Function at 0x406ec0
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x46fd68
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov eax, dword [0x48cc50]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
xor edi, edi
push str.UpdateService.exe
lea ecx, [esp + 0x2c]
mov dword [esp + 0x40], edi
call fcn.00402630
push str.ResPacket.dll
lea ecx, [esp + 0x34]
mov byte [esp + 0x40], 1
call fcn.00402630
mov dword [esp + 0x14], edi
lea eax, [esp + 0x14]
push eax
mov byte [esp + 0x40], 3
call fcn.0040d290
mov eax, dword [esp + 0x18]
mov ebx, dword [0x472354]
mov ebp, dword [0x472350]
add esp, 4
cmp eax, edi
je 0x406f57
mov esi, eax
mov eax, dword [eax]
cmp eax, edi
je 0x406f57
push eax
call ebp
mov ecx, dword [esi]
push eax
push ecx
call ebx
cmp eax, edi
jne 0x406f59
push 0x8007000e
call fcn.0040bab0
xor eax, eax
push eax
call dword [0x4723e0]
test eax, eax
jne 0x406f93
mov esi, dword [esp + 0x14]
cmp esi, edi
je 0x406f89
mov eax, dword [esi]
cmp eax, edi
je 0x406f89
push eax
call ebp
mov edx, dword [esi]
push eax
push edx
call ebx
cmp eax, edi
jne 0x406f8b
push 0x8007000e
call fcn.0040bab0
xor eax, eax
push edi
push eax
call dword [0x47230c]
mov dword [esp + 0x18], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x1c], edi
lea eax, [esp + 0x18]
push eax
mov byte [esp + 0x40], 7
call fcn.0040cec0
add esp, 4
test eax, eax
jne 0x4070f0
mov esi, dword [esp + 0x18]
mov ebx, dword [0x472360]
cmp esi, edi
mov edi, dword [0x472340]
je 0x407009
lea ecx, [esi + 8]
push ecx
call edi
test eax, eax
jne 0x407001
test esi, esi
je 0x407001
mov eax, dword [esi]
test eax, eax
je 0x406fe8
push eax
call ebx
mov eax, dword [esi + 4]
test eax, eax
je 0x406ff8
push eax
call fcn.0041b0cc
add esp, 4
push esi
call fcn.0041b0cc
add esp, 4
mov dword [esp + 0x18], 0
mov esi, dword [esp + 0x14]
test esi, esi
je 0x407049
lea edx, [esi + 8]
push edx
call edi
test eax, eax
jne 0x407041
test esi, esi
je 0x407041
mov eax, dword [esi]
test eax, eax
je 0x407028
push eax
call ebx
mov eax, dword [esi + 4]
test eax, eax
je 0x407038
push eax
call fcn.0041b0cc
add esp, 4
push esi
call fcn.0041b0cc
add esp, 4
mov dword [esp + 0x14], 0
mov esi, dword [esp + 0x30]
test esi, esi
je 0x40707d
lea eax, [esi + 8]
push eax
call edi
test eax, eax
jne 0x40707d
mov eax, dword [esi]
test eax, eax
je 0x407064
push eax
call ebx
mov eax, dword [esi + 4]
test eax, eax
je 0x407074
push eax
call fcn.0041b0cc
add esp, 4
push esi
call fcn.0041b0cc
add esp, 4
mov esi, dword [esp + 0x28]
test esi, esi
je 0x4070b1
lea ecx, [esi + 8]
push ecx
call edi
test eax, eax
jne 0x4070b1
mov eax, dword [esi]
test eax, eax
je 0x407098
push eax
call ebx
mov eax, dword [esi + 4]
test eax, eax
je 0x4070a8
push eax
call fcn.0041b0cc
add esp, 4
push esi
call fcn.0041b0cc
add esp, 4
mov esi, dword [esp + 0x48]
test esi, esi
je 0x4070e9
lea edx, [esi + 8]
push edx
call edi
test eax, eax
jne 0x4070e9
test esi, esi
je 0x4070e9
mov eax, dword [esi]
test eax, eax
je 0x4070d0
push eax
call ebx
mov eax, dword [esi + 4]
test eax, eax
je 0x4070e0
push eax
call fcn.0041b0cc
add esp, 4
push esi
call fcn.0041b0cc
add esp, 4
xor eax, eax
jmp 0x407311
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x24]
call fcn.004022a0
mov dword [esp + 0x2c], edi
mov edx, dword [esp + 0x44]
lea ecx, [esp + 0x2c]
push ecx
push edx
mov byte [esp + 0x44], 8
call fcn.00406c40
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x24]
call fcn.00402150
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x20]
call fcn.004022a0
lea edx, [esp + 0x30]
push edx
lea ecx, [esp + 0x20]
call fcn.00402150
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x1c]
call fcn.00402150
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x28]
call fcn.004022a0
lea edx, [esp + 0x28]
push edx
lea ecx, [esp + 0x28]
call fcn.00402150
mov edi, dword [esp + 0x24]
test edi, edi
je 0x407176
mov ecx, dword [edi]
jmp 0x407178
xor ecx, ecx
mov eax, dword [esp + 0x18]
test eax, eax
je 0x407184
mov eax, dword [eax]
jmp 0x407186
xor eax, eax
mov esi, dword [0x472308]
push 0
push ecx
push eax
call esi
test eax, eax
jne 0x4071ee
lea ecx, [esp + 0x2c]
call fcn.00402760
lea ecx, [esp + 0x1c]
call fcn.00402760
lea ecx, [esp + 0x20]
call fcn.00402760
lea ecx, [esp + 0x24]
call fcn.00402760
lea ecx, [esp + 0x18]
call fcn.00402760
lea ecx, [esp + 0x14]
call fcn.00402760
lea ecx, [esp + 0x30]
call fcn.00402760
lea ecx, [esp + 0x28]
call fcn.00402760
lea ecx, [esp + 0x48]
call fcn.00402760
xor eax, eax
jmp 0x407311
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x4071fa
mov ecx, dword [eax]
jmp 0x4071fc
xor ecx, ecx
mov eax, dword [esp + 0x20]
test eax, eax
je 0x407208
mov eax, dword [eax]
jmp 0x40720a
xor eax, eax
push 0
push ecx
push eax
call esi
test eax, eax
je 0x407196
mov eax, dword [esp + 0x48]
test eax, eax
je 0x407284
mov eax, dword [eax]
test eax, eax
je 0x407284
push eax
call dword [0x47235c]
test eax, eax
jbe 0x407284
mov esi, dword [esp + 0x48]
test esi, esi
je 0x407258
mov eax, dword [esi]
test eax, eax
je 0x407252
push eax
call ebp
push eax
mov eax, dword [esi]
push eax
call ebx
test eax, eax
jne 0x407254
push 0x8007000e
call fcn.0040bab0
xor eax, eax
mov esi, eax
jmp 0x40725a
xor esi, esi
test edi, edi
je 0x40727b
mov eax, dword [edi]
test eax, eax
je 0x40727b
push eax
call ebp
mov ecx, dword [edi]
push eax
push ecx
call ebx
test eax, eax
jne 0x40727d
push 0x8007000e
call fcn.0040bab0
xor eax, eax
push 5
push 0
push esi
jmp 0x4072ad
test edi, edi
je 0x4072a5
mov eax, dword [edi]
test eax, eax
je 0x4072a5
push eax
call ebp
mov edx, dword [edi]
push eax
push edx
call ebx
test eax, eax
jne 0x4072a7
push 0x8007000e
call fcn.0040bab0
xor eax, eax
push 5
push 0
push 0
push eax
push str.open
push 0
call dword [0x4723b0]
lea ecx, [esp + 0x2c]
call fcn.00402760
lea ecx, [esp + 0x1c]
call fcn.00402760
lea ecx, [esp + 0x20]
call fcn.00402760
lea ecx, [esp + 0x24]
call fcn.00402760
lea ecx, [esp + 0x18]
call fcn.00402760
lea ecx, [esp + 0x14]
call fcn.00402760
lea ecx, [esp + 0x30]
call fcn.00402760
lea ecx, [esp + 0x28]
call fcn.00402760
lea ecx, [esp + 0x48]
call fcn.00402760
mov eax, 1
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 8