Function at 0x1400498c0
Capabilities:
Create directory
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xf0
mov rsi, rcx
xor r14d, r14d
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov qword [rbp + 0x6f], rax
lea rcx, [rbp + 0x6f]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__localtime64]
call fcn.14004a090
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
lea ecx, [r14 + 0x30]
call fcn.1400848cc
mov rcx, rax
mov qword [rsp + 0x20], rax
movdqa xmm0, xmmword [0x1400d2850]
movdqu xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [str.https:__access.chairfbi.com_loader_version_NoUi]
movups xmmword [rax], xmm1
movups xmm0, xmmword [0x1400d23c0]
movups xmmword [rax + 0x10], xmm0
movsd xmm0, qword [0x1400d23d0]
movsd qword [rax + 0x20], xmm0
mov eax, dword [0x1400d23d8]
mov dword [rcx + 0x28], eax
movzx eax, word [0x1400d23dc]
mov word [rcx + 0x2c], ax
movzx eax, byte [0x1400d23de]
mov byte [rcx + 0x2e], al
mov byte [rcx + 0x2f], r14b
lea r12, [0x1401c3cf8]
mov rdx, r12
cmp qword [0x1401c3d10], 0xf
cmova rdx, qword [0x1401c3cf8]
mov r8, qword [0x1401c3d08]
lea rcx, [rsp + 0x20]
call fcn.14004da80
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rbp - 0x79], r14
mov qword [rbp - 0x71], r14
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x79], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], r14b
lea r8, [rsp + 0x40]
lea rdx, [rbp - 0x29]
mov rcx, rbx
call fcn.14006d460
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x140049a20
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049a1b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140049a1b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140084908
movdqa xmm0, xmmword [0x1400c94f0]
movdqu xmmword [rsp + 0x30], xmm0
mov byte [rsp + 0x20], 0
lea rcx, [rbp - 9]
call fcn.140004d20
cmp qword [rax + 0x18], 0xf
jbe 0x140049a46
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__mkdir]
mov rdx, qword [rbp + 0xf]
cmp rdx, 0xf
jbe 0x140049a8d
inc rdx
mov rcx, qword [rbp - 9]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049a88
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140049a88
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140084908
lea rdi, [rbp - 0x29]
cmp qword [rbp - 0x11], 0xf
cmova rdi, qword [rbp - 0x29]
lea rcx, [rbp - 9]
call fcn.140004d20
mov rbx, rax
cmp qword [rax + 0x18], 0xf
jbe 0x140049ab1
mov rbx, qword [rax]
xorps xmm0, xmm0
movups xmmword [rbp - 0x49], xmm0
mov qword [rbp - 0x39], r14
mov qword [rbp - 0x31], r14
mov ecx, 0x20
call fcn.1400848cc
mov qword [rbp - 0x49], rax
mov qword [rbp - 0x39], 0x10
mov qword [rbp - 0x31], 0x1f
movups xmm0, xmmword [str._s_s_laddon.exe]
movups xmmword [rax], xmm0
mov byte [rax + 0x10], 0
mov r9, rdi
mov r8, rbx
lea rdx, [rbp - 0x49]
lea rcx, [rbp - 0x69]
call fcn.14004db70
nop
mov rdx, qword [rbp + 0xf]
cmp rdx, 0xf
jbe 0x140049b3e
inc rdx
mov rcx, qword [rbp - 9]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049b39
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140049b39
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140084908
movdqa xmm0, xmmword [0x1400c94f0]
movdqu xmmword [rbp + 7], xmm0
mov byte [rbp - 9], 0
lea r8, [rbp - 0x29]
cmp qword [rbp - 0x11], 0xf
cmova r8, qword [rbp - 0x29]
mov word [rsp + 0x2e], r14w
mov qword [rsp + 0x30], 0xd
mov qword [rsp + 0x38], 0xf
movsd xmm0, qword [str._s_laddon.exe]
movsd qword [rsp + 0x20], xmm0
mov eax, dword [0x1400d2400]
mov dword [rsp + 0x28], eax
movzx eax, byte [0x1400d2404]
mov byte [rsp + 0x2c], al
mov byte [rsp + 0x2d], 0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.14004db70
mov rcx, rax
call fcn.140049080
lea rcx, [rbp - 0x69]
call fcn.140004c90
test al, al
jne 0x140049eda
call fcn.14004a090
mov r13, rax
mov r15, qword [0x1401c3d08]
movabs rax, 0x7fffffffffffffff
mov rcx, rax
sub rcx, r15
cmp rcx, 0x2b
jb 0x140049f56
cmp qword [0x1401c3d10], 0xf
cmova r12, qword [0x1401c3cf8]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], r14
lea r14, [r15 + 0x2b]
mov ebx, 0xf
lea rdi, [rsp + 0x20]
cmp r14, rbx
jbe 0x140049ca0
mov rbx, r14
or rbx, 0xf
cmp rbx, rax
jbe 0x140049c5b
mov rbx, rax
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400848cc
test rax, rax
je 0x140049c83
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140049c9b
mov eax, 0x16
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140049c8a
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140049f5c
jmp 0x140049c40
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140049c99
call fcn.1400848cc
mov rdi, rax
jmp 0x140049c9b
xor edi, edi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], rbx
movups xmm0, xmmword [str.https:__access.chairfbi.com_loader_url_NoUi]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [0x1400d2418]
movups xmmword [rdi + 0x10], xmm1
movsd xmm0, qword [0x1400d2428]
movsd qword [rdi + 0x20], xmm0
movzx eax, word [0x1400d2430]
mov word [rdi + 0x28], ax
movzx eax, byte [0x1400d2432]
mov byte [rdi + 0x2a], al
lea rcx, [rdi + 0x2b]
mov r8, r15
mov rdx, r12
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r14], 0
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x40]
mov rcx, r13
call fcn.14006d460
nop
call fcn.14004a090
mov rbx, rax
lea rax, [rbp - 0x49]
mov qword [rbp + 0x77], rax
lea rdx, [rbp - 0x69]
cmp qword [rbp - 0x51], 0xf
cmova rdx, qword [rbp - 0x69]
xorps xmm0, xmm0
movups xmmword [rbp - 0x49], xmm0
xor r14d, r14d
mov qword [rbp - 0x39], r14
mov qword [rbp - 0x31], r14
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rdx + r8], r14b
jne 0x140049d40
lea rcx, [rbp - 0x49]
call fcn.140002640
nop
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 9]
call fcn.1400035f0
nop
lea r8, [rbp - 0x49]
mov rdx, rax
mov rcx, rbx
call fcn.14006ce20
test al, al
jne 0x140049e9b
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp - 0x69]
cmp qword [rbp - 0x51], 0xf
cmova rcx, qword [rbp - 0x69]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.Failed_to_download_loader_addon
call fcn.140008a60
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r14
mov qword [rsi + 0x18], 0xf
mov byte [rsi], 0
mov rdx, qword [rbp - 0x71]
cmp rdx, 0xf
jbe 0x140049df5
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049df0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140049ece
call fcn.140084908
movdqa xmm0, xmmword [0x1400c94f0]
movdqu xmmword [rbp - 0x79], xmm0
mov byte [rsp + 0x40], 0
mov rdx, qword [rbp - 0x51]
cmp rdx, 0xf
jbe 0x140049e45
inc rdx
mov rcx, qword [rbp - 0x69]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049e40
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140049e40
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140084908
movdqa xmm0, xmmword [0x1400c94f0]
movdqu xmmword [rbp - 0x59], xmm0
mov byte [rbp - 0x69], 0
mov rdx, qword [rbp - 0x11]
cmp rdx, 0xf
jbe 0x140049f38
inc rdx
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049f33
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140049f33
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rdx, qword [rbp - 0x71]
cmp rdx, 0xf
jbe 0x140049eda
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049ed5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140049ed5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140084908
movups xmm0, xmmword [rbp - 0x69]
movups xmmword [rsi], xmm0
movups xmm1, xmmword [rbp - 0x59]
movups xmmword [rsi + 0x10], xmm1
movdqa xmm0, xmmword [0x1400c94f0]
movdqu xmmword [rbp - 0x59], xmm0
mov byte [rbp - 0x69], 0
mov rdx, qword [rbp - 0x11]
cmp rdx, 0xf
jbe 0x140049f38
inc rdx
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049f33
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140049f33
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140084908
mov rax, rsi
mov rbx, qword [rsp + 0x130]
add rsp, 0xf0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140005a60
nop
call fcn.1400059a0
int3