Function at 0x40d280
Capabilities:
Accept command line arguments
Create process on windows
Extract resource via kernel32 functions
Set environment variable
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ecx, 0x1000
mov edx, str._TEMP_onefile__PID___TIME_
mov eax, 0x426080
push edi
push esi
push ebx
sub esp, 0xfc
call fcn.00407710
test al, al
je 0x40da5d
mov dword [esp + 4], 1
mov dword [esp], 0x4082a0
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
sub esp, 8
test eax, eax
je 0x40daea
mov dword [esp + 8], 0xa
mov dword [esp + 4], 0x1b
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
sub esp, 0xc
mov ebx, eax
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
sub esp, 8
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
sub esp, 4
mov dword [0x426070], eax
mov dword [esp + 4], ebx
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [0x42606c], 0
mov dword [0x426068], eax
mov edi, eax
mov eax, dword [0x426070]
sub esp, 8
cmp byte [eax], 0x4b
lea ebp, [eax + 3]
movzx ecx, byte [eax + 2]
setne dl
cmp byte [eax + 1], 0x41
mov dword [0x426070], ebp
setne al
or dl, al
jne 0x40dae0
cmp cl, 0x59
jne 0x40dae0
mov dword [esp], 0x20000
mov dword [0x429088], 0
call sub.msvcrt.dll_malloc
mov dword [0x429094], eax
test eax, eax
je 0x40da53
mov dword [esp], 0x27420
call sub.msvcrt.dll_malloc
mov esi, eax
test eax, eax
je 0x40da49
mov dword [eax + 0x736c], 0
mov dword [eax + 0x7370], 0
mov dword [eax + 0x7374], 0
mov dword [eax + 0x7380], 0
mov dword [eax + 0x738c], 0
mov dword [eax + 0x7388], 0
mov dword [eax + 0x72b8], 0
mov dword [eax + 0x7394], 0
mov dword [eax + 0x7398], 0
mov dword [eax + 0x73a0], 0
mov dword [eax + 0x73a4], 0
mov dword [eax + 0x73b4], 0
mov dword [eax + 0x739c], 0
mov dword [eax + 0x73c4], 0
mov dword [eax + 0x73c8], 0
mov dword [eax + 0x73d4], 0
mov dword [eax + 0x2741c], 0
xor eax, eax
cpuid
xor ecx, ecx
cmp eax, 6
ja 0x40d814
mov dword [esi + 0x7384], ecx
mov dword [esi + 0x735c], 0
mov dword [esi + 0x73ac], 0x8000001
mov dword [esi + 0x73d8], 0
mov dword [esi + 0x7360], 0
mov dword [esi + 0x7364], 1
mov dword [0x429084], esi
mov dword [0x429088], ebp
mov dword [0x429090], 0
mov dword [0x42908c], edi
mov byte [0x426060], 1
mov ebp, 0x425860
mov ebx, dword [0x429098]
mov edi, dword [0x42909c]
mov dword [esp + 0x4c], ebp
lea esi, [esi]
lea eax, [esp + 0x70]
xor edx, edx
mov esi, 2
mov dword [esp + 0x3c], eax
lea esi, [esi]
nop
mov eax, ebx
sub eax, edi
jne 0x40d549
mov ebp, dword [0x429090]
mov ecx, dword [0x42908c]
cmp ebp, ecx
setb al
or dl, al
je 0x40d5a8
mov eax, dword [0x429084]
mov dword [0x42909c], 0
mov dword [0x429098], 0x20000
call fcn.0040bf20
mov ebx, dword [0x42909c]
cmp dword [0x429098], ebx
sete dl
cmp eax, 0xffffff88
ja 0x40d5b0
xor edi, edi
mov eax, ebx
mov dword [0x429098], ebx
mov dword [0x42909c], 0
sub eax, edi
je 0x40d4e6
cmp esi, eax
mov byte [esp + 0x48], dl
cmovbe eax, esi
mov ebp, eax
mov eax, dword [0x429094]
mov dword [esp + 8], ebp
add eax, edi
add edi, ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
add dword [esp + 0x3c], ebp
sub esi, ebp
movzx edx, byte [esp + 0x48]
mov dword [0x42909c], edi
jne 0x40d4e0
movzx eax, word [esp + 0x70]
mov esi, dword [esp + 0x4c]
mov word [esi], ax
test ax, ax
je 0x40d5ba
add esi, 2
mov dword [esp + 0x4c], esi
jmp 0x40d4c8
cmp ebp, ecx
je 0x40d4e0
mov eax, str.Error__couldnt_decode_attached_data.
call fcn.00407e70
movzx ecx, word [0x425860]
test cx, cx
je 0x40d828
movzx edx, word [0x426080]
xor esi, esi
mov eax, 2
mov word [0x423860], si
test dx, dx
jne 0x40d5fe
jmp 0x40d80a
add eax, 2
cmp eax, 0x2002
je 0x414ea4
mov word [eax + 0x42385e], dx
movzx edx, word [eax + 0x426080]
test dx, dx
jne 0x40d5f0
add eax, 0x423860
xor ebx, ebx
mov word [eax], bx
cmp word [0x423860], 0
je 0x40d800
mov edx, 0x1000
mov eax, 0x423860
lea esi, [esi]
nop
add eax, 2
sub edx, 1
cmp word [eax], 0
jne 0x40d638
test edx, edx
je 0x40db3c
mov dword [eax], 0x5c
mov edx, 0x1000
mov eax, 0x423860
cmp word [0x423860], 0
je 0x40d684
lea esi, [esi]
lea esi, [esi]
add eax, 2
sub edx, 1
cmp word [eax], 0
jne 0x40d670
test edx, edx
je 0x40db37
mov ebx, 0x425860
jmp 0x40d698
test edx, edx
je 0x40db32
add ebx, 2
mov word [eax], cx
add eax, 2
sub edx, 1
movzx ecx, word [ebx]
test cx, cx
jne 0x40d690
xor ecx, ecx
cmp word [0x423060], 0
mov word [eax], cx
je 0x40d7b0
mov edx, 8
lea eax, [esp + 0x70]
call fcn.0040d190
mov esi, dword [esp + 0x70]
mov edi, dword [esp + 0x74]
call fcn.00408080
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 2
mov dword [esp + 4], 0x40000000
mov dword [esp], 0x423860
call dword [sym.imp.KERNEL32.dll_CreateFileW]
sub esp, 0x1c
mov ebx, eax
cmp eax, 0xffffffff
jne 0x40d799
jmp 0x40daaf
xor eax, eax
mov edx, 0x8000
mov ecx, eax
cmp edx, esi
sbb ecx, edi
cmovae eax, edi
cmovae edx, esi
mov dword [esp + 0x44], eax
mov eax, 0x41b040
mov dword [esp + 0x40], edx
call fcn.0040d190
lea eax, [esp + 0x70]
mov dword [esp], ebx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x70], 0
mov dword [esp + 0x10], 0
mov dword [esp + 8], eax
mov dword [esp + 4], 0x41b040
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x14
test eax, eax
je 0x40da91
sub esi, dword [esp + 0x40]
sbb edi, dword [esp + 0x44]
mov eax, esi
or eax, edi
jne 0x40d730
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
jmp 0x40d4af
movzx edx, word [0x423860]
mov eax, 2
test dx, dx
jne 0x40d7de
jmp 0x40da3f
add eax, 2
cmp eax, 0x2002
je 0x414ea4
mov word [eax + 0x42305e], dx
movzx edx, word [eax + 0x423860]
test dx, dx
jne 0x40d7d0
add eax, 0x423060
xor edx, edx
mov word [eax], dx
jmp 0x40d6bf
mov eax, 0x423860
jmp 0x40d64c
mov eax, 0x423860
jmp 0x40d616
mov eax, 7
cpuid
mov ecx, ebx
shr ecx, 8
and ecx, 1
jmp 0x40d454
mov ebx, dword [0x429084]
test ebx, ebx
je 0x40d8ee
mov eax, dword [ebx + 0x7380]
test eax, eax
jne 0x40d8ee
mov eax, dword [ebx + 0x7374]
mov esi, dword [ebx + 0x7388]
mov edi, dword [ebx + 0x7370]
mov dword [esp + 0x3c], eax
test esi, esi
je 0x40d896
mov eax, dword [esi]
mov ebp, dword [esi + 0x6ab4]
mov edx, dword [esi + 0x6ab8]
test eax, eax
je 0x40da7c
test ebp, ebp
je 0x40db25
mov dword [esp], edx
mov dword [esp + 0x48], edx
mov dword [esp + 4], eax
call ebp
mov edx, dword [esp + 0x48]
mov dword [esp + 4], esi
mov dword [esp], edx
call ebp
mov dword [ebx + 0x7388], 0
mov eax, dword [ebx + 0x73a0]
mov dword [ebx + 0x738c], 0
mov dword [ebx + 0x7398], 0
test eax, eax
je 0x40da67
test edi, edi
je 0x40db18
mov dword [esp + 4], eax
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call edi
mov dword [ebx + 0x73a0], 0
mov eax, dword [esp + 0x3c]
mov dword [esp + 4], ebx
mov dword [esp], eax
call edi
mov eax, dword [0x429094]
mov dword [esp], eax
call sub.msvcrt.dll_free
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 8], 0x4162a8
mov dword [esp + 0xc], eax
lea eax, [esp + 0x70]
mov dword [esp + 4], pe_nt_image_headers32
mov dword [esp], eax
call fcn.00401ad0
lea eax, [esp + 0x70]
mov dword [esp], str.NUITKA_ONEFILE_PARENT
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
xor eax, eax
mov ecx, 0x10
sub esp, 8
lea edx, [esp + 0x74]
lea esi, [esp + 0x70]
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [esp + 0x70], 0x44
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea edx, [esp + 0x60]
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], edx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x20
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0x423060
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
sub esp, 0x28
test eax, eax
je 0x40daf4
mov eax, dword [esp + 0x64]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp], eax
call ebx
sub esp, 4
mov eax, dword [esp + 0x60]
mov dword [esp + 0x5c], 0
mov dword [0x423040], eax
test eax, eax
je 0x40da29
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
lea eax, [esp + 0x5c]
mov dword [esp + 4], eax
mov eax, dword [0x423040]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
sub esp, 8
test eax, eax
jne 0x40da12
mov dword [esp + 0x5c], 1
mov eax, dword [0x423040]
mov dword [esp], eax
call ebx
mov dword [0x423040], 0
sub esp, 4
call fcn.00408140
mov eax, dword [esp + 0x5c]
add esp, 0xfc
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
mov eax, 0x423060
jmp 0x40d7f6
mov dword [0x429084], 0
mov eax, str.Error__couldnt_allocate_memory.
call fcn.00407e70
mov eax, str._TEMP_onefile__PID___TIME_
call fcn.00407dc0
test edi, edi
jne 0x40d8e1
mov dword [esp], ebx
call sub.msvcrt.dll_free
jmp 0x40d8ee
test ebp, ebp
jne 0x40d88d
mov dword [esp], esi
call sub.msvcrt.dll_free
jmp 0x40d896
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov eax, str.Error__couldnt_unpack_file_to_target_path.
call fcn.00407df0
mov dword [esp], 2
call sub.msvcrt.dll_exit
mov dword [esp], 2
call dword [0x415054]
mov dword [esp + 8], 0x423860
mov dword [esp + 4], str.Error__failed_to_open__ls_for_writing._n
mov dword [esp], eax
call fcn.00401aa0
mov dword [esp], 2
call sub.msvcrt.dll_exit
mov eax, str.Error__couldnt_find_attached_data_header.
call fcn.00407e70
mov eax, str.Error__failed_to_register_signal_handler.
call fcn.00407e70
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov eax, str.Error__couldnt_launch_child
call fcn.00407df0
mov dword [esp], 2
call sub.msvcrt.dll_exit
lea esi, [esi]
mov dword [esp], eax
call sub.msvcrt.dll_free
jmp 0x40da6f
mov dword [esp], eax
call sub.msvcrt.dll_free
jmp 0x40da84
jmp 0x414ea4
jmp 0x414ea4
jmp 0x414ea4
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
jmp fcn.004014c0