Function at 0x1400303b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x50
mov r14, r9
mov rdi, rdx
mov rsi, rcx
test r8b, r8b
jne 0x1400304fd
test rdx, rdx
je 0x1400304fd
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400304fd
lea rcx, str.Okay_to_overwrite_event_log_
call fcn.1400b0640
mov rdx, rax
lea rcx, str.Okay_to_overwrite_event_log_
call fcn.1400b0780
mov qword [rbp - 0x18], rax
mov rcx, rdi
call fcn.1400b0640
mov rdx, rax
mov rcx, rdi
call fcn.1400b0780
mov qword [rbp - 0x20], rax
lea r8, [rbp - 0x20]
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x18]
call fcn.1400b0290
mov rbx, rax
lea rcx, [0x1400f903c]
call fcn.1400b0640
mov rdx, rax
lea rcx, [0x1400f903c]
call fcn.1400b0780
mov qword [rbp - 0x28], rax
lea r8, [rbp - 0x28]
lea rdx, [rbp - 0x30]
mov rcx, rbx
call fcn.1400b0290
nop
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x140030482
call fcn.1400b0810
nop
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x140030491
call fcn.1400b0810
nop
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x1400304a0
call fcn.1400b0810
nop
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x1400304af
call fcn.1400b0810
nop
lea rcx, [rbp - 0x30]
call fcn.1400b0200
mov r9d, 4
lea r8, [0x1400f7478]
mov rdx, rax
mov rcx, qword [rsi + 0x28]
call qword [sym.imp.USER32.dll_MessageBoxW]
nop
cmp eax, 6
je 0x1400304ee
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x1400304e7
call fcn.1400b0810
nop
xor al, al
jmp 0x140030653
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x1400304fd
call fcn.1400b0810
nop
mov r9, qword [rbp + 0x30]
mov r8, r14
mov rdx, rdi
mov rcx, rsi
call fcn.140030670
movzx r14d, al
test al, al
jne 0x14003064f
lea rcx, str.An_error_occurred_opening_the_snapshot
call fcn.1400b0640
mov rdx, rax
lea rcx, str.An_error_occurred_opening_the_snapshot
call fcn.1400b0780
mov qword [rbp - 0x30], rax
test rdi, rdi
je 0x14003061f
cmp word [rdi], 0
je 0x14003061f
lea rcx, [0x1400f90a0]
call fcn.1400b0640
mov rdx, rax
lea rcx, [0x1400f90a0]
call fcn.1400b0780
mov qword [rbp - 0x28], rax
mov rcx, rdi
call fcn.1400b0640
mov rdx, rax
mov rcx, rdi
call fcn.1400b0780
mov qword [rbp - 0x20], rax
lea r8, [rbp - 0x20]
lea rdx, [rbp - 8]
lea rcx, [rbp - 0x28]
call fcn.1400b0290
mov rbx, rax
lea rcx, [0x1400f90a8]
call fcn.1400b0640
mov rdx, rax
lea rcx, [0x1400f90a8]
call fcn.1400b0780
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x10]
mov rcx, rbx
call fcn.1400b0290
nop
mov rdx, rax
lea rcx, [rbp - 0x30]
call fcn.1400b03c0
nop
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x1400305e3
call fcn.1400b0810
nop
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x1400305f2
call fcn.1400b0810
nop
mov rcx, qword [rbp - 8]
test rcx, rcx
je 0x140030601
call fcn.1400b0810
nop
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x140030610
call fcn.1400b0810
nop
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x14003061f
call fcn.1400b0810
nop
lea rcx, [rbp - 0x30]
call fcn.1400b0200
xor r9d, r9d
lea r8, [0x1400f7478]
mov rdx, rax
mov rcx, qword [rsi + 0x28]
call qword [sym.imp.USER32.dll_MessageBoxW]
nop
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x14003064f
call fcn.1400b0810
nop
movzx eax, r14b
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r14, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret