Function at 0x1400477b0
Capabilities:
Create directory
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xf0
mov rsi, rcx
xor r14d, r14d
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov qword [rbp + 0x6f], rax
lea rcx, [rbp + 0x6f]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__localtime64]
call fcn.140047f80
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
lea ecx, [r14 + 0x30]
call fcn.14008250c
mov rcx, rax
mov qword [rsp + 0x20], rax
movdqa xmm0, xmmword [0x1400d0770]
movdqu xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [str.https:__access.chairfbi.com_loader_version_NoUi]
movups xmmword [rax], xmm1
movups xmm0, xmmword [0x1400d02f8]
movups xmmword [rax + 0x10], xmm0
movsd xmm0, qword [0x1400d0308]
movsd qword [rax + 0x20], xmm0
mov eax, dword [0x1400d0310]
mov dword [rcx + 0x28], eax
movzx eax, word [0x1400d0314]
mov word [rcx + 0x2c], ax
movzx eax, byte [0x1400d0316]
mov byte [rcx + 0x2e], al
mov byte [rcx + 0x2f], r14b
lea r12, [0x1401c1cf8]
mov rdx, r12
cmp qword [0x1401c1d10], 0xf
cmova rdx, qword [0x1401c1cf8]
mov r8, qword [0x1401c1d08]
lea rcx, [rsp + 0x20]
call fcn.14004b710
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rbp - 0x79], r14
mov qword [rbp - 0x71], r14
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x79], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], r14b
lea r8, [rsp + 0x40]
lea rdx, [rbp - 0x29]
mov rcx, rbx
call fcn.14006b0a0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x140047910
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004790b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004790b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140082548
movdqa xmm0, xmmword [0x1400c74f0]
movdqu xmmword [rsp + 0x30], xmm0
mov byte [rsp + 0x20], 0
lea rcx, [rbp - 9]
call fcn.140004d20
cmp qword [rax + 0x18], 0xf
jbe 0x140047936
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__mkdir]
mov rdx, qword [rbp + 0xf]
cmp rdx, 0xf
jbe 0x14004797d
inc rdx
mov rcx, qword [rbp - 9]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140047978
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140047978
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140082548
lea rdi, [rbp - 0x29]
cmp qword [rbp - 0x11], 0xf
cmova rdi, qword [rbp - 0x29]
lea rcx, [rbp - 9]
call fcn.140004d20
mov rbx, rax
cmp qword [rax + 0x18], 0xf
jbe 0x1400479a1
mov rbx, qword [rax]
xorps xmm0, xmm0
movups xmmword [rbp - 0x49], xmm0
mov qword [rbp - 0x39], r14
mov qword [rbp - 0x31], r14
mov ecx, 0x20
call fcn.14008250c
mov qword [rbp - 0x49], rax
mov qword [rbp - 0x39], 0x10
mov qword [rbp - 0x31], 0x1f
movups xmm0, xmmword [str._s_s_laddon.exe]
movups xmmword [rax], xmm0
mov byte [rax + 0x10], 0
mov r9, rdi
mov r8, rbx
lea rdx, [rbp - 0x49]
lea rcx, [rbp - 0x69]
call fcn.14004b7b0
nop
mov rdx, qword [rbp + 0xf]
cmp rdx, 0xf
jbe 0x140047a2e
inc rdx
mov rcx, qword [rbp - 9]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140047a29
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140047a29
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140082548
movdqa xmm0, xmmword [0x1400c74f0]
movdqu xmmword [rbp + 7], xmm0
mov byte [rbp - 9], 0
lea r8, [rbp - 0x29]
cmp qword [rbp - 0x11], 0xf
cmova r8, qword [rbp - 0x29]
mov word [rsp + 0x2e], r14w
mov qword [rsp + 0x30], 0xd
mov qword [rsp + 0x38], 0xf
movsd xmm0, qword [str._s_laddon.exe]
movsd qword [rsp + 0x20], xmm0
mov eax, dword [0x1400d0338]
mov dword [rsp + 0x28], eax
movzx eax, byte [0x1400d033c]
mov byte [rsp + 0x2c], al
mov byte [rsp + 0x2d], 0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.14004b7b0
mov rcx, rax
call fcn.140046f70
lea rcx, [rbp - 0x69]
call fcn.140004c90
test al, al
jne 0x140047dca
call fcn.140047f80
mov r13, rax
mov r15, qword [0x1401c1d08]
movabs rax, 0x7fffffffffffffff
mov rcx, rax
sub rcx, r15
cmp rcx, 0x2b
jb 0x140047e46
cmp qword [0x1401c1d10], 0xf
cmova r12, qword [0x1401c1cf8]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], r14
lea r14, [r15 + 0x2b]
mov ebx, 0xf
lea rdi, [rsp + 0x20]
cmp r14, rbx
jbe 0x140047b90
mov rbx, r14
or rbx, 0xf
cmp rbx, rax
jbe 0x140047b4b
mov rbx, rax
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14008250c
test rax, rax
je 0x140047b73
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140047b8b
mov eax, 0x16
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140047b7a
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140047e4c
jmp 0x140047b30
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140047b89
call fcn.14008250c
mov rdi, rax
jmp 0x140047b8b
xor edi, edi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], rbx
movups xmm0, xmmword [str.https:__access.chairfbi.com_loader_url_NoUi]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [0x1400d0350]
movups xmmword [rdi + 0x10], xmm1
movsd xmm0, qword [0x1400d0360]
movsd qword [rdi + 0x20], xmm0
movzx eax, word [0x1400d0368]
mov word [rdi + 0x28], ax
movzx eax, byte [0x1400d036a]
mov byte [rdi + 0x2a], al
lea rcx, [rdi + 0x2b]
mov r8, r15
mov rdx, r12
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r14], 0
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x40]
mov rcx, r13
call fcn.14006b0a0
nop
call fcn.140047f80
mov rbx, rax
lea rax, [rbp - 0x49]
mov qword [rbp + 0x77], rax
lea rdx, [rbp - 0x69]
cmp qword [rbp - 0x51], 0xf
cmova rdx, qword [rbp - 0x69]
xorps xmm0, xmm0
movups xmmword [rbp - 0x49], xmm0
xor r14d, r14d
mov qword [rbp - 0x39], r14
mov qword [rbp - 0x31], r14
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rdx + r8], r14b
jne 0x140047c30
lea rcx, [rbp - 0x49]
call fcn.140002640
nop
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 9]
call fcn.1400035f0
nop
lea r8, [rbp - 0x49]
mov rdx, rax
mov rcx, rbx
call fcn.14006aa60
test al, al
jne 0x140047d8b
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp - 0x69]
cmp qword [rbp - 0x51], 0xf
cmova rcx, qword [rbp - 0x69]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.Failed_to_download_loader_addon
call fcn.140008a60
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r14
mov qword [rsi + 0x18], 0xf
mov byte [rsi], 0
mov rdx, qword [rbp - 0x71]
cmp rdx, 0xf
jbe 0x140047ce5
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140047ce0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140047dbe
call fcn.140082548
movdqa xmm0, xmmword [0x1400c74f0]
movdqu xmmword [rbp - 0x79], xmm0
mov byte [rsp + 0x40], 0
mov rdx, qword [rbp - 0x51]
cmp rdx, 0xf
jbe 0x140047d35
inc rdx
mov rcx, qword [rbp - 0x69]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140047d30
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140047d30
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140082548
movdqa xmm0, xmmword [0x1400c74f0]
movdqu xmmword [rbp - 0x59], xmm0
mov byte [rbp - 0x69], 0
mov rdx, qword [rbp - 0x11]
cmp rdx, 0xf
jbe 0x140047e28
inc rdx
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140047e23
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140047e23
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rdx, qword [rbp - 0x71]
cmp rdx, 0xf
jbe 0x140047dca
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140047dc5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140047dc5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140082548
movups xmm0, xmmword [rbp - 0x69]
movups xmmword [rsi], xmm0
movups xmm1, xmmword [rbp - 0x59]
movups xmmword [rsi + 0x10], xmm1
movdqa xmm0, xmmword [0x1400c74f0]
movdqu xmmword [rbp - 0x59], xmm0
mov byte [rbp - 0x69], 0
mov rdx, qword [rbp - 0x11]
cmp rdx, 0xf
jbe 0x140047e28
inc rdx
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140047e23
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140047e23
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140082548
mov rax, rsi
mov rbx, qword [rsp + 0x130]
add rsp, 0xf0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140005a60
nop
call fcn.1400059a0
int3