Function at 0x140006cc0
Capabilities:
Create process on windows
Create thread
Encode data using xor
Log keystrokes via polling
Terminate process

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rbp
lea rbp, [r11 - 0x5f]
sub rsp, 0xb0
movups xmm0, xmmword [str.__AFD]
mov eax, dword [0x14007cc28]
xor ebx, ebx
cmp dword [reloc.WS2_32.dll_accept], 2
mov ecx, ebx
movups xmmword [rbp - 0x29], xmm0
mov dword [rbp - 0x11], eax
movsd xmm0, qword [0x14007cc20]
movzx eax, word [0x14007cc2c]
movsd qword [rbp - 0x19], xmm0
mov word [rbp - 0xd], ax
jl 0x140006e46
movdqa xmm0, xmmword [0x14007cc80]
lea rdx, [rbp - 0x29]
movdqa xmm5, xmmword [0x14007cc50]
movdqa xmm4, xmmword [0x14007ccc0]
movaps xmmword [r11 - 0x18], xmm6
movdqa xmm6, xmmword [str.6666]
movdqa xmmword [rbp - 9], xmm0
mov r8d, dword [rbp - 9]
movaps xmmword [r11 - 0x28], xmm7
movdqa xmm7, xmmword [0x14007cc70]
nop
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
paddd xmm3, xmm5
movdqa xmm0, xmm2
pmuldq xmm1, xmm4
punpckhdq xmm0, xmm2
add ecx, 8
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
pmulld xmm0, xmm6
psubd xmm2, xmm0
movd xmm0, r8d
andps xmm2, xmm7
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rdx - 8], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
movd xmm0, r8d
andps xmm3, xmm7
packuswb xmm3, xmm3
packuswb xmm3, xmm3
paddb xmm3, xmm0
movd xmm0, dword [rdx - 4]
xorps xmm3, xmm0
movd dword [rdx - 4], xmm3
cmp ecx, 0x18
jl 0x140006d50
movaps xmm7, xmmword [rsp + 0x90]
movaps xmm6, xmmword [rsp + 0xa0]
cmp ecx, 0x1e
jge 0x140006e7d
movsxd rax, ecx
lea r8, [rbp - 0x29]
add r8, rax
mov eax, 0x4bda12f7
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x36
movzx eax, cl
inc ecx
sub al, dl
add al, 0x33
xor byte [r8 - 1], al
cmp ecx, 0x1e
jl 0x140006e50
xorps xmm0, xmm0
mov qword [rbp + 0x27], rbx
movups xmmword [rbp + 0x17], xmm0
mov qword [rbp + 0x2f], rbx
lea rax, [rbp - 0x29]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], bl
jne 0x140006e97
lea rdx, [rbp - 0x29]
lea rcx, [rbp + 0x17]
call fcn.1400027c0
cmp qword [rbp + 0x2f], 0xf
lea r8, [rbp + 0x17]
mov dword [rsp + 0x28], 1
lea rdx, str.open
cmova r8, qword [rbp + 0x17]
xor r9d, r9d
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
call fcn.140004940
call fcn.140004940
mov rdx, rax
call fcn.140004870
test eax, eax
je 0x140006f0d
mov r8d, eax
mov dword [0x140087ea0], eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140087ea8], rax
call fcn.140004940
call fcn.140004940
mov rdx, rax
call fcn.140004870
test eax, eax
je 0x140007185
mov r8d, eax
mov dword [0x140087ea0], eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140087ea8], rax
test rax, rax
je 0x140007185
lea rcx, [0x140088570]
call fcn.140012b60
cmp byte [0x1400887a0], bl
je 0x14000717c
mov r9d, 0x40
lea r8, str.Info
lea rdx, str.Welcome_to_Atherx_Loader__nPress_Ins_Button_To_Inject_Menu_nPress_End_to_Exit_n
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 0x40
mov qword [rbp - 1], rbx
call fcn.14006677c
movups xmm0, xmmword [str.C:ProgramDataWindowsHolographicDevicescimgui.dll]
mov qword [rbp - 9], rax
mov rcx, rax
mov qword [rbp + 7], gethostname
mov edx, 0x65
mov qword [rbp + 0xf], 0x3f
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x14007ca50]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [0x14007ca60]
movups xmmword [rax + 0x20], xmm0
movzx eax, word [0x14007ca70]
mov word [rcx + 0x30], ax
movzx eax, byte [0x14007ca72]
mov byte [rcx + 0x32], al
mov byte [rcx + 0x33], bl
lea rcx, [rbp - 9]
call fcn.140006a10
mov ecx, reloc.WLDAP32.dll_Ordinal_32
mov qword [rbp - 1], rbx
call fcn.14006677c
movups xmm0, xmmword [str.C:WindowsTempClient.dll]
mov qword [rbp - 9], rax
mov edx, 0x66
mov qword [rbp + 7], reloc.WLDAP32.dll_Ordinal_26
mov qword [rbp + 0xf], Ordinal_33
movups xmmword [rax], xmm0
movsd xmm0, qword [0x14007cb50]
movsd qword [rax + 0x10], xmm0
movzx ecx, word [0x14007cb58]
mov word [rax + 0x18], cx
lea rcx, [rbp - 9]
mov byte [rax + 0x1a], bl
call fcn.140006a10
mov ecx, 0x40
mov qword [rbp - 1], rbx
call fcn.14006677c
movups xmm0, xmmword [str.C:ProgramDataWindowsHolographicDevicesAotBst.dll]
mov qword [rbp - 9], rax
mov rcx, rax
mov qword [rbp + 7], gethostname
mov edx, 0x68
mov qword [rbp + 0xf], 0x3f
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x14007ca88]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [0x14007ca98]
movups xmmword [rax + 0x20], xmm0
movzx eax, word [0x14007caa8]
mov word [rcx + 0x30], ax
movzx eax, byte [0x14007caaa]
mov byte [rcx + 0x32], al
mov byte [rcx + 0x33], bl
lea rcx, [rbp - 9]
call fcn.140006a10
nop dword [rax]
mov ecx, reloc.WLDAP32.dll_Ordinal_45
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140007117
mov ecx, 1
call fcn.14006677c
lea rcx, [rbp - 1]
mov r9, rax
mov qword [rsp + 0x28], rcx
lea r8, [0x140007dc0]
xor ecx, ecx
mov dword [rsp + 0x20], ebx
xor edx, edx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 9], rax
test rax, rax
je 0x140007148
cmp dword [rbp - 1], ebx
je 0x14000713c
movaps xmm0, xmmword [rbp - 9]
lea rcx, [rbp - 0x29]
movdqa xmmword [rbp - 0x29], xmm0
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14000713c
xorps xmm0, xmm0
movdqa xmmword [rbp - 9], xmm0
mov ecx, reloc.WLDAP32.dll_Ordinal_35
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
jne 0x140007157
lea rcx, [rbp - 0x29]
mov qword [rbp - 0x29], Ordinal_301
call fcn.1400077a0
jmp 0x1400070b0
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 6
mov dword [rbp - 1], ebx
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
call fcn.140006860
test al, al
jne 0x14000717c
mov r9d, reloc.WS2_32.dll_recv
lea r8, str.Error
lea rdx, str.Cant_Kill_BlueStack
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov r9d, reloc.WS2_32.dll_recv
lea r8, str.Error
lea rdx, str.Cant_Find_Process
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3