Function at 0x140006670
Capabilities:
Encode data using xor
Execute command
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xf0
movaps xmmword [rax - 0x18], xmm6
mov ecx, 1
movaps xmmword [rax - 0x28], xmm7
call fcn.140007214
lea rcx, str.color_E
mov qword [rbp + 0x67], rax
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140006ff0
movdqa xmm7, xmmword [0x140009630]
xor esi, esi
movdqa xmm6, xmmword [0x140009620]
mov edi, 0x133
mov ecx, 0x74
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x1400066d4
mov ecx, 0x46
xor edx, edx
call fcn.140001690
mov ecx, 0x6f
mov word [rbp - 0x55], ax
mov edx, 1
call fcn.140001690
mov ecx, 0x72
mov word [rbp - 0x53], ax
mov edx, 2
call fcn.140001690
mov ecx, 0x74
mov word [rbp - 0x51], ax
mov edx, 3
movzx r11d, ax
call fcn.140001690
mov ecx, 0x6e
mov word [rbp - 0x4f], ax
mov edx, 4
call fcn.140001690
mov ecx, 0x69
mov word [rbp - 0x4d], ax
mov edx, 5
call fcn.140001690
mov ecx, 0x74
mov word [rbp - 0x4b], ax
mov edx, 6
call fcn.140001690
mov ecx, 0x65
mov word [rbp - 0x49], ax
mov edx, 7
call fcn.140001690
mov ecx, 0x43
mov word [rbp - 0x47], ax
mov edx, 8
call fcn.140001690
mov ecx, 0x6c
mov word [rbp - 0x45], ax
mov edx, 9
call fcn.140001690
mov ecx, 0x69
mov word [rbp - 0x43], ax
mov edx, 0xa
call fcn.140001690
mov ecx, 0x65
mov word [rbp - 0x41], ax
mov edx, 0xb
call fcn.140001690
mov ecx, 0x6e
mov word [rbp - 0x3f], ax
mov edx, 0xc
call fcn.140001690
mov ecx, 0x74
mov word [rbp - 0x3d], ax
mov edx, 0xd
call fcn.140001690
mov ecx, 0x2d
mov word [rbp - 0x3b], ax
mov edx, 0xe
call fcn.140001690
mov ecx, 0x57
mov word [rbp - 0x39], ax
mov edx, 0xf
call fcn.140001690
mov ecx, 0x69
mov word [rbp - 0x37], ax
mov edx, 0x10
call fcn.140001690
mov ecx, 0x6e
mov word [rbp - 0x35], ax
mov edx, 0x11
call fcn.140001690
mov ecx, 0x36
mov word [rbp - 0x33], ax
mov edx, 0x12
call fcn.140001690
mov ecx, 0x34
mov word [rbp - 0x31], ax
mov edx, 0x13
call fcn.140001690
mov word [rbp - 0x2f], ax
mov ecx, 0x2d
mov edx, 0x14
call fcn.140001690
mov ecx, 0x53
mov word [rbp - 0x2d], ax
mov edx, 0x15
call fcn.140001690
mov ecx, 0x68
mov word [rbp - 0x2b], ax
mov edx, 0x16
call fcn.140001690
mov ecx, 0x69
mov word [rbp - 0x29], ax
mov edx, 0x17
call fcn.140001690
mov ecx, 0x70
mov word [rbp - 0x27], ax
mov edx, 0x18
call fcn.140001690
mov edx, 0x19
mov word [rbp - 0x25], ax
call fcn.140001690
mov ecx, 0x69
mov word [rbp - 0x23], ax
mov edx, 0x1a
call fcn.140001690
mov ecx, 0x6e
mov word [rbp - 0x21], ax
mov edx, 0x1b
call fcn.140001690
mov ecx, 0x67
mov word [rbp - 0x1f], ax
mov edx, 0x1c
call fcn.140001690
mov ecx, 0x2e
mov word [rbp - 0x1d], ax
mov edx, 0x1d
call fcn.140001690
mov ecx, 0x65
mov word [rbp - 0x1b], ax
mov edx, 0x1e
call fcn.140001690
mov ecx, 0x78
mov word [rbp - 0x19], ax
mov edx, 0x1f
call fcn.140001690
mov ecx, 0x65
mov word [rbp - 0x17], ax
mov edx, 0x20
call fcn.140001690
xor ecx, ecx
mov word [rbp - 0x15], ax
mov edx, 0x21
call fcn.140001690
movzx ecx, word [0x140009604]
mov edx, 0x22
mov word [rbp - 0x13], ax
call fcn.140001690
movzx ecx, word [0x140009606]
mov edx, 0x23
mov word [rbp - 0x11], ax
call fcn.140001690
movzx ecx, word [str.aura.dll]
mov edx, 0x24
mov word [rbp - 0xf], ax
call fcn.140001690
movzx ecx, word [0x14000960a]
mov edx, 0x25
mov word [rbp - 0xd], ax
call fcn.140001690
movzx ecx, word [0x14000960c]
mov edx, 0x26
mov word [rbp - 0xb], ax
call fcn.140001690
movzx ecx, word [0x14000960e]
mov edx, 0x27
mov word [rbp - 9], ax
call fcn.140001690
movzx ecx, word [0x140009610]
mov edx, 0x28
mov word [rbp - 7], ax
call fcn.140001690
movzx ecx, word [0x140009612]
mov edx, 0x29
mov word [rbp - 5], ax
call fcn.140001690
movzx ecx, word [0x140009614]
mov edx, 0x2a
mov word [rbp - 3], ax
call fcn.140001690
movzx ecx, word [0x140009616]
mov edx, 0x2b
mov word [rbp - 1], ax
call fcn.140001690
movzx ecx, word [0x140009618]
mov edx, 0x2c
mov word [rbp + 1], ax
call fcn.140001690
movzx ecx, word [0x14000961a]
mov edx, 0x2d
mov word [rbp + 3], ax
call fcn.140001690
movzx ecx, word [0x14000961c]
mov edx, 0x2e
mov word [rbp + 5], ax
call fcn.140001690
movzx ecx, word [0x14000961e]
mov edx, 0x2f
mov word [rbp + 7], ax
call fcn.140001690
movzx ecx, word [0x140009620]
mov edx, 0x30
mov word [rbp + 9], ax
call fcn.140001690
movzx ecx, word [0x140009622]
mov edx, 0x31
mov word [rbp + 0xb], ax
call fcn.140001690
movzx ecx, word [0x140009624]
mov edx, 0x32
mov word [rbp + 0xd], ax
call fcn.140001690
movzx ecx, word [0x140009626]
mov edx, 0x33
mov word [rbp + 0xf], ax
call fcn.140001690
movzx ecx, word [0x140009628]
mov edx, 0x34
mov word [rbp + 0x11], ax
call fcn.140001690
movzx ecx, word [0x14000962a]
mov edx, 0x35
mov word [rbp + 0x13], ax
call fcn.140001690
movzx ecx, word [0x14000962c]
mov edx, 0x36
mov word [rbp + 0x15], ax
call fcn.140001690
movzx ecx, word [0x14000962e]
mov edx, 0x37
mov word [rbp + 0x17], ax
call fcn.140001690
movzx ecx, word [0x140009630]
mov edx, 0x38
mov word [rbp + 0x19], ax
call fcn.140001690
movzx ecx, word [0x140009632]
mov edx, 0x39
mov word [rbp + 0x1b], ax
call fcn.140001690
movzx ecx, word [0x140009634]
mov edx, 0x3a
mov word [rbp + 0x1d], ax
call fcn.140001690
movzx ecx, word [0x140009636]
mov edx, 0x3b
mov word [rbp + 0x1f], ax
call fcn.140001690
movzx ecx, word [0x140009638]
mov edx, 0x3c
mov word [rbp + 0x21], ax
call fcn.140001690
movzx ecx, word [0x14000963a]
mov edx, 0x3d
mov word [rbp + 0x23], ax
call fcn.140001690
movzx ecx, word [0x14000963c]
mov edx, 0x3e
mov word [rbp + 0x25], ax
call fcn.140001690
movzx ecx, word [0x14000963e]
mov edx, 0x3f
mov word [rbp + 0x27], ax
call fcn.140001690
movzx ecx, word [0x140009640]
mov edx, 0x40
mov word [rbp + 0x29], ax
call fcn.140001690
movzx ecx, word [0x140009642]
mov edx, 0x41
mov word [rbp + 0x2b], ax
call fcn.140001690
movzx ecx, word [0x140009644]
mov edx, 0x42
mov word [rbp + 0x2d], ax
call fcn.140001690
mov word [rbp + 0x2f], ax
mov ecx, esi
xor eax, eax
mov rdx, rsi
mov word [rbp + 0x31], ax
mov r8d, 8
mov r9d, 4
mov r10d, 0xc
nop word [rax + rax]
movsxd rax, r8d
movq xmm2, xmm7
movd xmm0, ecx
add ecx, 0x10
pshufd xmm0, xmm0, 0
paddd xmm0, xmm6
pshufhw xmm0, xmm0, 0xd8
pshuflw xmm1, xmm0, 0xd8
movq xmm0, qword [rbp + rdx*2 - 0x55]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
movq xmm2, xmm7
xorps xmm3, xmm0
movd xmm0, r9d
movq qword [rbp + rdx*2 - 0x55], xmm3
add r9d, 0x10
pshufd xmm0, xmm0, 0
paddd xmm0, xmm6
movsxd rdx, ecx
pshufhw xmm0, xmm0, 0xd8
pshuflw xmm1, xmm0, 0xd8
movq xmm0, qword [rbp + rax*2 - 0x5d]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
movq xmm2, xmm7
xorps xmm3, xmm0
movd xmm0, r8d
movq qword [rbp + rax*2 - 0x5d], xmm3
pshufd xmm0, xmm0, 0
paddd xmm0, xmm6
movsxd rax, r8d
pshufhw xmm0, xmm0, 0xd8
pshuflw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm0, qword [rbp + rax*2 - 0x55]
paddw xmm3, xmm2
xorps xmm3, xmm0
movq xmm2, xmm7
movq qword [rbp + rax*2 - 0x55], xmm3
movsxd rax, r8d
add r8d, 0x10
movd xmm0, r10d
add r10d, 0x10
pshufd xmm0, xmm0, 0
paddd xmm0, xmm6
pshufhw xmm0, xmm0, 0xd8
pshuflw xmm1, xmm0, 0xd8
movq xmm0, qword [rbp + rax*2 - 0x4d]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
xorps xmm3, xmm0
movq qword [rbp + rax*2 - 0x4d], xmm3
cmp rdx, 0x40
jb 0x140006c40
cmp rdx, 0x43
jae 0x140006d53
nop word [rax + rax]
lea eax, [rdi + rcx]
inc ecx
xor word [rbp + rdx*2 - 0x55], ax
movsxd rdx, ecx
cmp rdx, 0x43
jb 0x140006d40
mov ecx, 0x61
mov word [rbp + 0x31], si
xor edx, edx
call fcn.140001690
mov ecx, 0x75
mov word [rbp - 0x79], ax
mov edx, 1
call fcn.140001690
mov ecx, 0x61
mov word [rbp - 0x77], ax
mov edx, 3
mov word [rbp - 0x75], r11w
call fcn.140001690
mov ecx, 0x2e
mov word [rbp - 0x73], ax
mov edx, 4
call fcn.140001690
mov ecx, 0x64
mov word [rbp - 0x71], ax
mov edx, 5
call fcn.140001690
mov ecx, 0x6c
mov word [rbp - 0x6f], ax
mov edx, 6
call fcn.140001690
mov edx, 7
mov word [rbp - 0x6d], ax
call fcn.140001690
xor ecx, ecx
mov word [rbp - 0x6b], ax
mov edx, 8
call fcn.140001690
movzx ecx, word [0x14000961a]
mov edx, 9
mov word [rbp - 0x69], ax
call fcn.140001690
movzx ecx, word [0x14000961c]
mov edx, 0xa
mov word [rbp - 0x67], ax
call fcn.140001690
movzx ecx, word [0x14000961e]
mov edx, 0xb
mov word [rbp - 0x65], ax
call fcn.140001690
movzx ecx, word [0x140009620]
mov edx, 0xc
mov word [rbp - 0x63], ax
call fcn.140001690
movzx ecx, word [0x140009622]
mov edx, 0xd
mov word [rbp - 0x61], ax
call fcn.140001690
movzx ecx, word [0x140009624]
mov edx, 0xe
mov word [rbp - 0x5f], ax
call fcn.140001690
movzx ecx, word [0x140009626]
mov edx, 0xf
mov word [rbp - 0x5d], ax
call fcn.140001690
movzx ecx, word [0x140009628]
mov edx, 0x10
mov word [rbp - 0x5b], ax
call fcn.140001690
mov word [rbp - 0x59], ax
mov rdx, rsi
xor eax, eax
mov r8d, 8
mov word [rbp - 0x57], ax
mov r9d, 4
mov r10d, 0xc
nop dword [rax]
movsxd rcx, r8d
movq xmm2, xmm7
movd xmm0, eax
add eax, 0x10
pshufd xmm0, xmm0, 0
paddd xmm0, xmm6
pshufhw xmm0, xmm0, 0xd8
pshuflw xmm1, xmm0, 0xd8
movq xmm0, qword [rbp + rdx*2 - 0x79]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
movq xmm2, xmm7
xorps xmm3, xmm0
movd xmm0, r9d
movq qword [rbp + rdx*2 - 0x79], xmm3
add r9d, 0x10
pshufd xmm0, xmm0, 0
paddd xmm0, xmm6
movsxd rdx, eax
pshufhw xmm0, xmm0, 0xd8
pshuflw xmm1, xmm0, 0xd8
movq xmm0, qword [rsp + rcx*2 + 0x18]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
movq xmm2, xmm7
xorps xmm3, xmm0
movd xmm0, r8d
movq qword [rsp + rcx*2 + 0x18], xmm3
pshufd xmm0, xmm0, 0
paddd xmm0, xmm6
movsxd rcx, r8d
pshufhw xmm0, xmm0, 0xd8
pshuflw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm0, qword [rbp + rcx*2 - 0x79]
paddw xmm3, xmm2
xorps xmm3, xmm0
movq xmm2, xmm7
movq qword [rbp + rcx*2 - 0x79], xmm3
movsxd rcx, r8d
add r8d, 0x10
movd xmm0, r10d
add r10d, 0x10
pshufd xmm0, xmm0, 0
paddd xmm0, xmm6
pshufhw xmm0, xmm0, 0xd8
pshuflw xmm1, xmm0, 0xd8
movq xmm0, qword [rbp + rcx*2 - 0x71]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
xorps xmm3, xmm0
movq qword [rbp + rcx*2 - 0x71], xmm3
cmp rdx, 0x10
jb 0x140006eb0
cmp rdx, 0x11
jae 0x140006fc3
nop word [rax + rax]
lea ecx, [rdi + rax]
inc eax
xor word [rbp + rdx*2 - 0x79], cx
movsxd rdx, eax
cmp rdx, 0x11
jb 0x140006fb0
lea r8, [rbp - 0x55]
mov word [rbp - 0x57], si
lea rdx, [rbp - 0x79]
mov rcx, rbx
call fcn.140002620
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400066d4