;; How the network interface data grabbed | #MalwareMustDie - @unixfreaxjp /malware/Iptablex]$ date
;; Mon Jun 16 14:08:28 JST 2014

.text:0804EAB0 public getethinfo
.text:0804EAB0 getethinfo      proc near 
.text:0804EAB0
.text:0804EAB0 var_248         = dword ptr -248h
.text:0804EAB0 var_244         = dword ptr -244h
.text:0804EAB0 var_240         = dword ptr -240h
.text:0804EAB0 var_238         = dword ptr -238h
.text:0804EAB0 var_234         = dword ptr -234h
.text:0804EAB0 var_22E         = word ptr -22Eh
.text:0804EAB0 var_220         = dword ptr -220h
.text:0804EAB0 var_20          = dword ptr -20h
.text:0804EAB0 var_1C          = dword ptr -1Ch
.text:0804EAB0 var_18          = dword ptr -18h
.text:0804EAB0 var_14          = dword ptr -14h
.text:0804EAB0 var_10          = dword ptr -10h
.text:0804EAB0 arg_0           = dword ptr  8
.text:0804EAB0
.text:0804EAB0                 push    ebp
.text:0804EAB1                 mov     ebp, esp
.text:0804EAB3                 push    edi
.text:0804EAB4                 push    esi
.text:0804EAB5                 push    ebx
.text:0804EAB6                 sub     esp, 23Ch
.text:0804EABC                 mov     [esp+248h+var_244], 80B3847h
.text:0804EAC4                 mov     [esp+248h+var_248], offset aProcNetDev 
                                           ; this offse contains "/proc/net/dev"
.text:0804EACB                 call    fopen
.text:0804EAD0                 mov     [ebp+var_234], eax
.text:0804EAD6                 mov     esi, [ebp+var_234]
.text:0804EADC                 xor     eax, eax
.text:0804EADE                 test    esi, esi
.text:0804EAE0                 jz      loc_804ECA7
.text:0804EAE6                 mov     eax, [ebp+var_234]
.text:0804EAEC                 lea     edx, [ebp+var_220]
.text:0804EAF2                 mov     [esp+248h+var_248], edx
.text:0804EAF5                 mov     [esp+248h+var_244], 200h
.text:0804EAFD                 mov     [esp+248h+var_240], eax
.text:0804EB01                 call    fgets
.text:0804EB06                 lea     eax, [ebp+var_220]
.text:0804EB0C                 mov     [esp+248h+var_240], 200h
.text:0804EB14                 mov     [esp+248h+var_244], 0
.text:0804EB1C                 mov     [esp+248h+var_248], eax
.text:0804EB1F                 call    memset
.text:0804EB24                 mov     [ebp+var_22E], 0
.text:0804EB2D                 lea     esi, [esi+0]
.text:0804EB30
.text:0804EB30 loc_804EB30:                    
.text:0804EB30                 mov     eax, [ebp+var_234]
.text:0804EB36                 lea     edx, [ebp+var_220]
.text:0804EB3C                 mov     [esp+248h+var_244], 200h
.text:0804EB44                 mov     [esp+248h+var_248], edx
.text:0804EB47                 mov     [esp+248h+var_240], eax
.text:0804EB4B                 call    fgets
.text:0804EB50                 test    eax, eax
.text:0804EB52                 jz      loc_804EC92
.text:0804EB58                 lea     esi, [ebp+var_220]
.text:0804EB5E                 mov     [ebp+var_20], 0
.text:0804EB65                 mov     [ebp+var_1C], 0
.text:0804EB6C                 mov     [ebp+var_18], 0
.text:0804EB73                 mov     [ebp+var_14], 0
.text:0804EB7A                 jmp     short loc_804EB83

;; #MalwareMustDie