Function at 0x40330a
Capabilities:
Create process on windows
Read file on windows
Write and execute a file
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x418
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3c0], rcx
mov rax, qword [rbp + 0x3c0]
mov rax, qword [rax + 0x10]
mov rcx, rax
call dbg.makeDir
test eax, eax
jne 0x403345
mov eax, 0x37
jmp 0x4036a1
mov rcx, qword [rbp + 0x3c0]
call dbg.createStdoutLog
mov qword [rbp + 0x380], rax
cmp qword [rbp + 0x380], 0
jne 0x40336c
mov eax, 0x37
jmp 0x4036a1
lea rax, [rbp + 0x310]
mov r8d, 0x68
mov edx, 0
mov rcx, rax
call sym.memset
lea rax, [rbp + 0x2f0]
mov r8d, 0x18
mov edx, 0
mov rcx, rax
call sym.memset
mov dword [rbp + 0x310], 0x68
mov eax, dword [rbp + 0x34c]
or ah, 1
mov dword [rbp + 0x34c], eax
mov ecx, 0xfffffff6
mov rax, qword [sym.imp.KERNEL32.dll_GetStdHandle]
call rax
mov qword [rbp + 0x360], rax
mov rax, qword [rbp + 0x380]
mov qword [rbp + 0x368], rax
mov rax, qword [rbp + 0x380]
mov qword [rbp + 0x370], rax
mov rax, qword [rbp + 0x3c0]
mov rdx, qword [rax + 0x28]
mov rax, qword [rbp + 0x3c0]
mov rax, qword [rax + 0x20]
mov r8, rdx
mov rdx, rax
lea rcx, str._s__s_n_n
call sym.printf
mov rax, qword [rbp + 0x3c0]
mov rdx, qword [rax + 0x28]
mov rax, qword [rbp + 0x3c0]
mov rcx, qword [rax + 0x20]
lea rax, [rbp + 0x2f0]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x310]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 1
mov r9d, 0
mov r8d, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
test eax, eax
jne 0x4034be
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov esi, eax
mov rax, qword [rbp + 0x3c0]
mov rbx, qword [rax + 0x20]
mov ecx, 2
mov rax, qword [sym.__acrt_iob_func]
call rax
mov r9d, esi
mov r8, rbx
lea rdx, str.CreateProcess_failed___s___lu_._n
mov rcx, rax
call sym.fprintf
mov eax, 1
jmp 0x4036a1
mov rax, qword [rbp + 0x3c0]
mov rdx, qword [rax + 0x10]
lea rax, [rbp + 0x1e0]
mov rcx, rax
call sym.strcpy
lea rax, [rbp + 0x1e0]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
lea rax, [rbp + 0x1e0]
add rax, rdx
movabs rbx, 0x6c65685c676f6c5c
mov qword [rax], rbx
mov dword [rax + 8], 0x742e6f6c
mov word [rax + 0xc], 0x7478
mov byte [rax + 0xe], 0
mov dword [rbp + 0x38c], 0
jmp 0x40363f
mov dword [rbp + 0x1dc], 0
mov rcx, qword [rbp + 0x2f0]
lea rax, [rbp + 0x1dc]
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
call rax
test eax, eax
je 0x40356d
mov eax, dword [rbp + 0x1dc]
cmp eax, 0x103
jne 0x40364e
lea rdx, [rbp + 0x1e0]
lea rax, [rbp + 0x1d0]
lea r8, [0x00408481]
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll_fopen_s]
call rax
mov rax, qword [rbp + 0x1d0]
test rax, rax
je 0x40362a
mov rdx, qword [rbp + 0x1d0]
lea rax, [rbp - 0x30]
mov r9, rdx
mov r8d, 0x200
mov edx, 1
mov rcx, rax
call sym.fread
mov qword [rbp + 0x378], rax
mov ecx, 1
mov rax, qword [sym.__acrt_iob_func]
call rax
mov rcx, rax
mov rdx, qword [rbp + 0x378]
lea rax, [rbp - 0x30]
mov r9, rcx
mov r8, rdx
mov edx, 1
mov rcx, rax
call sym.fwrite
cmp qword [rbp + 0x378], 0x1ff
jbe 0x403604
jmp 0x40359e
nop
mov rax, qword [rbp + 0x1d0]
mov rcx, rax
call sym.fclose
lea rax, [rbp + 0x1e0]
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll__unlink]
call rax
nop
jmp 0x40364f
mov ecx, 0xfa
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
add dword [rbp + 0x38c], 1
cmp dword [rbp + 0x38c], 0x4f
jle 0x403534
jmp 0x40364f
nop
mov rax, qword [rbp + 0x2f0]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rax, qword [rbp + 0x2f0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x2f8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x380]
mov rcx, rax
call sym.fclose
mov eax, 0
add rsp, 0x418
pop rbx
pop rsi
pop rdi
pop rbp
ret