Function at 0x402fc0
Capabilities:
Initialize winhttp library

Disassembly:
sub esp, 0x24
push ebx
push esi
xor esi, esi
push esi
push esi
push esi
push esi
push str.Preloader
mov byte [esp + 0x1f], 0
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov ebx, eax
mov dword [esp + 0x14], ebx
cmp ebx, esi
je 0x4031fc
push ebp
mov ebp, dword [esp + 0x3c]
push ebp
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 2
push esi
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x34]
push eax
push ebx
mov dword [esp + 0x34], esi
mov dword [esp + 0x40], esi
mov dword [esp + 0x3c], 0x4534e0
call fcn.00402f60
add esp, 0x20
test al, al
je 0x4031da
cmp dword [ebp], esi
je 0x403036
mov byte [esp + 0xf], 1
jmp 0x4031da
mov esi, dword [esp + 0x20]
push edi
cmp esi, 2
jne 0x4031cf
mov edi, dword [esp + 0x18]
cmp edi, esi
jle 0x4031cf
mov ax, word [esp + 0x14]
cmp al, 0x4d
jne 0x4031cb
cmp ah, 0x5a
jne 0x4031cb
cmp word [0xed7ee8], 0
je 0x40307d
push 0xed7ee8
call fcn.00401b00
add esp, 4
push edi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x4031be
cmp edi, 2
mov cl, byte [esp + 0x14]
mov byte [ebx], cl
mov dl, byte [esp + 0x15]
mov byte [ebx + 1], dl
jle 0x403128
lea esp, [esp]
mov eax, edi
sub eax, esi
cmp eax, 0xc800
mov dword [esp + 0x24], 0
jle 0x4030c8
mov eax, 0xc800
push ebp
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x20]
push edx
mov edx, dword [esp + 0x28]
push eax
push esi
lea eax, [ebx + esi]
push eax
lea ecx, [esp + 0x38]
push ecx
push edx
call fcn.00402f60
add esp, 0x20
test al, al
je 0x403110
cmp dword [ebp], 0
jne 0x40311a
add esi, dword [esp + 0x24]
cmp word [0xed7ee8], 0
je 0x403110
push 0xed7ee8
call fcn.00401b00
add esp, 4
mov edi, dword [esp + 0x18]
cmp esi, edi
jl 0x4030b0
jmp 0x403128
push 0x18
call fcn.00401970
mov edi, dword [esp + 0x1c]
add esp, 4
cmp esi, edi
jne 0x4031a8
lea eax, [esp + 0x28]
push eax
call fcn.00405080
add esp, 4
push str.__45_LoadedContent
push esi
push 0
push 4
lea ecx, [esp + 0x38]
push ecx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
lea edx, [esp + 0x28]
push edx
mov ebp, eax
call fcn.00404fe0
push ebp
push 1
call fcn.00405000
add esp, 0xc
test ebp, ebp
je 0x4031a8
push ebp
push 1
call fcn.00405000
add esp, 8
push 0
push 0
push 0
push 2
push ebp
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebp, eax
test ebp, ebp
je 0x4031a8
push edi
push ebx
push ebp
call fcn.00405139
add esp, 0xc
push ebp
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [0xee1f14], esi
mov byte [esp + 0x13], 1
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ebx, dword [esp + 0x1c]
jmp 0x4031d9
push 0x17
call fcn.00401970
mov ebx, dword [esp + 0x20]
jmp 0x4031d6
push 0x19
jmp 0x4031d1
push 0x16
call fcn.00401970
add esp, 4
pop edi
push ebx
call dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov eax, dword [esp + 0x1c]
push eax
push 0x4534e0
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov al, byte [esp + 0xf]
pop ebp
pop esi
pop ebx
add esp, 0x24
ret
push 9
call fcn.00401970
mov al, byte [esp + 0xf]
add esp, 4
pop esi
pop ebx
add esp, 0x24
ret