Function at 0x140012c10
Capabilities:
Accept command line arguments
Create process on windows
Extract resource via kernel32 functions
Write and execute a file
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xe8
mov rax, qword [0x140038008]
xor rax, rsp
mov qword [rsp + 0xe0], rax
call fcn.1400163d8
call fcn.1400163e0
lea rbp, [0x14003eae0]
lea rdx, str.TEMPonefile_PID_TIME
mov r8d, 0x1000
mov rcx, rbp
call fcn.140012290
test al, al
je 0x140013730
lea rcx, [0x140012aa0]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
test eax, eax
je 0x14001376f
mov edx, 0x1b
mov r8d, 0xa
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rsi, rax
xor ecx, ecx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [0x140043328], rax
mov qword [0x140040ae0], rax
xor ecx, ecx
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov eax, eax
mov qword [0x140040b00], rax
mov rdx, qword [0x140040ae0]
movzx r8d, byte [rdx]
movzx ecx, byte [rdx + 1]
movzx eax, byte [rdx + 2]
add rdx, 3
mov qword [0x140040ae0], rdx
cmp r8b, 0x4b
jne 0x140013766
cmp cl, 0x41
jne 0x140013766
cmp al, 0x59
jne 0x140013766
mov qword [0x140040ae8], 0
mov ecx, 0x20000
call fcn.14001b3e0
mov qword [0x140043330], rax
test rax, rax
je 0x140013783
mov ecx, 0x274b8
call fcn.14001b3e0
test rax, rax
je 0x140013778
mov r8, rax
mov qword [rax + 0x73c8], 0
mov qword [rax + 0x72d8], 0
mov qword [rax + 0x7420], 0
mov qword [rax + 0x7440], 0
mov dword [rax + 0x7448], 0
mov dword [rax + 0x7454], 0
mov qword [rax + 0x274b0], 0
xorps xmm0, xmm0
movups xmmword [rax + 0x73d8], xmm0
movups xmmword [rax + 0x73ec], xmm0
movups xmmword [rax + 0x73f8], xmm0
movups xmmword [rax + 0x73a0], xmm0
mov qword [rax + 0x73b0], 0
xor r9d, r9d
xor eax, eax
xor ecx, ecx
xchg rbx, r10
cpuid
xchg rbx, r10
test eax, eax
jle 0x140012de1
cmp eax, 7
jb 0x140012de1
mov eax, 7
xor ecx, ecx
xchg rbx, r9
cpuid
xchg rbx, r9
shr r9d, 8
and r9d, 1
mov dword [r8 + 0x73d0], r9d
mov dword [r8 + 0x7388], 0
mov qword [r8 + 0x7410], 0x8000001
mov dword [r8 + 0x7458], 0
movabs rax, 0x100000000
mov qword [r8 + 0x738c], rax
mov qword [0x140043348], r8
mov rax, qword [0x140040ae0]
mov qword [0x140040ae8], rax
mov qword [0x140040af8], 0
mov rax, qword [0x140040b00]
mov qword [0x140040af0], rax
mov byte [0x140041310], 1
lea r13, [0x140043350]
lea r15, [rsp + 0x70]
lea rbx, [0x140041320]
lea r14, [0x140045b50]
mov rsi, r13
jmp 0x140012e7f
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, r13
mov r15, rdi
mov edx, 2
mov rcx, r15
call fcn.140014300
movzx eax, word [rsp + 0x70]
mov word [rsi], ax
add rsi, 2
test ax, ax
jne 0x140012e7f
movzx eax, word [0x140043350]
test ax, ax
je 0x140013131
mov word [0x140041320], 0
movzx edx, word [0x14003eae0]
mov rcx, rbx
test dx, dx
je 0x140012f40
xor ecx, ecx
nop word [rax + rax]
cmp rcx, 0x2000
je 0x14001370d
mov word [rcx + rbx], dx
movzx edx, word [rcx + rbp + 2]
test dx, dx
je 0x140012f21
mov word [rcx + rbx + 2], dx
movzx edx, word [rcx + rbp + 4]
test dx, dx
je 0x140012f2a
mov word [rcx + rbx + 4], dx
movzx edx, word [rcx + rbp + 6]
test dx, dx
je 0x140012f33
mov word [rcx + rbx + 6], dx
movzx edx, word [rcx + rbp + 8]
add rcx, 8
test dx, dx
jne 0x140012ed0
add rcx, rbx
jmp 0x140012f40
add rcx, rbx
add rcx, 2
jmp 0x140012f40
add rcx, rbx
add rcx, 4
jmp 0x140012f40
add rcx, rbx
add rcx, 6
nop word [rax + rax]
mov word [rcx], 0
cmp word [0x140041320], 0
mov rcx, rbx
je 0x140012f77
mov rdx, 0xfffffffffffff000
mov rcx, rbx
nop dword [rax]
inc rdx
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x140012f60
test rdx, rdx
je 0x14001370d
mov dword [rcx], 0x5c
cmp word [0x140041320], 0
je 0x140012fa4
mov ecx, 0x1000
mov r8, rbx
nop
lea rdx, [r8 + 2]
dec rcx
cmp word [r8 + 2], 0
mov r8, rdx
jne 0x140012f90
jmp 0x140012fac
mov ecx, 0x1000
mov rdx, rbx
xor r8d, r8d
nop
cmp rcx, r8
je 0x14001370d
mov word [rdx + r8*2], ax
movzx eax, word [r13 + r8*2 + 2]
inc r8
test ax, ax
jne 0x140012fb0
mov word [rdx + r8*2], 0
cmp word [0x140040b10], 0
jne 0x14001306e
movzx ecx, word [0x140041320]
lea rdx, [0x140040b10]
mov rax, rdx
test cx, cx
je 0x140013069
xor eax, eax
nop dword [rax]
cmp rax, 0x2000
je 0x14001370d
mov word [rax + rdx], cx
movzx ecx, word [rax + rbx + 2]
test cx, cx
je 0x140013050
mov word [rax + rdx + 2], cx
movzx ecx, word [rax + rbx + 4]
test cx, cx
je 0x140013059
mov word [rax + rdx + 4], cx
movzx ecx, word [rax + rbx + 6]
test cx, cx
je 0x140013062
mov word [rax + rdx + 6], cx
movzx ecx, word [rax + rbx + 8]
add rax, 8
test cx, cx
jne 0x140013000
add rax, rdx
jmp 0x140013069
add rax, rdx
add rax, 2
jmp 0x140013069
add rax, rdx
add rax, 4
jmp 0x140013069
add rax, rdx
add rax, 6
mov word [rax], 0
mov edx, 8
mov rdi, r15
mov rcx, r15
call fcn.140014300
mov rsi, qword [rsp + 0x70]
mov rcx, rbx
call fcn.1400137e0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 2
mov rcx, rbx
mov edx, 0x40000000
mov r8d, 2
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x14001373c
mov r15, rax
test rsi, rsi
je 0x140012e70
nop word cs:[rax + rax]
cmp rsi, 0x8000
mov r12d, 0x8000
cmovb r12, rsi
mov rcx, r14
mov rdx, r12
call fcn.140014300
mov dword [rsp + 0x70], 0
mov qword [rsp + 0x20], 0
mov rcx, r15
mov rdx, r14
mov r8d, r12d
mov r9, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140013712
sub rsi, r12
jne 0x1400130e0
jmp 0x140012e70
mov r13, r15
mov rcx, qword [0x140043348]
call fcn.14000a360
mov rcx, qword [0x140043330]
call fcn.14001b3cc
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rcx, str.NUITKA_ONEFILE_PARENT
mov edx, eax
call fcn.1400120e0
cmp word [0x14003cac0], 0
jne 0x1400131e5
lea rdi, [0x14003cac0]
xor ecx, ecx
mov rdx, rdi
mov r8d, 0x1001
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
movzx ecx, word [0x14003cac0]
test cx, cx
je 0x1400131e0
lea rdi, [0x14003cac4]
mov rax, 0xfffffffffffff001
nop dword [rax]
mov word [rdi - 4], cx
movzx ecx, word [rdi - 2]
test cx, cx
je 0x1400131dc
mov word [rdi - 2], cx
movzx ecx, word [rdi]
test cx, cx
je 0x1400131e0
test rax, rax
je 0x14001370d
mov word [rdi], cx
movzx ecx, word [rdi + 2]
add rdi, 6
add rax, 3
test cx, cx
jne 0x1400131a0
add rdi, 0xfffffffffffffffc
jmp 0x1400131e0
add rdi, 0xfffffffffffffffe
mov word [rdi], 0
lea rcx, str.NUITKA_ONEFILE_BINARY
lea rdx, [0x14003cac0]
call fcn.140011fe0
xorps xmm0, xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0xb0], xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
mov dword [rsp + 0xac], 0x100
mov rsi, qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff6
call rsi
mov qword [rsp + 0xc0], rax
mov ecx, 0xfffffff5
call rsi
mov qword [rsp + 0xc8], rax
mov ecx, 0xfffffff4
call rsi
mov qword [rsp + 0xd0], rax
mov dword [rsp + 0x70], 0x68
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rdi, [rsp + 0x58]
mov rcx, rax
mov rdx, rdi
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov rbx, rax
mov word [0x14004db50], 0
lea r14, [0x140038ab0]
xor ecx, ecx
mov rdx, r14
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x14001370d
mov qword [rbx], r14
cmp dword [rsp + 0x58], 0
jle 0x140013635
xor r15d, r15d
lea r12, [0x14004db50]
nop word cs:[rax + rax]
test r15, r15
je 0x14001330d
cmp word [0x14004db50], 0
mov rax, r12
je 0x140013307
mov rcx, 0xffffffffffff8000
mov rax, r12
nop dword [rax]
inc rcx
cmp word [rax + 2], 0
lea rax, [rax + 2]
jne 0x1400132f0
test rcx, rcx
je 0x14001370d
mov dword [rax], 0x20
mov r14, qword [rbx + r15*8]
mov rcx, r14
mov dx, 0x20
call fcn.140016028
test rax, rax
jne 0x140013370
mov rcx, r14
mov dx, 9
call fcn.140016028
test rax, rax
jne 0x140013370
mov rcx, r14
mov dx, 0xa
call fcn.140016028
test rax, rax
jne 0x140013370
mov rcx, r14
mov dx, 0xb
call fcn.140016028
test rax, rax
jne 0x140013370
mov rcx, r14
mov dx, 0x22
call fcn.140016028
test rax, rax
je 0x1400135c8
nop word [rax + rax]
cmp word [0x14004db50], 0
mov rax, r12
je 0x1400133a7
mov rcx, 0xffffffffffff8000
mov rax, r12
nop word [rax + rax]
inc rcx
cmp word [rax + 2], 0
lea rax, [rax + 2]
jne 0x140013390
test rcx, rcx
je 0x14001370d
mov dword [rax], 0x22
mov rax, qword [rbx + r15*8]
mov r8d, 1
xor ecx, ecx
jmp 0x1400133d5
mov word [rdx], cx
mov word [rdx + 2], 0
xor ecx, ecx
add rax, 2
mov r8d, 1
xor edx, edx
movzx r9d, word [rax]
cmp r9d, 0x22
je 0x140013470
cmp r9d, 0x5c
jne 0x140013400
inc edx
add r8d, 2
add ecx, 2
add rax, 2
jmp 0x1400133d7
test r9d, r9d
je 0x140013510
test edx, edx
je 0x1400134d0
xor ecx, ecx
jmp 0x140013431
mov dword [r8], 0x5c
inc ecx
cmp ecx, edx
je 0x1400134d0
cmp word [0x14004db50], 0
mov r8, r12
je 0x140013420
mov r9, 0xffffffffffff8000
mov r8, r12
nop dword [rax + rax]
inc r9
cmp word [r8 + 2], 0
lea r8, [r8 + 2]
jne 0x140013450
test r9, r9
jne 0x140013420
jmp 0x14001370d
xor ecx, ecx
jmp 0x14001348d
mov dword [rdx], 0x5c
inc ecx
cmp ecx, r8d
je 0x1400134d0
cmp word [0x14004db50], 0
mov rdx, r12
je 0x140013480
mov r9, 0xffffffffffff8000
mov rdx, r12
nop word cs:[rax + rax]
inc r9
cmp word [rdx + 2], 0
lea rdx, [rdx + 2]
jne 0x1400134b0
test r9, r9
jne 0x140013480
jmp 0x14001370d
movzx ecx, word [rax]
cmp word [0x14004db50], 0
mov rdx, r12
je 0x1400133c0
mov r8, 0xffffffffffff8000
mov rdx, r12
nop
inc r8
cmp word [rdx + 2], 0
lea rdx, [rdx + 2]
jne 0x1400134f0
test r8, r8
jne 0x1400133c0
jmp 0x14001370d
test edx, edx
je 0x140013570
cmp ecx, 1
adc ecx, 0
xor eax, eax
jmp 0x14001352c
mov dword [rdx], 0x5c
inc eax
cmp eax, ecx
je 0x140013570
cmp word [0x14004db50], 0
mov rdx, r12
je 0x140013520
mov r8, 0xffffffffffff8000
mov rdx, r12
nop word cs:[rax + rax]
inc r8
cmp word [rdx + 2], 0
lea rdx, [rdx + 2]
jne 0x140013550
test r8, r8
jne 0x140013520
jmp 0x14001370d
cmp word [0x14004db50], 0
mov rax, r12
je 0x1400135a7
mov rcx, 0xffffffffffff8000
mov rax, r12
nop word [rax + rax]
inc rcx
cmp word [rax + 2], 0
lea rax, [rax + 2]
jne 0x140013590
test rcx, rcx
je 0x14001370d
mov word [rax], 0x22
add rax, 2
mov word [rax], 0
inc r15
movsxd rax, dword [rsp + 0x58]
cmp r15, rax
jl 0x1400132d0
jmp 0x140013635
cmp word [0x14004db50], 0
je 0x1400135f3
mov ecx, 0x8000
mov rdx, r12
nop word [rax + rax]
lea rax, [rdx + 2]
dec rcx
cmp word [rdx + 2], 0
mov rdx, rax
jne 0x1400135e0
jmp 0x1400135fb
mov ecx, 0x8000
mov rax, r12
mov rdx, qword [rbx + r15*8]
movzx r8d, word [rdx]
test r8w, r8w
je 0x1400135b0
xor r9d, r9d
nop dword [rax]
cmp rcx, r9
je 0x14001370d
mov word [rax], r8w
add rax, 2
movzx r8d, word [rdx + r9*2 + 2]
inc r9
test r8w, r8w
jne 0x140013610
jmp 0x1400135b0
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], r13
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 1
lea rcx, [0x140040b10]
lea rdx, [0x14004db50]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140013799
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
mov qword [0x14003eac8], rcx
mov dword [rsp + 0x54], 0
test rcx, rcx
je 0x1400136de
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [0x14003eac8]
lea rdx, [rsp + 0x54]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x1400136c6
mov dword [rsp + 0x54], 1
mov rcx, qword [0x14003eac8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x14003eac8], 0
call fcn.140012ac0
mov esi, dword [rsp + 0x54]
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.1400145f0
mov eax, esi
add rsp, 0xe8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.14001b36c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Error__couldnt_unpack_file_to_target_path.
mov edx, eax
call fcn.1400129a0
mov ecx, 2
call fcn.140019f50
lea rcx, str.TEMPonefile_PID_TIME
call fcn.1400137b0
mov ecx, 2
call fcn.140016230
lea rdx, str.Error__failed_to_open__ls_for_writing._n
lea r8, [0x140041320]
mov rcx, rax
call fcn.140012a30
mov ecx, 2
call fcn.140019f50
lea rcx, str.Error__couldnt_find_attached_data_header.
jmp 0x14001378a
lea rcx, str.Error__failed_to_register_signal_handler.
jmp 0x14001378a
mov qword [0x140043348], 0
lea rcx, str.Error__couldnt_allocate_memory.
call fcn.14001b680
mov ecx, 2
call fcn.140019f50
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Error__couldnt_launch_child
jmp 0x14001371f