Function at 0x401a20
Capabilities:
Create process on windows
Create process suspended
Delete file
Resume thread
Set current directory
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x964
mov eax, dword [ebp + 8]
mov dword [0x40b09c], eax
xor eax, eax
push ebx
push esi
push edi
mov byte [esp + 0x4c0], 0
mov ecx, 0x63
lea edi, [esp + 0x4c1]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x1a0], 0
mov ecx, 0x63
lea edi, [esp + 0x1a1]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x330], 0
mov ecx, 0x63
lea edi, [esp + 0x331]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x7e0], 0
mov ecx, 0x63
lea edi, [esp + 0x7e1]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [esp + 0x10], 0
xor eax, eax
mov ecx, 0x63
lea edi, [esp + 0x11]
rep stosd dword es:[edi], eax
push 0x186
lea ecx, [esp + 0x4c4]
stosw word es:[edi], ax
push ecx
push 0
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x4c0]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401ad7
sub eax, edx
xor ecx, ecx
jmp 0x401af0
mov dl, byte [esp + ecx + 0x4c0]
mov byte [esp + ecx + 0x1a0], dl
inc ecx
test dl, dl
jne 0x401af0
xor ecx, ecx
jmp 0x401b10
mov dl, byte [esp + ecx + 0x4c0]
mov byte [esp + ecx + 0x330], dl
inc ecx
test dl, dl
jne 0x401b10
mov cl, 0x6c
mov byte [esp + eax + 0x19e], cl
mov byte [esp + eax + 0x19f], cl
mov byte [esp + eax + 0x19d], 0x64
lea eax, [esp + eax + 0x330]
mov cl, 0x69
lea edx, [esp + 0x1a0]
push edx
mov byte [eax - 3], cl
mov byte [eax - 2], 0x6e
mov byte [eax - 1], cl
call fcn.00401700
add esp, 4
test al, al
jne 0x401b90
push 0x40010
push str._OGC__DLL_NOT_FOUND_
lea eax, [esp + 0x1a8]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
lea ecx, [esp + 0x330]
push 0x40852c
push ecx
call fcn.0040216f
mov esi, eax
add esp, 8
test esi, esi
je 0x401bd6
push esi
lea edx, [esp + 0x14]
push 0x186
push edx
call fcn.004020ee
lea eax, [esp + 0x1c]
push eax
mov byte [esp + 0x1ae], 0
call fcn.00401850
push esi
call fcn.00402098
add esp, 0x14
lea ecx, [esp + 0x10]
push ecx
call fcn.00401700
add esp, 4
test al, al
jne 0x401c97
lea edx, [esp + 0x10]
push edx
call fcn.004018b0
add esp, 4
test al, al
jne 0x401c38
push 0x30
push str._OGC__REQUEST
push str.WE_COULD_NOT_FIND_YOUR_HL_CS_EXECUTABLE__nHL.EXE_OR_CSTRIKE.EXE
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
push 0
push str.HL_CS_DIRECTORY
push str.hl.exe_or_cstrike.exe
lea eax, [esp + 0x20]
push str.c:_sierracounter_strikecstrike.exe
push eax
call fcn.00401730
add esp, 0x18
test al, al
je 0x401e9b
lea ecx, [esp + 0x330]
push 0x408484
push ecx
call fcn.0040216f
mov esi, eax
add esp, 8
test esi, esi
je 0x401c80
lea edx, [esp + 0x10]
push edx
push str._s_r_n
push esi
call fcn.00402066
push esi
call fcn.00402098
lea eax, [esp + 0x20]
push eax
call fcn.00401700
add esp, 0x14
test al, al
je 0x401b90
jmp 0x401c97
push 0
push str._OGC__WRITE_ERROR
lea ecx, [esp + 0x338]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea edx, [esp + 0x4c0]
push edx
lea eax, [esp + 0x14]
push eax
call fcn.004078f6
add esp, 8
test eax, eax
jne 0x401cdf
push 0x30
push str._OGC__ERROR
push str.CANNOT_EXECUTE_HL_CS_PROGRAM_
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [esp + 0x330]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
lea edx, [esp + 0x10]
push edx
call fcn.004017e0
add esp, 4
test al, al
je 0x401cf5
call sub.KERNEL32.dll_GetVersion
mov ebx, dword [ebp + 0x10]
push str._game
push ebx
call fcn.00401fe0
add esp, 8
test eax, eax
jne 0x401d1e
mov ecx, 6
mov esi, str.__game_cstrike__console
lea edi, [esp + 0x7e0]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov eax, ebx
mov edx, ebx
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401d22
lea edi, [esp + 0x7e0]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x401d33
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor eax, eax
mov ecx, 0x11
mov edi, 0x40b0a0
rep stosd dword es:[edi], eax
mov dword [0x40b0e8], eax
mov dword [0x40b0ec], eax
mov dword [0x40b0f0], eax
mov dword [0x40b0f4], eax
mov dword [0x40b0a0], 0x44
jmp 0x401d80
mov cl, byte [esp + eax + 0x10]
mov byte [esp + eax + 0x650], cl
inc eax
test cl, cl
jne 0x401d80
lea eax, [esp + 0x650]
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401da0
sub eax, edx
lea esi, [esp + eax + 0x650]
lea ecx, [esp + 0x650]
cmp esi, ecx
jb 0x401dd1
jmp 0x401dc0
cmp byte [esi], 0x5c
je 0x401dd1
dec esi
lea edx, [esp + 0x650]
cmp esi, edx
jae 0x401dc0
lea eax, [esp + 0x650]
push eax
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push 0x40b0e8
push 0x40b0a0
push 0
push 0
push 4
push 0
push 0
push 0
lea ecx, [esp + 0x800]
push ecx
inc esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x401e2e
push 0x40010
push str._OGC__ERROR
push str.CANNOT_CREATE_THE_HL_CS_PROCESS_
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
lea edx, [esp + 0x1a0]
push 0x40b0e8
push edx
call fcn.00401610
add esp, 8
test eax, eax
jne 0x401e77
push 0x40010
push str._OGC__ERROR
push str.HOOK_INJECTION_FAILED_
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [0x40b0e8]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [0x40b0ec]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov edx, dword [0x40b0e8]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [0x40b0ec]
push eax
call esi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10