The DGA of Symmi sample b75f00d7ae2857a3e1cc8f5eb4dc11b9
10006520 ; =============== S U B R O U T I N E ======================================= | |
10006520 | |
10006520 ; Attributes: bp-based frame | |
10006520 | |
10006520 ; int __cdecl create_domain(int third_lvl_len, int second_and_top_lvl, size_t type) | |
10006520 create_domain proc near ; CODE XREF: calls_create_next_url+A30p | |
10006520 ; sub_1000B530+1A6p ... | |
10006520 | |
10006520 first_letters = dword ptr -0Ch | |
10006520 second_letters = dword ptr -8 | |
10006520 var_4 = dword ptr -4 | |
10006520 third_lvl_len = dword ptr 8 | |
10006520 second_and_top_lvl= dword ptr 0Ch | |
10006520 type = dword ptr 10h | |
10006520 | |
10006520 set_nr = edi | |
10006520 push ebp | |
10006521 mov ebp, esp | |
10006523 sub esp, 0Ch | |
10006526 push ebx | |
10006527 mov ebx, [ebp+third_lvl_len] | |
1000652A push esi | |
1000652B mov esi, eax | |
1000652D xor eax, eax | |
1000652F test byte ptr [ebp+type], 2 | |
10006533 push set_nr | |
10006534 jz loc_10006691 | |
1000653A mov set_nr, [ebp+second_and_top_lvl] | |
1000653D test set_nr, set_nr | |
1000653F jz short loc_1000654F | |
10006541 mov eax, set_nr | |
10006543 lea edx, [eax+1] | |
10006546 | |
10006546 loc_10006546: ; CODE XREF: create_domain+2Bj | |
10006546 mov cl, [eax] | |
10006548 inc eax | |
10006549 test cl, cl | |
1000654B jnz short loc_10006546 | |
1000654D sub eax, edx | |
1000654F | |
1000654F loc_1000654F: ; CODE XREF: create_domain+1Fj | |
1000654F add eax, 10h | |
10006552 mov [ebp+type], eax | |
10006555 | |
10006555 loc_10006555: ; CODE XREF: create_domain+51j | |
10006555 mov eax, [ebp+type] | |
10006558 push eax ; size_t | |
10006559 call _malloc_1 | |
1000655E mov ebx, eax | |
10006560 add esp, 4 | |
10006563 test ebx, ebx | |
10006565 jnz short loc_10006573 | |
10006567 push 1 ; unsigned __int32 | |
10006569 call __sleep_1 | |
1000656E add esp, 4 | |
10006571 jmp short loc_10006555 | |
10006573 ; --------------------------------------------------------------------------- | |
10006573 | |
10006573 loc_10006573: ; CODE XREF: create_domain+45j | |
10006573 mov eax, [esi] | |
10006575 imul eax, 343FDh | |
1000657B add eax, 269EC3h | |
10006580 mov [esi], eax | |
10006582 shr eax, 10h | |
10006585 and eax, 7FFFh | |
1000658A xor edx, edx | |
1000658C mov ecx, 13h | |
10006591 div ecx | |
10006593 movzx edx, byte ptr ds:consonants[edx] ; "bcdfghklmnpqrstvwxz" | |
1000659A sub dl, 20h | |
1000659D mov [ebx], dl | |
1000659F mov eax, [esi] | |
100065A1 imul eax, 343FDh | |
100065A7 add eax, 269EC3h | |
100065AC mov [esi], eax | |
100065AE shr eax, 10h | |
100065B1 and eax, 7FFFh | |
100065B6 xor edx, edx | |
100065B8 div ecx | |
100065BA mov ecx, 0Ah | |
100065BF movzx edx, byte ptr ds:consonants[edx] ; "bcdfghklmnpqrstvwxz" | |
100065C6 sub dl, 20h | |
100065C9 mov [ebx+1], dl | |
100065CC mov eax, [esi] | |
100065CE imul eax, 343FDh | |
100065D4 add eax, 269EC3h | |
100065D9 mov [esi], eax | |
100065DB shr eax, 10h | |
100065DE and eax, 7FFFh | |
100065E3 xor edx, edx | |
100065E5 div ecx | |
100065E7 add dl, 30h | |
100065EA mov [ebx+2], dl | |
100065ED mov eax, [esi] | |
100065EF imul eax, 343FDh | |
100065F5 add eax, 269EC3h | |
100065FA mov [esi], eax | |
100065FC shr eax, 10h | |
100065FF and eax, 7FFFh | |
10006604 xor edx, edx | |
10006606 div ecx | |
10006608 add dl, 30h | |
1000660B mov [ebx+3], dl | |
1000660E mov eax, [esi] | |
10006610 imul eax, 343FDh | |
10006616 add eax, 269EC3h | |
1000661B mov [esi], eax | |
1000661D shr eax, 10h | |
10006620 and eax, 7FFFh | |
10006625 xor edx, edx | |
10006627 div ecx | |
10006629 add dl, 30h | |
1000662C mov [ebx+4], dl | |
1000662F mov eax, [esi] | |
10006631 imul eax, 343FDh | |
10006637 add eax, 269EC3h | |
1000663C mov [esi], eax | |
1000663E shr eax, 10h | |
10006641 xor edx, edx | |
10006643 and eax, 7FFFh | |
10006648 div ecx | |
1000664A add dl, 30h | |
1000664D mov [ebx+5], dl | |
10006650 mov byte ptr [ebx+6], 0 | |
10006654 test set_nr, set_nr | |
10006656 jz short loc_10006688 | |
10006658 mov eax, set_nr | |
1000665A mov edx, set_nr | |
1000665C lea esp, [esp+0] | |
10006660 | |
10006660 loc_10006660: ; CODE XREF: create_domain+145j | |
10006660 mov cl, [eax] | |
10006662 inc eax | |
10006663 test cl, cl | |
10006665 jnz short loc_10006660 | |
10006667 sub eax, edx | |
10006669 lea set_nr, [ebx-1] | |
1000666C lea esp, [esp+0] | |
10006670 | |
10006670 loc_10006670: ; CODE XREF: create_domain+156j | |
10006670 mov cl, [set_nr+1] | |
10006673 inc set_nr | |
10006674 test cl, cl | |
10006676 jnz short loc_10006670 | |
10006678 mov ecx, eax | |
1000667A shr ecx, 2 | |
1000667D mov esi, edx | |
1000667F rep movsd | |
10006681 mov ecx, eax | |
10006683 and ecx, 3 | |
10006686 rep movsb | |
10006688 | |
10006688 loc_10006688: ; CODE XREF: create_domain+136j | |
10006688 pop set_nr | |
10006689 pop esi | |
1000668A mov eax, ebx | |
1000668C pop ebx | |
1000668D mov esp, ebp | |
1000668F pop ebp | |
10006690 retn | |
10006691 ; --------------------------------------------------------------------------- | |
10006691 | |
10006691 loc_10006691: ; CODE XREF: create_domain+14j | |
10006691 mov ecx, [ebp+second_and_top_lvl] | |
10006694 test ecx, ecx | |
10006696 jz short loc_100066A9 | |
10006698 mov eax, ecx | |
1000669A lea edx, [eax+1] | |
1000669D lea ecx, [ecx+0] | |
100066A0 | |
100066A0 loc_100066A0: ; CODE XREF: create_domain+185j | |
100066A0 mov cl, [eax] | |
100066A2 inc eax | |
100066A3 test cl, cl | |
100066A5 jnz short loc_100066A0 | |
100066A7 sub eax, edx | |
100066A9 | |
100066A9 loc_100066A9: ; CODE XREF: create_domain+176j | |
100066A9 lea set_nr, [eax+ebx+4] | |
100066AD lea ecx, [ecx+0] | |
100066B0 | |
100066B0 loc_100066B0: ; CODE XREF: create_domain+1AAj | |
100066B0 push set_nr ; size_t | |
100066B1 call _malloc_1 | |
100066B6 add esp, 4 | |
100066B9 mov [ebp+var_4], eax | |
100066BC test eax, eax | |
100066BE jnz short loc_100066CC | |
100066C0 push 1 ; unsigned __int32 | |
100066C2 call __sleep_1 | |
100066C7 add esp, 4 | |
100066CA jmp short loc_100066B0 | |
100066CC ; --------------------------------------------------------------------------- | |
100066CC | |
100066CC loc_100066CC: ; CODE XREF: create_domain+19Ej | |
100066CC mov ecx, [esi] | |
100066CE imul ecx, 343FDh | |
100066D4 add ecx, 269EC3h | |
100066DA mov [esi], ecx | |
100066DC mov edx, offset consonants ; "bcdfghklmnpqrstvwxz" | |
100066E1 test ecx, 1000000h | |
100066E7 jz short loc_100066F5 | |
100066E9 mov [ebp+first_letters], edx | |
100066EC mov [ebp+second_letters], offset vowels ; "aeiouy" | |
100066F3 jmp short loc_100066FF | |
100066F5 ; --------------------------------------------------------------------------- | |
100066F5 | |
100066F5 loc_100066F5: ; CODE XREF: create_domain+1C7j | |
100066F5 mov [ebp+first_letters], offset vowels ; "aeiouy" | |
100066FC mov [ebp+second_letters], edx | |
100066FF | |
100066FF loc_100066FF: ; CODE XREF: create_domain+1D3j | |
100066FF xor ecx, ecx | |
10006701 xor set_nr, set_nr | |
10006703 test ebx, ebx | |
10006705 jz loc_10006795 | |
1000670B jmp short loc_10006715 | |
1000670B ; --------------------------------------------------------------------------- | |
1000670D align 10h | |
10006710 | |
10006710 loc_10006710: ; CODE XREF: create_domain+26Fj | |
10006710 mov edx, offset consonants ; "bcdfghklmnpqrstvwxz" | |
10006715 | |
10006715 loc_10006715: ; CODE XREF: create_domain+1EBj | |
10006715 cmp set_nr, 2 | |
10006718 jnz short loc_10006748 | |
1000671A mov eax, [esi] | |
1000671C imul eax, 343FDh | |
10006722 add eax, 269EC3h | |
10006727 mov [esi], eax | |
10006729 test eax, 1000000h | |
1000672E jz short loc_1000673C | |
10006730 mov [ebp+first_letters], edx | |
10006733 mov [ebp+second_letters], offset vowels ; "aeiouy" | |
1000673A jmp short loc_10006746 | |
1000673C ; --------------------------------------------------------------------------- | |
1000673C | |
1000673C loc_1000673C: ; CODE XREF: create_domain+20Ej | |
1000673C mov [ebp+first_letters], offset vowels ; "aeiouy" | |
10006743 mov [ebp+second_letters], edx | |
10006746 | |
10006746 loc_10006746: ; CODE XREF: create_domain+21Aj | |
10006746 xor set_nr, set_nr | |
10006748 | |
10006748 loc_10006748: ; CODE XREF: create_domain+1F8j | |
10006748 cmp [ebp+set_nr*4+first_letters], offset vowels ; "aeiouy" | |
10006750 mov edx, 13h | |
10006755 jnz short loc_1000675C | |
10006757 mov edx, 6 | |
1000675C | |
1000675C loc_1000675C: ; CODE XREF: create_domain+235j | |
1000675C mov eax, [esi] | |
1000675E imul eax, 343FDh | |
10006764 add eax, 269EC3h | |
10006769 mov [esi], eax | |
1000676B shr eax, 10h | |
1000676E lea ebx, [edx-1] | |
10006771 and eax, 7FFFh | |
10006776 xor edx, edx | |
10006778 div ebx | |
1000677A mov eax, [ebp+set_nr*4+first_letters] | |
1000677E mov ebx, [ebp+third_lvl_len] | |
10006781 inc ecx | |
10006782 inc set_nr | |
10006783 mov dl, [edx+eax] | |
10006786 mov eax, [ebp+var_4] | |
10006789 mov [eax+ecx-1], dl | |
1000678D cmp ecx, ebx | |
1000678F jb loc_10006710 | |
10006795 | |
10006795 loc_10006795: ; CODE XREF: create_domain+1E5j | |
10006795 test byte ptr [ebp+type], 1 | |
10006799 jnz short loc_100067D7 | |
1000679B add byte ptr [eax], 0E0h | |
1000679E mov ecx, 1 | |
100067A3 xor set_nr, set_nr | |
100067A5 cmp ebx, ecx | |
100067A7 jbe short loc_100067D7 | |
100067A9 lea esp, [esp+0] | |
100067B0 | |
100067B0 loc_100067B0: ; CODE XREF: create_domain+2B5j | |
100067B0 cmp set_nr, 3 | |
100067B3 jnz short loc_100067D1 | |
100067B5 mov edx, [esi] | |
100067B7 imul edx, 343FDh | |
100067BD add edx, 269EC3h | |
100067C3 mov [esi], edx | |
100067C5 test edx, 1000000h | |
100067CB jz short loc_100067D1 | |
100067CD add byte ptr [eax+ecx], 0E0h | |
100067D1 | |
100067D1 loc_100067D1: ; CODE XREF: create_domain+293j | |
100067D1 ; create_domain+2ABj | |
100067D1 inc ecx | |
100067D2 inc set_nr | |
100067D3 cmp ecx, ebx | |
100067D5 jb short loc_100067B0 | |
100067D7 | |
100067D7 loc_100067D7: ; CODE XREF: create_domain+279j | |
100067D7 ; create_domain+287j | |
100067D7 mov ecx, [ebp+second_and_top_lvl] | |
100067DA mov byte ptr [eax+ebx], 0 | |
100067DE test ecx, ecx | |
100067E0 jz short loc_10006808 | |
100067E2 mov esi, ecx | |
100067E4 | |
100067E4 loc_100067E4: ; CODE XREF: create_domain+2C9j | |
100067E4 mov dl, [ecx] | |
100067E6 inc ecx | |
100067E7 test dl, dl | |
100067E9 jnz short loc_100067E4 | |
100067EB sub ecx, esi | |
100067ED mov edx, ecx | |
100067EF lea set_nr, [eax-1] | |
100067F2 | |
100067F2 loc_100067F2: ; CODE XREF: create_domain+2D8j | |
100067F2 mov cl, [set_nr+1] | |
100067F5 inc set_nr | |
100067F6 test cl, cl | |
100067F8 jnz short loc_100067F2 | |
100067FA mov ecx, edx | |
100067FC shr ecx, 2 | |
100067FF rep movsd | |
10006801 mov ecx, edx | |
10006803 and ecx, 3 | |
10006806 rep movsb | |
10006808 | |
10006808 loc_10006808: ; CODE XREF: create_domain+2C0j | |
10006808 pop set_nr | |
10006809 pop esi | |
1000680A pop ebx | |
1000680B mov esp, ebp | |
1000680D pop ebp | |
1000680E retn | |
1000680E create_domain endp |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment