Function at 0x401ce0
Capabilities:
Create process on windows
Extract resource via kernel32 functions
Set environment variable
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x244
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x240], eax
push ebx
push esi
push edi
push 0x1000
mov edx, str.TEMPonefile_PID_TIME
mov ecx, 0x431c90
call fcn.00401190
add esp, 4
test al, al
je 0x402210
push 1
push 0x4019e0
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
test eax, eax
je 0x40221a
push 0xa
push 0x1b
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push 0
mov dword [0x4414a0], eax
mov dword [0x437490], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, dword [0x437490]
mov ax, word [edi]
mov word [esp + 0x10], ax
mov al, byte [edi + 2]
add edi, 3
cmp byte [esp + 0x10], 0x4b
mov dword [0x437490], edi
jne 0x40220b
cmp byte [esp + 0x11], 0x41
jne 0x40220b
cmp al, 0x58
jne 0x40220b
mov byte [0x41f488], 1
movzx eax, word [edi]
mov ecx, 0x433c90
add edi, 2
mov word [0x433c90], ax
mov dword [0x437490], edi
test ax, ax
je 0x401fb9
mov edx, edi
movzx eax, word [edi]
lea ecx, [ecx + 2]
mov word [ecx], ax
lea edi, [edx + 2]
mov edx, edi
test ax, ax
jne 0x401dc3
mov dword [0x437490], edi
cmp word [0x433c90], ax
je 0x401fb9
xor eax, eax
mov edx, 0x1000
mov ecx, 0x42fc90
mov word [0x42fc90], ax
cmp word [0x431c90], ax
je 0x401e2b
mov esi, 0x431c90
sub esi, ecx
nop dword [eax + eax]
cmp edx, 1
jb 0x40222e
mov ax, word [esi + ecx]
dec edx
mov word [ecx], ax
add ecx, 2
cmp word [esi + ecx], 0
jne 0x401e10
xor eax, eax
mov word [ecx], ax
mov ecx, 0x1000
cmp word [0x42fc90], 0
mov eax, 0x42fc90
je 0x401e57
add eax, 2
dec ecx
cmp word [eax], 0
jne 0x401e44
cmp ecx, 1
jb 0x40222e
mov dword [eax], 0x5c
mov edx, 0x1000
cmp word [0x42fc90], 0
mov eax, 0x42fc90
je 0x401e7b
add eax, 2
dec edx
cmp word [eax], 0
jne 0x401e71
mov esi, 0x433c90
sub esi, eax
cmp edx, 1
jb 0x40222e
mov cx, word [esi + eax]
dec edx
mov word [eax], cx
add eax, 2
cmp word [esi + eax], 0
jne 0x401e82
xor ecx, ecx
mov word [eax], cx
cmp word [0x41f490], cx
jne 0x401ee6
cmp word [0x42fc90], 0
mov edx, 0x1000
mov ecx, 0x41f490
je 0x401ee1
mov esi, 0x42fc90
sub esi, ecx
cmp edx, 1
jb 0x40222e
mov ax, word [esi + ecx]
dec edx
mov word [ecx], ax
add ecx, 2
cmp word [esi + ecx], 0
jne 0x401ec6
xor eax, eax
mov word [ecx], ax
mov esi, dword [edi + 4]
mov ecx, 0x42fc90
mov ebx, dword [edi]
add edi, 8
mov dword [esp + 0x18], esi
mov dword [0x437490], edi
call fcn.004017d0
push 0
push 0
push 2
push 0
push 2
push 0x40000000
push 0x42fc90
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
je 0x402229
test esi, esi
jne 0x401f33
test ebx, ebx
je 0x401fa7
test esi, esi
ja 0x401f43
jb 0x401f3f
cmp ebx, 0x8000
ja 0x401f43
mov edi, ebx
jmp 0x401f48
mov edi, 0x8000
mov esi, dword [0x437490]
push edi
push esi
push 0x4394a0
call fcn.00403dc0
add esp, 0xc
mov dword [esp + 0x14], 0
lea eax, [esp + 0x14]
add esi, edi
mov dword [0x437490], esi
push 0
push eax
push edi
push 0x4394a0
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x402224
mov esi, dword [esp + 0x18]
mov eax, edi
cdq
sub ebx, eax
sbb esi, edx
mov dword [esp + 0x18], esi
jne 0x401f31
jb 0x401fa3
test ebx, ebx
jne 0x401f31
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [0x437490]
jmp 0x401da1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x41bacc
lea eax, [esp + 0xd0]
push 0x80
push eax
call fcn.00401040
xor eax, eax
lea edx, [esp + 0xd8]
push 0x80
lea ecx, [esp + 0x15c]
mov word [esp + 0x15c], ax
call fcn.004014e0
add esp, 0x14
lea esi, [esp + 0x78]
xor eax, eax
mov ebx, str.NUITKA_ONEFILE_PARENT
mov word [esp + 0x78], ax
lea edi, [eax + 0x28]
mov al, byte [str.NUITKA_ONEFILE_PARENT]
mov byte [esp + 0x10], al
lea eax, [esp + 0x10]
push 2
push eax
lea eax, [esp + 0x1c]
mov byte [esp + 0x19], 0
push eax
call fcn.0040591c
add esp, 0xc
cmp eax, 1
jne 0x40222e
cmp word [esi], 0
mov eax, edi
mov ecx, esi
je 0x40204e
add ecx, 2
dec eax
cmp word [ecx], 0
jne 0x402044
cmp eax, 1
jb 0x40222e
mov ax, word [esp + 0x14]
inc ebx
mov word [ecx], ax
add esi, 2
xor eax, eax
dec edi
mov word [ecx + 2], ax
mov al, byte [ebx]
test al, al
jne 0x402014
lea eax, [esp + 0x148]
push eax
lea eax, [esp + 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
call fcn.00401090
mov cl, byte [str.NUITKA_ONEFILE_BINARY]
lea esi, [esp + 0x78]
mov dword [esp + 0x18], eax
mov ebx, str.NUITKA_ONEFILE_BINARY
xor eax, eax
mov word [esp + 0x78], ax
lea edi, [eax + 0x28]
push 2
lea eax, [esp + 0x14]
mov byte [esp + 0x14], cl
push eax
lea eax, [esp + 0x1c]
mov byte [esp + 0x19], 0
push eax
call fcn.0040591c
add esp, 0xc
cmp eax, 1
jne 0x40222e
cmp word [esi], 0
mov eax, edi
mov ecx, esi
je 0x4020df
add ecx, 2
dec eax
cmp word [ecx], 0
jne 0x4020d5
cmp eax, 1
jb 0x40222e
mov ax, word [esp + 0x14]
inc ebx
mov word [ecx], ax
add esi, 2
xor eax, eax
dec edi
mov word [ecx + 2], ax
mov cl, byte [ebx]
test cl, cl
jne 0x4020a5
push dword [esp + 0x18]
lea eax, [esp + 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov esi, dword [sym.imp.KERNEL32.dll_GetStdHandle]
xorps xmm0, xmm0
push 0xfffffffffffffff6
movlpd qword [esp + 0x38], xmm0
movlpd qword [esp + 0x40], xmm0
movlpd qword [esp + 0x48], xmm0
movlpd qword [esp + 0x50], xmm0
movlpd qword [esp + 0x58], xmm0
movlpd qword [esp + 0x64], xmm0
mov dword [esp + 0x60], 0x100
call esi
push 0xfffffffffffffff5
mov dword [esp + 0x6c], eax
call esi
push 0xfffffffffffffff4
mov dword [esp + 0x70], eax
call esi
mov dword [esp + 0x70], eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x34]
mov dword [esp + 0x34], 0x44
push eax
push 0
push 0
push 0x20
push 1
push 0
push 0
call fcn.00401a20
push eax
push 0x41f490
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x402233
push dword [esp + 0x24]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
mov eax, dword [esp + 0x20]
mov dword [0x41f484], eax
mov dword [esp + 0x1c], 0
test eax, eax
je 0x4021ed
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [esp + 0x1c]
push eax
push dword [0x41f484]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x4021db
mov dword [esp + 0x1c], 1
push dword [0x41f484]
call ebx
mov dword [0x41f484], 0
call fcn.004018d0
mov ecx, dword [esp + 0x24c]
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00402241
mov esp, ebp
pop ebp
ret
call fcn.00401610
mov ecx, str.TEMPonefile_PID_TIME
call fcn.00401660
mov ecx, str.Error__failed_to_register_signal_handler.
call fcn.004015c0
call fcn.004015f0
call fcn.00401630
call fcn.004055d1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
call fcn.00401620
int3