Function at 0x4ac460
Capabilities:
Check if file exists
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5fb4e4
mov eax, dword fs:[0]
push eax
sub esp, 0x84
mov eax, dword [0x68da90]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x68], edx
mov dword [ebp - 0x74], ecx
cmp dword [ebp + 0x24], 0xffffffff
mov edx, 0xf
mov eax, dword [ebp + 8]
cmovne edx, dword [ebp + 0x24]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x90], eax
mov byte [ebp - 0x61], 1
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x8c], edx
mov dword [ebp - 0x80], 0
mov dword [ebp - 4], 0
test ecx, ecx
jne 0x4ac4e0
xor eax, eax
jmp 0x4accbc
call fcn.004b97a0
mov edi, eax
mov dword [ebp - 0x84], edi
test edi, edi
je 0x4ac4d9
mov esi, dword [ebp + 0x10]
xor ebx, ebx
mov dword [ebp - 0x7c], ebx
mov byte [ebp - 0x78], bl
test esi, esi
je 0x4ac628
mov esi, dword [esi]
mov eax, dword [esi]
mov dword [ebp - 0x60], eax
nop dword [eax + eax]
cmp eax, esi
je 0x4ac622
cmp dword [eax + 0x38], 0
lea ebx, [eax + 0x10]
mov dword [ebp - 0x70], ebx
je 0x4ac60f
push 0xffffffffffffffff
push 0
push ebx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
call fcn.004053c0
cmp byte [ebp - 0x78], 0
mov byte [ebp - 4], 1
jne 0x4ac59a
cmp dword [ebp - 0x18], 0x10
lea ecx, [ebp - 0x2c]
mov ebx, dword [ebp - 0x1c]
mov eax, 0xa
cmovae ecx, dword [ebp - 0x2c]
cmp ebx, eax
cmovb eax, ebx
push eax
push 0x66390c
push ecx
call fcn.004192d0
add esp, 0xc
test eax, eax
jne 0x4ac597
cmp ebx, 0xa
mov ebx, dword [ebp - 0x70]
jb 0x4ac59a
mov eax, dword [ebp - 0x78]
mov ecx, 1
movzx eax, al
cmovbe eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x4ac59a
mov ebx, dword [ebp - 0x70]
push 2
push 0x661ebc
lea ecx, [ebp - 0x2c]
call fcn.00481500
push 0xffffffffffffffff
push 0
lea ecx, [ebx + 0x18]
push ecx
mov ecx, eax
call fcn.00481630
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
push dword [ebp - 0x7c]
call fcn.004bdae0
mov byte [ebp - 4], 0
add esp, 8
mov ecx, dword [ebp - 0x18]
mov ebx, eax
mov dword [ebp - 0x7c], ebx
cmp ecx, 0x10
jb 0x4ac5ed
inc ecx
push ecx
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x2c]
call fcn.00405210
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
call fcn.00409300
mov eax, dword [ebp - 0x60]
jmp 0x4ac510
mov ebx, dword [ebp - 0x7c]
lea ecx, [ebp - 0x60]
call fcn.00409300
mov eax, dword [ebp - 0x60]
jmp 0x4ac510
cmp byte [ebp - 0x78], 0
jne 0x4ac6a3
push 0xc
push str.User_Agent:
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x30], 0xf
mov dword [ebp - 0x34], 0
mov byte [ebp - 0x44], 0
call fcn.004052c0
push 0x84
push 0x663928
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 2
call fcn.00481500
cmp dword [ebp - 0x30], 0x10
lea eax, [ebp - 0x44]
cmovae eax, dword [ebp - 0x44]
push eax
push ebx
call fcn.004bdae0
mov esi, eax
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x30]
add esp, 8
cmp eax, 0x10
jb 0x4ac68f
inc eax
lea ecx, [ebp - 0x44]
push eax
push dword [ebp - 0x44]
call fcn.00405210
mov dword [ebp - 0x30], 0xf
mov dword [ebp - 0x34], 0
mov byte [ebp - 0x44], 0
jmp 0x4ac6a6
mov esi, dword [ebp - 0x7c]
push ecx
mov edx, str.full.data
lea ecx, [ebp - 0x70]
call fcn.0049d470
add esp, 4
push dword [eax]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edx, dword [ebp - 0x70]
test eax, eax
sete bl
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4ac6df
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test bl, bl
je 0x4ac6f3
push str.Referer:_https:__www.pdfxd.com_
push esi
call fcn.004bdae0
add esp, 8
mov esi, eax
test esi, esi
je 0x4ac706
push esi
push 0x2727
push edi
call fcn.004b9800
add esp, 0xc
mov ebx, dword [ebp - 0x74]
cmp dword [ebx + 0x14], 0x10
jb 0x4ac713
mov eax, dword [ebx]
jmp 0x4ac715
mov eax, ebx
push eax
push 0x2712
push edi
call fcn.004b9800
add esp, 0xc
mov ecx, ebx
push 5
push 0
push str.https
call fcn.004acd20
test eax, eax
jne 0x4ac74e
push eax
push 0x40
push edi
call fcn.004b9800
push 0
push 0x51
push edi
call fcn.004b9800
add esp, 0x18
cmp byte [ebp - 0x61], 0
je 0x4ac83e
push 1
push 0x2f
push edi
call fcn.004b9800
add esp, 0xc
xor eax, eax
je 0x4ac811
mov edi, dword [4]
mov esi, dword [pe_dos_header]
mov dword [ebp - 0x60], eax
cmp esi, edi
je 0x4ac7fa
lea ebx, [esi + 0x18]
cmp byte [esi], 0
je 0x4ac7bd
cmp dword [ebx + 0x18], 0x10
jb 0x4ac793
mov ecx, dword [ebx + 4]
jmp 0x4ac796
lea ecx, [ebx + 4]
cmp dword [ebx], 0x10
jb 0x4ac7a0
mov eax, dword [ebx - 0x14]
jmp 0x4ac7a3
lea eax, [ebx - 0x14]
push 0x11
push ecx
push 5
push eax
push 2
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.004bee40
add esp, 0x1c
jmp 0x4ac7f0
cmp dword [ebx], 0x10
jb 0x4ac7c7
mov eax, dword [ebx - 0x14]
jmp 0x4ac7ca
lea eax, [ebx - 0x14]
push 0x11
push dword [ebx + 0x20]
push 0xd
push dword [ebx + 0x1c]
push 0xc
push eax
push 0xb
push str.file
push 1
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.004bee40
add esp, 0x2c
add esi, 0x3c
add ebx, 0x3c
cmp esi, edi
jne 0x4ac783
push dword [ebp - 0x80]
mov edi, dword [ebp - 0x84]
push 0x2728
push edi
call fcn.004b9800
add esp, 0xc
mov ebx, dword [ebp - 0x68]
test ebx, ebx
je 0x4ac83e
cmp dword [ebx + 0x14], 0x10
jb 0x4ac822
mov eax, dword [ebx]
jmp 0x4ac824
mov eax, ebx
push eax
push 0x271f
push edi
call fcn.004b9800
push dword [ebx + 0x10]
push 0x3c
push edi
call fcn.004b9800
add esp, 0x18
xor eax, eax
je 0x4ac863
cmp dword [0x14], 0x10
jb 0x4ac852
mov eax, dword [pe_dos_header]
jmp 0x4ac854
xor eax, eax
push eax
push 0x2726
push edi
call fcn.004b9800
add esp, 0xc
push ecx
mov edx, str.full.data
lea ecx, [ebp - 0x68]
call fcn.0049d470
add esp, 4
push dword [eax]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edx, dword [ebp - 0x68]
or ebx, 0xffffffff
mov esi, eax
add edx, 0xfffffff0
mov ecx, ebx
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x4ac89b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test esi, esi
je 0x4ac8c4
push str.127.0.0.1
push 0x2714
push edi
call fcn.004b9800
push 0x22b8
push 0x3b
push edi
call fcn.004b9800
add esp, 0x18
jmp 0x4acad6
mov esi, dword [0x6acf2c]
lea edi, [esi + 4]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [esi]
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp esi, 2
jne 0x4acad0
mov ecx, dword [0x6acf2c]
lea eax, [ebp - 0x24]
push eax
call fcn.0049f220
push 0x663184
lea edx, [ebp - 0x1c]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x74]
call fcn.00408bd0
add esp, 4
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 4
push ecx
mov edx, eax
lea ecx, [ebp - 0x68]
call fcn.00408cb0
add esp, 4
mov edi, dword [eax]
test edi, edi
jne 0x4ac92b
xor eax, eax
jmp 0x4ac966
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4ac930
sub ecx, edx
sar ecx, 1
lea esi, [ecx + 1]
cmp esi, 0x3fffffff
jle 0x4ac94e
xor eax, eax
jmp 0x4ac966
add esi, esi
mov eax, esi
call fcn.005a9bf0
mov dword [ebp - 0x10], esp
mov ecx, esp
push 3
push esi
mov edx, edi
call fcn.00419340
mov edi, dword [ebp - 0x84]
push eax
push 0x2714
push edi
call fcn.004b9800
mov edx, dword [ebp - 0x68]
add esp, 0xc
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4ac995
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 3
mov eax, ebx
mov edx, dword [ebp - 0x74]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4ac9b3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x24]
mov ecx, 0x658bf4
nop dword [eax + eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4ac9e6
test dx, dx
je 0x4ac9e2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4ac9e6
add eax, 4
add ecx, 4
test dx, dx
jne 0x4ac9c0
xor eax, eax
jmp 0x4ac9eb
sbb eax, eax
or eax, 1
test eax, eax
setne al
test al, al
je 0x4acac2
mov edx, 0x658bf4
lea ecx, [ebp - 0x20]
call fcn.00408b30
test al, al
je 0x4acac2
push 0x663184
lea edx, [ebp - 0x24]
lea ecx, [ebp - 0x74]
call fcn.00408bd0
add esp, 4
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 5
push ecx
mov edx, eax
lea ecx, [ebp - 0x68]
call fcn.00408cb0
add esp, 4
mov ebx, dword [eax]
test ebx, ebx
jne 0x4aca3f
xor eax, eax
jmp 0x4aca7a
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4aca44
sub ecx, edx
sar ecx, 1
lea esi, [ecx + 1]
cmp esi, 0x3fffffff
jle 0x4aca62
xor eax, eax
jmp 0x4aca7a
add esi, esi
mov eax, esi
call fcn.005a9bf0
mov dword [ebp - 0x10], esp
mov ecx, esp
push 3
push esi
mov edx, ebx
call fcn.00419340
push eax
push 0x2716
push edi
call fcn.004b9800
mov edx, dword [ebp - 0x68]
or ebx, 0xffffffff
add esp, 0xc
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4acaa6
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x74]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x4acac2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0
call fcn.00491e40
jmp 0x4acad6
mov edi, dword [ebp - 0x84]
xor eax, eax
je 0x4acae7
push 1
push 0x2a
push edi
call fcn.004b9800
add esp, 0xc
push 0
push 0x4e2c
push edi
call fcn.004b9800
push 0x4ac440
push 0x4e2b
push edi
call fcn.004b9800
push dword [ebp - 0x6c]
push 0x2711
push edi
call fcn.004b9800
push 1
push 0x63
push edi
call fcn.004b9800
mov esi, dword [ebp - 0x8c]
push esi
push 0x4e
push edi
call fcn.004b9800
push esi
push 0xd
push edi
call fcn.004b9800
add esp, 0x48
push 1
push 0x34
push edi
call fcn.004b9800
push 0x14
push 0x44
push edi
call fcn.004b9800
push edi
call fcn.004b97e0
add esp, 0x1c
mov esi, eax
xor eax, eax
je 0x4acb6a
mov ecx, dword [ebp - 0x80]
test ecx, ecx
je 0x4acb6a
push ecx
call fcn.004bee60
add esp, 4
xor ebx, ebx
test esi, esi
sete bl
mov dword [ebp - 0x88], ebx
test ebx, ebx
je 0x4acca3
mov eax, dword [ebp - 0x90]
test eax, eax
je 0x4acba5
push eax
push 0x200002
push edi
call fcn.004b9780
add esp, 0xc
mov ebx, eax
neg ebx
sbb ebx, ebx
inc ebx
mov dword [ebp - 0x88], ebx
test ebx, ebx
je 0x4acca3
xor eax, eax
je 0x4acca3
lea eax, [ebp - 0x60]
push eax
push 0x20000b
push edi
call fcn.004b9780
mov ecx, dword [ebp - 0x6c]
lea eax, [ebp - 0x44]
add esp, 0xc
push dword [ebp - 0x60]
push 0
push eax
call fcn.004acce0
mov esi, eax
xor ecx, ecx
cmp ecx, esi
je 0x4acc24
mov eax, dword [0x14]
cmp eax, 0x10
jb 0x4acbf3
inc eax
push eax
push dword [ecx]
call fcn.00405210
mov dword [0x14], 0xf
cmp dword [0x14], 0x10
mov dword [0x10], 0
jb 0x4acc17
mov eax, dword [pe_dos_header]
jmp 0x4acc19
xor eax, eax
push esi
xor ecx, ecx
mov byte [eax], 0
call fcn.00416e90
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x30]
cmp eax, 0x10
jb 0x4acc3d
inc eax
lea ecx, [ebp - 0x44]
push eax
push dword [ebp - 0x44]
call fcn.00405210
mov ecx, dword [ebp - 0x6c]
lea eax, [ebp - 0x5c]
push 0xffffffffffffffff
push dword [ebp - 0x60]
push eax
call fcn.004acce0
mov esi, eax
mov ecx, dword [ebp - 0x6c]
cmp ecx, esi
je 0x4acc8e
mov eax, dword [ecx + 0x14]
cmp eax, 0x10
jb 0x4acc6b
inc eax
push eax
push dword [ecx]
call fcn.00405210
mov ecx, dword [ebp - 0x6c]
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], 0
jb 0x4acc83
mov eax, dword [ecx]
jmp 0x4acc85
mov eax, ecx
push esi
mov byte [eax], 0
call fcn.00416e90
mov eax, dword [ebp - 0x48]
cmp eax, 0x10
jb 0x4acca3
inc eax
lea ecx, [ebp - 0x5c]
push eax
push dword [ebp - 0x5c]
call fcn.00405210
push edi
call fcn.004b9760
add esp, 4
jmp 0x4accba
mov eax, ebx
lea esp, [ebp - 0xa0]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005a8a55
mov esp, ebp
pop ebp
ret