Function at 0x1400113f0
Capabilities:
Accept command line arguments
Create process on windows
Encode data using xor
Extract resource via kernel32 functions
Get file size
Hash data with crc32
Read file via mapping
Set environment variable
Write and execute a file
Write file on windows

Disassembly:
push rbp
push r13
push r12
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
lea r13, str.libgcc_s_dw2_1.dll
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r12, rax
test rax, rax
je 0x1400017a0
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r13, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.__register_frame_info
mov rcx, r12
mov qword [0x140025040], rax
call r13
lea rdx, str.__deregister_frame_info
mov rcx, r12
mov rbx, rax
call r13
mov qword [0x14001e010], rax
test rbx, rbx
jne 0x1400017b5
lea rcx, [0x1400017d0]
add rsp, 0x28
pop rbx
pop r12
pop r13
pop rbp
jmp fcn.1400016c7
lea rax, [0x140001710]
lea rbx, [0x140001700]
mov qword [0x14001e010], rax
lea rdx, [0x140025060]
lea rcx, [section..eh_fram]
call rbx
jmp 0x140001787
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x128
movaps xmmword [rsp + 0x110], xmm6
movdqa xmm6, xmmword [0x140020280]
lea rax, [rsp + 0x90]
mov qword [rsp + 0x58], rax
mov r15, qword [0x140034118]
mov r14, qword [0x140034120]
mov rbp, qword [rsp + 0x58]
lea r12, [0x14002f8c0]
nop word [rax + rax]
xor ebx, ebx
mov rdi, rbp
mov esi, 2
nop word [rax + rax]
mov r8, r15
sub r8, r14
jne 0x1400108ff
mov rcx, qword [0x140034100]
mov rdx, qword [0x1400340f8]
cmp rcx, rdx
setb al
or bl, al
je 0x140010958
mov rcx, qword [0x1400340e0]
movups xmmword [0x140034118], xmm6
call fcn.14000f450
mov r15, qword [0x140034120]
cmp qword [0x140034118], r15
sete bl
cmp rax, 0xffffffffffffff88
ja 0x140010f34
xor r14d, r14d
mov r8, r15
mov qword [0x140034118], r15
mov qword [0x140034120], 0
sub r8, r14
je 0x140010898
cmp r8, rsi
mov rdx, qword [0x140034110]
mov rcx, rdi
cmova r8, rsi
add rdx, r14
mov r13, r8
call sub.msvcrt.dll_memcpy
add r14, r13
add rdi, r13
mov qword [0x140034120], r14
sub rsi, r13
jne 0x140010890
movzx eax, word [rsp + 0x90]
mov word [r12], ax
test ax, ax
je 0x1400109b7
mov r15, qword [0x140034118]
add r12, 2
jmp 0x140010880
cmp rcx, rdx
jne 0x140010f34
mov rdx, qword [0x1400340d8]
mov rax, rdx
sub rax, qword [0x1400340d0]
neg rax
je 0x140010890
mov ecx, 0x20003
mov qword [0x1400340f0], rdx
mov qword [0x140034100], 0
cmp rax, rcx
cmova rax, rcx
add qword [0x1400340c8], rax
lea rcx, [rdx + rax]
mov qword [0x1400340f8], rax
mov qword [0x1400340d8], rcx
jmp 0x140010890
lea rax, [0x14002f8c0]
movzx ecx, word [rax]
test cx, cx
je 0x140010f9a
movzx edx, word [0x1400300c0]
lea r14, [0x14002d8c0]
xor r9d, r9d
lea r8, [0x1400300c0]
mov word [0x14002d8c0], r9w
mov rax, r14
lea r9, [r14 + 0x2000]
test dx, dx
jne 0x140010a09
jmp 0x140010a1d
cmp rax, r9
je 0x14001d2d8
add r8, 2
mov word [rax], dx
add rax, 2
movzx edx, word [r8]
test dx, dx
jne 0x140010a00
xor r8d, r8d
mov word [rax], r8w
cmp word [0x14002d8c0], 0
je 0x140010f46
mov edx, 0x1000
lea rax, [0x14002d8c0]
nop
add rax, 2
sub rdx, 1
cmp word [rax], 0
jne 0x140010a40
test rdx, rdx
je 0x14001128f
mov dword [rax], 0x5c
cmp word [0x14002d8c0], 0
je 0x140010f61
mov edx, 0x1000
lea rax, [0x14002d8c0]
nop word [rax + rax]
add rax, 2
sub rdx, 1
cmp word [rax], 0
jne 0x140010a80
test rdx, rdx
je 0x140011299
lea r8, [0x14002f8c0]
jmp 0x140010aa9
test rdx, rdx
je 0x140011294
add r8, 2
mov word [rax], cx
add rax, 2
sub rdx, 1
movzx ecx, word [r8]
test cx, cx
jne 0x140010aa0
xor ecx, ecx
cmp word [0x14002d0c0], 0
mov word [rax], cx
je 0x140010ed0
mov rdi, qword [rsp + 0x58]
mov edx, 8
mov rcx, rdi
call fcn.1400106d0
mov edx, 4
mov rcx, rdi
mov r12, qword [rsp + 0x90]
call fcn.1400106d0
mov dword [rsp + 0x28], pe_nt_image_headers64
xor r9d, r9d
mov esi, dword [rsp + 0x90]
mov dword [rsp + 0x20], 3
mov rbx, qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r8d, 7
mov rcx, r14
mov qword [rsp + 0x30], 0
mov edx, 0x80000000
call rbx
mov r13, rax
cmp rax, 0xffffffffffffffff
je 0x140010f39
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, eax
cmp eax, 0xffffffff
je 0x140010f1e
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor edx, edx
mov rcx, r13
mov qword [rsp + 0x28], 0
mov r8d, 2
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov r15, rax
test rax, rax
je 0x140010f1e
mov rcx, rax
xor r9d, r9d
xor r8d, r8d
mov edx, 4
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rcx, rax
test rax, rax
je 0x140010f7c
test ebp, ebp
je 0x140010f72
mov r8d, ebp
mov rdx, rax
add r8, rax
mov eax, 0xffffffff
nop dword [rax + rax]
movzx r9d, byte [rdx]
xor r9d, eax
mov eax, r9d
and r9d, 1
neg r9d
shr eax, 1
and r9d, 0xedb88320
xor eax, r9d
mov r9d, eax
and eax, 1
neg eax
shr r9d, 1
and eax, 0xedb88320
xor eax, r9d
mov r9d, eax
and eax, 1
neg eax
shr r9d, 1
and eax, 0xedb88320
xor eax, r9d
mov r9d, eax
and eax, 1
neg eax
shr r9d, 1
and eax, 0xedb88320
xor r9d, eax
mov eax, r9d
and r9d, 1
neg r9d
shr eax, 1
and r9d, 0xedb88320
xor eax, r9d
mov r9d, eax
and eax, 1
neg eax
shr r9d, 1
and eax, 0xedb88320
xor r9d, eax
mov eax, r9d
shr eax, 1
and r9d, 1
add rdx, 1
neg r9d
and r9d, 0xedb88320
xor eax, r9d
mov r9d, eax
and eax, 1
neg eax
shr r9d, 1
and eax, 0xedb88320
xor eax, r9d
cmp r8, rdx
jne 0x140010bd0
not eax
mov ebp, eax
test eax, eax
mov eax, 1
cmove ebp, eax
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, r15
mov r15, qword [sym.imp.KERNEL32.dll_CloseHandle]
call r15
mov rcx, r13
call r15
cmp esi, ebp
je 0x140010e9e
mov rcx, r14
call fcn.140011f30
xor r9d, r9d
mov edx, 0x40000000
mov rcx, r14
mov qword [rsp + 0x30], 0
mov r8d, 2
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 2
call rbx
mov qword [rsp + 0x50], rax
cmp rax, 0xffffffffffffffff
je 0x140011246
test r12, r12
je 0x14001118d
mov rdx, qword [0x140034118]
mov rax, qword [0x140034120]
mov r15, rdx
mov r14, rax
nop dword [rax]
mov ebp, 0x8000
lea rdi, [0x1400250c0]
cmp r12, rbp
cmovbe rbp, r12
xor ebx, ebx
mov rsi, rbp
mov r8, r15
sub r8, r14
jne 0x140010d9f
mov rcx, qword [0x140034100]
mov rdx, qword [0x1400340f8]
cmp rcx, rdx
setb al
or bl, al
je 0x140010e30
mov rcx, qword [0x1400340e0]
movups xmmword [0x140034118], xmm6
call fcn.14000f450
mov r15, qword [0x140034120]
cmp qword [0x140034118], r15
sete bl
cmp rax, 0xffffffffffffff88
ja 0x140010f34
xor r14d, r14d
mov r8, r15
mov qword [0x140034118], r15
mov qword [0x140034120], 0
sub r8, r14
je 0x140010d38
cmp r8, rsi
mov rdx, qword [0x140034110]
mov rcx, rdi
cmova r8, rsi
add rdx, r14
mov r13, r8
call sub.msvcrt.dll_memcpy
add r14, r13
add rdi, r13
mov qword [0x140034120], r14
sub rsi, r13
jne 0x140010d30
mov rax, qword [rsp + 0x50]
cmp rax, 0xffffffffffffffff
je 0x140010e90
mov qword [rsp + 0x20], 0
mov r9, qword [rsp + 0x58]
mov r8d, ebp
mov rcx, rax
mov dword [rsp + 0x90], 0
lea rdx, [0x1400250c0]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14001119d
sub r12, rbp
je 0x14001118d
mov r15, qword [0x140034118]
mov r14, qword [0x140034120]
jmp 0x140010d18
cmp rcx, rdx
jne 0x140010f34
mov rdx, qword [0x1400340d8]
mov rax, rdx
sub rax, qword [0x1400340d0]
neg rax
je 0x140010d30
mov ecx, 0x20003
mov qword [0x1400340f0], rdx
mov qword [0x140034100], 0
cmp rax, rcx
cmova rax, rcx
add qword [0x1400340c8], rax
lea rcx, [rdx + rax]
mov qword [0x1400340f8], rax
mov qword [0x1400340d8], rcx
jmp 0x140010d30
sub r12, rbp
jne 0x140010d18
jmp 0x14001086e
mov rdx, qword [0x140034118]
mov rax, qword [0x140034120]
mov qword [rsp + 0x50], 0xffffffffffffffff
mov r15, rdx
mov r14, rax
test r12, r12
jne 0x140010d0e
jmp 0x14001086e
movzx edx, word [0x14002d8c0]
lea rax, [0x14002d0c0]
lea rcx, [0x14002d8c0]
lea r8, [rax + 0x2000]
test dx, dx
jne 0x140010f01
jmp 0x140010f14
cmp rax, r8
je 0x14001d2d8
add rcx, 2
mov word [rax], dx
add rax, 2
movzx edx, word [rcx]
test dx, dx
jne 0x140010ef8
xor edx, edx
mov word [rax], dx
jmp 0x140010ad4
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor ebp, ebp
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140010cac
call fcn.140009600
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor ebp, ebp
jmp 0x140010cac
lea rax, [0x14002d8c0]
mov dword [rax], 0x5c
cmp word [0x14002d8c0], 0
jne 0x140010a6b
lea rax, [0x14002d8c0]
mov edx, 0x1000
jmp 0x140010a97
mov ebp, 1
jmp 0x140010c93
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rbp, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r15
call rbp
mov rcx, r13
call rbp
xor ebp, ebp
jmp 0x140010cac
mov r12, qword [0x1400340e0]
test r12, r12
je 0x140011052
cmp qword [r12 + 0x73c8], 0
jne 0x140011052
mov r14, qword [r12 + 0x73d8]
mov rbx, qword [r12 + 0x73a8]
mov r15, qword [r12 + 0x73b0]
test r14, r14
je 0x140011006
mov rdx, qword [r14]
mov rsi, qword [r14 + 0x6ac8]
mov rdi, qword [r14 + 0x6ad0]
test rdx, rdx
je 0x140011230
test rsi, rsi
je 0x140011285
mov rcx, rdi
call rsi
mov rdx, r14
mov rcx, rdi
call rsi
mov rdx, qword [r12 + 0x73f8]
pxor xmm0, xmm0
mov dword [r12 + 0x73f0], 0
movups xmmword [r12 + 0x73d8], xmm0
test rdx, rdx
je 0x1400111a9
test rbx, rbx
je 0x140011278
mov rcx, r15
call rbx
mov qword [r12 + 0x73f8], 0
mov rdx, r12
mov rcx, r15
call rbx
mov rcx, qword [0x140034110]
call sub.msvcrt.dll_free
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rdi, qword [rsp + 0x58]
mov edx, pe_nt_image_headers64
lea r8, [0x14001f33e]
mov r9d, eax
mov rcx, rdi
call fcn.140001a50
mov rdx, rdi
lea rcx, str.NUITKA_ONEFILE_PARENT
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
xor eax, eax
mov ecx, 0xd
mov qword [rsp + 0x58], rdi
rep stosq qword [rdi], rax
mov dword [rsp + 0x90], 0x68
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rdi, qword [rsp + 0x58]
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], 0
lea rcx, [0x14002d0c0]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1400111bf
mov rcx, qword [rsp + 0x78]
mov rbx, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rbx
mov rcx, qword [rsp + 0x70]
mov dword [rsp + 0x68], 0
mov qword [0x1400250a0], rcx
test rcx, rcx
je 0x140011168
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [0x1400250a0]
lea rdx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x140011154
mov dword [rsp + 0x68], 1
mov rcx, qword [0x1400250a0]
call rbx
mov qword [0x1400250a0], 0
call fcn.140009650
mov eax, dword [rsp + 0x68]
movaps xmm6, xmmword [rsp + 0x110]
add rsp, 0x128
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140010860
lea rcx, str.Error__couldnt_runtime_expand_target_path.
call fcn.1400095e0
test rbx, rbx
jne 0x14001104a
mov rcx, r12
call sub.msvcrt.dll_free
jmp 0x140011052
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, 0x409
xor edx, edx
mov ecx, 0x1300
mov ebx, eax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], 0
mov r8d, ebx
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov rsi, qword [rsp + 0x68]
mov ecx, 2
call qword [fcn.14001c940]
mov r9d, ebx
lea r8, str.Error__couldnt_launch_child
lea rdx, str._s___Error__d___s__n
mov qword [rsp + 0x20], rsi
mov rcx, rax
call fcn.140001a20
mov ecx, 2
call sub.msvcrt.dll_exit
test rsi, rsi
jne 0x140010ffe
mov rcx, r14
call sub.msvcrt.dll_free
jmp 0x140011006
mov ecx, 2
call qword [fcn.14001c940]
lea r8, [0x14002d8c0]
lea rdx, str.Error__failed_to_open__ls_for_writing._n
mov rcx, rax
call fcn.140001a20
mov ecx, 2
call sub.msvcrt.dll_exit
nop dword [rax]
mov rcx, rdx
call sub.msvcrt.dll_free
jmp 0x1400111b2
mov rcx, rdx
call sub.msvcrt.dll_free
jmp 0x140011239
jmp 0x14001d2d8
jmp 0x14001d2d8
jmp 0x14001d2d8
push r12
push rbx
sub rsp, 0x28
lea r12, str.bindata
mov r8d, 0x1000
lea rcx, [0x1400300c0]
mov rdx, r12
call fcn.140008ed0
test al, al
je 0x1400115e0
mov edx, 1
lea rcx, [0x1400096b0]
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
test eax, eax
je 0x1400115f4
mov r8d, 0xa
xor ecx, ecx
mov edx, 0x1b
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
lea rcx, [rax + 3]
cmp byte [rax + 1], 0x41
mov qword [0x1400340d0], rax
movzx edx, byte [rax]
movzx r8d, byte [rax + 2]
mov qword [0x1400340d8], rcx
jne 0x1400115e8
cmp dl, 0x4b
jne 0x1400115e8
cmp r8b, 0x59
jne 0x1400115e8
mov qword [0x1400340f0], 0
mov ecx, 0x20000
call sub.msvcrt.dll_malloc
mov qword [0x140034110], rax
test rax, rax
je 0x1400115d3
mov ecx, 0x274b8
call sub.msvcrt.dll_malloc
mov r8, rax
test rax, rax
je 0x1400115c8
mov qword [rax + 0x73b0], 0
pxor xmm0, xmm0
mov qword [rax + 0x73c8], 0
mov qword [rax + 0x72d8], 0
mov qword [rax + 0x73ec], 0
mov qword [rax + 0x73f8], 0
mov qword [rax + 0x7400], 0
mov qword [rax + 0x7420], 0
mov dword [rax + 0x73f4], 0
mov qword [rax + 0x7440], 0
mov dword [rax + 0x7448], 0
mov dword [rax + 0x7454], 0
mov qword [rax + 0x274b0], 0
movups xmmword [rax + 0x73a0], xmm0
movups xmmword [rax + 0x73d8], xmm0
xor eax, eax
cpuid
xor ecx, ecx
cmp eax, 6
jbe 0x14001157b
mov eax, 7
cpuid
shr ebx, 8
mov ecx, ebx
and ecx, 1
mov dword [r8 + 0x73d0], ecx
mov qword [r8 + 0x7410], 0x8000001
mov dword [r8 + 0x7458], 0
mov qword [r8 + 0x7388], 0
mov dword [r8 + 0x7390], 1
mov qword [0x1400340e0], r8
add rsp, 0x28
pop rbx
pop r12
jmp 0x140010830
mov qword [0x1400340e0], 0
lea rcx, str.Error__couldnt_allocate_memory.
call fcn.1400095e0
nop
mov rcx, r12
call fcn.140009620
lea rcx, str.Error__could_find_attached_data_header.
call fcn.1400095e0
lea rcx, str.Error__failed_to_register_signal_handler.
call fcn.1400095e0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
call sub.msvcrt.dll_abort
nop
nop
nop
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp 0x140001720