Function at 0x140072520
Capabilities:
Check for time delay via gettickcount
Delete file
Link many functions at runtime
Write file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rbp
push rbx
push rdi
push r15
lea rbp, [rsp - 0x3c8]
sub rsp, 0x4c8
mov rdi, rcx
mov rbx, rdx
lea rcx, str.wininet
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r15, rax
test rax, rax
jne 0x1400725b4
mov rax, qword [0x14012fa58]
lea rdx, [0x14010c7dc]
cmp byte [rax + 0x150], r15b
jne 0x140072595
mov rcx, qword [0x140134400]
xor r9d, r9d
or r8, 0xffffffffffffffff
mov byte [rsp + 0x20], 1
call fcn.1400ab090
add rsp, 0x4c8
pop r15
pop rdi
pop rbx
pop rbp
ret
lea r9, [0x140117ad8]
xor r8d, r8d
mov rcx, rdi
call fcn.140040a70
add rsp, 0x4c8
pop r15
pop rdi
pop rbx
pop rbp
ret
mov qword [rsp + 0x4f8], rsi
lea rdx, str.InternetOpenW
mov qword [rsp + 0x4c0], r12
mov rcx, r15
mov qword [rsp + 0x4b8], r13
mov qword [rsp + 0x4b0], r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.InternetOpenUrlW
mov rcx, r15
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.InternetCloseHandle
mov rcx, r15
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.InternetReadFileExA
mov rcx, r15
mov qword [rsp + 0x30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.InternetReadFile
mov rcx, r15
mov r13, rax
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
test r14, r14
je 0x140072978
test rsi, rsi
je 0x140072978
cmp qword [rsp + 0x30], 0
je 0x140072978
test r13, r13
je 0x140072978
test rax, rax
je 0x140072978
mov edi, 0x84000000
nop
movzx eax, word [rbx]
cmp ax, 0x20
je 0x14007267f
cmp ax, 9
jne 0x140072685
add rbx, 2
jmp 0x140072670
cmp word [rbx], 0x2a
jne 0x1400726c6
add rbx, 2
mov rcx, rbx
call fcn.14001cf30
lea rdx, [0x14010ca60]
mov rcx, rbx
mov rdi, rax
call fcn.14000b180
test rax, rax
je 0x1400726c6
mov rbx, rax
movzx ecx, word [rbx]
cmp cx, 0x20
je 0x1400726c0
cmp cx, 9
jne 0x1400726c6
add rbx, 2
jmp 0x1400726b1
xor r9d, r9d
mov dword [rsp + 0x20], 0
xor r8d, r8d
lea rcx, str.AutoHotkey
lea edx, [r9 + 4]
call r14
mov r13, rax
test rax, rax
je 0x140072740
mov qword [rsp + 0x28], 0
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], edi
mov rdx, rbx
mov rcx, rax
call rsi
mov rsi, rax
test rax, rax
jne 0x140072716
mov rcx, r13
call qword [rsp + 0x30]
jmp 0x140072740
mov rcx, qword [rbp + 0x400]
lea rdx, [0x1401179a8]
call fcn.1400d10e8
mov r14, rax
test rax, rax
jne 0x14007275a
mov rbx, qword [rsp + 0x30]
mov rcx, rsi
call rbx
mov rcx, r13
call rbx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rbp + 0x3f0]
call fcn.1400441b0
jmp 0x1400729c4
xor eax, eax
mov dword [rsp + 0x40], gethostname
mov qword [rsp + 0x68], rax
mov ecx, 0xffdf
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x70], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 0x400
mov edi, dword gs:[0x48]
movzx eax, word [rbx]
sub ax, 0x48
test cx, ax
mov rcx, rsi
je 0x140072876
lea r9, [rbp + 0x408]
mov r8d, 0x400
lea rdx, [rbp - 0x50]
call r12
mov ebx, eax
test eax, eax
je 0x140072934
nop dword [rax]
cmp dword [rbp + 0x408], 0
je 0x140072934
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [0x14012fa58]
sub eax, dword [0x14013a19c]
cmp eax, dword [rcx + 0x118]
jbe 0x140072838
xor r9d, r9d
mov dword [rsp + 0x20], 0
xor r8d, r8d
lea rcx, [rsp + 0x78]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x14007282c
cmp dword [0x140139538], edi
jne 0x14007282c
mov edx, 1
or ecx, 0xffffffff
call fcn.1400018b0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x14013a19c], eax
mov edx, dword [rbp + 0x408]
lea rcx, [rbp - 0x50]
mov r9, r14
mov r8d, 1
call fcn.1400d2208
lea r9, [rbp + 0x408]
mov r8d, 0x400
lea rdx, [rbp - 0x50]
mov rcx, rsi
call r12
mov ebx, eax
test eax, eax
jne 0x1400727d0
jmp 0x140072934
mov r12, qword [rsp + 0x38]
lea rdx, [rsp + 0x40]
xor r9d, r9d
lea r8d, [r9 + 8]
call r12
mov ebx, eax
test eax, eax
je 0x140072934
cmp dword [rsp + 0x68], 0
je 0x140072934
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [0x14012fa58]
sub eax, dword [0x14013a19c]
cmp eax, dword [rcx + 0x118]
jbe 0x1400728fa
xor r9d, r9d
mov dword [rsp + 0x20], 0
xor r8d, r8d
lea rcx, [rsp + 0x78]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x1400728ee
cmp dword [0x140139538], edi
jne 0x1400728ee
mov edx, 1
or ecx, 0xffffffff
call fcn.1400018b0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x14013a19c], eax
mov edx, dword [rsp + 0x68]
lea rcx, [rbp - 0x50]
mov r9, r14
mov r8d, 1
call fcn.1400d2208
xor r9d, r9d
mov dword [rsp + 0x68], 0x400
lea rdx, [rsp + 0x40]
mov rcx, rsi
lea r8d, [r9 + 8]
call r12
mov ebx, eax
test eax, eax
jne 0x140072894
mov rdi, qword [rsp + 0x30]
mov rcx, rsi
call rdi
mov rcx, r13
call rdi
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, r14
call fcn.1400d1c20
test ebx, ebx
jne 0x140072967
mov rcx, qword [rbp + 0x400]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test ebx, ebx
mov rcx, qword [rbp + 0x3f0]
sete dl
call fcn.140040b90
jmp 0x1400729c4
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rax, qword [0x14012fa58]
lea rdx, [0x14010c7dc]
cmp byte [rax + 0x150], 0
jne 0x1400729b2
mov rcx, qword [0x140134400]
xor r9d, r9d
or r8, 0xffffffffffffffff
mov byte [rsp + 0x20], 1
call fcn.1400ab090
jmp 0x1400729c4
lea r9, [0x140117ad8]
xor r8d, r8d
mov rcx, rdi
call fcn.140040a70
mov r13, qword [rsp + 0x4b8]
mov r12, qword [rsp + 0x4c0]
mov rsi, qword [rsp + 0x4f8]
mov r14, qword [rsp + 0x4b0]
add rsp, 0x4c8
pop r15
pop rdi
pop rbx
pop rbp
ret