Function at 0x402af0
Capabilities:
Delete file
Reference google public dns server

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, ecx
test eax, eax
je 0x402e50
mov ecx, eax
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x402b10
sub ecx, edx
sar ecx, 1
je 0x402e50
mov esi, dword [ebp + 8]
test esi, esi
je 0x402e50
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x402e50
push 0x31
push eax
lea eax, [edi + 0x7d8]
push eax
call fcn.00487152
add esp, 0xc
push dword [edi + 8]
xor eax, eax
mov word [edi + 0x83a], ax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push esi
mov ecx, edi
call fcn.00401e70
mov ebx, eax
test ebx, ebx
jns 0x402bc0
cmp dword [edi + 0x378], 0
je 0x402e55
push 0x2000
call fcn.0048614e
push dword [ebp + 8]
mov esi, eax
push str.URL__s__Reverse_lookup_fail
push 0xfff
push 0x1000
push esi
call fcn.00486606
push esi
call fcn.004010d0
mov eax, dword [ebp + 0x14]
add esp, 0x1c
mov dword [eax], 0x475
mov eax, dword [ebp + 0x18]
pop edi
mov dword [eax], esi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov edx, esi
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x402bc5
sub edx, ecx
sar edx, 1
lea eax, [esi - 8]
mov ecx, str..exe
lea eax, [eax + edx*2]
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x402c06
test dx, dx
je 0x402c02
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x402c06
add eax, 4
add ecx, 4
test dx, dx
jne 0x402be0
xor eax, eax
jmp 0x402c0b
sbb eax, eax
or eax, 1
test eax, eax
je 0x402c61
push 0x2000
call fcn.0048614e
push esi
push str.URL__s__not_ended_up_with_.exe
push 0xfff
mov ebx, eax
push 0x1000
push ebx
call fcn.00486606
push ebx
call fcn.004010d0
add esp, 0x1c
cmp dword [edi + 0x378], 0
je 0x402c51
mov eax, dword [ebp + 0x14]
mov dword [eax], 0x476
mov eax, dword [ebp + 0x18]
mov dword [eax], ebx
pop edi
mov ebx, 0x80700003
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov ebx, dword [ebp + 0xc]
push 0x103
lea eax, [edi + 0x3c8]
push ebx
push eax
call fcn.00487152
push 0x103
xor eax, eax
lea esi, [edi + 0x5d0]
push ebx
push esi
mov word [edi + 0x5ce], ax
call fcn.00487152
add esp, 0x18
xor eax, eax
push esi
mov word [edi + 0x7d6], ax
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
mov esi, dword [ebp + 8]
mov eax, dword [edi + 0xc]
lea ecx, [edi + 0xc]
push esi
call dword [eax]
push 0x2000
mov ebx, eax
call fcn.0048614e
test ebx, ebx
jns 0x402d27
push esi
push str.CreateConnection_failed__szURL___s
push 0xfff
push 0x1000
push eax
mov dword [ebp + 8], eax
call fcn.00486606
mov esi, dword [ebp + 8]
push esi
call fcn.004010d0
add esp, 0x1c
mov ecx, edi
push str.8.8.8.8
call fcn.00403570
test eax, eax
jns 0x402d01
push str.8.8.4.4
mov ecx, edi
call fcn.00403570
cmp dword [edi + 0x378], 0
je 0x402e55
mov eax, dword [ebp + 0x14]
pop edi
mov dword [eax], 0x476
mov eax, dword [ebp + 0x18]
mov dword [eax], esi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0x14
push 0x4a1b98
push 0xfff
mov esi, eax
push 0x1000
push esi
call fcn.00486606
add esp, 0x14
mov ecx, edi
push esi
push 1
call fcn.00401f90
mov ebx, eax
test ebx, ebx
jns 0x402dcd
push esi
push 0
mov ecx, edi
call fcn.00401f90
mov ebx, eax
test ebx, ebx
jns 0x402dcd
push 0x2000
call fcn.0048614e
push 0xfff
push esi
push 0x1000
push eax
mov dword [ebp + 8], eax
call fcn.00486548
mov ecx, dword [ebp + 8]
xor eax, eax
add esp, 0x14
mov word [ecx + 0x1ffe], ax
cmp dword [edi + 0x378], eax
je 0x402da4
mov eax, dword [ebp + 0x14]
mov dword [eax], 0x476
mov eax, dword [ebp + 0x18]
mov dword [eax], ecx
push str.GetInfo_failed_
call fcn.004010d0
add esp, 4
test esi, esi
je 0x402e55
push esi
call fcn.004866e2
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
cmp byte [edi + 0x384], 0
mov eax, dword [0x4c8068]
mov ecx, 1
cmove eax, ecx
mov dword [0x4c8068], eax
mov eax, dword [edi + 0x390]
mov ecx, dword [edi + 0x394]
cmp eax, dword [edi + 0x388]
jne 0x402e12
cmp ecx, dword [edi + 0x38c]
jne 0x402e12
pop edi
mov ebx, 1
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0x14
or eax, ecx
je 0x402db1
lea eax, [edi + 0x3c8]
push eax
mov dword [edi + 0x390], 0
mov dword [edi + 0x394], 0
mov dword [edi + 0x398], 0
mov dword [edi + 0x39c], 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x402db1
mov ebx, 0x80070057
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0x14