Function at 0x6308a378
Capabilities:
Write file on windows

Disassembly:
push ebp
mov eax, 0x354c
mov ebp, esp
push edi
push esi
push ebx
call fcn.630a6c70
xor esi, esi
mov ecx, 0x40
lea edx, [ebp - 0x3520]
lea edi, [ebp - 0x3518]
sub esp, eax
mov eax, esi
mov ebx, dword [ebp + 8]
rep stosd dword es:[edi], eax
mov edi, edx
mov ecx, 2
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x3018]
mov ecx, 0x400
rep stosd dword es:[edi], eax
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x630c4838
mov dword [esp], 0
call fcn.63085a10
lea edx, [eax + 3]
test eax, eax
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x630c483c
cmovns esi, edx
mov dword [esp], esi
call fcn.63085a10
test eax, eax
js 0x6308a42e
mov dword [ebp - 0x352c], eax
sub eax, esi
mov dword [esp + 8], esi
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x3518]
mov dword [esp + 4], ebx
mov edi, ebx
mov dword [esp], eax
call fcn.630856b3
xor eax, eax
or ecx, 0xffffffff
mov edx, dword [ebp - 0x352c]
repne scasb al, byte es:[edi]
not ecx
dec ecx
sub ecx, edx
mov dword [esp + 0xc], ecx
jmp 0x6308a474
mov dword [ebp - 0x352c], eax
mov edi, ebx
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
lea eax, [ebp - 0x3518]
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
not ecx
mov edi, ebx
dec ecx
mov dword [esp], eax
sub ecx, esi
mov dword [esp + 0xc], ecx
call fcn.630856b3
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [ebp - 0x352c]
repne scasb al, byte es:[edi]
not ecx
dec ecx
sub ecx, esi
mov dword [esp + 0xc], ecx
lea eax, [ebp - 0x3018]
mov dword [esp + 4], ebx
lea ebx, [ebp - 0x3518]
mov dword [esp + 8], edx
mov dword [esp], eax
call fcn.630856b3
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x630c483e
mov dword [esp], 0
call fcn.63085a10
test eax, eax
mov esi, eax
js 0x6308a4e6
xor eax, eax
or ecx, 0xffffffff
mov edi, ebx
repne scasb al, byte es:[edi]
mov eax, esi
mov dword [esp + 4], ebx
not ecx
not eax
lea eax, [ecx + eax - 1]
mov dword [esp + 0xc], eax
lea eax, [esi + 1]
mov dword [esp + 8], eax
lea eax, [ebp - 0x3520]
mov dword [esp], eax
call fcn.630856b3
mov byte [ebp + esi - 0x3518], 0
lea esi, [ebp - 0x3520]
mov dword [esp], esi
call sub.msvcrt.dll_atol
test eax, eax
jg 0x6308a508
mov dword [esp + 4], 0x630c4840
mov dword [esp], esi
call sub.msvcrt.dll_strcpy
cmp byte [ebp - 0x3518], 0
je 0x6308a79f
call fcn.63087439
mov dword [esp + 8], esi
lea esi, [ebp - 0x3524]
mov dword [esp + 4], ebx
mov dword [esp], esi
call fcn.63087483
test al, al
je 0x6308a79f
lea edi, [ebp - 0x2018]
xor eax, eax
mov ecx, 0x800
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x3018]
mov dword [esp + 0xc], ebx
lea edi, [ebp - 0x2018]
mov dword [esp + 4], 0x63162e80
or ebx, 0xffffffff
mov dword [esp + 8], eax
lea eax, [ebp - 0x2018]
mov dword [esp], eax
call sub.msvcrt.dll_sprintf
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
lea eax, [ebp - 0x2018]
mov dword [esp], esi
lea edi, [ebp - 0x2018]
not ecx
dec ecx
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
call fcn.63087630
mov ecx, 0x800
xor eax, eax
mov dword [ebp - 0x352c], 0
rep stosd dword es:[edi], eax
mov dword [ebp - 0x3530], 0
cmp dword [ebp - 0x3524], 0xffffffff
je 0x6308a68d
cmp dword [ebp - 0x352c], 0x1fff
jg 0x6308a68d
cmp dword [ebp - 0x3530], 7
jg 0x6308a68d
lea edi, [ebp - 0x3418]
xor eax, eax
mov ecx, 0x100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x3418]
mov dword [esp + 0x10], 0xbde31
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x400
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.630875f1
test eax, eax
mov edi, eax
jle 0x6308a873
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x352c]
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
lea eax, [ebp - 0x3418]
mov dword [esp + 4], eax
lea eax, [ebp - 0x2018]
mov dword [esp], eax
call fcn.63087b59
lea eax, [ebp - 0x2018]
mov dword [esp + 4], str._r_n_r_n
mov dword [esp], 0
add dword [ebp - 0x352c], edi
mov dword [esp + 8], eax
call fcn.63085a10
test eax, eax
mov ebx, eax
js 0x6308a87b
add ebx, 4
mov dword [ebp - 0x3530], 0
mov al, byte [ebp - 0x200f]
mov dword [ebp - 0x3418], 0
lea edi, [ebp - 0x3418]
mov dword [esp + 8], 3
mov dword [esp + 4], 0x630c4848
mov dword [esp], edi
mov byte [ebp - 0x3418], al
mov al, byte [ebp - 0x200e]
mov byte [ebp - 0x3417], al
mov al, byte [ebp - 0x200d]
mov byte [ebp - 0x3416], al
call fcn.63087082
cmp dword [ebp - 0x3530], 7
setg dl
cmp al, dl
jbe 0x6308a79f
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], 0x630c4350
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__wfopen]
test eax, eax
mov esi, eax
je 0x6308a79f
cmp dword [ebp - 0x352c], ebx
mov dword [ebp - 0x3530], 0
jle 0x6308a754
mov edx, ebx
movsx eax, byte [ebp + edx - 0x2018]
mov dword [esp + 4], esi
mov dword [ebp - 0x3530], edx
mov dword [esp], eax
call sub.msvcrt.dll_fputc
mov edx, dword [ebp - 0x3530]
inc edx
cmp dword [ebp - 0x352c], edx
jne 0x6308a71d
mov eax, dword [ebp - 0x352c]
sub eax, ebx
mov dword [ebp - 0x3530], eax
lea edx, [ebp - 0x2018]
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0x630c490e
mov dword [esp + 4], str.Content_Length:
mov dword [esp], edx
mov dword [ebp - 0x3534], edx
call fcn.6308a2dd
mov dword [esp], edi
call sub.msvcrt.dll_atol
mov ebx, eax
test eax, eax
mov eax, 0x100000
cmovle ebx, eax
mov dword [ebp - 0x352c], 0
jmp 0x6308a844
xor eax, eax
jmp 0x6308a898
cmp dword [ebp - 0x3530], ebx
jge 0x6308a851
cmp dword [ebp - 0x352c], 7
jg 0x6308a851
mov edi, dword [ebp - 0x3534]
xor eax, eax
mov ecx, 0x800
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x3534]
mov dword [esp + 0x10], 0xbde31
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x2000
mov dword [esp + 4], eax
lea eax, [ebp - 0x3524]
mov dword [esp], eax
call fcn.630875f1
inc dword [ebp - 0x352c]
test eax, eax
jle 0x6308a836
add dword [ebp - 0x3530], eax
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x3534]
mov dword [esp + 0xc], esi
mov dword [esp + 8], 1
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
mov dword [ebp - 0x352c], 0
mov dword [esp], 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push eax
cmp dword [ebp - 0x3524], 0xffffffff
jne 0x6308a7a6
mov dword [esp], esi
call sub.msvcrt.dll_fclose
lea eax, [ebp - 0x3524]
mov dword [esp], eax
call fcn.6308752c
cmp dword [ebp - 0x352c], 7
setle al
jmp 0x6308a898
inc dword [ebp - 0x3530]
jmp 0x6308a885
mov dword [ebp - 0x3530], 0
mov dword [esp], 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push edx
jmp 0x6308a5b7
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret