Function at 0x40a430
Capabilities:
Extract resource via kernel32 functions
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x228
lea rbx, [rsp + 0x120]
mov rbp, rcx
mov r12d, r9d
call qword [sym.imp.KERNEL32.dll_AllocConsole]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor edx, edx
mov rsi, qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, rax
call rsi
lea r8, [rsp + 0xb4]
xor eax, eax
xor r9d, r9d
lea rdx, [rsp + 0xb0]
mov rdi, r8
mov ecx, 0xc
mov dword [rsp + 0xb0], 0x68
rep stosq qword [rdi], rax
lea rax, [rsp + 0x60]
xor r8d, r8d
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
lea rcx, str.C:WindowsSystem32cmd.exe
mov qword [rsp + 0x70], 0
mov dword [rdi], 0
mov qword [rsp + 0x40], rdx
lea rdx, str.cmd.exe__t:0a__k_echo_Startup_Time:__time__On__date___echo_User:__username___echo_Working_Directory:__cd___set_prompt_date___username__Jailm8:__pause__NUL
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
lea rcx, [rsp + 0x58]
movabs rax, 0xff00000008
mov qword [0x00410050], rbp
mov qword [rsp + 0x58], rax
call qword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov r8d, 0x100
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov rcx, rbx
call fcn.00405210
lea rdx, [0x0040d390]
mov rcx, rax
call sub.msvcrt.dll__stricmp
test eax, eax
je 0x403c10
lea rdx, [0x0040d59e]
lea rcx, [0x0040d390]
call sub.msvcrt.dll_fopen
test rax, rax
mov qword [0x00410058], rax
jne 0x403c40
lea rcx, [0x004039a0]
call fcn.00401510
lea r8, str.BACKEND
xor ecx, ecx
mov edx, 0x4d2
call qword [sym.imp.KERNEL32.dll_FindResourceW]
xor ecx, ecx
mov rbx, rax
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, rbx
xor ecx, ecx
mov r13d, eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rcx, rbx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_FreeResource]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
lea rcx, [0x0040d5ea]
mov dword [rsp + 0x28], 0x102
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateFileW]
xor r9d, r9d
mov r8d, r13d
mov rdx, rdi
mov qword [rsp + 0x20], 0
mov rbx, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [0x0040d59e]
lea rcx, [0x0040d390]
call sub.msvcrt.dll_fopen
test rax, rax
mov qword [0x00410058], rax
jne 0x403c40
mov r9d, 0x10
xor ecx, ecx
mov ebx, 1
lea r8, [0x0040d520]
lea rdx, str.Error_extracting_backend
call qword [sym.imp.USER32.dll_MessageBoxW]
mov eax, ebx
add rsp, 0x228
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov r9d, 0x10
xor ecx, ecx
mov ebx, 1
lea r8, [0x0040d520]
lea rdx, str.ERROR:_You_cannot_save_this_executable_as__jailm8.exe_
call qword [sym.imp.USER32.dll_MessageBoxW]
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x403bf8
call fcn.004030b0
test eax, eax
mov ebx, eax
je 0x403d14
call fcn.004031a0
test rax, rax
mov rdi, rax
je 0x403cda
lea rbx, [rsp + 0x80]
mov rcx, rbp
mov edx, 0x67
call qword [sym.imp.USER32.dll_LoadAcceleratorsW]
mov edx, r12d
mov rcx, rdi
mov rbp, rax
call rsi
mov rcx, rdi
call qword [sym.imp.USER32.dll_UpdateWindow]
mov rsi, qword [sym.imp.USER32.dll_GetMessageW]
mov r12, qword [sym.imp.USER32.dll_TranslateAcceleratorW]
jmp 0x403cb0
mov r8, rbx
mov rdx, rbp
mov rcx, rdi
call r12
test eax, eax
je 0x403d00
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call rsi
test eax, eax
jg 0x403ca0
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, dword [rsp + 0x90]
jmp 0x403bf8
mov r9d, 0x10
xor ecx, ecx
xor ebx, ebx
lea r8, [0x0040d520]
lea rdx, str.Error_creating_main_window.
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x403bf8
mov rcx, rbx
call qword [sym.imp.USER32.dll_TranslateMessage]
mov rcx, rbx
call qword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x403cb0
lea r8, [0x0040d520]
mov r9d, 0x10
xor ecx, ecx
lea rdx, str.Error_registering_main_window_class.
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x403bf8
sub rsp, 0x28
call fcn.00403e00
mov rax, qword [0x0040ddd0]
xor edx, edx
mov r9d, dword [rax]
mov rax, qword [0x0040ddc0]
mov r8, qword [rax]
mov rax, qword [0x0040ddb0]
mov rcx, qword [rax]
add rsp, 0x28
jmp 0x4039d0