Function at 0x296203730
Capabilities:
Check if file exists
Create process on windows
Get file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x868
xor ebx, ebx
mov ecx, 0x1e
lea rdx, [0x2962be638]
mov rax, rbx
lea rdi, [rsp + 0x100]
lea r15, [rsp + 0xf0]
mov qword [rsp + 0xf0], 0
rep stosq qword [rdi], rax
mov rcx, r15
lea rbp, [rsp + 0x200]
mov rsi, r15
mov qword [rsp + 0xf8], 0
mov dword [rdi], 0
lea rdi, [rsp + 0x210]
call sub.msvcrt.dll_strcpy
mov rcx, r15
call sub.msvcrt.dll_strlen
mov ecx, 0x1e
mov qword [rsp + 0x200], 0
mov qword [rsp + 0x208], 0
mov r13, rax
mov eax, 0x5c
mov word [r15 + r13], ax
mov rax, rbx
lea r12, [r13 + 2]
rep stosq qword [rdi], rax
mov ecx, 0x1e
mov qword [rsp + 0x310], 0
mov qword [rsp + 0x318], 0
mov qword [rsp + 0x420], 0
mov qword [rsp + 0x428], 0
mov qword [rsp + 0x530], 0
mov qword [rsp + 0x538], 0
mov dword [rdi], 0
lea rdi, [rsp + 0x320]
rep stosq qword [rdi], rax
mov ecx, 0x1e
mov dword [rdi], 0
lea rdi, [rsp + 0x430]
rep stosq qword [rdi], rax
mov ecx, 0x1e
mov dword [rdi], 0
lea rdi, [rsp + 0x540]
rep stosq qword [rdi], rax
mov dword [rdi], 0
mov rdi, rbp
cmp r12d, 8
jb 0x29620387e
mov ecx, r12d
shr ecx, 3
rep movsq qword [rdi], qword [rsi]
xor eax, eax
test r12b, 4
je 0x29620388f
mov eax, dword [rsi]
mov dword [rdi], eax
mov eax, 4
test r12b, 2
je 0x2962038a1
movzx edx, word [rsi + rax]
mov word [rdi + rax], dx
add rax, 2
test r12b, 1
je 0x2962038ae
movzx edx, byte [rsi + rax]
mov byte [rdi + rax], dl
add r13, 1
lea rdx, [0x2962be73c]
lea r14, [rsp + 0x310]
mov rsi, r15
lea rcx, [rbp + r13]
mov rdi, r14
call sub.msvcrt.dll_strcpy
cmp r12d, 8
jb 0x2962038e0
mov ecx, r12d
shr ecx, 3
rep movsq qword [rdi], qword [rsi]
xor eax, eax
test r12b, 4
je 0x2962038f1
mov eax, dword [rsi]
mov dword [rdi], eax
mov eax, 4
test r12b, 2
je 0x296203903
movzx edx, word [rsi + rax]
mov word [rdi + rax], dx
add rax, 2
test r12b, 1
je 0x296203910
movzx edx, byte [rsi + rax]
mov byte [rdi + rax], dl
lea rcx, [r14 + r13]
lea rdx, [0x2962be840]
mov rsi, r15
call sub.msvcrt.dll_strcpy
lea rax, [rsp + 0x420]
mov qword [rsp + 0x58], rax
mov rdi, rax
cmp r12d, 8
jb 0x296203942
mov ecx, r12d
shr ecx, 3
rep movsq qword [rdi], qword [rsi]
xor eax, eax
test r12b, 4
je 0x296203953
mov eax, dword [rsi]
mov dword [rdi], eax
mov eax, 4
test r12b, 2
je 0x296203965
movzx edx, word [rsi + rax]
mov word [rdi + rax], dx
add rax, 2
test r12b, 1
je 0x296203972
movzx edx, byte [rsi + rax]
mov byte [rdi + rax], dl
mov rax, qword [rsp + 0x58]
lea rdx, [0x2962bed54]
mov rsi, r15
lea rdi, [rsp + 0x650]
lea rbx, [rsp + 0x530]
lea rcx, [rax + r13]
call sub.msvcrt.dll_strcpy
mov ecx, 0x1e
xor edx, edx
movabs rax, 0x696e692e706d6574
mov qword [rsp + 0x640], rax
xor eax, eax
rep stosq qword [rdi], rax
mov qword [rsp + 0x648], rdx
mov dword [rdi], 0
mov rdi, rbx
cmp r12d, 8
jb 0x2962039d8
mov ecx, r12d
shr ecx, 3
rep movsq qword [rdi], qword [rsi]
xor eax, eax
test r12b, 4
je 0x2962039e9
mov eax, dword [rsi]
mov dword [rdi], eax
mov eax, 4
test r12b, 2
je 0x2962039fb
movzx edx, word [rsi + rax]
mov word [rdi + rax], dx
add rax, 2
and r12d, 1
je 0x296203a08
movzx edx, byte [rsi + rax]
mov byte [rdi + rax], dl
mov rax, qword [rsp + 0x640]
add r13, rbx
mov rcx, r15
lea rdi, [rsp + 0x770]
mov qword [r13], rax
movzx eax, byte [rsp + 0x648]
mov byte [r13 + 8], al
call fcn.2962018e0
mov ecx, 0x1c
movabs rax, 0x2d73776f646e6977
movabs rdx, 0x6c6c6174736e69
mov qword [rsp + 0x750], rax
xor eax, eax
mov r8d, dword [0x296d08240]
mov r9d, 1
rep stosq qword [rdi], rax
mov rcx, r14
lea rax, [rsp + 0x750]
mov qword [rsp + 0x758], rdx
lea rdx, [0x296c19440]
mov qword [rsp + 0x760], 0
mov qword [rsp + 0x768], 0
mov dword [rdi], 0
mov qword [rsp + 0x20], rax
call fcn.296202920
test eax, eax
jne 0x296203ac8
xor eax, eax
add rsp, 0x868
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov r8d, dword [0x296c1942c]
lea rdx, [0x296baaa80]
lea rcx, [0x2962be944]
call fcn.296201e30
test eax, eax
je 0x296203aac
mov r8d, dword [0x2963bf7a4]
lea rdx, [0x2963bf7a8]
lea rcx, [0x2962bea48]
call fcn.296201e30
test eax, eax
je 0x296203aac
mov r8d, dword [0x296baaa68]
mov rcx, qword [rsp + 0x58]
xor r9d, r9d
mov qword [rsp + 0x20], 0
lea rdx, [0x296abf7c0]
call fcn.296202920
test eax, eax
je 0x296203aac
mov ecx, 0x1388
mov r15, qword [sym.imp.KERNEL32.dll_Sleep]
call r15
mov r8d, dword [0x296d0fe30]
xor r9d, r9d
mov rcx, rbp
mov qword [rsp + 0x20], 0
lea rdx, [0x296d08260]
call fcn.296202920
cmp byte [0x2962bee58], 0
jne 0x296203c38
xor esi, esi
mov r14, qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov rcx, rbx
mov r13, qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r12, [rsp + 0x80]
call r14
cmp eax, 0xffffffff
jne 0x296203c27
cmp esi, 3
je 0x296203c27
xor eax, eax
mov ecx, 0xe
mov rdi, r12
xor r9d, r9d
rep stosq qword [rdi], rax
lea rax, [rsp + 0x60]
xor r8d, r8d
mov rdx, rbp
mov dword [rsp + 0x80], 0x70
add esi, 1
mov dword [rsp + 0xbc], 1
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rcx, qword [rsp + 0x68]
call r13
mov rcx, qword [rsp + 0x60]
call r13
mov ecx, 0x1388
call r15
mov rcx, rbx
call r14
cmp eax, 0xffffffff
je 0x296203b91
mov eax, 1
jmp 0x296203aae
mov r8d, dword [0x2962bf684]
lea rdx, [0x2962bf688]
lea rcx, [0x2962bee58]
call fcn.296201e30
jmp 0x296203b6a