Function at 0x140006eb0
Capabilities:
Delete file
Encode data using xor
Execute command
Log keystrokes via polling
Set registry value
Terminate process

Disassembly:
push rbx
sub rsp, 0x40
xor ebx, ebx
lea rcx, [0x14000bf14]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea r9d, [rbx + 0x40]
lea r8, [0x14000c0c0]
lea rdx, str.Press_OK_to_begin_spoofing.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
lea rdx, [0x140011050]
cmp byte [0x14001106f], bl
je 0x140006f16
mov eax, ebx
lea ecx, [rax - 0x7d]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0x1e
jb 0x140006f01
mov byte [0x14001106f], bl
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbx
mov r8d, 0x1e
lea rcx, [rsp + 0x20]
call fcn.140004740
nop
mov r8d, 0x70e70
lea rdx, [0x140011070]
lea rcx, [rsp + 0x20]
call fcn.140007830
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x140006f91
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006f8c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006f8c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400099dc
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x1400c23e0]
cmp byte [0x1400c2403], 0
je 0x140006fc6
mov rcx, rbx
nop
lea eax, [rcx - 0x7d]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 0x22
jb 0x140006fb0
mov byte [0x1400c2403], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbx
mov r8d, 0x22
lea rcx, [rsp + 0x20]
call fcn.140004740
nop
mov r8d, 0x7450
lea rdx, [0x1400baf90]
lea rcx, [rsp + 0x20]
call fcn.140007830
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x140007041
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000703c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000703c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400099dc
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.C:WindowsSystem32zhjers.exe__SU_auto
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x2ee
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.C:WindowsSystem32zhjers.exe__SS__To_be_filled_by_O.E.M_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x2ee
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.C:WindowsSystem32zhjers.exe__BS__To_be_filled_by_O.E.M_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x2ee
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.C:WindowsSystem32zhjers.exe__PSN__Unknown_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x2ee
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.C:WindowsSystem32zhjers.exe__CS__To_be_filled_by_O.E.M_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x2ee
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.C:WindowsSystem32zhjers.exe__SK__To_be_filled_by_O.E.M_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x2ee
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.C:WindowsSystem32zhjers.exe__SF__To_be_filled_by_O.E.M._
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x2ee
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.C:WindowsSystem32zhjers.exe__BT__To_be_filled_by_O.E.M._
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x2ee
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.C:WindowsSystem32zhjers.exe__BLC__To_be_filled_by_O.E.M._
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x2ee
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.C:WindowsSystem32zhjers.exe__CA__To_be_filled_by_O.E.M._
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x2ee
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.C:WindowsSystem32zhjers.exe__CSK__To_be_filled_by_O.E.M._
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x2ee
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.C:WindowsSystem32zhjers.exe__IVN__American_Megatrends_International__LLC._
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x2ee
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.C:WindowsSystem32zhjers.exe__ID_06_27_23
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x2ee
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.C:WindowsSystem32zhjers.exe__IV__A.F0_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.1400055d0
mov ecx, 1
call fcn.1400099a0
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
call fcn.140002340
add rsp, 0x40
pop rbx
jmp fcn.140005ec0