|
|
@@ -1,930 +0,0 @@
|
|
|
-Microsoft (R) COFF/PE Dumper Version 14.29.30148.0
|
|
|
-Copyright (C) Microsoft Corporation. All rights reserved.
|
|
|
-
|
|
|
-
|
|
|
-Dump of file findsysmon.o
|
|
|
-
|
|
|
-File Type: COFF OBJECT
|
|
|
-
|
|
|
-BeaconPrintToStreamW:
|
|
|
- 0000000000000000: 48 89 4C 24 08 mov qword ptr [rsp+8],rcx
|
|
|
- 0000000000000005: 48 89 54 24 10 mov qword ptr [rsp+10h],rdx
|
|
|
- 000000000000000A: 4C 89 44 24 18 mov qword ptr [rsp+18h],r8
|
|
|
- 000000000000000F: 4C 89 4C 24 20 mov qword ptr [rsp+20h],r9
|
|
|
- 0000000000000014: 48 83 EC 58 sub rsp,58h
|
|
|
- 0000000000000018: C7 44 24 30 01 00 mov dword ptr [rsp+30h],1
|
|
|
- 00 00
|
|
|
- 0000000000000020: C7 44 24 34 00 00 mov dword ptr [rsp+34h],0
|
|
|
- 00 00
|
|
|
- 0000000000000028: 48 83 3D 00 00 00 cmp qword ptr [g_lpStream],1
|
|
|
- 00 01
|
|
|
- 0000000000000030: 77 28 ja 000000000000005A
|
|
|
- 0000000000000032: 4C 8D 05 00 00 00 lea r8,[g_lpStream]
|
|
|
- 00
|
|
|
- 0000000000000039: BA 01 00 00 00 mov edx,1
|
|
|
- 000000000000003E: 33 C9 xor ecx,ecx
|
|
|
- 0000000000000040: FF 15 00 00 00 00 call qword ptr [__imp_OLE32$CreateStreamOnHGlobal]
|
|
|
- 0000000000000046: 89 44 24 30 mov dword ptr [rsp+30h],eax
|
|
|
- 000000000000004A: 83 7C 24 30 00 cmp dword ptr [rsp+30h],0
|
|
|
- 000000000000004F: 7D 09 jge 000000000000005A
|
|
|
- 0000000000000051: 8B 44 24 30 mov eax,dword ptr [rsp+30h]
|
|
|
- 0000000000000055: E9 01 01 00 00 jmp 000000000000015B
|
|
|
- 000000000000005A: 48 83 3D 00 00 00 cmp qword ptr [g_lpwPrintBuffer],1
|
|
|
- 00 01
|
|
|
- 0000000000000062: 77 2E ja 0000000000000092
|
|
|
- 0000000000000064: BA 02 00 00 00 mov edx,2
|
|
|
- 0000000000000069: B9 00 20 00 00 mov ecx,2000h
|
|
|
- 000000000000006E: FF 15 00 00 00 00 call qword ptr [__imp_MSVCRT$calloc]
|
|
|
- 0000000000000074: 48 89 05 00 00 00 mov qword ptr [g_lpwPrintBuffer],rax
|
|
|
- 00
|
|
|
- 000000000000007B: 48 83 3D 00 00 00 cmp qword ptr [g_lpwPrintBuffer],0
|
|
|
- 00 00
|
|
|
- 0000000000000083: 75 0D jne 0000000000000092
|
|
|
- 0000000000000085: C7 44 24 30 05 40 mov dword ptr [rsp+30h],80004005h
|
|
|
- 00 80
|
|
|
- 000000000000008D: E9 9D 00 00 00 jmp 000000000000012F
|
|
|
- 0000000000000092: 48 8D 44 24 68 lea rax,[rsp+68h]
|
|
|
- 0000000000000097: 48 89 44 24 38 mov qword ptr [rsp+38h],rax
|
|
|
- 000000000000009C: 48 8B 44 24 38 mov rax,qword ptr [rsp+38h]
|
|
|
- 00000000000000A1: 48 89 44 24 20 mov qword ptr [rsp+20h],rax
|
|
|
- 00000000000000A6: 4C 8B 4C 24 60 mov r9,qword ptr [rsp+60h]
|
|
|
- 00000000000000AB: 41 B8 FF 1F 00 00 mov r8d,1FFFh
|
|
|
- 00000000000000B1: BA 00 20 00 00 mov edx,2000h
|
|
|
- 00000000000000B6: 48 8B 0D 00 00 00 mov rcx,qword ptr [g_lpwPrintBuffer]
|
|
|
- 00
|
|
|
- 00000000000000BD: FF 15 00 00 00 00 call qword ptr [__imp_MSVCRT$_vsnwprintf_s]
|
|
|
- 00000000000000C3: 85 C0 test eax,eax
|
|
|
- 00000000000000C5: 75 0A jne 00000000000000D1
|
|
|
- 00000000000000C7: C7 44 24 30 05 40 mov dword ptr [rsp+30h],80004005h
|
|
|
- 00 80
|
|
|
- 00000000000000CF: EB 5E jmp 000000000000012F
|
|
|
- 00000000000000D1: 48 83 3D 00 00 00 cmp qword ptr [g_lpStream],0
|
|
|
- 00 00
|
|
|
- 00000000000000D9: 74 4C je 0000000000000127
|
|
|
- 00000000000000DB: 48 8B 0D 00 00 00 mov rcx,qword ptr [g_lpwPrintBuffer]
|
|
|
- 00
|
|
|
- 00000000000000E2: FF 15 00 00 00 00 call qword ptr [__imp_MSVCRT$wcslen]
|
|
|
- 00000000000000E8: 8B C0 mov eax,eax
|
|
|
- 00000000000000EA: 48 D1 E0 shl rax,1
|
|
|
- 00000000000000ED: 48 8B 0D 00 00 00 mov rcx,qword ptr [g_lpStream]
|
|
|
- 00
|
|
|
- 00000000000000F4: 48 8B 09 mov rcx,qword ptr [rcx]
|
|
|
- 00000000000000F7: 48 89 4C 24 40 mov qword ptr [rsp+40h],rcx
|
|
|
- 00000000000000FC: 4C 8D 4C 24 34 lea r9,[rsp+34h]
|
|
|
- 0000000000000101: 44 8B C0 mov r8d,eax
|
|
|
- 0000000000000104: 48 8B 15 00 00 00 mov rdx,qword ptr [g_lpwPrintBuffer]
|
|
|
- 00
|
|
|
- 000000000000010B: 48 8B 0D 00 00 00 mov rcx,qword ptr [g_lpStream]
|
|
|
- 00
|
|
|
- 0000000000000112: 48 8B 44 24 40 mov rax,qword ptr [rsp+40h]
|
|
|
- 0000000000000117: FF 50 20 call qword ptr [rax+20h]
|
|
|
- 000000000000011A: 89 44 24 30 mov dword ptr [rsp+30h],eax
|
|
|
- 000000000000011E: 83 7C 24 30 00 cmp dword ptr [rsp+30h],0
|
|
|
- 0000000000000123: 7D 02 jge 0000000000000127
|
|
|
- 0000000000000125: EB 08 jmp 000000000000012F
|
|
|
- 0000000000000127: C7 44 24 30 00 00 mov dword ptr [rsp+30h],0
|
|
|
- 00 00
|
|
|
- 000000000000012F: 48 83 3D 00 00 00 cmp qword ptr [g_lpwPrintBuffer],0
|
|
|
- 00 00
|
|
|
- 0000000000000137: 74 15 je 000000000000014E
|
|
|
- 0000000000000139: 41 B8 00 40 00 00 mov r8d,4000h
|
|
|
- 000000000000013F: 33 D2 xor edx,edx
|
|
|
- 0000000000000141: 48 8B 0D 00 00 00 mov rcx,qword ptr [g_lpwPrintBuffer]
|
|
|
- 00
|
|
|
- 0000000000000148: FF 15 00 00 00 00 call qword ptr [__imp_MSVCRT$memset]
|
|
|
- 000000000000014E: 48 C7 44 24 38 00 mov qword ptr [rsp+38h],0
|
|
|
- 00 00 00
|
|
|
- 0000000000000157: 8B 44 24 30 mov eax,dword ptr [rsp+30h]
|
|
|
- 000000000000015B: 48 83 C4 58 add rsp,58h
|
|
|
- 000000000000015F: C3 ret
|
|
|
- 0000000000000160: CC int 3
|
|
|
- 0000000000000161: CC int 3
|
|
|
- 0000000000000162: CC int 3
|
|
|
- 0000000000000163: CC int 3
|
|
|
- 0000000000000164: CC int 3
|
|
|
- 0000000000000165: CC int 3
|
|
|
- 0000000000000166: CC int 3
|
|
|
- 0000000000000167: CC int 3
|
|
|
- 0000000000000168: CC int 3
|
|
|
- 0000000000000169: CC int 3
|
|
|
- 000000000000016A: CC int 3
|
|
|
- 000000000000016B: CC int 3
|
|
|
- 000000000000016C: CC int 3
|
|
|
- 000000000000016D: CC int 3
|
|
|
- 000000000000016E: CC int 3
|
|
|
- 000000000000016F: CC int 3
|
|
|
-BeaconOutputStreamW:
|
|
|
- 0000000000000170: 40 57 push rdi
|
|
|
- 0000000000000172: 48 81 EC A0 00 00 sub rsp,0A0h
|
|
|
- 00
|
|
|
- 0000000000000179: 48 8D 44 24 50 lea rax,[rsp+50h]
|
|
|
- 000000000000017E: 48 8B F8 mov rdi,rax
|
|
|
- 0000000000000181: 33 C0 xor eax,eax
|
|
|
- 0000000000000183: B9 50 00 00 00 mov ecx,50h
|
|
|
- 0000000000000188: F3 AA rep stos byte ptr [rdi]
|
|
|
- 000000000000018A: 48 C7 44 24 30 00 mov qword ptr [rsp+30h],0
|
|
|
- 00 00 00
|
|
|
- 0000000000000193: C7 44 24 28 00 00 mov dword ptr [rsp+28h],0
|
|
|
- 00 00
|
|
|
- 000000000000019B: 48 C7 44 24 20 00 mov qword ptr [rsp+20h],0
|
|
|
- 00 00 00
|
|
|
- 00000000000001A4: 48 8B 05 00 00 00 mov rax,qword ptr [g_lpStream]
|
|
|
- 00
|
|
|
- 00000000000001AB: 48 8B 00 mov rax,qword ptr [rax]
|
|
|
- 00000000000001AE: 41 B8 01 00 00 00 mov r8d,1
|
|
|
- 00000000000001B4: 48 8D 54 24 50 lea rdx,[rsp+50h]
|
|
|
- 00000000000001B9: 48 8B 0D 00 00 00 mov rcx,qword ptr [g_lpStream]
|
|
|
- 00
|
|
|
- 00000000000001C0: FF 50 60 call qword ptr [rax+60h]
|
|
|
- 00000000000001C3: 85 C0 test eax,eax
|
|
|
- 00000000000001C5: 7D 05 jge 00000000000001CC
|
|
|
- 00000000000001C7: E9 13 01 00 00 jmp 00000000000002DF
|
|
|
- 00000000000001CC: 8B 44 24 60 mov eax,dword ptr [rsp+60h]
|
|
|
- 00000000000001D0: 48 89 44 24 30 mov qword ptr [rsp+30h],rax
|
|
|
- 00000000000001D5: 48 8B 44 24 30 mov rax,qword ptr [rsp+30h]
|
|
|
- 00000000000001DA: 48 FF C0 inc rax
|
|
|
- 00000000000001DD: 48 89 44 24 38 mov qword ptr [rsp+38h],rax
|
|
|
- 00000000000001E2: FF 15 00 00 00 00 call qword ptr [__imp_KERNEL32$GetProcessHeap]
|
|
|
- 00000000000001E8: 48 8B 4C 24 38 mov rcx,qword ptr [rsp+38h]
|
|
|
- 00000000000001ED: 4C 8B C1 mov r8,rcx
|
|
|
- 00000000000001F0: BA 08 00 00 00 mov edx,8
|
|
|
- 00000000000001F5: 48 8B C8 mov rcx,rax
|
|
|
- 00000000000001F8: FF 15 00 00 00 00 call qword ptr [__imp_KERNEL32$HeapAlloc]
|
|
|
- 00000000000001FE: 48 89 44 24 20 mov qword ptr [rsp+20h],rax
|
|
|
- 0000000000000203: 48 83 7C 24 20 00 cmp qword ptr [rsp+20h],0
|
|
|
- 0000000000000209: 74 6B je 0000000000000276
|
|
|
- 000000000000020B: 48 C7 44 24 40 00 mov qword ptr [rsp+40h],0
|
|
|
- 00 00 00
|
|
|
- 0000000000000214: 48 8B 05 00 00 00 mov rax,qword ptr [g_lpStream]
|
|
|
- 00
|
|
|
- 000000000000021B: 48 8B 00 mov rax,qword ptr [rax]
|
|
|
- 000000000000021E: 45 33 C9 xor r9d,r9d
|
|
|
- 0000000000000221: 45 33 C0 xor r8d,r8d
|
|
|
- 0000000000000224: 48 8B 54 24 40 mov rdx,qword ptr [rsp+40h]
|
|
|
- 0000000000000229: 48 8B 0D 00 00 00 mov rcx,qword ptr [g_lpStream]
|
|
|
- 00
|
|
|
- 0000000000000230: FF 50 28 call qword ptr [rax+28h]
|
|
|
- 0000000000000233: 85 C0 test eax,eax
|
|
|
- 0000000000000235: 7D 02 jge 0000000000000239
|
|
|
- 0000000000000237: EB 3D jmp 0000000000000276
|
|
|
- 0000000000000239: 48 8B 05 00 00 00 mov rax,qword ptr [g_lpStream]
|
|
|
- 00
|
|
|
- 0000000000000240: 48 8B 00 mov rax,qword ptr [rax]
|
|
|
- 0000000000000243: 4C 8D 4C 24 28 lea r9,[rsp+28h]
|
|
|
- 0000000000000248: 44 8B 44 24 30 mov r8d,dword ptr [rsp+30h]
|
|
|
- 000000000000024D: 48 8B 54 24 20 mov rdx,qword ptr [rsp+20h]
|
|
|
- 0000000000000252: 48 8B 0D 00 00 00 mov rcx,qword ptr [g_lpStream]
|
|
|
- 00
|
|
|
- 0000000000000259: FF 50 18 call qword ptr [rax+18h]
|
|
|
- 000000000000025C: 85 C0 test eax,eax
|
|
|
- 000000000000025E: 7D 02 jge 0000000000000262
|
|
|
- 0000000000000260: EB 14 jmp 0000000000000276
|
|
|
- 0000000000000262: 4C 8B 44 24 20 mov r8,qword ptr [rsp+20h]
|
|
|
- 0000000000000267: 48 8D 15 00 00 00 lea rdx,[$SG105135]
|
|
|
- 00
|
|
|
- 000000000000026E: 33 C9 xor ecx,ecx
|
|
|
- 0000000000000270: FF 15 00 00 00 00 call qword ptr [__imp_BeaconPrintf]
|
|
|
- 0000000000000276: 48 83 3D 00 00 00 cmp qword ptr [g_lpStream],0
|
|
|
- 00 00
|
|
|
- 000000000000027E: 74 1F je 000000000000029F
|
|
|
- 0000000000000280: 48 8B 05 00 00 00 mov rax,qword ptr [g_lpStream]
|
|
|
- 00
|
|
|
- 0000000000000287: 48 8B 00 mov rax,qword ptr [rax]
|
|
|
- 000000000000028A: 48 8B 0D 00 00 00 mov rcx,qword ptr [g_lpStream]
|
|
|
- 00
|
|
|
- 0000000000000291: FF 50 10 call qword ptr [rax+10h]
|
|
|
- 0000000000000294: 48 C7 05 00 00 00 mov qword ptr [g_lpStream],0
|
|
|
- 00 00 00 00 00
|
|
|
- 000000000000029F: 48 83 3D 00 00 00 cmp qword ptr [g_lpwPrintBuffer],0
|
|
|
- 00 00
|
|
|
- 00000000000002A7: 74 18 je 00000000000002C1
|
|
|
- 00000000000002A9: 48 8B 0D 00 00 00 mov rcx,qword ptr [g_lpwPrintBuffer]
|
|
|
- 00
|
|
|
- 00000000000002B0: FF 15 00 00 00 00 call qword ptr [__imp_MSVCRT$free]
|
|
|
- 00000000000002B6: 48 C7 05 00 00 00 mov qword ptr [g_lpwPrintBuffer],0
|
|
|
- 00 00 00 00 00
|
|
|
- 00000000000002C1: 48 83 7C 24 20 00 cmp qword ptr [rsp+20h],0
|
|
|
- 00000000000002C7: 74 16 je 00000000000002DF
|
|
|
- 00000000000002C9: FF 15 00 00 00 00 call qword ptr [__imp_KERNEL32$GetProcessHeap]
|
|
|
- 00000000000002CF: 4C 8B 44 24 20 mov r8,qword ptr [rsp+20h]
|
|
|
- 00000000000002D4: 33 D2 xor edx,edx
|
|
|
- 00000000000002D6: 48 8B C8 mov rcx,rax
|
|
|
- 00000000000002D9: FF 15 00 00 00 00 call qword ptr [__imp_KERNEL32$HeapFree]
|
|
|
- 00000000000002DF: 48 81 C4 A0 00 00 add rsp,0A0h
|
|
|
- 00
|
|
|
- 00000000000002E6: 5F pop rdi
|
|
|
- 00000000000002E7: C3 ret
|
|
|
- 00000000000002E8: CC int 3
|
|
|
- 00000000000002E9: CC int 3
|
|
|
- 00000000000002EA: CC int 3
|
|
|
- 00000000000002EB: CC int 3
|
|
|
- 00000000000002EC: CC int 3
|
|
|
- 00000000000002ED: CC int 3
|
|
|
- 00000000000002EE: CC int 3
|
|
|
- 00000000000002EF: CC int 3
|
|
|
-PrintSysmonPID:
|
|
|
- 00000000000002F0: 48 89 4C 24 08 mov qword ptr [rsp+8],rcx
|
|
|
- 00000000000002F5: 48 81 EC E8 00 00 sub rsp,0E8h
|
|
|
- 00
|
|
|
- 00000000000002FC: C7 44 24 30 00 00 mov dword ptr [rsp+30h],0
|
|
|
- 00 00
|
|
|
- 0000000000000304: 48 C7 44 24 40 00 mov qword ptr [rsp+40h],0
|
|
|
- 00 00 00
|
|
|
- 000000000000030D: C7 44 24 70 13 75 mov dword ptr [rsp+70h],3837513h
|
|
|
- 83 03
|
|
|
- 0000000000000315: B8 8B 09 00 00 mov eax,98Bh
|
|
|
- 000000000000031A: 66 89 44 24 74 mov word ptr [rsp+74h],ax
|
|
|
- 000000000000031F: B8 D8 11 00 00 mov eax,11D8h
|
|
|
- 0000000000000324: 66 89 44 24 76 mov word ptr [rsp+76h],ax
|
|
|
- 0000000000000329: C6 44 24 78 94 mov byte ptr [rsp+78h],94h
|
|
|
- 000000000000032E: C6 44 24 79 14 mov byte ptr [rsp+79h],14h
|
|
|
- 0000000000000333: C6 44 24 7A 50 mov byte ptr [rsp+7Ah],50h
|
|
|
- 0000000000000338: C6 44 24 7B 50 mov byte ptr [rsp+7Bh],50h
|
|
|
- 000000000000033D: C6 44 24 7C 54 mov byte ptr [rsp+7Ch],54h
|
|
|
- 0000000000000342: C6 44 24 7D 50 mov byte ptr [rsp+7Dh],50h
|
|
|
- 0000000000000347: C6 44 24 7E 30 mov byte ptr [rsp+7Eh],30h
|
|
|
- 000000000000034C: C6 44 24 7F 30 mov byte ptr [rsp+7Fh],30h
|
|
|
- 0000000000000351: C7 44 24 60 12 75 mov dword ptr [rsp+60h],3837512h
|
|
|
- 83 03
|
|
|
- 0000000000000359: B8 8B 09 00 00 mov eax,98Bh
|
|
|
- 000000000000035E: 66 89 44 24 64 mov word ptr [rsp+64h],ax
|
|
|
- 0000000000000363: B8 D8 11 00 00 mov eax,11D8h
|
|
|
- 0000000000000368: 66 89 44 24 66 mov word ptr [rsp+66h],ax
|
|
|
- 000000000000036D: C6 44 24 68 94 mov byte ptr [rsp+68h],94h
|
|
|
- 0000000000000372: C6 44 24 69 14 mov byte ptr [rsp+69h],14h
|
|
|
- 0000000000000377: C6 44 24 6A 50 mov byte ptr [rsp+6Ah],50h
|
|
|
- 000000000000037C: C6 44 24 6B 50 mov byte ptr [rsp+6Bh],50h
|
|
|
- 0000000000000381: C6 44 24 6C 54 mov byte ptr [rsp+6Ch],54h
|
|
|
- 0000000000000386: C6 44 24 6D 50 mov byte ptr [rsp+6Dh],50h
|
|
|
- 000000000000038B: C6 44 24 6E 30 mov byte ptr [rsp+6Eh],30h
|
|
|
- 0000000000000390: C6 44 24 6F 30 mov byte ptr [rsp+6Fh],30h
|
|
|
- 0000000000000395: C7 84 24 80 00 00 mov dword ptr [rsp+80h],20404h
|
|
|
- 00 04 04 02 00
|
|
|
- 00000000000003A0: 33 C0 xor eax,eax
|
|
|
- 00000000000003A2: 66 89 84 24 84 00 mov word ptr [rsp+84h],ax
|
|
|
- 00 00
|
|
|
- 00000000000003AA: 33 C0 xor eax,eax
|
|
|
- 00000000000003AC: 66 89 84 24 86 00 mov word ptr [rsp+86h],ax
|
|
|
- 00 00
|
|
|
- 00000000000003B4: C6 84 24 88 00 00 mov byte ptr [rsp+88h],0C0h
|
|
|
- 00 C0
|
|
|
- 00000000000003BC: C6 84 24 89 00 00 mov byte ptr [rsp+89h],0
|
|
|
- 00 00
|
|
|
- 00000000000003C4: C6 84 24 8A 00 00 mov byte ptr [rsp+8Ah],0
|
|
|
- 00 00
|
|
|
- 00000000000003CC: C6 84 24 8B 00 00 mov byte ptr [rsp+8Bh],0
|
|
|
- 00 00
|
|
|
- 00000000000003D4: C6 84 24 8C 00 00 mov byte ptr [rsp+8Ch],0
|
|
|
- 00 00
|
|
|
- 00000000000003DC: C6 84 24 8D 00 00 mov byte ptr [rsp+8Dh],0
|
|
|
- 00 00
|
|
|
- 00000000000003E4: C6 84 24 8E 00 00 mov byte ptr [rsp+8Eh],0
|
|
|
- 00 00
|
|
|
- 00000000000003EC: C6 84 24 8F 00 00 mov byte ptr [rsp+8Fh],46h
|
|
|
- 00 46
|
|
|
- 00000000000003F4: C7 84 24 90 00 00 mov dword ptr [rsp+90h],3837533h
|
|
|
- 00 33 75 83 03
|
|
|
- 00000000000003FF: B8 8B 09 00 00 mov eax,98Bh
|
|
|
- 0000000000000404: 66 89 84 24 94 00 mov word ptr [rsp+94h],ax
|
|
|
- 00 00
|
|
|
- 000000000000040C: B8 D8 11 00 00 mov eax,11D8h
|
|
|
- 0000000000000411: 66 89 84 24 96 00 mov word ptr [rsp+96h],ax
|
|
|
- 00 00
|
|
|
- 0000000000000419: C6 84 24 98 00 00 mov byte ptr [rsp+98h],94h
|
|
|
- 00 94
|
|
|
- 0000000000000421: C6 84 24 99 00 00 mov byte ptr [rsp+99h],14h
|
|
|
- 00 14
|
|
|
- 0000000000000429: C6 84 24 9A 00 00 mov byte ptr [rsp+9Ah],50h
|
|
|
- 00 50
|
|
|
- 0000000000000431: C6 84 24 9B 00 00 mov byte ptr [rsp+9Bh],50h
|
|
|
- 00 50
|
|
|
- 0000000000000439: C6 84 24 9C 00 00 mov byte ptr [rsp+9Ch],54h
|
|
|
- 00 54
|
|
|
- 0000000000000441: C6 84 24 9D 00 00 mov byte ptr [rsp+9Dh],50h
|
|
|
- 00 50
|
|
|
- 0000000000000449: C6 84 24 9E 00 00 mov byte ptr [rsp+9Eh],30h
|
|
|
- 00 30
|
|
|
- 0000000000000451: C6 84 24 9F 00 00 mov byte ptr [rsp+9Fh],30h
|
|
|
- 00 30
|
|
|
- 0000000000000459: C7 44 24 4C 00 00 mov dword ptr [rsp+4Ch],0
|
|
|
- 00 00
|
|
|
- 0000000000000461: 33 D2 xor edx,edx
|
|
|
- 0000000000000463: 33 C9 xor ecx,ecx
|
|
|
- 0000000000000465: FF 15 00 00 00 00 call qword ptr [__imp_OLE32$CoInitializeEx]
|
|
|
- 000000000000046B: 89 44 24 30 mov dword ptr [rsp+30h],eax
|
|
|
- 000000000000046F: 83 7C 24 30 00 cmp dword ptr [rsp+30h],0
|
|
|
- 0000000000000474: 7D 07 jge 000000000000047D
|
|
|
- 0000000000000476: 33 C0 xor eax,eax
|
|
|
- 0000000000000478: E9 55 02 00 00 jmp 00000000000006D2
|
|
|
- 000000000000047D: 48 8D 44 24 40 lea rax,[rsp+40h]
|
|
|
- 0000000000000482: 48 89 44 24 20 mov qword ptr [rsp+20h],rax
|
|
|
- 0000000000000487: 4C 8D 4C 24 60 lea r9,[rsp+60h]
|
|
|
- 000000000000048C: 41 B8 01 00 00 00 mov r8d,1
|
|
|
- 0000000000000492: 33 D2 xor edx,edx
|
|
|
- 0000000000000494: 48 8D 4C 24 70 lea rcx,[rsp+70h]
|
|
|
- 0000000000000499: FF 15 00 00 00 00 call qword ptr [__imp_OLE32$CoCreateInstance]
|
|
|
- 000000000000049F: 89 44 24 30 mov dword ptr [rsp+30h],eax
|
|
|
- 00000000000004A3: 83 7C 24 30 00 cmp dword ptr [rsp+30h],0
|
|
|
- 00000000000004A8: 7D 17 jge 00000000000004C1
|
|
|
- 00000000000004AA: 44 8B 44 24 30 mov r8d,dword ptr [rsp+30h]
|
|
|
- 00000000000004AF: 48 8D 15 00 00 00 lea rdx,[$SG105178]
|
|
|
- 00
|
|
|
- 00000000000004B6: B9 0D 00 00 00 mov ecx,0Dh
|
|
|
- 00000000000004BB: FF 15 00 00 00 00 call qword ptr [__imp_BeaconPrintf]
|
|
|
- 00000000000004C1: 48 8B 44 24 40 mov rax,qword ptr [rsp+40h]
|
|
|
- 00000000000004C6: 48 8B 00 mov rax,qword ptr [rax]
|
|
|
- 00000000000004C9: 45 33 C0 xor r8d,r8d
|
|
|
- 00000000000004CC: 48 8B 94 24 F0 00 mov rdx,qword ptr [rsp+0F0h]
|
|
|
- 00 00
|
|
|
- 00000000000004D4: 48 8B 4C 24 40 mov rcx,qword ptr [rsp+40h]
|
|
|
- 00000000000004D9: FF 90 A8 00 00 00 call qword ptr [rax+0A8h]
|
|
|
- 00000000000004DF: 89 44 24 30 mov dword ptr [rsp+30h],eax
|
|
|
- 00000000000004E3: 83 7C 24 30 00 cmp dword ptr [rsp+30h],0
|
|
|
- 00000000000004E8: 7D 17 jge 0000000000000501
|
|
|
- 00000000000004EA: 44 8B 44 24 30 mov r8d,dword ptr [rsp+30h]
|
|
|
- 00000000000004EF: 48 8D 15 00 00 00 lea rdx,[$SG105180]
|
|
|
- 00
|
|
|
- 00000000000004F6: B9 0D 00 00 00 mov ecx,0Dh
|
|
|
- 00000000000004FB: FF 15 00 00 00 00 call qword ptr [__imp_BeaconPrintf]
|
|
|
- 0000000000000501: 48 C7 44 24 38 00 mov qword ptr [rsp+38h],0
|
|
|
- 00 00 00
|
|
|
- 000000000000050A: 48 8B 44 24 40 mov rax,qword ptr [rsp+40h]
|
|
|
- 000000000000050F: 48 8B 00 mov rax,qword ptr [rax]
|
|
|
- 0000000000000512: 48 8D 54 24 38 lea rdx,[rsp+38h]
|
|
|
- 0000000000000517: 48 8B 4C 24 40 mov rcx,qword ptr [rsp+40h]
|
|
|
- 000000000000051C: FF 90 C8 00 00 00 call qword ptr [rax+0C8h]
|
|
|
- 0000000000000522: 89 44 24 30 mov dword ptr [rsp+30h],eax
|
|
|
- 0000000000000526: 83 7C 24 30 00 cmp dword ptr [rsp+30h],0
|
|
|
- 000000000000052B: 0F 85 77 01 00 00 jne 00000000000006A8
|
|
|
- 0000000000000531: C7 44 24 48 00 00 mov dword ptr [rsp+48h],0
|
|
|
- 00 00
|
|
|
- 0000000000000539: 48 8B 44 24 38 mov rax,qword ptr [rsp+38h]
|
|
|
- 000000000000053E: 48 8B 00 mov rax,qword ptr [rax]
|
|
|
- 0000000000000541: 48 8D 54 24 48 lea rdx,[rsp+48h]
|
|
|
- 0000000000000546: 48 8B 4C 24 38 mov rcx,qword ptr [rsp+38h]
|
|
|
- 000000000000054B: FF 50 38 call qword ptr [rax+38h]
|
|
|
- 000000000000054E: 89 44 24 30 mov dword ptr [rsp+30h],eax
|
|
|
- 0000000000000552: 83 7C 24 48 00 cmp dword ptr [rsp+48h],0
|
|
|
- 0000000000000557: 0F 8E 4B 01 00 00 jle 00000000000006A8
|
|
|
- 000000000000055D: 48 C7 44 24 50 00 mov qword ptr [rsp+50h],0
|
|
|
- 00 00 00
|
|
|
- 0000000000000566: 48 8B 44 24 38 mov rax,qword ptr [rsp+38h]
|
|
|
- 000000000000056B: 48 8B 00 mov rax,qword ptr [rax]
|
|
|
- 000000000000056E: 48 8D 54 24 50 lea rdx,[rsp+50h]
|
|
|
- 0000000000000573: 48 8B 4C 24 38 mov rcx,qword ptr [rsp+38h]
|
|
|
- 0000000000000578: FF 50 48 call qword ptr [rax+48h]
|
|
|
- 000000000000057B: 89 44 24 30 mov dword ptr [rsp+30h],eax
|
|
|
- 000000000000057F: 48 C7 84 24 A0 00 mov qword ptr [rsp+0A0h],0
|
|
|
- 00 00 00 00 00 00
|
|
|
- 000000000000058B: 48 8B 44 24 50 mov rax,qword ptr [rsp+50h]
|
|
|
- 0000000000000590: 48 8B 00 mov rax,qword ptr [rax]
|
|
|
- 0000000000000593: 4C 8D 84 24 A0 00 lea r8,[rsp+0A0h]
|
|
|
- 00 00
|
|
|
- 000000000000059B: 48 8D 94 24 80 00 lea rdx,[rsp+80h]
|
|
|
- 00 00
|
|
|
- 00000000000005A3: 48 8B 4C 24 50 mov rcx,qword ptr [rsp+50h]
|
|
|
- 00000000000005A8: FF 10 call qword ptr [rax]
|
|
|
- 00000000000005AA: 89 44 24 30 mov dword ptr [rsp+30h],eax
|
|
|
- 00000000000005AE: 48 8B 44 24 50 mov rax,qword ptr [rsp+50h]
|
|
|
- 00000000000005B3: 48 8B 00 mov rax,qword ptr [rax]
|
|
|
- 00000000000005B6: 48 8B 4C 24 50 mov rcx,qword ptr [rsp+50h]
|
|
|
- 00000000000005BB: FF 50 10 call qword ptr [rax+10h]
|
|
|
- 00000000000005BE: 48 8D 8C 24 C0 00 lea rcx,[rsp+0C0h]
|
|
|
- 00 00
|
|
|
- 00000000000005C6: FF 15 00 00 00 00 call qword ptr [__imp_OLEAUT32$VariantInit]
|
|
|
- 00000000000005CC: 48 8D 8C 24 A8 00 lea rcx,[rsp+0A8h]
|
|
|
- 00 00
|
|
|
- 00000000000005D4: FF 15 00 00 00 00 call qword ptr [__imp_OLEAUT32$VariantInit]
|
|
|
- 00000000000005DA: 48 C7 44 24 58 00 mov qword ptr [rsp+58h],0
|
|
|
- 00 00 00
|
|
|
- 00000000000005E3: 48 8B 84 24 A0 00 mov rax,qword ptr [rsp+0A0h]
|
|
|
- 00 00
|
|
|
- 00000000000005EB: 48 8B 00 mov rax,qword ptr [rax]
|
|
|
- 00000000000005EE: 45 33 C9 xor r9d,r9d
|
|
|
- 00000000000005F1: 4C 8D 84 24 C0 00 lea r8,[rsp+0C0h]
|
|
|
- 00 00
|
|
|
- 00000000000005F9: BA 01 00 00 00 mov edx,1
|
|
|
- 00000000000005FE: 48 8B 8C 24 A0 00 mov rcx,qword ptr [rsp+0A0h]
|
|
|
- 00 00
|
|
|
- 0000000000000606: FF 50 18 call qword ptr [rax+18h]
|
|
|
- 0000000000000609: 89 44 24 30 mov dword ptr [rsp+30h],eax
|
|
|
- 000000000000060D: 83 7C 24 30 00 cmp dword ptr [rsp+30h],0
|
|
|
- 0000000000000612: 0F 85 90 00 00 00 jne 00000000000006A8
|
|
|
- 0000000000000618: 48 8B 84 24 C8 00 mov rax,qword ptr [rsp+0C8h]
|
|
|
- 00 00
|
|
|
- 0000000000000620: 48 8B 00 mov rax,qword ptr [rax]
|
|
|
- 0000000000000623: 4C 8D 44 24 58 lea r8,[rsp+58h]
|
|
|
- 0000000000000628: 48 8D 94 24 90 00 lea rdx,[rsp+90h]
|
|
|
- 00 00
|
|
|
- 0000000000000630: 48 8B 8C 24 C8 00 mov rcx,qword ptr [rsp+0C8h]
|
|
|
- 00 00
|
|
|
- 0000000000000638: FF 10 call qword ptr [rax]
|
|
|
- 000000000000063A: 48 8B 44 24 58 mov rax,qword ptr [rsp+58h]
|
|
|
- 000000000000063F: 48 8B 00 mov rax,qword ptr [rax]
|
|
|
- 0000000000000642: 48 8D 94 24 A8 00 lea rdx,[rsp+0A8h]
|
|
|
- 00 00
|
|
|
- 000000000000064A: 48 8B 4C 24 58 mov rcx,qword ptr [rsp+58h]
|
|
|
- 000000000000064F: FF 50 68 call qword ptr [rax+68h]
|
|
|
- 0000000000000652: 83 BC 24 B0 00 00 cmp dword ptr [rsp+0B0h],0
|
|
|
- 00 00
|
|
|
- 000000000000065A: 74 1B je 0000000000000677
|
|
|
- 000000000000065C: 8B 94 24 B0 00 00 mov edx,dword ptr [rsp+0B0h]
|
|
|
- 00
|
|
|
- 0000000000000663: 48 8D 0D 00 00 00 lea rcx,[$SG105184]
|
|
|
- 00
|
|
|
- 000000000000066A: E8 00 00 00 00 call BeaconPrintToStreamW
|
|
|
- 000000000000066F: C7 44 24 4C 01 00 mov dword ptr [rsp+4Ch],1
|
|
|
- 00 00
|
|
|
- 0000000000000677: 48 8D 8C 24 A8 00 lea rcx,[rsp+0A8h]
|
|
|
- 00 00
|
|
|
- 000000000000067F: FF 15 00 00 00 00 call qword ptr [__imp_OLEAUT32$VariantClear]
|
|
|
- 0000000000000685: 48 8B 44 24 58 mov rax,qword ptr [rsp+58h]
|
|
|
- 000000000000068A: 48 8B 00 mov rax,qword ptr [rax]
|
|
|
- 000000000000068D: 48 8B 4C 24 58 mov rcx,qword ptr [rsp+58h]
|
|
|
- 0000000000000692: FF 50 10 call qword ptr [rax+10h]
|
|
|
- 0000000000000695: 48 8D 8C 24 C0 00 lea rcx,[rsp+0C0h]
|
|
|
- 00 00
|
|
|
- 000000000000069D: FF 15 00 00 00 00 call qword ptr [__imp_OLEAUT32$VariantClear]
|
|
|
- 00000000000006A3: E9 3B FF FF FF jmp 00000000000005E3
|
|
|
- 00000000000006A8: 48 8B 44 24 38 mov rax,qword ptr [rsp+38h]
|
|
|
- 00000000000006AD: 48 8B 00 mov rax,qword ptr [rax]
|
|
|
- 00000000000006B0: 48 8B 4C 24 38 mov rcx,qword ptr [rsp+38h]
|
|
|
- 00000000000006B5: FF 50 10 call qword ptr [rax+10h]
|
|
|
- 00000000000006B8: 48 8B 44 24 40 mov rax,qword ptr [rsp+40h]
|
|
|
- 00000000000006BD: 48 8B 00 mov rax,qword ptr [rax]
|
|
|
- 00000000000006C0: 48 8B 4C 24 40 mov rcx,qword ptr [rsp+40h]
|
|
|
- 00000000000006C5: FF 50 10 call qword ptr [rax+10h]
|
|
|
- 00000000000006C8: FF 15 00 00 00 00 call qword ptr [__imp_OLE32$CoUninitialize]
|
|
|
- 00000000000006CE: 8B 44 24 4C mov eax,dword ptr [rsp+4Ch]
|
|
|
- 00000000000006D2: 48 81 C4 E8 00 00 add rsp,0E8h
|
|
|
- 00
|
|
|
- 00000000000006D9: C3 ret
|
|
|
- 00000000000006DA: CC int 3
|
|
|
- 00000000000006DB: CC int 3
|
|
|
- 00000000000006DC: CC int 3
|
|
|
- 00000000000006DD: CC int 3
|
|
|
- 00000000000006DE: CC int 3
|
|
|
- 00000000000006DF: CC int 3
|
|
|
-FindSysmon:
|
|
|
- 00000000000006E0: 48 81 EC E8 02 00 sub rsp,2E8h
|
|
|
- 00
|
|
|
- 00000000000006E7: C7 44 24 4C 00 00 mov dword ptr [rsp+4Ch],0
|
|
|
- 00 00
|
|
|
- 00000000000006EF: 48 C7 44 24 40 00 mov qword ptr [rsp+40h],0
|
|
|
- 00 00 00
|
|
|
- 00000000000006F8: 48 C7 44 24 70 00 mov qword ptr [rsp+70h],0
|
|
|
- 00 00 00
|
|
|
- 0000000000000701: C7 44 24 50 00 00 mov dword ptr [rsp+50h],0
|
|
|
- 00 00
|
|
|
- 0000000000000709: C7 44 24 64 00 00 mov dword ptr [rsp+64h],0
|
|
|
- 00 00
|
|
|
- 0000000000000711: C7 44 24 60 E8 FD mov dword ptr [rsp+60h],0FDE8h
|
|
|
- 00 00
|
|
|
- 0000000000000719: 48 C7 44 24 58 00 mov qword ptr [rsp+58h],0
|
|
|
- 00 00 00
|
|
|
- 0000000000000722: C7 44 24 68 00 00 mov dword ptr [rsp+68h],0
|
|
|
- 00 00
|
|
|
- 000000000000072A: 48 8D 44 24 78 lea rax,[rsp+78h]
|
|
|
- 000000000000072F: 48 89 44 24 20 mov qword ptr [rsp+20h],rax
|
|
|
- 0000000000000734: 41 B9 19 00 02 00 mov r9d,20019h
|
|
|
- 000000000000073A: 45 33 C0 xor r8d,r8d
|
|
|
- 000000000000073D: 48 8D 15 00 00 00 lea rdx,[$SG105226]
|
|
|
- 00
|
|
|
- 0000000000000744: 48 C7 C1 02 00 00 mov rcx,0FFFFFFFF80000002h
|
|
|
- 80
|
|
|
- 000000000000074B: FF 15 00 00 00 00 call qword ptr [__imp_ADVAPI32$RegOpenKeyExA]
|
|
|
- 0000000000000751: 85 C0 test eax,eax
|
|
|
- 0000000000000753: 0F 85 CD 00 00 00 jne 0000000000000826
|
|
|
- 0000000000000759: 8B 44 24 60 mov eax,dword ptr [rsp+60h]
|
|
|
- 000000000000075D: 48 89 84 24 88 00 mov qword ptr [rsp+88h],rax
|
|
|
- 00 00
|
|
|
- 0000000000000765: FF 15 00 00 00 00 call qword ptr [__imp_KERNEL32$GetProcessHeap]
|
|
|
- 000000000000076B: 48 8B 8C 24 88 00 mov rcx,qword ptr [rsp+88h]
|
|
|
- 00 00
|
|
|
- 0000000000000773: 4C 8B C1 mov r8,rcx
|
|
|
- 0000000000000776: BA 08 00 00 00 mov edx,8
|
|
|
- 000000000000077B: 48 8B C8 mov rcx,rax
|
|
|
- 000000000000077E: FF 15 00 00 00 00 call qword ptr [__imp_KERNEL32$HeapAlloc]
|
|
|
- 0000000000000784: 48 89 44 24 58 mov qword ptr [rsp+58h],rax
|
|
|
- 0000000000000789: 48 83 7C 24 58 00 cmp qword ptr [rsp+58h],0
|
|
|
- 000000000000078F: 75 07 jne 0000000000000798
|
|
|
- 0000000000000791: 33 C0 xor eax,eax
|
|
|
- 0000000000000793: E9 7A 02 00 00 jmp 0000000000000A12
|
|
|
- 0000000000000798: 48 8D 44 24 60 lea rax,[rsp+60h]
|
|
|
- 000000000000079D: 48 89 44 24 30 mov qword ptr [rsp+30h],rax
|
|
|
- 00000000000007A2: 48 8B 44 24 58 mov rax,qword ptr [rsp+58h]
|
|
|
- 00000000000007A7: 48 89 44 24 28 mov qword ptr [rsp+28h],rax
|
|
|
- 00000000000007AC: 48 8D 84 24 80 00 lea rax,[rsp+80h]
|
|
|
- 00 00
|
|
|
- 00000000000007B4: 48 89 44 24 20 mov qword ptr [rsp+20h],rax
|
|
|
- 00000000000007B9: 41 B9 FF FF 00 00 mov r9d,0FFFFh
|
|
|
- 00000000000007BF: 4C 8D 05 00 00 00 lea r8,[$SG105229]
|
|
|
- 00
|
|
|
- 00000000000007C6: 33 D2 xor edx,edx
|
|
|
- 00000000000007C8: 48 8B 4C 24 78 mov rcx,qword ptr [rsp+78h]
|
|
|
- 00000000000007CD: FF 15 00 00 00 00 call qword ptr [__imp_ADVAPI32$RegGetValueA]
|
|
|
- 00000000000007D3: 85 C0 test eax,eax
|
|
|
- 00000000000007D5: 74 07 je 00000000000007DE
|
|
|
- 00000000000007D7: 33 C0 xor eax,eax
|
|
|
- 00000000000007D9: E9 34 02 00 00 jmp 0000000000000A12
|
|
|
- 00000000000007DE: 48 8B 4C 24 58 mov rcx,qword ptr [rsp+58h]
|
|
|
- 00000000000007E3: FF 15 00 00 00 00 call qword ptr [__imp_MSVCRT$strlen]
|
|
|
- 00000000000007E9: 48 85 C0 test rax,rax
|
|
|
- 00000000000007EC: 74 2F je 000000000000081D
|
|
|
- 00000000000007EE: C7 44 24 28 00 01 mov dword ptr [rsp+28h],100h
|
|
|
- 00 00
|
|
|
- 00000000000007F6: 48 8D 84 24 E0 00 lea rax,[rsp+0E0h]
|
|
|
- 00 00
|
|
|
- 00000000000007FE: 48 89 44 24 20 mov qword ptr [rsp+20h],rax
|
|
|
- 0000000000000803: 41 B9 FF FF FF FF mov r9d,0FFFFFFFFh
|
|
|
- 0000000000000809: 4C 8B 44 24 58 mov r8,qword ptr [rsp+58h]
|
|
|
- 000000000000080E: 33 D2 xor edx,edx
|
|
|
- 0000000000000810: B9 E9 FD 00 00 mov ecx,0FDE9h
|
|
|
- 0000000000000815: FF 15 00 00 00 00 call qword ptr [__imp_KERNEL32$MultiByteToWideChar]
|
|
|
- 000000000000081B: EB 07 jmp 0000000000000824
|
|
|
- 000000000000081D: 33 C0 xor eax,eax
|
|
|
- 000000000000081F: E9 EE 01 00 00 jmp 0000000000000A12
|
|
|
- 0000000000000824: EB 07 jmp 000000000000082D
|
|
|
- 0000000000000826: 33 C0 xor eax,eax
|
|
|
- 0000000000000828: E9 E5 01 00 00 jmp 0000000000000A12
|
|
|
- 000000000000082D: 48 83 7C 24 58 00 cmp qword ptr [rsp+58h],0
|
|
|
- 0000000000000833: 74 16 je 000000000000084B
|
|
|
- 0000000000000835: FF 15 00 00 00 00 call qword ptr [__imp_KERNEL32$GetProcessHeap]
|
|
|
- 000000000000083B: 4C 8B 44 24 58 mov r8,qword ptr [rsp+58h]
|
|
|
- 0000000000000840: 33 D2 xor edx,edx
|
|
|
- 0000000000000842: 48 8B C8 mov rcx,rax
|
|
|
- 0000000000000845: FF 15 00 00 00 00 call qword ptr [__imp_KERNEL32$HeapFree]
|
|
|
- 000000000000084B: 48 8B 4C 24 78 mov rcx,qword ptr [rsp+78h]
|
|
|
- 0000000000000850: FF 15 00 00 00 00 call qword ptr [__imp_ADVAPI32$RegCloseKey]
|
|
|
- 0000000000000856: 48 8D 54 24 50 lea rdx,[rsp+50h]
|
|
|
- 000000000000085B: 48 8B 4C 24 40 mov rcx,qword ptr [rsp+40h]
|
|
|
- 0000000000000860: FF 15 00 00 00 00 call qword ptr [__imp_TDH$TdhEnumerateProviders]
|
|
|
- 0000000000000866: 89 44 24 4C mov dword ptr [rsp+4Ch],eax
|
|
|
- 000000000000086A: 83 7C 24 4C 7A cmp dword ptr [rsp+4Ch],7Ah
|
|
|
- 000000000000086F: 75 4E jne 00000000000008BF
|
|
|
- 0000000000000871: 8B 44 24 50 mov eax,dword ptr [rsp+50h]
|
|
|
- 0000000000000875: 8B D0 mov edx,eax
|
|
|
- 0000000000000877: 48 8B 4C 24 40 mov rcx,qword ptr [rsp+40h]
|
|
|
- 000000000000087C: FF 15 00 00 00 00 call qword ptr [__imp_MSVCRT$realloc]
|
|
|
- 0000000000000882: 48 89 44 24 70 mov qword ptr [rsp+70h],rax
|
|
|
- 0000000000000887: 48 83 7C 24 70 00 cmp qword ptr [rsp+70h],0
|
|
|
- 000000000000088D: 75 07 jne 0000000000000896
|
|
|
- 000000000000088F: 33 C0 xor eax,eax
|
|
|
- 0000000000000891: E9 7C 01 00 00 jmp 0000000000000A12
|
|
|
- 0000000000000896: 48 8B 44 24 70 mov rax,qword ptr [rsp+70h]
|
|
|
- 000000000000089B: 48 89 44 24 40 mov qword ptr [rsp+40h],rax
|
|
|
- 00000000000008A0: 48 C7 44 24 70 00 mov qword ptr [rsp+70h],0
|
|
|
- 00 00 00
|
|
|
- 00000000000008A9: 48 8D 54 24 50 lea rdx,[rsp+50h]
|
|
|
- 00000000000008AE: 48 8B 4C 24 40 mov rcx,qword ptr [rsp+40h]
|
|
|
- 00000000000008B3: FF 15 00 00 00 00 call qword ptr [__imp_TDH$TdhEnumerateProviders]
|
|
|
- 00000000000008B9: 89 44 24 4C mov dword ptr [rsp+4Ch],eax
|
|
|
- 00000000000008BD: EB AB jmp 000000000000086A
|
|
|
- 00000000000008BF: 83 7C 24 4C 00 cmp dword ptr [rsp+4Ch],0
|
|
|
- 00000000000008C4: 74 17 je 00000000000008DD
|
|
|
- 00000000000008C6: 48 8D 15 00 00 00 lea rdx,[$SG105236]
|
|
|
- 00
|
|
|
- 00000000000008CD: B9 0D 00 00 00 mov ecx,0Dh
|
|
|
- 00000000000008D2: FF 15 00 00 00 00 call qword ptr [__imp_BeaconPrintf]
|
|
|
- 00000000000008D8: E9 17 01 00 00 jmp 00000000000009F4
|
|
|
- 00000000000008DD: C7 44 24 48 00 00 mov dword ptr [rsp+48h],0
|
|
|
- 00 00
|
|
|
- 00000000000008E5: EB 0A jmp 00000000000008F1
|
|
|
- 00000000000008E7: 8B 44 24 48 mov eax,dword ptr [rsp+48h]
|
|
|
- 00000000000008EB: FF C0 inc eax
|
|
|
- 00000000000008ED: 89 44 24 48 mov dword ptr [rsp+48h],eax
|
|
|
- 00000000000008F1: 48 8B 44 24 40 mov rax,qword ptr [rsp+40h]
|
|
|
- 00000000000008F6: 8B 00 mov eax,dword ptr [rax]
|
|
|
- 00000000000008F8: 39 44 24 48 cmp dword ptr [rsp+48h],eax
|
|
|
- 00000000000008FC: 0F 83 F2 00 00 00 jae 00000000000009F4
|
|
|
- 0000000000000902: 8B 44 24 48 mov eax,dword ptr [rsp+48h]
|
|
|
- 0000000000000906: 48 6B C0 18 imul rax,rax,18h
|
|
|
- 000000000000090A: 48 8B 4C 24 40 mov rcx,qword ptr [rsp+40h]
|
|
|
- 000000000000090F: 48 8D 44 01 08 lea rax,[rcx+rax+8]
|
|
|
- 0000000000000914: 41 B8 27 00 00 00 mov r8d,27h
|
|
|
- 000000000000091A: 48 8D 94 24 90 00 lea rdx,[rsp+90h]
|
|
|
- 00 00
|
|
|
- 0000000000000922: 48 8B C8 mov rcx,rax
|
|
|
- 0000000000000925: FF 15 00 00 00 00 call qword ptr [__imp_OLE32$StringFromGUID2]
|
|
|
- 000000000000092B: 89 44 24 64 mov dword ptr [rsp+64h],eax
|
|
|
- 000000000000092F: 83 7C 24 64 00 cmp dword ptr [rsp+64h],0
|
|
|
- 0000000000000934: 7D 07 jge 000000000000093D
|
|
|
- 0000000000000936: 33 C0 xor eax,eax
|
|
|
- 0000000000000938: E9 D5 00 00 00 jmp 0000000000000A12
|
|
|
- 000000000000093D: 48 8D 94 24 E0 00 lea rdx,[rsp+0E0h]
|
|
|
- 00 00
|
|
|
- 0000000000000945: 48 8D 8C 24 90 00 lea rcx,[rsp+90h]
|
|
|
- 00 00
|
|
|
- 000000000000094D: FF 15 00 00 00 00 call qword ptr [__imp_MSVCRT$_wcsicmp]
|
|
|
- 0000000000000953: 85 C0 test eax,eax
|
|
|
- 0000000000000955: 0F 85 94 00 00 00 jne 00000000000009EF
|
|
|
- 000000000000095B: 48 8D 0D 00 00 00 lea rcx,[$SG105239]
|
|
|
- 00
|
|
|
- 0000000000000962: E8 00 00 00 00 call BeaconPrintToStreamW
|
|
|
- 0000000000000967: 48 8D 8C 24 E0 00 lea rcx,[rsp+0E0h]
|
|
|
- 00 00
|
|
|
- 000000000000096F: E8 00 00 00 00 call PrintSysmonPID
|
|
|
- 0000000000000974: 89 44 24 68 mov dword ptr [rsp+68h],eax
|
|
|
- 0000000000000978: 83 7C 24 68 00 cmp dword ptr [rsp+68h],0
|
|
|
- 000000000000097D: 75 0E jne 000000000000098D
|
|
|
- 000000000000097F: 48 8D 0D 00 00 00 lea rcx,[$SG105242]
|
|
|
- 00
|
|
|
- 0000000000000986: E8 00 00 00 00 call BeaconPrintToStreamW
|
|
|
- 000000000000098B: EB 0C jmp 0000000000000999
|
|
|
- 000000000000098D: 48 8D 0D 00 00 00 lea rcx,[$SG105243]
|
|
|
- 00
|
|
|
- 0000000000000994: E8 00 00 00 00 call BeaconPrintToStreamW
|
|
|
- 0000000000000999: 8B 44 24 48 mov eax,dword ptr [rsp+48h]
|
|
|
- 000000000000099D: 48 6B C0 18 imul rax,rax,18h
|
|
|
- 00000000000009A1: 48 8B 4C 24 40 mov rcx,qword ptr [rsp+40h]
|
|
|
- 00000000000009A6: 8B 44 01 1C mov eax,dword ptr [rcx+rax+1Ch]
|
|
|
- 00000000000009AA: 48 8B 4C 24 40 mov rcx,qword ptr [rsp+40h]
|
|
|
- 00000000000009AF: 48 03 C8 add rcx,rax
|
|
|
- 00000000000009B2: 48 8B C1 mov rax,rcx
|
|
|
- 00000000000009B5: 4C 8D 84 24 90 00 lea r8,[rsp+90h]
|
|
|
- 00 00
|
|
|
- 00000000000009BD: 48 8B D0 mov rdx,rax
|
|
|
- 00000000000009C0: 48 8D 0D 00 00 00 lea rcx,[$SG105244]
|
|
|
- 00
|
|
|
- 00000000000009C7: E8 00 00 00 00 call BeaconPrintToStreamW
|
|
|
- 00000000000009CC: 48 83 7C 24 40 00 cmp qword ptr [rsp+40h],0
|
|
|
- 00000000000009D2: 74 14 je 00000000000009E8
|
|
|
- 00000000000009D4: 48 8B 4C 24 40 mov rcx,qword ptr [rsp+40h]
|
|
|
- 00000000000009D9: FF 15 00 00 00 00 call qword ptr [__imp_MSVCRT$free]
|
|
|
- 00000000000009DF: 48 C7 44 24 40 00 mov qword ptr [rsp+40h],0
|
|
|
- 00 00 00
|
|
|
- 00000000000009E8: B8 01 00 00 00 mov eax,1
|
|
|
- 00000000000009ED: EB 23 jmp 0000000000000A12
|
|
|
- 00000000000009EF: E9 F3 FE FF FF jmp 00000000000008E7
|
|
|
- 00000000000009F4: 48 83 7C 24 40 00 cmp qword ptr [rsp+40h],0
|
|
|
- 00000000000009FA: 74 14 je 0000000000000A10
|
|
|
- 00000000000009FC: 48 8B 4C 24 40 mov rcx,qword ptr [rsp+40h]
|
|
|
- 0000000000000A01: FF 15 00 00 00 00 call qword ptr [__imp_MSVCRT$free]
|
|
|
- 0000000000000A07: 48 C7 44 24 40 00 mov qword ptr [rsp+40h],0
|
|
|
- 00 00 00
|
|
|
- 0000000000000A10: 33 C0 xor eax,eax
|
|
|
- 0000000000000A12: 48 81 C4 E8 02 00 add rsp,2E8h
|
|
|
- 00
|
|
|
- 0000000000000A19: C3 ret
|
|
|
- 0000000000000A1A: CC int 3
|
|
|
- 0000000000000A1B: CC int 3
|
|
|
- 0000000000000A1C: CC int 3
|
|
|
- 0000000000000A1D: CC int 3
|
|
|
- 0000000000000A1E: CC int 3
|
|
|
- 0000000000000A1F: CC int 3
|
|
|
-PrintMiniFilterData:
|
|
|
- 0000000000000A20: 48 89 4C 24 08 mov qword ptr [rsp+8],rcx
|
|
|
- 0000000000000A25: 48 83 EC 58 sub rsp,58h
|
|
|
- 0000000000000A29: 48 C7 44 24 28 00 mov qword ptr [rsp+28h],0
|
|
|
- 00 00 00
|
|
|
- 0000000000000A32: 48 8B 44 24 60 mov rax,qword ptr [rsp+60h]
|
|
|
- 0000000000000A37: 48 89 44 24 28 mov qword ptr [rsp+28h],rax
|
|
|
- 0000000000000A3C: 48 8B 44 24 28 mov rax,qword ptr [rsp+28h]
|
|
|
- 0000000000000A41: 0F B7 40 14 movzx eax,word ptr [rax+14h]
|
|
|
- 0000000000000A45: 89 44 24 20 mov dword ptr [rsp+20h],eax
|
|
|
- 0000000000000A49: 48 8B 44 24 28 mov rax,qword ptr [rsp+28h]
|
|
|
- 0000000000000A4E: 0F B7 40 16 movzx eax,word ptr [rax+16h]
|
|
|
- 0000000000000A52: 48 8B 4C 24 60 mov rcx,qword ptr [rsp+60h]
|
|
|
- 0000000000000A57: 48 03 C8 add rcx,rax
|
|
|
- 0000000000000A5A: 48 8B C1 mov rax,rcx
|
|
|
- 0000000000000A5D: 48 89 44 24 40 mov qword ptr [rsp+40h],rax
|
|
|
- 0000000000000A62: 8B 44 24 20 mov eax,dword ptr [rsp+20h]
|
|
|
- 0000000000000A66: 83 C0 02 add eax,2
|
|
|
- 0000000000000A69: 48 98 cdqe
|
|
|
- 0000000000000A6B: 48 8B C8 mov rcx,rax
|
|
|
- 0000000000000A6E: FF 15 00 00 00 00 call qword ptr [__imp_MSVCRT$malloc]
|
|
|
- 0000000000000A74: 48 89 44 24 30 mov qword ptr [rsp+30h],rax
|
|
|
- 0000000000000A79: 8B 44 24 20 mov eax,dword ptr [rsp+20h]
|
|
|
- 0000000000000A7D: 83 C0 02 add eax,2
|
|
|
- 0000000000000A80: 48 98 cdqe
|
|
|
- 0000000000000A82: 4C 8B C0 mov r8,rax
|
|
|
- 0000000000000A85: 33 D2 xor edx,edx
|
|
|
- 0000000000000A87: 48 8B 4C 24 30 mov rcx,qword ptr [rsp+30h]
|
|
|
- 0000000000000A8C: FF 15 00 00 00 00 call qword ptr [__imp_MSVCRT$memset]
|
|
|
- 0000000000000A92: 48 63 44 24 20 movsxd rax,dword ptr [rsp+20h]
|
|
|
- 0000000000000A97: 4C 8B C0 mov r8,rax
|
|
|
- 0000000000000A9A: 48 8B 54 24 40 mov rdx,qword ptr [rsp+40h]
|
|
|
- 0000000000000A9F: 48 8B 4C 24 30 mov rcx,qword ptr [rsp+30h]
|
|
|
- 0000000000000AA4: FF 15 00 00 00 00 call qword ptr [__imp_MSVCRT$memcpy]
|
|
|
- 0000000000000AAA: 48 8B 44 24 28 mov rax,qword ptr [rsp+28h]
|
|
|
- 0000000000000AAF: 0F B7 40 18 movzx eax,word ptr [rax+18h]
|
|
|
- 0000000000000AB3: 89 44 24 24 mov dword ptr [rsp+24h],eax
|
|
|
- 0000000000000AB7: 48 8B 44 24 28 mov rax,qword ptr [rsp+28h]
|
|
|
- 0000000000000ABC: 0F B7 40 1A movzx eax,word ptr [rax+1Ah]
|
|
|
- 0000000000000AC0: 48 8B 4C 24 60 mov rcx,qword ptr [rsp+60h]
|
|
|
- 0000000000000AC5: 48 03 C8 add rcx,rax
|
|
|
- 0000000000000AC8: 48 8B C1 mov rax,rcx
|
|
|
- 0000000000000ACB: 48 89 44 24 40 mov qword ptr [rsp+40h],rax
|
|
|
- 0000000000000AD0: 8B 44 24 24 mov eax,dword ptr [rsp+24h]
|
|
|
- 0000000000000AD4: 83 C0 02 add eax,2
|
|
|
- 0000000000000AD7: 48 98 cdqe
|
|
|
- 0000000000000AD9: 48 8B C8 mov rcx,rax
|
|
|
- 0000000000000ADC: FF 15 00 00 00 00 call qword ptr [__imp_MSVCRT$malloc]
|
|
|
- 0000000000000AE2: 48 89 44 24 38 mov qword ptr [rsp+38h],rax
|
|
|
- 0000000000000AE7: 8B 44 24 24 mov eax,dword ptr [rsp+24h]
|
|
|
- 0000000000000AEB: 83 C0 02 add eax,2
|
|
|
- 0000000000000AEE: 48 98 cdqe
|
|
|
- 0000000000000AF0: 4C 8B C0 mov r8,rax
|
|
|
- 0000000000000AF3: 33 D2 xor edx,edx
|
|
|
- 0000000000000AF5: 48 8B 4C 24 38 mov rcx,qword ptr [rsp+38h]
|
|
|
- 0000000000000AFA: FF 15 00 00 00 00 call qword ptr [__imp_MSVCRT$memset]
|
|
|
- 0000000000000B00: 48 63 44 24 24 movsxd rax,dword ptr [rsp+24h]
|
|
|
- 0000000000000B05: 4C 8B C0 mov r8,rax
|
|
|
- 0000000000000B08: 48 8B 54 24 40 mov rdx,qword ptr [rsp+40h]
|
|
|
- 0000000000000B0D: 48 8B 4C 24 38 mov rcx,qword ptr [rsp+38h]
|
|
|
- 0000000000000B12: FF 15 00 00 00 00 call qword ptr [__imp_MSVCRT$memcpy]
|
|
|
- 0000000000000B18: 48 8B 44 24 28 mov rax,qword ptr [rsp+28h]
|
|
|
- 0000000000000B1D: 83 78 04 01 cmp dword ptr [rax+4],1
|
|
|
- 0000000000000B21: 75 1F jne 0000000000000B42
|
|
|
- 0000000000000B23: 48 8B 44 24 28 mov rax,qword ptr [rsp+28h]
|
|
|
- 0000000000000B28: 44 8B 48 10 mov r9d,dword ptr [rax+10h]
|
|
|
- 0000000000000B2C: 4C 8B 44 24 38 mov r8,qword ptr [rsp+38h]
|
|
|
- 0000000000000B31: 48 8B 54 24 30 mov rdx,qword ptr [rsp+30h]
|
|
|
- 0000000000000B36: 48 8D 0D 00 00 00 lea rcx,[$SG105266]
|
|
|
- 00
|
|
|
- 0000000000000B3D: E8 00 00 00 00 call BeaconPrintToStreamW
|
|
|
- 0000000000000B42: 48 8B 4C 24 30 mov rcx,qword ptr [rsp+30h]
|
|
|
- 0000000000000B47: FF 15 00 00 00 00 call qword ptr [__imp_MSVCRT$free]
|
|
|
- 0000000000000B4D: 48 8B 4C 24 38 mov rcx,qword ptr [rsp+38h]
|
|
|
- 0000000000000B52: FF 15 00 00 00 00 call qword ptr [__imp_MSVCRT$free]
|
|
|
- 0000000000000B58: 33 C0 xor eax,eax
|
|
|
- 0000000000000B5A: 48 83 C4 58 add rsp,58h
|
|
|
- 0000000000000B5E: C3 ret
|
|
|
- 0000000000000B5F: CC int 3
|
|
|
- 0000000000000B60: CC int 3
|
|
|
- 0000000000000B61: CC int 3
|
|
|
- 0000000000000B62: CC int 3
|
|
|
- 0000000000000B63: CC int 3
|
|
|
- 0000000000000B64: CC int 3
|
|
|
- 0000000000000B65: CC int 3
|
|
|
- 0000000000000B66: CC int 3
|
|
|
- 0000000000000B67: CC int 3
|
|
|
- 0000000000000B68: CC int 3
|
|
|
- 0000000000000B69: CC int 3
|
|
|
- 0000000000000B6A: CC int 3
|
|
|
- 0000000000000B6B: CC int 3
|
|
|
- 0000000000000B6C: CC int 3
|
|
|
- 0000000000000B6D: CC int 3
|
|
|
- 0000000000000B6E: CC int 3
|
|
|
- 0000000000000B6F: CC int 3
|
|
|
-FindMiniFilters:
|
|
|
- 0000000000000B70: 48 83 EC 68 sub rsp,68h
|
|
|
- 0000000000000B74: C7 44 24 38 00 04 mov dword ptr [rsp+38h],400h
|
|
|
- 00 00
|
|
|
- 0000000000000B7C: 8B 44 24 38 mov eax,dword ptr [rsp+38h]
|
|
|
- 0000000000000B80: 48 89 44 24 48 mov qword ptr [rsp+48h],rax
|
|
|
- 0000000000000B85: FF 15 00 00 00 00 call qword ptr [__imp_KERNEL32$GetProcessHeap]
|
|
|
- 0000000000000B8B: 48 8B 4C 24 48 mov rcx,qword ptr [rsp+48h]
|
|
|
- 0000000000000B90: 4C 8B C1 mov r8,rcx
|
|
|
- 0000000000000B93: 33 D2 xor edx,edx
|
|
|
- 0000000000000B95: 48 8B C8 mov rcx,rax
|
|
|
- 0000000000000B98: FF 15 00 00 00 00 call qword ptr [__imp_KERNEL32$HeapAlloc]
|
|
|
- 0000000000000B9E: 48 89 44 24 40 mov qword ptr [rsp+40h],rax
|
|
|
- 0000000000000BA3: C7 44 24 34 00 00 mov dword ptr [rsp+34h],0
|
|
|
- 00 00
|
|
|
- 0000000000000BAB: 8B 44 24 38 mov eax,dword ptr [rsp+38h]
|
|
|
- 0000000000000BAF: 48 8D 4C 24 50 lea rcx,[rsp+50h]
|
|
|
- 0000000000000BB4: 48 89 4C 24 20 mov qword ptr [rsp+20h],rcx
|
|
|
- 0000000000000BB9: 4C 8D 4C 24 3C lea r9,[rsp+3Ch]
|
|
|
- 0000000000000BBE: 44 8B C0 mov r8d,eax
|
|
|
- 0000000000000BC1: 48 8B 54 24 40 mov rdx,qword ptr [rsp+40h]
|
|
|
- 0000000000000BC6: B9 02 00 00 00 mov ecx,2
|
|
|
- 0000000000000BCB: FF 15 00 00 00 00 call qword ptr [__imp_Fltlib$FilterFindFirst]
|
|
|
- 0000000000000BD1: 89 44 24 30 mov dword ptr [rsp+30h],eax
|
|
|
- 0000000000000BD5: 81 7C 24 30 03 01 cmp dword ptr [rsp+30h],80070103h
|
|
|
- 07 80
|
|
|
- 0000000000000BDD: 75 09 jne 0000000000000BE8
|
|
|
- 0000000000000BDF: 8B 44 24 34 mov eax,dword ptr [rsp+34h]
|
|
|
- 0000000000000BE3: E9 A8 00 00 00 jmp 0000000000000C90
|
|
|
- 0000000000000BE8: 83 7C 24 30 00 cmp dword ptr [rsp+30h],0
|
|
|
- 0000000000000BED: 74 09 je 0000000000000BF8
|
|
|
- 0000000000000BEF: 8B 44 24 34 mov eax,dword ptr [rsp+34h]
|
|
|
- 0000000000000BF3: E9 98 00 00 00 jmp 0000000000000C90
|
|
|
- 0000000000000BF8: 48 8D 0D 00 00 00 lea rcx,[$SG105287]
|
|
|
- 00
|
|
|
- 0000000000000BFF: E8 00 00 00 00 call BeaconPrintToStreamW
|
|
|
- 0000000000000C04: 48 8D 0D 00 00 00 lea rcx,[$SG105288]
|
|
|
- 00
|
|
|
- 0000000000000C0B: E8 00 00 00 00 call BeaconPrintToStreamW
|
|
|
- 0000000000000C10: 48 8B 4C 24 40 mov rcx,qword ptr [rsp+40h]
|
|
|
- 0000000000000C15: E8 00 00 00 00 call PrintMiniFilterData
|
|
|
- 0000000000000C1A: C7 44 24 34 01 00 mov dword ptr [rsp+34h],1
|
|
|
- 00 00
|
|
|
- 0000000000000C22: 33 C0 xor eax,eax
|
|
|
- 0000000000000C24: 83 F8 01 cmp eax,1
|
|
|
- 0000000000000C27: 74 4D je 0000000000000C76
|
|
|
- 0000000000000C29: 48 8D 44 24 3C lea rax,[rsp+3Ch]
|
|
|
- 0000000000000C2E: 48 89 44 24 20 mov qword ptr [rsp+20h],rax
|
|
|
- 0000000000000C33: 44 8B 4C 24 38 mov r9d,dword ptr [rsp+38h]
|
|
|
- 0000000000000C38: 4C 8B 44 24 40 mov r8,qword ptr [rsp+40h]
|
|
|
- 0000000000000C3D: BA 02 00 00 00 mov edx,2
|
|
|
- 0000000000000C42: 48 8B 4C 24 50 mov rcx,qword ptr [rsp+50h]
|
|
|
- 0000000000000C47: FF 15 00 00 00 00 call qword ptr [__imp_Fltlib$FilterFindNext]
|
|
|
- 0000000000000C4D: 89 44 24 30 mov dword ptr [rsp+30h],eax
|
|
|
- 0000000000000C51: 81 7C 24 30 03 01 cmp dword ptr [rsp+30h],80070103h
|
|
|
- 07 80
|
|
|
- 0000000000000C59: 75 02 jne 0000000000000C5D
|
|
|
- 0000000000000C5B: EB 19 jmp 0000000000000C76
|
|
|
- 0000000000000C5D: 83 7C 24 30 00 cmp dword ptr [rsp+30h],0
|
|
|
- 0000000000000C62: 74 06 je 0000000000000C6A
|
|
|
- 0000000000000C64: 8B 44 24 34 mov eax,dword ptr [rsp+34h]
|
|
|
- 0000000000000C68: EB 26 jmp 0000000000000C90
|
|
|
- 0000000000000C6A: 48 8B 4C 24 40 mov rcx,qword ptr [rsp+40h]
|
|
|
- 0000000000000C6F: E8 00 00 00 00 call PrintMiniFilterData
|
|
|
- 0000000000000C74: EB AC jmp 0000000000000C22
|
|
|
- 0000000000000C76: FF 15 00 00 00 00 call qword ptr [__imp_KERNEL32$GetProcessHeap]
|
|
|
- 0000000000000C7C: 4C 8B 44 24 40 mov r8,qword ptr [rsp+40h]
|
|
|
- 0000000000000C81: 33 D2 xor edx,edx
|
|
|
- 0000000000000C83: 48 8B C8 mov rcx,rax
|
|
|
- 0000000000000C86: FF 15 00 00 00 00 call qword ptr [__imp_KERNEL32$HeapFree]
|
|
|
- 0000000000000C8C: 8B 44 24 34 mov eax,dword ptr [rsp+34h]
|
|
|
- 0000000000000C90: 48 83 C4 68 add rsp,68h
|
|
|
- 0000000000000C94: C3 ret
|
|
|
- 0000000000000C95: CC int 3
|
|
|
- 0000000000000C96: CC int 3
|
|
|
- 0000000000000C97: CC int 3
|
|
|
- 0000000000000C98: CC int 3
|
|
|
- 0000000000000C99: CC int 3
|
|
|
- 0000000000000C9A: CC int 3
|
|
|
- 0000000000000C9B: CC int 3
|
|
|
- 0000000000000C9C: CC int 3
|
|
|
- 0000000000000C9D: CC int 3
|
|
|
- 0000000000000C9E: CC int 3
|
|
|
- 0000000000000C9F: CC int 3
|
|
|
-go:
|
|
|
- 0000000000000CA0: 89 54 24 10 mov dword ptr [rsp+10h],edx
|
|
|
- 0000000000000CA4: 48 89 4C 24 08 mov qword ptr [rsp+8],rcx
|
|
|
- 0000000000000CA9: 48 83 EC 58 sub rsp,58h
|
|
|
- 0000000000000CAD: C7 44 24 20 00 00 mov dword ptr [rsp+20h],0
|
|
|
- 00 00
|
|
|
- 0000000000000CB5: 44 8B 44 24 68 mov r8d,dword ptr [rsp+68h]
|
|
|
- 0000000000000CBA: 48 8B 54 24 60 mov rdx,qword ptr [rsp+60h]
|
|
|
- 0000000000000CBF: 48 8D 4C 24 30 lea rcx,[rsp+30h]
|
|
|
- 0000000000000CC4: FF 15 00 00 00 00 call qword ptr [__imp_BeaconDataParse]
|
|
|
- 0000000000000CCA: 33 D2 xor edx,edx
|
|
|
- 0000000000000CCC: 48 8D 4C 24 30 lea rcx,[rsp+30h]
|
|
|
- 0000000000000CD1: FF 15 00 00 00 00 call qword ptr [__imp_BeaconDataExtract]
|
|
|
- 0000000000000CD7: 48 89 44 24 28 mov qword ptr [rsp+28h],rax
|
|
|
- 0000000000000CDC: 48 8D 15 00 00 00 lea rdx,[$SG105304]
|
|
|
- 00
|
|
|
- 0000000000000CE3: 48 8B 4C 24 28 mov rcx,qword ptr [rsp+28h]
|
|
|
- 0000000000000CE8: FF 15 00 00 00 00 call qword ptr [__imp_MSVCRT$strcmp]
|
|
|
- 0000000000000CEE: 85 C0 test eax,eax
|
|
|
- 0000000000000CF0: 75 3E jne 0000000000000D30
|
|
|
- 0000000000000CF2: E8 00 00 00 00 call FindSysmon
|
|
|
- 0000000000000CF7: 89 44 24 20 mov dword ptr [rsp+20h],eax
|
|
|
- 0000000000000CFB: 83 7C 24 20 00 cmp dword ptr [rsp+20h],0
|
|
|
- 0000000000000D00: 75 18 jne 0000000000000D1A
|
|
|
- 0000000000000D02: 48 8D 15 00 00 00 lea rdx,[$SG105307]
|
|
|
- 00
|
|
|
- 0000000000000D09: 33 C9 xor ecx,ecx
|
|
|
- 0000000000000D0B: FF 15 00 00 00 00 call qword ptr [__imp_BeaconPrintf]
|
|
|
- 0000000000000D11: 33 C0 xor eax,eax
|
|
|
- 0000000000000D13: E9 80 00 00 00 jmp 0000000000000D98
|
|
|
- 0000000000000D18: EB 14 jmp 0000000000000D2E
|
|
|
- 0000000000000D1A: E8 00 00 00 00 call BeaconOutputStreamW
|
|
|
- 0000000000000D1F: 48 8D 15 00 00 00 lea rdx,[$SG105308]
|
|
|
- 00
|
|
|
- 0000000000000D26: 33 C9 xor ecx,ecx
|
|
|
- 0000000000000D28: FF 15 00 00 00 00 call qword ptr [__imp_BeaconPrintf]
|
|
|
- 0000000000000D2E: EB 66 jmp 0000000000000D96
|
|
|
- 0000000000000D30: 48 8D 15 00 00 00 lea rdx,[$SG105311]
|
|
|
- 00
|
|
|
- 0000000000000D37: 48 8B 4C 24 28 mov rcx,qword ptr [rsp+28h]
|
|
|
- 0000000000000D3C: FF 15 00 00 00 00 call qword ptr [__imp_MSVCRT$strcmp]
|
|
|
- 0000000000000D42: 85 C0 test eax,eax
|
|
|
- 0000000000000D44: 75 3E jne 0000000000000D84
|
|
|
- 0000000000000D46: E8 00 00 00 00 call FindMiniFilters
|
|
|
- 0000000000000D4B: 89 44 24 20 mov dword ptr [rsp+20h],eax
|
|
|
- 0000000000000D4F: 83 7C 24 20 00 cmp dword ptr [rsp+20h],0
|
|
|
- 0000000000000D54: 75 18 jne 0000000000000D6E
|
|
|
- 0000000000000D56: 48 8D 15 00 00 00 lea rdx,[$SG105314]
|
|
|
- 00
|
|
|
- 0000000000000D5D: B9 0D 00 00 00 mov ecx,0Dh
|
|
|
- 0000000000000D62: FF 15 00 00 00 00 call qword ptr [__imp_BeaconPrintf]
|
|
|
- 0000000000000D68: 33 C0 xor eax,eax
|
|
|
- 0000000000000D6A: EB 2C jmp 0000000000000D98
|
|
|
- 0000000000000D6C: EB 14 jmp 0000000000000D82
|
|
|
- 0000000000000D6E: E8 00 00 00 00 call BeaconOutputStreamW
|
|
|
- 0000000000000D73: 48 8D 15 00 00 00 lea rdx,[$SG105315]
|
|
|
- 00
|
|
|
- 0000000000000D7A: 33 C9 xor ecx,ecx
|
|
|
- 0000000000000D7C: FF 15 00 00 00 00 call qword ptr [__imp_BeaconPrintf]
|
|
|
- 0000000000000D82: EB 12 jmp 0000000000000D96
|
|
|
- 0000000000000D84: 48 8D 15 00 00 00 lea rdx,[$SG105316]
|
|
|
- 00
|
|
|
- 0000000000000D8B: B9 0D 00 00 00 mov ecx,0Dh
|
|
|
- 0000000000000D90: FF 15 00 00 00 00 call qword ptr [__imp_BeaconPrintf]
|
|
|
- 0000000000000D96: 33 C0 xor eax,eax
|
|
|
- 0000000000000D98: 48 83 C4 58 add rsp,58h
|
|
|
- 0000000000000D9C: C3 ret
|
|
|
-
|
|
|
- Summary
|
|
|
-
|
|
|
- 38 .chks64
|
|
|
- 5DA .data
|
|
|
- 84 .debug$S
|
|
|
- DA .drectve
|
|
|
- 54 .pdata
|
|
|
- D9D .text$mn
|
|
|
- 3C .xdata
|
unknown