Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- ;; How the network interface data grabbed | #MalwareMustDie - @unixfreaxjp /malware/Iptablex]$ date
- ;; Mon Jun 16 14:08:28 JST 2014
- .text:0804EAB0 public getethinfo
- .text:0804EAB0 getethinfo proc near
- .text:0804EAB0
- .text:0804EAB0 var_248 = dword ptr -248h
- .text:0804EAB0 var_244 = dword ptr -244h
- .text:0804EAB0 var_240 = dword ptr -240h
- .text:0804EAB0 var_238 = dword ptr -238h
- .text:0804EAB0 var_234 = dword ptr -234h
- .text:0804EAB0 var_22E = word ptr -22Eh
- .text:0804EAB0 var_220 = dword ptr -220h
- .text:0804EAB0 var_20 = dword ptr -20h
- .text:0804EAB0 var_1C = dword ptr -1Ch
- .text:0804EAB0 var_18 = dword ptr -18h
- .text:0804EAB0 var_14 = dword ptr -14h
- .text:0804EAB0 var_10 = dword ptr -10h
- .text:0804EAB0 arg_0 = dword ptr 8
- .text:0804EAB0
- .text:0804EAB0 push ebp
- .text:0804EAB1 mov ebp, esp
- .text:0804EAB3 push edi
- .text:0804EAB4 push esi
- .text:0804EAB5 push ebx
- .text:0804EAB6 sub esp, 23Ch
- .text:0804EABC mov [esp+248h+var_244], 80B3847h
- .text:0804EAC4 mov [esp+248h+var_248], offset aProcNetDev
- ; this offse contains "/proc/net/dev"
- .text:0804EACB call fopen
- .text:0804EAD0 mov [ebp+var_234], eax
- .text:0804EAD6 mov esi, [ebp+var_234]
- .text:0804EADC xor eax, eax
- .text:0804EADE test esi, esi
- .text:0804EAE0 jz loc_804ECA7
- .text:0804EAE6 mov eax, [ebp+var_234]
- .text:0804EAEC lea edx, [ebp+var_220]
- .text:0804EAF2 mov [esp+248h+var_248], edx
- .text:0804EAF5 mov [esp+248h+var_244], 200h
- .text:0804EAFD mov [esp+248h+var_240], eax
- .text:0804EB01 call fgets
- .text:0804EB06 lea eax, [ebp+var_220]
- .text:0804EB0C mov [esp+248h+var_240], 200h
- .text:0804EB14 mov [esp+248h+var_244], 0
- .text:0804EB1C mov [esp+248h+var_248], eax
- .text:0804EB1F call memset
- .text:0804EB24 mov [ebp+var_22E], 0
- .text:0804EB2D lea esi, [esi+0]
- .text:0804EB30
- .text:0804EB30 loc_804EB30:
- .text:0804EB30 mov eax, [ebp+var_234]
- .text:0804EB36 lea edx, [ebp+var_220]
- .text:0804EB3C mov [esp+248h+var_244], 200h
- .text:0804EB44 mov [esp+248h+var_248], edx
- .text:0804EB47 mov [esp+248h+var_240], eax
- .text:0804EB4B call fgets
- .text:0804EB50 test eax, eax
- .text:0804EB52 jz loc_804EC92
- .text:0804EB58 lea esi, [ebp+var_220]
- .text:0804EB5E mov [ebp+var_20], 0
- .text:0804EB65 mov [ebp+var_1C], 0
- .text:0804EB6C mov [ebp+var_18], 0
- .text:0804EB73 mov [ebp+var_14], 0
- .text:0804EB7A jmp short loc_804EB83
- ;; #MalwareMustDie
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement