Function at 0x412b14
Capabilities:
Create process on windows
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x25
push 0
push 0
dec ecx
jne 0x412b1d
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x412dc5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [esi]
push eax
call sub.kernel32.dll_FreeLibrary_1
mov eax, dword [esi]
push eax
call sub.kernel32.dll_FreeLibrary_1
lea eax, [ebp - 8]
mov ecx, 0x412de0
mov edx, edi
call fcn.0040418c
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.00407638
mov edx, edi
mov eax, ebx
call fcn.00407638
mov eax, 0x400
call fcn.00402994
mov ebx, eax
mov eax, 0x200
call fcn.00402994
mov esi, eax
mov byte [ebx], 0x3a
mov byte [ebx + 1], 0x74
mov byte [ebx + 2], 0x72
mov byte [ebx + 3], 0x79
mov byte [ebx + 4], 0xd
mov byte [ebx + 5], 0xa
mov byte [ebx + 6], 0x64
mov byte [ebx + 7], 0x65
mov byte [ebx + 8], 0x6c
mov byte [ebx + 9], 0x20
mov byte [ebx + 0xa], 0x22
mov byte [ebx + 0xb], 0
lea edx, [ebp - 0xc]
xor eax, eax
call fcn.00402cd0
lea eax, [ebp - 0xc]
mov edx, 0x412df0
call fcn.00404148
mov eax, dword [ebp - 0xc]
call fcn.00404340
push eax
push ebx
call sub.kernel32.dll_lstrcatA
push 0x412df8
push ebx
call sub.kernel32.dll_lstrcatA
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.00402cd0
lea eax, [ebp - 0x10]
mov edx, 0x412de0
call fcn.00404148
mov eax, dword [ebp - 0x10]
call fcn.00404340
push eax
push ebx
call sub.kernel32.dll_lstrcatA
mov byte [esi], 0x22
mov byte [esi + 1], 0x20
mov byte [esi + 2], 0x67
mov byte [esi + 3], 0x6f
mov byte [esi + 4], 0x74
mov byte [esi + 5], 0x6f
mov byte [esi + 6], 0x20
mov byte [esi + 7], 0x74
mov byte [esi + 8], 0x72
mov byte [esi + 9], 0x79
mov byte [esi + 0xa], 0
push esi
push ebx
call sub.kernel32.dll_lstrcatA
push 0x412e10
push edi
push 0x412e1c
lea edx, [ebp - 0x18]
mov al, byte [ebp + 8]
call fcn.00412e8c
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404200
mov eax, dword [ebp - 0x14]
call fcn.00404340
push eax
push ebx
call sub.kernel32.dll_lstrcatA
lea edx, [ebp - 0x1c]
xor eax, eax
call fcn.00402cd0
lea eax, [ebp - 0x1c]
mov edx, 0x412e28
call fcn.00404148
mov eax, dword [ebp - 0x1c]
call fcn.00404340
push eax
push esi
call sub.kernel32.dll_lstrcpyA
push 0x412e30
push ebx
call sub.kernel32.dll_lstrcatA
push 0x412e3c
push ebx
call sub.kernel32.dll_lstrcatA
push 0x412e4c
lea eax, [ebp - 0x124]
mov edx, esi
call fcn.00402ef0
lea edx, [ebp - 0x124]
lea eax, [ebp - 0x24]
call fcn.00404108
push dword [ebp - 0x24]
push 0x412e58
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00404200
mov eax, dword [ebp - 0x20]
call fcn.00404340
push eax
push ebx
call sub.kernel32.dll_lstrcatA
push 0x412e68
lea eax, [ebp - 0x12c]
mov edx, esi
call fcn.0040409c
push dword [ebp - 0x12c]
push 0x412e80
lea eax, [ebp - 0x128]
mov edx, 3
call fcn.00404200
mov eax, dword [ebp - 0x128]
call fcn.00404340
push eax
push ebx
call sub.kernel32.dll_lstrcatA
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push esi
call sub.kernel32.dll_CreateFileA
mov edi, eax
cmp edi, 0xffffffff
je 0x412d85
push 0
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x130]
mov edx, ebx
call fcn.0040409c
mov eax, dword [ebp - 0x130]
call fcn.00404140
push eax
push ebx
push edi
call sub.kernel32.dll_WriteFile_1
push edi
call sub.kernel32.dll_CloseHandle
push 0
push esi
call sub.kernel32.dll_WinExec
mov eax, esi
call fcn.004029c4
mov eax, ebx
call fcn.004029c4
xor eax, eax
call fcn.00403e8c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x412dcc
lea eax, [ebp - 0x130]
mov edx, 3
call fcn.00403ec8
lea eax, [ebp - 0x24]
mov edx, 8
call fcn.00403ec8
ret