Function at 0x4039b0
Capabilities:
Delete file
Reference google public dns server

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
test edi, edi
mov esi, ecx
je 0x403cf3
mov eax, edi
lea edx, [eax + 2]
jmp 0x4039d0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4039d0
sub eax, edx
sar eax, 1
je 0x403cf3
mov ebx, dword [esp + 0x18]
test ebx, ebx
je 0x403cf3
mov eax, dword [esp + 0x20]
test eax, eax
je 0x403cf3
lea edx, [esi + 0x63c]
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x403a05
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push ebx
mov ecx, esi
call fcn.004037c0
mov ebp, eax
test ebp, ebp
jge 0x403a7f
cmp dword [esi + 0x1e8], 0
je 0x403cf8
push 0x2000
call fcn.00477742
push ebx
push str.URL__s__Reverse_lookup_fail
mov edi, eax
push 0x1000
push edi
call fcn.00477bdc
push edi
call fcn.00401030
mov ecx, dword [esi + 0x1ec]
mov edx, dword [esi + 0x1e8]
push ecx
push edi
push ebp
push 0x475
call edx
add esp, 0x28
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
pop ecx
ret 0xc
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x403a84
sub eax, edx
sar eax, 1
mov ecx, str..exe
lea eax, [ebx + eax*2 - 8]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x403ac6
test dx, dx
je 0x403ac2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x403ac6
add eax, 4
add ecx, 4
test dx, dx
jne 0x403aa0
xor eax, eax
jmp 0x403acb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x403b21
push 0x2000
call fcn.00477742
push ebx
push str.URL__s__not_ended_up_with_.exe
mov edi, eax
push 0x1000
push edi
call fcn.00477bdc
push edi
call fcn.00401030
mov eax, dword [esi + 0x1e8]
add esp, 0x18
test eax, eax
je 0x403b12
mov ecx, dword [esi + 0x1ec]
push ecx
push edi
push ebp
push 0x476
call eax
add esp, 0x10
pop edi
mov ebp, 0x80700003
pop esi
mov eax, ebp
pop ebp
pop ebx
pop ecx
ret 0xc
lea edx, [esi + 0x22c]
mov dword [esp + 0x18], edx
mov eax, edi
sub edx, edi
nop
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x403b30
mov eax, edi
lea edi, [esi + 0x434]
mov edx, edi
sub edx, eax
jmp 0x403b50
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x403b50
push edi
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
mov edx, dword [esi + 0xc]
mov eax, dword [edx]
lea ecx, [esi + 0xc]
push ebx
call eax
push 0x2000
mov ebp, eax
call fcn.00477742
test ebp, ebp
mov edi, eax
jge 0x403be4
push ebx
push str.CreateConnection_failed__szURL___s
push 0x1000
push edi
call fcn.00477bdc
push edi
call fcn.00401030
add esp, 0x18
push str.8.8.8.8
mov ecx, esi
call fcn.00402ab0
test eax, eax
jge 0x403bb9
push str.8.8.4.4
mov ecx, esi
call fcn.00402ab0
mov eax, dword [esi + 0x1e8]
test eax, eax
je 0x403cf8
mov ecx, dword [esi + 0x1ec]
push ecx
push edi
push ebp
push 0x476
call eax
add esp, 0x10
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
pop ecx
ret 0xc
push 0x492aa0
push 0x1000
push edi
call fcn.00477bdc
add esp, 0x10
push edi
push 1
mov ecx, esi
call fcn.00402570
mov ebp, eax
xor ebx, ebx
cmp ebp, ebx
jge 0x403c78
push edi
push ebx
mov ecx, esi
call fcn.00402570
mov ebp, eax
cmp ebp, ebx
jge 0x403c78
push 0x2000
call fcn.00477742
push edi
mov ebx, eax
push 0x1000
push ebx
call fcn.00477a95
mov eax, dword [esi + 0x1e8]
add esp, 0x10
test eax, eax
je 0x403c50
mov edx, dword [esi + 0x1ec]
push edx
push ebx
push ebp
push 0x476
call eax
add esp, 0x10
push str.GetInfo_failed_
call fcn.00401030
add esp, 4
test edi, edi
je 0x403cf8
push edi
call fcn.00477e1a
add esp, 4
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
pop ecx
ret 0xc
cmp byte [esi + 0x1f4], bl
jne 0x403c8a
mov dword [0x4af068], 1
mov eax, dword [esi + 0x200]
cmp eax, dword [esi + 0x1f8]
mov ecx, dword [esi + 0x204]
jne 0x403cb5
cmp ecx, dword [esi + 0x1fc]
jne 0x403cb5
pop edi
mov ebp, 1
pop esi
mov eax, ebp
pop ebp
pop ebx
pop ecx
ret 0xc
or eax, ecx
je 0x403cdc
mov eax, dword [esp + 0x18]
push eax
mov dword [esi + 0x200], ebx
mov dword [esi + 0x204], ebx
mov dword [esi + 0x208], ebx
mov dword [esi + 0x20c], ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp edi, ebx
je 0x403cf8
push edi
call fcn.00477e1a
add esp, 4
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
pop ecx
ret 0xc
mov ebp, 0x80070057
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
pop ecx
ret 0xc