140002680
jmp 0x1400e4d40
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x30], rbx
call fcn.1400e35c0
mov rdi, qword [rsp + 0x30]
test rdi, rdi
je 0x1400e4ec5
mov rax, qword [rdi]
test rax, rax
jne 0x1400e4ec8
mov rax, rbx
lea rcx, [rsp + 0x30]
mov r9, rsi
xor edx, edx
mov r8d, __WSAFDIsSet
mov qword [rsp + 0x20], rax
call fcn.1400e0160
lea rdx, [0x140239da0]
lea r8, [0x14023a8d8]
mov rcx, qword [rax]
mov r9d, 0x40
test rcx, rcx
cmovne rdx, rcx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400e4f17
call fcn.1401e3600
test rdi, rdi
je 0x1400e4f39
dec dword [rdi + 0x10]
cmp dword [rdi + 0x10], ebx
jg 0x1400e4f39
mov rcx, qword [rdi]
test rcx, rcx
je 0x1400e4f31
call fcn.1401e36c8
mov rcx, rdi
call fcn.1401e32b0
cmp dword [rsp + 0xa4], ebx
je 0x1400e5020
lea rdx, str.general
lea rcx, [rsp + 0x60]
xor r8d, r8d
mov dword [rsp + 0xa4], ebx
call fcn.140002b70
mov rdi, rax
test rax, rax
je 0x1400e4fd5
lea rdx, [0x14023a110]
mov rcx, rax
call fcn.140001ef0
test eax, eax
js 0x1400e4fd5
movsxd rcx, eax
mov rax, qword [rdi + 8]
add rcx, rcx
mov rcx, qword [rax + rcx*8 + 8]
test rcx, rcx
je 0x1400e4fd5
movzx eax, byte [rcx]
cmp al, 0x23
jne 0x1400e4fa7
xor edx, edx
inc rcx
lea r8d, [rdx + 0x10]
call fcn.1401e4998
jmp 0x1400e4fd7
cmp al, 0x30
jne 0x1400e4fc8
movzx eax, byte [rcx + 1]
cmp al, 0x78
je 0x1400e4fb7
cmp al, 0x58
jne 0x1400e4fc8
xor edx, edx
add rcx, 2
lea r8d, [rdx + 0x10]
call fcn.1401e4998
jmp 0x1400e4fd7
xor edx, edx
lea r8d, [rdx + 0xa]
call fcn.1401e4998
jmp 0x1400e4fd7
mov eax, ebx
and al, 9
cmp al, 1
mov rax, qword [0x1402e2b88]
jne 0x1400e5006
test rax, rax
je 0x1400e4ff1
mov rdx, qword [rax]
test rdx, rdx
jne 0x1400e4ff4
mov rdx, rbx
lea rcx, [rsp + 0x60]
mov r8d, 1
call fcn.1400027e0
jmp 0x1400e5020
test rax, rax
je 0x1400e5013
mov rdx, qword [rax]
test rdx, rdx
jne 0x1400e5016
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.140002760
lea rcx, [rsp + 0x60]
call fcn.140002680
lea rcx, [rsp + 0x48]
call fcn.1400fc890
xor eax, eax
mov rcx, qword [rsp + 0x2d0]
xor rcx, rsp
call fcn.1401e42a0
lea r11, [rsp + 0x2e0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret