Function at 0x402a60
Capabilities:
Check internet connectivity via wininet
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5262a0
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x574c60]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x224], 0
call fcn.004069c6
mov eax, dword [esi + 0x20]
push 0
push eax
call dword [sym.imp.USER32.dll_GetSystemMenu]
push eax
call fcn.00417428
mov ebx, eax
test ebx, ebx
je 0x402b58
call fcn.0040522f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x402ad5
push 0x80004005
call fcn.00401950
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea edi, [eax + 0x10]
mov dword [ebp - 0x220], edi
push 0x65
mov dword [ebp - 4], 0
call fcn.00412fd8
test eax, eax
je 0x402b0d
push 0x65
push eax
lea ecx, [ebp - 0x220]
call fcn.00401d90
mov edi, dword [ebp - 0x220]
cmp dword [edi - 0xc], 0
je 0x402b35
mov ecx, dword [ebx + 4]
push 0
push 0
push 0x800
push ecx
call dword [sym.imp.USER32.dll_AppendMenuW]
mov edx, dword [ebx + 4]
push edi
push 0x10
push 0
push edx
call dword [sym.imp.USER32.dll_AppendMenuW]
lea eax, [edi - 0x10]
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402b58
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esi + 0xbc]
mov ecx, dword [esi + 0x20]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
push 1
push 0x80
push ecx
call edi
mov eax, dword [esi + 0xbc]
mov edx, dword [esi + 0x20]
push eax
push 0
push 0x80
push edx
call edi
push 0
push 0
push 0x91
push 0x84
lea ecx, [esi + 0x154]
call fcn.004171df
push 0
push 0
push 0x8f
push 0x86
lea ecx, [esi + 0x1e8]
call fcn.004171df
push 0
push 0
push 0x90
push 0x87
lea ecx, [esi + 0x27c]
call fcn.004171df
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
call fcn.0040522f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x402bfd
push 0x80004005
call fcn.00401950
mov edx, dword [eax]
push 2
mov edi, 3
mov ecx, eax
mov eax, dword [edx]
push edi
call eax
test eax, eax
jne 0x402c16
call fcn.00401940
add eax, 0x10
mov dword [ebp - 0x22c], eax
cmp dword [eax - 8], edi
jge 0x402c2e
push 0x80070057
call fcn.00401950
push 6
lea edx, [ebp - 0x218]
push edx
xor ecx, ecx
push 6
mov dword [eax - 0xc], edi
push eax
mov word [eax + 6], cx
call fcn.00503c39
push 0x553e98
lea eax, [ebp - 0x22c]
push eax
lea ecx, [ebp - 0x224]
push ecx
mov dword [ebp - 4], 1
call fcn.00404de0
add esp, 0x1c
mov byte [ebp - 4], 2
mov ecx, dword [eax]
mov edi, dword [esi + 0x43c]
lea eax, [ecx - 0x10]
sub edi, 0x10
cmp eax, edi
je 0x402cd5
cmp dword [edi + 0xc], 0
jl 0x402cc5
mov edx, dword [eax]
cmp edx, dword [edi]
jne 0x402cc5
push eax
call fcn.00405080
mov dword [ebp - 0x220], eax
add esp, 4
lea eax, [edi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x402cb4
mov ecx, dword [edi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push edi
call eax
mov ecx, dword [ebp - 0x220]
add ecx, 0x10
mov dword [esi + 0x43c], ecx
jmp 0x402cd5
mov eax, dword [ecx - 0xc]
push eax
push ecx
lea ecx, [esi + 0x43c]
call fcn.00401f50
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x224]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x402cfb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edi, 1
push edi
lea ecx, [ebp - 0x230]
push ecx
lea ecx, [esi + 0x43c]
call fcn.00404730
mov byte [ebp - 4], 3
mov ecx, 0x553eb0
mov edx, eax
mov dword [ebp - 0x224], edi
call fcn.00404860
test al, al
jne 0x402d6a
push edi
lea edx, [ebp - 0x220]
push edx
lea ecx, [esi + 0x43c]
call fcn.00404730
mov dword [ebp - 4], 4
mov ebx, 3
mov ecx, 0x553eb4
mov edx, eax
mov dword [ebp - 0x224], ebx
call fcn.00404860
test al, al
jne 0x402d70
mov byte [ebp - 0x219], al
jmp 0x402d77
mov ebx, dword [ebp - 0x224]
mov byte [ebp - 0x219], 1
mov dword [ebp - 4], 3
test bl, 2
je 0x402dae
mov eax, dword [ebp - 0x220]
and ebx, 0xfffffffd
add eax, 0xfffffff0
mov dword [ebp - 0x224], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402dae
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], edi
test bl, 1
je 0x402dd8
mov eax, dword [ebp - 0x230]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402dd8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp byte [ebp - 0x219], 0
je 0x402df8
push 0
push 0
push 0x553eb8
mov ecx, esi
call fcn.0040b51c
push 0
call fcn.005044c7
push str.http:__soft.aiheiyun.com_softheiyun2.5.html
lea ecx, [ebp - 0x228]
call fcn.00401c30
push str.http:__www.baidu.com
lea ecx, [ebp - 0x220]
mov byte [ebp - 4], 5
call fcn.00401c30
mov ecx, dword [ebp - 0x220]
xor edi, edi
push edi
push 1
push ecx
call dword [sym.imp.WININET.dll_InternetCheckConnectionW]
test eax, eax
mov eax, dword [ebp - 0x220]
je 0x402ea6
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x402e54
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ebx, [esi + 0xc0]
push 5
mov ecx, ebx
mov dword [esi + 0x438], 1
call fcn.0041123a
mov ecx, dword [ebp - 0x228]
push edi
push edi
push edi
push edi
push ecx
push str._bLLLL
push edi
push edi
push 1
push 0x68
push ebx
call fcn.004112a3
add esp, 0x2c
call dword [sym.imp.XLDownload.dll_XLInitDownloadEngine]
test eax, eax
jne 0x402ed4
push edi
push edi
push 0x553f54
mov ecx, esi
call fcn.0040b51c
jmp 0x402ece
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402ec2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push edi
lea ecx, [esi + 0xc0]
call fcn.0041123a
mov dword [esi + 0x438], edi
mov edx, dword [esi + 0x460]
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push 0x7d00000
push edi
push 0x401
push edx
mov dword [esi + 0x528], edi
call ebx
mov eax, dword [esi + 0x460]
push edi
push edi
push 0x402
push eax
call ebx
fldz
push 0x24
fstp qword [esi + 0x530]
lea ecx, [esi + 0x538]
push str.http:__down.aiheiyun.com_xp_ylmf.gho
call fcn.00401f50
push 0xa
lea ecx, [esi + 0x53c]
push str.winxp.gho
call fcn.00401f50
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x228]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402f56
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x22c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402f7f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00503c2a
mov esp, ebp
pop ebp
ret