Function at 0x140012c30
Capabilities:
Accept command line arguments
Create process on windows
Extract resource via kernel32 functions
Write and execute a file
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xe8
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0xe0], rax
lea rbp, [0x140040b20]
lea rdx, str.CACHE_DIRhellogreen_PID_TIME
mov r8d, 0x1000
mov rcx, rbp
call fcn.1400123e0
test al, al
je 0x140013750
lea rcx, [0x140012ac0]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
test eax, eax
je 0x14001378f
mov edx, 0x1b
mov r8d, 0xa
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rsi, rax
xor ecx, ecx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [0x140045368], rax
mov qword [0x140042b20], rax
xor ecx, ecx
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov eax, eax
mov qword [0x140042b40], rax
mov rdx, qword [0x140042b20]
movzx r8d, byte [rdx]
movzx ecx, byte [rdx + 1]
movzx eax, byte [rdx + 2]
add rdx, 3
mov qword [0x140042b20], rdx
cmp r8b, 0x4b
jne 0x140013786
cmp cl, 0x41
jne 0x140013786
cmp al, 0x59
jne 0x140013786
mov qword [0x140042b28], 0
mov ecx, 0x20000
call fcn.140019ca0
mov qword [0x140045370], rax
test rax, rax
je 0x1400137a3
mov ecx, 0x274b8
call fcn.140019ca0
test rax, rax
je 0x140013798
mov r8, rax
mov qword [rax + 0x73c8], 0
mov qword [rax + 0x72d8], 0
mov qword [rax + 0x7420], 0
mov qword [rax + 0x7440], 0
mov dword [rax + 0x7448], 0
mov dword [rax + 0x7454], 0
mov qword [rax + 0x274b0], 0
xorps xmm0, xmm0
movups xmmword [rax + 0x73d8], xmm0
movups xmmword [rax + 0x73ec], xmm0
movups xmmword [rax + 0x73f8], xmm0
movups xmmword [rax + 0x73a0], xmm0
mov qword [rax + 0x73b0], 0
xor r9d, r9d
xor eax, eax
xor ecx, ecx
xchg rbx, r10
cpuid
xchg rbx, r10
test eax, eax
jle 0x140012df7
cmp eax, 7
jb 0x140012df7
mov eax, 7
xor ecx, ecx
xchg rbx, r9
cpuid
xchg rbx, r9
shr r9d, 8
and r9d, 1
mov dword [r8 + 0x73d0], r9d
mov dword [r8 + 0x7388], 0
mov qword [r8 + 0x7410], 0x8000001
mov dword [r8 + 0x7458], 0
movabs rax, 0x100000000
mov qword [r8 + 0x738c], rax
mov qword [0x140045388], r8
mov rax, qword [0x140042b20]
mov qword [0x140042b28], rax
mov qword [0x140042b38], 0
mov rax, qword [0x140042b40]
mov qword [0x140042b30], rax
mov byte [0x140043350], 1
lea r13, [0x140045390]
lea r15, [rsp + 0x70]
lea rbx, [0x140043360]
lea r14, [0x140047b90]
mov rsi, r13
jmp 0x140012e9f
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, r13
mov r15, rdi
mov edx, 2
mov rcx, r15
call fcn.140014150
movzx eax, word [rsp + 0x70]
mov word [rsi], ax
add rsi, 2
test ax, ax
jne 0x140012e9f
movzx eax, word [0x140045390]
test ax, ax
je 0x140013151
mov word [0x140043360], 0
movzx edx, word [0x140040b20]
mov rcx, rbx
test dx, dx
je 0x140012f60
xor ecx, ecx
nop word [rax + rax]
cmp rcx, 0x2000
je 0x14001372d
mov word [rcx + rbx], dx
movzx edx, word [rcx + rbp + 2]
test dx, dx
je 0x140012f41
mov word [rcx + rbx + 2], dx
movzx edx, word [rcx + rbp + 4]
test dx, dx
je 0x140012f4a
mov word [rcx + rbx + 4], dx
movzx edx, word [rcx + rbp + 6]
test dx, dx
je 0x140012f53
mov word [rcx + rbx + 6], dx
movzx edx, word [rcx + rbp + 8]
add rcx, 8
test dx, dx
jne 0x140012ef0
add rcx, rbx
jmp 0x140012f60
add rcx, rbx
add rcx, 2
jmp 0x140012f60
add rcx, rbx
add rcx, 4
jmp 0x140012f60
add rcx, rbx
add rcx, 6
nop word [rax + rax]
mov word [rcx], 0
cmp word [0x140043360], 0
mov rcx, rbx
je 0x140012f97
mov rdx, 0xfffffffffffff000
mov rcx, rbx
nop dword [rax]
inc rdx
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x140012f80
test rdx, rdx
je 0x14001372d
mov dword [rcx], 0x5c
cmp word [0x140043360], 0
je 0x140012fc4
mov ecx, 0x1000
mov r8, rbx
nop
lea rdx, [r8 + 2]
dec rcx
cmp word [r8 + 2], 0
mov r8, rdx
jne 0x140012fb0
jmp 0x140012fcc
mov ecx, 0x1000
mov rdx, rbx
xor r8d, r8d
nop
cmp rcx, r8
je 0x14001372d
mov word [rdx + r8*2], ax
movzx eax, word [r13 + r8*2 + 2]
inc r8
test ax, ax
jne 0x140012fd0
mov word [rdx + r8*2], 0
cmp word [0x140042b50], 0
jne 0x14001308e
movzx ecx, word [0x140043360]
lea rdx, [0x140042b50]
mov rax, rdx
test cx, cx
je 0x140013089
xor eax, eax
nop dword [rax]
cmp rax, 0x2000
je 0x14001372d
mov word [rax + rdx], cx
movzx ecx, word [rax + rbx + 2]
test cx, cx
je 0x140013070
mov word [rax + rdx + 2], cx
movzx ecx, word [rax + rbx + 4]
test cx, cx
je 0x140013079
mov word [rax + rdx + 4], cx
movzx ecx, word [rax + rbx + 6]
test cx, cx
je 0x140013082
mov word [rax + rdx + 6], cx
movzx ecx, word [rax + rbx + 8]
add rax, 8
test cx, cx
jne 0x140013020
add rax, rdx
jmp 0x140013089
add rax, rdx
add rax, 2
jmp 0x140013089
add rax, rdx
add rax, 4
jmp 0x140013089
add rax, rdx
add rax, 6
mov word [rax], 0
mov edx, 8
mov rdi, r15
mov rcx, r15
call fcn.140014150
mov rsi, qword [rsp + 0x70]
mov rcx, rbx
call fcn.140013800
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 2
mov rcx, rbx
mov edx, 0x40000000
mov r8d, 2
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x14001375c
mov r15, rax
test rsi, rsi
je 0x140012e90
nop word cs:[rax + rax]
cmp rsi, 0x8000
mov r12d, 0x8000
cmovb r12, rsi
mov rcx, r14
mov rdx, r12
call fcn.140014150
mov dword [rsp + 0x70], 0
mov qword [rsp + 0x20], 0
mov rcx, r15
mov rdx, r14
mov r8d, r12d
mov r9, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140013732
sub rsi, r12
jne 0x140013100
jmp 0x140012e90
mov r13, r15
mov rcx, qword [0x140045388]
call fcn.14000a580
mov rcx, qword [0x140045370]
call fcn.140019c90
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rcx, str.NUITKA_ONEFILE_PARENT
mov edx, eax
call fcn.140012230
cmp word [0x14003eb00], 0
jne 0x140013205
lea rdi, [0x14003eb00]
xor ecx, ecx
mov rdx, rdi
mov r8d, 0x1001
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
movzx ecx, word [0x14003eb00]
test cx, cx
je 0x140013200
lea rdi, [0x14003eb04]
mov rax, 0xfffffffffffff001
nop dword [rax]
mov word [rdi - 4], cx
movzx ecx, word [rdi - 2]
test cx, cx
je 0x1400131fc
mov word [rdi - 2], cx
movzx ecx, word [rdi]
test cx, cx
je 0x140013200
test rax, rax
je 0x14001372d
mov word [rdi], cx
movzx ecx, word [rdi + 2]
add rdi, 6
add rax, 3
test cx, cx
jne 0x1400131c0
add rdi, 0xfffffffffffffffc
jmp 0x140013200
add rdi, 0xfffffffffffffffe
mov word [rdi], 0
lea rcx, str.NUITKA_ONEFILE_BINARY
lea rdx, [0x14003eb00]
call fcn.140012130
xorps xmm0, xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0xb0], xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
mov dword [rsp + 0xac], 0x100
mov rsi, qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff6
call rsi
mov qword [rsp + 0xc0], rax
mov ecx, 0xfffffff5
call rsi
mov qword [rsp + 0xc8], rax
mov ecx, 0xfffffff4
call rsi
mov qword [rsp + 0xd0], rax
mov dword [rsp + 0x70], 0x68
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rdi, [rsp + 0x58]
mov rcx, rax
mov rdx, rdi
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov rbx, rax
mov word [0x14004fb90], 0
lea r14, [0x14003aaf0]
xor ecx, ecx
mov rdx, r14
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x14001372d
mov qword [rbx], r14
cmp dword [rsp + 0x58], 0
jle 0x140013655
xor r15d, r15d
lea r12, [0x14004fb90]
nop word cs:[rax + rax]
test r15, r15
je 0x14001332d
cmp word [0x14004fb90], 0
mov rax, r12
je 0x140013327
mov rcx, 0xffffffffffff8000
mov rax, r12
nop dword [rax]
inc rcx
cmp word [rax + 2], 0
lea rax, [rax + 2]
jne 0x140013310
test rcx, rcx
je 0x14001372d
mov dword [rax], 0x20
mov r14, qword [rbx + r15*8]
mov rcx, r14
mov dx, 0x20
call fcn.140015500
test rax, rax
jne 0x140013390
mov rcx, r14
mov dx, 9
call fcn.140015500
test rax, rax
jne 0x140013390
mov rcx, r14
mov dx, 0xa
call fcn.140015500
test rax, rax
jne 0x140013390
mov rcx, r14
mov dx, 0xb
call fcn.140015500
test rax, rax
jne 0x140013390
mov rcx, r14
mov dx, 0x22
call fcn.140015500
test rax, rax
je 0x1400135e8
nop word [rax + rax]
cmp word [0x14004fb90], 0
mov rax, r12
je 0x1400133c7
mov rcx, 0xffffffffffff8000
mov rax, r12
nop word [rax + rax]
inc rcx
cmp word [rax + 2], 0
lea rax, [rax + 2]
jne 0x1400133b0
test rcx, rcx
je 0x14001372d
mov dword [rax], 0x22
mov rax, qword [rbx + r15*8]
mov r8d, 1
xor ecx, ecx
jmp 0x1400133f5
mov word [rdx], cx
mov word [rdx + 2], 0
xor ecx, ecx
add rax, 2
mov r8d, 1
xor edx, edx
movzx r9d, word [rax]
cmp r9d, 0x22
je 0x140013490
cmp r9d, 0x5c
jne 0x140013420
inc edx
add r8d, 2
add ecx, 2
add rax, 2
jmp 0x1400133f7
test r9d, r9d
je 0x140013530
test edx, edx
je 0x1400134f0
xor ecx, ecx
jmp 0x140013451
mov dword [r8], 0x5c
inc ecx
cmp ecx, edx
je 0x1400134f0
cmp word [0x14004fb90], 0
mov r8, r12
je 0x140013440
mov r9, 0xffffffffffff8000
mov r8, r12
nop dword [rax + rax]
inc r9
cmp word [r8 + 2], 0
lea r8, [r8 + 2]
jne 0x140013470
test r9, r9
jne 0x140013440
jmp 0x14001372d
xor ecx, ecx
jmp 0x1400134ad
mov dword [rdx], 0x5c
inc ecx
cmp ecx, r8d
je 0x1400134f0
cmp word [0x14004fb90], 0
mov rdx, r12
je 0x1400134a0
mov r9, 0xffffffffffff8000
mov rdx, r12
nop word cs:[rax + rax]
inc r9
cmp word [rdx + 2], 0
lea rdx, [rdx + 2]
jne 0x1400134d0
test r9, r9
jne 0x1400134a0
jmp 0x14001372d
movzx ecx, word [rax]
cmp word [0x14004fb90], 0
mov rdx, r12
je 0x1400133e0
mov r8, 0xffffffffffff8000
mov rdx, r12
nop
inc r8
cmp word [rdx + 2], 0
lea rdx, [rdx + 2]
jne 0x140013510
test r8, r8
jne 0x1400133e0
jmp 0x14001372d
test edx, edx
je 0x140013590
cmp ecx, 1
adc ecx, 0
xor eax, eax
jmp 0x14001354c
mov dword [rdx], 0x5c
inc eax
cmp eax, ecx
je 0x140013590
cmp word [0x14004fb90], 0
mov rdx, r12
je 0x140013540
mov r8, 0xffffffffffff8000
mov rdx, r12
nop word cs:[rax + rax]
inc r8
cmp word [rdx + 2], 0
lea rdx, [rdx + 2]
jne 0x140013570
test r8, r8
jne 0x140013540
jmp 0x14001372d
cmp word [0x14004fb90], 0
mov rax, r12
je 0x1400135c7
mov rcx, 0xffffffffffff8000
mov rax, r12
nop word [rax + rax]
inc rcx
cmp word [rax + 2], 0
lea rax, [rax + 2]
jne 0x1400135b0
test rcx, rcx
je 0x14001372d
mov word [rax], 0x22
add rax, 2
mov word [rax], 0
inc r15
movsxd rax, dword [rsp + 0x58]
cmp r15, rax
jl 0x1400132f0
jmp 0x140013655
cmp word [0x14004fb90], 0
je 0x140013613
mov ecx, 0x8000
mov rdx, r12
nop word [rax + rax]
lea rax, [rdx + 2]
dec rcx
cmp word [rdx + 2], 0
mov rdx, rax
jne 0x140013600
jmp 0x14001361b
mov ecx, 0x8000
mov rax, r12
mov rdx, qword [rbx + r15*8]
movzx r8d, word [rdx]
test r8w, r8w
je 0x1400135d0
xor r9d, r9d
nop dword [rax]
cmp rcx, r9
je 0x14001372d
mov word [rax], r8w
add rax, 2
movzx r8d, word [rdx + r9*2 + 2]
inc r9
test r8w, r8w
jne 0x140013630
jmp 0x1400135d0
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], r13
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 1
lea rcx, [0x140042b50]
lea rdx, [0x14004fb90]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1400137b9
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
mov qword [0x140040b08], rcx
mov dword [rsp + 0x54], 0
test rcx, rcx
je 0x1400136fe
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [0x140040b08]
lea rdx, [rsp + 0x54]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x1400136e6
mov dword [rsp + 0x54], 1
mov rcx, qword [0x140040b08]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140040b08], 0
call fcn.140012ae0
mov esi, dword [rsp + 0x54]
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.140014440
mov eax, esi
add rsp, 0xe8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.140019c28
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Error__couldnt_unpack_file_to_target_path.
mov edx, eax
call fcn.1400129c0
mov ecx, 2
call fcn.14001879c
lea rcx, str.CACHE_DIRhellogreen_PID_TIME
call fcn.1400137d0
mov ecx, 2
call fcn.1400156f0
lea rdx, str.Error__failed_to_open__ls_for_writing._n
lea r8, [0x140043360]
mov rcx, rax
call fcn.140012a50
mov ecx, 2
call fcn.14001879c
lea rcx, str.Error__couldnt_find_attached_data_header.
jmp 0x1400137aa
lea rcx, str.Error__failed_to_register_signal_handler.
jmp 0x1400137aa
mov qword [0x140045388], 0
lea rcx, str.Error__couldnt_allocate_memory.
call fcn.140019f3c
mov ecx, 2
call fcn.14001879c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Error__couldnt_launch_child
jmp 0x14001373f