Function at 0x1400033f0
Capabilities:
Accept command line arguments
Create process on windows
Encode data using xor
Extract resource via kernel32 functions
Get file size
Hash data with crc32
Read file via mapping
Set environment variable
Write and execute a file
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x2f8
movaps xmmword [rsp + 0x2e0], xmm6
movd xmm6, dword [0x14000f6a0]
nop dword [rax + rax]
mov rax, qword [0x1400210e0]
lea rdi, [0x1400208e0]
movzx edx, word [rax]
add rax, 2
mov qword [0x1400210e0], rax
mov word [rdi], dx
test dx, dx
je 0x140002e99
mov rdx, rdi
nop dword [rax + rax]
movzx ecx, word [rax]
add rdx, 2
mov r9, rax
lea rax, [rax + 2]
mov word [rdx], cx
test cx, cx
jne 0x1400020b8
mov qword [0x1400210e0], rax
lea rax, [0x1400208e0]
movzx ecx, word [rax]
test cx, cx
je 0x140002e99
movzx r8d, word [0x140021100]
lea r14, [0x14001e8e0]
xor r12d, r12d
lea rax, [0x140021100]
mov word [0x14001e8e0], r12w
mov rdx, r14
test r8w, r8w
jne 0x140002128
jmp 0x14000213e
lea rbx, [0x140023100]
cmp rax, rbx
je 0x14000b0fc
add rax, 2
mov word [rdx], r8w
add rdx, 2
movzx r8d, word [rax]
test r8w, r8w
jne 0x140002118
xor ebp, ebp
mov word [rdx], bp
cmp word [0x14001e8e0], 0
je 0x140002f7d
mov edx, 0x1000
lea rax, [0x14001e8e0]
nop dword [rax]
add rax, 2
sub rdx, 1
cmp word [rax], 0
jne 0x140002160
test rdx, rdx
je 0x1400033df
movd dword [rax], xmm6
cmp word [0x14001e8e0], 0
je 0x140002f96
mov edx, 0x1000
lea rax, [0x14001e8e0]
nop dword [rax]
add rax, 2
sub rdx, 1
cmp word [rax], 0
jne 0x140002198
test rdx, rdx
je 0x1400033e4
lea r8, [0x1400208e0]
jmp 0x1400021c9
test rdx, rdx
je 0x1400033e9
add r8, 2
mov word [rax], cx
add rax, 2
sub rdx, 1
movzx ecx, word [r8]
test cx, cx
jne 0x1400021c0
xor edi, edi
cmp word [0x14001e0e0], 0
mov word [rax], di
je 0x140002e28
mov eax, dword [r9 + 0xa]
mov rbx, qword [r9 + 2]
add r9, 0xe
mov rcx, r14
mov qword [0x1400210e0], r9
mov edx, 0x80000000
xor r9d, r9d
mov r15, qword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [rsp + 0x60], eax
mov r8d, 7
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call r15
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x140002e8c
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r12d, eax
cmp eax, 0xffffffff
je 0x140002e76
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor edx, edx
mov rcx, rbp
mov qword [rsp + 0x28], 0
mov r8d, 2
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rsi, rax
test rax, rax
je 0x140002e76
xor r9d, r9d
xor r8d, r8d
mov edx, 4
mov rcx, rax
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rsp + 0x68], rax
test rax, rax
je 0x14000331b
cmp r12d, 0x2e
mov edi, r12d
mov r12, rax
mov eax, 0xffffffff
jbe 0x140002927
test r12b, 7
je 0x140003339
mov ecx, 0xffffffff
lea r11, [0x14000f2a0]
jmp 0x1400022fa
test r12b, 7
je 0x140002fa7
add r12, 1
mov eax, ecx
xor cl, byte [r12 - 1]
shr eax, 8
movzx ecx, cl
xor eax, dword [r11 + rcx*4]
mov ecx, eax
sub rdi, 1
jne 0x1400022f0
mov qword [rsp + 0x70], 0xffffffffffffffff
mov qword [rsp + 0x98], r12
mov r13, r12
xor r8d, r8d
xor edx, edx
mov rax, qword [rsp + 0x70]
mov dword [rsp + 0x58], ecx
xor r10d, r10d
xor r9d, r9d
mov qword [rsp + 0x80], rdi
mov qword [rsp + 0x78], rax
mov r12, qword [rsp + 0x78]
lea rax, [0x14000d2a0]
mov qword [rsp + 0x88], rbp
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x78], rbx
nop dword [rax]
mov rbx, qword [r13 + 0x20]
mov ecx, dword [rsp + 0x58]
add r13, 0x28
xor rcx, qword [r13 - 0x28]
xor rdx, qword [r13 - 0x20]
xor rbx, r8
mov r8, rcx
mov rbp, rdx
mov rsi, qword [r13 - 0x10]
shr r8, 0x38
movzx edx, cl
mov rdi, qword [r13 - 0x18]
mov edx, dword [rax + rdx*4]
xor edx, dword [rax + r8*4 + 0x1c00]
xor rsi, r10
mov r8, rcx
mov r10d, edx
movzx edx, ch
shr r8, 0x10
xor rdi, r9
mov edx, dword [rax + rdx*4 + 0x400]
movzx r8d, r8b
movzx r9d, dil
mov r9d, dword [rax + r9*4]
xor edx, r10d
xor edx, dword [rax + r8*4 + 0x800]
mov r8, rcx
movzx r10d, sil
shr r8, 0x18
mov r10d, dword [rax + r10*4]
movzx r8d, r8b
xor edx, dword [rax + r8*4 + 0xc00]
mov r8, rcx
shr r8, 0x20
movzx r8d, r8b
xor edx, dword [rax + r8*4 + 0x1000]
mov r8, rcx
shr rcx, 0x30
shr r8, 0x28
movzx ecx, cl
movzx r8d, r8b
xor edx, dword [rax + r8*4 + 0x1400]
mov r8, rbp
xor edx, dword [rax + rcx*4 + 0x1800]
mov rcx, rbp
shr r8, 0x38
mov dword [rsp + 0x58], edx
movzx edx, bpl
movzx ecx, ch
mov edx, dword [rax + rdx*4]
xor edx, dword [rax + r8*4 + 0x1c00]
mov r8, rbp
shr r8, 0x10
xor edx, dword [rax + rcx*4 + 0x400]
mov rcx, rdi
movzx r8d, r8b
movzx ecx, ch
xor edx, dword [rax + r8*4 + 0x800]
mov r8, rbp
shr r8, 0x18
movzx r8d, r8b
xor edx, dword [rax + r8*4 + 0xc00]
mov r8, rbp
shr r8, 0x20
movzx r8d, r8b
xor edx, dword [rax + r8*4 + 0x1000]
mov r8, rbp
shr rbp, 0x30
shr r8, 0x28
movzx ebp, bpl
movzx r8d, r8b
xor edx, dword [rax + r8*4 + 0x1400]
mov r8, rdi
xor edx, dword [rax + rbp*4 + 0x1800]
shr r8, 0x38
xor r9d, dword [rax + r8*4 + 0x1c00]
mov r8, rdi
xor r9d, dword [rax + rcx*4 + 0x400]
mov rcx, rsi
shr r8, 0x10
movzx r8d, r8b
xor r9d, dword [rax + r8*4 + 0x800]
mov r8, rdi
shr r8, 0x18
movzx r8d, r8b
xor r9d, dword [rax + r8*4 + 0xc00]
mov r8, rdi
shr r8, 0x20
movzx r8d, r8b
xor r9d, dword [rax + r8*4 + 0x1000]
mov r8, rdi
shr rdi, 0x30
shr r8, 0x28
movzx edi, dil
movzx r8d, r8b
xor r9d, dword [rax + r8*4 + 0x1400]
mov r8, rsi
xor r9d, dword [rax + rdi*4 + 0x1800]
movzx edi, ch
shr r8, 0x38
xor r10d, dword [rax + r8*4 + 0x1c00]
mov r8, rsi
xor r10d, dword [rax + rdi*4 + 0x400]
shr r8, 0x10
movzx r8d, r8b
xor r10d, dword [rax + r8*4 + 0x800]
mov r8, rsi
shr r8, 0x18
movzx r8d, r8b
xor r10d, dword [rax + r8*4 + 0xc00]
mov r8, rsi
shr r8, 0x20
movzx r8d, r8b
xor r10d, dword [rax + r8*4 + 0x1000]
mov r8, rsi
shr rsi, 0x30
shr r8, 0x28
movzx esi, sil
movzx r8d, r8b
xor r10d, dword [rax + r8*4 + 0x1400]
xor r10d, dword [rax + rsi*4 + 0x1800]
mov rsi, rbx
movzx r8d, bl
shr rsi, 0x38
mov r8d, dword [rax + r8*4]
xor r8d, dword [rax + rsi*4 + 0x1c00]
movzx esi, bh
xor r8d, dword [rax + rsi*4 + 0x400]
mov rsi, rbx
shr rsi, 0x10
movzx esi, sil
xor r8d, dword [rax + rsi*4 + 0x800]
mov rsi, rbx
shr rsi, 0x18
movzx esi, sil
xor r8d, dword [rax + rsi*4 + 0xc00]
mov rsi, rbx
shr rsi, 0x20
movzx esi, sil
xor r8d, dword [rax + rsi*4 + 0x1000]
mov rsi, rbx
shr rbx, 0x30
shr rsi, 0x28
movzx ebx, bl
movzx esi, sil
xor r8d, dword [rax + rsi*4 + 0x1400]
xor r8d, dword [rax + rbx*4 + 0x1800]
sub r12, 1
jne 0x140002370
mov rax, qword [rsp + 0x70]
mov r12, qword [rsp + 0x98]
mov ecx, dword [rsp + 0x58]
mov rdi, qword [rsp + 0x80]
lea rax, [rax + rax*4]
mov rbp, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x78]
lea r12, [r12 + rax*8]
mov rsi, qword [rsp + 0x90]
mov eax, r10d
mov qword [rsp + 0x70], rax
mov eax, ecx
xor rax, qword [r12]
xor rdx, qword [r12 + 8]
movzx ecx, al
shr rax, 8
mov ecx, dword [r11 + rcx*4]
xor rax, rcx
mov rcx, rax
movzx eax, al
mov eax, dword [r11 + rax*4]
shr rcx, 8
xor rax, rcx
mov rcx, rax
movzx eax, al
mov eax, dword [r11 + rax*4]
shr rcx, 8
xor rax, rcx
mov rcx, rax
movzx eax, al
mov eax, dword [r11 + rax*4]
shr rcx, 8
xor rax, rcx
mov rcx, rax
movzx eax, al
mov eax, dword [r11 + rax*4]
shr rcx, 8
xor rax, rcx
mov rcx, rax
movzx eax, al
mov eax, dword [r11 + rax*4]
shr rcx, 8
xor rax, rcx
mov rcx, rax
movzx eax, al
mov eax, dword [r11 + rax*4]
shr rcx, 8
xor rax, rcx
mov rcx, rax
movzx eax, al
shr rcx, 8
xor rdx, rcx
mov ecx, dword [r11 + rax*4]
xor rcx, rdx
movzx eax, cl
shr rcx, 8
mov edx, dword [r11 + rax*4]
xor rdx, rcx
mov rax, rdx
movzx edx, dl
mov edx, dword [r11 + rdx*4]
shr rax, 8
xor rax, rdx
mov rdx, rax
movzx eax, al
mov eax, dword [r11 + rax*4]
shr rdx, 8
xor rdx, rax
mov rax, rdx
movzx edx, dl
mov edx, dword [r11 + rdx*4]
shr rax, 8
xor rax, rdx
mov rdx, rax
movzx eax, al
mov eax, dword [r11 + rax*4]
shr rdx, 8
xor rdx, rax
mov rax, rdx
movzx edx, dl
mov edx, dword [r11 + rdx*4]
shr rax, 8
xor rax, rdx
mov rdx, rax
movzx eax, al
mov eax, dword [r11 + rax*4]
shr rdx, 8
xor rax, rdx
xor r9, qword [r12 + 0x10]
mov rdx, rax
movzx eax, al
mov eax, dword [r11 + rax*4]
shr rdx, 8
xor r9, rdx
xor r9, rax
movzx eax, r9b
shr r9, 8
mov edx, dword [r11 + rax*4]
xor rdx, r9
mov rax, rdx
movzx edx, dl
mov edx, dword [r11 + rdx*4]
shr rax, 8
xor rax, rdx
mov rdx, rax
movzx eax, al
mov eax, dword [r11 + rax*4]
shr rdx, 8
xor rdx, rax
mov rax, rdx
movzx edx, dl
mov edx, dword [r11 + rdx*4]
shr rax, 8
xor rax, rdx
mov rdx, rax
movzx eax, al
mov eax, dword [r11 + rax*4]
shr rdx, 8
xor rdx, rax
mov rax, rdx
movzx edx, dl
mov edx, dword [r11 + rdx*4]
shr rax, 8
xor rax, rdx
mov rdx, rax
movzx eax, al
mov eax, dword [r11 + rax*4]
shr rdx, 8
xor rdx, rax
mov rax, qword [rsp + 0x70]
xor rax, qword [r12 + 0x18]
mov rcx, rdx
movzx edx, dl
mov edx, dword [r11 + rdx*4]
shr rcx, 8
xor rax, rcx
xor rax, rdx
movzx edx, al
shr rax, 8
mov edx, dword [r11 + rdx*4]
xor rdx, rax
mov rax, rdx
movzx edx, dl
mov edx, dword [r11 + rdx*4]
shr rax, 8
xor rax, rdx
mov rdx, rax
movzx eax, al
mov eax, dword [r11 + rax*4]
shr rdx, 8
xor rax, rdx
mov rdx, rax
movzx eax, al
mov eax, dword [r11 + rax*4]
shr rdx, 8
xor rax, rdx
mov rdx, rax
movzx eax, al
mov eax, dword [r11 + rax*4]
shr rdx, 8
xor rdx, rax
xor r8, qword [r12 + 0x20]
add r12, 0x28
mov rax, rdx
movzx edx, dl
mov edx, dword [r11 + rdx*4]
shr rax, 8
xor rax, rdx
mov rdx, rax
movzx eax, al
mov eax, dword [r11 + rax*4]
shr rdx, 8
xor rax, rdx
mov rdx, rax
movzx eax, al
mov eax, dword [r11 + rax*4]
shr rdx, 8
xor r8, rdx
xor r8, rax
movzx eax, r8b
shr r8, 8
mov edx, dword [r11 + rax*4]
xor rdx, r8
mov rax, rdx
movzx edx, dl
mov edx, dword [r11 + rdx*4]
shr rax, 8
xor rax, rdx
mov rcx, rax
movzx eax, al
mov edx, dword [r11 + rax*4]
shr rcx, 8
xor rdx, rcx
mov rax, rdx
movzx edx, dl
mov edx, dword [r11 + rdx*4]
shr rax, 8
xor rax, rdx
mov rdx, rax
movzx eax, al
mov eax, dword [r11 + rax*4]
shr rdx, 8
xor rax, rdx
mov rdx, rax
movzx eax, al
mov eax, dword [r11 + rax*4]
shr rdx, 8
xor rax, rdx
mov rcx, rax
movzx eax, al
mov edx, dword [r11 + rax*4]
shr rcx, 8
xor rdx, rcx
mov rax, rdx
movzx edx, dl
shr rax, 8
xor eax, dword [r11 + rdx*4]
cmp rdi, 7
jbe 0x140002c23
mov edx, eax
xor al, byte [r12]
lea r11, [0x14000f2a0]
movzx eax, al
shr edx, 8
lea rcx, [rdi - 8]
xor edx, dword [r11 + rax*4]
mov eax, edx
xor dl, byte [r12 + 1]
movzx edx, dl
shr eax, 8
xor eax, dword [r11 + rdx*4]
mov edx, eax
xor al, byte [r12 + 2]
movzx eax, al
shr edx, 8
xor edx, dword [r11 + rax*4]
mov eax, edx
xor dl, byte [r12 + 3]
movzx edx, dl
shr eax, 8
xor eax, dword [r11 + rdx*4]
mov edx, eax
xor al, byte [r12 + 4]
movzx eax, al
shr edx, 8
xor edx, dword [r11 + rax*4]
mov eax, edx
xor dl, byte [r12 + 5]
movzx edx, dl
shr eax, 8
xor eax, dword [r11 + rdx*4]
mov edx, eax
xor al, byte [r12 + 6]
movzx eax, al
shr edx, 8
xor edx, dword [r11 + rax*4]
mov eax, edx
xor dl, byte [r12 + 7]
movzx edx, dl
shr eax, 8
xor eax, dword [r11 + rdx*4]
cmp rcx, 7
jbe 0x140002c17
mov edx, eax
xor al, byte [r12 + 8]
movzx eax, al
shr edx, 8
xor edx, dword [r11 + rax*4]
mov eax, edx
xor dl, byte [r12 + 9]
movzx edx, dl
shr eax, 8
xor eax, dword [r11 + rdx*4]
mov edx, eax
xor al, byte [r12 + 0xa]
movzx eax, al
shr edx, 8
xor edx, dword [r11 + rax*4]
mov eax, edx
xor dl, byte [r12 + 0xb]
movzx edx, dl
shr eax, 8
xor eax, dword [r11 + rdx*4]
mov edx, eax
xor al, byte [r12 + 0xc]
movzx eax, al
shr edx, 8
xor edx, dword [r11 + rax*4]
mov eax, edx
xor dl, byte [r12 + 0xd]
movzx edx, dl
shr eax, 8
xor eax, dword [r11 + rdx*4]
mov edx, eax
xor al, byte [r12 + 0xe]
movzx eax, al
shr edx, 8
xor edx, dword [r11 + rax*4]
mov eax, edx
xor dl, byte [r12 + 0xf]
movzx edx, dl
shr eax, 8
xor eax, dword [r11 + rdx*4]
lea rdx, [rdi - 0x10]
cmp rdx, 7
jbe 0x140002c17
mov edx, eax
xor al, byte [r12 + 0x10]
movzx eax, al
shr edx, 8
xor edx, dword [r11 + rax*4]
mov eax, edx
xor dl, byte [r12 + 0x11]
movzx edx, dl
shr eax, 8
xor eax, dword [r11 + rdx*4]
mov edx, eax
xor al, byte [r12 + 0x12]
movzx eax, al
shr edx, 8
xor edx, dword [r11 + rax*4]
mov eax, edx
xor dl, byte [r12 + 0x13]
movzx edx, dl
shr eax, 8
xor eax, dword [r11 + rdx*4]
mov edx, eax
xor al, byte [r12 + 0x14]
movzx eax, al
shr edx, 8
xor edx, dword [r11 + rax*4]
mov eax, edx
xor dl, byte [r12 + 0x15]
movzx edx, dl
shr eax, 8
xor eax, dword [r11 + rdx*4]
mov edx, eax
xor al, byte [r12 + 0x16]
movzx eax, al
shr edx, 8
xor edx, dword [r11 + rax*4]
mov eax, edx
xor dl, byte [r12 + 0x17]
movzx edx, dl
shr eax, 8
xor eax, dword [r11 + rdx*4]
lea rdx, [rdi - 0x18]
cmp rdx, 7
jbe 0x140002c17
mov edx, eax
xor al, byte [r12 + 0x18]
movzx eax, al
shr edx, 8
xor edx, dword [r11 + rax*4]
mov eax, edx
xor dl, byte [r12 + 0x19]
movzx edx, dl
shr eax, 8
xor eax, dword [r11 + rdx*4]
mov edx, eax
xor al, byte [r12 + 0x1a]
movzx eax, al
shr edx, 8
xor edx, dword [r11 + rax*4]
mov eax, edx
xor dl, byte [r12 + 0x1b]
movzx edx, dl
shr eax, 8
xor eax, dword [r11 + rdx*4]
mov edx, eax
xor al, byte [r12 + 0x1c]
movzx eax, al
shr edx, 8
xor edx, dword [r11 + rax*4]
mov eax, edx
xor dl, byte [r12 + 0x1d]
movzx edx, dl
shr eax, 8
xor eax, dword [r11 + rdx*4]
mov edx, eax
xor al, byte [r12 + 0x1e]
movzx eax, al
shr edx, 8
xor edx, dword [r11 + rax*4]
mov eax, edx
xor dl, byte [r12 + 0x1f]
movzx edx, dl
shr eax, 8
xor eax, dword [r11 + rdx*4]
lea rdx, [rdi - 0x20]
cmp rdx, 7
jbe 0x140002c17
mov edx, eax
xor al, byte [r12 + 0x20]
movzx eax, al
shr edx, 8
xor edx, dword [r11 + rax*4]
mov eax, edx
xor dl, byte [r12 + 0x21]
movzx edx, dl
shr eax, 8
xor eax, dword [r11 + rdx*4]
mov edx, eax
xor al, byte [r12 + 0x22]
movzx eax, al
shr edx, 8
xor edx, dword [r11 + rax*4]
mov eax, edx
xor dl, byte [r12 + 0x23]
movzx edx, dl
shr eax, 8
xor eax, dword [r11 + rdx*4]
mov edx, eax
xor al, byte [r12 + 0x24]
movzx eax, al
shr edx, 8
xor edx, dword [r11 + rax*4]
mov eax, edx
xor dl, byte [r12 + 0x25]
movzx edx, dl
shr eax, 8
xor eax, dword [r11 + rdx*4]
mov edx, eax
xor al, byte [r12 + 0x26]
movzx eax, al
shr edx, 8
xor edx, dword [r11 + rax*4]
mov eax, edx
xor dl, byte [r12 + 0x27]
movzx edx, dl
shr eax, 8
xor eax, dword [r11 + rdx*4]
shr rcx, 3
and edi, 7
lea r12, [r12 + rcx*8 + 8]
test rdi, rdi
je 0x140002cd3
mov edx, eax
xor al, byte [r12]
lea r11, [0x14000f2a0]
movzx eax, al
shr edx, 8
xor edx, dword [r11 + rax*4]
mov eax, edx
cmp rdi, 1
je 0x140002cd3
xor al, byte [r12 + 1]
shr edx, 8
movzx eax, al
xor edx, dword [r11 + rax*4]
mov eax, edx
cmp rdi, 2
je 0x140002cd3
xor al, byte [r12 + 2]
shr edx, 8
movzx eax, al
xor edx, dword [r11 + rax*4]
mov eax, edx
cmp rdi, 3
je 0x140002cd3
xor al, byte [r12 + 3]
shr edx, 8
movzx eax, al
xor edx, dword [r11 + rax*4]
mov eax, edx
cmp rdi, 4
je 0x140002cd3
xor al, byte [r12 + 4]
shr edx, 8
movzx eax, al
xor edx, dword [r11 + rax*4]
mov eax, edx
cmp rdi, 5
je 0x140002cd3
xor al, byte [r12 + 5]
shr edx, 8
movzx eax, al
xor edx, dword [r11 + rax*4]
mov eax, edx
cmp rdi, 6
je 0x140002cd3
xor al, byte [r12 + 6]
shr edx, 8
movzx eax, al
xor edx, dword [r11 + rax*4]
mov eax, edx
not eax
mov rcx, qword [rsp + 0x68]
test eax, eax
mov edi, eax
mov eax, 1
cmove edi, eax
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rsi
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
mov rcx, rbp
call rsi
cmp dword [rsp + 0x60], edi
je 0x140002dd8
mov rcx, r14
call fcn.140001f10
mov rcx, r14
xor r9d, r9d
mov edx, 0x40000000
mov qword [rsp + 0x30], 0
mov r8d, 2
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 2
call r15
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x140003395
mov r13, qword [sym.imp.KERNEL32.dll_WriteFile]
lea r12, [0x1400140a0]
lea rdi, [rsp + 0x1e0]
test rbx, rbx
je 0x140002dc3
nop dword [rax]
mov esi, 0x8000
mov rbp, qword [0x1400210e0]
mov rcx, r12
cmp rbx, rsi
cmovbe rsi, rbx
mov rdx, rbp
mov r8, rsi
add rbp, rsi
call sub.msvcrt.dll_memcpy
mov r9, rdi
mov r8d, esi
mov rdx, r12
mov qword [0x1400210e0], rbp
mov rcx, r14
mov dword [rsp + 0x1e0], 0
mov qword [rsp + 0x20], 0
call r13
test eax, eax
je 0x140003377
sub rbx, rsi
jne 0x140002d68
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140002088
test rbx, rbx
je 0x140002088
lea r12, [0x1400140a0]
nop dword [rax + rax]
mov esi, 0x8000
mov rdi, qword [0x1400210e0]
mov rcx, r12
cmp rbx, rsi
cmovbe rsi, rbx
mov rdx, rdi
mov r8, rsi
add rdi, rsi
call sub.msvcrt.dll_memcpy
mov qword [0x1400210e0], rdi
sub rbx, rsi
jne 0x140002df0
jmp 0x140002088
movzx ecx, word [0x14001e8e0]
lea rax, [0x14001e8e0]
lea rdx, [0x14001e0e0]
lea r8, [rax + 0x2000]
test cx, cx
jne 0x140002e59
jmp 0x140002e6c
cmp rax, r8
je 0x14000b0fc
add rax, 2
mov word [rdx], cx
add rdx, 2
movzx ecx, word [rax]
test cx, cx
jne 0x140002e50
xor esi, esi
mov word [rdx], si
jmp 0x1400021f4
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor edi, edi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140002cfd
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor edi, edi
jmp 0x140002cfd
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea r13, [rsp + 0x160]
lea r8, [0x14000d0ba]
xor ebx, ebx
mov r9d, eax
mov edx, pe_nt_image_headers64
mov rcx, r13
call fcn.140001700
movzx eax, byte [rsp + 0x160]
mov word [rsp + 0x1e0], bx
test al, al
je 0x140002fe7
lea rbx, [rsp + 0x1e0]
mov r14d, pe_nt_image_headers64
lea r12, [rsp + 0xae]
mov edi, 1
mov rsi, rbx
lea rbp, [rsp + 0xb4]
nop
mov r8d, 2
mov rdx, r12
mov rcx, rbp
mov byte [rsp + 0xae], al
mov byte [rsp + 0xaf], 0
call sub.msvcrt.dll_mbstowcs
cmp rax, 1
jne 0x14000b0fc
cmp word [rsi], 0
movzx ecx, word [rsp + 0xb4]
mov rdx, r14
mov rax, rsi
je 0x140002f4e
nop
add rax, 2
sub rdx, 1
cmp word [rax], 0
jne 0x140002f40
test rdx, rdx
je 0x14000b0fc
xor r10d, r10d
mov word [rax], cx
add rsi, 2
lea rdx, [r14 - 1]
mov word [rax + 2], r10w
mov rax, rdi
sub rax, r14
movzx eax, byte [rbx + rax]
test al, al
je 0x140002fe7
mov r14, rdx
jmp 0x140002f00
lea rax, [0x14001e8e0]
movd dword [rax], xmm6
cmp word [0x14001e8e0], 0
jne 0x140002189
lea rax, [0x14001e8e0]
mov edx, 0x1000
jmp 0x1400021af
movabs rax, 0xcccccccccccccccd
mul rdi
shr rdx, 5
lea rax, [rdx + rdx*4]
shl rax, 3
sub rdi, rax
lea rax, [rdx - 1]
mov qword [rsp + 0x70], rax
mov eax, ecx
cmp qword [rsp + 0x70], 0
jne 0x140002320
xor r8d, r8d
xor edx, edx
xor r9d, r9d
jmp 0x140002662
xor r11d, r11d
lea rsi, str.NUITKA_ONEFILE_PARENT
lea r15, [rsp + 0xc0]
mov eax, 0x4e
mov word [rsp + 0xc0], r11w
mov rdi, r15
lea r14, [rsi + 0x28]
lea r12, [rsp + 0xb0]
lea rbp, [rsp + 0xb8]
nop
mov rbx, r14
mov r8d, 2
mov rdx, r12
mov rcx, rbp
sub rbx, rsi
mov byte [rsp + 0xb0], al
mov byte [rsp + 0xb1], 0
call sub.msvcrt.dll_mbstowcs
cmp rax, 1
jne 0x14000b0fc
cmp word [rdi], 0
movzx edx, word [rsp + 0xb8]
mov rax, rdi
je 0x140003076
nop dword [rax]
add rax, 2
sub rbx, 1
cmp word [rax], 0
jne 0x140003068
test rbx, rbx
je 0x14000b0fc
xor r9d, r9d
add rsi, 1
mov word [rax], dx
add rdi, 2
mov word [rax + 2], r9w
movzx eax, byte [rsi]
test al, al
jne 0x140003020
mov rax, qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rbx, [rsp + 0x1e0]
mov rcx, r15
mov rdx, rbx
mov qword [rsp + 0x58], rax
call rax
lea rdx, [0x14001c0c0]
xor ecx, ecx
mov r8d, 0x1001
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rax, [0x14001c0c0]
cmp word [0x14001c0c0], 0
lea rdx, [rax + 0x2002]
je 0x1400030ff
add rax, 2
cmp word [rax], 0
je 0x1400030ff
cmp rax, rdx
je 0x14000b0fc
add rax, 2
cmp word [rax], 0
jne 0x1400030ec
xor r8d, r8d
xor ecx, ecx
lea r14, str.NUITKA_ONEFILE_BINARY
mov qword [rsp + 0x60], rbx
mov word [rsp + 0x110], r8w
lea rsi, [rsp + 0x110]
lea r12, [r14 + 0x28]
mov r15, r14
lea rdi, [rsp + 0xbc]
mov word [rax], cx
mov rbx, rsi
mov eax, 0x4e
lea rbp, [rsp + 0xb2]
mov r14, rdi
nop word cs:[rax + rax]
mov rdi, r12
mov r8d, 2
mov rdx, rbp
mov rcx, r14
sub rdi, r15
mov byte [rsp + 0xb2], al
mov byte [rsp + 0xb3], 0
call sub.msvcrt.dll_mbstowcs
cmp rax, 1
jne 0x14000b0fc
cmp word [rbx], 0
movzx edx, word [rsp + 0xbc]
mov rax, rbx
je 0x1400031a6
nop dword [rax]
add rax, 2
sub rdi, 1
cmp word [rax], 0
jne 0x140003198
test rdi, rdi
je 0x14000b0fc
mov word [rax], dx
add r15, 1
xor edx, edx
add rbx, 2
mov word [rax + 2], dx
movzx eax, byte [r15]
test al, al
jne 0x140003150
mov rbx, qword [rsp + 0x60]
lea rdx, [0x14001c0c0]
mov rcx, rsi
mov rax, qword [rsp + 0x58]
call rax
xor eax, eax
mov ecx, 0xd
mov rdi, rbx
rep stosq qword [rdi], rax
mov rdi, qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff6
mov dword [rsp + 0x21c], 0x100
call rdi
mov ecx, 0xfffffff5
mov qword [rsp + 0x230], rax
call rdi
mov ecx, 0xfffffff4
mov qword [rsp + 0x238], rax
call rdi
mov dword [rsp + 0x1e0], 0x68
mov qword [rsp + 0x240], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], rbx
mov rdx, rax
lea rcx, [0x14001e0e0]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1400033c0
mov rcx, qword [rsp + 0x168]
mov rbx, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rbx
mov rcx, qword [rsp + 0x160]
mov dword [rsp + 0x110], 0
mov qword [0x14001c0a0], rcx
test rcx, rcx
je 0x1400032f3
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [0x14001c0a0]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x1400032df
mov dword [rsp + 0x110], 1
mov rcx, qword [0x14001c0a0]
call rbx
mov qword [0x14001c0a0], 0
call fcn.140001fe0
mov eax, dword [rsp + 0x110]
movaps xmm6, xmmword [rsp + 0x2e0]
add rsp, 0x2f8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor edi, edi
mov rcx, rsi
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
mov rcx, rbp
call rsi
jmp 0x140002cfd
movabs rax, 0xcccccccccccccccd
mov ecx, 0xffffffff
lea r11, [0x14000f2a0]
mul rdi
mov rax, rdx
shr rax, 5
lea rdx, [rax + rax*4]
sub rax, 1
shl rdx, 3
mov qword [rsp + 0x70], rax
mov eax, 0xffffffff
sub rdi, rdx
jmp 0x140002fce
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Error__couldnt_unpack_file_to_target_path.
mov edx, eax
call fcn.140001d60
mov ecx, 2
call sub.msvcrt.dll_exit
mov ecx, 2
call qword [fcn.14000a760]
lea r8, [0x14001e8e0]
lea rdx, str.Error__failed_to_open__ls_for_writing._n
mov rcx, rax
call fcn.1400016d0
mov ecx, 2
call sub.msvcrt.dll_exit
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Error__couldnt_launch_child
mov edx, eax
call fcn.140001d60
mov ecx, 2
call sub.msvcrt.dll_exit
nop
jmp 0x14000b0fc
jmp 0x14000b0fc
jmp 0x14000b0fc
push rbx
sub rsp, 0x20
lea rbx, str.TEMPonefile_PID_TIME
mov r8d, 0x1000
lea rcx, [0x140021100]
mov rdx, rbx
call fcn.140001720
test al, al
je 0x1400034a8
mov edx, 1
lea rcx, [0x140002040]
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
test eax, eax
je 0x1400034c6
mov r8d, 0xa
xor ecx, ecx
mov edx, 0x1b
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov rdx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
xor ecx, ecx
mov rdx, rbx
mov qword [0x1400210e0], rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rax, qword [0x1400210e0]
lea rcx, [rax + 3]
cmp byte [rax], 0x4b
movzx edx, byte [rax + 1]
mov qword [0x1400210e0], rcx
movzx r8d, byte [rax + 2]
jne 0x1400034b0
cmp dl, 0x41
jne 0x1400034b0
cmp r8b, 0x58
jne 0x1400034b0
add rsp, 0x20
pop rbx
jmp 0x140002060
mov rcx, rbx
call fcn.140001d30
lea rcx, str.Error__couldnt_find_attached_data_header.
call sub.msvcrt.dll_puts
mov ecx, 2
call sub.msvcrt.dll_exit
lea rcx, str.Error__failed_to_register_signal_handler.
call sub.msvcrt.dll_puts
mov ecx, 2
call sub.msvcrt.dll_exit
nop
nop
nop
nop
push rbp
mov rbp, rsp
sub rsp, 0x20
jmp 0x140003508
mov rax, qword [0x14000c010]
mov rax, qword [rax]
call rax
mov rax, qword [0x14000c010]
add rax, 8
mov qword [0x14000c010], rax
mov rax, qword [0x14000c010]
mov rax, qword [rax]
test rax, rax
jne 0x1400034ea
nop
nop
add rsp, 0x20
pop rbp
ret