Function at 0x14000b6f0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Execute command
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x90
call fcn.14000c190
mov dword [rbp + 0x67], 0x2b3b35
mov byte [rbp + 0x6b], 1
xor ebx, ebx
mov ecx, ebx
nop dword [rax + rax]
lea eax, [rcx + 0x56]
xor byte [rbp + rcx + 0x67], al
inc rcx
cmp rcx, 3
jb 0x14000b730
mov byte [rbp + 0x6b], bl
lea rcx, [rbp + 0x67]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
cmp byte [0x140095b28], bl
jne 0x14000b765
mov edx, 0x190
mov ecx, 0x370
call qword [sym.imp.USER32.dll_SetCursorPos]
mov edx, 4
mov rcx, qword [0x1400958a0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov r15, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movdqa xmm0, xmmword [str._RSz_ap]
movdqu xmmword [rbp - 0x39], xmm0
mov dword [rbp - 0x29], 0x120e0a
mov dword [rbp - 0x25], 0x43420c04
mov dword [rbp - 0x21], 0x1004f40
mov rcx, rbx
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x56]
xor byte [rbp + rcx - 0x39], al
inc rcx
cmp rcx, 0x1a
jb 0x14000b7b0
mov byte [rbp - 0x1e], bl
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 9], xmm1
lea rax, [rbp - 0x39]
mov rdi, 0xffffffffffffffff
mov r8, rdi
inc r8
cmp byte [rax + r8], bl
jne 0x14000b7e0
lea rdx, [rbp - 0x39]
lea rcx, [rbp - 0x19]
call fcn.140002fa0
mov dword [rbp + 7], reloc.WLDAP32.dll_Ordinal_50
lea rsi, [rbp - 0x19]
mov r14, qword [rbp - 0x19]
mov r13, qword [rbp - 1]
cmp r13, 0xf
cmova rsi, r14
lea rcx, [rbp - 0x19]
cmova rcx, r14
mov r12, qword [rbp - 9]
add r12, rcx
cmp rsi, r12
je 0x14000b85c
mov qword [rbp + 0x67], reloc.WLDAP32.dll_Ordinal_50
nop dword [rax]
movzx edx, byte [rsi]
mov rcx, r15
call fcn.1400029a0
lea rdx, [0x140004280]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rbp + 0x67]
call fcn.1400045c0
inc rsi
cmp rsi, r12
jne 0x14000b830
cmp r13, 0xf
jbe 0x14000b893
lea rdx, [r13 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x14000b88b
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b9f7
mov rcx, r14
call fcn.14006d208
call fcn.14000c190
mov dword [rbp + 0x67], 0x2b3b35
mov byte [rbp + 0x6b], 1
mov rcx, rbx
nop word [rax + rax]
lea eax, [rcx + 0x56]
xor byte [rbp + rcx + 0x67], al
inc rcx
cmp rcx, 3
jb 0x14000b8b0
mov byte [rbp + 0x6b], 0
lea rcx, [rbp + 0x67]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x3e8
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Beep]
mov edx, 2
mov rcx, qword [0x1400958a0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov r12, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movdqa xmm0, xmmword [str._RSz_a]
movdqu xmmword [rbp - 0x39], xmm0
mov dword [rbp - 0x29], 0xc120e0a
mov dword [rbp - 0x25], 0x1004b0e
mov rcx, rbx
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x56]
xor byte [rbp + rcx - 0x39], al
inc rcx
cmp rcx, 0x16
jb 0x14000b920
mov byte [rbp - 0x22], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0xf], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x1f], xmm1
lea rax, [rbp - 0x39]
inc rdi
cmp byte [rax + rdi], 0
jne 0x14000b947
mov r8, rdi
lea rdx, [rbp - 0x39]
lea rcx, [rbp + 0xf]
call fcn.140002fa0
mov dword [rbp + 0x2f], reloc.WLDAP32.dll_Ordinal_50
lea rdi, [rbp + 0xf]
mov rsi, qword [rbp + 0xf]
mov r15, qword [rbp + 0x27]
cmp r15, 0xf
cmova rdi, rsi
lea rcx, [rbp + 0xf]
cmova rcx, rsi
mov r14, qword [rbp + 0x1f]
add r14, rcx
cmp rdi, r14
je 0x14000b9cc
mov qword [rbp + 0x67], reloc.WLDAP32.dll_Ordinal_50
nop word [rax + rax]
movzx edx, byte [rdi]
mov rcx, r12
call fcn.1400029a0
lea rdx, [0x140004280]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rbp + 0x67]
call fcn.1400045c0
inc rdi
cmp rdi, r14
jne 0x14000b9a0
cmp r15, 0xf
jbe 0x14000ba06
lea rdx, [r15 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14000b9fe
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b9fe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.14006d208
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.14000aaf0
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rbp + 0x67], 0x2b3b35
mov byte [rbp + 0x6b], 1
nop dword [rax]
lea eax, [rbx + 0x56]
xor byte [rbp + rbx + 0x67], al
inc rbx
cmp rbx, 3
jb 0x14000ba30
mov byte [rbp + 0x6b], 0
lea rcx, [rbp + 0x67]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
jmp fcn.1400080f0