Function at 0x14000e130
Capabilities:
Accept command line arguments
Create process on windows
Encode data using xor
Extract resource via kernel32 functions
Get file size
Hash data with crc32
Read file via mapping
Set environment variable
Terminate process
Write and execute a file
Write file on windows

Disassembly:
lea rcx, [0x140001440]
jmp 0x140001410
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x2e8
movaps xmmword [rsp + 0x2c0], xmm6
movaps xmmword [rsp + 0x2d0], xmm7
lea rbx, str.TEMP_vzor_parser_8155207742
mov r8d, 0x1000
lea rcx, [0x14002a0a0]
mov rdx, rbx
call fcn.1400072d0
test al, al
je 0x14000f61e
lea rcx, [0x1400079e0]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
test eax, eax
je 0x14000f6c6
mov r8d, 0xa
xor ecx, ecx
mov edx, 0x1b
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov rdx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
xor ecx, ecx
mov rdx, rbx
mov qword [0x14002a088], rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov rax, qword [0x14002a088]
mov qword [0x14002a080], rsi
cmp byte [rax + 1], 0x41
lea rdi, [rax + 3]
movzx ecx, byte [rax + 2]
mov qword [0x14002a088], rdi
setne dl
cmp byte [rax], 0x4b
setne al
or dl, al
jne 0x14000f695
cmp cl, 0x59
jne 0x14000f695
mov qword [0x14002e0b0], 0
mov ecx, 0x20000
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
test rax, rax
mov qword [0x14002e0d0], rax
je 0x14000f612
mov ecx, 0x274b8
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
test rax, rax
mov r8, rax
je 0x14000f607
mov qword [rax + 0x73b0], 0
pxor xmm0, xmm0
mov qword [rax + 0x73c8], 0
movups xmmword [rax + 0x73a0], xmm0
movups xmmword [rax + 0x73d8], xmm0
mov qword [rax + 0x72d8], 0
mov qword [rax + 0x73ec], 0
mov qword [rax + 0x73f8], 0
mov qword [rax + 0x7400], 0
mov qword [rax + 0x7420], 0
mov dword [rax + 0x73f4], 0
mov qword [rax + 0x7440], 0
mov dword [rax + 0x7448], 0
mov dword [rax + 0x7454], 0
mov qword [rax + 0x274b0], 0
xor eax, eax
cpuid
xor ecx, ecx
cmp eax, 6
ja 0x14000f1a5
movdqa xmm6, xmmword [0x14001a5f0]
mov dword [r8 + 0x73d0], ecx
lea r15, [rsp + 0x1c0]
movd xmm7, dword [0x14001a600]
mov qword [r8 + 0x7410], 0x8000001
mov dword [r8 + 0x7458], 0
mov qword [r8 + 0x7388], 0
mov dword [r8 + 0x7390], 1
mov qword [0x14002e0a8], r8
mov qword [0x14002e0b0], rdi
mov qword [0x14002e0c0], 0
mov qword [0x14002e0b8], rsi
mov rsi, qword [0x14002e0e0]
lea r13, [0x140029880]
mov rbx, qword [0x14002e0d8]
xor edi, edi
mov r12, r15
mov ebp, 2
nop dword [rax]
mov r8, rbx
sub r8, rsi
jne 0x14000e3e4
mov rcx, qword [0x14002e0c0]
mov rdx, qword [0x14002e0b8]
cmp rcx, rdx
setb al
or dil, al
je 0x14000e420
mov rcx, qword [0x14002e0a8]
movups xmmword [0x14002e0d8], xmm6
call fcn.14000cb60
mov rbx, qword [0x14002e0e0]
cmp qword [0x14002e0d8], rbx
sete dil
cmp rax, 0xffffffffffffff88
ja 0x14000e429
xor esi, esi
mov r8, rbx
mov qword [0x14002e0d8], rbx
mov qword [0x14002e0e0], 0
sub r8, rsi
je 0x14000e380
mov rdx, qword [0x14002e0d0]
cmp r8, rbp
mov r14, r8
mov rcx, r12
cmova r14, rbp
mov r8, r14
add rdx, rsi
add rsi, r14
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
sub rbp, r14
mov qword [0x14002e0e0], rsi
je 0x14000e438
add r12, r14
jmp 0x14000e378
cmp rcx, rdx
je 0x14000e378
lea rcx, str.Error__couldnt_decode_attached_data.
call fcn.140007960
nop dword [rax]
movzx eax, word [rsp + 0x1c0]
test ax, ax
mov word [r13], ax
je 0x14000e453
add r13, 2
jmp 0x14000e360
lea rax, [0x140029880]
movzx ecx, word [rax]
test cx, cx
je 0x14000f1d9
lea rax, [0x14002a0a0]
xor esi, esi
movzx r8d, word [rax]
mov word [0x140027880], si
lea rdx, [0x140027880]
lea r9, [rax + 0x2000]
test r8w, r8w
jne 0x14000e499
jmp 0x14000e4af
cmp rax, r9
je 0x140015aff
add rax, 2
mov word [rdx], r8w
add rdx, 2
movzx r8d, word [rax]
test r8w, r8w
jne 0x14000e490
xor ebx, ebx
mov word [rdx], bx
cmp word [0x140027880], 0
je 0x14000f159
lea rax, [0x140027880]
mov edx, 0x1000
nop
add rax, 2
sub rdx, 1
cmp word [rax], 0
jne 0x14000e4d0
test rdx, rdx
je 0x14000f744
movd dword [rax], xmm7
cmp word [0x140027880], 0
je 0x14000f148
lea rax, [0x140027880]
mov edx, 0x1000
nop dword [rax]
add rax, 2
sub rdx, 1
cmp word [rax], 0
jne 0x14000e508
test rdx, rdx
je 0x14000f73a
lea r8, [0x140029880]
jmp 0x14000e539
test rdx, rdx
je 0x14000f73f
add r8, 2
mov word [rax], cx
add rax, 2
sub rdx, 1
movzx ecx, word [r8]
test cx, cx
jne 0x14000e530
xor r11d, r11d
cmp word [0x140027080], 0
mov word [rax], r11w
je 0x14000f0c9
mov edx, 8
mov rcx, r15
call fcn.14000dee0
mov edx, 4
mov rcx, r15
mov rbx, qword [rsp + 0x1c0]
call fcn.14000dee0
mov eax, dword [rsp + 0x1c0]
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov r8d, 7
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea rcx, [0x140027880]
mov dword [rsp + 0x6c], eax
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x70], rax
call rax
cmp rax, 0xffffffffffffffff
mov r12, rax
je 0x14000f13b
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov esi, eax
je 0x14000f118
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], 0
mov rcx, r12
mov qword [rsp + 0x28], 0
mov r8d, 2
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
test rax, rax
mov qword [rsp + 0x58], rax
je 0x14000f118
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov qword [rsp + 0x20], 0
mov edx, 4
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
test rax, rax
mov r10, rax
je 0x14000f1b9
cmp esi, 0x2e
mov ebp, esi
jbe 0x14000f12e
test al, 7
je 0x14000f63c
lea r9, [0x140019ca0]
mov rdx, rax
mov ecx, 0xffffffff
mov qword [rsp + 0x78], r9
jmp 0x14000e680
test dl, 7
je 0x14000f165
add rdx, 1
mov r8d, ecx
xor cl, byte [rdx - 1]
shr r8d, 8
movzx eax, cl
mov ecx, r8d
xor ecx, dword [r9 + rax*4]
sub rbp, 1
jne 0x14000e677
mov qword [rsp + 0x60], rdx
mov rsi, 0xffffffffffffffff
mov r13, qword [rsp + 0x60]
mov r14, rsi
xor edx, edx
xor r9d, r9d
mov qword [rsp + 0x88], r12
xor r8d, r8d
xor r11d, r11d
mov r12, rbx
lea rax, [0x140017ca0]
mov qword [rsp + 0x80], rbp
mov qword [rsp + 0x90], r10
mov qword [rsp + 0x98], rsi
xor rcx, qword [r13]
add r13, 0x28
mov rdi, qword [r13 - 0x18]
mov rbx, qword [r13 - 8]
xor r11, qword [r13 - 0x20]
movzx esi, ch
mov r10, qword [r13 - 0x10]
xor rdi, r8
mov r8, rcx
xor rbx, rdx
shr r8, 0x38
movzx edx, cl
mov edx, dword [rax + rdx*4]
mov rbp, r11
xor edx, dword [rax + r8*4 + 0x1c00]
mov r8, rcx
xor r10, r9
shr r8, 0x10
xor edx, dword [rax + rsi*4 + 0x400]
movzx r9d, r10b
movzx r8d, r8b
mov r9d, dword [rax + r9*4]
xor edx, dword [rax + r8*4 + 0x800]
mov r8, rcx
shr r8, 0x18
movzx r8d, r8b
xor edx, dword [rax + r8*4 + 0xc00]
mov r8, rcx
shr r8, 0x20
movzx r8d, r8b
xor edx, dword [rax + r8*4 + 0x1000]
mov r8, rcx
shr rcx, 0x30
shr r8, 0x28
movzx ecx, cl
movzx r8d, r8b
xor edx, dword [rax + r8*4 + 0x1400]
movzx r8d, r11b
xor edx, dword [rax + rcx*4 + 0x1800]
mov ecx, edx
mov rdx, r11
mov r11d, dword [rax + r8*4]
movzx r8d, dil
shr rdx, 0x38
mov r8d, dword [rax + r8*4]
xor r11d, dword [rax + rdx*4 + 0x1c00]
mov rdx, rbp
movzx edx, dh
xor r11d, dword [rax + rdx*4 + 0x400]
mov rdx, rbp
shr rdx, 0x10
movzx edx, dl
xor r11d, dword [rax + rdx*4 + 0x800]
mov rdx, rbp
shr rdx, 0x18
movzx edx, dl
xor r11d, dword [rax + rdx*4 + 0xc00]
mov rdx, rbp
shr rdx, 0x20
movzx edx, dl
xor r11d, dword [rax + rdx*4 + 0x1000]
mov rdx, rbp
shr rbp, 0x30
shr rdx, 0x28
movzx edx, dl
xor r11d, dword [rax + rdx*4 + 0x1400]
movzx edx, bpl
xor r11d, dword [rax + rdx*4 + 0x1800]
mov rdx, rdi
shr rdx, 0x38
xor r8d, dword [rax + rdx*4 + 0x1c00]
mov rdx, rdi
movzx edx, dh
xor r8d, dword [rax + rdx*4 + 0x400]
mov rdx, rdi
shr rdx, 0x10
movzx edx, dl
xor r8d, dword [rax + rdx*4 + 0x800]
mov rdx, rdi
shr rdx, 0x18
movzx edx, dl
xor r8d, dword [rax + rdx*4 + 0xc00]
mov rdx, rdi
shr rdx, 0x20
movzx edx, dl
xor r8d, dword [rax + rdx*4 + 0x1000]
mov rdx, rdi
shr rdi, 0x30
shr rdx, 0x28
movzx edx, dl
xor r8d, dword [rax + rdx*4 + 0x1400]
movzx edx, dil
movzx edi, bh
xor r8d, dword [rax + rdx*4 + 0x1800]
mov rdx, r10
shr rdx, 0x38
xor r9d, dword [rax + rdx*4 + 0x1c00]
mov rdx, r10
movzx edx, dh
xor r9d, dword [rax + rdx*4 + 0x400]
mov rdx, r10
shr rdx, 0x10
movzx edx, dl
xor r9d, dword [rax + rdx*4 + 0x800]
mov rdx, r10
shr rdx, 0x18
movzx edx, dl
xor r9d, dword [rax + rdx*4 + 0xc00]
mov rdx, r10
shr rdx, 0x20
movzx edx, dl
xor r9d, dword [rax + rdx*4 + 0x1000]
mov rdx, r10
shr r10, 0x30
shr rdx, 0x28
movzx edx, dl
xor r9d, dword [rax + rdx*4 + 0x1400]
movzx edx, r10b
mov r10, rbx
shr r10, 0x38
xor r9d, dword [rax + rdx*4 + 0x1800]
movzx edx, bl
mov edx, dword [rax + rdx*4]
xor edx, dword [rax + r10*4 + 0x1c00]
mov r10, rbx
shr r10, 0x10
xor edx, dword [rax + rdi*4 + 0x400]
movzx r10d, r10b
xor edx, dword [rax + r10*4 + 0x800]
mov r10, rbx
shr r10, 0x18
movzx r10d, r10b
xor edx, dword [rax + r10*4 + 0xc00]
mov r10, rbx
shr r10, 0x20
movzx r10d, r10b
xor edx, dword [rax + r10*4 + 0x1000]
mov r10, rbx
shr rbx, 0x30
shr r10, 0x28
movzx r10d, r10b
xor edx, dword [rax + r10*4 + 0x1400]
movzx r10d, bl
xor edx, dword [rax + r10*4 + 0x1800]
sub r14, 1
jne 0x14000e6e7
mov rsi, qword [rsp + 0x98]
mov rbx, r12
mov rdi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x80]
mov r10, qword [rsp + 0x90]
mov r12, qword [rsp + 0x88]
lea rax, [rsi + rsi*4]
mov esi, r9d
mov r9d, r8d
lea rax, [rdi + rax*8]
mov r8d, r11d
mov qword [rsp + 0x60], rax
mov eax, ecx
mov ecx, edx
mov r14, qword [rsp + 0x60]
mov r11, qword [rsp + 0x78]
xor rax, qword [r14]
xor r8, qword [r14 + 8]
mov rdi, qword [r14 + 0x18]
movzx edx, al
shr rax, 8
mov edx, dword [r11 + rdx*4]
xor rax, rdx
mov rdx, rax
movzx eax, al
mov eax, dword [r11 + rax*4]
shr rdx, 8
xor rax, rdx
mov rdx, rax
movzx eax, al
mov eax, dword [r11 + rax*4]
shr rdx, 8
xor rax, rdx
mov rdx, rax
movzx eax, al
mov eax, dword [r11 + rax*4]
shr rdx, 8
xor rax, rdx
mov rdx, rax
movzx eax, al
mov eax, dword [r11 + rax*4]
shr rdx, 8
xor rax, rdx
mov rdx, rax
movzx eax, al
mov eax, dword [r11 + rax*4]
shr rdx, 8
xor rax, rdx
mov rdx, rax
movzx eax, al
mov eax, dword [r11 + rax*4]
shr rdx, 8
xor rax, rdx
mov rdx, rax
movzx eax, al
mov eax, dword [r11 + rax*4]
shr rdx, 8
xor rdx, r8
xor rax, rdx
movzx edx, al
shr rax, 8
mov edx, dword [r11 + rdx*4]
xor rax, rdx
mov rdx, rax
movzx eax, al
mov eax, dword [r11 + rax*4]
shr rdx, 8
xor rax, rdx
mov rdx, rax
movzx eax, al
mov eax, dword [r11 + rax*4]
shr rdx, 8
xor rax, rdx
mov rdx, rax
movzx eax, al
mov eax, dword [r11 + rax*4]
shr rdx, 8
xor rax, rdx
mov rdx, rax
movzx eax, al
mov eax, dword [r11 + rax*4]
shr rdx, 8
xor rax, rdx
mov rdx, rax
movzx eax, al
mov eax, dword [r11 + rax*4]
shr rdx, 8
xor rax, rdx
mov rdx, rax
movzx eax, al
mov eax, dword [r11 + rax*4]
shr rdx, 8
xor rax, rdx
xor r9, qword [r14 + 0x10]
xor rdi, rsi
mov rsi, r14
mov rdx, rax
movzx eax, al
mov eax, dword [r11 + rax*4]
shr rdx, 8
xor rdx, r9
xor rax, rdx
movzx edx, al
shr rax, 8
mov edx, dword [r11 + rdx*4]
xor rdx, rax
mov rax, rdx
movzx edx, dl
mov edx, dword [r11 + rdx*4]
shr rax, 8
xor rax, rdx
mov rdx, rax
movzx eax, al
mov eax, dword [r11 + rax*4]
shr rdx, 8
xor rdx, rax
mov rax, rdx
movzx edx, dl
mov edx, dword [r11 + rdx*4]
shr rax, 8
xor rax, rdx
mov rdx, rax
movzx eax, al
mov eax, dword [r11 + rax*4]
shr rdx, 8
xor rdx, rax
mov rax, rdx
movzx edx, dl
mov edx, dword [r11 + rdx*4]
shr rax, 8
xor rax, rdx
mov rdx, rax
movzx eax, al
mov eax, dword [r11 + rax*4]
shr rdx, 8
xor rdx, rax
mov rax, rdx
movzx edx, dl
shr rax, 8
xor rdi, rax
mov eax, dword [r11 + rdx*4]
xor rax, rdi
movzx edx, al
shr rax, 8
mov edx, dword [r11 + rdx*4]
xor rdx, rax
mov rax, rdx
movzx edx, dl
mov edx, dword [r11 + rdx*4]
shr rax, 8
xor rax, rdx
mov rdx, rax
movzx eax, al
mov eax, dword [r11 + rax*4]
shr rdx, 8
xor rax, rdx
mov rdx, rax
movzx eax, al
mov eax, dword [r11 + rax*4]
shr rdx, 8
xor rax, rdx
mov rdx, rax
movzx eax, al
mov eax, dword [r11 + rax*4]
shr rdx, 8
xor rax, rdx
add rsi, 0x28
mov rdx, rax
movzx eax, al
mov eax, dword [r11 + rax*4]
shr rdx, 8
xor rax, rdx
mov rdx, rax
movzx eax, al
mov eax, dword [r11 + rax*4]
shr rdx, 8
xor rdx, rax
mov rax, qword [r14 + 0x20]
xor rax, rcx
mov rcx, rdx
movzx edx, dl
mov edx, dword [r11 + rdx*4]
shr rcx, 8
xor rax, rcx
xor rax, rdx
movzx edx, al
shr rax, 8
mov edx, dword [r11 + rdx*4]
xor rdx, rax
mov rax, rdx
movzx edx, dl
mov edx, dword [r11 + rdx*4]
shr rax, 8
xor rax, rdx
mov rcx, rax
movzx eax, al
mov edx, dword [r11 + rax*4]
shr rcx, 8
xor rdx, rcx
mov rax, rdx
movzx edx, dl
mov edx, dword [r11 + rdx*4]
shr rax, 8
xor rax, rdx
mov rdx, rax
movzx eax, al
mov eax, dword [r11 + rax*4]
shr rdx, 8
xor rax, rdx
mov rdx, rax
movzx eax, al
mov eax, dword [r11 + rax*4]
shr rdx, 8
xor rax, rdx
mov rcx, rax
movzx eax, al
mov edx, dword [r11 + rax*4]
shr rcx, 8
xor rdx, rcx
mov rax, rdx
movzx edx, dl
shr rax, 8
xor eax, dword [r11 + rdx*4]
cmp rbp, 7
jbe 0x14000ef10
lea rdi, [0x140019ca0]
mov ecx, eax
xor al, byte [rsi]
shr ecx, 8
lea rdx, [rbp - 8]
movzx eax, al
xor ecx, dword [rdi + rax*4]
mov eax, ecx
xor cl, byte [rsi + 1]
shr eax, 8
movzx ecx, cl
xor eax, dword [rdi + rcx*4]
mov ecx, eax
xor al, byte [rsi + 2]
shr ecx, 8
movzx eax, al
xor ecx, dword [rdi + rax*4]
mov eax, ecx
xor cl, byte [rsi + 3]
shr eax, 8
movzx ecx, cl
xor eax, dword [rdi + rcx*4]
mov ecx, eax
xor al, byte [rsi + 4]
shr ecx, 8
movzx eax, al
xor ecx, dword [rdi + rax*4]
mov eax, ecx
xor cl, byte [rsi + 5]
shr eax, 8
movzx ecx, cl
xor eax, dword [rdi + rcx*4]
mov ecx, eax
xor al, byte [rsi + 6]
shr ecx, 8
movzx eax, al
xor ecx, dword [rdi + rax*4]
mov eax, ecx
xor cl, byte [rsi + 7]
shr eax, 8
movzx ecx, cl
xor eax, dword [rdi + rcx*4]
cmp rdx, 7
jbe 0x14000ef04
mov ecx, eax
xor al, byte [rsi + 8]
shr ecx, 8
movzx eax, al
xor ecx, dword [rdi + rax*4]
mov eax, ecx
xor cl, byte [rsi + 9]
shr eax, 8
movzx ecx, cl
xor eax, dword [rdi + rcx*4]
mov ecx, eax
xor al, byte [rsi + 0xa]
shr ecx, 8
movzx eax, al
xor ecx, dword [rdi + rax*4]
mov eax, ecx
xor cl, byte [rsi + 0xb]
shr eax, 8
movzx ecx, cl
xor eax, dword [rdi + rcx*4]
mov ecx, eax
xor al, byte [rsi + 0xc]
shr ecx, 8
movzx eax, al
xor ecx, dword [rdi + rax*4]
mov eax, ecx
xor cl, byte [rsi + 0xd]
shr eax, 8
movzx ecx, cl
xor eax, dword [rdi + rcx*4]
mov ecx, eax
xor al, byte [rsi + 0xe]
shr ecx, 8
movzx eax, al
xor ecx, dword [rdi + rax*4]
mov eax, ecx
xor cl, byte [rsi + 0xf]
shr eax, 8
movzx ecx, cl
xor eax, dword [rdi + rcx*4]
lea rcx, [rbp - 0x10]
cmp rcx, 7
jbe 0x14000ef04
mov ecx, eax
xor al, byte [rsi + 0x10]
shr ecx, 8
movzx eax, al
xor ecx, dword [rdi + rax*4]
mov eax, ecx
xor cl, byte [rsi + 0x11]
shr eax, 8
movzx ecx, cl
xor eax, dword [rdi + rcx*4]
mov ecx, eax
xor al, byte [rsi + 0x12]
shr ecx, 8
movzx eax, al
xor ecx, dword [rdi + rax*4]
mov eax, ecx
xor cl, byte [rsi + 0x13]
shr eax, 8
movzx ecx, cl
xor eax, dword [rdi + rcx*4]
mov ecx, eax
xor al, byte [rsi + 0x14]
shr ecx, 8
movzx eax, al
xor ecx, dword [rdi + rax*4]
mov eax, ecx
xor cl, byte [rsi + 0x15]
shr eax, 8
movzx ecx, cl
xor eax, dword [rdi + rcx*4]
mov ecx, eax
xor al, byte [rsi + 0x16]
shr ecx, 8
movzx eax, al
xor ecx, dword [rdi + rax*4]
mov eax, ecx
xor cl, byte [rsi + 0x17]
shr eax, 8
movzx ecx, cl
xor eax, dword [rdi + rcx*4]
lea rcx, [rbp - 0x18]
cmp rcx, 7
jbe 0x14000ef04
mov ecx, eax
xor al, byte [rsi + 0x18]
shr ecx, 8
movzx eax, al
xor ecx, dword [rdi + rax*4]
mov eax, ecx
xor cl, byte [rsi + 0x19]
shr eax, 8
movzx ecx, cl
xor eax, dword [rdi + rcx*4]
mov ecx, eax
xor al, byte [rsi + 0x1a]
shr ecx, 8
movzx eax, al
xor ecx, dword [rdi + rax*4]
mov eax, ecx
xor cl, byte [rsi + 0x1b]
shr eax, 8
movzx ecx, cl
xor eax, dword [rdi + rcx*4]
mov ecx, eax
xor al, byte [rsi + 0x1c]
shr ecx, 8
movzx eax, al
xor ecx, dword [rdi + rax*4]
mov eax, ecx
xor cl, byte [rsi + 0x1d]
shr eax, 8
movzx ecx, cl
xor eax, dword [rdi + rcx*4]
mov ecx, eax
xor al, byte [rsi + 0x1e]
shr ecx, 8
movzx eax, al
xor ecx, dword [rdi + rax*4]
mov eax, ecx
xor cl, byte [rsi + 0x1f]
shr eax, 8
movzx ecx, cl
xor eax, dword [rdi + rcx*4]
lea rcx, [rbp - 0x20]
cmp rcx, 7
jbe 0x14000ef04
mov ecx, eax
xor al, byte [rsi + 0x20]
shr ecx, 8
movzx eax, al
xor ecx, dword [rdi + rax*4]
mov eax, ecx
xor cl, byte [rsi + 0x21]
shr eax, 8
movzx ecx, cl
xor eax, dword [rdi + rcx*4]
mov ecx, eax
xor al, byte [rsi + 0x22]
shr ecx, 8
movzx eax, al
xor ecx, dword [rdi + rax*4]
mov eax, ecx
xor cl, byte [rsi + 0x23]
shr eax, 8
movzx ecx, cl
xor eax, dword [rdi + rcx*4]
mov ecx, eax
xor al, byte [rsi + 0x24]
shr ecx, 8
movzx eax, al
xor ecx, dword [rdi + rax*4]
mov eax, ecx
xor cl, byte [rsi + 0x25]
shr eax, 8
movzx ecx, cl
xor eax, dword [rdi + rcx*4]
mov ecx, eax
xor al, byte [rsi + 0x26]
shr ecx, 8
movzx eax, al
xor ecx, dword [rdi + rax*4]
mov eax, ecx
xor cl, byte [rsi + 0x27]
shr eax, 8
movzx ecx, cl
xor eax, dword [rdi + rcx*4]
shr rdx, 3
and ebp, 7
lea rsi, [rsi + rdx*8 + 8]
test rbp, rbp
je 0x14000efa7
lea rdi, [0x140019ca0]
mov edx, eax
xor al, byte [rsi]
shr edx, 8
movzx eax, al
xor edx, dword [rdi + rax*4]
cmp rbp, 1
mov eax, edx
je 0x14000efa7
xor al, byte [rsi + 1]
shr edx, 8
movzx eax, al
xor edx, dword [rdi + rax*4]
cmp rbp, 2
mov eax, edx
je 0x14000efa7
xor al, byte [rsi + 2]
shr edx, 8
movzx eax, al
xor edx, dword [rdi + rax*4]
cmp rbp, 3
mov eax, edx
je 0x14000efa7
xor al, byte [rsi + 3]
shr edx, 8
movzx eax, al
xor edx, dword [rdi + rax*4]
cmp rbp, 4
mov eax, edx
je 0x14000efa7
xor al, byte [rsi + 4]
shr edx, 8
movzx eax, al
xor edx, dword [rdi + rax*4]
cmp rbp, 5
mov eax, edx
je 0x14000efa7
xor al, byte [rsi + 5]
shr edx, 8
movzx eax, al
xor edx, dword [rdi + rax*4]
cmp rbp, 6
mov eax, edx
je 0x14000efa7
xor al, byte [rsi + 6]
shr edx, 8
movzx eax, al
xor edx, dword [rdi + rax*4]
mov eax, edx
not eax
mov rcx, r10
test eax, eax
mov esi, eax
mov eax, 1
cmove esi, eax
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, qword [rsp + 0x58]
mov rdi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rdi
mov rcx, r12
call rdi
cmp dword [rsp + 0x6c], esi
je 0x14000f095
lea rcx, [0x140027880]
call fcn.140010a90
xor r9d, r9d
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov r8d, 2
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
lea rcx, [0x140027880]
call rax
cmp rax, 0xffffffffffffffff
mov rbp, rax
je 0x14000f6d2
test rbx, rbx
mov r12, qword [sym.imp.KERNEL32.dll_WriteFile]
lea rdi, [0x14001d040]
je 0x14000f087
nop dword [rax]
mov esi, 0x8000
mov rcx, rdi
cmp rbx, rsi
cmovbe rsi, rbx
mov rdx, rsi
call fcn.14000dee0
mov r9, r15
mov r8d, esi
mov rdx, rdi
mov dword [rsp + 0x1c0], 0
mov rcx, rbp
mov qword [rsp + 0x20], 0
call r12
test eax, eax
je 0x14000f6a8
sub rbx, rsi
jne 0x14000f040
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000e352
test rbx, rbx
je 0x14000e352
lea rdi, [0x14001d040]
nop dword [rax]
mov esi, 0x8000
mov rcx, rdi
cmp rbx, rsi
cmovbe rsi, rbx
mov rdx, rsi
call fcn.14000dee0
sub rbx, rsi
jne 0x14000f0a8
jmp 0x14000e352
movzx edx, word [0x140027880]
lea rax, [0x140027080]
lea rcx, [0x140027880]
lea r8, [rax + 0x2000]
test dx, dx
jne 0x14000f0f9
jmp 0x14000f10c
cmp rax, r8
je 0x140015aff
add rcx, 2
mov word [rax], dx
add rax, 2
movzx edx, word [rcx]
test dx, dx
jne 0x14000f0f0
xor r10d, r10d
mov word [rax], r10w
jmp 0x14000e566
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000efd1
mov rsi, rax
mov eax, 0xffffffff
jmp 0x14000ec90
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
jmp 0x14000efd1
lea rax, [0x140027880]
mov edx, 0x1000
jmp 0x14000e51f
lea rax, [0x140027880]
jmp 0x14000e4e7
movabs rax, 0xcccccccccccccccd
mov qword [rsp + 0x60], rdx
mul rbp
mov rax, rdx
shr rax, 5
lea rsi, [rax - 1]
lea rax, [rax + rax*4]
shl rax, 3
sub rbp, rax
mov eax, ecx
test rsi, rsi
jne 0x14000e6aa
xor ecx, ecx
xor r8d, r8d
xor r9d, r9d
jmp 0x14000e9c4
mov eax, 7
cpuid
shr ebx, 8
and ebx, 1
mov ecx, ebx
jmp 0x14000e2e7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call rsi
mov rcx, r12
call rsi
xor esi, esi
jmp 0x14000efd1
mov rbx, qword [0x14002e0a8]
test rbx, rbx
je 0x14000f287
cmp qword [rbx + 0x73c8], 0
jne 0x14000f287
mov rsi, qword [rbx + 0x73d8]
mov rdi, qword [rbx + 0x73a8]
mov r12, qword [rbx + 0x73b0]
test rsi, rsi
je 0x14000f241
mov rdx, qword [rsi]
mov rbp, qword [rsi + 0x6ac8]
mov r13, qword [rsi + 0x6ad0]
test rdx, rdx
je 0x14000f67f
test rbp, rbp
je 0x14000f72d
mov rcx, r13
call rbp
mov rdx, rsi
mov rcx, r13
call rbp
mov rdx, qword [rbx + 0x73f8]
pxor xmm0, xmm0
mov dword [rbx + 0x73f0], 0
movups xmmword [rbx + 0x73d8], xmm0
test rdx, rdx
je 0x14000f626
test rdi, rdi
je 0x14000f720
mov rcx, r12
call rdi
mov qword [rbx + 0x73f8], 0
mov rdx, rbx
mov rcx, r12
call rdi
mov rcx, qword [0x14002e0d0]
lea rsi, [rsp + 0x140]
mov rbp, r15
mov r14d, pe_nt_image_headers64
lea r13, [rsp + 0xf0]
mov r12d, 1
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea r8, [0x1400172ba]
mov edx, pe_nt_image_headers64
mov rcx, rsi
mov r9d, eax
call fcn.140015920
movzx edi, byte [rsp + 0x140]
xor r9d, r9d
mov word [rsp + 0x1c0], r9w
test dil, dil
je 0x14000f356
cmp word [rbp], 0
mov rax, r14
mov rbx, rbp
je 0x14000f306
nop dword [rax]
add rbx, 2
sub rax, 1
cmp word [rbx], 0
jne 0x14000f2f8
test rax, rax
je 0x140015aff
mov rcx, rbx
add rbp, 2
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
mov rdx, r13
mov r8d, 2
mov byte [rsp + 0xf0], dil
lea rcx, [rbx + rax*2]
mov byte [rsp + 0xf1], 0
call sub.api_ms_win_crt_convert_l1_1_0.dll_mbstowcs
lea rax, [r14 - 1]
mov rdx, r12
sub rdx, r14
movzx edi, byte [r15 + rdx]
test dil, dil
je 0x14000f356
mov r14, rax
jmp 0x14000f2e8
lea rcx, [rsp + 0xa0]
xor r8d, r8d
mov qword [rsp + 0x58], rsi
mov r14d, 0x4e
lea r12, str.NUITKA_ONEFILE_PARENT
mov rdi, rcx
mov rsi, rcx
mov word [rsp + 0xa0], r8w
lea r13, [r12 + 0x28]
lea rbp, [rsp + 0xf0]
mov rax, r13
mov rbx, rdi
sub rax, r12
cmp word [rdi], 0
je 0x14000f3ae
nop
add rbx, 2
sub rax, 1
cmp word [rbx], 0
jne 0x14000f3a0
test rax, rax
je 0x140015aff
mov rcx, rbx
add r12, 1
add rdi, 2
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
mov r8d, 2
mov rdx, rbp
mov byte [rsp + 0xf0], r14b
lea rcx, [rbx + rax*2]
mov byte [rsp + 0xf1], 0
call sub.api_ms_win_crt_convert_l1_1_0.dll_mbstowcs
movzx r14d, byte [r12]
test r14b, r14b
jne 0x14000f38f
lea rdi, [0x140025060]
mov rcx, rsi
mov rdx, r15
mov rsi, qword [rsp + 0x58]
mov r12, qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
call r12
mov rdx, rdi
xor ecx, ecx
mov r8d, 0x1001
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp word [0x140025060], 0
mov rax, rdi
lea rdx, [rdi + 0x2002]
je 0x14000f450
add rax, 2
cmp word [rax], 0
je 0x14000f450
cmp rax, rdx
jne 0x14000f434
jmp 0x140015aff
xor edx, edx
xor ecx, ecx
mov r14, rbp
mov qword [rsp + 0x58], rbp
lea r9, str.NUITKA_ONEFILE_BINARY
mov rbp, rsi
mov word [rax], dx
mov r13d, 0x4e
mov word [rsp + 0xf0], cx
mov rsi, r9
lea rax, [0x14001745a]
mov rbx, r14
sub rax, rsi
cmp word [r14], 0
je 0x14000f49e
nop
add rbx, 2
sub rax, 1
cmp word [rbx], 0
jne 0x14000f490
test rax, rax
je 0x140015aff
mov rcx, rbx
add rsi, 1
add r14, 2
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
mov r8d, 2
mov rdx, r15
mov byte [rsp + 0x1c0], r13b
lea rcx, [rbx + rax*2]
mov byte [rsp + 0x1c1], 0
call sub.api_ms_win_crt_convert_l1_1_0.dll_mbstowcs
movzx r13d, byte [rsi]
test r13b, r13b
jne 0x14000f47a
mov rsi, rbp
mov rbp, qword [rsp + 0x58]
mov rdx, rdi
mov rcx, rbp
call r12
lea rdx, [rsp + 0x1c4]
xor eax, eax
mov ecx, 0xc
mov rdi, rdx
rep stosq qword [rdi], rax
mov dword [rdi], 0
mov dword [rsp + 0x1c0], 0x68
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], r15
mov rdx, rax
mov qword [rsp + 0x38], 0
lea rcx, [0x140027080]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14000f6fd
mov rcx, qword [rsp + 0x148]
mov rbx, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rbx
mov rcx, qword [rsp + 0x140]
mov dword [rsp + 0xf0], 0
test rcx, rcx
mov qword [0x140025040], rcx
je 0x14000f5d7
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [0x140025040]
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x14000f5c3
mov dword [rsp + 0xf0], 1
mov rcx, qword [0x140025040]
call rbx
mov qword [0x140025040], 0
call fcn.140007980
mov eax, dword [rsp + 0xf0]
movaps xmm6, xmmword [rsp + 0x2c0]
movaps xmm7, xmmword [rsp + 0x2d0]
add rsp, 0x2e8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov qword [0x14002e0a8], 0
lea rcx, str.Error__couldnt_allocate_memory.
call fcn.140007960
mov rcx, rbx
call fcn.1400078c0
test rdi, rdi
jne 0x14000f27f
mov rcx, rbx
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
jmp 0x14000f287
movabs rax, 0xcccccccccccccccd
mov qword [rsp + 0x60], r10
mov ecx, 0xffffffff
mul rbp
lea rdi, [0x140019ca0]
mov qword [rsp + 0x78], rdi
mov rax, rdx
shr rax, 5
lea rsi, [rax - 1]
lea rax, [rax + rax*4]
shl rax, 3
sub rbp, rax
mov eax, 0xffffffff
jmp 0x14000f18f
test rbp, rbp
jne 0x14000f239
mov rcx, rsi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
jmp 0x14000f241
lea rcx, str.Error__couldnt_find_attached_data_header.
call fcn.140007960
nop dword [rax]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Error__couldnt_unpack_file_to_target_path.
mov edx, eax
call fcn.1400078f0
mov ecx, 2
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
lea rcx, str.Error__failed_to_register_signal_handler.
call fcn.140007960
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea r8, [0x140027880]
lea rdx, str.Error__failed_to_open__ls_for_writing._n
mov rcx, rax
call fcn.140015540
mov ecx, 2
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Error__couldnt_launch_child
mov edx, eax
call fcn.1400078f0
mov ecx, 2
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
nop dword [rax + rax]
mov rcx, rdx
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
jmp 0x14000f62f
mov rcx, rdx
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
jmp 0x14000f688
jmp 0x140015aff
jmp 0x140015aff
jmp 0x140015aff
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp 0x140001430