Function at 0x401a6a
Capabilities:
Create process on windows
Create process suspended
Delete file
Resume thread
Set current directory
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x97c
push edi
mov eax, dword [ebp + 8]
mov dword [0x40b07c], eax
mov al, byte [0x408443]
mov byte [ebp - 0x970], al
push 0x63
pop ecx
xor eax, eax
lea edi, [ebp - 0x96f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov al, byte [0x408443]
mov byte [ebp - 0x7e0], al
push 0x63
pop ecx
xor eax, eax
lea edi, [ebp - 0x7df]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov al, byte [0x408443]
mov byte [ebp - 0x4b0], al
push 0x63
pop ecx
xor eax, eax
lea edi, [ebp - 0x4af]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov al, byte [0x408443]
mov byte [ebp - 0x320], al
push 0x63
pop ecx
xor eax, eax
lea edi, [ebp - 0x31f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov al, byte [0x408443]
mov byte [ebp - 0x648], al
push 0x63
pop ecx
xor eax, eax
lea edi, [ebp - 0x647]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x186
lea eax, [ebp - 0x970]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x970]
push eax
call fcn.00402170
pop ecx
mov dword [ebp - 0x650], eax
lea eax, [ebp - 0x970]
push eax
lea eax, [ebp - 0x7e0]
push eax
call fcn.00401f30
pop ecx
pop ecx
lea eax, [ebp - 0x970]
push eax
lea eax, [ebp - 0x4b0]
push eax
call fcn.00401f30
pop ecx
pop ecx
mov eax, dword [ebp - 0x650]
mov byte [ebp + eax - 0x7e3], 0x64
mov eax, dword [ebp - 0x650]
mov byte [ebp + eax - 0x7e2], 0x6c
mov eax, dword [ebp - 0x650]
mov byte [ebp + eax - 0x7e1], 0x6c
mov eax, dword [ebp - 0x650]
mov byte [ebp + eax - 0x4b3], 0x69
mov eax, dword [ebp - 0x650]
mov byte [ebp + eax - 0x4b2], 0x6e
mov eax, dword [ebp - 0x650]
mov byte [ebp + eax - 0x4b1], 0x69
lea eax, [ebp - 0x7e0]
push eax
call fcn.0040188a
pop ecx
movzx eax, al
test eax, eax
jne 0x401bdd
push 0x40010
push str.DLL_NOT_FOUND_
lea eax, [ebp - 0x7e0]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
inc eax
jmp 0x401f28
and byte [ebp - 0x649], 0
push 0x408430
lea eax, [ebp - 0x4b0]
push eax
call fcn.0040238f
pop ecx
pop ecx
mov dword [ebp - 0x978], eax
cmp dword [ebp - 0x978], 0
je 0x401c40
push dword [ebp - 0x978]
push 0x186
lea eax, [ebp - 0x648]
push eax
call fcn.0040230e
add esp, 0xc
and byte [ebp - 0x4ba], 0
lea eax, [ebp - 0x648]
push eax
call fcn.00401a26
pop ecx
push dword [ebp - 0x978]
call fcn.004022b8
pop ecx
lea eax, [ebp - 0x648]
push eax
call fcn.0040188a
pop ecx
movzx eax, al
test eax, eax
jne 0x401d25
push 0x30
push str.MURDER_INCREQUEST_
push str.POINT_ME_TO_YOUR_HL_CS_EXECUTABLE___nHL.EXE_OR_CSTRIKE.EXE
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
push 0
push str.SHOW_ME_YOUR_HL_CS_DIRECTORY_
push 0x408398
push str.c:_sierrahalf_lifehl.exe
lea eax, [ebp - 0x648]
push eax
call fcn.004018b7
add esp, 0x18
mov byte [ebp - 0x979], al
movzx eax, byte [ebp - 0x979]
test eax, eax
jne 0x401ca6
xor eax, eax
jmp 0x401f28
push 0x408378
lea eax, [ebp - 0x4b0]
push eax
call fcn.0040238f
pop ecx
pop ecx
mov dword [ebp - 0x978], eax
cmp dword [ebp - 0x978], 0
je 0x401cf0
lea eax, [ebp - 0x648]
push eax
push str._s_r_n
push dword [ebp - 0x978]
call fcn.00402286
add esp, 0xc
push dword [ebp - 0x978]
call fcn.004022b8
pop ecx
jmp 0x401d08
push 0
push str.WRITE_ERROR_
lea eax, [ebp - 0x4b0]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x401d3b
lea eax, [ebp - 0x648]
push eax
call fcn.0040188a
pop ecx
movzx eax, al
test eax, eax
je 0x401d23
mov byte [ebp - 0x649], 1
jmp 0x401d2c
mov byte [ebp - 0x649], 1
movzx eax, byte [ebp - 0x649]
test eax, eax
je 0x401be4
lea eax, [ebp - 0x970]
push eax
lea eax, [ebp - 0x648]
push eax
call fcn.00407936
pop ecx
pop ecx
test eax, eax
jne 0x401d7d
push 0x30
push str.ERROR_
push str.CANNOT_EXECUTE_PROGRAM_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea eax, [ebp - 0x4b0]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor eax, eax
inc eax
jmp 0x401f28
lea eax, [ebp - 0x648]
push eax
call fcn.00401958
pop ecx
movzx eax, al
test eax, eax
je 0x401d96
call fcn.004019f8
push str._game
push dword [ebp + 0x10]
call fcn.00402200
pop ecx
pop ecx
test eax, eax
jne 0x401dbc
push str.__game_cstrike__console
lea eax, [ebp - 0x320]
push eax
call fcn.00401f30
pop ecx
pop ecx
push dword [ebp + 0x10]
lea eax, [ebp - 0x320]
push eax
call fcn.00401f40
pop ecx
pop ecx
push 0x44
push 0
push 0x40b080
call fcn.00402030
add esp, 0xc
push 0x10
push 0
push 0x40b0c8
call fcn.00402030
add esp, 0xc
mov dword [0x40b080], 0x44
lea eax, [ebp - 0x648]
push eax
lea eax, [ebp - 0x190]
push eax
call fcn.00401f30
pop ecx
pop ecx
lea eax, [ebp - 0x190]
push eax
call fcn.00402170
pop ecx
lea eax, [ebp + eax - 0x190]
mov dword [ebp - 0x974], eax
mov eax, dword [ebp - 0x974]
lea ecx, [ebp - 0x190]
cmp eax, ecx
jb 0x401e55
mov eax, dword [ebp - 0x974]
movsx eax, byte [eax]
cmp eax, 0x5c
je 0x401e55
mov eax, dword [ebp - 0x974]
dec eax
mov dword [ebp - 0x974], eax
jmp 0x401e28
mov eax, dword [ebp - 0x974]
and byte [eax], 0
mov eax, dword [ebp - 0x974]
inc eax
mov dword [ebp - 0x4b4], eax
lea eax, [ebp - 0x190]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push 0x40b0c8
push 0x40b080
push 0
push 0
push 4
push 0
push 0
push 0
lea eax, [ebp - 0x320]
push eax
push dword [ebp - 0x4b4]
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x401ec1
push 0x40010
push str.MURDER_INC_ERROR_
push str.CANT_EXECUTE_HALF_LIFE_PROCESS_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
or eax, 0xffffffff
jmp 0x401f28
push 0x40b0c8
lea eax, [ebp - 0x7e0]
push eax
call section..text
pop ecx
pop ecx
test eax, eax
jne 0x401f02
push 0x40010
push str.MURDER_INC_ERROR_
push str.HOOK_INJECTION_FAILED_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0xffffffffffffffff
push dword [0x40b0c8]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
or eax, 0xffffffff
jmp 0x401f28
push dword [0x40b0cc]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push dword [0x40b0c8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [0x40b0cc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
leave
ret 0x10