Function at 0x48bf38
Capabilities:
Delete directory
Delete file
Move file
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x48bf40
push ebx
mov eax, 0x48a36c
call fcn.00407654
mov ebx, dword [0x6350a8]
xor eax, eax
push ebp
push 0x48c523
push dword fs:[eax]
mov dword fs:[eax], esp
nop
call fcn.00489e18
test al, al
jne 0x48bf96
push 0x10
push 0
lea edx, [ebp - 0x14]
mov eax, 0xb0fd
call fcn.00462aec
mov eax, dword [ebp - 0x14]
call fcn.00405858
push eax
push 0
call sub.user32.dll_MessageBoxA_1
jmp 0x48c4e3
nop
call fcn.0048a30c
mov edx, dword [0x63504c]
mov byte [edx], al
nop
lea edx, [ebp - 0x20]
xor eax, eax
call fcn.004033c4
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.00423150
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
call fcn.004227b8
mov eax, dword [ebp - 0x18]
mov edx, 0x48c538
call fcn.004057f0
jne 0x48c0a1
call fcn.00403364
cmp eax, 2
jle 0x48c0dd
push 0x32
call sub.kernel32.dll_Sleep_1
push 0
lea edx, [ebp - 0x24]
mov eax, 2
call fcn.004033c4
mov eax, dword [ebp - 0x24]
mov edx, 0xde
call fcn.00409bd4
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
push 0x64
call sub.kernel32.dll_Sleep_1
lea edx, [ebp - 0x2c]
mov eax, 3
call fcn.004033c4
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x28]
xor edx, edx
call fcn.0048a284
mov eax, dword [ebp - 0x28]
call fcn.00405d34
push eax
call sub.kernel32.dll_DeleteFileW
push 0x28
call sub.kernel32.dll_Sleep_1
lea edx, [ebp - 0x34]
mov eax, 3
call fcn.004033c4
mov eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x30]
xor edx, edx
call fcn.0048a284
mov eax, dword [ebp - 0x30]
call fcn.00405d34
push eax
push 0x48c548
call sub.kernel32.dll_MoveFileW
test eax, eax
je 0x48c019
lea edx, [ebp - 0x38]
mov eax, 3
call fcn.004033c4
mov edx, dword [ebp - 0x38]
mov ecx, 0x48c56c
xor eax, eax
call fcn.00461e38
jmp 0x48c4e3
call fcn.00403364
test eax, eax
jne 0x48c0b3
mov byte [0x634934], 0
jmp 0x48c0dd
push 1
call sub.kernel32.dll_Sleep_1
lea edx, [ebp - 0x3c]
mov eax, 1
call fcn.004033c4
mov eax, dword [ebp - 0x3c]
mov edx, 0x48c56c
call fcn.004057f0
je 0x48c0dd
mov byte [0x634934], 0
nop
cmp byte [0x634934], 0
jne 0x48c105
lea edx, [ebp - 0x40]
xor eax, eax
call fcn.004033c4
mov edx, dword [ebp - 0x40]
mov ecx, 0x48c56c
xor eax, eax
call fcn.00461e38
jmp 0x48c4e3
nop
nop
push 3
call sub.kernel32.dll_Sleep_1
nop
nop
nop
nop
mov eax, 0x48c57c
call fcn.00484f40
test al, al
jne 0x48c14a
mov byte [0x634930], 1
mov edx, dword [0x484ef8]
xor eax, eax
call fcn.00485d18
mov edx, dword [0x634b04]
mov dword [edx], eax
call fcn.00426e10
mov eax, dword [0x634b04]
xor edx, edx
mov dword [eax], edx
mov eax, 0x48c57c
call fcn.00484f40
test al, al
je 0x48c4e3
push 0x48c580
call sub.kernel32.dll_RemoveDirectoryA
mov eax, 0x48c590
call fcn.00423088
test al, al
je 0x48c198
mov eax, 0x48c598
call fcn.00423088
test al, al
je 0x48c198
mov eax, 0x48c5a4
call fcn.00423088
test al, al
je 0x48c198
mov eax, dword [0x634f84]
mov byte [eax], 1
mov eax, dword [0x634f84]
cmp byte [eax], 0
jne 0x48c2b9
mov eax, dword [0x634e24]
mov byte [eax], 0
mov eax, dword [ebx]
call fcn.00406700
add eax, 0xa
push eax
mov eax, ebx
mov ecx, 1
mov edx, dword [0x461d88]
call fcn.004068bc
add esp, 4
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 4]
mov edx, 0x48c5bc
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 8]
mov edx, 0x48c5cc
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0xc]
mov edx, 0x48c5e0
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x10]
mov edx, 0x48c5f4
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x14]
mov edx, 0x48c608
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x18]
mov edx, 0x48c61c
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x1c]
mov edx, 0x48c630
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x20]
mov edx, 0x48c644
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x24]
mov edx, 0x48c658
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x28]
mov edx, 0x48c66c
call fcn.0040541c
jmp 0x48c4a5
mov eax, dword [ebx]
call fcn.00406700
add eax, 0x14
push eax
mov eax, ebx
mov ecx, 1
mov edx, dword [0x461d88]
call fcn.004068bc
add esp, 4
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 4]
mov edx, 0x48c680
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 8]
mov edx, 0x48c690
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0xc]
mov edx, 0x48c6a4
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x10]
mov edx, 0x48c6b8
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x14]
mov edx, 0x48c6cc
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x18]
mov edx, 0x48c6e0
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x1c]
mov edx, 0x48c6f4
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x20]
mov edx, 0x48c704
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x24]
mov edx, 0x48c718
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x28]
mov edx, 0x48c72c
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x2c]
mov edx, 0x48c740
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x30]
mov edx, 0x48c754
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x34]
mov edx, 0x48c768
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x38]
mov edx, 0x48c77c
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x3c]
mov edx, 0x48c790
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x40]
mov edx, 0x48c7a4
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x44]
mov edx, 0x48c7b8
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x48]
mov edx, 0x48c7cc
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x4c]
mov edx, 0x48c7e0
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x50]
mov edx, 0x48c7f4
call fcn.0040541c
mov edx, dword [0x486ef8]
xor eax, eax
call fcn.00489850
mov edx, dword [0x634aa8]
mov dword [edx], eax
call fcn.00426e10
mov eax, dword [0x634f10]
cmp byte [eax], 0
je 0x48c4e3
mov edx, dword [0x47f9e8]
xor eax, eax
call fcn.0048460c
mov edx, dword [0x634b58]
mov dword [edx], eax
call fcn.00426e10
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48c52a
lea eax, [ebp - 0x40]
mov edx, 4
call fcn.004053ec
lea eax, [ebp - 0x30]
call fcn.00405ba4
lea eax, [ebp - 0x2c]
call fcn.004053c8
lea eax, [ebp - 0x28]
call fcn.00405ba4
lea eax, [ebp - 0x24]
mov edx, 5
call fcn.004053ec
ret