Function at 0x4016b0
Capabilities:
Create process on windows
Delete file
Print debug messages

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1094
call fcn.0040b880
mov eax, dword [0x415310]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
xor eax, ebp
push 0
mov dword [esp + 0x10a0], eax
mov dword [esp + 0x1c], edi
call dword [sym.imp.ole32.dll_CoInitialize]
mov ebx, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push edi
call ebx
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DefWindowProcA]
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], 8
mov dword [esp + 0x18], 4
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
push 0
push esi
push 0
mov ecx, 0x415044
call fcn.004014a0
mov edi, dword [sym.imp.KERNEL32.dll_OpenEventA]
push str.94C36BFB_3871_4e1d_8AE1_7EA729134726
push 0
push 0x1f0003
call edi
mov esi, eax
test esi, esi
je 0x40176d
mov edi, edi
push str.Client_Exists
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.94C36BFB_3871_4e1d_8AE1_7EA729134726
push 0
push 0x1f0003
call edi
mov esi, eax
test esi, esi
jne 0x401740
lea ecx, [esp + 0x2c]
push ecx
push 0xffffffffffffffff
push fcn.0040b7ca
push fcn.0040acfc
push fcn.0040b6ab
push 0x40b444
push fcn.0040b07e
push fcn.0040b0d8
push fcn.0040b255
call fcn.00404290
mov esi, eax
add esp, 0x24
test esi, esi
je 0x4018bc
push 0x8000
push str..upgrade.cab
call fcn.0040b07e
mov edi, eax
add esp, 8
cmp edi, 0xffffffff
mov dword [esp + 0x10], edi
je 0x4018b3
lea edx, [esp + 0x38]
push edx
push edi
push esi
call fcn.004043a0
add esp, 0xc
test eax, eax
je 0x4018b3
push 0
push 0
push 0x4011d0
push 0
push 0x4123d0
push str.upgrade.cab
push esi
call fcn.00404470
add esp, 0x1c
test eax, eax
jne 0x40180f
push str.FDICopy_Fail
call ebx
jmp 0x401897
push str.FDICopy_Success
call ebx
xor eax, eax
mov byte [esp + 0x98], 0
mov ecx, 0x3ff
lea edi, [esp + 0x99]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov ecx, 0x11
lea edi, [esp + 0x50]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x18]
push ecx
mov dword [esp + 0x20], eax
push str.launchcrossfire.exe__s
mov dword [esp + 0x28], eax
lea edx, [esp + 0xa0]
mov dword [esp + 0x2c], eax
push 0x1000
push edx
mov dword [esp + 0x38], eax
call fcn.0040b157
add esp, 0x10
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x54]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [esp + 0xb8]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov edi, dword [esp + 0x10]
push esi
call fcn.00404330
push edi
call fcn.0040acfc
add esp, 8
push str..upgrade.cab
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x4018bc
push esi
call fcn.00404330
add esp, 4
mov ecx, 0x415044
call fcn.00401620
mov edi, dword [0x415078]
xor esi, esi
cmp edi, esi
je 0x401902
mov eax, dword [edi]
cmp eax, esi
je 0x4018e3
push eax
call fcn.0040b0d8
add esp, 4
mov dword [edi], esi
mov eax, dword [edi + 4]
cmp eax, esi
je 0x4018f6
push eax
call fcn.0040b0d8
add esp, 4
mov dword [edi + 4], esi
push edi
mov dword [edi + 8], esi
call fcn.0040b0d3
add esp, 4
mov ecx, 0x415044
call fcn.00401400
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [esp + 0x109c]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0040aa71
mov esp, ebp
pop ebp
ret 0x10