Function at 0x140002980
Capabilities:
Accept command line arguments
Create directory
Create process on windows
Read file on windows
Set environment variable
Write and execute a file
Write file on windows

Disassembly:
push rbp
push r13
push r12
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
lea r13, str.libgcc_s_dw2_1.dll
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r12, rax
test rax, rax
je 0x1400017a0
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r13, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.__register_frame_info
mov rcx, r12
mov qword [0x140011040], rax
call r13
lea rdx, str.__deregister_frame_info
mov rcx, r12
mov rbx, rax
call r13
mov qword [0x14000b010], rax
test rbx, rbx
jne 0x1400017b5
lea rcx, [0x1400017d0]
add rsp, 0x28
pop rbx
pop r12
pop r13
pop rbp
jmp fcn.1400016c7
lea rax, [0x140001710]
lea rbx, [0x140001700]
mov qword [0x14000b010], rax
lea rdx, [0x140011060]
lea rcx, [section..eh_fram]
call rbx
jmp 0x140001787
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x138
mov rax, qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea r13, [0x1400110a0]
xor edx, edx
lea rcx, [0x14001e0c0]
mov qword [rsp + 0x60], rax
call rax
xor ecx, ecx
mov byte [0x1400200c0], 1
mov rdx, r13
mov rbx, qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov r8d, 0x1000
call rbx
test eax, eax
je 0x140002404
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileW]
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov r8d, 1
mov dword [rsp + 0x28], 0
mov edx, 0x80000000
mov rcx, r13
mov dword [rsp + 0x20], 3
mov qword [rsp + 0x58], rax
call rax
mov qword [0x14001e0a8], rax
cmp rax, 0xffffffffffffffff
je 0x140002347
xor ecx, ecx
mov r8d, 0x1000
mov rdx, r13
call rbx
test eax, eax
je 0x140002404
xor r8d, r8d
xor edx, edx
mov rcx, r13
mov rsi, qword [sym.imp.KERNEL32.dll_GetShortPathNameW]
call rsi
lea ecx, [rax + 1]
mov ebx, eax
add rcx, rcx
call sub.msvcrt.dll_malloc
mov r12, rax
test rax, rax
je 0x1400023e0
mov r8d, ebx
mov rdx, rax
mov rcx, r13
call rsi
test eax, eax
je 0x14000232c
lea r14, [rsp + 0xb0]
xor r8d, r8d
xor edx, edx
mov r9, r12
mov qword [rsp + 0x20], 0xffffffffffffffff
mov rbx, qword [sym.imp.msvcrt.dll_wcstombs_s]
mov rcx, r14
call rbx
test eax, eax
jne 0x14000232c
mov rsi, qword [rsp + 0xb0]
mov rcx, rsi
call sub.msvcrt.dll_malloc
mov r13, rax
test rax, rax
je 0x1400023e0
mov r9, r12
mov r8, rsi
mov rdx, rax
mov rcx, r14
mov qword [rsp + 0x20], 0xffffffffffffffff
call rbx
test eax, eax
jne 0x140002324
mov rcx, r12
call sub.msvcrt.dll_free
xor r9d, r9d
mov r8, r14
mov rcx, r13
mov dword [rsp + 0x20], 1
lea rdx, str.dont_search_path
call qword [sym.imp.imagehlp.dll_MapAndLoad]
test eax, eax
jne 0x140001fd6
mov rcx, r13
call sub.msvcrt.dll_free
mov rcx, qword [0x14001e0a8]
mov rbx, qword [sym.imp.KERNEL32.dll_SetFilePointer]
xor r8d, r8d
mov edx, 0xfffffff8
mov r9d, 2
call rbx
cmp eax, 0xffffffff
je 0x1400023ec
xor r8d, r8d
xor edx, edx
mov rcx, qword [0x14001e0a8]
mov r9d, 1
call rbx
mov rcx, qword [0x14001e0a8]
mov rsi, qword [sym.imp.KERNEL32.dll_ReadFile]
mov qword [rsp + 0x20], 0
mov eax, eax
lea r9, [rsp + 0x78]
mov r8d, 8
mov qword [0x14001e0a0], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x68], rax
mov rdx, rax
call rsi
test eax, eax
je 0x1400023a4
cmp dword [rsp + 0x78], 8
jne 0x1400023a4
mov rdx, qword [0x14001e0a0]
xor r9d, r9d
xor r8d, r8d
sub edx, dword [rsp + 0x90]
mov rcx, qword [0x14001e0a8]
call rbx
cmp eax, 0xffffffff
je 0x1400023ec
lea rdx, [rsp + 0x75]
lea r9, [rsp + 0x7c]
mov qword [rsp + 0x20], 0
mov rcx, qword [0x14001e0a8]
mov r8d, 3
call rsi
test eax, eax
je 0x1400023a4
cmp dword [rsp + 0x7c], 3
jne 0x1400023a4
cmp byte [rsp + 0x75], 0x4b
jne 0x1400023ec
cmp byte [rsp + 0x76], 0x41
jne 0x1400023ec
cmp byte [rsp + 0x77], 0x58
jne 0x1400023ec
lea r13, [rsp + 0x80]
lea rbp, [rsp + 0x72]
nop dword [rax]
lea rbx, [0x14001d8a0]
jmp 0x140001cec
add rbx, 2
mov qword [rsp + 0x20], 0
mov rcx, qword [0x14001e0a8]
mov r9, r13
mov rdx, rbp
mov r8d, 2
call rsi
test eax, eax
je 0x1400023a4
cmp dword [rsp + 0x80], 2
jne 0x1400023a4
movzx eax, word [rsp + 0x72]
mov word [rbx], ax
test ax, ax
jne 0x140001ce8
lea rax, [0x14001d8a0]
movzx eax, word [rax]
test ax, ax
je 0x1400021e6
lea rbx, [0x14001d8a0]
lea r12, [0x14001b8a0]
nop
lea rdi, [0x14001e0c0]
movzx edx, word [rdi]
cmp ax, 0x5c
je 0x140002038
movzx eax, word [rbx + 2]
add rbx, 2
test ax, ax
jne 0x140001d50
lea rax, [0x14001e0c0]
xor r8d, r8d
lea rdx, [0x14001b8a0]
movzx ecx, word [rax]
mov word [0x14001b8a0], r8w
lea r8, [rax + 0x2000]
test cx, cx
jne 0x140001da9
jmp 0x140001dbc
cmp rax, r8
je 0x14000a5f0
add rax, 2
mov word [rdx], cx
add rdx, 2
movzx ecx, word [rax]
test cx, cx
jne 0x140001da0
xor ecx, ecx
mov word [rdx], cx
cmp word [0x14001b8a0], 0
je 0x1400021c0
mov edx, 0x1000
lea rax, [0x14001b8a0]
nop dword [rax + rax]
add rax, 2
sub rdx, 1
cmp word [rax], 0
jne 0x140001de0
test rdx, rdx
je 0x140002416
mov dword [rax], 0x5c
lea rax, [0x14001d8a0]
mov edx, 0x1000
cmp word [0x14001b8a0], 0
movzx ecx, word [rax]
lea rax, [0x14001b8a0]
je 0x1400021b0
nop dword [rax]
add rax, 2
sub rdx, 1
cmp word [rax], 0
jne 0x140001e28
test cx, cx
je 0x140001e71
test rdx, rdx
je 0x14000241b
lea r8, [0x14001d8a0]
jmp 0x140001e59
test rdx, rdx
je 0x140002411
add r8, 2
mov word [rax], cx
add rax, 2
sub rdx, 1
movzx ecx, word [r8]
test cx, cx
jne 0x140001e50
xor edx, edx
cmp word [0x14001b0a0], 0
mov word [rax], dx
je 0x140002160
mov qword [rsp + 0x20], 0
mov rcx, qword [0x14001e0a8]
lea rdx, [rsp + 0xb0]
lea r9, [rsp + 0x88]
mov r8d, 8
call rsi
test eax, eax
je 0x1400023a4
cmp dword [rsp + 0x88], 8
jne 0x1400023a4
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x71]
mov rbx, qword [rsp + 0xb0]
lea r9, [rsp + 0x84]
mov rcx, qword [0x14001e0a8]
mov r8d, 1
call rsi
test eax, eax
je 0x1400023a4
cmp dword [rsp + 0x84], 1
jne 0x1400023a4
mov rcx, r12
mov rax, qword [rsp + 0x58]
xor r9d, r9d
mov edx, 0x40000000
mov qword [rsp + 0x30], 0
mov r8d, 2
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 2
call rax
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x1400023b5
lea r15, [rsp + 0x8c]
lea rdi, [0x1400130a0]
test rbx, rbx
je 0x140001fc8
nop word [rax + rax]
mov r14d, 0x8000
mov rcx, qword [0x14001e0a8]
mov r9, r15
mov rdx, rdi
mov qword [rsp + 0x20], 0
cmp rbx, r14
cmovbe r14, rbx
mov r8d, r14d
call rsi
test eax, eax
je 0x1400023a4
mov eax, dword [rsp + 0x8c]
cmp r14, rax
jne 0x1400023a4
xor r9d, r9d
mov r8d, r14d
mov rdx, rdi
mov rcx, r12
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400023a9
sub rbx, r14
jne 0x140001f60
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140001cd8
mov rax, qword [rsp + 0xc8]
test rax, rax
je 0x140002339
cmp dword [rax + 0x84], 4
jbe 0x140002339
mov ebx, dword [rax + 0xa8]
mov rcx, r14
call qword [sym.imp.imagehlp.dll_UnMapAndLoad]
mov rcx, r13
call sub.msvcrt.dll_free
test ebx, ebx
je 0x140001bbd
lea edx, [rbx - 8]
mov rcx, qword [0x14001e0a8]
xor r9d, r9d
xor r8d, r8d
mov rbx, qword [sym.imp.KERNEL32.dll_SetFilePointer]
call rbx
jmp 0x140001bdb
xor r14d, r14d
xor r15d, r15d
lea rax, [0x14001b8a0]
mov rcx, rdi
mov word [rbx], r14w
mov word [0x14001b8a0], r15w
test dx, dx
jne 0x140002070
jmp 0x140002083
lea rdi, [0x14001d8a0]
cmp rax, rdi
je 0x14000a5f0
add rcx, 2
mov word [rax], dx
add rax, 2
movzx edx, word [rcx]
test dx, dx
jne 0x140002060
xor r11d, r11d
mov word [rax], r11w
cmp word [r12], 0
je 0x1400021cc
mov edx, 0x1000
lea rax, [0x14001b8a0]
nop word [rax + rax]
add rax, 2
sub rdx, 1
cmp word [rax], 0
jne 0x1400020a8
test rdx, rdx
je 0x140002420
mov dword [rax], 0x5c
lea rax, [0x14001d8a0]
mov edx, 0x1000
cmp word [r12], 0
movzx ecx, word [rax]
lea rax, [0x14001b8a0]
je 0x1400021d8
nop word [rax + rax]
add rax, 2
sub rdx, 1
cmp word [rax], 0
jne 0x1400020f0
test cx, cx
je 0x140002139
test rdx, rdx
je 0x140002425
lea r8, [0x14001d8a0]
jmp 0x140002121
test rdx, rdx
je 0x14000242a
add r8, 2
mov word [rax], cx
add rax, 2
sub rdx, 1
movzx ecx, word [r8]
test cx, cx
jne 0x140002118
xor r9d, r9d
mov r10d, 0x5c
xor edx, edx
mov rcx, r12
mov word [rax], r9w
mov rax, qword [rsp + 0x60]
mov word [rbx], r10w
call rax
jmp 0x140001d64
movzx ecx, word [0x14001b8a0]
lea rdx, [0x14001b0a0]
lea rax, [0x14001b8a0]
test cx, cx
jne 0x140002190
jmp 0x1400021a3
lea rdi, [0x14001d8a0]
cmp rax, rdi
je 0x14000a5f0
add rax, 2
mov word [rdx], cx
add rdx, 2
movzx ecx, word [rax]
test cx, cx
jne 0x140002180
xor eax, eax
mov word [rdx], ax
jmp 0x140001e84
test cx, cx
jne 0x140001e44
jmp 0x140001e71
lea rax, [0x14001b8a0]
jmp 0x140001df7
lea rax, [0x14001b8a0]
jmp 0x1400020bf
test cx, cx
jne 0x14000210c
jmp 0x140002139
lea rbp, [rsp + 0xb0]
mov rcx, qword [0x14001e0a8]
mov rbx, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rbx
mov rdi, rbp
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea r8, [0x14000c1c0]
mov edx, pe_nt_image_headers64
mov rcx, rbp
mov r9d, eax
call fcn.140001840
mov rdx, rbp
lea rcx, str.NUITKA_ONEFILE_PARENT
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
xor eax, eax
mov ecx, 0xd
rep stosq qword [rdi], rax
mov dword [rsp + 0xb0], 0x68
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x40], rbp
mov rdx, rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x38], 0
lea rcx, [0x14001b0a0]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1400023f8
mov rcx, qword [rsp + 0x98]
call rbx
mov rcx, qword [rsp + 0x90]
mov dword [rsp + 0x8c], 0
mov qword [0x1400200c8], rcx
test rcx, rcx
je 0x140002304
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [0x1400200c8]
lea rdx, [rsp + 0x8c]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x1400022f0
mov dword [rsp + 0x8c], 1
mov rcx, qword [0x1400200c8]
call rbx
mov qword [0x1400200c8], 0
call fcn.1400018e0
mov eax, dword [rsp + 0x8c]
add rsp, 0x138
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, r13
call sub.msvcrt.dll_free
mov rcx, r12
call sub.msvcrt.dll_free
jmp 0x140001bbd
mov rcx, r14
call qword [sym.imp.imagehlp.dll_UnMapAndLoad]
jmp 0x140001bb5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, 0x400
xor edx, edx
mov ecx, 0x1300
mov r8d, eax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
lea rcx, str.Error__failed_to_access_unpacked_executable.
call sub.msvcrt.dll_puts
mov rcx, qword [rsp + 0xb0]
call sub.msvcrt.dll_puts
mov eax, 1
jmp 0x140002310
call fcn.1400018c0
lea rcx, str.Error__couldnt_runtime_expand_temporary_files.
call fcn.140001860
mov ecx, 2
call qword [fcn.140009cd0]
lea r8, [0x14001b8a0]
lea rdx, str.Error__failed_to_open__ls_for_writing._n
mov rcx, rax
call fcn.140001810
mov ecx, 2
call sub.msvcrt.dll_exit
lea rcx, str.Error__couldnt_allocate_memory.
call fcn.140001860
lea rcx, str.Error__couldnt_find_attached_data.
call fcn.140001860
lea rcx, str.Error__couldnt_launch_child.
call fcn.140001860
lea rcx, str.Error__failed_to_locate_onefile_filename.
call fcn.140001860
nop
jmp 0x14000a5f0
jmp 0x14000a5f0
jmp 0x14000a5f0
jmp 0x14000a5f0
jmp 0x14000a5f0
jmp 0x14000a5f0
sub rsp, 0x58
call fcn.140002430
test al, al
je 0x140002a10
mov edx, 1
lea rcx, [0x140001a10]
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
test eax, eax
je 0x1400029b0
add rsp, 0x58
jmp 0x140001a30
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, 0x400
xor edx, edx
mov qword [rsp + 0x30], 0
mov r8d, eax
lea rax, [rsp + 0x48]
mov dword [rsp + 0x28], 0
mov ecx, 0x1300
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
lea rcx, str.Error__failed_to_register_signal_handler.
call sub.msvcrt.dll_puts
mov rcx, qword [rsp + 0x48]
call sub.msvcrt.dll_puts
mov eax, 1
add rsp, 0x58
ret
mov ecx, 2
call qword [fcn.140009cd0]
lea r8, str._TEMP_onefile__PID___TIME_
lea rdx, str.Error__couldnt_runtime_expand_spec__ls._n
mov rcx, rax
call fcn.140001810
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp qword [sym.imp.imagehlp.dll_UnMapAndLoad]
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
jmp 0x140001720