Function at 0x402a61
Capabilities:
Create directory
Delete directory
Delete file
Get common file path
Initialize winhttp library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
xor edi, edi
push edi
push edi
push edi
push edi
push str.Preloader
mov byte [ebp - 1], 0
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov dword [ebp - 0x18], eax
cmp eax, edi
je 0x402c46
mov esi, dword [ebp + 0xc]
push esi
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push 2
push edi
lea ecx, [ebp - 8]
mov eax, 0x914130
push ecx
push eax
push dword [ebp - 0x18]
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], eax
call fcn.00402a23
add esp, 0x24
test al, al
je 0x402c3b
cmp dword [esi], edi
je 0x402ad0
mov byte [ebp - 1], 1
jmp 0x402c3b
mov ebx, dword [ebp - 0x14]
cmp ebx, 2
jne 0x402c33
cmp dword [ebp - 0xc], ebx
jle 0x402c33
cmp byte [ebp - 8], 0x4d
jne 0x402c2f
cmp byte [ebp - 7], 0x5a
jne 0x402c2f
cmp word [0x405130], di
je 0x402b0d
push 0x405130
call main
pop ecx
push dword [ebp - 0xc]
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0x14], esi
cmp esi, edi
je 0x402c2b
cmp dword [ebp - 0xc], 2
mov al, byte [ebp - 8]
mov byte [esi], al
mov al, byte [ebp - 7]
mov byte [esi + 1], al
jle 0x402ba4
mov ecx, dword [ebp - 0xc]
sub ecx, ebx
mov eax, 0xc800
cmp ecx, eax
mov dword [ebp - 0x1c], edi
jg 0x402b50
mov eax, ecx
push dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push eax
push ebx
lea eax, [esi + ebx]
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x18]
call fcn.00402a23
add esp, 0x24
test al, al
je 0x402b95
mov eax, dword [ebp + 0xc]
cmp dword [eax], edi
jne 0x402b9c
add ebx, dword [ebp - 0x1c]
cmp word [0x405130], di
je 0x402b95
push 0x405130
call main
pop ecx
cmp ebx, dword [ebp - 0xc]
jl 0x402b3d
jmp 0x402ba4
push 0x18
pop eax
call fcn.004019f4
cmp ebx, dword [ebp - 0xc]
jne 0x402c1a
mov esi, 0xbb54b8
push esi
push 0x2800
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push esi
push edi
push 0x404534
push esi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
call ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push esi
mov edi, 0x94b5f0
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push edi
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push dword [ebp - 0xc]
push dword [ebp - 0x14]
call fcn.00402524
pop ecx
pop ecx
mov byte [ebp - 1], al
test al, al
jne 0x402c15
push edi
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esi, dword [ebp - 0x14]
xor edi, edi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x402c3b
push 0x17
jmp 0x402c35
push 0x19
jmp 0x402c35
push 0x16
pop eax
call fcn.004019f4
push dword [ebp - 0x18]
call dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
jmp 0x402c4e
push 9
pop eax
call fcn.004019f4
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret