Function at 0x140013220
Capabilities:
Accept command line arguments
Create process on windows
Extract resource via kernel32 functions
Write and execute a file
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xe8
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0xe0], rax
lea rbp, [0x140040b20]
lea rdx, str.TEMPonefile_PID_TIME
mov r8d, 0x1000
mov rcx, rbp
call fcn.140012780
test al, al
je 0x140013d40
lea rcx, [0x1400130b0]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
test eax, eax
je 0x140013d7f
mov edx, 0x1b
mov r8d, 0xa
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rsi, rax
xor ecx, ecx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [0x140045368], rax
mov qword [0x140042b20], rax
xor ecx, ecx
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov eax, eax
mov qword [0x140042b40], rax
mov rdx, qword [0x140042b20]
movzx r8d, byte [rdx]
movzx ecx, byte [rdx + 1]
movzx eax, byte [rdx + 2]
add rdx, 3
mov qword [0x140042b20], rdx
cmp r8b, 0x4b
jne 0x140013d76
cmp cl, 0x41
jne 0x140013d76
cmp al, 0x59
jne 0x140013d76
mov qword [0x140042b28], 0
mov ecx, 0x20000
call fcn.14001af74
mov qword [0x140045370], rax
test rax, rax
je 0x140013d93
mov ecx, 0x274b8
call fcn.14001af74
test rax, rax
je 0x140013d88
mov r8, rax
mov qword [rax + 0x73c8], 0
mov qword [rax + 0x72d8], 0
mov qword [rax + 0x7420], 0
mov qword [rax + 0x7440], 0
mov dword [rax + 0x7448], 0
mov dword [rax + 0x7454], 0
mov qword [rax + 0x274b0], 0
xorps xmm0, xmm0
movups xmmword [rax + 0x73d8], xmm0
movups xmmword [rax + 0x73ec], xmm0
movups xmmword [rax + 0x73f8], xmm0
movups xmmword [rax + 0x73a0], xmm0
mov qword [rax + 0x73b0], 0
xor r9d, r9d
xor eax, eax
xor ecx, ecx
xchg rbx, r10
cpuid
xchg rbx, r10
test eax, eax
jle 0x1400133e7
cmp eax, 7
jb 0x1400133e7
mov eax, 7
xor ecx, ecx
xchg rbx, r9
cpuid
xchg rbx, r9
shr r9d, 8
and r9d, 1
mov dword [r8 + 0x73d0], r9d
mov dword [r8 + 0x7388], 0
mov qword [r8 + 0x7410], 0x8000001
mov dword [r8 + 0x7458], 0
movabs rax, 0x100000000
mov qword [r8 + 0x738c], rax
mov qword [0x140045388], r8
mov rax, qword [0x140042b20]
mov qword [0x140042b28], rax
mov qword [0x140042b38], 0
mov rax, qword [0x140042b40]
mov qword [0x140042b30], rax
mov byte [0x140043350], 1
lea r13, [0x140045390]
lea r15, [rsp + 0x70]
lea rbx, [0x140043360]
lea r14, [0x140047b90]
mov rsi, r13
jmp 0x14001348f
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, r13
mov r15, rdi
mov edx, 2
mov rcx, r15
call fcn.140014740
movzx eax, word [rsp + 0x70]
mov word [rsi], ax
add rsi, 2
test ax, ax
jne 0x14001348f
movzx eax, word [0x140045390]
test ax, ax
je 0x140013741
mov word [0x140043360], 0
movzx edx, word [0x140040b20]
mov rcx, rbx
test dx, dx
je 0x140013550
xor ecx, ecx
nop word [rax + rax]
cmp rcx, 0x2000
je 0x140013d1d
mov word [rcx + rbx], dx
movzx edx, word [rcx + rbp + 2]
test dx, dx
je 0x140013531
mov word [rcx + rbx + 2], dx
movzx edx, word [rcx + rbp + 4]
test dx, dx
je 0x14001353a
mov word [rcx + rbx + 4], dx
movzx edx, word [rcx + rbp + 6]
test dx, dx
je 0x140013543
mov word [rcx + rbx + 6], dx
movzx edx, word [rcx + rbp + 8]
add rcx, 8
test dx, dx
jne 0x1400134e0
add rcx, rbx
jmp 0x140013550
add rcx, rbx
add rcx, 2
jmp 0x140013550
add rcx, rbx
add rcx, 4
jmp 0x140013550
add rcx, rbx
add rcx, 6
nop word [rax + rax]
mov word [rcx], 0
cmp word [0x140043360], 0
mov rcx, rbx
je 0x140013587
mov rdx, 0xfffffffffffff000
mov rcx, rbx
nop dword [rax]
inc rdx
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x140013570
test rdx, rdx
je 0x140013d1d
mov dword [rcx], 0x5c
cmp word [0x140043360], 0
je 0x1400135b4
mov ecx, 0x1000
mov r8, rbx
nop
lea rdx, [r8 + 2]
dec rcx
cmp word [r8 + 2], 0
mov r8, rdx
jne 0x1400135a0
jmp 0x1400135bc
mov ecx, 0x1000
mov rdx, rbx
xor r8d, r8d
nop
cmp rcx, r8
je 0x140013d1d
mov word [rdx + r8*2], ax
movzx eax, word [r13 + r8*2 + 2]
inc r8
test ax, ax
jne 0x1400135c0
mov word [rdx + r8*2], 0
cmp word [0x140042b50], 0
jne 0x14001367e
movzx ecx, word [0x140043360]
lea rdx, [0x140042b50]
mov rax, rdx
test cx, cx
je 0x140013679
xor eax, eax
nop dword [rax]
cmp rax, 0x2000
je 0x140013d1d
mov word [rax + rdx], cx
movzx ecx, word [rax + rbx + 2]
test cx, cx
je 0x140013660
mov word [rax + rdx + 2], cx
movzx ecx, word [rax + rbx + 4]
test cx, cx
je 0x140013669
mov word [rax + rdx + 4], cx
movzx ecx, word [rax + rbx + 6]
test cx, cx
je 0x140013672
mov word [rax + rdx + 6], cx
movzx ecx, word [rax + rbx + 8]
add rax, 8
test cx, cx
jne 0x140013610
add rax, rdx
jmp 0x140013679
add rax, rdx
add rax, 2
jmp 0x140013679
add rax, rdx
add rax, 4
jmp 0x140013679
add rax, rdx
add rax, 6
mov word [rax], 0
mov edx, 8
mov rdi, r15
mov rcx, r15
call fcn.140014740
mov rsi, qword [rsp + 0x70]
mov rcx, rbx
call fcn.140013df0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 2
mov rcx, rbx
mov edx, 0x40000000
mov r8d, 2
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x140013d4c
mov r15, rax
test rsi, rsi
je 0x140013480
nop word cs:[rax + rax]
cmp rsi, 0x8000
mov r12d, 0x8000
cmovb r12, rsi
mov rcx, r14
mov rdx, r12
call fcn.140014740
mov dword [rsp + 0x70], 0
mov qword [rsp + 0x20], 0
mov rcx, r15
mov rdx, r14
mov r8d, r12d
mov r9, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140013d22
sub rsi, r12
jne 0x1400136f0
jmp 0x140013480
mov r13, r15
mov rcx, qword [0x140045388]
call fcn.14000a7f0
mov rcx, qword [0x140045370]
call fcn.14001af60
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rcx, str.NUITKA_ONEFILE_PARENT
mov edx, eax
call fcn.1400125d0
cmp word [0x14003eb00], 0
jne 0x1400137f5
lea rdi, [0x14003eb00]
xor ecx, ecx
mov rdx, rdi
mov r8d, 0x1001
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
movzx ecx, word [0x14003eb00]
test cx, cx
je 0x1400137f0
lea rdi, [0x14003eb04]
mov rax, 0xfffffffffffff001
nop dword [rax]
mov word [rdi - 4], cx
movzx ecx, word [rdi - 2]
test cx, cx
je 0x1400137ec
mov word [rdi - 2], cx
movzx ecx, word [rdi]
test cx, cx
je 0x1400137f0
test rax, rax
je 0x140013d1d
mov word [rdi], cx
movzx ecx, word [rdi + 2]
add rdi, 6
add rax, 3
test cx, cx
jne 0x1400137b0
add rdi, 0xfffffffffffffffc
jmp 0x1400137f0
add rdi, 0xfffffffffffffffe
mov word [rdi], 0
lea rcx, str.NUITKA_ONEFILE_BINARY
lea rdx, [0x14003eb00]
call fcn.1400124d0
xorps xmm0, xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0xb0], xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
mov dword [rsp + 0xac], 0x100
mov rsi, qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff6
call rsi
mov qword [rsp + 0xc0], rax
mov ecx, 0xfffffff5
call rsi
mov qword [rsp + 0xc8], rax
mov ecx, 0xfffffff4
call rsi
mov qword [rsp + 0xd0], rax
mov dword [rsp + 0x70], 0x68
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rdi, [rsp + 0x58]
mov rcx, rax
mov rdx, rdi
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov rbx, rax
mov word [0x14004fb90], 0
lea r14, [0x14003aaf0]
xor ecx, ecx
mov rdx, r14
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x140013d1d
mov qword [rbx], r14
cmp dword [rsp + 0x58], 0
jle 0x140013c45
xor r15d, r15d
lea r12, [0x14004fb90]
mov ebp, 1
nop word [rax + rax]
test r15, r15
je 0x14001391d
cmp word [0x14004fb90], 0
mov rax, r12
je 0x140013917
mov rcx, 0xffffffffffff8000
mov rax, r12
nop dword [rax]
inc rcx
cmp word [rax + 2], 0
lea rax, [rax + 2]
jne 0x140013900
test rcx, rcx
je 0x140013d1d
mov dword [rax], 0x20
mov r14, qword [rbx + r15*8]
mov rcx, r14
mov dx, 0x20
call fcn.1400159d0
test rax, rax
jne 0x140013980
mov rcx, r14
mov dx, 9
call fcn.1400159d0
test rax, rax
jne 0x140013980
mov rcx, r14
mov dx, 0xa
call fcn.1400159d0
test rax, rax
jne 0x140013980
mov rcx, r14
mov dx, 0xb
call fcn.1400159d0
test rax, rax
jne 0x140013980
mov rcx, r14
mov dx, 0x22
call fcn.1400159d0
test rax, rax
je 0x140013bd8
nop word [rax + rax]
cmp word [0x14004fb90], 0
mov rax, r12
je 0x1400139b7
mov rcx, 0xffffffffffff8000
mov rax, r12
nop word [rax + rax]
inc rcx
cmp word [rax + 2], 0
lea rax, [rax + 2]
jne 0x1400139a0
test rcx, rcx
je 0x140013d1d
mov dword [rax], 0x22
mov rax, qword [rbx + r15*8]
mov r8d, 1
xor ecx, ecx
jmp 0x1400139e5
mov word [rdx], cx
mov word [rdx + 2], 0
xor ecx, ecx
add rax, 2
mov r8d, 1
xor edx, edx
movzx r9d, word [rax]
cmp r9d, 0x22
je 0x140013a80
cmp r9d, 0x5c
jne 0x140013a10
inc edx
add r8d, 2
add ecx, 2
add rax, 2
jmp 0x1400139e7
test r9d, r9d
je 0x140013b20
test edx, edx
je 0x140013ae0
xor ecx, ecx
jmp 0x140013a41
mov dword [r8], 0x5c
inc ecx
cmp ecx, edx
je 0x140013ae0
cmp word [0x14004fb90], 0
mov r8, r12
je 0x140013a30
mov r9, 0xffffffffffff8000
mov r8, r12
nop dword [rax + rax]
inc r9
cmp word [r8 + 2], 0
lea r8, [r8 + 2]
jne 0x140013a60
test r9, r9
jne 0x140013a30
jmp 0x140013d1d
xor ecx, ecx
jmp 0x140013a9d
mov dword [rdx], 0x5c
inc ecx
cmp ecx, r8d
je 0x140013ae0
cmp word [0x14004fb90], 0
mov rdx, r12
je 0x140013a90
mov r9, 0xffffffffffff8000
mov rdx, r12
nop word cs:[rax + rax]
inc r9
cmp word [rdx + 2], 0
lea rdx, [rdx + 2]
jne 0x140013ac0
test r9, r9
jne 0x140013a90
jmp 0x140013d1d
movzx ecx, word [rax]
cmp word [0x14004fb90], 0
mov rdx, r12
je 0x1400139d0
mov r8, 0xffffffffffff8000
mov rdx, r12
nop
inc r8
cmp word [rdx + 2], 0
lea rdx, [rdx + 2]
jne 0x140013b00
test r8, r8
jne 0x1400139d0
jmp 0x140013d1d
test edx, edx
je 0x140013b80
cmp ecx, 2
cmovb ecx, ebp
xor eax, eax
jmp 0x140013b3c
mov dword [rdx], 0x5c
inc eax
cmp eax, ecx
je 0x140013b80
cmp word [0x14004fb90], 0
mov rdx, r12
je 0x140013b30
mov r8, 0xffffffffffff8000
mov rdx, r12
nop word cs:[rax + rax]
inc r8
cmp word [rdx + 2], 0
lea rdx, [rdx + 2]
jne 0x140013b60
test r8, r8
jne 0x140013b30
jmp 0x140013d1d
cmp word [0x14004fb90], 0
mov rax, r12
je 0x140013bb7
mov rcx, 0xffffffffffff8000
mov rax, r12
nop word [rax + rax]
inc rcx
cmp word [rax + 2], 0
lea rax, [rax + 2]
jne 0x140013ba0
test rcx, rcx
je 0x140013d1d
mov word [rax], 0x22
add rax, 2
mov word [rax], 0
inc r15
movsxd rax, dword [rsp + 0x58]
cmp r15, rax
jl 0x1400138e0
jmp 0x140013c45
cmp word [0x14004fb90], 0
je 0x140013c03
mov ecx, 0x8000
mov rdx, r12
nop word [rax + rax]
lea rax, [rdx + 2]
dec rcx
cmp word [rdx + 2], 0
mov rdx, rax
jne 0x140013bf0
jmp 0x140013c0b
mov ecx, 0x8000
mov rax, r12
mov rdx, qword [rbx + r15*8]
movzx r8d, word [rdx]
test r8w, r8w
je 0x140013bc0
xor r9d, r9d
nop dword [rax]
cmp rcx, r9
je 0x140013d1d
mov word [rax], r8w
add rax, 2
movzx r8d, word [rdx + r9*2 + 2]
inc r9
test r8w, r8w
jne 0x140013c20
jmp 0x140013bc0
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], r13
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 1
lea rcx, [0x140042b50]
lea rdx, [0x14004fb90]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140013da9
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
mov qword [0x140040b08], rcx
mov dword [rsp + 0x54], 0
test rcx, rcx
je 0x140013cee
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [0x140040b08]
lea rdx, [rsp + 0x54]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x140013cd6
mov dword [rsp + 0x54], 1
mov rcx, qword [0x140040b08]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140040b08], 0
call fcn.1400130d0
mov esi, dword [rsp + 0x54]
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.140014a30
mov eax, esi
add rsp, 0xe8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.14001af00
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Error__couldnt_unpack_file_to_target_path.
mov edx, eax
call fcn.140012fb0
mov ecx, 2
call fcn.1400199f0
lea rcx, str.TEMPonefile_PID_TIME
call fcn.140013dc0
mov ecx, 2
call fcn.140015bd4
lea rdx, str.Error__failed_to_open__ls_for_writing._n
lea r8, [0x140043360]
mov rcx, rax
call fcn.140013040
mov ecx, 2
call fcn.1400199f0
lea rcx, str.Error__couldnt_find_attached_data_header.
jmp 0x140013d9a
lea rcx, str.Error__failed_to_register_signal_handler.
jmp 0x140013d9a
mov qword [0x140045388], 0
lea rcx, str.Error__couldnt_allocate_memory.
call fcn.14001b214
mov ecx, 2
call fcn.1400199f0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Error__couldnt_launch_child
jmp 0x140013d2f