Function at 0x1400246a0
Capabilities:
Create thread
Enumerate pe sections
Get file size
Read file on windows
Resolve function by parsing pe exports
Terminate thread
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x7b0
mov rax, qword [0x140066018]
xor rax, rsp
mov qword [rsp + 0x7a0], rax
lea rcx, [0x140050b44]
call fcn.1400337c0
xor ecx, ecx
call fcn.140025b60
mov ecx, eax
call fcn.14003329c
cmp dword [rsp + 0x7c0], 1
jne 0x1400246f6
movsd xmm0, qword [0x1400516e8]
call fcn.140023ab0
jmp 0x140024703
movsd xmm0, qword [0x140051718]
call fcn.140023ab0
lea rax, [rsp + 0x560]
mov rdi, rax
xor eax, eax
mov ecx, 0x104
rep stosb byte [rdi], al
mov dword [rsp + 0xa8], 0x104
mov r8d, dword [rsp + 0xa8]
lea rdx, [rsp + 0x560]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp eax, dword [rsp + 0xa8]
jb 0x1400247a4
lea rcx, [0x140050c1c]
call fcn.1400337c0
movzx r8d, byte [rsp + 0x79]
lea rdx, str.Failed_with_exotic_error__closing_now...
lea rcx, [rsp + 0x390]
call fcn.14000c220
mov rcx, rax
call fcn.1400211f0
mov rdx, rax
lea rcx, [0x140067ad0]
call fcn.140016700
lea rdx, [0x140018ad0]
mov rcx, rax
call fcn.14001a750
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 1
jmp 0x140025a82
lea rcx, [rsp + 0x560]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
mov qword [rsp + 0x130], rax
cmp dword [rsp + 0x7c0], 1
jne 0x1400247d3
movsd xmm0, qword [0x1400516f0]
call fcn.140023ab0
jmp 0x1400247e0
movsd xmm0, qword [0x140051720]
call fcn.140023ab0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0x130]
lea r8, [0x14001b220]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0xd0], rax
cmp dword [rsp + 0x7c0], 1
jne 0x14002482b
movsd xmm0, qword [0x1400516f8]
call fcn.140023ab0
jmp 0x140024838
movsd xmm0, qword [0x140051728]
call fcn.140023ab0
call fcn.14001b450
test eax, eax
je 0x1400248bf
lea rcx, [0x140050c2c]
call fcn.1400337c0
movzx r8d, byte [rsp + 0x7b]
lea rdx, str.Close_opened_game...
lea rcx, [rsp + 0x1d0]
call fcn.140011f00
mov rcx, rax
call fcn.140020a70
mov rdx, rax
lea rcx, [0x140067ad0]
call fcn.140016700
lea rdx, [0x140018ad0]
mov rcx, rax
call fcn.14001a750
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rsp + 0xd0]
call sub.ntdll.dll_NtClose
mov eax, 1
jmp 0x140025a82
cmp dword [rsp + 0x7c0], 1
jne 0x1400248d8
movsd xmm0, qword [0x140051700]
call fcn.140023ab0
jmp 0x1400248e5
movsd xmm0, qword [0x140051730]
call fcn.140023ab0
cmp dword [rsp + 0x7c0], 1
jle 0x140025847
mov eax, 8
imul rax, rax, 1
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 3
mov edx, 0x80000000
mov rcx, qword [rsp + 0x7c8]
mov rcx, qword [rcx + rax]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x88], rax
cmp qword [rsp + 0x88], 0xffffffffffffffff
jne 0x1400249a9
lea rcx, [0x140050cd4]
call fcn.1400337c0
movzx r8d, byte [rsp + 0x7c]
lea rdx, str.Failed_to_open_file...
lea rcx, [rsp + 0x1e8]
call fcn.140010e70
mov rcx, rax
call fcn.140020b10
mov rdx, rax
lea rcx, [0x140067ad0]
call fcn.140016700
lea rdx, [0x140018ad0]
mov rcx, rax
call fcn.14001a750
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 1
jmp 0x140025a82
xor edx, edx
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x68], eax
movsd xmm0, qword [0x140051738]
call fcn.140023ab0
mov eax, dword [rsp + 0x68]
mov ecx, eax
call fcn.14002ec58
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jne 0x140024a51
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x140050f1c]
call fcn.1400337c0
movzx r8d, byte [rsp + 0x7d]
lea rdx, str.Fail_memory_allocation...
lea rcx, [rsp + 0x288]
call fcn.14000fc70
mov rcx, rax
call fcn.140020cf0
mov rdx, rax
lea rcx, [0x140067ad0]
call fcn.140016700
lea rdx, [0x140018ad0]
mov rcx, rax
call fcn.14001a750
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 1
jmp 0x140025a82
mov dword [rsp + 0xf8], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0xf8]
mov r8d, dword [rsp + 0x68]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140024b02
mov rcx, qword [rsp + 0x48]
call fcn.14002ec44
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x140050f7c]
call fcn.1400337c0
movzx r8d, byte [rsp + 0x7e]
lea rdx, str.Failed_reading_file...
lea rcx, [rsp + 0x200]
call fcn.1400111d0
mov rcx, rax
call fcn.140020b10
mov rdx, rax
lea rcx, [0x140067ad0]
call fcn.140016700
lea rdx, [0x140018ad0]
mov rcx, rax
call fcn.14001a750
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 1
jmp 0x140025a82
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x140024b39
xor r9d, r9d
lea r8, str.Error
lea rdx, str.CloseHandle_hFile__failed
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 1
jmp 0x140025a82
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
movsd xmm0, qword [0x140051740]
call fcn.140023ab0
mov qword [rsp + 0x98], 0
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x100], rax
mov rax, qword [rsp + 0x100]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140024be7
mov rcx, qword [rsp + 0x48]
call fcn.14002ec44
lea rcx, [0x140050f94]
call fcn.1400337c0
movzx r8d, byte [rsp + 0x7f]
lea rdx, str.Error_in_Validation...
lea rcx, [rsp + 0x218]
call fcn.140011530
mov rcx, rax
call fcn.140020b10
mov rdx, rax
lea rcx, [0x140067ad0]
call fcn.140016700
lea rdx, [0x140018ad0]
mov rcx, rax
call fcn.14001a750
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 1
jmp 0x140025a82
mov rax, qword [rsp + 0x100]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x158], rax
mov dword [rsp + 0x6c], 0
jmp 0x140024c1a
mov eax, dword [rsp + 0x6c]
inc eax
mov dword [rsp + 0x6c], eax
mov rax, qword [rsp + 0x158]
movzx eax, word [rax + 6]
cmp dword [rsp + 0x6c], eax
jge 0x140024c7f
mov rax, qword [rsp + 0x100]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
movsxd rcx, dword [rsp + 0x6c]
imul rcx, rcx, 0x28
lea rax, [rax + rcx + 0x108]
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0x98]
mov eax, dword [rax + 0x14]
mov rcx, qword [rsp + 0x98]
mov ecx, dword [rcx + 0x10]
add rax, rcx
mov qword [rsp + 0x1c8], rax
jmp 0x140024c10
mov rax, qword [rsp + 0x98]
mov eax, dword [rax + 0x14]
mov rcx, qword [rsp + 0x98]
add eax, dword [rcx + 0x10]
mov dword [rsp + 0x64], eax
mov byte [rsp + 0x40], 0
mov eax, dword [rsp + 0x64]
cmp dword [rsp + 0x68], eax
ja 0x140024cad
mov byte [rsp + 0x40], 1
mov eax, dword [rsp + 0x64]
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x108], 0
mov r8d, 0x20
xor edx, edx
lea rcx, [rsp + 0x430]
call fcn.140029b90
call fcn.14001c540
test eax, eax
jne 0x140024d56
mov rcx, qword [rsp + 0x48]
call fcn.14002ec44
lea rcx, [0x140050fac]
call fcn.1400337c0
movzx r8d, byte [rsp + 0x70]
lea rdx, str.Failed_picking_server...
lea rcx, [rsp + 0x268]
call fcn.1400103d0
mov rcx, rax
call fcn.140020c50
mov rdx, rax
lea rcx, [0x140067ad0]
call fcn.140016700
lea rdx, [0x140018ad0]
mov rcx, rax
call fcn.14001a750
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 1
jmp 0x140025a82
movsd xmm0, qword [0x140051748]
call fcn.140023ab0
lea rcx, [rsp + 0xb0]
call fcn.1400194f0
nop
movzx r8d, byte [rsp + 0x7a]
lea rdx, str._loader_new_.loader_version.txt
lea rcx, [rsp + 0x2c8]
call fcn.14000e6a0
mov rcx, rax
call fcn.140020ed0
xor r8d, r8d
lea rdx, [rsp + 0xb0]
mov rcx, rax
call fcn.14001b0f0
movzx eax, al
test eax, eax
jne 0x140024e36
mov rcx, qword [rsp + 0x48]
call fcn.14002ec44
lea rcx, [0x140050fd4]
call fcn.1400337c0
movzx r8d, byte [rsp + 0x71]
lea rdx, str.Failed_to_grab_current_version...
lea rcx, [rsp + 0x340]
call fcn.14000d820
mov rcx, rax
call fcn.140021010
mov rdx, rax
lea rcx, [0x140067ad0]
call fcn.140016700
lea rdx, [0x140018ad0]
mov rcx, rax
call fcn.14001a750
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rsp + 0x110], 1
lea rcx, [rsp + 0xb0]
call fcn.14001a0c0
mov eax, dword [rsp + 0x110]
jmp 0x140025a82
movsd xmm0, qword [0x140051750]
call fcn.140023ab0
movzx eax, byte [rsp + 0x40]
test eax, eax
jne 0x140024fd2
mov r8d, 0x20
xor edx, edx
lea rcx, [rsp + 0x3f0]
call fcn.140029b90
mov byte [rsp + 0x41], 0
mov dword [rsp + 0x44], 0
jmp 0x140024e7e
mov eax, dword [rsp + 0x44]
inc eax
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0x20
jge 0x140024f83
movsxd rax, dword [rsp + 0x44]
mov rcx, qword [rsp + 0x58]
movsx eax, byte [rcx + rax]
cmp eax, 0x79
jne 0x140024f7e
mov eax, dword [rsp + 0x44]
inc eax
cdqe
mov rcx, qword [rsp + 0x58]
movsx eax, byte [rcx + rax]
cmp eax, 0x79
jne 0x140024f7e
movsxd rax, dword [rsp + 0x44]
mov r8, rax
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0x3f0]
call fcn.1400294e0
movsxd rax, dword [rsp + 0x44]
mov qword [rsp + 0x138], rax
cmp qword [rsp + 0x138], 0x20
jae 0x140024eee
jmp 0x140024ef3
call fcn.140025e34
mov rax, qword [rsp + 0x138]
mov byte [rsp + rax + 0x3f0], 0
mov eax, dword [rsp + 0x44]
add eax, 2
cdqe
mov rcx, qword [rsp + 0x58]
add rcx, rax
mov rax, rcx
mov r8d, 0x20
mov rdx, rax
lea rcx, [rsp + 0x430]
call fcn.1400294e0
mov eax, dword [rsp + 0x44]
add eax, 0x24
cdqe
mov rcx, qword [rsp + 0x58]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x108], rax
mov eax, dword [rsp + 0x44]
add eax, 0x22
cdqe
mov rcx, qword [rsp + 0x58]
movsx eax, byte [rcx + rax]
cmp eax, 0x79
jne 0x140024f77
mov eax, dword [rsp + 0x44]
add eax, 0x23
cdqe
mov rcx, qword [rsp + 0x58]
movsx eax, byte [rcx + rax]
cmp eax, 0x79
je 0x140024f7c
mov byte [rsp + 0x41], 1
jmp 0x140024f83
jmp 0x140024e74
movzx eax, byte [rsp + 0x41]
test eax, eax
jne 0x140024fcd
lea rcx, [rsp + 0xb0]
call fcn.140023fc0
mov qword [rsp + 0x160], rax
lea rcx, [rsp + 0xb0]
call fcn.140020370
mov rcx, qword [rsp + 0x160]
mov r8, rcx
lea rdx, [rsp + 0x3f0]
mov rcx, rax
call fcn.140029f50
test eax, eax
je 0x140024fd2
mov byte [rsp + 0x40], 1
call fcn.140023210
movzx eax, al
test eax, eax
jne 0x14002500d
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rsp + 0xd8], 1
lea rcx, [rsp + 0xb0]
call fcn.14001a0c0
mov eax, dword [rsp + 0xd8]
jmp 0x140025a82
movzx eax, byte [rsp + 0x40]
test eax, eax
je 0x14002573d
lea rcx, [rsp + 0x118]
call fcn.1400194f0
nop
lea rcx, [0x140050950]
call fcn.1400337c0
movzx r8d, byte [rsp + 0x72]
lea rdx, str.Updating_loader__please_wait...
lea rcx, [rsp + 0x2f0]
call fcn.14000eb40
mov rcx, rax
call fcn.140020ed0
mov rdx, rax
lea rcx, [0x140067ad0]
call fcn.140016700
lea rdx, [0x140018ad0]
mov rcx, rax
call fcn.14001a750
movzx r8d, byte [rsp + 0x73]
lea rdx, str._loader_new_.loader.exe
lea rcx, [rsp + 0x248]
call fcn.140010af0
mov rcx, rax
call fcn.140020bb0
mov r8b, 1
lea rdx, [rsp + 0x118]
mov rcx, rax
call fcn.14001b0f0
movzx eax, al
test eax, eax
jne 0x140025147
mov rcx, qword [rsp + 0x48]
call fcn.14002ec44
lea rcx, [0x140050954]
call fcn.1400337c0
movzx r8d, byte [rsp + 0x74]
lea rdx, str.Failed_to_grab_current_loader...
lea rcx, [rsp + 0x318]
call fcn.14000e1e0
mov rcx, rax
call fcn.140020f70
mov rdx, rax
lea rcx, [0x140067ad0]
call fcn.140016700
lea rdx, [0x140018ad0]
mov rcx, rax
call fcn.14001a750
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rsp + 0xdc], 1
lea rcx, [rsp + 0x118]
call fcn.14001a0c0
nop
lea rcx, [rsp + 0xb0]
call fcn.14001a0c0
mov eax, dword [rsp + 0xdc]
jmp 0x140025a82
mov r8d, 0x20
xor edx, edx
lea rcx, [rsp + 0x410]
call fcn.140029b90
mov edx, 0x20
lea rcx, [rsp + 0x410]
call fcn.14001b830
lea rcx, [rsp + 0x140]
call fcn.1400194f0
nop
lea rcx, [rsp + 0x118]
call fcn.140023fc0
xor edx, edx
mov ecx, 0x20
div rcx
mov rax, rdx
mov ecx, 0x20
sub rcx, rax
mov rax, rcx
mov byte [rsp + 0x50], al
lea rcx, [rsp + 0x118]
call fcn.140023fc0
movzx ecx, byte [rsp + 0x50]
add rax, rcx
mov rdx, rax
lea rcx, [rsp + 0x140]
call fcn.140023dc0
lea rcx, [rsp + 0x118]
call fcn.140023fc0
mov qword [rsp + 0x168], rax
lea rcx, [rsp + 0x140]
call fcn.140020370
mov qword [rsp + 0x170], rax
lea rcx, [rsp + 0x118]
call fcn.140020370
lea r9, [rsp + 0x410]
mov rcx, qword [rsp + 0x168]
mov r8, rcx
mov rcx, qword [rsp + 0x170]
mov rdx, rcx
mov rcx, rax
call fcn.140023eb0
mov eax, dword [rsp + 0x64]
mov qword [rsp + 0x178], rax
lea rcx, [rsp + 0xb0]
call fcn.140023fc0
mov rcx, qword [rsp + 0x178]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x180], rax
lea rcx, [rsp + 0x140]
call fcn.140023fc0
mov rcx, qword [rsp + 0x180]
lea rax, [rcx + rax + 0x24]
mov dword [rsp + 0xac], eax
mov eax, dword [rsp + 0xac]
mov edx, eax
mov rcx, qword [rsp + 0x48]
call fcn.140033260
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x64]
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0xb0]
call fcn.140023fc0
mov qword [rsp + 0x188], rax
lea rcx, [rsp + 0xb0]
call fcn.140020370
mov rcx, qword [rsp + 0x188]
mov r8, rcx
mov rdx, rax
mov rcx, qword [rsp + 0x58]
call fcn.1400294e0
lea rcx, [rsp + 0xb0]
call fcn.140023fc0
mov rcx, qword [rsp + 0x58]
add rcx, rax
mov rax, rcx
mov r8d, 2
lea rdx, [0x1400509b4]
mov rcx, rax
call fcn.1400294e0
lea rcx, [rsp + 0xb0]
call fcn.140023fc0
mov rcx, qword [rsp + 0x58]
lea rax, [rcx + rax + 2]
mov r8d, 0x20
lea rdx, [rsp + 0x410]
mov rcx, rax
call fcn.1400294e0
lea rcx, [rsp + 0xb0]
call fcn.140023fc0
mov rcx, qword [rsp + 0x58]
lea rax, [rcx + rax + 0x22]
mov r8d, 2
lea rdx, [0x1400509b8]
mov rcx, rax
call fcn.1400294e0
lea rcx, [rsp + 0x140]
call fcn.140023fc0
mov qword [rsp + 0x190], rax
lea rcx, [rsp + 0x140]
call fcn.140020370
mov qword [rsp + 0x198], rax
lea rcx, [rsp + 0xb0]
call fcn.140023fc0
mov rcx, qword [rsp + 0x58]
lea rax, [rcx + rax + 0x24]
mov rcx, qword [rsp + 0x190]
mov r8, rcx
mov rcx, qword [rsp + 0x198]
mov rdx, rcx
mov rcx, rax
call fcn.1400294e0
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rsp + 0x7c8]
mov rdx, qword [rcx + rax]
lea rcx, [rsp + 0x450]
call fcn.140018c40
mov dword [rsp + 0x60], 1
jmp 0x1400253f8
mov eax, dword [rsp + 0x60]
inc eax
mov dword [rsp + 0x60], eax
movsxd rax, dword [rsp + 0x60]
mov qword [rsp + 0x1a0], rax
lea rcx, [rsp + 0x450]
call fcn.1400331b0
mov rcx, qword [rsp + 0x1a0]
cmp rcx, rax
jae 0x140025474
lea rcx, [rsp + 0x450]
call fcn.1400331b0
movsxd rcx, dword [rsp + 0x60]
sub rax, rcx
movsx eax, byte [rsp + rax + 0x450]
cmp eax, 0x2e
jne 0x14002546f
lea rcx, [rsp + 0x450]
call fcn.1400331b0
movsxd rcx, dword [rsp + 0x60]
sub rax, rcx
lea rax, [rsp + rax + 0x450]
lea rdx, str.___Updated.exe
mov rcx, rax
call fcn.140032bf0
jmp 0x140025474
jmp 0x1400253ee
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
lea rcx, [rsp + 0x450]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0xc8], rax
cmp qword [rsp + 0xc8], 0xffffffffffffffff
jne 0x1400255b6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xe0], eax
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rsp + 0x7c8]
mov r9, qword [rcx + rax]
mov r8d, dword [rsp + 0xe0]
lea rdx, str.Fail_open_with_0x_08X__s
lea rcx, [rsp + 0x670]
call fcn.140018c00
xor r9d, r9d
lea r8, [0x1400509ec]
lea rdx, [rsp + 0x670]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, qword [rsp + 0x48]
call fcn.14002ec44
lea rcx, [0x1400509bc]
call fcn.1400337c0
movzx r8d, byte [rsp + 0x75]
lea rdx, str.Cant_open_file_for_writing...
lea rcx, [rsp + 0x2a8]
call fcn.14000efe0
mov rcx, rax
call fcn.140020e30
mov rdx, rax
lea rcx, [0x140067ad0]
call fcn.140016700
lea rdx, [0x140018ad0]
mov rcx, rax
call fcn.14001a750
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rsp + 0xe4], 1
lea rcx, [rsp + 0x140]
call fcn.14001a0c0
nop
lea rcx, [rsp + 0x118]
call fcn.14001a0c0
nop
lea rcx, [rsp + 0xb0]
call fcn.14001a0c0
mov eax, dword [rsp + 0xe4]
jmp 0x140025a82
mov dword [rsp + 0xf4], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0xf4]
mov r8d, dword [rsp + 0xac]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1400256a4
mov rcx, qword [rsp + 0x48]
call fcn.14002ec44
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x1400509f4]
call fcn.1400337c0
movzx r8d, byte [rsp + 0x76]
lea rdx, str.Cant_write_to_file...
lea rcx, [rsp + 0x230]
call fcn.140011890
mov rcx, rax
call fcn.140020b10
mov rdx, rax
lea rcx, [0x140067ad0]
call fcn.140016700
lea rdx, [0x140018ad0]
mov rcx, rax
call fcn.14001a750
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rsp + 0xe8], 1
lea rcx, [rsp + 0x140]
call fcn.14001a0c0
nop
lea rcx, [rsp + 0x118]
call fcn.14001a0c0
nop
lea rcx, [rsp + 0xb0]
call fcn.14001a0c0
mov eax, dword [rsp + 0xe8]
jmp 0x140025a82
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx r8d, byte [rsp + 0x77]
lea rdx, str.Updated_loader__please_restart...
lea rcx, [rsp + 0x368]
call fcn.14000dd00
mov rcx, rax
call fcn.140021010
mov rdx, rax
lea rcx, [0x140067ad0]
call fcn.140016700
lea rdx, [0x140018ad0]
mov rcx, rax
call fcn.14001a750
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rsp + 0xec], 0
lea rcx, [rsp + 0x140]
call fcn.14001a0c0
nop
lea rcx, [rsp + 0x118]
call fcn.14001a0c0
nop
lea rcx, [rsp + 0xb0]
call fcn.14001a0c0
mov eax, dword [rsp + 0xec]
jmp 0x140025a82
movsd xmm0, qword [0x140051758]
call fcn.140023ab0
lea rcx, [rsp + 0x1b0]
call fcn.1400194f0
nop
mov eax, dword [rsp + 0x64]
mov ecx, dword [rsp + 0x68]
sub ecx, eax
mov eax, ecx
mov eax, eax
mov edx, eax
lea rcx, [rsp + 0x1b0]
call fcn.140023dc0
mov eax, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x108]
sub rdx, rcx
mov rcx, rdx
sub rax, rcx
mov qword [rsp + 0x1a8], rax
lea rcx, [rsp + 0x1b0]
call fcn.140020370
lea r9, [rsp + 0x430]
mov rcx, qword [rsp + 0x1a8]
mov r8, rcx
mov rdx, rax
mov rcx, qword [rsp + 0x108]
call fcn.140023df0
lea rcx, [rsp + 0x1b0]
call fcn.140020370
xor r8d, r8d
mov rdx, qword [rsp + 0x130]
mov rcx, rax
call fcn.14001b8a0
mov rcx, qword [rsp + 0x48]
call fcn.14002ec44
movsd xmm0, qword [0x140051760]
call fcn.140023ab0
xor edx, edx
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rsp + 0xd0]
call sub.ntdll.dll_NtClose
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rcx, [rsp + 0x1b0]
call fcn.14001a0c0
nop
lea rcx, [rsp + 0xb0]
call fcn.14001a0c0
jmp 0x140025a80
cmp dword [rsp + 0x7c0], 1
jne 0x140025a2e
mov eax, 8
imul rax, rax, 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 3
mov edx, 0x80000000
mov rcx, qword [rsp + 0x7c8]
mov rcx, qword [rcx + rax]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x80], rax
cmp qword [rsp + 0x80], 0xffffffffffffffff
jne 0x1400258b4
mov eax, 1
jmp 0x140025a82
xor edx, edx
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x90], eax
movsd xmm0, qword [0x140051708]
call fcn.140023ab0
mov eax, dword [rsp + 0x90]
mov r9d, 4
mov r8d, 0x3000
mov edx, eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0xa0], rax
cmp qword [rsp + 0xa0], 0
jne 0x14002593d
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x140025933
xor r9d, r9d
lea r8, [0x140050a54]
lea rdx, [0x140050a60]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 1
jmp 0x140025a82
mov dword [rsp + 0xf0], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0xf0]
mov r8d, dword [rsp + 0x90]
mov rdx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400259c6
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x1400259bc
xor r9d, r9d
lea r8, [0x140050a7c]
lea rdx, [0x140050a90]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 1
jmp 0x140025a82
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x1400259f1
xor r9d, r9d
lea r8, [0x140050aac]
lea rdx, [0x140050ab8]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
movsd xmm0, qword [0x140051710]
call fcn.140023ab0
mov r8b, 1
lea rdx, [rsp + 0x560]
mov rcx, qword [rsp + 0xa0]
call fcn.14001b8a0
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x140025a80
movzx r8d, byte [rsp + 0x78]
lea rdx, str.Failed_with_unknown_error__closing_now...
lea rcx, [rsp + 0x3c0]
call fcn.14000bc20
mov rcx, rax
call fcn.140021290
mov rdx, rax
lea rcx, [0x140067ad0]
call fcn.140016700
lea rdx, [0x140018ad0]
mov rcx, rax
call fcn.14001a750
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 1
jmp 0x140025a82
xor eax, eax
mov rcx, qword [rsp + 0x7a0]
xor rcx, rsp
call fcn.140025cc0
add rsp, 0x7b0
pop rdi
ret