Function at 0x100030b0
Capabilities:
Create directory
Create process on windows
Create shortcut via ishelllink
Delete directory
Delete file
Enumerate gui resources
Enumerate processes
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x77c
mov eax, dword [0x10007024]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x330]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
call fcn.10002e30
push eax
lea eax, [ebp - 0x330]
push eax
lea eax, [ebp - 0x120]
push str._shi_014_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x120]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0
xor bl, bl
mov dword [ebp - 0x644], 0x104
push 2
mov byte [ebp - 0x779], bl
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
mov dword [ebp - 0x778], 0x128
lea eax, [ebp - 0x778]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32First]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x100031c3
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
nop
push str.wegame.exe
lea eax, [ebp - 0x754]
push eax
call ebx
test eax, eax
jne 0x100031ab
push dword [ebp - 0x770]
push eax
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x100031a5
lea eax, [ebp - 0x644]
push eax
lea eax, [ebp - 0x438]
push eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameA]
test eax, eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
setne byte [ebp - 0x779]
call esi
jmp 0x100031ab
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x778]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x10003150
mov bl, byte [ebp - 0x779]
push edi
call esi
test bl, bl
je 0x1000334f
call fcn.10002e30
push eax
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x228]
push str._s_s.lnk
push eax
call fcn.100038e0
mov eax, dword [0x100053e8]
add esp, 0x10
movq xmm0, qword [str._disablesp_1]
mov dword [ebp - 0xc], eax
mov al, byte [0x100053ec]
push 0
movq qword [ebp - 0x14], xmm0
mov byte [ebp - 8], al
mov dword [ebp - 0x648], 0
mov dword [ebp - 0x64c], 0
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 0x648]
push eax
push 0x100051d0
push 1
push 0
push 0x100051f0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x100032ff
mov eax, dword [ebp - 0x648]
lea edx, [ebp - 0x438]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov eax, dword [ebp - 0x648]
lea edx, [ebp - 0x14]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [ebp - 0x648]
lea edx, [ebp - 0x64c]
push edx
push 0x100051e0
push eax
mov ecx, dword [eax]
call dword [ecx]
test eax, eax
jns 0x10003297
mov eax, dword [ebp - 0x648]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
jmp 0x100032ff
push 0x208
lea eax, [ebp - 0x640]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x640]
push 0x104
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x228]
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [ebp - 0x64c]
lea edx, [ebp - 0x640]
push 1
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov eax, dword [ebp - 0x648]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x64c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
push 0
push 0
push 0
lea eax, [ebp - 0x120]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jle 0x1000333f
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0xfa0
call esi
push 0
push 0x10003020
call dword [sym.imp.USER32.dll_EnumWindows]
push 0xfa0
call esi
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
add esp, 4
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10003e55
mov esp, ebp
pop ebp
ret