Function at 0x489f24
Capabilities:
Delete directory
Delete file
Move file
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xa
push 0
push 0
dec ecx
jne 0x489f2c
push ebx
mov eax, 0x48875c
call fcn.00407618
mov ebx, dword [0x652078]
xor eax, eax
push ebp
push 0x48a636
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x65191c]
mov edx, 0x48a64c
call fcn.004057b4
jne 0x489fec
push 0
push 0x48a670
push 0x48a67c
push 0
call sub.user32.dll_MessageBoxW
push 0
push 0x48a670
push 0x48a6d8
push 0
call sub.user32.dll_MessageBoxW
push 0
push 0x48a70c
push 0x48a734
push 0
call sub.user32.dll_MessageBoxW
push 0
push 0x48a70c
push 0x48a784
push 0
call sub.user32.dll_MessageBoxW
push 0
push 0x48a70c
push 0x48a7ac
push 0
call sub.user32.dll_MessageBoxW
push 0
push 0x48a7e0
push 0x48a800
push 0
call sub.user32.dll_MessageBoxW
push 0
push 0x48a818
push 0x48a838
push 0
call sub.user32.dll_MessageBoxW
call fcn.00488590
call fcn.004884dc
nop
call fcn.00488070
test al, al
jne 0x48a026
push 0x10
push 0
lea edx, [ebp - 0x14]
mov eax, 0xb0fd
call fcn.00464394
mov eax, dword [ebp - 0x14]
call fcn.0040581c
push eax
push 0
call sub.user32.dll_MessageBoxA_1
jmp 0x48a5f6
nop
call fcn.004886c8
mov edx, dword [0x65201c]
mov byte [edx], al
nop
lea edx, [ebp - 0x20]
xor eax, eax
call fcn.004033c4
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.00422e40
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
call fcn.00422358
mov eax, dword [ebp - 0x18]
mov edx, 0x48a870
call fcn.004057b4
jne 0x48a131
call fcn.00403364
cmp eax, 2
jle 0x48a16d
push 0x32
call sub.kernel32.dll_Sleep_1
push 0
lea edx, [ebp - 0x24]
mov eax, 2
call fcn.004033c4
mov eax, dword [ebp - 0x24]
mov edx, 0xde
call fcn.00409b48
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
push 0x64
call sub.kernel32.dll_Sleep_1
lea edx, [ebp - 0x2c]
mov eax, 3
call fcn.004033c4
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x28]
xor edx, edx
call fcn.00488640
mov eax, dword [ebp - 0x28]
call fcn.00405cf8
push eax
call sub.kernel32.dll_DeleteFileW
push 0x28
call sub.kernel32.dll_Sleep_1
lea edx, [ebp - 0x34]
mov eax, 3
call fcn.004033c4
mov eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x30]
xor edx, edx
call fcn.00488640
mov eax, dword [ebp - 0x30]
call fcn.00405cf8
push eax
push 0x48a880
call sub.kernel32.dll_MoveFileW
test eax, eax
je 0x48a0a9
lea edx, [ebp - 0x38]
mov eax, 3
call fcn.004033c4
mov edx, dword [ebp - 0x38]
mov ecx, 0x48a8a4
xor eax, eax
call fcn.00463594
jmp 0x48a5f6
call fcn.00403364
test eax, eax
jne 0x48a143
mov byte [0x651918], 0
jmp 0x48a16d
push 1
call sub.kernel32.dll_Sleep_1
lea edx, [ebp - 0x3c]
mov eax, 1
call fcn.004033c4
mov eax, dword [ebp - 0x3c]
mov edx, 0x48a8a4
call fcn.004057b4
je 0x48a16d
mov byte [0x651918], 0
nop
cmp byte [0x651918], 0
jne 0x48a195
lea edx, [ebp - 0x40]
xor eax, eax
call fcn.004033c4
mov edx, dword [ebp - 0x40]
mov ecx, 0x48a8a4
xor eax, eax
call fcn.00463594
jmp 0x48a5f6
nop
nop
push 3
call sub.kernel32.dll_Sleep_1
call fcn.00463e60
nop
nop
call fcn.00465b6c
nop
nop
mov eax, 0x48a8b4
call fcn.00483180
test al, al
jne 0x48a1e4
mov byte [0x651914], 1
mov edx, dword [0x483138]
xor eax, eax
call fcn.00483f68
mov edx, dword [0x651aec]
mov dword [edx], eax
call fcn.00426a64
mov eax, dword [0x651aec]
xor edx, edx
mov dword [eax], edx
lea eax, [ebp - 0x48]
call fcn.004232b0
lea eax, [ebp - 0x48]
mov edx, 0x48a8c0
call fcn.00405658
mov eax, dword [ebp - 0x48]
call fcn.0040581c
mov edx, eax
lea eax, [ebp - 0x44]
call fcn.00405584
mov eax, dword [ebp - 0x44]
xor edx, edx
call fcn.00464144
push 0x20
lea eax, [ebp - 0x4c]
call fcn.004232b0
lea eax, [ebp - 0x4c]
mov edx, 0x48a8c0
call fcn.00405658
mov eax, dword [ebp - 0x4c]
call fcn.0040581c
push eax
call sub.kernel32.dll_SetFileAttributesA
lea eax, [ebp - 0x50]
call fcn.004232b0
lea eax, [ebp - 0x50]
mov edx, 0x48a8c0
call fcn.00405658
mov eax, dword [ebp - 0x50]
call fcn.0040581c
push eax
call sub.kernel32.dll_DeleteFileA
mov eax, 0x48a8b4
call fcn.00483180
test al, al
je 0x48a5f6
push 0x48a8d4
call sub.kernel32.dll_RemoveDirectoryA
mov eax, 0x48a8e4
call fcn.00422d78
test al, al
je 0x48a2ab
mov eax, 0x48a8ec
call fcn.00422d78
test al, al
je 0x48a2ab
mov eax, 0x48a8f8
call fcn.00422d78
test al, al
je 0x48a2ab
mov eax, dword [0x651f54]
mov byte [eax], 1
mov eax, dword [0x651f54]
cmp byte [eax], 0
jne 0x48a3cc
mov eax, dword [0x651e00]
mov byte [eax], 0
mov eax, dword [ebx]
call fcn.004066c4
add eax, 0xa
push eax
mov eax, ebx
mov ecx, 1
mov edx, dword [0x4634e4]
call fcn.00406880
add esp, 4
mov eax, dword [ebx]
call fcn.004066c4
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 4]
mov edx, 0x48a910
call fcn.004053e0
mov eax, dword [ebx]
call fcn.004066c4
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 8]
mov edx, 0x48a920
call fcn.004053e0
mov eax, dword [ebx]
call fcn.004066c4
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0xc]
mov edx, 0x48a934
call fcn.004053e0
mov eax, dword [ebx]
call fcn.004066c4
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x10]
mov edx, 0x48a948
call fcn.004053e0
mov eax, dword [ebx]
call fcn.004066c4
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x14]
mov edx, 0x48a95c
call fcn.004053e0
mov eax, dword [ebx]
call fcn.004066c4
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x18]
mov edx, 0x48a970
call fcn.004053e0
mov eax, dword [ebx]
call fcn.004066c4
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x1c]
mov edx, 0x48a984
call fcn.004053e0
mov eax, dword [ebx]
call fcn.004066c4
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x20]
mov edx, 0x48a998
call fcn.004053e0
mov eax, dword [ebx]
call fcn.004066c4
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x24]
mov edx, 0x48a9ac
call fcn.004053e0
mov eax, dword [ebx]
call fcn.004066c4
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x28]
mov edx, 0x48a9c0
call fcn.004053e0
jmp 0x48a5b8
mov eax, dword [ebx]
call fcn.004066c4
add eax, 0x14
push eax
mov eax, ebx
mov ecx, 1
mov edx, dword [0x4634e4]
call fcn.00406880
add esp, 4
mov eax, dword [ebx]
call fcn.004066c4
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 4]
mov edx, 0x48a9d4
call fcn.004053e0
mov eax, dword [ebx]
call fcn.004066c4
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 8]
mov edx, 0x48a9e4
call fcn.004053e0
mov eax, dword [ebx]
call fcn.004066c4
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0xc]
mov edx, 0x48a9f8
call fcn.004053e0
mov eax, dword [ebx]
call fcn.004066c4
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x10]
mov edx, 0x48aa0c
call fcn.004053e0
mov eax, dword [ebx]
call fcn.004066c4
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x14]
mov edx, 0x48aa20
call fcn.004053e0
mov eax, dword [ebx]
call fcn.004066c4
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x18]
mov edx, 0x48aa34
call fcn.004053e0
mov eax, dword [ebx]
call fcn.004066c4
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x1c]
mov edx, 0x48aa48
call fcn.004053e0
mov eax, dword [ebx]
call fcn.004066c4
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x20]
mov edx, 0x48aa58
call fcn.004053e0
mov eax, dword [ebx]
call fcn.004066c4
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x24]
mov edx, 0x48aa6c
call fcn.004053e0
mov eax, dword [ebx]
call fcn.004066c4
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x28]
mov edx, 0x48aa80
call fcn.004053e0
mov eax, dword [ebx]
call fcn.004066c4
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x2c]
mov edx, 0x48aa94
call fcn.004053e0
mov eax, dword [ebx]
call fcn.004066c4
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x30]
mov edx, 0x48aaa8
call fcn.004053e0
mov eax, dword [ebx]
call fcn.004066c4
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x34]
mov edx, 0x48aabc
call fcn.004053e0
mov eax, dword [ebx]
call fcn.004066c4
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x38]
mov edx, 0x48aad0
call fcn.004053e0
mov eax, dword [ebx]
call fcn.004066c4
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x3c]
mov edx, 0x48aae4
call fcn.004053e0
mov eax, dword [ebx]
call fcn.004066c4
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x40]
mov edx, 0x48aaf8
call fcn.004053e0
mov eax, dword [ebx]
call fcn.004066c4
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x44]
mov edx, 0x48ab0c
call fcn.004053e0
mov eax, dword [ebx]
call fcn.004066c4
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x48]
mov edx, 0x48ab20
call fcn.004053e0
mov eax, dword [ebx]
call fcn.004066c4
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x4c]
mov edx, 0x48ab34
call fcn.004053e0
mov eax, dword [ebx]
call fcn.004066c4
mov edx, dword [ebx]
lea eax, [edx + eax*4 - 0x50]
mov edx, 0x48ab48
call fcn.004053e0
mov edx, dword [0x485148]
xor eax, eax
call fcn.00487aa0
mov edx, dword [0x651a90]
mov dword [edx], eax
call fcn.00426a64
mov eax, dword [0x651ee8]
cmp byte [eax], 0
je 0x48a5f6
mov edx, dword [0x47e718]
xor eax, eax
call fcn.004828f0
mov edx, dword [0x651b40]
mov dword [edx], eax
call fcn.00426a64
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48a63d
lea eax, [ebp - 0x50]
mov edx, 8
call fcn.004053b0
lea eax, [ebp - 0x30]
call fcn.00405b68
lea eax, [ebp - 0x2c]
call fcn.0040538c
lea eax, [ebp - 0x28]
call fcn.00405b68
lea eax, [ebp - 0x24]
mov edx, 5
call fcn.004053b0
ret