Function at 0x10030230
Capabilities:
Delete file
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x9c
mov eax, dword [0x1005f0b4]
xor eax, esp
mov dword [esp + 0x98], eax
push ebx
push esi
push edi
mov edi, edx
xor ebx, ebx
mov dword [esp + 0x28], edi
mov esi, ecx
mov dword [esp + 0x24], ebx
call fcn.100310ba
mov dword [esp + 0x30], eax
test eax, eax
je 0x10030738
and dword [esp + 0x10], ebx
lea edx, [esp + 0x10]
mov ecx, eax
call fcn.10030a25
mov esi, eax
mov dword [esp + 0x20], esi
test esi, esi
je 0x10030701
test edi, 1
je 0x10030297
xor eax, eax
jmp 0x1003029a
push 7
pop eax
push 0
push 0x2200000
push 3
push 0
push eax
push 0x10180
push esi
mov dword [esp + 0x48], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0x1c], eax
cmp eax, 0xffffffff
je 0x100306a1
and dword [esp + 0x14], ebx
mov dword [esp + 0x18], 1
test edi, 0x20
je 0x10030341
lea ecx, [esp + 0x14]
mov edx, esi
push ecx
lea ecx, [esp + 0x1c]
push ecx
mov ecx, eax
call fcn.1003196e
test eax, eax
jne 0x10030312
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push 0x1000de70
push 0x3000000
push 0x1005f83c
call fcn.1002fa5c
xor eax, eax
add esp, 0x14
inc eax
jmp 0x10030316
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x10030341
mov edi, dword [esp + 0x14]
mov ebx, 0x2a9
push edi
push esi
push 0x1000e2b0
push 0x3000000
push 0x1005f83c
call fcn.1002fa5c
add esp, 0x14
jmp 0x10030681
push 0x34
lea eax, [esp + 0x74]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea edi, [esp + 0x48]
xor eax, eax
push 0xa
pop ecx
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x1c]
lea eax, [esp + 0x70]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x1003065c
push 0x28
lea eax, [esp + 0x4c]
push eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandleEx]
test eax, eax
je 0x1003065c
push 0x28
lea eax, [esp + 0x4c]
mov dword [esp + 0x6c], 0x2000
push eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_SetFileInformationByHandle]
test eax, eax
je 0x1003064b
xor edi, edi
cmp dword [esp + 0x10], ebx
je 0x10030556
call fcn.100301b7
test eax, eax
je 0x10030556
cmp dword [esp + 0x98], 1
jbe 0x100304b9
push 0x10000
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x1003053a
mov eax, dword [esp + 0x10]
mov edx, 0x8000
sub eax, esi
mov ecx, edi
sar eax, 1
push eax
push esi
mov dword [esp + 0x20], eax
call fcn.1002f5b7
mov eax, dword [esp + 0x18]
mov ecx, 0x8000
sub ecx, eax
mov dword [esp + 0x18], ecx
mov dword [esp + 0x10], ecx
lea edx, [edi + eax*2]
push edx
lea eax, [esp + 0x14]
mov dword [esp + 0x38], edx
push eax
push 0
push esi
mov esi, dword [0x1005f834]
mov ecx, esi
call dword [0x10060380]
call esi
mov esi, eax
mov dword [esp + 0x38], esi
cmp esi, 0xffffffff
je 0x100304b5
mov ebx, dword [esp + 0x20]
push ebx
push edi
call sub.msvcrt.dll__wcsicmp
mov edx, dword [esp + 0x20]
pop ecx
pop ecx
xor ecx, ecx
mov dword [esp + 0x10], edx
test eax, eax
setne cl
mov dword [esp + 0x3c], ecx
test eax, eax
jne 0x10030494
push dword [esp + 0x34]
lea eax, [esp + 0x14]
push eax
push esi
mov esi, dword [0x1005f838]
mov ecx, esi
call dword [0x10060380]
call esi
mov esi, dword [esp + 0x38]
test eax, eax
jne 0x1003044e
mov ecx, dword [esp + 0x3c]
mov ebx, dword [esp + 0x24]
test ecx, ecx
jne 0x100304ae
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, dword [esp + 0x20]
push 0xd
push 1
lea eax, [esp + 0x17]
mov byte [esp + 0x17], 1
push eax
lea eax, [esp + 0x4c]
push eax
push dword [esp + 0x2c]
call dword [sym.imp.ntdll.dll_NtSetInformationFile]
test eax, eax
jns 0x10030583
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
push 0x40
mov ebx, eax
mov dword [esp + 0x28], 1
push 4
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x4c]
push eax
push dword [esp + 0x2c]
call dword [sym.imp.ntdll.dll_NtSetInformationFile]
test eax, eax
jns 0x10030581
cmp eax, 0xc0000003
je 0x1003051b
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov ebx, eax
test ebx, ebx
je 0x10030583
push ebx
push esi
push 0x1000dfe8
push 0x3000000
push 0x1005f83c
call fcn.1002fa5c
add esp, 0x14
jmp 0x10030583
push 0x1000def8
push 0x3000000
push 0x1005f83c
call fcn.1002fa5c
add esp, 0xc
jmp 0x100304b9
cmp dword [esp + 0x98], 1
jbe 0x100304b9
push esi
push 0x1000df68
push 0x3000000
push 0x1005f83c
call fcn.1002fa5c
add esp, 0x10
jmp 0x100304b9
xor ebx, ebx
test edi, edi
je 0x1003067d
test dword [esp + 0x28], 4
jne 0x100305ad
push edi
push 0x1000e048
push 0x4000000
push 0x1005f83c
call fcn.1002fa5c
add esp, 0x10
push 0
push 0x2200000
push 3
push 0
push dword [esp + 0x3c]
push 0x100
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, eax
mov dword [esp + 0x28], ecx
cmp ecx, 0xffffffff
je 0x1003061a
mov eax, dword [esp + 0x70]
push 0x28
mov dword [esp + 0x6c], eax
lea eax, [esp + 0x4c]
push eax
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileInformationByHandle]
test eax, eax
jne 0x1003060e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push 0x1000e0d0
push 0x3000000
push 0x1005f83c
call fcn.1002fa5c
add esp, 0x14
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10030639
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push 0x1000e150
push 0x3000000
push 0x1005f83c
call fcn.1002fa5c
add esp, 0x14
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1003067d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push ebx
push esi
push 0x1000e1b0
jmp 0x1003066b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push ebx
push esi
push 0x1000e238
push 0x3000000
push 0x1005f83c
call fcn.1002fa5c
add esp, 0x14
mov edi, dword [esp + 0x14]
test edi, edi
je 0x10030695
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100306eb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, 5
jne 0x100306d2
test edi, 0x20
jne 0x100306d2
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x100306eb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push ebx
push esi
push 0x1000e320
jmp 0x100306d9
push ebx
push esi
push 0x1000e150
push 0x3000000
push 0x1005f83c
call fcn.1002fa5c
add esp, 0x14
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [esp + 0x30]
jmp 0x10030726
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [esp + 0x30]
mov ebx, eax
push ebx
push esi
push 0x1000e380
push 0x3000000
push 0x1005f83c
call fcn.1002fa5c
add esp, 0x14
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x10030759
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push ebx
push esi
push 0x1000e408
push 0x3000000
push 0x1005f83c
call fcn.1002fa5c
add esp, 0x14
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [esp + 0xa4]
xor eax, eax
pop edi
test ebx, ebx
pop esi
sete al
pop ebx
xor ecx, esp
call fcn.1004f280
mov esp, ebp
pop ebp
ret