Function at 0x10002d80
Capabilities:
Delete file
Download url
Enumerate pe sections
Receive data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100057be
push eax
mov dword fs:[0], esp
sub esp, 0x7c
push ebx
push ebp
push esi
push edi
mov esi, ecx
call sub.MFC42.DLL_AfxGetModuleState
mov ebp, dword [eax + 4]
mov al, byte [esi + 6]
xor ebx, ebx
cmp al, bl
jne 0x10002db7
or eax, 0xffffffff
jmp 0x100030c3
lea eax, [esi + 0x10]
lea ecx, [esp + 0x14]
push eax
call sub.MFC42.DLL_CString::CString_2
push 0x100082d8
lea ecx, [esp + 0x24]
mov dword [esp + 0x98], ebx
call sub.MFC42.DLL_CString::CString
mov cl, byte [0x100082d8]
xor eax, eax
mov byte [esp + 0x28], cl
mov ecx, 0x18
lea edi, [esp + 0x29]
lea edx, [esi + 0x14]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push edx
lea ecx, [esp + 0x20]
mov byte [esp + 0x98], 1
xor edi, edi
call sub.MFC42.DLL_CString::CString_2
lea eax, [esi + 0x20]
lea ecx, [esp + 0x18]
push eax
mov byte [esp + 0x98], 2
call sub.MFC42.DLL_CString::CString_2
push ecx
lea edx, [esp + 0x20]
mov ecx, esp
mov dword [esp + 0x28], esp
push edx
mov byte [esp + 0x9c], 3
call sub.MFC42.DLL_CString::CString_2
lea eax, [esp + 0x28]
mov ecx, esi
push eax
call fcn.100036c0
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x98], 4
call fcn.10004cfc
lea ecx, [esp + 0x24]
mov byte [esp + 0x94], 3
call fcn.10004cf0
push ecx
lea edx, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x28], esp
push edx
call sub.MFC42.DLL_CString::CString_2
lea eax, [esp + 0x28]
mov ecx, esi
push eax
call fcn.100036c0
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x98], 5
call fcn.10004cfc
lea ecx, [esp + 0x24]
mov byte [esp + 0x94], 3
call fcn.10004cf0
push str._temp.32
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::operator_1
add esi, 0xcc
lea ecx, [esp + 0x10]
push esi
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esp + 0x1c]
mov byte [esp + 0x94], 6
push ecx
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::operator
push str.x_servicetype
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::operator_1
lea edx, [esp + 0x18]
lea ecx, [esp + 0x10]
push edx
call sub.MFC42.DLL_CString::operator
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push ebx
push ebx
push eax
push ecx
push ebx
call sub.urlmon.dll_URLDownloadToFileA
cmp eax, ebx
je 0x10002f2d
inc edi
cmp edi, 2
jge 0x1000304a
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
push ebx
push ebx
push edx
push eax
push ebx
call sub.urlmon.dll_URLDownloadToFileA
cmp eax, ebx
jne 0x10002f0d
mov ecx, dword [esp + 0x14]
push 0x100080b4
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
mov eax, dword [esi + 0xc]
test al, 0x10
jne 0x10002f78
mov edi, dword [sym.imp.MSVCRT.dll_fscanf]
test al, 0x20
jne 0x10002f78
lea edx, [esp + 0x28]
push edx
push 0x100080b0
push esi
call edi
add esp, 0xc
lea eax, [esp + 0x28]
lea ecx, [esp + 0x20]
push eax
call fcn.10004dbc
mov eax, dword [esi + 0xc]
test al, 0x10
je 0x10002f4f
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov ecx, dword [esp + 0x18]
add esp, 4
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esp + 0x20]
mov esi, 0x100080a8
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x10002fba
cmp cl, bl
je 0x10002fb6
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x10002fba
add eax, 2
add esi, 2
cmp cl, bl
jne 0x10002f96
xor eax, eax
jmp 0x10002fbf
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x10003024
lea ecx, [esp + 0x10]
mov byte [esp + 0x94], 3
call fcn.10004cf0
lea ecx, [esp + 0x18]
mov byte [esp + 0x94], 2
call fcn.10004cf0
lea ecx, [esp + 0x1c]
mov byte [esp + 0x94], 1
call fcn.10004cf0
lea ecx, [esp + 0x20]
mov byte [esp + 0x94], bl
call fcn.10004cf0
lea ecx, [esp + 0x14]
mov dword [esp + 0x94], 0xffffffff
call fcn.10004cf0
mov eax, 1
jmp 0x100030c3
mov eax, dword [ebp + 0x20]
cmp eax, ebx
jne 0x1000303a
push ebx
push 0x100080a0
xor eax, eax
push 0x10008108
jmp 0x10003063
mov eax, dword [eax + 0x20]
push ebx
push 0x100080a0
push 0x10008108
jmp 0x10003063
mov eax, dword [ebp + 0x20]
cmp eax, ebx
jne 0x10003055
xor eax, eax
jmp 0x10003058
mov eax, dword [eax + 0x20]
push ebx
push 0x100080a0
push 0x100080f8
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [esp + 0x10]
mov byte [esp + 0x94], 3
call fcn.10004cf0
lea ecx, [esp + 0x18]
mov byte [esp + 0x94], 2
call fcn.10004cf0
lea ecx, [esp + 0x1c]
mov byte [esp + 0x94], 1
call fcn.10004cf0
lea ecx, [esp + 0x20]
mov byte [esp + 0x94], bl
call fcn.10004cf0
lea ecx, [esp + 0x14]
mov dword [esp + 0x94], 0xffffffff
call fcn.10004cf0
xor eax, eax
mov ecx, dword [esp + 0x8c]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x88
ret