Function at 0x4856c0
Capabilities:
Reference http user-agent string

Disassembly:
push 0xffffffffffffffff
push 0x4ef158
mov eax, dword fs:[0]
push eax
sub esp, 0x148
mov eax, dword [0x52b360]
xor eax, esp
mov dword [esp + 0x144], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x52b360]
xor eax, esp
push eax
lea eax, [esp + 0x15c]
mov dword fs:[0], eax
mov esi, edx
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov ebp, 0xf
mov dword [esi + 0x18], ebp
mov dword [esi + 0x14], ebx
mov edi, ecx
mov dword [esp + 0x18], esi
mov byte [esi + 4], bl
mov eax, 1
mov dword [esp + 0x14], eax
mov dword [esp + 0x50], ebp
mov dword [esp + 0x4c], ebx
mov byte [esp + 0x3c], bl
mov dword [esp + 0x164], eax
mov dword [esp + 0x34], ebp
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
mov byte [esp + 0x164], 2
cmp dword [edi + 0xac], 0x10
jb 0x485758
mov eax, dword [edi + 0x98]
jmp 0x48575e
lea eax, [edi + 0x98]
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x3c]
push edx
call fcn.004864b0
add esp, 8
push 6
push 0x50bd88
mov eax, esi
call fcn.00409900
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x40]
push eax
call fcn.00409a10
push 2
push 0x50bd90
mov eax, esi
call fcn.00409900
push 0xc
push str.User_Agent:
mov eax, esi
call fcn.00409900
push 0x6d
push str.Mozilla_5.0__Windows_NT_6.1__WOW64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_42.0.2311.135_Safari_537.36
mov eax, esi
call fcn.00409900
push 2
push 0x50bd90
mov eax, esi
call fcn.00409900
cmp dword [edi + 0x4c], ebx
je 0x4857f0
push 0x11
push str.x_requested_with:
mov eax, esi
call fcn.00409900
push 0xffffffffffffffff
push ebx
lea ecx, [edi + 0x38]
push ecx
call fcn.00409a10
push 2
push 0x50bd90
mov eax, esi
call fcn.00409900
push 0xd
push 0x50be2c
mov eax, esi
call fcn.00409900
push 0x36
push str.Accept_Language:_zh_cn_zh_q0.8_en_us_q0.5_en_q0.3_r_n
mov eax, esi
call fcn.00409900
push 0x20
push 0x50be74
mov eax, esi
call fcn.00409900
push 9
push 0x50be98
mov eax, esi
call fcn.00409900
push 0xffffffffffffffff
push ebx
lea edx, [edi + 0x78]
push edx
call fcn.00409a10
push 2
push 0x50bd90
mov eax, esi
call fcn.00409900
push 0x12
push 0x50bea4
mov eax, esi
call fcn.00409900
push 0x18
push str.Accept_Language:_zh_cn_r_n
mov eax, esi
call fcn.00409900
cmp dword [edi + 0xd8], ebx
je 0x4858d6
mov eax, esi
cmp byte [edi + 0xb8], bl
je 0x485879
push 0x41
push str.Content_Type:_application_x_www_form_urlencoded_charset_utf_8__r_n
jmp 0x485880
push 0x31
push str.Content_Type:_application_x_www_form_urlencoded_r_n
call fcn.00409900
push 0x103
lea eax, [esp + 0x59]
push ebx
push eax
mov byte [esp + 0x60], bl
call fcn.004d1df0
mov ecx, dword [edi + 0xdc]
push ecx
lea edx, [esp + 0x64]
push str.Content_Length:__d_r_n
push edx
call fcn.004cb3cf
lea eax, [esp + 0x6c]
add esp, 0x18
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4858c0
sub eax, edx
push eax
lea eax, [esp + 0x58]
push eax
mov eax, esi
call fcn.00409900
push 2
push 0x50bd90
mov eax, esi
call fcn.00409900
mov edi, 0x10
cmp dword [esp + 0x34], edi
jb 0x4858fc
mov ecx, dword [esp + 0x20]
push ecx
call fcn.004c8f17
add esp, 4
mov dword [esp + 0x34], ebp
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
cmp dword [esp + 0x50], edi
jb 0x48591b
mov edx, dword [esp + 0x3c]
push edx
call fcn.004c8f17
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x15c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x144]
xor ecx, esp
call fcn.004c8f08
add esp, 0x154
ret