Function at 0x48af38
Capabilities:
Delete directory
Delete file
Move file
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x48af40
push ebx
mov eax, 0x48911c
call fcn.00407654
mov ebx, dword [0x6340a8]
xor eax, eax
push ebp
push 0x48b523
push dword fs:[eax]
mov dword fs:[eax], esp
nop
call fcn.00488bc8
test al, al
jne 0x48af96
push 0x10
push 0
lea edx, [ebp - 0x14]
mov eax, 0xb0fd
call fcn.0046446c
mov eax, dword [ebp - 0x14]
call fcn.00405858
push eax
push 0
call sub.user32.dll_MessageBoxA_1
jmp 0x48b4e3
nop
call fcn.004890bc
mov edx, dword [0x63404c]
mov byte [edx], al
nop
lea edx, [ebp - 0x20]
xor eax, eax
call fcn.004033c4
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.00423148
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
call fcn.004227b8
mov eax, dword [ebp - 0x18]
mov edx, 0x48b538
call fcn.004057f0
jne 0x48b0a1
call fcn.00403364
cmp eax, 2
jle 0x48b0dd
push 0x32
call sub.kernel32.dll_Sleep_1
push 0
lea edx, [ebp - 0x24]
mov eax, 2
call fcn.004033c4
mov eax, dword [ebp - 0x24]
mov edx, 0xde
call fcn.00409bd4
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
push 0x64
call sub.kernel32.dll_Sleep_1
lea edx, [ebp - 0x2c]
mov eax, 3
call fcn.004033c4
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x28]
xor edx, edx
call fcn.00489034
mov eax, dword [ebp - 0x28]
call fcn.00405d34
push eax
call sub.kernel32.dll_DeleteFileW
push 0x28
call sub.kernel32.dll_Sleep_1
lea edx, [ebp - 0x34]
mov eax, 3
call fcn.004033c4
mov eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x30]
xor edx, edx
call fcn.00489034
mov eax, dword [ebp - 0x30]
call fcn.00405d34
push eax
push 0x48b548
call sub.kernel32.dll_MoveFileW
test eax, eax
je 0x48b019
lea edx, [ebp - 0x38]
mov eax, 3
call fcn.004033c4
mov edx, dword [ebp - 0x38]
mov ecx, 0x48b56c
xor eax, eax
call fcn.004637b8
jmp 0x48b4e3
call fcn.00403364
test eax, eax
jne 0x48b0b3
mov byte [0x633934], 0
jmp 0x48b0dd
push 1
call sub.kernel32.dll_Sleep_1
lea edx, [ebp - 0x3c]
mov eax, 1
call fcn.004033c4
mov eax, dword [ebp - 0x3c]
mov edx, 0x48b56c
call fcn.004057f0
je 0x48b0dd
mov byte [0x633934], 0
nop
cmp byte [0x633934], 0
jne 0x48b105
lea edx, [ebp - 0x40]
xor eax, eax
call fcn.004033c4
mov edx, dword [ebp - 0x40]
mov ecx, 0x48b56c
xor eax, eax
call fcn.004637b8
jmp 0x48b4e3
nop
nop
push 3
call sub.kernel32.dll_Sleep_1
nop
nop
nop
nop
mov eax, 0x48b57c
call fcn.00483cf0
test al, al
jne 0x48b14a
mov byte [0x633930], 1
mov edx, dword [0x483ca8]
xor eax, eax
call fcn.00484ac8
mov edx, dword [0x633b04]
mov dword [edx], eax
call fcn.00426e04
mov eax, dword [0x633b04]
xor edx, edx
mov dword [eax], edx
mov eax, 0x48b57c
call fcn.00483cf0
test al, al
je 0x48b4e3
push 0x48b580
call sub.kernel32.dll_RemoveDirectoryA
mov eax, 0x48b590
call fcn.00423080
test al, al
je 0x48b198
mov eax, 0x48b598
call fcn.00423080
test al, al
je 0x48b198
mov eax, 0x48b5a4
call fcn.00423080
test al, al
je 0x48b198
mov eax, dword [0x633f84]
mov byte [eax], 1
mov eax, dword [0x633f84]
cmp byte [eax], 0
jne 0x48b2b9
mov eax, dword [0x633e24]
mov byte [eax], 0
mov eax, dword [ebx]
call fcn.00406700
add eax, 0xa
push eax
mov eax, ebx
mov ecx, 1
mov edx, dword [0x463708]
call fcn.004068bc
add esp, 4
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 4]
mov edx, 0x48b5bc
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 8]
mov edx, 0x48b5cc
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0xc]
mov edx, 0x48b5e0
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x10]
mov edx, 0x48b5f4
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x14]
mov edx, 0x48b608
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x18]
mov edx, 0x48b61c
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x1c]
mov edx, 0x48b630
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x20]
mov edx, 0x48b644
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x24]
mov edx, 0x48b658
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x28]
mov edx, 0x48b66c
call fcn.0040541c
jmp 0x48b4a5
mov eax, dword [ebx]
call fcn.00406700
add eax, 0x14
push eax
mov eax, ebx
mov ecx, 1
mov edx, dword [0x463708]
call fcn.004068bc
add esp, 4
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 4]
mov edx, 0x48b680
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 8]
mov edx, 0x48b690
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0xc]
mov edx, 0x48b6a4
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x10]
mov edx, 0x48b6b8
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x14]
mov edx, 0x48b6cc
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x18]
mov edx, 0x48b6e0
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x1c]
mov edx, 0x48b6f4
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x20]
mov edx, 0x48b704
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x24]
mov edx, 0x48b718
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x28]
mov edx, 0x48b72c
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x2c]
mov edx, 0x48b740
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x30]
mov edx, 0x48b754
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x34]
mov edx, 0x48b768
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x38]
mov edx, 0x48b77c
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x3c]
mov edx, 0x48b790
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x40]
mov edx, 0x48b7a4
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x44]
mov edx, 0x48b7b8
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x48]
mov edx, 0x48b7cc
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x4c]
mov edx, 0x48b7e0
call fcn.0040541c
mov eax, dword [ebx]
call fcn.00406700
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x50]
mov edx, 0x48b7f4
call fcn.0040541c
mov edx, dword [0x485ca8]
xor eax, eax
call fcn.00488600
mov edx, dword [0x633aa8]
mov dword [edx], eax
call fcn.00426e04
mov eax, dword [0x633f10]
cmp byte [eax], 0
je 0x48b4e3
mov edx, dword [0x47e7c0]
xor eax, eax
call fcn.004833bc
mov edx, dword [0x633b58]
mov dword [edx], eax
call fcn.00426e04
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48b52a
lea eax, [ebp - 0x40]
mov edx, 4
call fcn.004053ec
lea eax, [ebp - 0x30]
call fcn.00405ba4
lea eax, [ebp - 0x2c]
call fcn.004053c8
lea eax, [ebp - 0x28]
call fcn.00405ba4
lea eax, [ebp - 0x24]
mov edx, 5
call fcn.004053ec
ret