Function at 0x14001b9f0
Capabilities:
Check if file exists
Create process on windows
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rax, qword [0x1400590c0]
xor rax, rsp
mov qword [rbp + 0x80], rax
mov r13, rdx
xor r15d, r15d
call fcn.14001aab0
movzx r14d, al
lea rcx, [rsp + 0x60]
call fcn.140019bf0
mov rbx, qword [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edi, eax
lea rdx, [rbx - 0x18]
mov rsi, 0xffffffffffffffff
mov ecx, esi
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x14001ba72
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
mov rcx, qword [r13]
cmp dword [rcx - 0x10], r15d
jl 0x14001ba9c
lea rdx, str._noreplace
call fcn.14001ea78
test rax, rax
je 0x14001ba9c
sub rax, qword [r13]
sar rax, 1
test eax, eax
jns 0x14001c37f
test r14b, r14b
je 0x14001c37f
test edi, edi
je 0x14001c37f
xor edx, edx
lea rcx, [rsp + 0x70]
call fcn.140019360
nop
lea r8, str.new_
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x80]
call fcn.140002620
nop
lea r8, str.new_Aliworkbench.exe
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x78]
call fcn.140002620
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x30], xmm1
mov rdx, qword [rsp + 0x78]
mov r8, rsi
nop dword [rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x14001bb00
lea rcx, [rbp + 0x20]
call fcn.140001850
nop
mov rcx, qword [rbp + 0x30]
mov rdx, qword [rbp + 0x38]
mov rax, rdx
sub rax, rcx
mov r14d, 1
lea r12, [0x14004548c]
cmp rax, r14
jb 0x14001bbbf
lea r8, [rcx + 1]
mov qword [rbp + 0x30], r8
lea r15, [rbp + 0x20]
cmp rdx, 7
cmova r15, qword [rbp + 0x20]
lea rax, [0x14004548e]
cmp rax, r15
jbe 0x14001bb77
lea rax, [r15 + rcx*2]
cmp r12, rax
ja 0x14001bb77
cmp r15, r12
ja 0x14001bb6c
xor edi, edi
jmp 0x14001bb7a
mov rdi, r15
sub rdi, r12
sar rdi, 1
jmp 0x14001bb7a
mov rdi, r14
lea rcx, [r15 + 2]
add r8, r8
mov rdx, r15
call fcn.14003f6b0
lea rbx, [rdi + rdi]
mov r8, rbx
mov rdx, r12
mov rcx, r15
call fcn.14003f6b0
lea rdx, [r12 + 2]
lea rdx, [rdx + rdi*2]
lea rcx, [rbx + r15]
mov r8, r14
sub r8, rdi
add r8, r8
call fcn.14003f6b0
lea rax, [rbp + 0x20]
xor r15d, r15d
jmp 0x14001bbde
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r12
xor r9d, r9d
movzx r8d, byte [rsp + 0x50]
mov rdx, r14
lea rcx, [rbp + 0x20]
call fcn.140018f00
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x50], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x50], xmm1
mov qword [rax + 0x18], 7
mov qword [rax + 0x10], r15
mov word [rax], r15w
mov rdx, r12
lea rcx, [rbp + 0x40]
call fcn.14001c3f0
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
xor r12d, r12d
mov qword [rbp + 0x10], r12
mov qword [rbp + 0x18], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x10], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
mov rdx, qword [rbp + 0x58]
cmp rdx, 7
jbe 0x14001bc89
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001bc84
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001c3b7
call fcn.14001d5ec
movdqa xmm0, xmmword [0x140045990]
movdqu xmmword [rbp + 0x50], xmm0
mov word [rbp + 0x40], r12w
mov rdx, qword [rbp + 0x38]
cmp rdx, 7
jbe 0x14001bce3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001bcd6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001c3bd
call fcn.14001d5ec
movdqa xmm0, xmmword [0x140045990]
movdqu xmmword [rbp + 0x30], xmm0
mov word [rbp + 0x20], r12w
lea r8, str._test
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x58]
call fcn.140002620
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x14001bf51
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001bd56
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea r8, str.runas
mov edx, 0x10
lea rcx, [rbp + 0x60]
call fcn.140023c28
call sub.KERNEL32.dll_GetCurrentProcessId
mov ebx, eax
mov rcx, qword [r13]
sub rcx, 0x18
call fcn.140002eb0
add rax, 0x18
mov qword [rsp + 0x58], rax
lea rdx, str.__pid:
mov r8, rsi
inc r8
cmp word [rdx + r8*2], 0
jne 0x14001bd92
lea rcx, [rsp + 0x58]
call fcn.140018b50
nop
call fcn.1400033f0
mov rcx, rax
test rax, rax
je 0x14001c3c3
mov rax, qword [rax]
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x60], rdi
mov ecx, r14d
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, 0xa
or eax, ecx
jge 0x14001bdec
mov edx, 0xa
lea rcx, [rsp + 0x60]
call fcn.1400045e0
mov rdi, qword [rsp + 0x60]
mov r9d, 0xa
mov r8d, r9d
mov rdx, rdi
mov ecx, ebx
call fcn.14002bda8
movsxd rax, dword [rdi - 0x10]
mov r13, rdi
mov r12, rdi
mov rbx, qword [rsp + 0x58]
sub r12, rbx
sar r12, 1
mov r15d, dword [rbx - 0x10]
mov dword [rsp + 0x68], r15d
test eax, eax
js 0x14001c3ce
mov rdx, rax
mov rcx, rdi
call fcn.140023de0
mov rdx, rax
mov qword [rbp - 0x78], rax
mov ecx, 0x7fffffff
sub ecx, eax
cmp ecx, r15d
jl 0x14001c3ce
add r15d, eax
js 0x14001c3ce
sub r14d, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, r15d
or eax, r14d
jge 0x14001be75
mov edx, r15d
lea rcx, [rsp + 0x58]
call fcn.1400045e0
mov rbx, qword [rsp + 0x58]
mov rdx, qword [rbp - 0x78]
mov eax, dword [rsp + 0x68]
cmp r12, rax
ja 0x14001be82
lea r13, [rbx + r12*2]
movsxd r8, edx
add r8, r8
lea rcx, [rbx + rax*2]
je 0x14001beb9
test rcx, rcx
je 0x14001bea9
test r13, r13
je 0x14001bea2
mov rdx, r13
call fcn.14003f6b0
jmp 0x14001beb9
xor edx, edx
call fcn.14003fd50
call fcn.140023c08
mov dword [rax], 0x16
call fcn.140023ae4
cmp r15d, dword [rbx - 0xc]
jg 0x14001c3ce
mov dword [rbx - 0x10], r15d
movsxd rax, r15d
xor r12d, r12d
mov word [rbx + rax*2], r12w
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
mov qword [rbp - 0x70], 0x70
lea rax, [rbp + 0x60]
mov qword [rbp - 0x60], rax
lea rax, [rbp]
cmp qword [rbp + 0x18], 7
cmova rax, qword [rbp]
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rbx
mov dword [rbp - 0x40], r12d
lea rcx, [rbp - 0x70]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov r14d, eax
lea rdx, [rdi - 0x18]
mov ecx, esi
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x14001bf43
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
jmp 0x14001c209
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001bf83
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x6c], xmm0
movups xmmword [rbp - 0x5c], xmm0
movups xmmword [rbp - 0x4c], xmm0
movups xmmword [rbp - 0x3c], xmm0
movups xmmword [rbp - 0x2c], xmm0
movups xmmword [rbp - 0x1c], xmm0
mov dword [rbp - 0xc], eax
mov dword [rbp - 0x70], 0x68
movups xmmword [rbp + 0x60], xmm0
mov qword [rbp + 0x70], rax
mov rcx, qword [rbp + 0x10]
mov rdx, qword [rbp + 0x18]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x14001bfe4
lea rax, [rcx + 1]
mov qword [rbp + 0x10], rax
lea rax, [rbp]
cmp rdx, 7
cmova rax, qword [rbp]
mov dword [rax + rcx*2], 0x20
jmp 0x14001c002
mov qword [rsp + 0x20], r14
lea r9, [0x1400439c8]
movzx r8d, byte [rsp + 0x50]
mov rdx, r14
lea rcx, [rbp]
call fcn.140018d40
mov r9, qword [r13]
mov rdi, rsi
nop dword [rax]
inc rdi
cmp word [r9 + rdi*2], 0
jne 0x14001c010
mov r15, qword [rbp + 0x10]
mov rcx, qword [rbp + 0x18]
mov rax, rcx
sub rax, r15
cmp rdi, rax
ja 0x14001c05e
lea rax, [rdi + r15]
mov qword [rbp + 0x10], rax
lea rbx, [rbp]
cmp rcx, 7
cmova rbx, qword [rbp]
lea rcx, [rbx + r15*2]
lea r8, [rdi + rdi]
mov rdx, r9
call fcn.14003f6b0
lea rax, [r15 + rdi]
mov word [rbx + rax*2], r12w
jmp 0x14001c075
mov qword [rsp + 0x20], rdi
movzx r8d, byte [rsp + 0x50]
mov rdx, rdi
lea rcx, [rbp]
call fcn.140018d40
call sub.KERNEL32.dll_GetCurrentProcessId
mov r15d, eax
mov rdi, qword [rbp + 0x10]
mov rdx, qword [rbp + 0x18]
mov rcx, rdx
sub rcx, rdi
cmp rcx, 5
jb 0x14001c0c4
lea rcx, [rdi + 5]
mov qword [rbp + 0x10], rcx
lea rbx, [rbp]
cmp rdx, 7
cmova rbx, qword [rbp]
lea rcx, [rbx + rdi*2]
mov r8d, 0xa
lea rdx, str._pid:
call fcn.14003f6b0
mov word [rbx + rdi*2 + 0xa], r12w
jmp 0x14001c0e9
mov qword [rsp + 0x20], 5
lea r9, str._pid:
movzx r8d, byte [rsp + 0x50]
mov edx, 5
lea rcx, [rbp]
call fcn.140018d40
nop
call fcn.1400033f0
mov rcx, rax
test rax, rax
je 0x14001c3d9
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x60], rbx
sub r14d, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, 0xa
or eax, r14d
jge 0x14001c12c
mov edx, 0xa
lea rcx, [rsp + 0x60]
call fcn.1400045e0
mov rbx, qword [rsp + 0x60]
mov r9d, 0xa
mov r8d, r9d
mov rdx, rbx
mov ecx, r15d
call fcn.14002bda8
mov r14, rsi
inc r14
cmp word [rbx + r14*2], 0
jne 0x14001c143
mov r15, qword [rbp + 0x10]
mov rcx, qword [rbp + 0x18]
mov rax, rcx
sub rax, r15
cmp r14, rax
ja 0x14001c191
lea rax, [r15 + r14]
mov qword [rbp + 0x10], rax
lea rdi, [rbp]
cmp rcx, 7
cmova rdi, qword [rbp]
lea rcx, [rdi + r15*2]
lea r8, [r14 + r14]
mov rdx, rbx
call fcn.14003f6b0
lea rax, [r15 + r14]
mov word [rdi + rax*2], r12w
jmp 0x14001c1ab
mov qword [rsp + 0x20], r14
mov r9, rbx
movzx r8d, byte [rsp + 0x50]
mov rdx, r14
lea rcx, [rbp]
call fcn.140018d40
lea rdx, [rbp]
cmp qword [rbp + 0x18], 7
cmova rdx, qword [rbp]
lea rax, [rbp + 0x60]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov r14d, eax
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001c21f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x18]
test r14d, r14d
je 0x14001c2d9
cmp rdx, 7
jbe 0x14001c268
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001c263
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001c3b1
call fcn.14001d5ec
mov qword [rbp + 0x10], r12
mov qword [rbp + 0x18], 7
mov word [rbp], r12w
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001c298
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x80]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001c2b6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x14001c2d2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov al, 1
jmp 0x14001c381
cmp rdx, 7
jbe 0x14001c315
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001c310
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001c3b1
call fcn.14001d5ec
mov qword [rbp + 0x10], r12
mov qword [rbp + 0x18], 7
mov word [rbp], r12w
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001c345
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x80]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001c363
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x14001c37f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
xor al, al
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.14001d590
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140023b04
nop
call fcn.140023b04
nop
call fcn.140023b04
nop
mov ecx, 0x80004005
call fcn.140002a90
nop
mov ecx, 0x80070057
call fcn.140002a90
nop
mov ecx, 0x80004005
call fcn.140002a90
int3