Function at 0x140030f10
Capabilities:
Delete file
Get common file path
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1d0]
sub rsp, 0x2d0
mov rax, qword [0x1403749c0]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
mov r13, rcx
xor eax, eax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], 7
mov word [rsp + 0x58], ax
lea rdx, [rbp - 0x50]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x1400311e0
lea rax, [rbp - 0x50]
mov r12, 0xffffffffffffffff
mov r8, r12
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140030f90
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x58]
call fcn.1400047e0
call fcn.140018720
mov r15, rax
call fcn.140018720
mov r14, rax
call fcn.140018720
mov rsi, rax
call fcn.140018720
mov rbx, rax
call fcn.140018720
mov rdi, rax
call fcn.140018720
movzx ecx, ax
movzx edx, bx
movzx r8d, si
movzx r9d, r14w
mov dword [rsp + 0x40], ecx
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x28], r8d
mov dword [rsp + 0x20], r9d
mov r9d, r15d
lea r8, str._08x__04x__04x__04x__08x_04x
mov edx, 0x25
lea rcx, [rbp - 0x80]
call fcn.140017540
lea rax, [rbp - 0x80]
mov rdx, r12
nop dword [rax]
inc rdx
cmp byte [rax + rdx], 0
jne 0x140031020
xor esi, esi
mov r8d, esi
mov r14d, 1
mov eax, r14d
cmp r8, rdx
jae 0x14003106a
movsx ecx, byte [rsp + rax + 0x7f]
mov word [rbp + r8*2 - 0x50], cx
cmp rax, rdx
jae 0x140031067
movsx ecx, byte [rbp + rax - 0x80]
mov word [rbp + r8*2 - 0x4e], cx
add r8, 2
add rax, 2
cmp rax, 0x25
jb 0x140031037
jmp 0x14003106a
inc r8
mov word [rbp + r8*2 - 0x50], si
lea rax, [rbp - 0x50]
inc r12
cmp word [rax + r12*2], si
jne 0x140031074
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
mov rax, rdx
sub rax, rcx
cmp r12, rax
ja 0x1400310c2
lea rdi, [rcx + r12]
mov qword [rsp + 0x68], rdi
lea rbx, [rsp + 0x58]
cmp rdx, 8
cmovae rbx, qword [rsp + 0x58]
lea rcx, [rbx + rcx*2]
lea r8, [r12 + r12]
lea rdx, [rbp - 0x50]
call fcn.14015b790
mov word [rbx + rdi*2], si
jmp 0x1400310de
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x50]
movzx r8d, byte [rsp + 0x50]
mov rdx, r12
lea rcx, [rsp + 0x58]
call fcn.14000fae0
lea rcx, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rcx, qword [rsp + 0x58]
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400311e0
mov rdx, qword [r13]
mov r8, qword [r13 + 8]
sub r8, rdx
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x78]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400311d7
mov rcx, qword [r13 + 8]
sub rcx, qword [r13]
mov eax, dword [rsp + 0x78]
cmp rax, rcx
jne 0x1400311d7
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rcx, qword [rsp + 0x58]
call fcn.140018d00
sub eax, 3
je 0x14003118c
cmp eax, r14d
je 0x140031188
movzx ebx, r14b
jmp 0x1400311be
xor bl, bl
jmp 0x1400311be
xor bl, bl
lea rcx, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rcx, qword [rsp + 0x58]
lea rdx, [rbp - 0x50]
call fcn.140018e30
test al, al
je 0x1400311be
lea rcx, [rbp - 0x50]
call fcn.1400190e0
movzx ebx, bl
test al, al
cmovne ebx, r14d
lea rcx, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1400311e2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
mov rdx, qword [rsp + 0x70]
cmp rdx, 8
jb 0x140031220
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003121b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031253
call fcn.1401594f8
movzx eax, bl
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.140158fa0
lea r11, [rsp + 0x2d0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14015fc24
int3