Function at 0x7ff6fd4f2840
Capabilities:
Accept command line arguments
Create process on windows
Extract resource via kernel32 functions
Set environment variable
Write and execute a file
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x108
lea r13, [0x7ff6fd50e0e0]
nop word [rax + rax]
mov rax, qword [0x7ff6fd50c0c8]
lea rdi, [0x7ff6fd50b8c0]
movzx edx, word [rax]
add rax, 2
mov qword [0x7ff6fd50c0c8], rax
mov word [rdi], dx
test dx, dx
je 0x7ff6fd4f265e
mov rdx, rdi
nop dword [rax + rax]
movzx ecx, word [rax]
add rdx, 2
mov r9, rax
lea rax, [rax + 2]
mov word [rdx], cx
test cx, cx
jne 0x7ff6fd4f23e0
mov qword [0x7ff6fd50c0c8], rax
lea rax, [0x7ff6fd50b8c0]
movzx ecx, word [rax]
test cx, cx
je 0x7ff6fd4f265e
movzx r8d, word [0x7ff6fd50c0e0]
xor r10d, r10d
lea rdx, [0x7ff6fd5098c0]
lea rax, [0x7ff6fd50c0e0]
mov word [0x7ff6fd5098c0], r10w
test r8w, r8w
jne 0x7ff6fd4f2449
jmp 0x7ff6fd4f245f
cmp rax, r13
je 0x7ff6fd4fa4d2
add rax, 2
mov word [rdx], r8w
add rdx, 2
movzx r8d, word [rax]
test r8w, r8w
jne 0x7ff6fd4f2440
xor r8d, r8d
lea rax, [0x7ff6fd5098c0]
mov word [rdx], r8w
cmp word [rax], 0
je 0x7ff6fd4f2652
mov edx, 0x1000
nop dword [rax]
add rax, 2
sub rdx, 1
cmp word [rax], 0
jne 0x7ff6fd4f2480
test rdx, rdx
je 0x7ff6fd4f2831
mov dword [rax], 0x5c
lea rax, [0x7ff6fd5098c0]
mov edx, 0x1000
cmp word [rax], 0
je 0x7ff6fd4f2646
nop dword [rax + rax]
add rax, 2
sub rdx, 1
cmp word [rax], 0
jne 0x7ff6fd4f24b8
test rdx, rdx
je 0x7ff6fd4f2836
lea r8, [0x7ff6fd50b8c0]
jmp 0x7ff6fd4f24e9
test rdx, rdx
je 0x7ff6fd4f282c
add r8, 2
mov word [rax], cx
add rax, 2
sub rdx, 1
movzx ecx, word [r8]
test cx, cx
jne 0x7ff6fd4f24e0
xor edx, edx
cmp word [0x7ff6fd5090c0], 0
mov word [rax], dx
je 0x7ff6fd4f25f8
mov r15, qword [r9 + 2]
add r9, 0xa
mov qword [0x7ff6fd50c0c8], r9
call fcn.7ff6fd4f2140
mov dword [rsp + 0x28], 0
xor r9d, r9d
mov r8d, 2
mov qword [rsp + 0x30], 0
mov edx, 0x40000000
lea rcx, [0x7ff6fd5098c0]
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x7ff6fd4f2800
mov rdi, qword [sym.imp.KERNEL32.dll_WriteFile]
lea rsi, [0x7ff6fd5010c0]
lea rbp, [rsp + 0x80]
test r15, r15
je 0x7ff6fd4f25e3
nop dword [rax]
mov ebx, 0x8000
mov r14, qword [0x7ff6fd50c0c8]
mov rcx, rsi
cmp r15, rbx
cmovbe rbx, r15
mov rdx, r14
mov r8, rbx
call sub.msvcrt.dll_memcpy
lea rdx, [r14 + rbx]
mov r9, rbp
mov r8d, ebx
mov qword [0x7ff6fd50c0c8], rdx
mov rcx, r12
mov rdx, rsi
mov dword [rsp + 0x80], 0
mov qword [rsp + 0x20], 0
call rdi
test eax, eax
je 0x7ff6fd4f2781
sub r15, rbx
jne 0x7ff6fd4f2588
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x7ff6fd4f23b0
lea rax, [0x7ff6fd5098c0]
lea rdx, [0x7ff6fd5090c0]
movzx ecx, word [rax]
lea r8, [rax + 0x2000]
test cx, cx
jne 0x7ff6fd4f2629
jmp 0x7ff6fd4f263c
cmp rax, r8
je 0x7ff6fd4fa4d2
add rax, 2
mov word [rdx], cx
add rdx, 2
movzx ecx, word [rax]
test cx, cx
jne 0x7ff6fd4f2620
xor eax, eax
mov word [rdx], ax
jmp 0x7ff6fd4f2514
lea rax, [0x7ff6fd5098c0]
jmp 0x7ff6fd4f24cf
lea rax, [0x7ff6fd5098c0]
jmp 0x7ff6fd4f2497
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rbp, [rsp + 0x80]
mov edx, pe_nt_image_headers64
lea r8, [0x7ff6fd4fc0aa]
mov r9d, eax
mov rcx, rbp
mov rdi, rbp
call fcn.7ff6fd4f1840
mov rdx, rbp
lea rcx, str.NUITKA_ONEFILE_PARENT
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
xor eax, eax
mov ecx, 0xd
rep stosq qword [rdi], rax
mov dword [rsp + 0x80], 0x68
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x40], rbp
mov rdx, rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], 0
lea rcx, [0x7ff6fd5090c0]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x7ff6fd4f278d
mov rcx, qword [rsp + 0x68]
mov rbx, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rbx
mov rcx, qword [rsp + 0x60]
mov dword [rsp + 0x58], 0
mov qword [0x7ff6fd5010a0], rcx
test rcx, rcx
je 0x7ff6fd4f2764
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [0x7ff6fd5010a0]
lea rdx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x7ff6fd4f2750
mov dword [rsp + 0x58], 1
mov rcx, qword [0x7ff6fd5010a0]
call rbx
mov qword [0x7ff6fd5010a0], 0
call fcn.7ff6fd4f2210
mov eax, dword [rsp + 0x58]
add rsp, 0x108
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, str.Error__couldnt_runtime_expand_target_path.
call fcn.7ff6fd4f1ed0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, 0x409
xor edx, edx
mov ecx, 0x1300
mov ebx, eax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], 0
mov r8d, ebx
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov rsi, qword [rsp + 0x58]
mov ecx, 2
call qword [fcn.7ff6fd4f9b40]
mov r9d, ebx
lea r8, str.Error__couldnt_launch_child
lea rdx, str._s___Error__d___s__n
mov qword [rsp + 0x20], rsi
mov rcx, rax
call fcn.7ff6fd4f1810
mov ecx, 2
call sub.msvcrt.dll_exit
nop
mov ecx, 2
call qword [fcn.7ff6fd4f9b40]
lea r8, [0x7ff6fd5098c0]
lea rdx, str.Error__failed_to_open__ls_for_writing._n
mov rcx, rax
call fcn.7ff6fd4f1810
mov ecx, 2
call sub.msvcrt.dll_exit
nop
jmp 0x7ff6fd4fa4d2
jmp 0x7ff6fd4fa4d2
jmp 0x7ff6fd4fa4d2
push r12
sub rsp, 0x20
lea r12, str._TEMP_onefile__PID___TIME_
mov r8d, 0x1000
lea rcx, [0x7ff6fd50c0e0]
mov rdx, r12
call fcn.7ff6fd4f1860
test al, al
je 0x7ff6fd4f28e0
mov edx, 1
lea rcx, [0x7ff6fd4f2370]
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
test eax, eax
je 0x7ff6fd4f28f4
mov r8d, 0xa
xor ecx, ecx
mov edx, 0x1b
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
lea rcx, [rax + 3]
cmp byte [rax + 1], 0x41
movzx edx, byte [rax]
mov qword [0x7ff6fd50c0c8], rcx
movzx r8d, byte [rax + 2]
jne 0x7ff6fd4f28e8
cmp dl, 0x4b
jne 0x7ff6fd4f28e8
cmp r8b, 0x58
jne 0x7ff6fd4f28e8
mov byte [0x7ff6fd50c0c0], 1
add rsp, 0x20
pop r12
jmp 0x7ff6fd4f2390
mov rcx, r12
call fcn.7ff6fd4f1ef0
lea rcx, str.Error__could_find_attached_data_header.
call fcn.7ff6fd4f1ed0
lea rcx, str.Error__failed_to_register_signal_handler.
call fcn.7ff6fd4f1ed0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push rbp
mov rbp, rsp
sub rsp, 0x20
jmp 0x7ff6fd4f2938
mov rax, qword [0x7ff6fd4fb020]
mov rax, qword [rax]
call rax
mov rax, qword [0x7ff6fd4fb020]
add rax, 8
mov qword [0x7ff6fd4fb020], rax
mov rax, qword [0x7ff6fd4fb020]
mov rax, qword [rax]
test rax, rax
jne 0x7ff6fd4f291a
nop
nop
add rsp, 0x20
pop rbp
ret