Function at 0x14000e410
Capabilities:
Accept command line arguments
Create process on windows
Encode data using xor
Extract resource via kernel32 functions
Get file size
Hash data with crc32
Read file via mapping
Set environment variable
Write and execute a file
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
lea rsi, str.libgcc_s_dw2_1.dll
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
je 0x140001670
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.__register_frame_info
mov rcx, rbx
mov qword [0x140026040], rax
call rdi
lea rdx, str.__deregister_frame_info
mov rcx, rbx
mov rsi, rax
call rdi
mov qword [section..data], rax
test rsi, rsi
je 0x140001653
lea rdx, [0x140026060]
lea rcx, [section..eh_fram]
call rsi
lea rcx, [0x140001690]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp fcn.140001586
lea rax, [0x1400015d0]
lea rsi, [0x1400015c0]
mov qword [section..data], rax
jmp 0x140001643
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x378
movaps xmmword [rsp + 0x350], xmm6
movaps xmmword [rsp + 0x360], xmm7
lea rbx, str.TEMP_vzor_parser_11620255806
mov r8d, 0x1000
lea rcx, [0x140045100]
mov rdx, rbx
call fcn.140007540
test al, al
je 0x14000fd1b
mov edx, 1
lea rcx, [0x140007c70]
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
test eax, eax
je 0x14000fe1e
mov r8d, 0xa
xor ecx, ecx
mov edx, 0x1b
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov rdx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
xor ecx, ecx
mov rdx, rbx
mov qword [0x1400450e8], rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov rax, qword [0x1400450e8]
mov qword [0x1400450e0], rsi
cmp byte [rax + 1], 0x41
lea rdi, [rax + 3]
movzx ecx, byte [rax + 2]
setne dl
cmp byte [rax], 0x4b
mov qword [0x1400450e8], rdi
setne al
or dl, al
jne 0x14000fdec
cmp cl, 0x59
jne 0x14000fdec
mov qword [0x140049110], 0
mov ecx, 0x20000
call sub.msvcrt.dll_malloc
mov qword [0x140049130], rax
test rax, rax
je 0x14000fd0f
mov ecx, 0x274b8
call sub.msvcrt.dll_malloc
mov r8, rax
test rax, rax
je 0x14000fd04
mov qword [rax + 0x73b0], 0
pxor xmm0, xmm0
mov qword [rax + 0x73c8], 0
mov qword [rax + 0x72d8], 0
mov qword [rax + 0x73ec], 0
mov qword [rax + 0x73f8], 0
mov qword [rax + 0x7400], 0
mov qword [rax + 0x7420], 0
mov dword [rax + 0x73f4], 0
mov qword [rax + 0x7440], 0
mov dword [rax + 0x7448], 0
mov dword [rax + 0x7454], 0
mov qword [rax + 0x274b0], 0
movups xmmword [rax + 0x73a0], xmm0
movups xmmword [rax + 0x73d8], xmm0
xor eax, eax
cpuid
xor ecx, ecx
cmp eax, 6
ja 0x14000f4aa
mov dword [r8 + 0x73d0], ecx
movdqa xmm6, xmmword [0x140021650]
lea r15, [rsp + 0x250]
mov qword [r8 + 0x7410], 0x8000001
movd xmm7, dword [0x140021660]
mov dword [r8 + 0x7458], 0
mov qword [r8 + 0x7388], 0
mov dword [r8 + 0x7390], 1
mov qword [0x140049108], r8
mov qword [0x140049110], rdi
mov qword [0x140049120], 0
mov qword [0x140049118], rsi
mov rbx, qword [0x140049138]
mov rsi, qword [0x140049140]
lea r13, [0x1400448e0]
nop word [rax + rax]
xor edi, edi
mov r12, r15
mov ebp, 2
nop word [rax + rax]
mov r8, rbx
sub r8, rsi
jne 0x14000e6cc
mov rcx, qword [0x140049120]
mov rdx, qword [0x140049118]
cmp rcx, rdx
setb al
or dil, al
je 0x14000e720
mov rcx, qword [0x140049108]
movups xmmword [0x140049138], xmm6
call fcn.14000cf30
mov rbx, qword [0x140049140]
cmp qword [0x140049138], rbx
sete dil
cmp rax, 0xffffffffffffff88
ja 0x14000e729
xor esi, esi
mov r8, rbx
mov qword [0x140049138], rbx
mov qword [0x140049140], 0
sub r8, rsi
je 0x14000e668
cmp r8, rbp
mov r14, r8
mov rdx, qword [0x140049130]
mov rcx, r12
cmova r14, rbp
add rdx, rsi
mov r8, r14
add rsi, r14
add r12, r14
call sub.msvcrt.dll_memcpy
mov qword [0x140049140], rsi
sub rbp, r14
jne 0x14000e660
movzx eax, word [rsp + 0x250]
mov word [r13], ax
test ax, ax
je 0x14000e735
add r13, 2
jmp 0x14000e650
cmp rcx, rdx
je 0x14000e660
lea rcx, str.Error__couldnt_decode_attached_data.
call fcn.140007bf0
lea rax, [0x1400448e0]
movzx ecx, word [rax]
test cx, cx
je 0x14000f4dc
lea rax, [0x140045100]
xor esi, esi
lea rdx, [0x1400428e0]
movzx r8d, word [rax]
mov word [0x1400428e0], si
lea r9, [rax + 0x2000]
test r8w, r8w
jne 0x14000e781
jmp 0x14000e797
cmp rax, r9
je 0x14001c888
add rax, 2
mov word [rdx], r8w
add rdx, 2
movzx r8d, word [rax]
test r8w, r8w
jne 0x14000e778
xor ebx, ebx
mov word [rdx], bx
cmp word [0x1400428e0], 0
je 0x14000f463
mov edx, 0x1000
lea rax, [0x1400428e0]
nop word cs:[rax + rax]
add rax, 2
sub rdx, 1
cmp word [rax], 0
jne 0x14000e7c0
test rdx, rdx
je 0x14000fe97
movd dword [rax], xmm7
mov edx, 0x1000
cmp word [0x1400428e0], 0
lea rax, [0x1400428e0]
je 0x14000e80f
nop dword [rax]
add rax, 2
sub rdx, 1
cmp word [rax], 0
jne 0x14000e7f8
test rdx, rdx
je 0x14000fe92
lea r8, [0x1400448e0]
jmp 0x14000e829
test rdx, rdx
je 0x14000fea6
add r8, 2
mov word [rax], cx
add rax, 2
sub rdx, 1
movzx ecx, word [r8]
test cx, cx
jne 0x14000e820
xor r11d, r11d
cmp word [0x1400420e0], 0
mov word [rax], r11w
je 0x14000f3f1
mov edx, 8
mov rcx, r15
call fcn.14000e1c0
mov edx, 4
mov rcx, r15
mov rbx, qword [rsp + 0x250]
call fcn.14000e1c0
mov eax, dword [rsp + 0x250]
xor r9d, r9d
mov edx, 0x80000000
mov qword [rsp + 0x30], 0
mov r8d, 7
lea rcx, [0x1400428e0]
mov dword [rsp + 0x60], eax
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
mov qword [rsp + 0x70], rax
call rax
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x14000f456
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp eax, 0xffffffff
je 0x14000f440
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor edx, edx
mov rcx, r12
mov qword [rsp + 0x28], 0
mov r8d, 2
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov r14, rax
test rax, rax
je 0x14000f440
xor r9d, r9d
xor r8d, r8d
mov edx, 4
mov rcx, rax
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rsp + 0x68], rax
test rax, rax
je 0x14000f4be
cmp esi, 0x2e
mov ebp, esi
mov rsi, rax
mov eax, 0xffffffff
jbe 0x14000ef89
test sil, 7
je 0x14000fd87
mov ecx, 0xffffffff
lea r10, [0x140020d00]
jmp 0x14000e973
test sil, 7
je 0x14000f46f
add rsi, 1
mov edx, ecx
xor cl, byte [rsi - 1]
shr edx, 8
movzx eax, cl
mov ecx, dword [r10 + rax*4]
xor ecx, edx
sub rbp, 1
jne 0x14000e969
mov rdi, 0xffffffffffffffff
mov qword [rsp + 0x78], rbp
mov r13, rsi
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x58], ecx
xor edx, edx
xor r11d, r11d
lea rax, [0x14001ed00]
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x98], rdi
mov qword [rsp + 0x80], r12
mov r12, rdi
mov qword [rsp + 0x88], r14
mov r14, rbx
mov rsi, qword [r13 + 0x18]
mov rdi, qword [r13 + 0x10]
add r13, 0x28
mov ecx, dword [rsp + 0x58]
xor rcx, qword [r13 - 0x28]
xor rsi, r8
mov r8, rcx
xor rdi, rdx
movzx edx, cl
shr r8, 0x38
xor r11, qword [r13 - 0x20]
mov edx, dword [rax + rdx*4]
xor edx, dword [rax + r8*4 + 0x1c00]
mov rbp, r11
mov r8, rcx
mov rbx, qword [r13 - 8]
mov r11d, edx
movzx edx, ch
shr r8, 0x10
mov edx, dword [rax + rdx*4 + 0x400]
movzx r8d, r8b
xor rbx, r9
mov r9, rsi
xor edx, r11d
xor edx, dword [rax + r8*4 + 0x800]
mov r8, rcx
shr r8, 0x18
movzx r8d, r8b
xor edx, dword [rax + r8*4 + 0xc00]
mov r8, rcx
shr r8, 0x20
movzx r8d, r8b
xor edx, dword [rax + r8*4 + 0x1000]
mov r8, rcx
shr rcx, 0x30
shr r8, 0x28
movzx ecx, cl
movzx r8d, r8b
xor edx, dword [rax + r8*4 + 0x1400]
xor edx, dword [rax + rcx*4 + 0x1800]
movzx r8d, bpl
mov rcx, rdi
mov dword [rsp + 0x58], edx
mov rdx, rbp
mov r11d, dword [rax + r8*4]
mov r8, rdi
shr rdx, 0x38
movzx ecx, ch
xor r11d, dword [rax + rdx*4 + 0x1c00]
mov rdx, rbp
movzx edx, dh
xor r11d, dword [rax + rdx*4 + 0x400]
mov rdx, rbp
shr rdx, 0x10
movzx edx, dl
xor r11d, dword [rax + rdx*4 + 0x800]
mov rdx, rbp
shr rdx, 0x18
movzx edx, dl
xor r11d, dword [rax + rdx*4 + 0xc00]
mov rdx, rbp
shr rdx, 0x20
movzx edx, dl
xor r11d, dword [rax + rdx*4 + 0x1000]
mov rdx, rbp
shr rbp, 0x30
shr rdx, 0x28
movzx edx, dl
xor r11d, dword [rax + rdx*4 + 0x1400]
movzx edx, bpl
xor r11d, dword [rax + rdx*4 + 0x1800]
shr r8, 0x38
movzx edx, dil
mov edx, dword [rax + rdx*4]
xor edx, dword [rax + r8*4 + 0x1c00]
mov r8, rdi
shr r9, 0x38
shr r8, 0x10
xor edx, dword [rax + rcx*4 + 0x400]
mov rcx, rsi
movzx r8d, r8b
xor edx, dword [rax + r8*4 + 0x800]
mov r8, rdi
shr r8, 0x18
movzx r8d, r8b
xor edx, dword [rax + r8*4 + 0xc00]
mov r8, rdi
shr r8, 0x20
movzx r8d, r8b
xor edx, dword [rax + r8*4 + 0x1000]
mov r8, rdi
shr rdi, 0x30
shr r8, 0x28
movzx r8d, r8b
xor edx, dword [rax + r8*4 + 0x1400]
movzx r8d, dil
movzx edi, ch
xor edx, dword [rax + r8*4 + 0x1800]
movzx r8d, sil
mov r8d, dword [rax + r8*4]
xor r8d, dword [rax + r9*4 + 0x1c00]
mov r9, rsi
shr r9, 0x10
xor r8d, dword [rax + rdi*4 + 0x400]
movzx r9d, r9b
xor r8d, dword [rax + r9*4 + 0x800]
mov r9, rsi
shr r9, 0x18
movzx r9d, r9b
xor r8d, dword [rax + r9*4 + 0xc00]
mov r9, rsi
shr r9, 0x20
movzx r9d, r9b
xor r8d, dword [rax + r9*4 + 0x1000]
mov r9, rsi
shr rsi, 0x30
shr r9, 0x28
movzx r9d, r9b
xor r8d, dword [rax + r9*4 + 0x1400]
movzx r9d, sil
mov rsi, rbx
shr rsi, 0x38
xor r8d, dword [rax + r9*4 + 0x1800]
movzx r9d, bl
mov r9d, dword [rax + r9*4]
xor r9d, dword [rax + rsi*4 + 0x1c00]
movzx esi, bh
xor r9d, dword [rax + rsi*4 + 0x400]
mov rsi, rbx
shr rsi, 0x10
movzx esi, sil
xor r9d, dword [rax + rsi*4 + 0x800]
mov rsi, rbx
shr rsi, 0x18
movzx esi, sil
xor r9d, dword [rax + rsi*4 + 0xc00]
mov rsi, rbx
shr rsi, 0x20
movzx esi, sil
xor r9d, dword [rax + rsi*4 + 0x1000]
mov rsi, rbx
shr rbx, 0x30
shr rsi, 0x28
movzx ebx, bl
movzx esi, sil
xor r9d, dword [rax + rsi*4 + 0x1400]
xor r9d, dword [rax + rbx*4 + 0x1800]
sub r12, 1
jne 0x14000e9d9
mov rdi, qword [rsp + 0x98]
mov ecx, dword [rsp + 0x58]
mov rbx, r14
mov rsi, qword [rsp + 0x90]
mov rbp, qword [rsp + 0x78]
lea rax, [rdi + rdi*4]
mov r12, qword [rsp + 0x80]
mov edi, r9d
mov r14, qword [rsp + 0x88]
lea rsi, [rsi + rax*8]
mov r9d, r8d
mov eax, ecx
mov r8d, edx
mov edx, r11d
xor rax, qword [rsi]
xor rdx, qword [rsi + 8]
movzx ecx, al
shr rax, 8
mov ecx, dword [r10 + rcx*4]
xor rax, rcx
mov rcx, rax
movzx eax, al
mov eax, dword [r10 + rax*4]
shr rcx, 8
xor rax, rcx
mov rcx, rax
movzx eax, al
mov eax, dword [r10 + rax*4]
shr rcx, 8
xor rax, rcx
mov rcx, rax
movzx eax, al
mov eax, dword [r10 + rax*4]
shr rcx, 8
xor rax, rcx
mov rcx, rax
movzx eax, al
mov eax, dword [r10 + rax*4]
shr rcx, 8
xor rax, rcx
mov rcx, rax
movzx eax, al
mov eax, dword [r10 + rax*4]
shr rcx, 8
xor rax, rcx
mov rcx, rax
movzx eax, al
mov eax, dword [r10 + rax*4]
shr rcx, 8
xor rax, rcx
mov rcx, rax
movzx eax, al
mov eax, dword [r10 + rax*4]
shr rcx, 8
xor rcx, rdx
xor rax, rcx
movzx edx, al
shr rax, 8
mov edx, dword [r10 + rdx*4]
xor rax, rdx
mov rdx, rax
movzx eax, al
mov eax, dword [r10 + rax*4]
shr rdx, 8
xor rax, rdx
mov rdx, rax
movzx eax, al
mov eax, dword [r10 + rax*4]
shr rdx, 8
xor rax, rdx
mov rdx, rax
movzx eax, al
mov eax, dword [r10 + rax*4]
shr rdx, 8
xor rax, rdx
mov rdx, rax
movzx eax, al
mov eax, dword [r10 + rax*4]
shr rdx, 8
xor rax, rdx
mov rdx, rax
movzx eax, al
mov eax, dword [r10 + rax*4]
shr rdx, 8
xor rax, rdx
mov rdx, rax
movzx eax, al
mov eax, dword [r10 + rax*4]
shr rdx, 8
xor rax, rdx
xor r8, qword [rsi + 0x10]
mov rdx, rax
movzx eax, al
mov eax, dword [r10 + rax*4]
shr rdx, 8
xor rdx, r8
xor rdx, rax
movzx eax, dl
shr rdx, 8
mov eax, dword [r10 + rax*4]
xor rax, rdx
mov rdx, rax
movzx eax, al
mov eax, dword [r10 + rax*4]
shr rdx, 8
xor rax, rdx
mov rdx, rax
movzx eax, al
mov eax, dword [r10 + rax*4]
shr rdx, 8
xor rdx, rax
mov rax, rdx
movzx edx, dl
mov edx, dword [r10 + rdx*4]
shr rax, 8
xor rax, rdx
mov rdx, rax
movzx eax, al
mov eax, dword [r10 + rax*4]
shr rdx, 8
xor rdx, rax
mov rax, rdx
movzx edx, dl
mov edx, dword [r10 + rdx*4]
shr rax, 8
xor rax, rdx
mov rdx, rax
movzx eax, al
mov eax, dword [r10 + rax*4]
shr rdx, 8
xor rax, rdx
mov rdx, qword [rsi + 0x18]
mov rcx, rax
movzx eax, al
mov eax, dword [r10 + rax*4]
shr rcx, 8
xor rdx, r9
xor rdx, rcx
xor rdx, rax
movzx eax, dl
shr rdx, 8
mov eax, dword [r10 + rax*4]
xor rax, rdx
mov rdx, rax
movzx eax, al
mov eax, dword [r10 + rax*4]
shr rdx, 8
xor rax, rdx
mov rdx, rax
movzx eax, al
mov eax, dword [r10 + rax*4]
shr rdx, 8
xor rax, rdx
mov rdx, rax
movzx eax, al
mov eax, dword [r10 + rax*4]
shr rdx, 8
xor rax, rdx
mov rcx, rax
movzx eax, al
mov edx, dword [r10 + rax*4]
shr rcx, 8
xor rdx, rcx
add rsi, 0x28
mov rax, rdx
movzx edx, dl
mov edx, dword [r10 + rdx*4]
shr rax, 8
xor rax, rdx
mov rcx, rax
movzx eax, al
mov edx, dword [r10 + rax*4]
shr rcx, 8
mov rax, qword [rsi - 8]
xor rdx, rcx
xor rax, rdi
mov rcx, rdx
movzx edx, dl
mov edx, dword [r10 + rdx*4]
shr rcx, 8
xor rax, rcx
xor rax, rdx
movzx edx, al
shr rax, 8
mov edx, dword [r10 + rdx*4]
xor rdx, rax
mov rax, rdx
movzx edx, dl
mov edx, dword [r10 + rdx*4]
shr rax, 8
xor rax, rdx
mov rdx, rax
movzx eax, al
mov eax, dword [r10 + rax*4]
shr rdx, 8
xor rax, rdx
mov rdx, rax
movzx eax, al
mov eax, dword [r10 + rax*4]
shr rdx, 8
xor rdx, rax
mov rax, rdx
movzx edx, dl
mov edx, dword [r10 + rdx*4]
shr rax, 8
xor rax, rdx
mov rdx, rax
movzx eax, al
mov eax, dword [r10 + rax*4]
shr rdx, 8
xor rax, rdx
mov rdx, rax
movzx eax, al
mov eax, dword [r10 + rax*4]
shr rdx, 8
xor rdx, rax
mov rax, rdx
movzx edx, dl
shr rax, 8
xor eax, dword [r10 + rdx*4]
cmp rbp, 7
jbe 0x14000f231
mov ecx, eax
lea r10, [0x140020d00]
lea rdx, [rbp - 8]
xor al, byte [rsi]
movzx eax, al
shr ecx, 8
xor ecx, dword [r10 + rax*4]
mov eax, ecx
xor cl, byte [rsi + 1]
movzx ecx, cl
shr eax, 8
xor eax, dword [r10 + rcx*4]
mov ecx, eax
xor al, byte [rsi + 2]
movzx eax, al
shr ecx, 8
xor ecx, dword [r10 + rax*4]
mov eax, ecx
xor cl, byte [rsi + 3]
movzx ecx, cl
shr eax, 8
xor eax, dword [r10 + rcx*4]
mov ecx, eax
xor al, byte [rsi + 4]
movzx eax, al
shr ecx, 8
xor ecx, dword [r10 + rax*4]
mov eax, ecx
xor cl, byte [rsi + 5]
movzx ecx, cl
shr eax, 8
xor eax, dword [r10 + rcx*4]
mov ecx, eax
xor al, byte [rsi + 6]
movzx eax, al
shr ecx, 8
xor ecx, dword [r10 + rax*4]
mov eax, ecx
xor cl, byte [rsi + 7]
movzx ecx, cl
shr eax, 8
xor eax, dword [r10 + rcx*4]
cmp rdx, 7
jbe 0x14000f225
mov ecx, eax
xor al, byte [rsi + 8]
movzx eax, al
shr ecx, 8
xor ecx, dword [r10 + rax*4]
mov eax, ecx
xor cl, byte [rsi + 9]
movzx ecx, cl
shr eax, 8
xor eax, dword [r10 + rcx*4]
mov ecx, eax
xor al, byte [rsi + 0xa]
movzx eax, al
shr ecx, 8
xor ecx, dword [r10 + rax*4]
mov eax, ecx
xor cl, byte [rsi + 0xb]
movzx ecx, cl
shr eax, 8
xor eax, dword [r10 + rcx*4]
mov ecx, eax
xor al, byte [rsi + 0xc]
movzx eax, al
shr ecx, 8
xor ecx, dword [r10 + rax*4]
mov eax, ecx
xor cl, byte [rsi + 0xd]
movzx ecx, cl
shr eax, 8
xor eax, dword [r10 + rcx*4]
mov ecx, eax
xor al, byte [rsi + 0xe]
movzx eax, al
shr ecx, 8
xor ecx, dword [r10 + rax*4]
mov eax, ecx
xor cl, byte [rsi + 0xf]
movzx ecx, cl
shr eax, 8
xor eax, dword [r10 + rcx*4]
lea rcx, [rbp - 0x10]
cmp rcx, 7
jbe 0x14000f225
mov ecx, eax
xor al, byte [rsi + 0x10]
movzx eax, al
shr ecx, 8
xor ecx, dword [r10 + rax*4]
mov eax, ecx
xor cl, byte [rsi + 0x11]
movzx ecx, cl
shr eax, 8
xor eax, dword [r10 + rcx*4]
mov ecx, eax
xor al, byte [rsi + 0x12]
movzx eax, al
shr ecx, 8
xor ecx, dword [r10 + rax*4]
mov eax, ecx
xor cl, byte [rsi + 0x13]
movzx ecx, cl
shr eax, 8
xor eax, dword [r10 + rcx*4]
mov ecx, eax
xor al, byte [rsi + 0x14]
movzx eax, al
shr ecx, 8
xor ecx, dword [r10 + rax*4]
mov eax, ecx
xor cl, byte [rsi + 0x15]
movzx ecx, cl
shr eax, 8
xor eax, dword [r10 + rcx*4]
mov ecx, eax
xor al, byte [rsi + 0x16]
movzx eax, al
shr ecx, 8
xor ecx, dword [r10 + rax*4]
mov eax, ecx
xor cl, byte [rsi + 0x17]
movzx ecx, cl
shr eax, 8
xor eax, dword [r10 + rcx*4]
lea rcx, [rbp - 0x18]
cmp rcx, 7
jbe 0x14000f225
mov ecx, eax
xor al, byte [rsi + 0x18]
movzx eax, al
shr ecx, 8
xor ecx, dword [r10 + rax*4]
mov eax, ecx
xor cl, byte [rsi + 0x19]
movzx ecx, cl
shr eax, 8
xor eax, dword [r10 + rcx*4]
mov ecx, eax
xor al, byte [rsi + 0x1a]
movzx eax, al
shr ecx, 8
xor ecx, dword [r10 + rax*4]
mov eax, ecx
xor cl, byte [rsi + 0x1b]
movzx ecx, cl
shr eax, 8
xor eax, dword [r10 + rcx*4]
mov ecx, eax
xor al, byte [rsi + 0x1c]
movzx eax, al
shr ecx, 8
xor ecx, dword [r10 + rax*4]
mov eax, ecx
xor cl, byte [rsi + 0x1d]
movzx ecx, cl
shr eax, 8
xor eax, dword [r10 + rcx*4]
mov ecx, eax
xor al, byte [rsi + 0x1e]
movzx eax, al
shr ecx, 8
xor ecx, dword [r10 + rax*4]
mov eax, ecx
xor cl, byte [rsi + 0x1f]
movzx ecx, cl
shr eax, 8
xor eax, dword [r10 + rcx*4]
lea rcx, [rbp - 0x20]
cmp rcx, 7
jbe 0x14000f225
mov ecx, eax
xor al, byte [rsi + 0x20]
movzx eax, al
shr ecx, 8
xor ecx, dword [r10 + rax*4]
mov eax, ecx
xor cl, byte [rsi + 0x21]
movzx ecx, cl
shr eax, 8
xor eax, dword [r10 + rcx*4]
mov ecx, eax
xor al, byte [rsi + 0x22]
movzx eax, al
shr ecx, 8
xor ecx, dword [r10 + rax*4]
mov eax, ecx
xor cl, byte [rsi + 0x23]
movzx ecx, cl
shr eax, 8
xor eax, dword [r10 + rcx*4]
mov ecx, eax
xor al, byte [rsi + 0x24]
movzx eax, al
shr ecx, 8
xor ecx, dword [r10 + rax*4]
mov eax, ecx
xor cl, byte [rsi + 0x25]
movzx ecx, cl
shr eax, 8
xor eax, dword [r10 + rcx*4]
mov ecx, eax
xor al, byte [rsi + 0x26]
movzx eax, al
shr ecx, 8
xor ecx, dword [r10 + rax*4]
mov eax, ecx
xor cl, byte [rsi + 0x27]
movzx ecx, cl
shr eax, 8
xor eax, dword [r10 + rcx*4]
shr rdx, 3
and ebp, 7
lea rsi, [rsi + rdx*8 + 8]
test rbp, rbp
je 0x14000f2cf
mov edx, eax
xor al, byte [rsi]
lea r10, [0x140020d00]
movzx eax, al
shr edx, 8
xor edx, dword [r10 + rax*4]
mov eax, edx
cmp rbp, 1
je 0x14000f2cf
xor al, byte [rsi + 1]
shr edx, 8
movzx eax, al
xor edx, dword [r10 + rax*4]
mov eax, edx
cmp rbp, 2
je 0x14000f2cf
xor al, byte [rsi + 2]
shr edx, 8
movzx eax, al
xor edx, dword [r10 + rax*4]
mov eax, edx
cmp rbp, 3
je 0x14000f2cf
xor al, byte [rsi + 3]
shr edx, 8
movzx eax, al
xor edx, dword [r10 + rax*4]
mov eax, edx
cmp rbp, 4
je 0x14000f2cf
xor al, byte [rsi + 4]
shr edx, 8
movzx eax, al
xor edx, dword [r10 + rax*4]
mov eax, edx
cmp rbp, 5
je 0x14000f2cf
xor al, byte [rsi + 5]
shr edx, 8
movzx eax, al
xor edx, dword [r10 + rax*4]
mov eax, edx
cmp rbp, 6
je 0x14000f2cf
xor al, byte [rsi + 6]
shr edx, 8
movzx eax, al
xor edx, dword [r10 + rax*4]
mov eax, edx
not eax
mov rcx, qword [rsp + 0x68]
test eax, eax
mov esi, eax
mov eax, 1
cmove esi, eax
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, r14
mov rdi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rdi
mov rcx, r12
call rdi
cmp dword [rsp + 0x60], esi
je 0x14000f3bd
lea rcx, [0x1400428e0]
call fcn.140011090
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov r8d, 2
mov edx, 0x40000000
lea rcx, [0x1400428e0]
mov dword [rsp + 0x20], 2
call rax
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x14000fe2a
mov r12, qword [sym.imp.KERNEL32.dll_WriteFile]
lea rdi, [0x1400260a0]
test rbx, rbx
je 0x14000f3af
nop dword [rax]
mov esi, 0x8000
mov rcx, rdi
cmp rbx, rsi
cmovbe rsi, rbx
mov rdx, rsi
call fcn.14000e1c0
mov r9, r15
mov r8d, esi
mov rdx, rdi
mov dword [rsp + 0x250], 0
mov rcx, rbp
mov qword [rsp + 0x20], 0
call r12
test eax, eax
je 0x14000fe00
sub rbx, rsi
jne 0x14000f368
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000e632
test rbx, rbx
je 0x14000e632
lea rdi, [0x1400260a0]
nop dword [rax]
mov esi, 0x8000
mov rcx, rdi
cmp rbx, rsi
cmovbe rsi, rbx
mov rdx, rsi
call fcn.14000e1c0
sub rbx, rsi
jne 0x14000f3d0
jmp 0x14000e632
movzx edx, word [0x1400428e0]
lea rax, [0x1400420e0]
lea rcx, [0x1400428e0]
lea r8, [rax + 0x2000]
test dx, dx
jne 0x14000f421
jmp 0x14000f434
cmp rax, r8
je 0x14001c888
add rcx, 2
mov word [rax], dx
add rax, 2
movzx edx, word [rcx]
test dx, dx
jne 0x14000f418
xor r10d, r10d
mov word [rax], r10w
jmp 0x14000e856
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000f2f9
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
jmp 0x14000f2f9
lea rax, [0x1400428e0]
jmp 0x14000e7d7
movabs rax, 0xcccccccccccccccd
mul rbp
mov rax, rdx
shr rax, 5
lea rdx, [rax + rax*4]
lea rdi, [rax - 1]
mov eax, ecx
shl rdx, 3
sub rbp, rdx
test rdi, rdi
jne 0x14000e995
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x14000ecca
mov eax, 7
cpuid
shr ebx, 8
and ebx, 1
mov ecx, ebx
jmp 0x14000e5c7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r14
call rsi
mov rcx, r12
call rsi
xor esi, esi
jmp 0x14000f2f9
mov rbx, qword [0x140049108]
test rbx, rbx
je 0x14000f58c
cmp qword [rbx + 0x73c8], 0
jne 0x14000f58c
mov rsi, qword [rbx + 0x73d8]
mov r12, qword [rbx + 0x73a8]
mov r13, qword [rbx + 0x73b0]
test rsi, rsi
je 0x14000f544
mov rdx, qword [rsi]
mov rdi, qword [rsi + 0x6ac8]
mov r14, qword [rsi + 0x6ad0]
test rdx, rdx
je 0x14000fdd6
test rdi, rdi
je 0x14000fe85
mov rcx, r14
call rdi
mov rdx, rsi
mov rcx, r14
call rdi
mov rdx, qword [rbx + 0x73f8]
pxor xmm0, xmm0
mov dword [rbx + 0x73f0], 0
movups xmmword [rbx + 0x73d8], xmm0
test rdx, rdx
je 0x14000fdc0
test r12, r12
je 0x14000fe78
mov rcx, r13
call r12
mov qword [rbx + 0x73f8], 0
mov rdx, rbx
mov rcx, r13
call r12
mov rcx, qword [0x140049130]
lea rsi, [rsp + 0x1d0]
call sub.msvcrt.dll_free
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea r8, [0x14001e31a]
mov edx, pe_nt_image_headers64
mov rcx, rsi
mov r9d, eax
call fcn.140001910
movzx eax, byte [rsp + 0x1d0]
xor r9d, r9d
mov word [rsp + 0x250], r9w
test al, al
je 0x14000f677
mov edi, pe_nt_image_headers64
mov rbx, r15
lea r14, [rsp + 0xaa]
mov r12d, 1
lea r13, [rsp + 0xb4]
mov r8d, 2
mov rdx, r14
mov rcx, r13
mov byte [rsp + 0xaa], al
mov byte [rsp + 0xab], 0
call sub.msvcrt.dll_mbstowcs
cmp rax, 1
jne 0x14001c888
cmp word [rbx], 0
movzx ecx, word [rsp + 0xb4]
mov rdx, rdi
mov rax, rbx
je 0x14000f646
nop dword [rax]
add rax, 2
sub rdx, 1
cmp word [rax], 0
jne 0x14000f638
test rdx, rdx
je 0x14001c888
mov word [rax], cx
xor ecx, ecx
add rbx, 2
lea rdx, [rdi - 1]
mov word [rax + 2], cx
mov rax, r12
sub rax, rdi
movzx eax, byte [r15 + rax]
test al, al
je 0x14000f677
mov rdi, rdx
jmp 0x14000f5f7
xor r8d, r8d
lea rbx, [rsp + 0x110]
lea r14, [rsp + 0xb8]
mov eax, 0x4e
mov word [rsp + 0x110], r8w
mov rcx, r14
lea r12, str.NUITKA_ONEFILE_PARENT
mov r14, rsi
mov rdi, rbx
lea r13, [rsp + 0xac]
mov rsi, rbx
lea rbx, [0x14001e4a4]
mov r8d, 2
mov rdx, r13
mov byte [rsp + 0xac], al
sub rbx, r12
mov byte [rsp + 0xad], 0
mov qword [rsp + 0x58], rcx
call sub.msvcrt.dll_mbstowcs
cmp rax, 1
jne 0x14001c888
cmp word [rdi], 0
movzx edx, word [rsp + 0xb8]
mov rax, rdi
mov rcx, qword [rsp + 0x58]
je 0x14000f70e
nop
add rax, 2
sub rbx, 1
cmp word [rax], 0
jne 0x14000f700
test rbx, rbx
je 0x14001c888
mov word [rax], dx
add r12, 1
xor edx, edx
add rdi, 2
mov word [rax + 2], dx
movzx eax, byte [r12]
test al, al
jne 0x14000f6b3
mov rbx, rsi
mov rdx, r15
lea rdi, [0x14002e0a0]
mov rsi, r14
mov rcx, rbx
mov rbx, qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
call rbx
cmp word [0x14002e0a0], 0
je 0x14000fd3a
xor r12d, r12d
lea rcx, [rsp + 0xc0]
mov qword [rsp + 0x60], rbx
lea rdx, [rsp + 0xae]
mov r13, rcx
mov qword [rsp + 0x58], r15
mov r15, rsi
lea r14, str.NUITKA_ONEFILE_BINARY
mov word [rsp + 0xc0], r12w
lea r12, [rsp + 0xbc]
mov eax, 0x4e
mov rsi, rdx
mov rcx, r12
mov r12, r13
lea rbx, [0x14001e4ba]
mov r8d, 2
mov rdx, rsi
mov byte [rsp + 0xae], al
sub rbx, r14
mov byte [rsp + 0xaf], 0
mov qword [rsp + 0x68], rcx
call sub.msvcrt.dll_mbstowcs
cmp rax, 1
jne 0x14001c888
cmp word [r13], 0
movzx edx, word [rsp + 0xbc]
mov rax, r13
mov rcx, qword [rsp + 0x68]
je 0x14000f80e
nop word cs:[rax + rax]
add rax, 2
sub rbx, 1
cmp word [rax], 0
jne 0x14000f800
test rbx, rbx
je 0x14001c888
xor r11d, r11d
add r14, 1
mov word [rax], dx
add r13, 2
mov word [rax + 2], r11w
movzx eax, byte [r14]
test al, al
jne 0x14000f7a8
mov rdx, rdi
mov rcx, r12
mov rbx, qword [rsp + 0x60]
mov rsi, r15
mov r15, qword [rsp + 0x58]
lea r12, [0x1400300c0]
call rbx
lea rbx, [rsp + 0x160]
xor eax, eax
mov ecx, 0xd
mov rdi, rbx
rep stosq qword [rdi], rax
mov rdi, qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff6
mov dword [rsp + 0x19c], 0x100
call rdi
mov ecx, 0xfffffff5
mov qword [rsp + 0x1b0], rax
call rdi
mov ecx, 0xfffffff4
mov qword [rsp + 0x1b8], rax
call rdi
mov dword [rsp + 0x160], 0x68
mov qword [rsp + 0x1c0], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rdx, [rsp + 0xb0]
mov rcx, rax
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
xor r10d, r10d
xor ecx, ecx
mov r8d, 0x1000
mov word [0x1400320c0], r10w
mov rdi, rax
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x14001c888
mov r9d, dword [rsp + 0xb0]
mov qword [rdi], r12
lea r12, [0x1400320c0]
mov r14d, dword [0x140021660]
test r9d, r9d
jle 0x14000fb65
mov qword [rsp + 0x58], rbx
test ebp, ebp
jg 0x14000fcce
mov r13, qword [rdi + rbp*8]
lea rbx, str.__t_n_v_
mov eax, 0x20
jmp 0x14000f941
movzx eax, word [rbx + 2]
add rbx, 2
test ax, ax
je 0x14000faf6
movzx edx, ax
mov rcx, r13
call sub.msvcrt.dll_wcschr
test rax, rax
je 0x14000f930
cmp word [r12], 0
mov edx, 0x8000
lea rax, [0x1400320c0]
je 0x14000f97c
add rax, 2
sub rdx, 1
cmp word [rax], 0
jne 0x14000f965
test rdx, rdx
je 0x14001c888
mov r11d, dword [0x140021664]
mov rcx, qword [rdi + rbp*8]
mov dword [rax], r11d
movzx edx, word [rcx]
cmp dx, 0x5c
jne 0x14000fa73
xor eax, eax
nop dword [rax]
mov r10, rcx
movzx edx, word [rcx + 2]
add rcx, 2
mov r9d, eax
add eax, 1
cmp dx, 0x5c
je 0x14000f9a0
test dx, dx
je 0x14000fc4d
cmp dx, 0x22
je 0x14000fa8a
xor r8d, r8d
test eax, eax
jle 0x14000fa1d
nop dword [rax]
cmp word [r12], 0
mov edx, 0x8000
lea rax, [0x1400320c0]
je 0x14000fa07
nop dword [rax]
add rax, 2
sub rdx, 1
cmp word [rax], 0
jne 0x14000f9f0
test rdx, rdx
je 0x14001c888
mov dword [rax], r14d
lea eax, [r8 + 1]
cmp r9d, r8d
je 0x14000fa18
mov r8d, eax
jmp 0x14000f9d8
movzx edx, word [r10 + 2]
cmp word [r12], 0
je 0x14000faea
mov r8d, 0x8000
lea rax, [0x1400320c0]
nop word cs:[rax + rax]
add rax, 2
sub r8, 1
cmp word [rax], 0
jne 0x14000fa40
test r8, r8
je 0x14000fea1
xor r8d, r8d
add rcx, 2
mov word [rax], dx
mov word [rax + 2], r8w
movzx edx, word [rcx]
cmp dx, 0x5c
je 0x14000f997
test dx, dx
je 0x14000fc9b
cmp dx, 0x22
jne 0x14000fa1d
mov r9d, 1
jmp 0x14000fa94
lea r9d, [rax + rax + 1]
test r9d, r9d
jle 0x14000fa1d
xor r8d, r8d
nop word [rax + rax]
cmp word [r12], 0
mov edx, 0x8000
lea rax, [0x1400320c0]
je 0x14000facf
nop dword [rax]
add rax, 2
sub rdx, 1
cmp word [rax], 0
jne 0x14000fab8
test rdx, rdx
je 0x14001c888
add r8d, 1
mov dword [rax], r14d
cmp r8d, r9d
jne 0x14000faa0
cmp word [r12], 0
movzx edx, word [rcx]
jne 0x14000fa29
lea rax, [0x1400320c0]
jmp 0x14000fa57
mov r8, qword [rdi + rbp*8]
cmp word [r12], 0
mov edx, 0x8000
lea rax, [0x1400320c0]
movzx ecx, word [r8]
je 0x14000fd2c
add rax, 2
sub rdx, 1
cmp word [rax], 0
jne 0x14000fb16
test cx, cx
je 0x14000fb4a
test rdx, rdx
je 0x14001c888
add r8, 2
mov word [rax], cx
add rax, 2
sub rdx, 1
movzx ecx, word [r8]
test cx, cx
jne 0x14000fb29
xor edx, edx
mov word [rax], dx
add rbp, 1
cmp dword [rsp + 0xb0], ebp
jg 0x14000f916
mov rbx, qword [rsp + 0x58]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x48], r15
mov rdx, r12
mov qword [rsp + 0x40], rbx
lea rcx, [0x1400420e0]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14000fe55
mov rcx, qword [rsp + 0x258]
mov rbx, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rbx
mov rcx, qword [rsp + 0x250]
mov dword [rsp + 0x1d0], 0
mov qword [0x1400420c0], rcx
test rcx, rcx
je 0x14000fc1d
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [0x1400420c0]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x14000fc09
mov dword [rsp + 0x1d0], 1
mov rcx, qword [0x1400420c0]
call rbx
mov qword [0x1400420c0], 0
call fcn.140007c10
mov eax, dword [rsp + 0x1d0]
movaps xmm6, xmmword [rsp + 0x350]
movaps xmm7, xmmword [rsp + 0x360]
add rsp, 0x378
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
add eax, eax
test eax, eax
jle 0x14000fc9b
mov r9d, dword [0x140021660]
xor r8d, r8d
cmp word [r12], 0
mov ecx, 0x8000
lea rdx, [0x1400320c0]
je 0x14000fc8f
nop dword [rax]
add rdx, 2
sub rcx, 1
cmp word [rdx], 0
jne 0x14000fc78
test rcx, rcx
je 0x14001c888
add r8d, 1
mov dword [rdx], r9d
cmp r8d, eax
jne 0x14000fc5d
cmp word [r12], 0
mov edx, 0x8000
lea rax, [0x1400320c0]
je 0x14000fcc6
add rax, 2
sub rdx, 1
cmp word [rax], 0
jne 0x14000fcaf
test rdx, rdx
je 0x14001c888
mov dword [rax], r11d
jmp 0x14000fb4f
cmp word [r12], 0
je 0x14000fd23
mov edx, 0x8000
lea rax, [0x1400320c0]
add rax, 2
sub rdx, 1
cmp word [rax], 0
jne 0x14000fce2
test rdx, rdx
je 0x14000fe9c
mov dword [rax], 0x20
jmp 0x14000f91e
mov qword [0x140049108], 0
lea rcx, str.Error__couldnt_allocate_memory.
call fcn.140007bf0
mov rcx, rbx
call fcn.140007b50
lea rax, [0x1400320c0]
jmp 0x14000fcf9
test cx, cx
jne 0x14000fb32
jmp 0x14000fb4a
mov rdx, rdi
xor ecx, ecx
mov r8d, 0x1001
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp word [0x14002e0a0], 0
mov rax, rdi
lea rdx, [rdi + 0x2002]
jne 0x14000fd71
jmp 0x14000fd7b
cmp rax, rdx
je 0x14001c888
add rax, 2
cmp word [rax], 0
jne 0x14000fd68
xor r13d, r13d
mov word [rax], r13w
jmp 0x14000f75f
movabs rax, 0xcccccccccccccccd
mov ecx, 0xffffffff
lea r10, [0x140020d00]
mul rbp
mov rax, rdx
shr rax, 5
lea rdx, [rax + rax*4]
lea rdi, [rax - 1]
mov eax, 0xffffffff
shl rdx, 3
sub rbp, rdx
jmp 0x14000f494
test r12, r12
jne 0x14000f583
mov rcx, rbx
call sub.msvcrt.dll_free
jmp 0x14000f58c
test rdi, rdi
jne 0x14000f53c
mov rcx, rsi
call sub.msvcrt.dll_free
jmp 0x14000f544
lea rcx, str.Error__couldnt_find_attached_data_header.
call fcn.140007bf0
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Error__couldnt_unpack_file_to_target_path.
mov edx, eax
call fcn.140007b80
mov ecx, 2
call sub.msvcrt.dll_exit
lea rcx, str.Error__failed_to_register_signal_handler.
call fcn.140007bf0
mov ecx, 2
call qword [fcn.14001bee0]
lea r8, [0x1400428e0]
lea rdx, str.Error__failed_to_open__ls_for_writing._n
mov rcx, rax
call fcn.1400018e0
mov ecx, 2
call sub.msvcrt.dll_exit
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Error__couldnt_launch_child
mov edx, eax
call fcn.140007b80
mov ecx, 2
call sub.msvcrt.dll_exit
nop dword [rax + rax]
mov rcx, rdx
call sub.msvcrt.dll_free
jmp 0x14000fdc9
mov rcx, rdx
call sub.msvcrt.dll_free
jmp 0x14000fddf
jmp 0x14001c888
jmp 0x14001c888
jmp 0x14001c888
jmp 0x14001c888
jmp 0x14001c888
call sub.msvcrt.dll_abort
nop
nop
nop
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp 0x1400015e0