Function at 0x4969e0
Capabilities:
Check if file exists
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d9c6b
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x655140]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x5c], ecx
mov edx, dword [ebp + 8]
cmp dword [ebp + 0x24], 0xffffffff
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x68], edx
mov edx, dword [ebp + 0x14]
mov dword [ebp - 0x6c], edx
mov edx, 0xf
cmovne edx, dword [ebp + 0x24]
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x64], edx
mov dword [ebp - 0x70], 0
mov dword [ebp - 4], 0
test ecx, ecx
je 0x4971bd
call fcn.004e6f60
mov dword [ebp - 0x4c], eax
test eax, eax
je 0x4971bd
mov esi, dword [ebp + 0x10]
xor edi, edi
mov dword [ebp - 0x54], edi
mov byte [ebp - 0x58], 0
test esi, esi
je 0x496c0c
mov esi, dword [esi]
mov esi, dword [esi]
nop dword [eax + eax]
cmp byte [esi + 0xd], 0
jne 0x496bff
cmp dword [esi + 0x38], 0
lea edi, [esi + 0x10]
je 0x496bb3
push edi
lea ecx, [ebp - 0x44]
call fcn.00424c20
mov byte [ebp - 4], 1
cmp byte [ebp - 0x58], 0
jne 0x496b29
cmp dword [ebp - 0x30], 0xf
lea ecx, [ebp - 0x44]
mov edx, dword [ebp - 0x34]
cmova ecx, dword [ebp - 0x44]
cmp edx, 0xa
jne 0x496b29
mov edi, str.User_Agent
sub edx, 4
jb 0x496ad8
mov eax, dword [ecx]
cmp eax, dword [edi]
jne 0x496add
add ecx, 4
add edi, 4
sub edx, 4
jae 0x496ac7
cmp edx, 0xfffffffc
je 0x496b11
mov al, byte [ecx]
cmp al, byte [edi]
jne 0x496b0a
cmp edx, 0xfffffffd
je 0x496b11
mov al, byte [ecx + 1]
cmp al, byte [edi + 1]
jne 0x496b0a
cmp edx, 0xfffffffe
je 0x496b11
mov al, byte [ecx + 2]
cmp al, byte [edi + 2]
jne 0x496b0a
cmp edx, 0xffffffff
je 0x496b11
mov al, byte [ecx + 3]
cmp al, byte [edi + 3]
je 0x496b11
sbb eax, eax
or eax, 1
jmp 0x496b13
xor eax, eax
mov ecx, dword [ebp - 0x58]
lea edi, [esi + 0x10]
test eax, eax
movzx ecx, cl
mov eax, 1
cmove ecx, eax
mov dword [ebp - 0x58], ecx
push 2
push 0x63bbf8
lea ecx, [ebp - 0x44]
call fcn.0048f470
cmp dword [edi + 0x2c], 0xf
lea edx, [edi + 0x18]
jbe 0x496b44
mov edx, dword [edi + 0x18]
push dword [edi + 0x28]
mov ecx, eax
push edx
call fcn.0048f470
cmp dword [ebp - 0x30], 0xf
lea eax, [ebp - 0x44]
cmova eax, dword [ebp - 0x44]
push eax
push dword [ebp - 0x54]
call fcn.004e7b50
mov byte [ebp - 4], 0
add esp, 8
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x54], eax
cmp ecx, 0xf
jbe 0x496ba1
mov edx, dword [ebp - 0x44]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x496b97
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4971de
push ecx
push edx
call fcn.004b4401
add esp, 8
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0xf
mov byte [ebp - 0x44], 0
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
je 0x496bdc
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x496bd5
cmp esi, dword [eax + 8]
jne 0x496bd5
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x496bc5
mov esi, eax
jmp 0x496a80
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
jne 0x496a80
nop word [eax + eax]
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
je 0x496bf0
jmp 0x496a80
cmp byte [ebp - 0x58], 0
jne 0x496ca8
mov edi, dword [ebp - 0x54]
push 0xc
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
push str.User_Agent:
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 0
movups xmmword [ebp - 0x2c], xmm0
call fcn.004094a0
push 0x84
push str.Mozilla_5.0__Windows_NT_6.2__WOW64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_49.0.2623.110_Safari_537.36_XunduPDF_49.0.2623.110
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 2
call fcn.0048f470
cmp dword [ebp - 0x18], 0xf
lea eax, [ebp - 0x2c]
cmova eax, dword [ebp - 0x2c]
push eax
push edi
call fcn.004e7b50
mov byte [ebp - 4], 0
add esp, 8
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x54], eax
cmp ecx, 0xf
jbe 0x496c96
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x496c8c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4971e3
push ecx
push edx
call fcn.004b4401
add esp, 8
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
push ecx
lea ecx, [ebp - 0x58]
call fcn.0048ff30
add esp, 4
push dword [eax]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edx, dword [ebp - 0x58]
or edi, 0xffffffff
mov esi, eax
add edx, 0xfffffff0
mov ecx, edi
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x496cdb
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test esi, esi
jne 0x496cf1
push str.Referer:_https:__www.pdfxd.com_
push dword [ebp - 0x54]
call fcn.004e7b50
add esp, 8
jmp 0x496cf4
mov eax, dword [ebp - 0x54]
mov esi, dword [ebp - 0x4c]
test eax, eax
je 0x496d0a
push eax
push 0x2727
push esi
call fcn.004e6fc0
add esp, 0xc
mov ecx, dword [ebp - 0x5c]
mov eax, ecx
cmp dword [ecx + 0x14], 0xf
jbe 0x496d17
mov eax, dword [ecx]
push eax
push 0x2712
push esi
call fcn.004e6fc0
mov ecx, dword [ebp - 0x5c]
add esp, 4
call fcn.004971f0
test eax, eax
jne 0x496d48
push eax
push 0x40
push esi
call fcn.004e6fc0
push 0
push 0x51
push esi
call fcn.004e6fc0
add esp, 0x18
cmp byte [ebp + 0x18], 0
je 0x496d89
push 1
push 0x2f
push esi
call fcn.004e6fc0
mov ecx, dword [ebp - 0x48]
add esp, 0xc
test ecx, ecx
je 0x496d89
cmp dword [ecx + 0x14], 0xf
mov eax, ecx
jbe 0x496d6c
mov eax, dword [ecx]
push eax
push 0x271f
push esi
call fcn.004e6fc0
mov edx, dword [ebp - 0x48]
push dword [edx + 0x10]
push 0x3c
push esi
call fcn.004e6fc0
add esp, 0x18
mov eax, dword [ebp - 0x50]
test eax, eax
je 0x496da7
cmp dword [eax + 0x14], 0xf
jbe 0x496d98
mov eax, dword [eax]
push eax
push 0x2726
push esi
call fcn.004e6fc0
add esp, 0xc
push ecx
lea ecx, [ebp - 0x50]
call fcn.0048ff30
add esp, 4
push dword [eax]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edx, dword [ebp - 0x50]
mov esi, eax
add edx, 0xfffffff0
mov ecx, edi
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x496dd7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test esi, esi
je 0x496e03
mov esi, dword [ebp - 0x4c]
push str.127.0.0.1
push 0x2714
push esi
call fcn.004e6fc0
push 0x22b8
push 0x3b
push esi
call fcn.004e6fc0
add esp, 0x18
jmp 0x49710e
mov esi, dword [0x67a778]
test esi, esi
jne 0x496e31
push 0x4c
call fcn.004b4016
add esp, 4
mov dword [ebp - 0x48], eax
mov ecx, eax
mov byte [ebp - 4], 3
call fcn.004abb40
mov esi, eax
mov byte [ebp - 4], 0
mov dword [0x67a778], esi
lea edi, [esi + 4]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [esi]
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp esi, 2
jne 0x49710b
mov eax, dword [0x67a778]
test eax, eax
jne 0x496e77
push 0x4c
call fcn.004b4016
add esp, 4
mov dword [ebp - 0x50], eax
mov ecx, eax
mov byte [ebp - 4], 4
call fcn.004abb40
mov byte [ebp - 4], 0
mov dword [0x67a778], eax
lea ecx, [ebp - 0x24]
push ecx
mov ecx, eax
call fcn.004abfb0
push 0x63be1c
lea edx, [ebp - 0x1c]
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x5c]
call fcn.00408100
add esp, 4
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 6
push ecx
mov edx, eax
lea ecx, [ebp - 0x48]
call fcn.004082a0
add esp, 4
mov edi, dword [eax]
test edi, edi
je 0x496f0d
mov ecx, edi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x496ec0
sub ecx, edx
sar ecx, 1
inc ecx
cmp ecx, 0x3fffffff
jg 0x496f0d
lea eax, [ecx + ecx]
mov dword [ebp - 0x50], eax
call fcn.004b4f90
mov esi, esp
mov dword [ebp - 0x10], esp
test esi, esi
je 0x496f0d
push 0
push 0
push dword [ebp - 0x50]
mov byte [esi], 0
push esi
push 0xffffffffffffffff
push edi
push 0
push 3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
xor ecx, ecx
test eax, eax
cmove esi, ecx
jmp 0x496f0f
xor esi, esi
push esi
push 0x2714
push dword [ebp - 0x4c]
call fcn.004e6fc0
mov edx, dword [ebp - 0x48]
or esi, 0xffffffff
add esp, 0xc
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x496f3d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 5
mov eax, esi
mov edx, dword [ebp - 0x5c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x496f5b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x24]
mov ecx, 0x6318e4
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x496f89
test dx, dx
je 0x496f85
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x496f89
add eax, 4
add ecx, 4
test dx, dx
jne 0x496f63
xor eax, eax
jmp 0x496f8e
sbb eax, eax
or eax, 1
test eax, eax
je 0x4970a1
mov eax, dword [ebp - 0x20]
mov ecx, 0x6318e4
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x496fc6
test dx, dx
je 0x496fc2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x496fc6
add eax, 4
add ecx, 4
test dx, dx
jne 0x496fa0
xor eax, eax
jmp 0x496fcb
sbb eax, eax
or eax, 1
test eax, eax
je 0x4970a1
push 0x63be1c
lea edx, [ebp - 0x24]
lea ecx, [ebp - 0x5c]
call fcn.00408100
add esp, 4
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 7
push ecx
mov edx, eax
lea ecx, [ebp - 0x48]
call fcn.004082a0
add esp, 4
mov edi, dword [eax]
test edi, edi
je 0x497053
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x497006
sub ecx, edx
sar ecx, 1
inc ecx
cmp ecx, 0x3fffffff
jg 0x497053
lea eax, [ecx + ecx]
mov dword [ebp - 0x50], eax
call fcn.004b4f90
mov esi, esp
mov dword [ebp - 0x10], esp
test esi, esi
je 0x497053
push 0
push 0
push dword [ebp - 0x50]
mov byte [esi], 0
push esi
push 0xffffffffffffffff
push edi
push 0
push 3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
xor ecx, ecx
test eax, eax
cmove esi, ecx
jmp 0x497055
xor esi, esi
push esi
push 0x2716
push dword [ebp - 0x4c]
call fcn.004e6fc0
mov edx, dword [ebp - 0x48]
or esi, 0xffffffff
add esp, 0xc
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x497083
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 5
mov eax, esi
mov edx, dword [ebp - 0x5c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4970a1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov eax, esi
mov edx, dword [ebp - 0x18]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4970bf
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x1c]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4970d9
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x20]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4970f3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x24]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x49710b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x4c]
push 0
push 0x4e2c
push esi
call fcn.004e6fc0
push 0x4969c0
push 0x4e2b
push esi
call fcn.004e6fc0
push dword [ebp - 0x68]
push 0x2711
push esi
call fcn.004e6fc0
push 1
push 0x63
push esi
call fcn.004e6fc0
mov edi, dword [ebp - 0x64]
push edi
push 0x4e
push esi
call fcn.004e6fc0
push edi
push 0xd
push esi
call fcn.004e6fc0
add esp, 0x48
push 1
push 0x34
push esi
call fcn.004e6fc0
push 0x14
push 0x44
push esi
call fcn.004e6fc0
push esi
call fcn.004e6fa0
xor ecx, ecx
add esp, 0x1c
test eax, eax
sete cl
mov dword [ebp - 0x48], ecx
test eax, eax
jne 0x4971a4
mov eax, dword [ebp - 0x6c]
test eax, eax
je 0x4971a4
push eax
push 0x200002
push esi
call fcn.004e6f40
add esp, 0xc
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x48], eax
push esi
call fcn.004e6f20
mov eax, dword [ebp - 0x48]
add esp, 4
jmp 0x4971bf
xor eax, eax
lea esp, [ebp - 0x80]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004b3f1a
mov esp, ebp
pop ebp
ret
call fcn.004c0e66
call fcn.004c0e66
int3