Function at 0x1000309d
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 8
call fcn.1000d129
add esp, 4
mov dword [ebp - 0xc], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebp - 0x10], 0
push 8
call fcn.1000d129
add esp, 4
mov dword [ebp - 0x14], eax
mov edi, eax
mov esi, 0x100a8172
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
push 0x10
call fcn.1000d129
add esp, 4
mov dword [ebp - 0x28], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov eax, 3
mov dword [ebx], eax
mov dword [ebp - 0x2c], 0
push 8
call fcn.1000d129
add esp, 4
mov dword [ebp - 0x30], eax
mov edi, eax
mov esi, 0x100a8172
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
cmp dword [ebp + 0x30], 0
mov eax, 0
sete al
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jne 0x100031b3
mov ebx, dword [ebp + 0x2c]
mov eax, dword [ebx]
test eax, eax
je 0x1000319e
push eax
mov ebx, eax
call fcn.100012a7
inc eax
push eax
call fcn.1000d129
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x100031af
push ebx
call fcn.1000d12f
add esp, 4
pop eax
mov dword [ebp - 4], eax
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x100031c6
mov eax, 0x100a7fc0
push eax
push 1
mov ebx, 0x1000d350
call fcn.1000d123
add esp, 0x10
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jne 0x10003222
push 0x100a8259
mov ebx, dword [ebp + 8]
push dword [ebx]
push str.Accept:__r_nReferer:
mov ecx, 3
call fcn.10001937
add esp, 0xc
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x10003219
push ebx
call fcn.1000d12f
add esp, 4
pop eax
mov dword [ebp - 4], eax
jmp 0x100035c9
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x10003235
mov eax, 0x100a7fc0
push eax
push 1
mov ebx, 0x1000d940
call fcn.1000d123
add esp, 0x10
mov dword [ebp - 0x34], eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push 0
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.accept
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 0x34]
test eax, eax
jne 0x1000327c
mov eax, 0x100a7fc0
push eax
push 4
mov ebx, 0x1000d790
call fcn.1000d123
add esp, 0x34
mov dword [ebp - 0x38], eax
mov ebx, dword [ebp - 0x34]
test ebx, ebx
je 0x100032a2
push ebx
call fcn.1000d12f
add esp, 4
cmp dword [ebp - 0x38], 0xffffffff
jne 0x100032dc
push str._r_nAccept:__
push dword [ebp - 4]
mov ecx, 2
call fcn.10001937
add esp, 8
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x100032d8
push ebx
call fcn.1000d12f
add esp, 4
pop eax
mov dword [ebp - 4], eax
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x100032ef
mov eax, 0x100a7fc0
push eax
push 1
mov ebx, 0x1000d940
call fcn.1000d123
add esp, 0x10
mov dword [ebp - 0x34], eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push 0
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.referer
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 0x34]
test eax, eax
jne 0x10003336
mov eax, 0x100a7fc0
push eax
push 4
mov ebx, 0x1000d790
call fcn.1000d123
add esp, 0x34
mov dword [ebp - 0x38], eax
mov ebx, dword [ebp - 0x34]
test ebx, ebx
je 0x1000335c
push ebx
call fcn.1000d12f
add esp, 4
cmp dword [ebp - 0x38], 0xffffffff
jne 0x1000339b
mov ebx, dword [ebp + 8]
push dword [ebx]
push str._r_nReferer:
push dword [ebp - 4]
mov ecx, 3
call fcn.10001937
add esp, 0xc
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x10003397
push ebx
call fcn.1000d12f
add esp, 4
pop eax
mov dword [ebp - 4], eax
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x100033ae
mov eax, 0x100a7fc0
push eax
push 1
mov ebx, 0x1000d940
call fcn.1000d123
add esp, 0x10
mov dword [ebp - 0x34], eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push 0
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.accept_language
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 0x34]
test eax, eax
jne 0x100033f5
mov eax, 0x100a7fc0
push eax
push 4
mov ebx, 0x1000d790
call fcn.1000d123
add esp, 0x34
mov dword [ebp - 0x38], eax
mov ebx, dword [ebp - 0x34]
test ebx, ebx
je 0x1000341b
push ebx
call fcn.1000d12f
add esp, 4
cmp dword [ebp - 0x38], 0xffffffff
jne 0x10003455
push str._r_nAccept_Language:_zh_cn
push dword [ebp - 4]
mov ecx, 2
call fcn.10001937
add esp, 8
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x10003451
push ebx
call fcn.1000d12f
add esp, 4
pop eax
mov dword [ebp - 4], eax
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x10003468
mov eax, 0x100a7fc0
push eax
push 1
mov ebx, 0x1000d940
call fcn.1000d123
add esp, 0x10
mov dword [ebp - 0x34], eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push 0
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.user_agent
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 0x34]
test eax, eax
jne 0x100034af
mov eax, 0x100a7fc0
push eax
push 4
mov ebx, 0x1000d790
call fcn.1000d123
add esp, 0x34
mov dword [ebp - 0x38], eax
mov ebx, dword [ebp - 0x34]
test ebx, ebx
je 0x100034d5
push ebx
call fcn.1000d12f
add esp, 4
cmp dword [ebp - 0x38], 0xffffffff
jne 0x1000350f
push str._r_nUser_Agent:_Mozilla_5.0__Windows_NT_6.1__WOW64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_50.0.2661.87_Safari_537.36
push dword [ebp - 4]
mov ecx, 2
call fcn.10001937
add esp, 8
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x1000350b
push ebx
call fcn.1000d12f
add esp, 4
pop eax
mov dword [ebp - 4], eax
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x10003522
mov eax, 0x100a7fc0
push eax
push 1
mov ebx, 0x1000d940
call fcn.1000d123
add esp, 0x10
mov dword [ebp - 0x34], eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push 0
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.content_type
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 0x34]
test eax, eax
jne 0x10003569
mov eax, 0x100a7fc0
push eax
push 4
mov ebx, 0x1000d790
call fcn.1000d123
add esp, 0x34
mov dword [ebp - 0x38], eax
mov ebx, dword [ebp - 0x34]
test ebx, ebx
je 0x1000358f
push ebx
call fcn.1000d12f
add esp, 4
cmp dword [ebp - 0x38], 0xffffffff
jne 0x100035c9
push str._r_nContent_Type:_application_x_www_form_urlencoded
push dword [ebp - 4]
mov ecx, 2
call fcn.10001937
add esp, 8
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x100035c5
push ebx
call fcn.1000d12f
add esp, 4
pop eax
mov dword [ebp - 4], eax
cmp dword [ebp + 0x60], 0
mov eax, 0
sete al
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jne 0x100037fa
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push 0
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.X_Forwarded_For
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x10003613
mov eax, 0x100a7fc0
push eax
push 4
mov ebx, 0x1000d790
call fcn.1000d123
add esp, 0x34
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0xffffffff
jne 0x10003668
mov ebx, dword [ebp + 0x5c]
push dword [ebx]
push str._r_nX_Forwarded_For:
push dword [ebp - 4]
mov ecx, 3
call fcn.10001937
add esp, 0xc
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x10003664
push ebx
call fcn.1000d12f
add esp, 4
pop eax
mov dword [ebp - 4], eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push 0
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.CLIENT_IP
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x10003699
mov eax, 0x100a7fc0
push eax
push 4
mov ebx, 0x1000d790
call fcn.1000d123
add esp, 0x34
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0xffffffff
jne 0x100036ee
mov ebx, dword [ebp + 0x5c]
push dword [ebx]
push str._r_nCLIENT_IP:
push dword [ebp - 4]
mov ecx, 3
call fcn.10001937
add esp, 0xc
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x100036ea
push ebx
call fcn.1000d12f
add esp, 4
pop eax
mov dword [ebp - 4], eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push 0
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push 0x100a8483
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x1000371f
mov eax, 0x100a7fc0
push eax
push 4
mov ebx, 0x1000d790
call fcn.1000d123
add esp, 0x34
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0xffffffff
jne 0x10003774
mov ebx, dword [ebp + 0x5c]
push dword [ebx]
push str._r_nVIA:
push dword [ebp - 4]
mov ecx, 3
call fcn.10001937
add esp, 0xc
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x10003770
push ebx
call fcn.1000d12f
add esp, 4
pop eax
mov dword [ebp - 4], eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push 0
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.REMOTE_ADDR
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x100037a5
mov eax, 0x100a7fc0
push eax
push 4
mov ebx, 0x1000d790
call fcn.1000d123
add esp, 0x34
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0xffffffff
jne 0x100037fa
mov ebx, dword [ebp + 0x5c]
push dword [ebx]
push str._r_nREMOTE_ADDR:
push dword [ebp - 4]
mov ecx, 3
call fcn.10001937
add esp, 0xc
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x100037f6
push ebx
call fcn.1000d12f
add esp, 4
pop eax
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0
jl 0x10003812
cmp dword [ebp + 0xc], 7
jg 0x10003812
xor eax, eax
jmp 0x10003817
mov eax, 1
test eax, eax
je 0x10003826
mov dword [ebp + 0xc], 0
fild dword [ebp + 0xc]
fstp qword [ebp - 0x38]
fld qword [ebp - 0x38]
fadd qword [0x100a8251]
fstp qword [ebp - 0x40]
fld qword [ebp - 0x40]
call fcn.100028cf
cmp eax, 1
jl 0x1000384a
cmp eax, 9
jl 0x10003861
push 0xa19
push 0x40225eb
push 9
call fcn.1000d117
add esp, 0xc
dec eax
call 0x10003867
pop ebx
add ebx, dword [eax*4 + 0x100a84da]
jmp ebx