Function at 0x402df3
Capabilities:
Create directory
Delete directory
Delete file
Get common file path
Initialize winhttp library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push edi
xor edi, edi
push edi
push edi
push edi
push edi
push str.Preloader
mov byte [ebp - 1], 0
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov dword [ebp - 0x18], eax
cmp eax, edi
je 0x402fda
push esi
mov esi, dword [ebp + 0xc]
push esi
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push 2
push edi
lea ecx, [ebp - 8]
mov eax, 0x915248
push ecx
push eax
push dword [ebp - 0x18]
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], eax
call fcn.00402db6
add esp, 0x24
test al, al
je 0x402fce
cmp dword [esi], edi
je 0x402e61
mov byte [ebp - 1], 1
jmp 0x402fce
push ebx
mov ebx, dword [ebp - 0x14]
cmp ebx, 2
jne 0x402fc5
cmp dword [ebp - 0xc], ebx
jle 0x402fc5
cmp byte [ebp - 8], 0x4d
jne 0x402fc1
cmp byte [ebp - 7], 0x5a
jne 0x402fc1
cmp word [0x406248], di
je 0x402e9f
push 0x406248
call fcn.00401c29
pop ecx
push dword [ebp - 0xc]
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0x14], esi
cmp esi, edi
je 0x402fbd
cmp dword [ebp - 0xc], 2
mov al, byte [ebp - 8]
mov byte [esi], al
mov al, byte [ebp - 7]
mov byte [esi + 1], al
jle 0x402f36
mov ecx, dword [ebp - 0xc]
sub ecx, ebx
mov eax, 0xc800
cmp ecx, eax
mov dword [ebp - 0x1c], edi
jg 0x402ee2
mov eax, ecx
push dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push eax
push ebx
lea eax, [esi + ebx]
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x18]
call fcn.00402db6
add esp, 0x24
test al, al
je 0x402f27
mov eax, dword [ebp + 0xc]
cmp dword [eax], edi
jne 0x402f2e
add ebx, dword [ebp - 0x1c]
cmp word [0x406248], di
je 0x402f27
push 0x406248
call fcn.00401c29
pop ecx
cmp ebx, dword [ebp - 0xc]
jl 0x402ecf
jmp 0x402f36
push 0x18
pop eax
call fcn.00401b10
cmp ebx, dword [ebp - 0xc]
jne 0x402fac
mov esi, 0xbe76e8
push esi
push 0x2800
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push esi
push edi
push 0x40463c
push esi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
call ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push esi
mov edi, 0x94df30
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push edi
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push dword [ebp - 0xc]
push dword [ebp - 0x14]
call fcn.00402912
pop ecx
pop ecx
mov byte [ebp - 1], al
test al, al
jne 0x402fa7
push edi
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esi, dword [ebp - 0x14]
xor edi, edi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x402fcd
push 0x17
jmp 0x402fc7
push 0x19
jmp 0x402fc7
push 0x16
pop eax
call fcn.00401b10
pop ebx
push dword [ebp - 0x18]
call dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
pop esi
jmp 0x402fe2
push 9
pop eax
call fcn.00401b10
mov al, byte [ebp - 1]
pop edi
leave
ret