Function at 0x403710
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x23c
mov edx, dword [esp + 0x250]
lea ebx, [esp + 0x20]
mov eax, ebx
call fcn.004026b0
test eax, eax
je 0x403acb
cmp byte [esp + 0x20], 0
mov dword [esp + 0x14], 0
je 0x40393e
mov dword [esp + 8], 6
mov dword [esp + 4], str.HTTP_1
mov dword [esp], ebx
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x403b78
mov dword [esp + 4], 0x20
mov dword [esp], ebx
call sub.msvcrt.dll_strchr
test eax, eax
mov esi, eax
je 0x403b78
lea eax, [eax + 1]
mov dword [esp], eax
call sub.msvcrt.dll_atoi
cmp eax, 0x12d
mov dword [esp + 0x14], eax
jne 0x4038e4
cmp byte [esi - 1], 0x30
je 0x403b2a
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x1c], 0
sub ecx, 0x12d
mov dword [esp + 0x18], ecx
nop
lea esi, [esi]
mov edx, dword [esp + 0x250]
mov eax, ebx
call fcn.004026b0
test eax, eax
je 0x403acb
movzx eax, byte [esp + 0x20]
test al, al
je 0x403a8e
cmp al, 0xd
je 0x403a8e
mov dword [esp + 4], 0x413f15
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
test eax, eax
mov esi, eax
je 0x403acb
mov byte [eax], 0
lea ebp, [eax + 2]
movzx eax, byte [ebx]
test al, al
je 0x40382b
mov edx, ebx
lea ecx, [eax - 0x41]
cmp cl, 0x19
ja 0x403821
add eax, 0x20
mov byte [edx], al
add edx, 1
movzx eax, byte [edx]
test al, al
jne 0x403814
mov dword [esp + 4], 0x413f18
mov edi, str.connection
mov dword [esp], ebp
call sub.msvcrt.dll_strcspn
mov ecx, 0xb
mov byte [esi + eax + 2], 0
mov esi, ebx
repe cmpsb byte [esi], byte es:[edi]
jne 0x403871
mov edi, 0x413f26
mov ecx, 6
mov esi, ebp
repe cmpsb byte [esi], byte es:[edi]
jne 0x403871
mov edx, dword [esp + 0x250]
mov dword [edx + 0x1138], 2
cmp dword [esp + 0x14], 0xce
je 0x403950
cmp dword [esp + 0x18], 1
ja 0x4037c0
mov edi, str.location
mov ecx, 9
mov esi, ebx
repe cmpsb byte [esi], byte es:[edi]
jne 0x4037c0
mov edi, dword [esp + 0x1c]
test edi, edi
jne 0x403b9c
mov esi, dword [0x4183fc]
test esi, esi
je 0x403ae2
mov eax, dword [esp + 0x250]
mov edx, ebp
call fcn.00402500
mov edx, dword [esp + 0x250]
mov dword [esp + 0x1c], 1
mov dword [edx + 0x1138], 2
jmp 0x4037c0
cmp eax, 0xce
je 0x40379b
cmp eax, 0x12e
je 0x40379b
sub eax, 0x12c
cmp eax, 0x63
jbe 0x403bd1
cmp dword [esp + 0x14], 0xc8
je 0x403b15
mov eax, dword [esp + 0x14]
mov dword [esp + 4], str.bad_status_code__d_n
mov dword [esp + 8], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov dword [esp + 0x14], 0xffffffff
mov eax, dword [esp + 0x14]
add esp, 0x23c
pop ebx
pop esi
pop edi
pop ebp
ret
mov edi, str.content_range
mov ecx, 0xe
mov esi, ebx
repe cmpsb byte [esi], byte es:[edi]
je 0x403a05
mov dword [esp + 4], str.content_type
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll__stricmp]
test eax, eax
jne 0x40387f
mov dword [esp + 8], 0x14
mov dword [esp + 4], str.multipart_byteranges
mov dword [esp], ebp
call dword [sym.imp.msvcrt.dll__strnicmp_1]
test eax, eax
jne 0x40387f
mov dword [esp + 4], str.boundary
mov dword [esp], ebp
call sub.msvcrt.dll_strstr
test eax, eax
je 0x403acb
cmp byte [eax + 9], 0x22
je 0x403b40
add eax, 9
mov dword [esp], eax
call sub.msvcrt.dll__strdup
mov esi, eax
mov eax, dword [esp + 0x250]
mov dword [eax + 0x114], esi
mov dword [esp], esi
call sub.msvcrt.dll_strlen
lea eax, [esi + eax - 1]
jmp 0x4039ee
mov byte [eax], 0
sub eax, 1
movzx edx, byte [eax]
cmp dl, 0x20
je 0x4039e8
cmp dl, 0xd
je 0x4039e8
cmp dl, 0xa
je 0x4039e8
jmp 0x40387f
lea eax, [esp + 0x228]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x220]
mov dword [esp + 8], eax
mov dword [esp + 4], str.bytes__I64u__I64u_
mov dword [esp], ebp
call sub.msvcrt.dll_sscanf
mov eax, dword [esp + 0x224]
cmp eax, dword [esp + 0x22c]
mov edx, dword [esp + 0x220]
mov ecx, dword [esp + 0x228]
jg 0x403a6d
jge 0x403b03
mov esi, dword [esp + 0x250]
add ecx, 1
sub ecx, edx
mov dword [esi + 0x118], ecx
mov dword [esi + 0x120], edx
mov dword [esi + 0x124], eax
mov edx, dword [esp + 0x250]
mov eax, dword [edx + 0x1148]
add eax, 1
mov dword [edx + 0x1148], eax
mov dword [edx + 0x1144], eax
jmp 0x403964
mov esi, dword [esp + 0x250]
mov eax, dword [esi + 0x114]
test eax, eax
je 0x403b89
mov eax, dword [esi + 0x118]
test eax, eax
je 0x40393e
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x403acb
mov eax, dword [esp + 0x14]
sub eax, 0x12c
cmp eax, 0x63
jbe 0x40393e
mov dword [esp + 0x14], 0xffffffff
mov eax, dword [esp + 0x14]
add esp, 0x23c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], ebp
mov dword [esp + 4], str.followed_redirect_to__s_n
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
jmp 0x4038b8
cmp edx, ecx
ja 0x403a6d
nop
lea esi, [esi]
jmp 0x403a4f
mov dword [esp + 8], 0xc8
mov dword [esp + 4], str._nzsync_received_a_data_response__code__d__but_this_is_not_a_partial_content_response_nzsync_can_only_work_with_servers_that_support_returning_partial_content_from_files._The_person_entity_creating_this_.zsync_has_tried_to_use_a_server_that_is_not_returning_partial_content._zsync_cannot_be_used_with_this_server._nSee_http:__zsync.moria.orc.uk_server_issues_n
jmp 0x403926
mov edx, dword [esp + 0x250]
mov dword [edx + 0x1138], 2
jmp 0x4037a5
add eax, 0xa
mov dword [esp], eax
call sub.msvcrt.dll__strdup
mov ecx, dword [esp + 0x250]
mov dword [ecx + 0x114], eax
mov dword [esp + 4], 0x22
mov dword [esp], eax
call sub.msvcrt.dll_strchr
test eax, eax
je 0x40387f
mov byte [eax], 0
jmp 0x40387f
mov dword [esp + 8], ebx
mov dword [esp + 4], str.got_non_HTTP_response__s_n
jmp 0x403926
mov eax, dword [esi + 0x118]
test eax, eax
jne 0x40393e
jmp 0x403ab1
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x2d
mov dword [esp + 4], 1
mov dword [esp], str.Error:_multiple_Location_headers_on_redirect_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov dword [esp + 0x14], 0xffffffff
jmp 0x40393e
mov eax, dword [esp + 0x14]
mov dword [esp + 4], str._nzsync_received_a_redirect_further_action_required_status_code:__d_nzsync_specifically_refuses_to_proceed_when_a_server_requests_further_action._This_is_because_zsync_makes_a_very_large_number_of_requests_per_file_retrieved__and_so_if_zsync_has_to_perform_additional_actions_per_request__it_further_increases_the_load_on_the_target_server._The_person_entity_who_created_this_zsync_file_should_change_it_to_point_directly_to_a_URL_where_the_target_file_can_be_retrieved_without_additional_actions_redirects_needing_to_be_followed._nSee_http:__zsync.moria.orc.uk_server_issues_n
mov dword [esp + 8], eax
jmp 0x403926