Function at 0x30003ade
Capabilities:
Delete file
Enumerate files on windows
Get file attributes
Read file on windows
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 3
and eax, 0xff00
mov ecx, 0x3000
xor esi, esi
cmp eax, ecx
mov dword [ebp - 4], esi
pop ebx
jle 0x3002de4d
mov ecx, 0x3c00
cmp eax, ecx
jle 0x3002debb
mov ecx, 0x3e00
cmp eax, ecx
jle 0x3002df14
mov ecx, 0x4000
cmp eax, ecx
jle 0x3002dfcf
cmp eax, 0x4100
je 0x3002e110
cmp eax, 0x4200
je 0x3002e0ec
cmp eax, 0x4300
jne 0x3002e014
test byte [ebp + 8], 1
jne 0x3002e0af
cmp dword [0x3017dbf4], esi
push dword [ebp + 0x14]
jne 0x30003b66
call fcn.30014495
jmp 0x30003b6c
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x3002e0e2
test al, 1
jne 0x3002e0d2
test al, 0x10
jne 0x3002e0da
test al, 0x20
je 0x30003b8c
or esi, 0x20
mov eax, esi
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
leave
ret 0x10
cmp eax, ecx
jne 0x3002de5f
call dword [sym.imp.KERNEL32.dll_GetVersion]
movzx eax, ax
jmp 0x30003b8e
cmp eax, 0x1a00
jne 0x3002df75
test esi, esi
jne 0x3002e060
call dword [sym.imp.KERNEL32.dll_GetLastError]
dec eax
dec eax
je 0x3002e162
dec eax
dec eax
je 0x3002e158
dec eax
je 0x3002e14e
sub eax, 3
je 0x3002e144
sub eax, 0x18
je 0x3002e13a
sub eax, 0x21
je 0x3002e14e
sub eax, 0x60
je 0x3002e130
or eax, 0xffffffff
jmp 0x30003b8e
cmp eax, ecx
je 0x3002dedb
cmp eax, 0x3b00
jne 0x3002df75
push dword [ebp + 0x14]
call fcn.301588a6
mov esi, eax
neg esi
sbb esi, esi
inc esi
jmp 0x3002de6a
mov esi, dword [ebp + 0x14]
push 2
mov edi, 0xc0000000
mov dword [ebp + 0xc], 1
pop ebx
cmp dword [0x3017dbf4], 0
jne 0x3002dfa9
xor eax, eax
push eax
push eax
push ebx
push eax
push dword [ebp + 0xc]
push edi
push esi
call fcn.30168987
cmp eax, 0xffffffff
je 0x3002df75
jmp 0x30003b8e
cmp eax, ecx
je 0x3002dfbf
cmp eax, 0x3d00
jne 0x3002df75
movzx eax, byte [ebp + 8]
sub eax, 0xa2
je 0x3002df7d
sub eax, 0x1e
jne 0x3002df8b
mov edi, Ordinal_4
mov dword [ebp + 0xc], ebx
mov eax, 0x200
call fcn.3016b5d7
cmp dword [0x3017dbf4], 0
mov esi, esp
jne 0x3002df93
xor eax, eax
push eax
push esi
push 0x100
push eax
push dword [ebp + 0x14]
push eax
call fcn.3016920b
test eax, eax
mov dword [ebp + 0x10], eax
je 0x3002df75
cmp eax, 0xff
jle 0x3002deed
mov esi, dword [ebp - 4]
jmp 0x3002de6a
mov edi, 0xc0000000
mov dword [ebp + 0xc], 1
jmp 0x3002df3b
mov edi, dword [ebp + 0x14]
mov ebx, dword [ebp + 0x14]
jmp 0x3002df3b
xor eax, eax
push eax
push esi
push 0x100
push eax
push dword [ebp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_SearchPathW]
jmp 0x3002df63
xor eax, eax
push eax
push eax
push ebx
push eax
push dword [ebp + 0xc]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x3002df0a
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, eax
jmp 0x3002de6a
cmp eax, ecx
je 0x3002dffe
cmp eax, 0x3f00
jne 0x3002df75
push esi
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0x14]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x3002de6a
mov eax, dword [ebp + 0x10]
jmp 0x30003b8e
push esi
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0x14]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x3002dfee
cmp eax, 0x4400
je 0x3002e060
mov edi, dword [sym.imp.KERNEL32.dll_FindClose]
cmp eax, 0x4e00
mov esi, 0x3017cd80
jne 0x3002e067
mov eax, dword [0x3017db38]
test eax, eax
je 0x3002e039
push eax
call edi
cmp dword [0x3017dbf4], 0
push esi
push dword [ebp + 0x14]
jne 0x3002e09f
call fcn.30168bd6
cmp eax, 0xffffffff
mov dword [0x3017db38], eax
je 0x3002e093
test word [0x3017cd80], 0x116
jne 0x3002e072
xor eax, eax
jmp 0x30003b8e
cmp eax, 0x4f00
jne 0x3002df75
cmp dword [0x3017dbf4], 0
push esi
push dword [0x3017db38]
jne 0x3002e0a7
call fcn.30168c54
test eax, eax
jne 0x3002e055
push dword [0x3017db38]
call edi
and dword [0x3017db38], 0
jmp 0x3002df75
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
jmp 0x3002e04b
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
jmp 0x3002e087
push dword [ebp + 0x10]
cmp dword [0x3017dbf4], esi
push dword [ebp + 0x14]
jne 0x3002e0c7
call fcn.301692fb
jmp 0x30003b8e
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x30003b8e
push 1
pop esi
jmp 0x30003b7d
or esi, 0x10
jmp 0x30003b85
mov eax, Ordinal_4
jmp 0x30003b8e
mov eax, dword [ebp + 0x10]
push esi
shl eax, 0x10
or eax, dword [ebp + 0x14]
push esi
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov esi, ecx
jmp 0x3002de6a
cmp dword [0x3017dbf4], esi
push dword [ebp + 0x14]
jne 0x3002e125
call fcn.301689f9
jmp 0x3002dfc8
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x3002dfc8
mov eax, reloc.GRINTL32.dll_Ordinal_3
jmp 0x30003b8e
mov eax, 0x80000020
jmp 0x30003b8e
mov eax, Ordinal_10
jmp 0x30003b8e
mov eax, Ordinal_7
jmp 0x30003b8e
mov eax, reloc.GRINTL32.dll_Ordinal_4
jmp 0x30003b8e
mov eax, reloc.GRINTL32.dll_Ordinal_2
jmp 0x30003b8e