Function at 0x3000df59
Capabilities:
Delete file
Get common file path
Query environment variable
Set file attributes

Disassembly:
push ebp
lea ebp, [esp - 0x18c]
sub esp, 0x20c
mov eax, dword [0x30012970]
push esi
push edi
mov edi, 0x104
push edi
mov esi, 0x300161a8
push esi
mov dword [ebp + 0x188], eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x3000df94
mov eax, 0x349
jmp 0x3000e513
push esi
call fcn.3000690b
cmp word [eax], 0x5c
pop ecx
je 0x3000dfad
push 0x3000135c
push edi
push esi
call fcn.3000405a
push ebx
push edi
mov ebx, 0x30014538
push ebx
push 0x30002408
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
xor esi, esi
test eax, eax
jne 0x3000dfcd
mov word [0x30014538], si
cmp word [0x30014538], si
mov dword [0x300129d8], ebx
jne 0x3000dff0
push 0x300161a8
push edi
push ebx
call fcn.30002c36
mov dword [0x300163bc], esi
jmp 0x3000e013
push ebx
mov dword [0x300163bc], 1
call fcn.3000690b
cmp word [eax], 0x5c
pop ecx
je 0x3000e013
push 0x3000135c
push edi
push ebx
call fcn.3000405a
push ebx
push 0x300023e4
push 0x1a
push edi
mov ecx, 0x300023d4
mov ebx, 0x30014330
call fcn.3000d33b
push 0x30014538
mov ecx, 0x300023c4
push ecx
push 0x10
push edi
mov ebx, 0x30014740
call fcn.3000d33b
push 0x30014538
mov ecx, 0x300023b0
push ecx
push 6
push edi
mov ebx, 0x30014948
call fcn.3000d33b
push 0x30014538
mov ecx, 0x300023a0
push ecx
push 0x13
push edi
mov ebx, 0x30014b50
call fcn.3000d33b
add esp, 0x40
push 0x30014538
mov ecx, 0x30001ac0
push ecx
push 5
push edi
mov ebx, 0x30014d58
call fcn.3000d33b
push 0x30014538
mov ecx, 0x3000238c
push ecx
push 0x1b
push edi
mov ebx, 0x30014f60
call fcn.3000d33b
push edi
mov ebx, 0x30015168
push ebx
push 0x3000236c
push 0x30002318
push 0x80000002
call fcn.30006414
add esp, 0x34
test eax, eax
je 0x3000e0e3
push ebx
call fcn.3000690b
cmp word [eax], 0x5c
pop ecx
je 0x3000e0ef
push 0x3000135c
push edi
push ebx
call fcn.3000405a
jmp 0x3000e0ef
push 0x300022f4
push edi
push ebx
call fcn.30002c36
push edi
mov ebx, 0x30015370
push ebx
push 0x300022d4
push 0x30002318
push 0x80000002
call fcn.30006414
add esp, 0x14
test eax, eax
je 0x3000e12c
push ebx
call fcn.3000690b
cmp word [eax], 0x5c
pop ecx
je 0x3000e138
push 0x3000135c
push edi
push ebx
call fcn.3000405a
jmp 0x3000e138
push 0x30002294
push edi
push ebx
call fcn.30002c36
push 0x30014538
mov ecx, 0x30002284
push ecx
push 8
push edi
mov ebx, 0x30015578
call fcn.3000d33b
push 0x30014538
mov ecx, 0x30002274
push ecx
push 9
push edi
mov ebx, 0x30015780
call fcn.3000d33b
push esi
push esi
push 0x15
push edi
mov ecx, 0x30002260
mov ebx, 0x30015988
call fcn.3000d33b
push 0x30014538
mov ecx, 0x30002248
push ecx
push 0xb
push edi
mov ebx, 0x30015b90
call fcn.3000d33b
add esp, 0x40
push ebx
mov ecx, 0x30002234
push ecx
push 2
push edi
mov ebx, 0x30015d98
call fcn.3000d33b
push ebx
mov ecx, 0x30002224
push ecx
push 7
push edi
mov ebx, 0x30015fa0
call fcn.3000d33b
add esp, 0x20
cmp dword [0x30013434], esi
je 0x3000e4ee
lea eax, [ebp - 0x80]
push eax
push edi
call fcn.3000781b
lea eax, [ebp - 0x80]
push eax
call fcn.3000690b
add esp, 0xc
cmp word [eax], 0x5c
je 0x3000e1f9
push 0x3000135c
push edi
lea eax, [ebp - 0x80]
push eax
call fcn.3000405a
push 0x30002208
push edi
lea eax, [ebp - 0x80]
push eax
call fcn.3000405a
lea eax, [ebp - 0x80]
push eax
call fcn.3000684a
test eax, eax
pop ecx
je 0x3000e22f
push 0x80
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x80]
push eax
call fcn.3000684a
test eax, eax
pop ecx
jne 0x3000e4ee
push esi
push esi
lea eax, [ebp - 0x80]
push esi
push eax
call fcn.30002e2b
mov edi, eax
add esp, 0x10
cmp edi, 0xffffffff
je 0x3000e4ee
push esi
push esi
push 0x300021b8
lea eax, [ebp - 0x80]
push eax
push edi
call fcn.30002ffb
push esi
push esi
push 0x30002194
lea eax, [ebp - 0x80]
push eax
push edi
call fcn.30002ffb
push esi
push esi
push 0x300161a8
lea eax, [ebp - 0x80]
push eax
push edi
call fcn.30002ffb
push esi
push esi
push 0x30002170
lea eax, [ebp - 0x80]
push eax
push edi
call fcn.30002ffb
add esp, 0x50
push esi
push esi
push 0x30014538
lea eax, [ebp - 0x80]
push eax
push edi
call fcn.30002ffb
push esi
push esi
push 0x3000214c
lea eax, [ebp - 0x80]
push eax
push edi
call fcn.30002ffb
push esi
push esi
push 0x30014330
lea eax, [ebp - 0x80]
push eax
push edi
call fcn.30002ffb
push esi
push esi
push 0x30002128
lea eax, [ebp - 0x80]
push eax
push edi
call fcn.30002ffb
add esp, 0x50
push esi
push esi
push 0x30014740
lea eax, [ebp - 0x80]
push eax
push edi
call fcn.30002ffb
push esi
push esi
push 0x30002104
lea eax, [ebp - 0x80]
push eax
push edi
call fcn.30002ffb
push esi
push esi
push 0x30014948
lea eax, [ebp - 0x80]
push eax
push edi
call fcn.30002ffb
push esi
push esi
push 0x300020e0
lea eax, [ebp - 0x80]
push eax
push edi
call fcn.30002ffb
add esp, 0x50
push esi
push esi
push 0x30014b50
lea eax, [ebp - 0x80]
push eax
push edi
call fcn.30002ffb
push esi
push esi
push 0x300020bc
lea eax, [ebp - 0x80]
push eax
push edi
call fcn.30002ffb
push esi
push esi
push 0x30014d58
lea eax, [ebp - 0x80]
push eax
push edi
call fcn.30002ffb
push esi
push esi
push 0x30002098
lea eax, [ebp - 0x80]
push eax
push edi
call fcn.30002ffb
add esp, 0x50
push esi
push esi
push 0x30014f60
lea eax, [ebp - 0x80]
push eax
push edi
call fcn.30002ffb
push esi
push esi
push 0x30002074
lea eax, [ebp - 0x80]
push eax
push edi
call fcn.30002ffb
push esi
push esi
push 0x30015578
lea eax, [ebp - 0x80]
push eax
push edi
call fcn.30002ffb
push esi
push esi
push 0x30002050
lea eax, [ebp - 0x80]
push eax
push edi
call fcn.30002ffb
add esp, 0x50
push esi
push esi
push 0x30015780
lea eax, [ebp - 0x80]
push eax
push edi
call fcn.30002ffb
push esi
push esi
mov ebx, 0x30002048
push ebx
lea eax, [ebp - 0x80]
push eax
push edi
call fcn.30002ffb
push esi
push esi
push 0x30002024
lea eax, [ebp - 0x80]
push eax
push edi
call fcn.30002ffb
push esi
push esi
push 0x30015b90
lea eax, [ebp - 0x80]
push eax
push edi
call fcn.30002ffb
add esp, 0x50
push esi
push esi
push 0x30002000
lea eax, [ebp - 0x80]
push eax
push edi
call fcn.30002ffb
push esi
push esi
push 0x30015d98
lea eax, [ebp - 0x80]
push eax
push edi
call fcn.30002ffb
push esi
push esi
push 0x30001fdc
lea eax, [ebp - 0x80]
push eax
push edi
call fcn.30002ffb
push esi
push esi
push 0x30015fa0
lea eax, [ebp - 0x80]
push eax
push edi
call fcn.30002ffb
add esp, 0x50
push esi
push esi
push ebx
lea eax, [ebp - 0x80]
push eax
push edi
call fcn.30002ffb
push esi
push esi
push 0x30001fb8
lea eax, [ebp - 0x80]
push eax
push edi
call fcn.30002ffb
push esi
push esi
push 0x30015168
lea eax, [ebp - 0x80]
push eax
push edi
call fcn.30002ffb
push esi
push esi
push 0x30001f94
lea eax, [ebp - 0x80]
push eax
push edi
call fcn.30002ffb
add esp, 0x50
push esi
push esi
push 0x30015370
lea eax, [ebp - 0x80]
push eax
push edi
call fcn.30002ffb
push esi
push esi
push ebx
lea eax, [ebp - 0x80]
push eax
push edi
call fcn.30002ffb
push esi
push esi
push 0x30001f70
lea eax, [ebp - 0x80]
push eax
push edi
call fcn.30002ffb
push esi
push esi
push 0x30015988
lea eax, [ebp - 0x80]
push eax
push edi
call fcn.30002ffb
add esp, 0x50
push esi
push esi
push 0x30001f64
lea eax, [ebp - 0x80]
push eax
push edi
call fcn.30002ffb
add esp, 0x14
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x30014330
push eax
mov dword [0x3001296c], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [0x300163b0], eax
mov eax, dword [0x300163b4]
neg eax
sbb eax, eax
and eax, 0x349
pop ebx
mov ecx, dword [ebp + 0x188]
pop edi
pop esi
call fcn.300101bf
add ebp, 0x18c
leave
ret