Function at 0x296202920
Capabilities:
Get common file path
Get file size
Read file on windows
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xbe8
xor ebp, ebp
mov r14, qword [sym.imp.KERNEL32.dll_GetTempPathA]
mov rax, rbp
mov qword [rsp + 0xc30], rcx
mov ecx, 0x1e
lea rdi, [rsp + 0x1d0]
lea r13, [rsp + 0x600]
rep stosq qword [rdi], rax
mov ecx, 0x1e
mov esi, r8d
mov r12, rdx
lea rbx, [rsp + 0x1c0]
mov rdx, r13
mov dword [rsp + 0xcc], r9d
lea r15, [rsp + 0x710]
mov qword [rsp + 0x1c0], 0
mov qword [rsp + 0x1c8], 0
mov qword [rsp + 0x600], 0
mov qword [rsp + 0x608], 0
mov dword [rdi], 0
lea rdi, [rsp + 0x610]
rep stosq qword [rdi], rax
mov ecx, 0x104
mov dword [rdi], 0
mov byte [rdi + 4], 0
lea rdi, [rsp + 0x2e0]
call r14
mov r9, rbx
xor r8d, r8d
mov rcx, r13
lea rdx, [0x296d130e1]
mov r13, qword [sym.imp.KERNEL32.dll_GetTempFileNameA]
call r13
mov rax, rbp
mov ecx, 0x1e
mov rdx, r15
rep stosq qword [rdi], rax
mov ecx, 0x1e
mov qword [rsp + 0x2d0], 0
mov qword [rsp + 0x2d8], 0
mov qword [rsp + 0x710], 0
mov qword [rsp + 0x718], 0
mov dword [rdi], 0
lea rdi, [rsp + 0x720]
rep stosq qword [rdi], rax
mov ecx, 0x104
mov dword [rdi], 0
mov byte [rdi + 4], 0
call r14
xor r8d, r8d
lea rdx, [0x296d130e1]
mov rcx, r15
lea r14, [rsp + 0x2d0]
mov r9, r14
call r13
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileA]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x28], 0
mov edx, 0x40000000
mov rcx, rbx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x20], 2
mov qword [rsp + 0x88], rax
call rax
mov r13, rax
cmp rax, 0xffffffffffffffff
je 0x296203510
lea rax, [rsp + 0x128]
mov r8d, esi
mov rdx, r12
mov rcx, r13
mov r9, rax
mov qword [rsp + 0xe0], rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteFile]
lea r15, [rsp + 0x160]
mov qword [rsp + 0x20], 0
mov qword [rsp + 0xd8], rax
call rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r13
mov qword [rsp + 0xd0], rax
call rax
lea rax, [rsp + 0x150]
mov ecx, 0xe8
mov qword [rsp + 0x148], 0
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0x140], rax
lea rax, [rsp + 0x170]
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0x160], rax
lea rax, [rsp + 0x190]
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0x180], rax
lea rax, [rsp + 0x1b0]
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0x1a0], rax
lea rax, [rsp + 0x180]
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0x1a0]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x140]
mov byte [rsp + 0x150], 0
mov qword [rsp + 0x168], 0
mov byte [rsp + 0x170], 0
mov qword [rsp + 0x188], 0
mov byte [rsp + 0x190], 0
mov qword [rsp + 0x1a8], 0
mov byte [rsp + 0x1b0], 0
mov qword [rsp + 0x50], rax
call fcn.2962bbd10
xor edx, edx
mov rcx, rax
mov r12, rax
call fcn.2962254c0
lea rdi, [rsp + 0x3f0]
mov ecx, 0x1e
xor edx, edx
movabs rax, 0x73776f646e69772d
mov qword [rsp + 0x3e0], rax
xor eax, eax
movabs rsi, 0x6c6c6174736e692d
rep stosq qword [rdi], rax
mov ecx, 0x1e
mov qword [rsp + 0x3e8], rdx
mov qword [rsp + 0x130], r12
mov qword [rsp + 0x138], 0
mov qword [rsp + 0x4f0], rsi
mov dword [rdi], 0
xor edi, edi
mov qword [rsp + 0x4f8], rdi
lea rdi, [rsp + 0x500]
rep stosq qword [rdi], rax
mov rcx, rbx
mov dword [rdi], 0
call sub.msvcrt.dll_strlen
mov r8, qword [rsp + 0x188]
mov r9, rbx
xor edx, edx
mov qword [rsp + 0x20], rax
lea rax, [rsp + 0x1a0]
lea rcx, [rsp + 0x180]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x140]
mov qword [rsp + 0xa0], rcx
mov qword [rsp + 0x50], rax
call fcn.2962a6e60
mov rcx, r14
call sub.msvcrt.dll_strlen
mov r8, qword [rsp + 0x1a8]
mov r9, r14
xor edx, edx
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x1a0]
lea rax, [rsp + 0x140]
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x50], rax
call fcn.2962a6e60
lea rbx, [rsp + 0x3e0]
mov rcx, rbx
call sub.msvcrt.dll_strlen
mov r8, qword [rsp + 0x148]
mov r9, rbx
xor edx, edx
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x140]
mov qword [rsp + 0x50], rcx
call fcn.2962a6e60
lea rbx, [rsp + 0x4f0]
mov rcx, rbx
call sub.msvcrt.dll_strlen
mov r9, rbx
xor edx, edx
mov rcx, r15
mov qword [rsp + 0x20], rax
mov r8, qword [rsp + 0x168]
call fcn.2962a6e60
mov rax, qword [rsp + 0x140]
mov rcx, qword [rsp + 0x130]
mov rdx, qword [rax]
mov rax, qword [rcx]
call qword [rax]
mov rax, qword [rsp + 0x160]
lea rbx, [rsp + 0x820]
mov qword [rsp + 0x98], rbx
mov rax, qword [rax]
mov qword [rsp + 0x138], rax
lea rax, [rsp + 0x8f8]
mov rcx, rax
mov qword [rsp + 0x80], rax
call fcn.2962b2e90
mov rax, qword [0x296d194d0]
mov rbp, qword [0x296d19000]
xor edx, edx
mov word [rsp + 0x9d8], dx
xor edx, edx
add rax, 0x10
mov rsi, qword [rbp + 0x10]
mov qword [rsp + 0x9d0], 0
mov qword [rsp + 0x8f8], rax
mov rax, qword [rbp + 0x18]
mov qword [rsp + 0x9e0], 0
mov rdi, rax
mov qword [rsp + 0x48], rax
mov rax, qword [rsi - 0x18]
mov qword [rsp + 0x9e8], 0
mov qword [rsp + 0x9f0], 0
mov qword [rsp + 0x9f8], 0
mov qword [rsp + 0x820], rsi
mov qword [rsp + rax + 0x820], rdi
mov qword [rsp + 0x828], 0
add rbx, qword [rsi - 0x18]
mov rcx, rbx
call fcn.2962b3f80
mov rdi, qword [rbp + 0x20]
xor edx, edx
mov rax, qword [rdi - 0x18]
mov qword [rsp + 0x830], rdi
lea rcx, [rsp + rax + 0x830]
mov rax, qword [rbp + 0x28]
mov qword [rcx], rax
mov qword [rsp + 0x68], rax
call fcn.2962b3f80
mov rax, qword [rbp + 8]
mov rbx, qword [rbp + 0x30]
lea r12, [rsp + 0x838]
mov rcx, r12
mov qword [rsp + 0x58], rax
mov rax, qword [rax - 0x18]
mov qword [rsp + 0x60], rbx
mov qword [rsp + rax + 0x820], rbx
mov rbx, qword [0x296d19210]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x820], rax
lea rax, [rbx + 0x68]
mov qword [rsp + 0x8f8], rax
lea rax, [rbx + 0x40]
mov qword [rsp + 0x830], rax
call fcn.29628ab90
mov rcx, qword [rsp + 0x80]
mov rdx, r12
call fcn.2962b3f80
mov rdx, qword [rsp + 0x180]
mov r8d, 0xc
mov rcx, r12
call fcn.296289030
mov rdx, qword [rsp + 0x820]
mov rcx, qword [rsp + 0x98]
add rcx, qword [rdx - 0x18]
test rax, rax
je 0x2962032a0
xor edx, edx
call fcn.2962b4150
lea rax, [rsp + 0xad8]
lea r13, [rsp + 0xa00]
mov rcx, rax
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x90], r13
call fcn.2962b2e90
mov rax, qword [0x296d194d0]
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 0xbb0], 0
mov qword [rsp + 0xbc0], 0
add rax, 0x10
mov qword [rsp + 0xbc8], 0
mov qword [rsp + 0xad8], rax
xor eax, eax
mov word [rsp + 0xbb8], ax
mov rax, qword [rsi - 0x18]
mov qword [rsp + 0xbd0], 0
mov qword [rsp + 0xbd8], 0
mov qword [rsp + 0xa00], rsi
mov qword [rsp + rax + 0xa00], rdx
xor edx, edx
mov qword [rsp + 0xa08], 0
mov rcx, qword [rsi - 0x18]
add rcx, r13
call fcn.2962b3f80
mov rax, qword [rdi - 0x18]
mov qword [rsp + 0xa10], rdi
xor edx, edx
lea rcx, [rsp + rax + 0xa10]
mov rax, qword [rsp + 0x68]
mov qword [rcx], rax
call fcn.2962b3f80
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
lea r13, [rsp + 0xa18]
mov rcx, r13
mov rax, qword [rax - 0x18]
mov qword [rsp + rax + 0xa00], rdx
lea rax, [rbx + 0x18]
mov qword [rsp + 0xa00], rax
lea rax, [rbx + 0x68]
mov qword [rsp + 0xad8], rax
lea rax, [rbx + 0x40]
mov qword [rsp + 0xa10], rax
call fcn.29628ab90
mov rcx, qword [rsp + 0x78]
mov rdx, r13
call fcn.2962b3f80
mov rdx, qword [rsp + 0x1a0]
mov r8d, 0x14
mov rcx, r13
call fcn.296289030
mov rdx, qword [rsp + 0xa00]
mov rcx, qword [rsp + 0x90]
add rcx, qword [rdx - 0x18]
test rax, rax
je 0x296203518
xor edx, edx
call fcn.2962b4150
mov rax, qword [rsp + 0xa10]
mov r8, qword [rsp + 0x820]
mov ecx, 0xffffffff
lea r9, [rsp + 0xf0]
mov rax, qword [rax - 0x18]
mov r8, qword [r8 - 0x18]
mov rdx, qword [rsp + rax + 0xaf8]
mov r8, qword [rsp + r8 + 0x908]
mov eax, 0
mov qword [rsp + 0x118], rcx
mov qword [rsp + 0x108], rcx
lea rcx, [rsp + 0x130]
test rdx, rdx
mov qword [rsp + 0x110], r8
lea r8, [rsp + 0x100]
mov qword [rsp + 0xf0], rdx
sete al
lea rdx, [rsp + 0x110]
mov qword [rsp + 0x100], 0
mov qword [rsp + 0xf8], rax
call fcn.2962273f0
mov rcx, r12
call fcn.2962894c0
test rax, rax
je 0x296203558
mov rcx, r13
call fcn.2962894c0
test rax, rax
je 0x296203530
mov qword [rsp + 0x30], 0
xor r9d, r9d
xor r8d, r8d
mov rax, qword [rsp + 0x88]
mov dword [rsp + 0x28], 0
mov edx, 0x80000000
mov rcx, r14
mov dword [rsp + 0x20], 3
call rax
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x2962032b8
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, eax
test eax, eax
je 0x2962032b8
mov edx, eax
mov r9d, 4
mov r8d, 0x3000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0xe8], rax
test rax, rax
je 0x2962032b8
mov qword [rsp + 0x20], 0
mov r8d, ebp
mov rdx, rax
mov rcx, r14
lea r9, [rsp + 0x12c]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
mov rcx, r14
mov rax, qword [rsp + 0xd0]
je 0x2962032b0
call rax
cmp qword [rsp + 0xc50], 0
je 0x296203214
cmp byte [rsp + 0xcc], 0
je 0x296203214
mov r8, qword [rsp + 0xc50]
mov edx, dword [rsp + 0x12c]
mov rcx, qword [rsp + 0xe8]
call fcn.2962017b0
mov qword [rsp + 0x30], 0
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsp + 0xc30]
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x88]
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
call rax
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x2962032b8
mov rcx, rax
mov r9, qword [rsp + 0xe0]
mov qword [rsp + 0x20], 0
mov r8d, dword [rsp + 0x12c]
mov rdx, qword [rsp + 0xe8]
mov rax, qword [rsp + 0xd8]
call rax
mov rax, qword [rsp + 0xd0]
mov rcx, r14
call rax
mov r14d, 1
jmp 0x2962032bb
mov edx, dword [rcx + 0x20]
or edx, 4
call fcn.2962b4150
jmp 0x296202f1c
call rax
nop word [rax + rax]
xor r14d, r14d
lea rax, [rbx + 0x18]
mov r15, qword [0x296d191f0]
mov rcx, r13
mov qword [rsp + 0xa00], rax
lea rax, [rbx + 0x68]
mov qword [rsp + 0xad8], rax
lea rax, [rbx + 0x40]
mov qword [rsp + 0xa10], rax
lea rax, [r15 + 0x10]
mov qword [rsp + 0xa18], rax
call fcn.2962894c0
lea rcx, [rsp + 0xa60]
add r15, 0x10
call fcn.296282a80
mov rbp, qword [0x296d19280]
lea rcx, [rsp + 0xa50]
lea rax, [rbp + 0x10]
mov qword [rsp + 0xa18], rax
call fcn.2962a5d70
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x78]
mov rax, qword [rax - 0x18]
mov qword [rsp + rax + 0xa00], rdx
mov rax, qword [rdi - 0x18]
mov rdx, qword [rsp + 0x68]
mov qword [rsp + 0xa10], rdi
mov qword [rsp + rax + 0xa10], rdx
mov rax, qword [rsi - 0x18]
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 0xa00], rsi
mov qword [rsp + rax + 0xa00], rdx
mov rax, qword [0x296d194d0]
mov qword [rsp + 0xa08], 0
add rax, 0x10
mov qword [rsp + 0xad8], rax
call fcn.2962b2f40
lea rax, [rbx + 0x18]
mov rcx, r12
mov qword [rsp + 0x838], r15
mov qword [rsp + 0x820], rax
lea rax, [rbx + 0x68]
add rbx, 0x40
mov qword [rsp + 0x8f8], rax
mov qword [rsp + 0x830], rbx
call fcn.2962894c0
lea rcx, [rsp + 0x880]
add rbp, 0x10
call fcn.296282a80
lea rcx, [rsp + 0x870]
mov qword [rsp + 0x838], rbp
call fcn.2962a5d70
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x80]
mov rax, qword [rax - 0x18]
mov qword [rsp + rax + 0x820], rbx
mov rax, qword [rdi - 0x18]
mov qword [rsp + 0x830], rdi
mov rdi, qword [rsp + 0x68]
mov qword [rsp + rax + 0x830], rdi
mov rax, qword [rsi - 0x18]
mov qword [rsp + 0x820], rsi
mov rsi, qword [rsp + 0x48]
mov qword [rsp + rax + 0x820], rsi
mov rax, qword [0x296d194d0]
mov qword [rsp + 0x828], 0
add rax, 0x10
mov qword [rsp + 0x8f8], rax
call fcn.2962b2f40
mov rcx, qword [rsp + 0x1a0]
cmp rcx, qword [rsp + 0xc0]
je 0x29620348d
mov rax, qword [rsp + 0x1b0]
lea rdx, [rax + 1]
call fcn.2962bbcd0
mov rcx, qword [rsp + 0x180]
cmp rcx, qword [rsp + 0xb8]
je 0x2962034b0
mov rax, qword [rsp + 0x190]
lea rdx, [rax + 1]
call fcn.2962bbcd0
mov rcx, qword [rsp + 0x160]
cmp rcx, qword [rsp + 0xb0]
je 0x2962034d3
mov rax, qword [rsp + 0x170]
lea rdx, [rax + 1]
call fcn.2962bbcd0
mov rcx, qword [rsp + 0x140]
cmp rcx, qword [rsp + 0xa8]
je 0x2962034f6
mov rax, qword [rsp + 0x150]
lea rdx, [rax + 1]
call fcn.2962bbcd0
mov eax, r14d
add rsp, 0xbe8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
xor r14d, r14d
jmp 0x2962034f6
mov edx, dword [rcx + 0x20]
or edx, 4
call fcn.2962b4150
jmp 0x296203081
mov rax, qword [rsp + 0xa00]
mov rcx, qword [rsp + 0x90]
add rcx, qword [rax - 0x18]
mov edx, dword [rcx + 0x20]
or edx, 4
call fcn.2962b4150
jmp 0x296203134
mov rax, qword [rsp + 0x820]
mov rcx, qword [rsp + 0x98]
add rcx, qword [rax - 0x18]
mov edx, dword [rcx + 0x20]
or edx, 4
call fcn.2962b4150
jmp 0x296203123