Function at 0x412b34
Capabilities:
Create process on windows
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x12c], ebx
mov dword [ebp - 0x124], ebx
mov dword [ebp - 0x128], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
mov edi, ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x412e38
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [esi]
push eax
call sub.kernel32.dll_FreeLibrary_1
mov eax, dword [esi]
push eax
call sub.kernel32.dll_FreeLibrary_1
lea eax, [ebp - 8]
mov ecx, 0x412e50
mov edx, edi
call fcn.0040418c
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.00407638
mov edx, edi
mov eax, ebx
call fcn.00407638
mov eax, 0x400
call fcn.00402994
mov esi, eax
mov eax, 0x200
call fcn.00402994
mov ebx, eax
mov byte [esi], 0x3a
mov byte [esi + 1], 0x74
mov byte [esi + 2], 0x72
mov byte [esi + 3], 0x79
mov byte [esi + 4], 0xd
mov byte [esi + 5], 0xa
mov byte [esi + 6], 0x64
mov byte [esi + 7], 0x65
mov byte [esi + 8], 0x6c
mov byte [esi + 9], 0x20
mov byte [esi + 0xa], 0x22
mov byte [esi + 0xb], 0
lea edx, [ebp - 0xc]
xor eax, eax
call fcn.00402cd0
lea eax, [ebp - 0xc]
mov edx, 0x412e60
call fcn.00404148
mov eax, dword [ebp - 0xc]
call fcn.00404340
push eax
push esi
call sub.kernel32.dll_lstrcatA
mov byte [ebx], 0x2f
mov byte [ebx + 1], 0x71
mov byte [ebx + 2], 0xd
mov byte [ebx + 3], 0xa
mov byte [ebx + 4], 0x69
mov byte [ebx + 5], 0x66
mov byte [ebx + 6], 0x20
mov byte [ebx + 7], 0x65
mov byte [ebx + 8], 0x78
mov byte [ebx + 9], 0x69
mov byte [ebx + 0xa], 0x73
mov byte [ebx + 0xb], 0x74
mov byte [ebx + 0xc], 0x20
mov byte [ebx + 0xd], 0x22
mov byte [ebx + 0xe], 0
push ebx
push esi
call sub.kernel32.dll_lstrcatA
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.00402cd0
lea eax, [ebp - 0x10]
mov edx, 0x412e50
call fcn.00404148
mov eax, dword [ebp - 0x10]
call fcn.00404340
push eax
push esi
call sub.kernel32.dll_lstrcatA
mov byte [ebx], 0x22
mov byte [ebx + 1], 0x20
mov byte [ebx + 2], 0x67
mov byte [ebx + 3], 0x6f
mov byte [ebx + 4], 0x74
mov byte [ebx + 5], 0x6f
mov byte [ebx + 6], 0x20
mov byte [ebx + 7], 0x74
mov byte [ebx + 8], 0x72
mov byte [ebx + 9], 0x79
mov byte [ebx + 0xa], 0
push ebx
push esi
call sub.kernel32.dll_lstrcatA
push 0x412e70
push edi
push 0x412e7c
xor eax, eax
mov al, byte [ebp + 8]
push dword [eax*4 + 0x414394]
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404200
mov eax, dword [ebp - 0x14]
call fcn.00404340
push eax
push esi
call sub.kernel32.dll_lstrcatA
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00402cd0
lea eax, [ebp - 0x18]
mov edx, 0x412e88
call fcn.00404148
mov eax, dword [ebp - 0x18]
call fcn.00404340
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 0x412e90
push esi
call sub.kernel32.dll_lstrcatA
push 0x412e9c
push esi
call sub.kernel32.dll_lstrcatA
push 0x412eac
lea eax, [ebp - 0x120]
mov edx, ebx
call fcn.00402ef0
lea edx, [ebp - 0x120]
lea eax, [ebp - 0x20]
call fcn.00404108
push dword [ebp - 0x20]
push 0x412eb8
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00404200
mov eax, dword [ebp - 0x1c]
call fcn.00404340
push eax
push esi
call sub.kernel32.dll_lstrcatA
push 0x412ec8
lea eax, [ebp - 0x128]
mov edx, ebx
call fcn.0040409c
push dword [ebp - 0x128]
push 0x412ee0
lea eax, [ebp - 0x124]
mov edx, 3
call fcn.00404200
mov eax, dword [ebp - 0x124]
call fcn.00404340
push eax
push esi
call sub.kernel32.dll_lstrcatA
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push ebx
call sub.kernel32.dll_CreateFileA
mov edi, eax
cmp edi, 0xffffffff
je 0x412df8
push 0
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x12c]
mov edx, esi
call fcn.0040409c
mov eax, dword [ebp - 0x12c]
call fcn.00404140
push eax
push esi
push edi
call sub.kernel32.dll_WriteFile_1
push edi
call sub.kernel32.dll_CloseHandle
push 0
push ebx
call sub.kernel32.dll_WinExec
mov eax, ebx
call fcn.004029c4
mov eax, esi
call fcn.004029c4
xor eax, eax
call fcn.00403e8c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x412e3f
lea eax, [ebp - 0x12c]
mov edx, 3
call fcn.00403ec8
lea eax, [ebp - 0x20]
mov edx, 7
call fcn.00403ec8
ret