Function at 0x100057248
Capabilities:
Check if file exists
Delete file
Get common file path
Get file attributes
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x870
mov rax, qword [0x10010f190]
xor rax, rsp
mov qword [rsp + 0x860], rax
and qword [rsp + 0x28], 0
mov rbx, rcx
mov rdi, rdx
mov qword [rsp + 0x38], rdx
lea rcx, [rsp + 0x41]
xor r14d, r14d
xor ebp, ebp
xor edx, edx
mov r8d, 0x3ff
mov qword [rsp + 0x30], r14
mov byte [rsp + 0x40], bpl
call sub.msvcrt.dll_memset
and qword [rdi], rbp
lea rcx, [rsp + 0x28]
or r8d, 0xffffffff
mov rdx, rbx
xor r12d, r12d
call fcn.1000b9064
test eax, eax
jne 0x1000572dd
mov r8d, 0x8007000e
xor r9d, r9d
mov edx, 0x437013e
xor ecx, ecx
mov edi, r8d
call fcn.1000b51b8
jmp 0x1000577bf
mov rcx, qword [rsp + 0x28]
lea rdx, [0x1000161dc]
call qword [sym.imp.msvcrt.dll_fopen]
mov r13, rax
test rax, rax
jne 0x10005731c
mov rcx, rbx
mov edi, 0x80070002
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea esi, [r13 + 1]
mov edx, 0x446013e
cmp eax, 0xffffffff
cmovne edi, esi
mov r8d, edi
jmp 0x100057786
lea rcx, [rsp + 0x40]
mov esi, 1
mov r8, rax
mov edx, 0x400
mov edi, esi
call qword [sym.imp.msvcrt.dll_fgets]
test rax, rax
jne 0x100057345
mov edx, 0x44b013e
jmp 0x100057783
lea rcx, [rsp + 0x40]
mov edx, 0x5b
call qword [sym.imp.msvcrt.dll_strchr]
mov rbx, rax
test rax, rax
je 0x10005777e
lea rdx, [0x1000161e0]
mov rcx, rax
call qword [sym.imp.msvcrt.dll_strstr]
test rax, rax
je 0x10005777e
mov edx, 0x5d
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_strchr]
test rax, rax
je 0x10005777e
mov edi, reloc.certcli.dll_Ordinal_260
lea rdx, [rsp + 0x650]
lea rcx, [0x1000161f0]
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x1000573ce
lea rdx, [rsp + 0x650]
lea rcx, [0x100016200]
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x1000573d2
cmp eax, edi
jb 0x100057409
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
xor r9d, r9d
mov edx, 0x45d013e
mov r8d, eax
xor ecx, ecx
call fcn.1000b51b8
lea r8, [0x100016208]
lea rcx, [rsp + 0x650]
mov edx, 0x208
call fcn.10005f390
lea r9, [rsp + 0x440]
lea rdx, [0x100016210]
lea rcx, [rsp + 0x650]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x10005744b
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
xor r9d, r9d
mov edx, 0x467013e
mov edi, eax
mov r8d, eax
jmp 0x100057789
lea rdx, [rsp + 0x440]
lea rcx, [rsp + 0x30]
or r8d, 0xffffffff
mov r12d, esi
call fcn.1000b9064
test eax, eax
jne 0x10005748a
mov r8d, 0x8007000e
xor r9d, r9d
mov edx, 0x46e013e
xor ecx, ecx
mov edi, r8d
call fcn.1000b51b8
mov r14, qword [rsp + 0x30]
jmp 0x100057790
mov r14, qword [rsp + 0x30]
lea rdx, [0x100016218]
mov rcx, r14
call qword [sym.imp.msvcrt.dll_fopen]
mov rbp, rax
test rax, rax
jne 0x1000574bc
mov edi, 0x80070002
xor r9d, r9d
mov edx, 0x474013e
mov r8d, edi
jmp 0x100057789
lea rcx, [0x100016220]
mov rdx, rax
call qword [sym.imp.msvcrt.dll_fputs]
xor r8d, r8d
xor edx, edx
mov rcx, r13
call qword [sym.imp.msvcrt.dll_fseek]
test eax, eax
je 0x1000574f3
mov edi, 0x80070026
xor r9d, r9d
mov edx, 0x47b013e
mov r8d, edi
jmp 0x100057789
lea rcx, [rsp + 0x40]
mov r8, r13
mov edx, 0x400
call qword [sym.imp.msvcrt.dll_fgets]
test rax, rax
je 0x10005770f
lea rcx, [rsp + 0x40]
mov edx, 0xa
call qword [sym.imp.msvcrt.dll_strchr]
test rax, rax
je 0x100057738
mov byte [rax], 0
xor r12d, r12d
cmp byte [rsp + 0x40], 0x20
lea rbx, [rsp + 0x40]
lea rdi, [rsp + 0x40]
jne 0x100057547
add rdi, rsi
cmp byte [rdi], 0x20
je 0x10005753f
lea rcx, [rsp + 0x40]
mov edx, Ordinal_65
call qword [sym.imp.msvcrt.dll_strchr]
cmp byte [rdi], 0x3b
je 0x1000576bf
test rax, rax
je 0x1000576bf
lea rbx, [rax + 1]
jmp 0x100057577
sub rax, rsi
cmp byte [rax], 0x20
jne 0x100057584
lea rcx, [rsp + 0x40]
mov byte [rax], r12b
cmp rcx, rax
jb 0x10005756f
mov edx, Ordinal_36
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_strchr]
test rax, rax
setne r12b
test r12d, r12d
je 0x1000575ae
lea rcx, [0x100016248]
mov rdx, rbp
call qword [sym.imp.msvcrt.dll_fputs]
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_fputs]
test r12d, r12d
je 0x1000575cf
lea rcx, [0x100016248]
mov rdx, rbp
call qword [sym.imp.msvcrt.dll_fputs]
lea rcx, [0x10001624c]
mov rdx, rbp
call qword [sym.imp.msvcrt.dll_fputs]
jmp 0x1000575e4
add rbx, rsi
cmp byte [rbx], 0x20
je 0x1000575e1
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
sub rcx, rsi
add rcx, rbx
jmp 0x100057609
sub rcx, rsi
cmp byte [rcx], 0x20
jne 0x10005760e
mov byte [rcx], al
cmp rbx, rcx
jb 0x1000575ff
lea rdx, [0x100016250]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_strcspn]
xor r12d, r12d
cmp byte [rax + rbx], r12b
setne r12b
test r12d, r12d
je 0x1000576bf
lea rcx, [0x100016248]
mov rdx, rbp
call qword [sym.imp.msvcrt.dll_fputs]
mov edx, 0x2c
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_strchr]
mov rdi, rax
test rax, rax
je 0x1000576bf
mov edx, Ordinal_65
mov rcx, rax
call qword [sym.imp.msvcrt.dll_strchr]
test rax, rax
jne 0x1000576bf
lea r12, [rdi + 1]
jmp 0x100057674
add r12, rsi
cmp byte [r12], 0x20
je 0x100057671
jmp 0x100057685
sub rdi, rsi
cmp byte [rdi], 0x20
jne 0x10005768d
mov byte [rdi], 0
cmp rbx, rdi
jb 0x10005767d
mov rdx, rbp
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_fputs]
lea rcx, [0x100016248]
mov rdx, rbp
call qword [sym.imp.msvcrt.dll_fputs]
lea rcx, [0x100016254]
mov rdx, rbp
call qword [sym.imp.msvcrt.dll_fputs]
mov rbx, r12
xor r12d, r12d
mov rdx, rbp
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_fputs]
test r12d, r12d
je 0x1000576e0
lea rcx, [0x100016248]
mov rdx, rbp
call qword [sym.imp.msvcrt.dll_fputs]
lea rcx, [0x100016258]
mov rdx, rbp
call qword [sym.imp.msvcrt.dll_fputs]
lea rcx, [rsp + 0x40]
mov r8, r13
mov edx, 0x400
call qword [sym.imp.msvcrt.dll_fgets]
test rax, rax
jne 0x10005750f
mov r12d, esi
mov rcx, rbp
call qword [sym.imp.msvcrt.dll_fflush]
mov rcx, rbp
call qword [sym.imp.msvcrt.dll_ferror]
test eax, eax
je 0x100057754
mov r8d, 0x8007000e
xor r9d, r9d
mov edx, 0x4d9013e
mov edi, r8d
jmp 0x100057789
mov edi, 0x8007000d
xor r9d, r9d
mov edx, 0x488013e
mov r8d, edi
xor ecx, ecx
call fcn.1000b51b8
mov r12d, esi
jmp 0x100057790
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x440]
call fcn.1000b80c8
mov edi, eax
test eax, eax
je 0x100057779
xor r9d, r9d
mov r8d, eax
mov edx, 0x4dd013e
jmp 0x100057789
xor r12d, r12d
jmp 0x100057790
mov edx, 0x452013e
mov r8d, esi
mov r9d, esi
xor ecx, ecx
call fcn.1000b51b8
test r13, r13
je 0x10005779e
mov rcx, r13
call qword [sym.imp.msvcrt.dll_fclose]
test rbp, rbp
je 0x1000577ac
mov rcx, rbp
call qword [sym.imp.msvcrt.dll_fclose]
test r12d, r12d
je 0x1000577bf
lea rcx, [rsp + 0x440]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp qword [rsp + 0x28], 0
je 0x1000577d2
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_LocalFree]
test r14, r14
je 0x1000577e0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, edi
mov rcx, qword [rsp + 0x860]
xor rcx, rsp
call fcn.1000ef870
lea r11, [rsp + 0x870]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret