Function at 0x30008885
Capabilities:
Create process on windows
Delete file
Get common file path
Set file attributes

Disassembly:
push ebp
mov eax, 0x11a4
lea ebp, [esp - 0x1124]
call fcn.300101d0
mov eax, dword [0x30012970]
push ebx
push esi
xor esi, esi
push edi
mov edx, 0x81
mov dword [ebp + 0x1120], eax
xor eax, eax
mov ecx, edx
mov dword [ebp + 0xd10], esi
lea edi, [ebp + 0xd14]
rep stosd dword es:[edi], eax
mov ecx, edx
mov dword [ebp + 0xf18], esi
lea edi, [ebp + 0xf1c]
rep stosd dword es:[edi], eax
mov ecx, edx
mov dword [ebp + 0xb08], esi
lea edi, [ebp + 0xb0c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 4]
push 0x400
push eax
xor ebx, ebx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x18], esi
call fcn.30007193
cmp word [ebp - 4], si
pop ecx
lea eax, [ebp - 4]
pop ecx
mov dword [0x300129d8], eax
je 0x30008b26
cmp word [ebp - 4], 0x20
jne 0x30008935
push eax
call dword [sym.imp.USER32.dll_CharNextW]
cmp word [eax], 0x20
je 0x30008928
mov cx, word [eax]
cmp cx, si
je 0x30008aa1
cmp cx, 0x2f
je 0x30008951
cmp cx, 0x2d
jne 0x30008a3a
push eax
call dword [sym.imp.USER32.dll_CharNextW]
mov cx, word [eax]
cmp cx, 0x61
jb 0x3000896d
cmp cx, 0x7a
ja 0x3000896d
add ecx, 0xffffffe0
mov word [eax], cx
mov di, word [eax]
cmp di, si
je 0x30008a3a
cmp di, 0x3f
je 0x30008a3a
push eax
call dword [sym.imp.USER32.dll_CharNextW]
mov dword [ebp - 0x1c], eax
push edi
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.30007d4c
add esp, 0xc
test eax, eax
jne 0x30008a7d
movzx eax, di
cmp eax, 0x49
jg 0x300089fd
je 0x300089f5
sub eax, 0x41
je 0x300089ee
dec eax
dec eax
je 0x300089e6
dec eax
je 0x300089da
dec eax
je 0x300089ce
dec eax
jne 0x30008a3a
mov dword [ebp - 0x14], 1
jmp 0x30008a7a
mov dword [ebp - 8], 1
jmp 0x30008a7a
mov dword [ebp - 0x10], 1
jmp 0x30008a7d
lea eax, [ebp + 0xb08]
jmp 0x30008a24
xor ebx, ebx
jmp 0x30008a7d
lea eax, [ebp + 0xd10]
jmp 0x30008a24
sub eax, 0x50
je 0x30008a73
dec eax
je 0x30008a61
dec eax
je 0x30008a55
dec eax
je 0x30008a14
dec eax
dec eax
jne 0x30008a3a
xor ebx, ebx
inc ebx
jmp 0x30008a7d
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x28], esi
lea eax, [ebp + 0xf18]
push 0x104
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.30007c8b
add esp, 0xc
test eax, eax
jne 0x30008a7d
push 0x30006abd
push esi
push 0xaa
push dword [0x30012c08]
call fcn.300056ad
jmp 0x30009017
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x24], esi
jmp 0x30008a1e
mov dword [ebp - 0x20], 1
mov dword [ebp - 8], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0xc], esi
jmp 0x30008a7d
mov dword [ebp - 0xc], 1
mov dword [ebp - 0x20], esi
mov eax, dword [ebp - 0x1c]
jmp 0x30008a89
push eax
call dword [sym.imp.USER32.dll_CharNextW]
cmp word [eax], 0x20
je 0x30008a82
mov cx, word [eax]
cmp cx, si
jne 0x30008941
cmp word [ebp - 0x18], si
jne 0x30008aa8
mov dword [ebp - 0x18], 0xffff
mov eax, dword [ebp - 0x18]
cmp ax, 0xffff
mov word [0x300126a4], ax
jne 0x30008ac6
cmp dword [0x30013430], esi
jne 0x30008ac6
or word [0x300126a4], ax
cmp dword [ebp - 0x24], esi
je 0x30008ad3
cmp dword [ebp - 0x10], esi
je 0x30008ad8
mov dword [ebp - 0x10], esi
cmp dword [ebp - 0x10], esi
jne 0x30008b2e
cmp dword [ebp - 0x28], esi
jne 0x30008b2e
cmp dword [ebp - 0x24], esi
jne 0x30008b2e
cmp word [ebp + 0xd10], si
lea eax, [ebp + 0xd10]
mov word [ebp + 0xb08], si
mov dword [0x300129d8], eax
je 0x30008b0a
push 0x104
push eax
call fcn.300080af
pop ecx
pop ecx
lea eax, [ebp + 0xd10]
push eax
push 0x104
push 0x30012c10
call fcn.30002c36
mov dword [0x30013430], ebx
xor eax, eax
inc eax
jmp 0x3000901c
call fcn.3000df59
cmp dword [ebp - 0x20], esi
jne 0x30008b53
cmp dword [ebp - 8], esi
jne 0x30008b53
cmp dword [ebp - 0x14], esi
jne 0x30008b53
cmp dword [ebp - 0xc], esi
jne 0x30008b53
xor eax, eax
inc eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], eax
cmp dword [ebp - 0x24], esi
mov dword [0x30013430], ebx
je 0x30008d66
cmp word [ebp + 0xd10], si
lea eax, [ebp + 0xd10]
mov dword [0x300129d8], eax
je 0x30008bb5
push 0x104
push eax
call fcn.300080af
lea eax, [ebp + 0xd10]
push eax
call fcn.3000684a
add esp, 0xc
test eax, eax
jne 0x30008c0b
cmp dword [ebp - 8], esi
je 0x3000901a
mov eax, dword [0x30013430]
neg eax
sbb eax, eax
push 0x10
add eax, 0x351
push eax
push 0x330
jmp 0x30008c05
neg ebx
sbb ebx, ebx
add ebx, 0x322
push ebx
mov eax, 0x104
lea ebx, [ebp + 0xd10]
call fcn.30007c4f
mov eax, ebx
push eax
call fcn.3000684a
test eax, eax
pop ecx
pop ecx
jne 0x30008c0b
cmp dword [ebp - 8], esi
je 0x3000901a
mov eax, dword [0x30013430]
mov ecx, eax
neg ecx
sbb ecx, ecx
add ecx, 0x351
neg eax
push 0x10
sbb eax, eax
push ecx
add eax, 0x325
push eax
push esi
jmp 0x30009012
push dword [ebp - 8]
lea eax, [ebp + 0xd10]
push eax
call fcn.30008032
test eax, eax
pop ecx
pop ecx
je 0x3000901a
lea eax, [ebp + 0xd10]
push eax
mov esi, 0x104
push esi
push 0x30012c10
call fcn.30002c36
lea eax, [ebp + 0xf18]
push esi
push eax
call fcn.300080af
lea eax, [ebp + 0xf18]
push eax
call fcn.3000684a
add esp, 0xc
test eax, eax
mov esi, 0x351
je 0x30008cab
cmp dword [ebp - 8], 0
je 0x30008c8c
mov eax, dword [0x30013430]
neg eax
sbb eax, eax
push 0x24
add eax, esi
push eax
push 0x32a
push 0
call fcn.30006e80
add esp, 0x10
cmp eax, 7
je 0x3000901a
push 0x80
lea eax, [ebp + 0xf18]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp + 0xf18]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp + 0xf18]
push eax
call fcn.3000684a
test eax, eax
pop ecx
jne 0x3000901a
lea eax, [ebp + 0xf18]
push eax
call fcn.300069a6
mov edi, eax
mov bx, word [edi]
and word [edi], 0
lea eax, [ebp + 0xf18]
push eax
call fcn.30006c8d
test eax, eax
pop ecx
pop ecx
jne 0x30008d0a
cmp dword [ebp - 8], eax
je 0x3000901a
mov eax, dword [0x30013430]
neg eax
push 0x30
sbb eax, eax
add eax, esi
push eax
push 0x32e
push 0
jmp 0x30009012
push dword [ebp - 8]
lea eax, [ebp + 0xf18]
push dword [ebp - 0xc]
mov word [edi], bx
push 1
push 0
push eax
call fcn.3000f6c3
add esp, 0x14
test eax, eax
je 0x30008f38
cmp dword [ebp - 0x14], 0
je 0x30008f38
lea eax, [ebp + 0xf18]
push eax
push 0x104
push 0x300129e8
call fcn.30002c36
mov eax, dword [0x30013430]
neg eax
sbb eax, eax
push 0x40
add eax, esi
push eax
push 0x38e
jmp 0x30008e83
xor edi, edi
cmp dword [ebp - 0x28], esi
mov word [ebp + 0xd10], di
mov esi, 0x351
je 0x30008e8a
cmp dword [ebp - 0x10], edi
je 0x30008da6
cmp word [ebp - 0x18], 0xffff
je 0x30008da6
cmp dword [ebp - 8], edi
je 0x30008da6
neg ebx
sbb ebx, ebx
push 0x30
add ebx, esi
push ebx
push 0x393
push edi
call fcn.30006e80
add esp, 0x10
lea eax, [ebp + 0xf18]
push 0x104
push eax
call fcn.300080af
lea eax, [ebp + 0xf18]
push eax
call fcn.3000684a
add esp, 0xc
test eax, eax
jne 0x30008deb
cmp dword [ebp - 8], edi
je 0x3000901a
mov eax, dword [0x30013430]
neg eax
sbb eax, eax
push 0x30
add eax, esi
push eax
push 0x32b
jmp 0x30008ef2
push edi
push dword [ebp - 8]
lea eax, [ebp + 0xf18]
push eax
call fcn.3000a175
add esp, 0xc
test eax, eax
jne 0x30008e2f
cmp dword [ebp - 8], edi
je 0x3000901a
mov eax, dword [0x30013430]
mov ecx, eax
neg ecx
sbb ecx, ecx
add ecx, esi
push 0x30
push ecx
xor ecx, ecx
cmp eax, edi
sete cl
lea ecx, [ecx + ecx + 0x13f]
push ecx
jmp 0x30008ef2
push dword [ebp - 8]
lea eax, [ebp + 0xf18]
push dword [ebp - 0xc]
push edi
push dword [ebp - 0x10]
push eax
call fcn.3000ba26
add esp, 0x14
test eax, eax
je 0x30008f38
cmp dword [ebp - 0x14], 0
je 0x30008f38
lea eax, [ebp + 0xf18]
push eax
push 0x104
push 0x300129e8
call fcn.30002c36
mov eax, dword [0x30013430]
neg eax
sbb eax, eax
push 0x40
add eax, esi
push eax
push 0x38f
push 0
jmp 0x30008f30
cmp dword [ebp - 0x10], edi
je 0x30008eb3
cmp word [ebp - 0x18], 0xffff
je 0x30008eb3
cmp dword [ebp - 8], edi
je 0x30008eb3
neg ebx
sbb ebx, ebx
push 0x30
add ebx, esi
push ebx
push 0x394
push edi
call fcn.30006e80
add esp, 0x10
push 0x323
mov eax, 0x104
lea ebx, [ebp + 0xf18]
call fcn.30007c4f
mov eax, ebx
push eax
call fcn.3000684a
test eax, eax
pop ecx
pop ecx
jne 0x30008ef8
cmp dword [ebp - 8], edi
je 0x3000901a
mov eax, dword [0x30013430]
neg eax
sbb eax, eax
push 0x10
add eax, esi
push eax
push 0x326
push edi
jmp 0x30009012
push dword [ebp - 8]
lea eax, [ebp + 0xf18]
push dword [ebp - 0xc]
push edi
push 1
push eax
call fcn.3000ba26
add esp, 0x14
cmp eax, edi
mov dword [ebp - 0x2c], eax
je 0x30008f38
cmp dword [ebp - 0x14], edi
je 0x30008f38
mov eax, dword [0x30013430]
neg eax
push 0x40
sbb eax, eax
add eax, esi
push eax
push 0x390
push edi
call fcn.30006e80
add esp, 0x10
cmp word [ebp + 0xb08], 0
lea eax, [ebp + 0xb08]
mov dword [0x300129d8], eax
je 0x3000901a
cmp dword [ebp - 0x2c], 0
je 0x3000901a
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x3c], ebx
lea edi, [ebp - 0x38]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x10
pop ecx
xor eax, eax
lea edi, [ebp - 0x7c]
rep stosd dword es:[edi], eax
lea eax, [ebp + 0xb08]
push 0x30001b2c
push eax
mov dword [ebp - 0x80], 0x44
call fcn.3000726f
test eax, eax
pop ecx
pop ecx
jne 0x30008fa7
lea eax, [ebp + 0xb08]
push 0x30001b10
push eax
call fcn.3000726f
test eax, eax
pop ecx
pop ecx
je 0x30008ff9
push 0x104
lea eax, [ebp + 0x7fc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x30001af4
push 0x186
lea eax, [ebp + 0x7fc]
push eax
call fcn.3000405a
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x80]
push eax
push ebx
push ebx
push 0x4000080
push ebx
push ebx
push ebx
lea eax, [ebp + 0xb08]
push eax
lea eax, [ebp + 0x7fc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x3000901a
cmp dword [ebp - 8], ebx
je 0x3000901a
mov eax, dword [0x30013430]
neg eax
sbb eax, eax
push 0x10
add eax, esi
push eax
push 0x34f
push ebx
call fcn.30006e80
add esp, 0x10
xor eax, eax
mov ecx, dword [ebp + 0x1120]
pop edi
pop esi
pop ebx
call fcn.300101bf
add ebp, 0x1124
leave
ret