Function at 0x140002840
Capabilities:
Accept command line arguments
Create process on windows
Extract resource via kernel32 functions
Set environment variable
Write and execute a file
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x108
lea r13, [0x14001e0e0]
nop word [rax + rax]
mov rax, qword [0x14001c0c8]
lea rdi, [0x14001b8c0]
movzx edx, word [rax]
add rax, 2
mov qword [0x14001c0c8], rax
mov word [rdi], dx
test dx, dx
je 0x14000265e
mov rdx, rdi
nop dword [rax + rax]
movzx ecx, word [rax]
add rdx, 2
mov r9, rax
lea rax, [rax + 2]
mov word [rdx], cx
test cx, cx
jne 0x1400023e0
mov qword [0x14001c0c8], rax
lea rax, [0x14001b8c0]
movzx ecx, word [rax]
test cx, cx
je 0x14000265e
movzx r8d, word [0x14001c0e0]
xor r10d, r10d
lea rdx, [0x1400198c0]
lea rax, [0x14001c0e0]
mov word [0x1400198c0], r10w
test r8w, r8w
jne 0x140002449
jmp 0x14000245f
cmp rax, r13
je 0x14000a4d2
add rax, 2
mov word [rdx], r8w
add rdx, 2
movzx r8d, word [rax]
test r8w, r8w
jne 0x140002440
xor r8d, r8d
lea rax, [0x1400198c0]
mov word [rdx], r8w
cmp word [rax], 0
je 0x140002652
mov edx, 0x1000
nop dword [rax]
add rax, 2
sub rdx, 1
cmp word [rax], 0
jne 0x140002480
test rdx, rdx
je 0x140002831
mov dword [rax], 0x5c
lea rax, [0x1400198c0]
mov edx, 0x1000
cmp word [rax], 0
je 0x140002646
nop dword [rax + rax]
add rax, 2
sub rdx, 1
cmp word [rax], 0
jne 0x1400024b8
test rdx, rdx
je 0x140002836
lea r8, [0x14001b8c0]
jmp 0x1400024e9
test rdx, rdx
je 0x14000282c
add r8, 2
mov word [rax], cx
add rax, 2
sub rdx, 1
movzx ecx, word [r8]
test cx, cx
jne 0x1400024e0
xor edx, edx
cmp word [0x1400190c0], 0
mov word [rax], dx
je 0x1400025f8
mov r15, qword [r9 + 2]
add r9, 0xa
mov qword [0x14001c0c8], r9
call fcn.140002140
mov dword [rsp + 0x28], 0
xor r9d, r9d
mov r8d, 2
mov qword [rsp + 0x30], 0
mov edx, 0x40000000
lea rcx, [0x1400198c0]
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x140002800
mov rdi, qword [sym.imp.KERNEL32.dll_WriteFile]
lea rsi, [0x1400110c0]
lea rbp, [rsp + 0x80]
test r15, r15
je 0x1400025e3
nop dword [rax]
mov ebx, 0x8000
mov r14, qword [0x14001c0c8]
mov rcx, rsi
cmp r15, rbx
cmovbe rbx, r15
mov rdx, r14
mov r8, rbx
call sub.msvcrt.dll_memcpy
lea rdx, [r14 + rbx]
mov r9, rbp
mov r8d, ebx
mov qword [0x14001c0c8], rdx
mov rcx, r12
mov rdx, rsi
mov dword [rsp + 0x80], 0
mov qword [rsp + 0x20], 0
call rdi
test eax, eax
je 0x140002781
sub r15, rbx
jne 0x140002588
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400023b0
lea rax, [0x1400198c0]
lea rdx, [0x1400190c0]
movzx ecx, word [rax]
lea r8, [rax + 0x2000]
test cx, cx
jne 0x140002629
jmp 0x14000263c
cmp rax, r8
je 0x14000a4d2
add rax, 2
mov word [rdx], cx
add rdx, 2
movzx ecx, word [rax]
test cx, cx
jne 0x140002620
xor eax, eax
mov word [rdx], ax
jmp 0x140002514
lea rax, [0x1400198c0]
jmp 0x1400024cf
lea rax, [0x1400198c0]
jmp 0x140002497
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rbp, [rsp + 0x80]
mov edx, pe_nt_image_headers64
lea r8, [0x14000c0aa]
mov r9d, eax
mov rcx, rbp
mov rdi, rbp
call fcn.140001840
mov rdx, rbp
lea rcx, str.NUITKA_ONEFILE_PARENT
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
xor eax, eax
mov ecx, 0xd
rep stosq qword [rdi], rax
mov dword [rsp + 0x80], 0x68
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x40], rbp
mov rdx, rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], 0
lea rcx, [0x1400190c0]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14000278d
mov rcx, qword [rsp + 0x68]
mov rbx, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rbx
mov rcx, qword [rsp + 0x60]
mov dword [rsp + 0x58], 0
mov qword [0x1400110a0], rcx
test rcx, rcx
je 0x140002764
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [0x1400110a0]
lea rdx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x140002750
mov dword [rsp + 0x58], 1
mov rcx, qword [0x1400110a0]
call rbx
mov qword [0x1400110a0], 0
call fcn.140002210
mov eax, dword [rsp + 0x58]
add rsp, 0x108
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, str.Error__couldnt_runtime_expand_target_path.
call fcn.140001ed0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, 0x409
xor edx, edx
mov ecx, 0x1300
mov ebx, eax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], 0
mov r8d, ebx
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov rsi, qword [rsp + 0x58]
mov ecx, 2
call qword [fcn.140009b40]
mov r9d, ebx
lea r8, str.Error__couldnt_launch_child
lea rdx, str._s___Error__d___s__n
mov qword [rsp + 0x20], rsi
mov rcx, rax
call fcn.140001810
mov ecx, 2
call sub.msvcrt.dll_exit
nop
mov ecx, 2
call qword [fcn.140009b40]
lea r8, [0x1400198c0]
lea rdx, str.Error__failed_to_open__ls_for_writing._n
mov rcx, rax
call fcn.140001810
mov ecx, 2
call sub.msvcrt.dll_exit
nop
jmp 0x14000a4d2
jmp 0x14000a4d2
jmp 0x14000a4d2
push r12
sub rsp, 0x20
lea r12, str._TEMP_onefile__PID___TIME_
mov r8d, 0x1000
lea rcx, [0x14001c0e0]
mov rdx, r12
call fcn.140001860
test al, al
je 0x1400028e0
mov edx, 1
lea rcx, [0x140002370]
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
test eax, eax
je 0x1400028f4
mov r8d, 0xa
xor ecx, ecx
mov edx, 0x1b
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
lea rcx, [rax + 3]
cmp byte [rax + 1], 0x41
movzx edx, byte [rax]
mov qword [0x14001c0c8], rcx
movzx r8d, byte [rax + 2]
jne 0x1400028e8
cmp dl, 0x4b
jne 0x1400028e8
cmp r8b, 0x58
jne 0x1400028e8
mov byte [0x14001c0c0], 1
add rsp, 0x20
pop r12
jmp 0x140002390
mov rcx, r12
call fcn.140001ef0
lea rcx, str.Error__could_find_attached_data_header.
call fcn.140001ed0
lea rcx, str.Error__failed_to_register_signal_handler.
call fcn.140001ed0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push rbp
mov rbp, rsp
sub rsp, 0x20
jmp 0x140002938
mov rax, qword [0x14000b020]
mov rax, qword [rax]
call rax
mov rax, qword [0x14000b020]
add rax, 8
mov qword [0x14000b020], rax
mov rax, qword [0x14000b020]
mov rax, qword [rax]
test rax, rax
jne 0x14000291a
nop
nop
add rsp, 0x20
pop rbp
ret