Function at 0x300611fa
Capabilities:
Delete file
Enumerate files on windows
Get file attributes
Read file on windows
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x3001d1b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
and eax, 0xff00
mov ecx, 0x4000
push esi
xor ebx, ebx
cmp eax, ecx
push edi
jg 0x30061364
je 0x3006134b
cmp eax, 0x3000
je 0x3006133d
cmp eax, 0x3b00
je 0x30061329
cmp eax, 0x3c00
je 0x300612f7
cmp eax, 0x3d00
je 0x30061296
cmp eax, 0x3e00
je 0x30061288
cmp eax, 0x3f00
jne 0x30061494
push ebx
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0x14]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x30061494
mov eax, dword [ebp - 8]
jmp 0x300614e6
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x3006148a
movzx eax, byte [ebp + 8]
sub eax, 0xa2
je 0x300612b1
push 3
pop ebx
sub eax, 0x1e
mov edi, 0x80000000
mov dword [ebp - 0xc], ebx
jmp 0x300612c0
xor ebx, ebx
mov edi, 0xc0000000
inc ebx
mov dword [ebp - 0xc], 3
mov eax, 0x200
call fcn.30201ce6
mov esi, esp
xor eax, eax
push eax
push esi
push pe_nt_image_headers32
push eax
push dword [ebp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
mov dword [ebp - 8], eax
je 0x30061494
cmp eax, 0xff
jbe 0x30061309
jmp 0x30061494
mov esi, dword [ebp + 0x14]
xor ebx, ebx
mov edi, 0xc0000000
inc ebx
mov dword [ebp - 0xc], 2
xor eax, eax
push eax
push eax
push eax
push dword [ebp - 0xc]
push eax
push ebx
push edi
push esi
call dword [sym.imp.MSO.dll_Ordinal_403]
cmp eax, 0xffffffff
je 0x30061494
jmp 0x300614e6
push dword [ebp + 0x14]
call fcn.30061e84
mov ebx, eax
neg ebx
sbb ebx, ebx
inc ebx
jmp 0x3006148c
call dword [sym.imp.KERNEL32.dll_GetVersion]
movzx eax, ax
jmp 0x300614e6
push ebx
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0x14]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x30061278
cmp eax, 0x4100
je 0x30061481
cmp eax, 0x4200
je 0x30061462
cmp eax, 0x4300
je 0x3006140c
cmp eax, 0x4400
je 0x300613fa
cmp eax, 0x4e00
mov edi, dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, 0x302ad748
je 0x300613ab
cmp eax, 0x4f00
jne 0x30061494
jmp 0x300613d6
mov eax, dword [0x302ae808]
test eax, eax
je 0x300613b7
push eax
call edi
push esi
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [0x302ae808], eax
je 0x30061401
test word [0x302ad748], 0x116
je 0x300613fa
push esi
push dword [0x302ae808]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x300613cb
push dword [0x302ae808]
call edi
and dword [0x302ae808], ebx
jmp 0x3006148c
xor eax, eax
jmp 0x300614e6
and dword [0x302ae808], ebx
jmp 0x30061494
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test byte [ebp + 8], 1
je 0x30061437
cmp eax, 0xffffffff
je 0x30061426
and eax, 2
or dword [ebp + 0x10], eax
push dword [ebp + 0x10]
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x300614e6
cmp eax, 0xffffffff
je 0x30061458
test al, 1
je 0x30061443
xor ebx, ebx
inc ebx
test al, 0x10
je 0x3006144a
or ebx, 0x10
test al, 0x20
je 0x30061451
or ebx, 0x20
mov eax, ebx
jmp 0x300614e6
mov eax, 0x80000000
jmp 0x300614e6
mov eax, dword [ebp + 0x10]
push ebx
shl eax, 0x10
or eax, dword [ebp + 0x14]
push ebx
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
xor ebx, ebx
cmp eax, 0xffffffff
setne bl
jmp 0x3006148c
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebx, eax
test ebx, ebx
jne 0x300613fa
call dword [sym.imp.KERNEL32.dll_GetLastError]
dec eax
dec eax
je 0x300614e1
dec eax
dec eax
je 0x300614da
dec eax
je 0x300614d3
sub eax, 3
je 0x300614cc
sub eax, 0x18
je 0x300614c5
sub eax, 0x21
je 0x300614d3
sub eax, 0x60
je 0x300614be
or eax, 0xffffffff
jmp 0x300614e6
mov eax, 0x80000003
jmp 0x300614e6
mov eax, 0x80000020
jmp 0x300614e6
mov eax, 0x80000008
jmp 0x300614e6
mov eax, 0x80000005
jmp 0x300614e6
mov eax, 0x80000004
jmp 0x300614e6
mov eax, 0x80000002
lea esp, [ebp - 0x18]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.3020156b
leave
ret 0x10