Function at 0x4676d0
Capabilities:
Delete directory
Move file
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x52c0aa
mov eax, dword fs:[0]
push eax
sub esp, 0x208
mov eax, dword [0x55bb24]
xor eax, esp
mov dword [esp + 0x200], eax
push ebx
push esi
push edi
mov eax, dword [0x55bb24]
xor eax, esp
push eax
lea eax, [esp + 0x218]
mov dword fs:[0], eax
call fcn.004cefff
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 8]
push 0x40
call eax
test al, al
je 0x467799
push 0x534dc4
push ecx
push str.Removing_Yupdate.
push ecx
push 0x534dd4
push ecx
push 0xe
push ecx
push 0x534dd8
push ecx
push str.CommitSuicide
push ecx
push 0x534dc0
push ecx
call fcn.004cf0d6
add esp, 4
push eax
call fcn.00405660
add esp, 0xc
push eax
call fcn.00405660
add esp, 0xc
push eax
call fcn.00405660
add esp, 0xc
push eax
call fcn.00402b90
add esp, 4
push eax
call fcn.00405660
add esp, 0xc
push eax
call fcn.00405660
add esp, 0xc
push eax
call fcn.00405660
add esp, 8
push 0x40
call fcn.004cf0e5
lea esi, [esp + 0x18]
call fcn.004cc986
xor edi, edi
mov edx, eax
lea esi, [esp + 0x34]
mov dword [esp + 0x220], edi
call fcn.00427180
mov esi, 8
mov byte [esp + 0x220], 1
cmp dword [eax + 0x18], esi
jb 0x4677cd
mov eax, dword [eax + 4]
jmp 0x4677d0
add eax, 4
push eax
call fcn.004d5822
add esp, 4
cmp dword [esp + 0x4c], esi
jb 0x4677ec
mov ecx, dword [esp + 0x38]
push ecx
call fcn.004f0cfc
add esp, 4
xor edx, edx
mov dword [esp + 0x220], 0xffffffff
mov dword [esp + 0x4c], 7
mov dword [esp + 0x48], edi
mov word [esp + 0x38], dx
cmp dword [esp + 0x30], esi
jb 0x46781d
mov eax, dword [esp + 0x1c]
push eax
call fcn.004f0cfc
add esp, 4
call fcn.004cefff
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 8]
push 0x100
call eax
test al, al
je 0x4678ac
push 0x534dc4
push ecx
push str.Wait_for_process_termination...
push ecx
push 0x534dd4
push ecx
push 0x14
push ecx
push 0x534dd8
push ecx
push str.CommitSuicide
push ecx
push 0x534dc0
push ecx
call fcn.004cf0d6
add esp, 4
push eax
call fcn.00405660
add esp, 0xc
push eax
call fcn.00405660
add esp, 0xc
push eax
call fcn.00405660
add esp, 0xc
push eax
call fcn.00402b90
add esp, 4
push eax
call fcn.00405660
add esp, 0xc
push eax
call fcn.00405660
add esp, 0xc
push eax
call fcn.00405660
add esp, 8
push 0x100
call fcn.004cf0e5
mov ebx, 0x14
jmp 0x4678c0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0xa4], 0
lea edi, [esp + 0xa4]
mov dword [esp + 0xcc], esp
call fcn.004cca4b
call fcn.004ce773
add esp, 0x1c
test al, al
je 0x4679ac
mov esi, dword [esp + 0x88]
cmp esi, 1
jle 0x4679ac
call fcn.004cefff
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 8]
push 0x100
call eax
test al, al
je 0x4679a1
push 0x534dc4
push ecx
push esi
push ecx
push str.Process_count:
push ecx
push 0x534dd4
push ecx
push 0x1a
push ecx
push 0x534dd8
push ecx
push str.CommitSuicide
push ecx
push 0x534dc0
push ecx
call fcn.004cf0d6
add esp, 4
push eax
call fcn.00405660
add esp, 0xc
push eax
call fcn.00405660
add esp, 0xc
push eax
call fcn.00405660
add esp, 0xc
push eax
call fcn.00402b90
add esp, 4
push eax
call fcn.00405660
add esp, 0xc
push eax
call fcn.00405660
add esp, 0xc
push eax
call fcn.00402b90
add esp, 4
push eax
call fcn.00405660
add esp, 8
push 0x100
call fcn.004cf0e5
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
sub ebx, 1
jne 0x4678c0
call fcn.004cefff
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 8]
push 0x100
call eax
test al, al
je 0x467a44
push 0x534dc4
push ecx
push str.Move_exe_to_temp...
push ecx
push 0x534dd4
push ecx
push 0x21
push ecx
push 0x534dd8
push ecx
push str.CommitSuicide
push ecx
push 0x534dc0
push ecx
call fcn.004cf0d6
add esp, 4
push eax
call fcn.00405660
add esp, 0xc
push eax
call fcn.00405660
add esp, 0xc
push eax
call fcn.00405660
add esp, 0xc
push eax
call fcn.00402b90
add esp, 4
push eax
call fcn.00405660
add esp, 0xc
push eax
call fcn.00405660
add esp, 0xc
push eax
call fcn.00405660
add esp, 8
push 0x100
call fcn.004cf0e5
call fcn.004d00f8
lea ecx, [esp + 0x18]
push ecx
call fcn.004d066e
add esp, 4
lea esi, [esp + 0x50]
mov dword [esp + 0x220], 2
call fcn.0040b2f0
mov esi, eax
lea edx, [esp + 0x6c]
push edx
mov byte [esp + 0x224], 3
call fcn.004d05f3
add esp, 4
mov edx, str.yupdate.exe_
mov ecx, eax
lea edi, [esp + 0x34]
mov byte [esp + 0x220], 4
call fcn.0041ad70
push esi
mov ecx, eax
lea esi, [esp + 0xd4]
mov byte [esp + 0x224], 5
call fcn.0040a800
add esp, 4
cmp dword [esp + 0x4c], 8
jb 0x467ac7
mov eax, dword [esp + 0x38]
push eax
call fcn.004f0cfc
add esp, 4
mov edi, 7
xor ebx, ebx
xor ecx, ecx
mov dword [esp + 0x4c], edi
mov dword [esp + 0x48], ebx
mov word [esp + 0x38], cx
mov esi, 8
cmp dword [esp + 0x84], esi
jb 0x467af8
mov edx, dword [esp + 0x70]
push edx
call fcn.004f0cfc
add esp, 4
xor eax, eax
mov dword [esp + 0x84], edi
mov dword [esp + 0x80], ebx
mov word [esp + 0x70], ax
cmp dword [esp + 0x68], esi
jb 0x467b20
mov ecx, dword [esp + 0x54]
push ecx
call fcn.004f0cfc
add esp, 4
xor edx, edx
mov dword [esp + 0x68], edi
mov dword [esp + 0x64], ebx
mov word [esp + 0x54], dx
mov byte [esp + 0x220], 0xa
cmp dword [esp + 0x30], 0x10
jb 0x467b4b
mov eax, dword [esp + 0x1c]
push eax
call fcn.004f0cfc
add esp, 4
mov edi, 0xf
mov dword [esp + 0x30], edi
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], 0
call fcn.004d00f8
lea ecx, [esp + 0xb4]
push ecx
call fcn.004d0308
mov byte [esp + 0x220], 0xb
mov ecx, dword [esp + 0xd4]
cmp dword [esp + 0xe8], esi
jae 0x467b8e
lea ecx, [esp + 0xd4]
mov eax, dword [esp + 0xb8]
cmp dword [esp + 0xcc], esi
jae 0x467ba5
lea eax, [esp + 0xb8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x46814a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call fcn.004cefff
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 8]
push esi
call eax
test al, al
je 0x467d23
lea eax, [esp + 0xd0]
lea esi, [esp + 0x34]
call fcn.0040bab0
mov esi, eax
lea ecx, [esp + 0xb4]
push ecx
lea edx, [esp + 0x1c]
push edx
mov byte [esp + 0x228], 0xc
call fcn.004022c0
add esp, 8
push str.__error:_0x
push ecx
push esi
push ecx
push str._to
push ecx
push eax
push ecx
push str.Failed_to_move
push ecx
push 0x534dd4
push ecx
push 0x26
push ecx
push 0x534dd8
push ecx
push str.CommitSuicide
push ecx
push 0x534dc0
push ecx
mov byte [esp + 0x270], 0xd
call fcn.004cf0d6
add esp, 4
push eax
call fcn.00405660
add esp, 0xc
push eax
call fcn.00405660
add esp, 0xc
push eax
call fcn.00405660
add esp, 0xc
push eax
call fcn.00402b90
add esp, 4
push eax
call fcn.00405660
add esp, 0xc
push eax
call fcn.00405660
add esp, 0xc
push eax
call fcn.00405890
add esp, 0xc
push eax
call fcn.00405660
add esp, 0xc
push eax
call fcn.00405890
add esp, 0xc
push eax
call fcn.00405660
add esp, 8
cmp eax, ebx
jne 0x467ca6
xor ecx, ecx
jmp 0x467cad
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
add ecx, eax
mov edx, dword [ecx + 0x10]
push 0x534dc4
push ecx
and edx, 0xfffff9ff
push edi
or edx, 0x800
push eax
mov dword [ecx + 0x10], edx
call fcn.0041f0d0
add esp, 4
push eax
call fcn.00405660
mov esi, 0x10
add esp, 8
cmp dword [esp + 0x30], esi
jb 0x467cf0
mov eax, dword [esp + 0x1c]
push eax
call fcn.004f0cfc
add esp, 4
mov byte [esp + 0x220], 0xb
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], 0
cmp dword [esp + 0x4c], esi
jb 0x467d1c
mov ecx, dword [esp + 0x38]
push ecx
call fcn.004f0cfc
add esp, 4
push 8
call fcn.004cf0e5
lea edx, [esp + 0x50]
push edx
call fcn.004d066e
add esp, 4
lea esi, [esp + 0x6c]
mov byte [esp + 0x220], 0xe
call fcn.0040b2f0
mov esi, eax
mov edx, 0x53e5f0
lea ecx, [esp + 0xb4]
lea edi, [esp + 0x34]
mov byte [esp + 0x220], 0xf
call fcn.0041ad70
push esi
mov ecx, eax
lea esi, [esp + 0x1c]
mov byte [esp + 0x224], 0x10
call fcn.0040a800
add esp, 4
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0xdc]
mov byte [esp + 0x22c], 0x11
call fcn.00403000
cmp dword [esp + 0x30], 8
jb 0x467da3
mov eax, dword [esp + 0x1c]
push eax
call fcn.004f0cfc
add esp, 4
xor ecx, ecx
mov edi, 8
mov esi, 7
mov dword [esp + 0x30], esi
mov dword [esp + 0x2c], ebx
mov word [esp + 0x1c], cx
cmp dword [esp + 0x4c], edi
jb 0x467dcf
mov edx, dword [esp + 0x38]
push edx
call fcn.004f0cfc
add esp, 4
xor eax, eax
mov dword [esp + 0x4c], esi
mov dword [esp + 0x48], ebx
mov word [esp + 0x38], ax
cmp dword [esp + 0x84], edi
jb 0x467df4
mov ecx, dword [esp + 0x70]
push ecx
call fcn.004f0cfc
add esp, 4
xor edx, edx
mov byte [esp + 0x220], 0xb
cmp dword [esp + 0x68], 0x10
mov dword [esp + 0x84], esi
mov dword [esp + 0x80], ebx
mov word [esp + 0x70], dx
jb 0x467e25
mov eax, dword [esp + 0x54]
push eax
call fcn.004f0cfc
add esp, 4
mov ecx, dword [esp + 0xd4]
cmp dword [esp + 0xe8], edi
jae 0x467e3c
lea ecx, [esp + 0xd4]
mov eax, dword [esp + 0xb8]
cmp dword [esp + 0xcc], edi
jae 0x467e53
lea eax, [esp + 0xb8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x46858e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call fcn.004cefff
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 8]
push 8
call eax
test al, al
je 0x467fd6
lea eax, [esp + 0xd0]
lea esi, [esp + 0x34]
call fcn.0040bab0
mov esi, eax
lea ecx, [esp + 0xb4]
push ecx
lea edx, [esp + 0x1c]
push edx
mov byte [esp + 0x228], 0x12
call fcn.004022c0
add esp, 8
push str.__error:_0x
push ecx
push esi
push ecx
push str._to
push ecx
push eax
push ecx
push str.Failed_to_move
push ecx
push 0x534dd4
push ecx
push 0x2a
push ecx
push 0x534dd8
push ecx
push str.CommitSuicide
push ecx
push 0x534dc0
push ecx
mov byte [esp + 0x270], 0x13
call fcn.004cf0d6
add esp, 4
push eax
call fcn.00405660
add esp, 0xc
push eax
call fcn.00405660
add esp, 0xc
push eax
call fcn.00405660
add esp, 0xc
push eax
call fcn.00402b90
add esp, 4
push eax
call fcn.00405660
add esp, 0xc
push eax
call fcn.00405660
add esp, 0xc
push eax
call fcn.00405890
add esp, 0xc
push eax
call fcn.00405660
add esp, 0xc
push eax
call fcn.00405890
add esp, 0xc
push eax
call fcn.00405660
add esp, 8
test eax, eax
jne 0x467f55
xor ecx, ecx
jmp 0x467f5c
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
add ecx, eax
mov edx, dword [ecx + 0x10]
push 0x534dc4
push ecx
and edx, 0xfffff9ff
push edi
or edx, 0x800
push eax
mov dword [ecx + 0x10], edx
call fcn.0041f0d0
add esp, 4
push eax
call fcn.00405660
mov esi, 0x10
add esp, 8
cmp dword [esp + 0x30], esi
jb 0x467f9f
mov eax, dword [esp + 0x1c]
push eax
call fcn.004f0cfc
add esp, 4
mov byte [esp + 0x220], 0xb
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], 0
mov byte [esp + 0x1c], 0
cmp dword [esp + 0x4c], esi
jb 0x467fcf
mov ecx, dword [esp + 0x38]
push ecx
call fcn.004f0cfc
add esp, 4
push 8
call fcn.004cf0e5
push 0x31
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
lea ecx, [esp + 0x58]
mov dword [esp + 0x70], 0xf
mov dword [esp + 0x6c], 0
mov byte [esp + 0x5c], 0
call fcn.00403c20
lea edx, [esp + 0x50]
push edx
lea eax, [esp + 0xf0]
push eax
mov ebx, SysReAllocString
mov byte [esp + 0x228], 0x14
call fcn.004675c0
mov byte [esp + 0x220], 0x16
cmp dword [esp + 0x68], 0x10
jb 0x468036
mov ecx, dword [esp + 0x54]
push ecx
call fcn.004f0cfc
add esp, 4
xor ebx, ebx
mov edi, 7
mov eax, 0xf
push edi
push str.Suicide
lea ecx, [esp + 0x74]
mov dword [esp + 0x70], eax
mov dword [esp + 0x6c], ebx
mov byte [esp + 0x5c], bl
mov dword [esp + 0x8c], eax
mov dword [esp + 0x88], ebx
mov byte [esp + 0x78], bl
call fcn.00403c20
push str.___del
lea ecx, [esp + 0x38]
mov byte [esp + 0x224], 0x17
call fcn.0040b580
push eax
lea ecx, [esp + 0xb8]
lea esi, [esp + 0x1c]
mov byte [esp + 0x224], 0x18
call fcn.0040a800
add esp, 4
mov esi, eax
lea edx, [esp + 0x6c]
push edx
lea eax, [esp + 0xf0]
push eax
lea ecx, [esp + 0x94]
mov byte [esp + 0x228], 0x19
call fcn.004457e0
mov ecx, esi
mov edx, eax
mov byte [esp + 0x220], 0x1a
call fcn.00445450
lea esi, [esp + 0x8c]
call fcn.00445400
mov esi, 8
cmp dword [esp + 0x30], esi
jb 0x4680f9
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.004f0cfc
add esp, 4
xor edx, edx
mov dword [esp + 0x30], edi
mov dword [esp + 0x2c], ebx
mov word [esp + 0x1c], dx
cmp dword [esp + 0x4c], esi
jb 0x46811b
mov eax, dword [esp + 0x38]
push eax
call fcn.004f0cfc
add esp, 4
xor ecx, ecx
cmp dword [esp + 0x84], 0x10
mov dword [esp + 0x4c], edi
mov dword [esp + 0x48], ebx
mov word [esp + 0x38], cx
jb 0x468582
mov edx, dword [esp + 0x70]
push edx
call fcn.004f0cfc
add esp, 4
jmp 0x468582
push 0x31
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
lea ecx, [esp + 0x58]
mov dword [esp + 0x70], edi
mov dword [esp + 0x6c], 0
mov byte [esp + 0x5c], 0
call fcn.00403c20
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 0xf0]
push ecx
mov ebx, SysReAllocString
mov byte [esp + 0x228], 0x1b
call fcn.004675c0
mov byte [esp + 0x220], 0x1d
cmp dword [esp + 0x68], 0x10
jb 0x4681a6
mov edx, dword [esp + 0x54]
push edx
call fcn.004f0cfc
add esp, 4
xor ebx, ebx
mov eax, 0xf
push 9
push str.ClearTemp
lea ecx, [esp + 0x3c]
mov dword [esp + 0x70], eax
mov dword [esp + 0x6c], ebx
mov byte [esp + 0x5c], bl
mov dword [esp + 0x54], eax
mov dword [esp + 0x50], ebx
mov byte [esp + 0x40], bl
call fcn.00403c20
mov byte [esp + 0x220], 0x1e
push 4
xor eax, eax
mov edi, 7
push str.del
lea ecx, [esp + 0x74]
mov dword [esp + 0x8c], edi
mov dword [esp + 0x88], ebx
mov word [esp + 0x78], ax
call fcn.0040b490
lea ecx, [esp + 0xd0]
push ecx
lea ecx, [esp + 0x70]
lea esi, [esp + 0x1c]
mov byte [esp + 0x224], 0x1f
call fcn.0040a800
add esp, 4
mov esi, eax
lea edx, [esp + 0x34]
push edx
lea eax, [esp + 0xf0]
push eax
lea ecx, [esp + 0x94]
mov byte [esp + 0x228], 0x20
call fcn.004457e0
mov ecx, esi
mov edx, eax
mov byte [esp + 0x220], 0x21
call fcn.00445450
mov eax, dword [esp + 0xac]
mov dword [esp + 0x8c], vtable.registry::const_value.0
cmp eax, ebx
je 0x46827f
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0xac], ebx
mov esi, 8
cmp dword [esp + 0xa8], esi
jb 0x46829d
mov ecx, dword [esp + 0x94]
push ecx
call fcn.004f0cfc
add esp, 4
xor edx, edx
mov dword [esp + 0xa8], edi
mov dword [esp + 0xa4], ebx
mov word [esp + 0x94], dx
cmp dword [esp + 0x30], esi
jb 0x4682c8
mov eax, dword [esp + 0x1c]
push eax
call fcn.004f0cfc
add esp, 4
xor ecx, ecx
mov dword [esp + 0x30], edi
mov dword [esp + 0x2c], ebx
mov word [esp + 0x1c], cx
cmp dword [esp + 0x84], esi
jb 0x4682ed
mov edx, dword [esp + 0x70]
push edx
call fcn.004f0cfc
add esp, 4
mov dword [esp + 0x84], edi
xor eax, eax
mov edi, 0x10
mov byte [esp + 0x220], 0x1d
mov dword [esp + 0x80], ebx
mov word [esp + 0x70], ax
cmp dword [esp + 0x4c], edi
jb 0x468322
mov ecx, dword [esp + 0x38]
push ecx
call fcn.004f0cfc
add esp, 4
call fcn.004cefff
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 8]
push 0x100
call eax
test al, al
je 0x4683b1
push 0x534dc4
push ecx
push str.Remove_directory...
push ecx
push 0x534dd4
push ecx
push 0x36
push ecx
push 0x534dd8
push ecx
push str.CommitSuicide
push ecx
push 0x534dc0
push ecx
call fcn.004cf0d6
add esp, 4
push eax
call fcn.00405660
add esp, 0xc
push eax
call fcn.00405660
add esp, 0xc
push eax
call fcn.00405660
add esp, 0xc
push eax
call fcn.00402b90
add esp, 4
push eax
call fcn.00405660
add esp, 0xc
push eax
call fcn.00405660
add esp, 0xc
push eax
call fcn.00405660
add esp, 8
push 0x100
call fcn.004cf0e5
call fcn.004cefff
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 8]
push 0x100
call eax
test al, al
je 0x4684ab
call fcn.004d00f8
lea ecx, [esp + 0x34]
push ecx
call fcn.004d0324
push eax
lea edx, [esp + 0x1c]
push edx
mov byte [esp + 0x228], 0x22
call fcn.004022c0
add esp, 8
push 0x534dc4
push ecx
push eax
push ecx
push 0x534dd4
push ecx
push 0x37
push ecx
push 0x534dd8
push ecx
push str.CommitSuicide
push ecx
push 0x534dc0
push ecx
mov byte [esp + 0x258], 0x23
call fcn.004cf0d6
add esp, 4
push eax
call fcn.00405660
add esp, 0xc
push eax
call fcn.00405660
add esp, 0xc
push eax
call fcn.00405660
add esp, 0xc
push eax
call fcn.00402b90
add esp, 4
push eax
call fcn.00405660
add esp, 0xc
push eax
call fcn.00405890
add esp, 0xc
push eax
call fcn.00405660
add esp, 8
cmp dword [esp + 0x30], edi
jb 0x468476
mov eax, dword [esp + 0x1c]
push eax
call fcn.004f0cfc
add esp, 4
mov byte [esp + 0x220], 0x1d
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
cmp dword [esp + 0x4c], esi
jb 0x4684a1
mov ecx, dword [esp + 0x38]
push ecx
call fcn.004f0cfc
add esp, 4
push 0x100
call fcn.004cf0e5
call fcn.004d00f8
lea edx, [esp + 0x8c]
push edx
call fcn.004d0324
cmp dword [eax + 0x18], esi
jb 0x4684c7
mov eax, dword [eax + 4]
jmp 0x4684ca
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
sete byte [esp + 0x17]
cmp dword [esp + 0xa4], esi
jb 0x4684f1
mov eax, dword [esp + 0x90]
push eax
call fcn.004f0cfc
add esp, 4
cmp byte [esp + 0x17], bl
je 0x468582
call fcn.004cefff
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 8]
push edi
call eax
test al, al
je 0x468582
push 0x534dc4
push ecx
push str.Cannot_remove_application_directory__probably__its_not_empty_
push ecx
push 0x534dd4
push ecx
push 0x39
push ecx
push 0x534dd8
push ecx
push str.CommitSuicide
push ecx
push 0x534dc0
push ecx
call fcn.004cf0d6
add esp, 4
push eax
call fcn.00405660
add esp, 0xc
push eax
call fcn.00405660
add esp, 0xc
push eax
call fcn.00405660
add esp, 0xc
push eax
call fcn.00402b90
add esp, 4
push eax
call fcn.00405660
add esp, 0xc
push eax
call fcn.00405660
add esp, 0xc
push eax
call fcn.00405660
add esp, 8
push edi
call fcn.004cf0e5
lea edi, [esp + 0xec]
call fcn.00445600
mov esi, 8
cmp dword [esp + 0xcc], esi
jb 0x4685ac
mov ecx, dword [esp + 0xb8]
push ecx
call fcn.004f0cfc
add esp, 4
xor edx, edx
mov dword [esp + 0xcc], 7
mov dword [esp + 0xc8], 0
mov word [esp + 0xb8], dx
cmp dword [esp + 0xe8], esi
jb 0x4685e5
mov eax, dword [esp + 0xd4]
push eax
call fcn.004f0cfc
add esp, 4
mov ecx, dword [esp + 0x218]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.004f070d
mov esp, ebp
pop ebp
ret