Function at 0x402ba0
Capabilities:
Move file
Read and send data from client to server
Read file on windows
Resolve function by parsing pe exports
Send data
Send data on socket
Send http request
Send http request with host header
Write file on windows

Disassembly:
push ebp
xor eax, eax
push edi
mov ecx, 0x31
push esi
push ebx
sub esp, 0x76c
lea edi, [esp + 0x668]
rep stosd dword es:[edi], eax
mov dword [esp + 0x664], 0
mov dword [esp + 0x48], 0
mov ecx, dword [esp + 0x788]
test ecx, ecx
je 0x402cd0
mov edx, dword [esp + 0x788]
mov dword [esp], edx
call sub.msvcrt.dll_strlen
add eax, 6
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov edx, dword [esp + 0x788]
mov dword [esp + 4], edx
mov dword [esp + 0x48], eax
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
mov edx, dword [esp + 0x48]
mov ecx, dword [edx]
add edx, 4
lea eax, [ecx - 0x1010101]
not ecx
and eax, ecx
and eax, 0x80808080
je 0x402c11
mov ecx, eax
mov ebx, dword [sym.imp.msvcrt.dll__stat64]
shr ecx, 0x10
test eax, 0x8080
cmove eax, ecx
lea ecx, [edx + 2]
cmove edx, ecx
add al, al
sbb edx, 3
mov dword [edx], 0x7261702e
lea esi, [esp + 0x60]
mov word [edx + 4], 0x74
mov eax, dword [esp + 0x48]
mov dword [esp + 4], esi
mov dword [esp], eax
call ebx
test eax, eax
jne 0x40323a
mov eax, dword [esp + 0x88]
lea ebx, [esp + 0x72c]
mov edx, dword [esp + 0x8c]
mov dword [esp + 4], ebx
mov dword [esp + 0x750], eax
lea eax, [esp + 0x750]
mov dword [esp + 0x754], edx
mov dword [esp], eax
call fcn.00405830
test eax, eax
je 0x402cd0
lea edi, [esp + 0x460]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], str._a___d__h__Y__T_GMT
mov dword [esp + 4], 0x32
mov dword [esp], edi
call sub.msvcrt.dll_strftime
test eax, eax
jne 0x4033dd
nop
mov eax, dword [esp + 0x780]
mov dword [esp], eax
call sub.msvcrt.dll__strdup
test eax, eax
mov ebp, eax
je 0x4034d3
mov dword [esp + 0x3c], 5
xor ebx, ebx
mov dword [esp + 0x44], 0
mov dword [esp + 0x54], 0
test ebx, ebx
jne 0x402f98
test ebp, ebp
je 0x402f98
lea edx, [esp + 0x758]
lea ecx, [esp + 0x460]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x100
mov dword [esp + 4], ecx
mov dword [esp], ebp
call fcn.004040d0
test eax, eax
mov dword [esp + 0x40], eax
je 0x403415
mov ebx, dword [0x418020]
test ebx, ebx
je 0x4032f2
mov eax, dword [0x418024]
mov dword [esp], eax
call sub.msvcrt.dll__strdup
mov esi, eax
mov dword [esp], ebx
mov dword [esp + 4], esi
call fcn.00402770
mov dword [esp], esi
mov ebx, eax
call sub.msvcrt.dll_free
cmp ebx, 0xffffffff
je 0x403415
mov edi, dword [esp + 0x44]
mov eax, 0x413980
mov edx, 0x413980
mov ecx, 5
test edi, edi
mov edi, str.http
cmovne eax, dword [esp + 0x44]
cmp byte [esp + 0x664], 0
mov dword [esp + 0x4c], eax
lea eax, [esp + 0x664]
cmovne edx, eax
mov eax, dword [esp + 0x758]
mov dword [esp + 0x50], edx
mov esi, eax
repe cmpsb byte [esi], byte es:[edi]
mov esi, 0x413a3c
mov dword [esp + 0x1c], 0x413a65
mov dword [esp + 8], str.GET__s_HTTP_1.0_r_nHost:__s_s_s_r_nUser_Agent:_zsync__s_r_n_s_s_r_n
mov dword [esp + 4], 0x400
setb dl
seta cl
sub cl, dl
mov edx, dword [0x418020]
movsx edi, cl
mov ecx, 0x413980
test edi, edi
cmove esi, ecx
cmove eax, ecx
mov ecx, dword [esp + 0x4c]
test edx, edx
mov edx, dword [esp + 0x40]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x460]
mov dword [esp + 0x14], esi
lea esi, [esp + 0x60]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x50]
cmovne edx, ebp
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], ecx
mov dword [esp], esi
call fcn.00410ca0
mov edx, esi
mov ecx, dword [edx]
add edx, 4
lea eax, [ecx - 0x1010101]
not ecx
and eax, ecx
and eax, 0x80808080
je 0x402e3e
mov ecx, eax
shr ecx, 0x10
test eax, 0x8080
cmove eax, ecx
lea ecx, [edx + 2]
cmove edx, ecx
add al, al
sbb edx, 3
sub edx, esi
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [sym.imp.WS2_32.dll_send]
sub esp, 0x10
cmp eax, 0xffffffff
je 0x403476
mov dword [esp], ebx
mov dword [esp + 4], 0x413a20
call fcn.00405910
mov dword [esp + 4], 0x100
mov dword [esp], esi
mov ebx, eax
mov dword [esp + 8], eax
call sub.msvcrt.dll_fgets
test eax, eax
je 0x403310
mov dword [esp + 8], 6
mov dword [esp + 4], str.HTTP_1
mov dword [esp], esi
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x403310
mov dword [esp + 4], 0x20
mov dword [esp], esi
call sub.msvcrt.dll_strchr
test eax, eax
je 0x403310
add eax, 1
mov dword [esp], eax
call sub.msvcrt.dll_atoi
test ebx, ebx
mov dword [esp + 0x38], eax
je 0x402f98
sub eax, 0x12d
cmp eax, 1
jbe 0x403213
cmp dword [esp + 0x38], 0x133
je 0x403213
cmp dword [esp + 0x38], 0x191
je 0x403381
cmp dword [esp + 0x38], 0x19c
je 0x4033d0
cmp dword [esp + 0x38], 0xc8
je 0x403327
cmp dword [esp + 0x38], 0xce
je 0x403350
cmp dword [esp + 0x38], 0x130
jne 0x403491
mov edx, dword [esp + 0x788]
mov dword [esp + 4], 0x413a20
mov dword [esp], edx
call sub.msvcrt.dll_fopen
mov dword [esp + 0x54], eax
sub dword [esp + 0x3c], 1
jne 0x402d03
mov edx, dword [esp + 0x784]
test edx, edx
je 0x40345b
mov edx, dword [esp + 0x784]
mov dword [edx], ebp
cmp dword [esp + 0x38], 0x130
je 0x40341c
test ebx, ebx
je 0x4034a0
mov eax, dword [esp + 0x54]
test eax, eax
je 0x4034ec
mov dword [esp + 0x75c], 0
lea edi, [esp + 0x460]
lea esi, [esp + 0x75c]
nop
lea esi, [esi]
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x200
mov dword [esp], edi
call sub.msvcrt.dll_fgets
test eax, eax
je 0x403505
mov dword [esp + 8], esi
mov dword [esp + 4], str.Content_Length:__Iu
mov dword [esp], edi
call sub.msvcrt.dll_sscanf
cmp byte [esp + 0x460], 0xd
je 0x403036
mov dword [esp], ebx
call sub.msvcrt.dll_feof
test eax, eax
je 0x402ff0
mov eax, dword [0x4183fc]
mov dword [esp + 0x460], 0
mov dword [esp + 0x464], 0
mov dword [esp + 0x468], 0
test eax, eax
mov dword [esp + 0x46c], 0
mov dword [esp + 0x470], 0
mov dword [esp + 0x478], 0
mov dword [esp + 0x47c], 0
je 0x4033a8
mov ebp, dword [esp + 0x54]
lea esi, [esp + 0x60]
mov dword [esp + 0x38], 0
mov dword [esp], ebx
call sub.msvcrt.dll_feof
test eax, eax
jne 0x403170
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x400
mov dword [esp + 4], 1
mov dword [esp], esi
call sub.msvcrt.dll_fread
test eax, eax
je 0x4031c7
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], esi
mov dword [esp + 0x34], eax
call sub.msvcrt.dll_fwrite
mov edx, dword [esp + 0x34]
cmp edx, eax
ja 0x403436
mov eax, dword [0x4183fc]
add dword [esp + 0x38], edx
test eax, eax
jne 0x4030a0
mov eax, dword [esp + 0x75c]
fldz
test eax, eax
je 0x403140
fstp st(0)
mov edx, dword [esp + 0x38]
xor ecx, ecx
mov dword [esp + 0x5c], ecx
mov dword [esp + 0x58], edx
xor edx, edx
fild qword [esp + 0x58]
fmul dword [0x414070]
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], edx
fild qword [esp + 0x58]
fdivp st(1)
mov edx, dword [esp + 0x38]
fstp dword [esp + 4]
mov dword [esp + 0xc], 0
mov dword [esp], edi
mov dword [esp + 8], edx
call fcn.00404410
mov dword [esp], ebx
call sub.msvcrt.dll_feof
test eax, eax
je 0x4030b0
lea esi, [esi]
mov eax, dword [0x4183fc]
test eax, eax
je 0x4031f0
mov dword [esp], ebx
call sub.msvcrt.dll_fclose
mov eax, dword [esp + 0x54]
mov dword [esp], eax
call sub.msvcrt.dll_rewind
mov eax, dword [esp + 0x48]
test eax, eax
je 0x4031b8
mov edx, dword [esp + 0x788]
mov eax, dword [esp + 0x48]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.msvcrt.dll_rename
mov eax, dword [esp + 0x48]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [esp + 0x54]
add esp, 0x76c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], ebx
call sub.msvcrt.dll_ferror
test eax, eax
je 0x4030a0
mov dword [esp], 0x413a06
call sub.msvcrt.dll_perror
mov eax, dword [0x4183fc]
test eax, eax
jne 0x403179
lea esi, [esi]
mov dword [esp], ebx
call sub.msvcrt.dll_feof
mov dword [esp], edi
cmp eax, 1
sbb eax, eax
not eax
and eax, 2
mov dword [esp + 4], eax
call fcn.00404670
jmp 0x403179
mov dword [esp + 4], ebp
mov dword [esp], ebx
call fcn.00402950
mov dword [esp], ebp
mov esi, eax
mov ebp, esi
call sub.msvcrt.dll_free
mov dword [esp], ebx
xor ebx, ebx
call sub.msvcrt.dll_fclose
jmp 0x402f8d
call dword [sym.imp.msvcrt.dll__errno]
cmp dword [eax], 2
jne 0x402cd0
mov edx, dword [esp + 0x788]
mov dword [esp + 4], esi
mov dword [esp], edx
call ebx
test eax, eax
jne 0x402cd0
mov eax, dword [esp + 0x88]
lea ebx, [esp + 0x72c]
mov edx, dword [esp + 0x8c]
mov dword [esp + 4], ebx
mov dword [esp + 0x750], eax
lea eax, [esp + 0x750]
mov dword [esp + 0x754], edx
mov dword [esp], eax
call fcn.00405830
test eax, eax
je 0x402cd0
lea edi, [esp + 0x460]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], str._a___d__h__Y__T_GMT
mov dword [esp + 4], 0x32
mov dword [esp], edi
call sub.msvcrt.dll_strftime
test eax, eax
je 0x402cd0
lea eax, [esp + 0x664]
mov dword [esp + 0xc], edi
mov dword [esp + 8], str.If_Modified_Since:__s_r_n
mov dword [esp + 4], 0xc8
mov dword [esp], eax
call fcn.00410ca0
jmp 0x402cd0
mov eax, dword [esp + 0x758]
lea ebx, [esp + 0x460]
mov dword [esp], eax
call sub.msvcrt.dll__strdup
mov esi, eax
jmp 0x402d62
mov dword [esp], ebx
xor ebx, ebx
call sub.msvcrt.dll_fclose
mov dword [esp + 0x38], 0
jmp 0x402f98
mov esi, dword [esp + 0x48]
test esi, esi
je 0x403468
mov eax, dword [esp + 0x48]
mov dword [esp + 4], 0x413ab0
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov dword [esp + 0x54], eax
jmp 0x402f8d
mov ecx, dword [esp + 0x48]
test ecx, ecx
je 0x402f64
mov eax, dword [esp + 0x48]
mov dword [esp + 4], 0x413ab4
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov dword [esp + 0x38], 0xce
mov dword [esp + 0x54], eax
jmp 0x402f8d
lea eax, [esp + 0x460]
call fcn.00402410
mov dword [esp], ebx
test eax, eax
mov dword [esp + 0x44], eax
je 0x403494
call sub.msvcrt.dll_fclose
xor ebx, ebx
jmp 0x402f8d
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0
mov dword [esp], edi
call fcn.00404410
jmp 0x403090
mov byte [esp + 0x664], 0
mov dword [esp], ebx
jmp 0x40339c
mov eax, dword [esp + 0x78]
mov edx, dword [esp + 0x7c]
mov dword [esp + 0xc], edi
mov dword [esp + 8], str.If_Unmodified_Since:__s_r_nRange:_bytes_I64u__r_n
mov dword [esp + 0x10], eax
lea eax, [esp + 0x664]
mov dword [esp + 0x14], edx
mov dword [esp + 4], 0xc8
mov dword [esp], eax
call fcn.00410ca0
jmp 0x402cd0
xor ebx, ebx
jmp 0x402f98
mov dword [esp], ebx
nop
call sub.msvcrt.dll_fclose
mov eax, dword [esp + 0x48]
mov dword [esp], eax
call sub.msvcrt.dll_free
jmp 0x4031b8
mov eax, dword [esp + 0x48]
mov dword [esp + 4], str.short_write_on__s_n
mov dword [esp + 8], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
jmp 0x403170
mov dword [esp], ebp
call sub.msvcrt.dll_free
jmp 0x402fb0
call fcn.00405b10
mov dword [esp + 0x54], eax
jmp 0x402f8d
mov dword [esp], str.sendmsg
call sub.msvcrt.dll_perror
mov dword [esp], ebx
xor ebx, ebx
call sub.msvcrt.dll__close
jmp 0x402f98
mov dword [esp], ebx
call sub.msvcrt.dll_fclose
xor ebx, ebx
jmp 0x402f98
test ebp, ebp
mov eax, str._missing_redirect_
cmove ebp, eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], ebp
mov dword [esp + 4], str.failed_on_url__s_n
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov dword [esp + 0x54], 0
jmp 0x4031b8
mov eax, dword [esp + 0x48]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov dword [esp + 0x54], 0
jmp 0x4031b8
mov dword [esp], ebx
call sub.msvcrt.dll_fclose
mov dword [esp], str.fopen
call sub.msvcrt.dll_perror
jmp 0x4031b8
mov dword [esp], 0x413a06
call sub.msvcrt.dll_perror
mov dword [esp], 1
call sub.msvcrt.dll_exit
lea esi, [esi]