The DGA of Symmi sample b75f00d7ae2857a3e1cc8f5eb4dc11b9
| 10006520 ; =============== S U B R O U T I N E ======================================= | |
| 10006520 | |
| 10006520 ; Attributes: bp-based frame | |
| 10006520 | |
| 10006520 ; int __cdecl create_domain(int third_lvl_len, int second_and_top_lvl, size_t type) | |
| 10006520 create_domain proc near ; CODE XREF: calls_create_next_url+A30p | |
| 10006520 ; sub_1000B530+1A6p ... | |
| 10006520 | |
| 10006520 first_letters = dword ptr -0Ch | |
| 10006520 second_letters = dword ptr -8 | |
| 10006520 var_4 = dword ptr -4 | |
| 10006520 third_lvl_len = dword ptr 8 | |
| 10006520 second_and_top_lvl= dword ptr 0Ch | |
| 10006520 type = dword ptr 10h | |
| 10006520 | |
| 10006520 set_nr = edi | |
| 10006520 push ebp | |
| 10006521 mov ebp, esp | |
| 10006523 sub esp, 0Ch | |
| 10006526 push ebx | |
| 10006527 mov ebx, [ebp+third_lvl_len] | |
| 1000652A push esi | |
| 1000652B mov esi, eax | |
| 1000652D xor eax, eax | |
| 1000652F test byte ptr [ebp+type], 2 | |
| 10006533 push set_nr | |
| 10006534 jz loc_10006691 | |
| 1000653A mov set_nr, [ebp+second_and_top_lvl] | |
| 1000653D test set_nr, set_nr | |
| 1000653F jz short loc_1000654F | |
| 10006541 mov eax, set_nr | |
| 10006543 lea edx, [eax+1] | |
| 10006546 | |
| 10006546 loc_10006546: ; CODE XREF: create_domain+2Bj | |
| 10006546 mov cl, [eax] | |
| 10006548 inc eax | |
| 10006549 test cl, cl | |
| 1000654B jnz short loc_10006546 | |
| 1000654D sub eax, edx | |
| 1000654F | |
| 1000654F loc_1000654F: ; CODE XREF: create_domain+1Fj | |
| 1000654F add eax, 10h | |
| 10006552 mov [ebp+type], eax | |
| 10006555 | |
| 10006555 loc_10006555: ; CODE XREF: create_domain+51j | |
| 10006555 mov eax, [ebp+type] | |
| 10006558 push eax ; size_t | |
| 10006559 call _malloc_1 | |
| 1000655E mov ebx, eax | |
| 10006560 add esp, 4 | |
| 10006563 test ebx, ebx | |
| 10006565 jnz short loc_10006573 | |
| 10006567 push 1 ; unsigned __int32 | |
| 10006569 call __sleep_1 | |
| 1000656E add esp, 4 | |
| 10006571 jmp short loc_10006555 | |
| 10006573 ; --------------------------------------------------------------------------- | |
| 10006573 | |
| 10006573 loc_10006573: ; CODE XREF: create_domain+45j | |
| 10006573 mov eax, [esi] | |
| 10006575 imul eax, 343FDh | |
| 1000657B add eax, 269EC3h | |
| 10006580 mov [esi], eax | |
| 10006582 shr eax, 10h | |
| 10006585 and eax, 7FFFh | |
| 1000658A xor edx, edx | |
| 1000658C mov ecx, 13h | |
| 10006591 div ecx | |
| 10006593 movzx edx, byte ptr ds:consonants[edx] ; "bcdfghklmnpqrstvwxz" | |
| 1000659A sub dl, 20h | |
| 1000659D mov [ebx], dl | |
| 1000659F mov eax, [esi] | |
| 100065A1 imul eax, 343FDh | |
| 100065A7 add eax, 269EC3h | |
| 100065AC mov [esi], eax | |
| 100065AE shr eax, 10h | |
| 100065B1 and eax, 7FFFh | |
| 100065B6 xor edx, edx | |
| 100065B8 div ecx | |
| 100065BA mov ecx, 0Ah | |
| 100065BF movzx edx, byte ptr ds:consonants[edx] ; "bcdfghklmnpqrstvwxz" | |
| 100065C6 sub dl, 20h | |
| 100065C9 mov [ebx+1], dl | |
| 100065CC mov eax, [esi] | |
| 100065CE imul eax, 343FDh | |
| 100065D4 add eax, 269EC3h | |
| 100065D9 mov [esi], eax | |
| 100065DB shr eax, 10h | |
| 100065DE and eax, 7FFFh | |
| 100065E3 xor edx, edx | |
| 100065E5 div ecx | |
| 100065E7 add dl, 30h | |
| 100065EA mov [ebx+2], dl | |
| 100065ED mov eax, [esi] | |
| 100065EF imul eax, 343FDh | |
| 100065F5 add eax, 269EC3h | |
| 100065FA mov [esi], eax | |
| 100065FC shr eax, 10h | |
| 100065FF and eax, 7FFFh | |
| 10006604 xor edx, edx | |
| 10006606 div ecx | |
| 10006608 add dl, 30h | |
| 1000660B mov [ebx+3], dl | |
| 1000660E mov eax, [esi] | |
| 10006610 imul eax, 343FDh | |
| 10006616 add eax, 269EC3h | |
| 1000661B mov [esi], eax | |
| 1000661D shr eax, 10h | |
| 10006620 and eax, 7FFFh | |
| 10006625 xor edx, edx | |
| 10006627 div ecx | |
| 10006629 add dl, 30h | |
| 1000662C mov [ebx+4], dl | |
| 1000662F mov eax, [esi] | |
| 10006631 imul eax, 343FDh | |
| 10006637 add eax, 269EC3h | |
| 1000663C mov [esi], eax | |
| 1000663E shr eax, 10h | |
| 10006641 xor edx, edx | |
| 10006643 and eax, 7FFFh | |
| 10006648 div ecx | |
| 1000664A add dl, 30h | |
| 1000664D mov [ebx+5], dl | |
| 10006650 mov byte ptr [ebx+6], 0 | |
| 10006654 test set_nr, set_nr | |
| 10006656 jz short loc_10006688 | |
| 10006658 mov eax, set_nr | |
| 1000665A mov edx, set_nr | |
| 1000665C lea esp, [esp+0] | |
| 10006660 | |
| 10006660 loc_10006660: ; CODE XREF: create_domain+145j | |
| 10006660 mov cl, [eax] | |
| 10006662 inc eax | |
| 10006663 test cl, cl | |
| 10006665 jnz short loc_10006660 | |
| 10006667 sub eax, edx | |
| 10006669 lea set_nr, [ebx-1] | |
| 1000666C lea esp, [esp+0] | |
| 10006670 | |
| 10006670 loc_10006670: ; CODE XREF: create_domain+156j | |
| 10006670 mov cl, [set_nr+1] | |
| 10006673 inc set_nr | |
| 10006674 test cl, cl | |
| 10006676 jnz short loc_10006670 | |
| 10006678 mov ecx, eax | |
| 1000667A shr ecx, 2 | |
| 1000667D mov esi, edx | |
| 1000667F rep movsd | |
| 10006681 mov ecx, eax | |
| 10006683 and ecx, 3 | |
| 10006686 rep movsb | |
| 10006688 | |
| 10006688 loc_10006688: ; CODE XREF: create_domain+136j | |
| 10006688 pop set_nr | |
| 10006689 pop esi | |
| 1000668A mov eax, ebx | |
| 1000668C pop ebx | |
| 1000668D mov esp, ebp | |
| 1000668F pop ebp | |
| 10006690 retn | |
| 10006691 ; --------------------------------------------------------------------------- | |
| 10006691 | |
| 10006691 loc_10006691: ; CODE XREF: create_domain+14j | |
| 10006691 mov ecx, [ebp+second_and_top_lvl] | |
| 10006694 test ecx, ecx | |
| 10006696 jz short loc_100066A9 | |
| 10006698 mov eax, ecx | |
| 1000669A lea edx, [eax+1] | |
| 1000669D lea ecx, [ecx+0] | |
| 100066A0 | |
| 100066A0 loc_100066A0: ; CODE XREF: create_domain+185j | |
| 100066A0 mov cl, [eax] | |
| 100066A2 inc eax | |
| 100066A3 test cl, cl | |
| 100066A5 jnz short loc_100066A0 | |
| 100066A7 sub eax, edx | |
| 100066A9 | |
| 100066A9 loc_100066A9: ; CODE XREF: create_domain+176j | |
| 100066A9 lea set_nr, [eax+ebx+4] | |
| 100066AD lea ecx, [ecx+0] | |
| 100066B0 | |
| 100066B0 loc_100066B0: ; CODE XREF: create_domain+1AAj | |
| 100066B0 push set_nr ; size_t | |
| 100066B1 call _malloc_1 | |
| 100066B6 add esp, 4 | |
| 100066B9 mov [ebp+var_4], eax | |
| 100066BC test eax, eax | |
| 100066BE jnz short loc_100066CC | |
| 100066C0 push 1 ; unsigned __int32 | |
| 100066C2 call __sleep_1 | |
| 100066C7 add esp, 4 | |
| 100066CA jmp short loc_100066B0 | |
| 100066CC ; --------------------------------------------------------------------------- | |
| 100066CC | |
| 100066CC loc_100066CC: ; CODE XREF: create_domain+19Ej | |
| 100066CC mov ecx, [esi] | |
| 100066CE imul ecx, 343FDh | |
| 100066D4 add ecx, 269EC3h | |
| 100066DA mov [esi], ecx | |
| 100066DC mov edx, offset consonants ; "bcdfghklmnpqrstvwxz" | |
| 100066E1 test ecx, 1000000h | |
| 100066E7 jz short loc_100066F5 | |
| 100066E9 mov [ebp+first_letters], edx | |
| 100066EC mov [ebp+second_letters], offset vowels ; "aeiouy" | |
| 100066F3 jmp short loc_100066FF | |
| 100066F5 ; --------------------------------------------------------------------------- | |
| 100066F5 | |
| 100066F5 loc_100066F5: ; CODE XREF: create_domain+1C7j | |
| 100066F5 mov [ebp+first_letters], offset vowels ; "aeiouy" | |
| 100066FC mov [ebp+second_letters], edx | |
| 100066FF | |
| 100066FF loc_100066FF: ; CODE XREF: create_domain+1D3j | |
| 100066FF xor ecx, ecx | |
| 10006701 xor set_nr, set_nr | |
| 10006703 test ebx, ebx | |
| 10006705 jz loc_10006795 | |
| 1000670B jmp short loc_10006715 | |
| 1000670B ; --------------------------------------------------------------------------- | |
| 1000670D align 10h | |
| 10006710 | |
| 10006710 loc_10006710: ; CODE XREF: create_domain+26Fj | |
| 10006710 mov edx, offset consonants ; "bcdfghklmnpqrstvwxz" | |
| 10006715 | |
| 10006715 loc_10006715: ; CODE XREF: create_domain+1EBj | |
| 10006715 cmp set_nr, 2 | |
| 10006718 jnz short loc_10006748 | |
| 1000671A mov eax, [esi] | |
| 1000671C imul eax, 343FDh | |
| 10006722 add eax, 269EC3h | |
| 10006727 mov [esi], eax | |
| 10006729 test eax, 1000000h | |
| 1000672E jz short loc_1000673C | |
| 10006730 mov [ebp+first_letters], edx | |
| 10006733 mov [ebp+second_letters], offset vowels ; "aeiouy" | |
| 1000673A jmp short loc_10006746 | |
| 1000673C ; --------------------------------------------------------------------------- | |
| 1000673C | |
| 1000673C loc_1000673C: ; CODE XREF: create_domain+20Ej | |
| 1000673C mov [ebp+first_letters], offset vowels ; "aeiouy" | |
| 10006743 mov [ebp+second_letters], edx | |
| 10006746 | |
| 10006746 loc_10006746: ; CODE XREF: create_domain+21Aj | |
| 10006746 xor set_nr, set_nr | |
| 10006748 | |
| 10006748 loc_10006748: ; CODE XREF: create_domain+1F8j | |
| 10006748 cmp [ebp+set_nr*4+first_letters], offset vowels ; "aeiouy" | |
| 10006750 mov edx, 13h | |
| 10006755 jnz short loc_1000675C | |
| 10006757 mov edx, 6 | |
| 1000675C | |
| 1000675C loc_1000675C: ; CODE XREF: create_domain+235j | |
| 1000675C mov eax, [esi] | |
| 1000675E imul eax, 343FDh | |
| 10006764 add eax, 269EC3h | |
| 10006769 mov [esi], eax | |
| 1000676B shr eax, 10h | |
| 1000676E lea ebx, [edx-1] | |
| 10006771 and eax, 7FFFh | |
| 10006776 xor edx, edx | |
| 10006778 div ebx | |
| 1000677A mov eax, [ebp+set_nr*4+first_letters] | |
| 1000677E mov ebx, [ebp+third_lvl_len] | |
| 10006781 inc ecx | |
| 10006782 inc set_nr | |
| 10006783 mov dl, [edx+eax] | |
| 10006786 mov eax, [ebp+var_4] | |
| 10006789 mov [eax+ecx-1], dl | |
| 1000678D cmp ecx, ebx | |
| 1000678F jb loc_10006710 | |
| 10006795 | |
| 10006795 loc_10006795: ; CODE XREF: create_domain+1E5j | |
| 10006795 test byte ptr [ebp+type], 1 | |
| 10006799 jnz short loc_100067D7 | |
| 1000679B add byte ptr [eax], 0E0h | |
| 1000679E mov ecx, 1 | |
| 100067A3 xor set_nr, set_nr | |
| 100067A5 cmp ebx, ecx | |
| 100067A7 jbe short loc_100067D7 | |
| 100067A9 lea esp, [esp+0] | |
| 100067B0 | |
| 100067B0 loc_100067B0: ; CODE XREF: create_domain+2B5j | |
| 100067B0 cmp set_nr, 3 | |
| 100067B3 jnz short loc_100067D1 | |
| 100067B5 mov edx, [esi] | |
| 100067B7 imul edx, 343FDh | |
| 100067BD add edx, 269EC3h | |
| 100067C3 mov [esi], edx | |
| 100067C5 test edx, 1000000h | |
| 100067CB jz short loc_100067D1 | |
| 100067CD add byte ptr [eax+ecx], 0E0h | |
| 100067D1 | |
| 100067D1 loc_100067D1: ; CODE XREF: create_domain+293j | |
| 100067D1 ; create_domain+2ABj | |
| 100067D1 inc ecx | |
| 100067D2 inc set_nr | |
| 100067D3 cmp ecx, ebx | |
| 100067D5 jb short loc_100067B0 | |
| 100067D7 | |
| 100067D7 loc_100067D7: ; CODE XREF: create_domain+279j | |
| 100067D7 ; create_domain+287j | |
| 100067D7 mov ecx, [ebp+second_and_top_lvl] | |
| 100067DA mov byte ptr [eax+ebx], 0 | |
| 100067DE test ecx, ecx | |
| 100067E0 jz short loc_10006808 | |
| 100067E2 mov esi, ecx | |
| 100067E4 | |
| 100067E4 loc_100067E4: ; CODE XREF: create_domain+2C9j | |
| 100067E4 mov dl, [ecx] | |
| 100067E6 inc ecx | |
| 100067E7 test dl, dl | |
| 100067E9 jnz short loc_100067E4 | |
| 100067EB sub ecx, esi | |
| 100067ED mov edx, ecx | |
| 100067EF lea set_nr, [eax-1] | |
| 100067F2 | |
| 100067F2 loc_100067F2: ; CODE XREF: create_domain+2D8j | |
| 100067F2 mov cl, [set_nr+1] | |
| 100067F5 inc set_nr | |
| 100067F6 test cl, cl | |
| 100067F8 jnz short loc_100067F2 | |
| 100067FA mov ecx, edx | |
| 100067FC shr ecx, 2 | |
| 100067FF rep movsd | |
| 10006801 mov ecx, edx | |
| 10006803 and ecx, 3 | |
| 10006806 rep movsb | |
| 10006808 | |
| 10006808 loc_10006808: ; CODE XREF: create_domain+2C0j | |
| 10006808 pop set_nr | |
| 10006809 pop esi | |
| 1000680A pop ebx | |
| 1000680B mov esp, ebp | |
| 1000680D pop ebp | |
| 1000680E retn | |
| 1000680E create_domain endp |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment