Function at 0x140001ba0
Capabilities:
Accept command line arguments
Create process on windows
Extract resource via kernel32 functions
Set environment variable
Write and execute a file
Write file on windows

Disassembly:
sub rsp, 0x198
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov r8d, 0x1000
lea rdx, str._TEMP_onefile__PID___TIME_
lea rcx, [0x1400285e0]
call fcn.140001190
test al, al
je 0x1400020a1
mov edx, 1
lea rcx, [0x140001b70]
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
test eax, eax
je 0x1400020ae
mov edx, 0x1b
mov qword [rsp + 0x1a0], rbx
xor ecx, ecx
lea r8d, [rdx - 0x11]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdx, rax
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdx, rbx
xor ecx, ecx
mov qword [0x140034df0], rax
mov qword [0x14002cde0], rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r9, qword [0x14002cde0]
movzx eax, word [r9]
movzx ecx, byte [r9 + 2]
add r9, 3
mov word [rsp + 0x50], ax
mov qword [0x14002cde0], r9
cmp al, 0x4b
jne 0x14000209b
cmp byte [rsp + 0x51], 0x41
jne 0x14000209b
cmp cl, 0x58
jne 0x14000209b
mov qword [rsp + 0x1a8], rbp
mov qword [rsp + 0x1b0], rsi
mov qword [rsp + 0x190], rdi
mov qword [rsp + 0x188], r12
lea r12, [0x1400265e0]
mov qword [rsp + 0x180], r13
lea r13, [0x14002a5e0]
mov qword [rsp + 0x178], r14
mov qword [rsp + 0x170], r15
xor r15d, r15d
mov byte [0x14002cde8], 1
nop dword [rax]
movzx eax, word [r9]
mov rcx, r13
add r9, 2
mov word [0x14002a5e0], ax
mov qword [0x14002cde0], r9
test ax, ax
je 0x140001f15
mov rdx, r9
nop word [rax + rax]
movzx eax, word [r9]
lea rcx, [rcx + 2]
mov word [rcx], ax
lea r9, [rdx + 2]
mov rdx, r9
test ax, ax
jne 0x140001d00
cmp word [0x14002a5e0], r15w
mov qword [0x14002cde0], r9
je 0x140001f15
cmp word [0x1400285e0], r15w
mov edx, 0x1000
mov word [0x1400265e0], r15w
mov rcx, r12
je 0x140001d70
lea r8, [0x1400285e0]
sub r8, r12
cmp rdx, 1
jb 0x1400020c7
movzx eax, word [r8 + rcx]
dec rdx
mov word [rcx], ax
add rcx, 2
cmp word [r8 + rcx], r15w
jne 0x140001d50
mov word [rcx], r15w
mov rax, r12
cmp word [0x1400265e0], r15w
mov ecx, 0x1000
je 0x140001da7
nop word [rax + rax]
add rax, 2
dec rcx
cmp word [rax], r15w
jne 0x140001d90
cmp rcx, 1
jb 0x1400020c7
mov dword [rax], 0x5c
mov edx, 0x1000
cmp word [0x1400265e0], r15w
mov rax, r12
je 0x140001dcd
nop
add rax, 2
dec rdx
cmp word [rax], r15w
jne 0x140001dc0
mov r8, r13
sub r8, rax
cmp rdx, 1
jb 0x1400020c7
movzx ecx, word [r8 + rax]
dec rdx
mov word [rax], cx
add rax, 2
cmp word [r8 + rax], r15w
jne 0x140001dd3
cmp word [0x140025de0], r15w
mov word [rax], r15w
jne 0x140001e45
cmp word [0x1400265e0], r15w
lea rdx, [0x140025de0]
mov r8d, 0x1000
mov rcx, r12
je 0x140001e41
nop dword [rax + rax]
cmp r8, 1
jb 0x1400020c7
movzx eax, word [rcx]
dec r8
add rcx, 2
mov word [rdx], ax
add rdx, 2
cmp word [rcx], r15w
jne 0x140001e20
mov word [rdx], r15w
mov rsi, qword [r9]
mov rcx, r12
add r9, 8
mov qword [0x14002cde0], r9
call fcn.140001920
xor r9d, r9d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov edx, 0x40000000
mov rcx, r12
mov dword [rsp + 0x20], 2
lea r8d, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x1400020c1
test rsi, rsi
je 0x140001f00
nop dword [rax]
nop dword [rax + rax]
mov rbx, qword [0x14002cde0]
lea rcx, [0x14002cdf0]
mov edi, 0x8000
mov rdx, rbx
cmp rsi, rdi
cmovbe edi, esi
movsxd rbp, edi
mov r8, rbp
call fcn.140016ff0
add rbx, rbp
mov dword [rsp + 0x50], r15d
lea r9, [rsp + 0x50]
mov qword [0x14002cde0], rbx
mov r8d, edi
mov qword [rsp + 0x20], r15
lea rdx, [0x14002cdf0]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400020bb
sub rsi, rbp
jne 0x140001ea0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r9, qword [0x14002cde0]
jmp 0x140001cd0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea r8, [0x1400208f4]
mov edx, 0x80
mov r9d, eax
lea rcx, [rsp + 0xe0]
call fcn.140001060
lea rdx, [rsp + 0xe0]
lea rcx, str.NUITKA_ONEFILE_PARENT
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
xorps xmm0, xmm0
mov dword [rsp + 0x70], 0x68
xor eax, eax
movups xmmword [rsp + 0x74], xmm0
mov dword [rsp + 0xd4], eax
movups xmmword [rsp + 0x84], xmm0
movups xmmword [rsp + 0x94], xmm0
movups xmmword [rsp + 0xa4], xmm0
movups xmmword [rsp + 0xb4], xmm0
movups xmmword [rsp + 0xc4], xmm0
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
xor r9d, r9d
lea rcx, [0x140025de0]
mov rdx, rax
xor r8d, r8d
lea rax, [rsp + 0x58]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1400020cd
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
mov qword [0x140025dd8], rcx
mov dword [rsp + 0x54], r15d
test rcx, rcx
je 0x14000203a
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [0x140025dd8]
lea rdx, [rsp + 0x54]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x140002026
mov dword [rsp + 0x54], 1
mov rcx, qword [0x140025dd8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140025dd8], r15
call fcn.140001a30
mov eax, dword [rsp + 0x54]
mov r14, qword [rsp + 0x178]
mov r13, qword [rsp + 0x180]
mov r12, qword [rsp + 0x188]
mov rdi, qword [rsp + 0x190]
mov rsi, qword [rsp + 0x1b0]
mov rbp, qword [rsp + 0x1a8]
mov r15, qword [rsp + 0x170]
mov rbx, qword [rsp + 0x1a0]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400020f0
add rsp, 0x198
ret
call fcn.140001710
int3
lea rcx, str._TEMP_onefile__PID___TIME_
call fcn.140001780
int3
lea rcx, str.Error__failed_to_register_signal_handler.
call fcn.1400016b0
int3
call fcn.1400016f0
int3
call fcn.140001750
int3
call fcn.140006724
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
call fcn.140001730
int3