Function at 0x402cc0
Capabilities:
Create process on windows
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x348
mov eax, dword [0x406668]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x100
push 0
lea eax, [ebp - 0x210]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov ecx, dword [str.D0g3]
mov dword [ebp - 0xc], ecx
mov dl, byte [0x4041c0]
mov byte [ebp - 8], dl
push 0x104
push 0
lea eax, [ebp - 0x110]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov ecx, 0x33
mov esi, str.cmd__c_start_https:__www.bilibili.com_video_BV1uT4y1P7CX__spm_id_from333.788.recommend_more_video._1
lea edi, [ebp - 0x2dc]
rep movsd dword es:[edi], dword [esi]
push 0x44
push 0
lea ecx, [ebp - 0x320]
push ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x330], edx
mov dword [ebp - 0x32c], edx
mov dword [ebp - 0x328], edx
mov dword [ebp - 0x324], edx
push str.Hello_challengers__welcome_to_The_Itach1s_challenge__here_are_two_things_you_need_to_know._n
call fcn.00402f90
add esp, 4
push str._t1._All_characters_are_lowercase_characters__n
call fcn.00402f90
add esp, 4
push str._t2._Please_encrypt_the_final_string_with_md5__lowercase._n
call fcn.00402f90
add esp, 4
push str.I_hope_you_can_complete_my_challenge_and_learn_useful_knowledge_from_it__this_is_the_most_important_thing__not_py._n_n
call fcn.00402f90
add esp, 4
lea eax, [ebp - 0xc]
mov dword [ebp - 0x33c], eax
mov ecx, dword [ebp - 0x33c]
add ecx, 1
mov dword [ebp - 0x340], ecx
mov edx, dword [ebp - 0x33c]
mov al, byte [edx]
mov byte [ebp - 0x331], al
add dword [ebp - 0x33c], 1
cmp byte [ebp - 0x331], 0
jne 0x402d9e
mov ecx, dword [ebp - 0x33c]
sub ecx, dword [ebp - 0x340]
mov dword [ebp - 0x344], ecx
mov edx, dword [ebp - 0x344]
push edx
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x210]
push ecx
call fcn.00402a80
add esp, 0xc
push str.now__please_input_your_flag:
call fcn.00402f90
add esp, 4
lea edx, [ebp - 0x110]
push edx
push 0x4042fc
call fcn.00402fd0
add esp, 8
mov dword [ebp - 0x338], 0
jmp 0x402e24
mov eax, dword [ebp - 0x338]
add eax, 1
mov dword [ebp - 0x338], eax
cmp dword [ebp - 0x338], 0x19
jge 0x402e53
mov ecx, dword [ebp - 0x338]
movzx edx, byte [ebp + ecx - 0x110]
xor edx, dword [ebp - 0x338]
add edx, 0xc
mov eax, dword [ebp - 0x338]
mov byte [ebp + eax - 0x110], dl
jmp 0x402e15
push 0x19
lea ecx, [ebp - 0x110]
push ecx
lea edx, [ebp - 0x210]
push edx
call fcn.00402bd0
add esp, 0xc
push 0x19
push 0x406640
lea eax, [ebp - 0x110]
push eax
call sub.VCRUNTIME140.dll_memcmp
add esp, 0xc
mov dword [ebp - 0x348], eax
cmp dword [ebp - 0x348], 0
jne 0x402ebb
lea ecx, [ebp - 0x330]
push ecx
lea edx, [ebp - 0x320]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x2dc]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
jmp 0x402ec8
push str.Sorry_you_are_wrong___
call fcn.00402f90
add esp, 4
mov ecx, dword [ebp - 0x330]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x32c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00402410
push str.pause
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 4
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040300b
mov esp, ebp
pop ebp
ret