Function at 0x140006170
Capabilities:
Encode data using xor
Execute command
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x80
mov ecx, 1
call fcn.140006754
lea rcx, str.color_E
mov qword [rbp + 0x10], rax
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140006540
xor esi, esi
mov edi, 0x133
nop dword [rax + rax]
mov ecx, 0x74
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x1400061c0
mov ecx, 0x63
xor edx, edx
call fcn.140001670
lea ecx, [rdx + 0x6f]
mov word [rbp - 0x60], ax
lea edx, [rcx - 0x6e]
call fcn.140001670
lea ecx, [rdx + 0x63]
mov word [rbp - 0x5e], ax
lea edx, [rcx - 0x62]
call fcn.140001670
lea ecx, [rdx + 0x2c]
mov word [rbp - 0x5c], ax
lea edx, [rcx - 0x2b]
call fcn.140001670
lea ecx, [rdx + 0x62]
mov word [rbp - 0x5a], ax
lea edx, [rcx - 0x61]
call fcn.140001670
lea ecx, [rdx + 0x74]
mov word [rbp - 0x58], ax
lea edx, [rcx - 0x73]
call fcn.140001670
lea ecx, [rdx + 0x60]
mov word [rbp - 0x56], ax
lea edx, [rcx - 0x5f]
call fcn.140001670
xor ecx, ecx
mov word [rbp - 0x54], ax
lea edx, [rcx + 7]
call fcn.140001670
lea edx, [rcx + 8]
mov word [rbp - 0x52], ax
movzx ecx, word [str.payson1337.dll]
call fcn.140001670
movzx ecx, word [0x140008622]
mov edx, 9
mov word [rbp - 0x50], ax
call fcn.140001670
movzx ecx, word [0x140008624]
mov edx, 0xa
mov word [rbp - 0x4e], ax
call fcn.140001670
movzx ecx, word [0x140008626]
mov edx, 0xb
mov word [rbp - 0x4c], ax
call fcn.140001670
movzx ecx, word [0x140008628]
mov edx, 0xc
mov word [rbp - 0x4a], ax
call fcn.140001670
movzx ecx, word [0x14000862a]
mov edx, 0xd
mov word [rbp - 0x48], ax
call fcn.140001670
movzx ecx, word [0x14000862c]
mov edx, 0xe
mov word [rbp - 0x46], ax
call fcn.140001670
mov word [rbp - 0x44], ax
mov rdx, rsi
xor eax, eax
mov word [rbp - 0x42], ax
lea ecx, [rdi + rax]
inc eax
xor word [rbp + rdx*2 - 0x60], cx
movsxd rdx, eax
cmp rdx, 0xf
jb 0x1400062e2
mov ecx, 0x70
mov word [rbp - 0x42], si
xor edx, edx
call fcn.140001670
lea ecx, [rdx + 0x61]
mov word [rbp - 0x40], ax
lea edx, [rcx - 0x60]
call fcn.140001670
lea ecx, [rdx + 0x78]
mov word [rbp - 0x3e], ax
lea edx, [rcx - 0x77]
call fcn.140001670
lea ecx, [rdx + 0x71]
mov word [rbp - 0x3c], ax
lea edx, [rcx - 0x70]
call fcn.140001670
lea ecx, [rdx + 0x6c]
mov word [rbp - 0x3a], ax
lea edx, [rcx - 0x6b]
call fcn.140001670
lea ecx, [rdx + 0x6a]
mov word [rbp - 0x38], ax
lea edx, [rcx - 0x69]
call fcn.140001670
lea ecx, [rdx + 0x2c]
mov word [rbp - 0x36], ax
lea edx, [rcx - 0x2b]
call fcn.140001670
lea ecx, [rdx + 0x2d]
mov word [rbp - 0x34], ax
lea edx, [rcx - 0x2c]
call fcn.140001670
lea edx, [rcx - 0x2b]
mov word [rbp - 0x32], ax
call fcn.140001670
lea ecx, [rdx + 0x2f]
mov word [rbp - 0x30], ax
lea edx, [rcx - 0x2e]
call fcn.140001670
lea ecx, [rdx + 0x25]
mov word [rbp - 0x2e], ax
lea edx, [rcx - 0x24]
call fcn.140001670
lea ecx, [rdx + 0x5a]
mov word [rbp - 0x2c], ax
lea edx, [rcx - 0x59]
call fcn.140001670
lea ecx, [rdx + 0x61]
mov word [rbp - 0x2a], ax
lea edx, [rcx - 0x60]
call fcn.140001670
lea edx, [rcx - 0x5f]
mov word [rbp - 0x28], ax
call fcn.140001670
xor ecx, ecx
mov word [rbp - 0x26], ax
lea edx, [rcx + 0xe]
call fcn.140001670
lea edx, [rcx + 0xf]
mov word [rbp - 0x24], ax
movzx ecx, word [0x14000863e]
call fcn.140001670
movzx ecx, word [0x140008640]
mov edx, 0x10
mov word [rbp - 0x22], ax
call fcn.140001670
movzx ecx, word [0x140008642]
mov edx, 0x11
mov word [rbp - 0x20], ax
call fcn.140001670
movzx ecx, word [0x140008644]
mov edx, 0x12
mov word [rbp - 0x1e], ax
call fcn.140001670
movzx ecx, word [0x140008646]
mov edx, 0x13
mov word [rbp - 0x1c], ax
call fcn.140001670
movzx ecx, word [0x140008648]
mov edx, 0x14
mov word [rbp - 0x1a], ax
call fcn.140001670
movzx ecx, word [0x14000864a]
mov edx, 0x15
mov word [rbp - 0x18], ax
call fcn.140001670
movzx ecx, word [0x14000864c]
mov edx, 0x16
mov word [rbp - 0x16], ax
call fcn.140001670
movzx ecx, word [0x14000864e]
mov edx, 0x17
mov word [rbp - 0x14], ax
call fcn.140001670
movzx ecx, word [0x140008650]
mov edx, 0x18
mov word [rbp - 0x12], ax
call fcn.140001670
movzx ecx, word [0x140008652]
mov edx, 0x19
mov word [rbp - 0x10], ax
call fcn.140001670
movzx ecx, word [0x140008654]
mov edx, 0x1a
mov word [rbp - 0xe], ax
call fcn.140001670
movzx ecx, word [0x140008656]
mov edx, 0x1b
mov word [rbp - 0xc], ax
call fcn.140001670
movzx ecx, word [0x140008658]
mov edx, 0x1c
mov word [rbp - 0xa], ax
call fcn.140001670
mov word [rbp - 8], ax
mov ecx, esi
xor eax, eax
mov rdx, rsi
mov word [rbp - 6], ax
lea eax, [rdi + rcx]
inc ecx
xor word [rbp + rdx*2 - 0x40], ax
movsxd rdx, ecx
cmp rdx, 0x1d
jb 0x140006503
lea r8, [rbp - 0x60]
mov word [rbp - 6], si
lea rdx, [rbp - 0x40]
mov rcx, rbx
call fcn.140002560
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400061c0