Function at 0x3000a5b2
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x664
mov eax, dword [0x30001dbc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
cmp dword [esi + 4], 0
mov dword [ebp - 0x620], eax
jne 0x3000a5e1
mov eax, 0xc6c8120f
jmp 0x3000a918
mov edx, dword [ebp + 0x14]
and dword [ebp - 0x634], 0
and dword [ebp - 0x630], 0
push ebx
mov ecx, edx
shr ecx, 4
push edi
not ecx
and ecx, 1
mov edi, edx
shr edi, 5
mov dword [ebp - 0x640], ecx
mov ebx, edx
shr ebx, 6
xor ecx, ecx
mov eax, edx
not edi
inc ecx
not eax
not ebx
and edi, 1
and eax, 1
and ebx, ecx
test edi, edi
jne 0x3000a629
test ebx, ebx
je 0x3000a633
test eax, eax
je 0x3000a633
mov dword [ebp - 0x630], ecx
shr edx, 7
not edx
and edx, ecx
mov dword [ebp - 0x63c], edx
je 0x3000a648
mov dword [ebp - 0x630], ecx
xor ecx, ecx
xor edx, edx
cmp eax, ecx
setne dl
cmp eax, ecx
mov dword [esi + 0x218], ecx
mov dword [ebp - 0x624], ecx
mov dword [esi + 0x214], edx
je 0x3000a914
lea eax, [ebp - 0x628]
push eax
mov dword [ebp - 0x628], ecx
call fcn.3000a1a3
mov eax, dword [ebp - 0x628]
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
mov ecx, dword [ebp - 0x628]
mov eax, dword [ebp + 0x10]
mov dword [ecx + 8], eax
mov eax, dword [esi]
mov edx, dword [eax]
push ecx
push eax
call dword [edx + 0x60]
mov eax, dword [esi]
mov ecx, dword [eax]
lea edx, [ebp - 0x638]
push edx
push dword [ebp - 0x620]
push eax
call dword [ecx + 0x1c]
test eax, eax
jge 0x3000a6c8
mov dword [ebp - 0x634], 0xc6c81203
xor ebx, ebx
jmp 0x3000a8ef
movzx edx, word [ebp + 0xc]
mov eax, dword [esi]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x78]
mov eax, dword [esi]
mov ecx, dword [eax]
push 0
push 4
push eax
call dword [ecx + 0x18]
xor ecx, ecx
test edi, edi
je 0x3000a6ea
push 8
pop ecx
test ebx, ebx
je 0x3000a6f1
or ecx, 4
mov eax, dword [esi]
mov edx, dword [eax]
push ecx
push 4
push eax
call dword [edx + 0x18]
xor ebx, ebx
cmp dword [ebp - 0x638], ebx
mov dword [ebp - 0x62c], ebx
jbe 0x3000a8e7
xor edi, edi
lea eax, [ebp - 0x654]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
mov eax, dword [esi]
mov ecx, dword [eax]
inc edi
push edi
push eax
call dword [ecx + 0x14]
test eax, eax
jge 0x3000a746
mov dword [ebp - 0x634], 0xc6c81205
mov dword [esi + 0x214], 2
jmp 0x3000a8ce
mov eax, dword [esi]
mov ecx, dword [eax]
xor edx, edx
cmp dword [ebp - 0x630], ebx
push ebx
sete dl
lea edi, [esi + 0x210]
push edx
push edi
push eax
call dword [ecx + 0x58]
lea eax, [ebp - 0x664]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x664]
push eax
lea eax, [ebp - 0x654]
push eax
mov ecx, esi
call fcn.3000902f
add dword [esi + 0x218], eax
cmp dword [ebp - 0x630], ebx
je 0x3000a835
cmp dword [ebp - 0x638], 1
jne 0x3000a835
mov eax, dword [esi]
mov ecx, dword [eax]
lea edx, [ebp - 0x644]
push edx
push eax
call dword [ecx + 0x50]
test eax, eax
jl 0x3000a835
lea eax, [ebp - 0x61c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x20c]
push eax
push ebx
push 0x30001d54
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
cmp dword [ebp - 0x63c], ebx
mov eax, dword [esi]
mov ecx, dword [eax]
lea edx, [ebp - 0x20c]
je 0x3000a7fb
push edx
push eax
call dword [ecx + 0x5c]
jmp 0x3000a802
push 1
push edx
push eax
call dword [ecx + 0x6c]
cmp eax, ebx
mov dword [ebp - 0x624], eax
jl 0x3000a828
mov eax, dword [esi]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x20]
push dword [ebp - 0x620]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x20c]
jmp 0x3000a896
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x61c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x414]
push eax
push ebx
push 0x30001d4c
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov eax, dword [esi]
mov ecx, dword [eax]
push 1
lea edx, [ebp - 0x414]
push edx
push eax
call dword [ecx + 0x6c]
cmp eax, ebx
mov dword [ebp - 0x624], eax
jl 0x3000a8a5
mov eax, dword [esi]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x20]
push dword [ebp - 0x620]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x414]
push ebx
push dword [ebp - 0x620]
push eax
call fcn.3000726a
jmp 0x3000a8b2
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 0x640], ebx
je 0x3000a8ce
cmp word [ebp - 0x62c], bx
jne 0x3000a8ce
lea eax, [esi + 8]
push eax
push dword [edi]
call fcn.3000a27c
inc dword [ebp - 0x62c]
movzx edi, word [ebp - 0x62c]
cmp edi, dword [ebp - 0x638]
jb 0x3000a712
mov esi, dword [esi]
mov eax, dword [esi]
push esi
call dword [eax + 0x20]
mov eax, dword [ebp - 0x628]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x634]
cmp eax, ebx
jl 0x3000a916
cmp dword [ebp - 0x624], ebx
jge 0x3000a914
mov eax, 0xc6c8120e
jmp 0x3000a916
xor eax, eax
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.3000adb6
leave
ret 0x10