Function at 0x48bf38
Capabilities:
Delete directory
Delete file
Move file
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x48bf40
push ecx
push ebx
mov eax, 0x48a0a0
call fcn.00407654
mov ebx, dword [0x6350a8]
xor eax, eax
push ebp
push 0x48c57d
push dword fs:[eax]
mov dword fs:[eax], esp
nop
call fcn.004899dc
test al, al
jne 0x48bf97
push 0x10
push 0
lea edx, [ebp - 0x14]
mov eax, 0xb0fd
call fcn.00464740
mov eax, dword [ebp - 0x14]
call fcn.00405858
push eax
push 0
call sub.user32.dll_MessageBoxA_1
jmp 0x48c53d
nop
call fcn.0048a040
mov edx, dword [0x63504c]
mov byte [edx], al
nop
lea edx, [ebp - 0x20]
xor eax, eax
call fcn.004033c4
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.0042316c
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
call fcn.004227c0
mov eax, dword [ebp - 0x18]
mov edx, 0x48c594
call fcn.004057f0
jne 0x48c0a2
call fcn.00403364
cmp eax, 2
jle 0x48c0de
push 0x32
call sub.kernel32.dll_Sleep_1
push 0
lea edx, [ebp - 0x24]
mov eax, 2
call fcn.004033c4
mov eax, dword [ebp - 0x24]
mov edx, 0xde
call fcn.00409bdc
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
push 0x64
call sub.kernel32.dll_Sleep_1
lea edx, [ebp - 0x2c]
mov eax, 3
call fcn.004033c4
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x28]
xor edx, edx
call fcn.00489fb8
mov eax, dword [ebp - 0x28]
call fcn.00405d34
push eax
call sub.kernel32.dll_DeleteFileW
push 0x28
call sub.kernel32.dll_Sleep_1
lea edx, [ebp - 0x34]
mov eax, 3
call fcn.004033c4
mov eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x30]
xor edx, edx
call fcn.00489fb8
mov eax, dword [ebp - 0x30]
call fcn.00405d34
push eax
push 0x48c5a4
call sub.kernel32.dll_MoveFileW
test eax, eax
je 0x48c01a
lea edx, [ebp - 0x38]
mov eax, 3
call fcn.004033c4
mov edx, dword [ebp - 0x38]
mov ecx, 0x48c5c8
xor eax, eax
call fcn.00463828
jmp 0x48c53d
call fcn.00403364
test eax, eax
jne 0x48c0b4
mov byte [0x634934], 0
jmp 0x48c0de
push 1
call sub.kernel32.dll_Sleep_1
lea edx, [ebp - 0x3c]
mov eax, 1
call fcn.004033c4
mov eax, dword [ebp - 0x3c]
mov edx, 0x48c5c8
call fcn.004057f0
je 0x48c0de
mov byte [0x634934], 0
nop
cmp byte [0x634934], 0
jne 0x48c106
lea edx, [ebp - 0x40]
xor eax, eax
call fcn.004033c4
mov edx, dword [ebp - 0x40]
mov ecx, 0x48c5c8
xor eax, eax
call fcn.00463828
jmp 0x48c53d
nop
call fcn.00489e48
test al, al
jne 0x48c12c
call fcn.00464240
test al, al
je 0x48c12c
push 0x40
push 0x48c5d0
push 0x48c5d8
push 0
call sub.user32.dll_MessageBoxA_1
nop
push 3
call sub.kernel32.dll_Sleep_1
call fcn.004640f4
push 2
lea eax, [ebp - 0x44]
call fcn.004235b8
lea eax, [ebp - 0x44]
mov edx, 0x48c680
call fcn.00405694
mov eax, dword [ebp - 0x44]
call fcn.00405858
push eax
push 0x48c694
call sub.kernel32.dll_MoveFileExA
nop
nop
call fcn.004654f4
nop
nop
mov eax, 0x48c6a8
call fcn.00484b04
test al, al
jne 0x48c1a4
mov byte [0x634930], 1
mov edx, dword [0x484abc]
xor eax, eax
call fcn.004858dc
mov edx, dword [0x634b04]
mov dword [edx], eax
call fcn.00426e44
mov eax, dword [0x634b04]
xor edx, edx
mov dword [eax], edx
mov eax, 0x48c6a8
call fcn.00484b04
test al, al
je 0x48c53d
push 0x48c6ac
call sub.kernel32.dll_RemoveDirectoryA
mov eax, 0x48c6bc
call fcn.004230a4
test al, al
je 0x48c1f2
mov eax, 0x48c6c4
call fcn.004230a4
test al, al
je 0x48c1f2
mov eax, 0x48c6d0
call fcn.004230a4
test al, al
je 0x48c1f2
mov eax, dword [0x634f84]
mov byte [eax], 1
mov eax, dword [0x634f84]
cmp byte [eax], 0
jne 0x48c313
mov eax, dword [0x634e24]
mov byte [eax], 0
mov eax, dword [ebx]
call fcn.00406700
add eax, 0xa
push eax
mov eax, ebx
mov ecx, 1
mov edx, dword [0x463778]
call fcn.004068bc
add esp, 4
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 4]
mov edx, 0x48c6e8
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 8]
mov edx, 0x48c6f8
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0xc]
mov edx, 0x48c70c
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x10]
mov edx, 0x48c720
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x14]
mov edx, 0x48c734
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x18]
mov edx, 0x48c748
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x1c]
mov edx, 0x48c75c
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x20]
mov edx, 0x48c770
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x24]
mov edx, 0x48c784
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x28]
mov edx, 0x48c798
call fcn.0040541c
jmp 0x48c4ff
mov eax, dword [ebx]
call fcn.00406700
add eax, 0x14
push eax
mov eax, ebx
mov ecx, 1
mov edx, dword [0x463778]
call fcn.004068bc
add esp, 4
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 4]
mov edx, 0x48c7ac
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 8]
mov edx, 0x48c7bc
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0xc]
mov edx, 0x48c7d0
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x10]
mov edx, 0x48c7e4
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x14]
mov edx, 0x48c7f8
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x18]
mov edx, 0x48c80c
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x1c]
mov edx, 0x48c820
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x20]
mov edx, 0x48c830
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x24]
mov edx, 0x48c844
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x28]
mov edx, 0x48c858
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x2c]
mov edx, 0x48c86c
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x30]
mov edx, 0x48c880
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x34]
mov edx, 0x48c894
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x38]
mov edx, 0x48c8a8
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x3c]
mov edx, 0x48c8bc
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x40]
mov edx, 0x48c8d0
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x44]
mov edx, 0x48c8e4
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x48]
mov edx, 0x48c8f8
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x4c]
mov edx, 0x48c90c
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x50]
mov edx, 0x48c920
call fcn.0040541c
mov edx, dword [0x486abc]
xor eax, eax
call fcn.00489414
mov edx, dword [0x634aa8]
mov dword [edx], eax
call fcn.00426e44
mov eax, dword [0x634f10]
cmp byte [eax], 0
je 0x48c53d
mov edx, dword [0x47f5ac]
xor eax, eax
call fcn.004841d0
mov edx, dword [0x634b58]
mov dword [edx], eax
call fcn.00426e44
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48c584
lea eax, [ebp - 0x44]
mov edx, 5
call fcn.004053ec
lea eax, [ebp - 0x30]
call fcn.00405ba4
lea eax, [ebp - 0x2c]
call fcn.004053c8
lea eax, [ebp - 0x28]
call fcn.00405ba4
lea eax, [ebp - 0x24]
mov edx, 5
call fcn.004053ec
ret