Function at 0x414cc0
Capabilities:
Accept command line arguments
Create process on windows
Extract resource via kernel32 functions
Set environment variable
Write and execute a file
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0xfc
mov dword [esp + 8], 0x1000
mov dword [esp + 4], str._TEMP_onefile__PID___TIME_
mov dword [esp], 0x4360a0
call fcn.00413fd0
test al, al
je 0x4155c7
mov dword [esp + 4], 1
mov dword [esp], 0x402c70
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
sub esp, 8
test eax, eax
je 0x41572b
mov dword [esp + 8], 0xa
mov dword [esp + 4], 0x1b
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
sub esp, 0xc
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
sub esp, 8
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
lea edx, [eax + 3]
sub esp, 4
cmp byte [eax + 1], 0x41
mov dword [0x4380c0], eax
mov dword [0x4380bc], edx
setne dl
cmp byte [eax], 0x4b
movzx ecx, byte [eax + 2]
setne al
or dl, al
jne 0x4157b6
cmp cl, 0x59
jne 0x4157b6
mov dword [esp], 0x20000
mov dword [0x4380ac], 0
call sub.msvcrt.dll_malloc
mov dword [0x4380a0], eax
test eax, eax
je 0x415506
mov dword [esp], 0x27420
call sub.msvcrt.dll_malloc
mov esi, eax
test eax, eax
je 0x4154fc
mov dword [eax + 0x736c], 0
mov dword [eax + 0x7370], 0
mov dword [eax + 0x7374], 0
mov dword [eax + 0x7380], 0
mov dword [eax + 0x738c], 0
mov dword [eax + 0x7388], 0
mov dword [eax + 0x72b8], 0
mov dword [eax + 0x7394], 0
mov dword [eax + 0x7398], 0
mov dword [eax + 0x73a0], 0
mov dword [eax + 0x73a4], 0
mov dword [eax + 0x73b4], 0
mov dword [eax + 0x739c], 0
mov dword [eax + 0x73c4], 0
mov dword [eax + 0x73c8], 0
mov dword [eax + 0x73d4], 0
mov dword [eax + 0x2741c], 0
xor eax, eax
cpuid
xor ecx, ecx
cmp eax, 6
ja 0x4154de
mov dword [esi + 0x7384], ecx
mov dword [esi + 0x735c], 0
mov dword [esi + 0x73ac], 0x8000001
mov dword [esi + 0x73d8], 0
mov dword [esi + 0x7360], 0
mov dword [esi + 0x7364], 1
mov dword [0x4380b8], esi
mov byte [0x436080], 1
mov dword [esp + 0x38], 0x426060
mov esi, dword [0x4380a8]
lea esi, [esi]
nop
lea eax, [esp + 0x60]
mov ebx, dword [0x4380a4]
xor edx, edx
mov edi, 2
mov dword [esp + 0x30], eax
lea esi, [esi]
mov eax, ebx
sub eax, esi
jne 0x414f60
mov ebp, dword [0x4380b4]
mov ecx, dword [0x4380b0]
cmp ebp, ecx
setb al
or dl, al
je 0x414fc0
mov eax, dword [0x4380b8]
mov dword [esp + 8], 0x4380ac
mov dword [esp + 4], 0x4380a0
mov dword [esp], eax
mov dword [0x4380a8], 0
mov dword [0x4380a4], 0x20000
call fcn.00412b30
mov ebx, dword [0x4380a8]
cmp dword [0x4380a4], ebx
sete dl
cmp eax, 0xffffff88
ja 0x4154d9
xor esi, esi
mov eax, ebx
mov dword [0x4380a4], ebx
mov dword [0x4380a8], 0
sub eax, esi
je 0x414ee6
cmp eax, edi
mov byte [esp + 0x34], dl
cmova eax, edi
mov ebp, eax
mov eax, dword [0x4380a0]
mov dword [esp + 8], ebp
add eax, esi
add esi, ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
add dword [esp + 0x30], ebp
sub edi, ebp
movzx edx, byte [esp + 0x34]
mov dword [0x4380a8], esi
jne 0x414ee0
movzx eax, word [esp + 0x60]
mov edi, dword [esp + 0x38]
mov word [edi], ax
test ax, ax
je 0x415011
add edi, 2
mov dword [esp + 0x38], edi
jmp 0x414ec8
cmp ebp, ecx
jne 0x4154d9
mov ecx, dword [0x4380bc]
mov eax, ecx
sub eax, dword [0x4380c0]
neg eax
je 0x414ee0
mov ebp, 0x20003
mov dword [0x4380ac], ecx
mov dword [0x4380b4], 0
cmp eax, ebp
cmova eax, ebp
add dword [0x426048], eax
lea ebp, [ecx + eax]
mov dword [0x4380b0], eax
mov dword [0x4380bc], ebp
jmp 0x414ee0
movzx ecx, word [0x426060]
test cx, cx
je 0x415510
movzx edx, word [0x4360a0]
xor edi, edi
mov eax, 2
mov ebx, 0x42f060
mov word [0x42f060], di
test dx, dx
jne 0x415056
jmp 0x41506f
add eax, 2
cmp eax, 0x2002
je 0x41c9d6
mov word [eax + 0x42f05e], dx
movzx edx, word [eax + 0x4360a0]
lea ebx, [eax + 0x42f060]
test dx, dx
jne 0x415048
xor esi, esi
mov word [ebx], si
cmp word [0x42f060], 0
je 0x4154f2
mov edx, 0x1000
mov eax, 0x42f060
lea esi, [esi]
add eax, 2
sub edx, 1
cmp word [eax], 0
jne 0x415090
test edx, edx
je 0x4157d4
mov dword [eax], 0x5c
mov edx, 0x1000
mov eax, 0x42f060
cmp word [0x42f060], 0
je 0x4150d4
nop
add eax, 2
sub edx, 1
cmp word [eax], 0
jne 0x4150c0
test edx, edx
je 0x4157d9
mov ebx, 0x426060
jmp 0x4150e8
test edx, edx
je 0x4157de
add ebx, 2
mov word [eax], cx
add eax, 2
sub edx, 1
movzx ecx, word [ebx]
test cx, cx
jne 0x4150e0
xor ecx, ecx
cmp word [0x42e860], 0
mov word [eax], cx
je 0x415489
lea eax, [esp + 0x70]
mov ebx, dword [0x4380a4]
xor edx, edx
mov edi, 8
mov dword [esp + 0x30], eax
mov esi, dword [0x4380a8]
lea esi, [esi]
mov eax, ebx
sub eax, esi
jne 0x4151b0
mov ebp, dword [0x4380b4]
mov ecx, dword [0x4380b0]
cmp ebp, ecx
setb al
or dl, al
je 0x415438
mov eax, dword [0x4380b8]
mov dword [esp + 8], 0x4380ac
mov dword [esp + 4], 0x4380a0
mov dword [esp], eax
mov dword [0x4380a8], 0
mov dword [0x4380a4], 0x20000
call fcn.00412b30
mov ebx, dword [0x4380a8]
cmp dword [0x4380a4], ebx
sete dl
cmp eax, 0xffffff88
ja 0x4154d9
xor esi, esi
mov eax, ebx
mov dword [0x4380a4], ebx
mov dword [0x4380a8], 0
sub eax, esi
je 0x415136
cmp eax, edi
mov byte [esp + 0x34], dl
cmova eax, edi
mov ebp, eax
mov eax, dword [0x4380a0]
mov dword [esp + 8], ebp
add eax, esi
add esi, ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
add dword [esp + 0x30], ebp
sub edi, ebp
movzx edx, byte [esp + 0x34]
mov dword [0x4380a8], esi
jne 0x415130
mov edi, dword [esp + 0x70]
mov ebp, dword [esp + 0x74]
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], ebp
call fcn.00414860
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 2
mov dword [esp + 4], 0x40000000
mov dword [esp], 0x42f060
call dword [sym.imp.KERNEL32.dll_CreateFileW]
sub esp, 0x1c
mov dword [esp + 0x4c], eax
cmp eax, 0xffffffff
je 0x415785
mov edx, ebp
or edx, edi
je 0x4153c9
lea esi, [esi]
nop
mov edi, dword [esp + 0x38]
xor eax, eax
mov ebp, dword [esp + 0x3c]
mov edx, 0x8000
mov esi, eax
mov dword [esp + 0x30], 0x426860
mov ebx, dword [0x4380a4]
cmp edx, edi
sbb esi, ebp
mov esi, dword [0x4380a8]
cmovae edx, edi
cmovae eax, ebp
mov dword [esp + 0x40], edx
mov edi, dword [esp + 0x40]
xor edx, edx
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], edi
lea esi, [esi]
mov eax, ebx
sub eax, esi
jne 0x415328
mov ebp, dword [0x4380b4]
mov ecx, dword [0x4380b0]
cmp ebp, ecx
setb al
or dl, al
je 0x4153e0
mov eax, dword [0x4380b8]
mov dword [esp + 8], 0x4380ac
mov dword [esp + 4], 0x4380a0
mov dword [esp], eax
mov dword [0x4380a8], 0
mov dword [0x4380a4], 0x20000
call fcn.00412b30
mov ebx, dword [0x4380a8]
cmp dword [0x4380a4], ebx
sete dl
cmp eax, 0xffffff88
ja 0x4154d9
xor esi, esi
mov eax, ebx
mov dword [0x4380a4], ebx
mov dword [0x4380a8], 0
sub eax, esi
je 0x4152ae
cmp eax, edi
mov byte [esp + 0x34], dl
cmova eax, edi
mov ebp, eax
mov eax, dword [0x4380a0]
mov dword [esp + 8], ebp
add eax, esi
add esi, ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
add dword [esp + 0x30], ebp
sub edi, ebp
movzx edx, byte [esp + 0x34]
mov dword [0x4380a8], esi
jne 0x4152a8
lea eax, [esp + 0x70]
mov dword [esp + 0x70], 0
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x10], 0
mov dword [esp + 8], eax
mov eax, dword [esp + 0x4c]
mov dword [esp + 4], 0x426860
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x14
test eax, eax
je 0x4157c0
mov edi, dword [esp + 0x40]
mov ebp, dword [esp + 0x44]
sub dword [esp + 0x38], edi
mov edi, dword [esp + 0x38]
sbb dword [esp + 0x3c], ebp
mov ebp, dword [esp + 0x3c]
mov eax, ebp
or eax, edi
jne 0x415260
mov eax, dword [esp + 0x4c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
jmp 0x414eb5
cmp ebp, ecx
jne 0x4154d9
mov ecx, dword [0x4380bc]
mov eax, ecx
sub eax, dword [0x4380c0]
neg eax
je 0x4152a8
mov ebp, 0x20003
mov dword [0x4380ac], ecx
mov dword [0x4380b4], 0
cmp eax, ebp
cmova eax, ebp
add dword [0x426048], eax
lea ebp, [ecx + eax]
mov dword [0x4380b0], eax
mov dword [0x4380bc], ebp
jmp 0x4152a8
cmp ebp, ecx
jne 0x4154d9
mov ecx, dword [0x4380bc]
mov eax, ecx
sub eax, dword [0x4380c0]
neg eax
je 0x415130
mov ebp, 0x20003
mov dword [0x4380ac], ecx
mov dword [0x4380b4], 0
cmp eax, ebp
cmova eax, ebp
add dword [0x426048], eax
lea ebp, [ecx + eax]
mov dword [0x4380b0], eax
mov dword [0x4380bc], ebp
jmp 0x415130
movzx edx, word [0x42f060]
mov eax, 2
mov ecx, 0x42e860
test dx, dx
jne 0x4154b6
jmp 0x4154cf
add eax, 2
cmp eax, 0x2002
je 0x41c9d6
mov word [eax + 0x42e85e], dx
movzx edx, word [eax + 0x42f060]
lea ecx, [eax + 0x42e860]
test dx, dx
jne 0x4154a8
xor edx, edx
mov word [ecx], dx
jmp 0x41510f
call fcn.00401b10
mov eax, 7
cpuid
shr ebx, 8
mov ecx, ebx
and ecx, 1
jmp 0x414e70
mov eax, 0x42f060
jmp 0x4150a4
mov dword [0x4380b8], 0
mov eax, str.Error__couldnt_allocate_memory.
call fcn.00401af0
mov ebx, dword [0x4380b8]
test ebx, ebx
je 0x4155e2
mov eax, dword [ebx + 0x7380]
test eax, eax
jne 0x4155e2
mov esi, dword [ebx + 0x7388]
mov edi, dword [ebx + 0x7370]
mov ebp, dword [ebx + 0x7374]
test esi, esi
je 0x415582
mov edx, dword [esi]
mov eax, dword [esi + 0x6ab4]
mov ecx, dword [esi + 0x6ab8]
test edx, edx
je 0x415770
test eax, eax
je 0x4157ca
mov dword [esp], ecx
mov dword [esp + 0x34], ecx
mov dword [esp + 0x30], eax
mov dword [esp + 4], edx
call eax
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
mov dword [esp + 4], esi
mov dword [esp], ecx
call eax
mov dword [ebx + 0x7388], 0
mov eax, dword [ebx + 0x73a0]
mov dword [ebx + 0x738c], 0
mov dword [ebx + 0x7398], 0
test eax, eax
je 0x4155d1
test edi, edi
je 0x415738
mov dword [esp + 4], eax
mov dword [esp], ebp
call edi
mov dword [ebx + 0x73a0], 0
jmp 0x4155d9
mov eax, str._TEMP_onefile__PID___TIME_
call fcn.00401ac0
test edi, edi
je 0x415740
mov dword [esp + 4], ebx
mov dword [esp], ebp
call edi
mov eax, dword [0x4380a0]
lea ebx, [esp + 0x70]
mov dword [esp], eax
call sub.msvcrt.dll_free
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 8], 0x41e1a6
mov dword [esp + 0xc], eax
mov dword [esp + 4], pe_nt_image_headers32
mov dword [esp], ebx
call fcn.00401a60
mov dword [esp + 4], ebx
mov dword [esp], str.NUITKA_ONEFILE_PARENT
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
xor eax, eax
mov ecx, 0x10
sub esp, 8
lea edx, [esp + 0x74]
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [esp + 0x70], 0x44
lea edi, [esp + 0x60]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [esp + 0x24], edi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x20
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0x42e860
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
sub esp, 0x28
test eax, eax
je 0x41574d
mov eax, dword [esp + 0x64]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp], eax
call ebx
sub esp, 4
mov eax, dword [esp + 0x60]
mov dword [esp + 0x5c], 0
mov dword [0x426044], eax
test eax, eax
je 0x415715
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
lea eax, [esp + 0x5c]
mov dword [esp + 4], eax
mov eax, dword [0x426044]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
sub esp, 8
test eax, eax
jne 0x4156fe
mov dword [esp + 0x5c], 1
mov eax, dword [0x426044]
mov dword [esp], eax
call ebx
mov dword [0x426044], 0
sub esp, 4
call fcn.00402b10
mov eax, dword [esp + 0x5c]
add esp, 0xfc
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
mov eax, str.Error__failed_to_register_signal_handler.
call fcn.00401af0
lea esi, [esi]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov dword [esp], ebx
call sub.msvcrt.dll_free
jmp 0x4155e2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.Error__couldnt_launch_child
mov dword [esp + 4], eax
call fcn.00414c40
mov dword [esp], 2
call sub.msvcrt.dll_exit
nop
test eax, eax
jne 0x415579
mov dword [esp], esi
call sub.msvcrt.dll_free
jmp 0x415582
mov dword [esp], 2
call dword [0x41d058]
mov dword [esp + 8], 0x42f060
mov dword [esp + 4], str.Error__failed_to_open__ls_for_writing._n
mov dword [esp], eax
call fcn.00401a90
mov dword [esp], 2
call sub.msvcrt.dll_exit
mov eax, str.Error__could_find_attached_data_header.
call fcn.00401af0
mov eax, str.Error__couldnt_runtime_expand_target_path.
call fcn.00401af0
mov dword [esp], edx
call sub.msvcrt.dll_free
jmp 0x415778
jmp 0x41c9d6
jmp 0x41c9d6
jmp 0x41c9d6