Function at 0x10001770
Capabilities:
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10013478
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x730
push ebx
push esi
push edi
xor ebx, ebx
mov ecx, 0x63
xor eax, eax
lea edi, [ebp - 0x33b]
mov byte [ebp - 0x33c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x31
xor eax, eax
lea edi, [ebp - 0x1ab]
mov byte [ebp - 0x1ac], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x18
xor eax, eax
lea edi, [ebp - 0x7f]
mov byte [ebp - 0x80], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x10], esp
lea eax, [ebp - 0x33c]
push str._idquery_TuxSingleCheckAction.do_opselect
push eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xfffffff6
call fcn.10002ba0
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x1ac]
push esi
push str.Referer:_http:___s_idquery_TuxSingleCheckAction.do_opinit
push ecx
call fcn.10002ba0
push esi
lea edx, [ebp - 0x80]
push str.Host:__s
push edx
call fcn.10002ba0
mov ecx, 0x18
xor eax, eax
lea edi, [ebp - 0xe3]
mov byte [ebp - 0xe4], bl
rep stosd dword es:[edi], eax
mov esi, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [ebp + 0x14]
mov eax, dword [ebp + 0xc]
push edi
push esi
push eax
push ecx
lea edx, [ebp - 0xe4]
push str.http:___s:_d_CIIS_idchk__pageContext.request.contextPath_idchk_PBCIdCardCheckAjaxAction.action_acName_scerNO_strCode0000trType05cerType1cerValidDatephEquipment02
push edx
mov dword [ebp - 4], ebx
call fcn.10002ba0
mov eax, dword [0x100196e0]
add esp, 0x38
mov dword [ebp + 0x14], eax
push 0x1001a9cc
lea ecx, [ebp + 0x10]
mov byte [ebp - 4], 1
call fcn.1000bcf1
push esi
lea ecx, [ebp + 0x14]
mov byte [ebp - 4], 2
call fcn.1000bdc0
lea ecx, [ebp + 0x14]
push ecx
call fcn.10001140
mov ecx, esp
mov dword [ebp + 0xc], esp
lea edx, [ebp + 0x14]
push edx
call fcn.1000b9f8
lea eax, [ebp + 0xc]
push eax
call fcn.10001ea0
add esp, 8
push eax
lea ecx, [ebp + 0x14]
mov byte [ebp - 4], 3
call fcn.1000bd70
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 2
call fcn.1000bc83
mov ecx, dword [0x1001a9a8]
push 0x20000000
push ebx
push ebx
push 1
push ebx
push str._idquery_TuxSingleCheckAction.do_opselect
push ebx
call fcn.10011831
or esi, 0xffffffff
mov ecx, eax
push esi
push 0x10000000
push str.Accept:_image_gif__image_x_xbitmap__image_jpeg__image_pjpeg__application_x_shockwave_flash__application_vnd.ms_excel__application_vnd.ms_powerpoint__application_msword___
mov dword [0x1001a9a4], ecx
call fcn.100119bb
push esi
lea ecx, [ebp - 0x1ac]
push 0x10000000
push ecx
mov ecx, dword [0x1001a9a4]
call fcn.100119bb
mov ecx, dword [0x1001a9a4]
push esi
push 0x10000000
push str.Accept_Language:_zh_cn
call fcn.100119bb
mov ecx, dword [0x1001a9a4]
push esi
push 0x10000000
push str.Content_Type:_application_x_www_form_urlencoded
call fcn.100119bb
mov ecx, dword [0x1001a9a4]
push esi
push 0x10000000
push str.Accept_Encoding:_gzip__deflate
call fcn.100119bb
mov ecx, dword [0x1001a9a4]
push esi
push 0x10000000
push str.User_Agent:_Mozilla_4.0__compatible__MSIE_6.0__Windows_NT_5.1__SV1__InfoPath.3_
call fcn.100119bb
mov ecx, dword [0x1001a9a4]
push esi
lea edx, [ebp - 0x80]
push 0x10000000
push edx
call fcn.100119bb
mov ecx, dword [0x1001a9a4]
push esi
push 0x10000000
push str.Content_Length:_128
call fcn.100119bb
mov ecx, dword [0x1001a9a4]
push esi
push 0x10000000
push str.Connection:_Keep_Alive
call fcn.100119bb
mov ecx, dword [0x1001a9a4]
push esi
push 0x10000000
push str.Cache_Control:_no_cache
call fcn.100119bb
mov eax, dword [ebp + 0x14]
push eax
push edi
lea ecx, [ebp + 0x10]
push str.PlatType02HavePhoto1ID1_sName1_sID2Name2ID3Name3ID4Name4ID5Name5
push ecx
call fcn.1000b448
mov ecx, dword [0x1001a9a4]
add esp, 0x10
lea edx, [ebp + 0x10]
push 0x10000000
push edx
call fcn.100119ee
mov eax, dword [ebp + 0x10]
mov ecx, dword [0x1001a9a4]
push 1
push 8
mov eax, dword [eax - 8]
push eax
call fcn.10011a6f
mov ecx, dword [0x1001a9a4]
mov eax, dword [ebp + 0x10]
push eax
mov edx, dword [ecx]
call dword [edx + 0x54]
mov ecx, dword [0x1001a9a4]
push ebx
push ebx
push ebx
push ebx
call fcn.10011a04
lea ecx, [ebp - 0x18]
push ecx
mov ecx, dword [0x1001a9a4]
call fcn.10011b12
mov eax, dword [ebp - 0x18]
cmp eax, 0xc8
jne 0x10001c26
mov ecx, dword [0x1001a9a4]
push 0x1001a9ac
mov edx, dword [ecx]
call dword [edx + 0x58]
cmp eax, ebx
je 0x10001bc3
push 0x1001a9ac
mov ecx, 0x1001a9b0
call fcn.1000bec0
push 0x1001a9b0
call fcn.10001210
add esp, 4
mov ecx, 0x1001a9b0
push 0x1001949c
call fcn.1000b107
cmp eax, ebx
jle 0x10001a7a
mov dword [ebp - 0x14], ebx
push str.idimage
mov ecx, 0x1001a9b0
call fcn.1000b107
cmp eax, ebx
jle 0x10001b39
cmp dword [ebp - 0x14], ebx
jne 0x10001b39
push 0x64
push eax
lea eax, [ebp + 0xc]
mov ecx, 0x1001a9b0
push eax
call fcn.1000b071
push eax
lea ecx, [ebp + 0x14]
mov byte [ebp - 4], 4
call fcn.1000bd70
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 2
call fcn.1000bc83
mov ecx, dword [ebp + 0x14]
push str.jpg_
mov esi, dword [ecx - 8]
lea ecx, [ebp + 0x14]
call fcn.1000b107
sub esi, eax
lea edx, [ebp + 0xc]
add esi, 8
lea ecx, [ebp + 0x14]
push esi
push ebx
push edx
call fcn.1000b071
push eax
lea ecx, [ebp + 0x10]
mov byte [ebp - 4], 5
call fcn.1000bd70
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 2
call fcn.1000bc83
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
push eax
push ecx
lea edx, [ebp + 0x10]
push str.http:___s_idquery__s
push edx
call fcn.1000b448
mov eax, dword [ebp + 0x10]
add esp, 0x10
push ebx
push ebx
push str.C:_szztweb_flashimagesidSourcePhoto.jpg
push eax
push ebx
call sub.urlmon.dll_URLDownloadToFileA
mov dword [ebp - 4], 2
jmp 0x10001bc3
push 0x10019424
mov ecx, 0x1001a9b0
call fcn.1000b107
cmp eax, ebx
jle 0x10001b51
mov dword [ebp - 0x14], esi
jmp 0x10001bc3
push 0x10019400
mov ecx, 0x1001a9b0
call fcn.1000b107
cmp eax, ebx
jle 0x10001b6d
mov dword [ebp - 0x14], 0xfffffffe
jmp 0x10001bc3
push 0x100193ec
mov ecx, 0x1001a9b0
call fcn.1000b107
cmp eax, ebx
jle 0x10001b89
mov dword [ebp - 0x14], 0xfffffffd
jmp 0x10001bc3
push 0x100193e0
mov ecx, 0x1001a9b0
call fcn.1000b107
cmp eax, ebx
jle 0x10001ba5
mov dword [ebp - 0x14], 0xfffffffc
jmp 0x10001bc3
push 0x100193d0
mov ecx, 0x1001a9b0
call fcn.1000b107
cmp eax, ebx
jle 0x10001a30
mov dword [ebp - 0x14], 0xfffffffb
lea ecx, [ebp + 0x10]
mov byte [ebp - 4], 1
call fcn.1000bc83
lea ecx, [ebp + 0x14]
mov byte [ebp - 4], bl
call fcn.1000bc83
mov ecx, dword [0x1001a9a4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ecx]
call dword [edx + 0x4c]
mov ecx, dword [0x1001a9a4]
cmp ecx, ebx
je 0x10001bfd
mov eax, dword [ecx]
push 1
call dword [eax + 4]
mov ecx, dword [0x1001a9a8]
mov edx, dword [ecx]
call dword [edx + 0xc]
mov ecx, 0x1001a9b8
call fcn.10010e08
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
push str.RhCheckID__QueryInfoStatusCode:_d
call fcn.10001fe0
mov ecx, dword [0x1001a9a4]
add esp, 8
mov eax, dword [ecx]
call dword [eax + 0x4c]
mov ecx, dword [0x1001a9a4]
cmp ecx, ebx
je 0x10001c50
mov edx, dword [ecx]
push 1
call dword [edx + 4]
mov ecx, dword [0x1001a9a8]
mov eax, dword [ecx]
call dword [eax + 0xc]
mov ecx, 0x1001a9b8
call fcn.10010e08
lea ecx, [ebp + 0x10]
mov byte [ebp - 4], 1
call fcn.1000bc83
lea ecx, [ebp + 0x14]
mov byte [ebp - 4], bl
call fcn.1000bc83
mov eax, 0xfffffff8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret