Function at 0x14000d340
Capabilities:
Create process on windows
Create process suspended
Query or enumerate registry value
Read .ini file
Resume thread
Set environment variable
Set registry value
Terminate process

Disassembly:
push rbp
push rdi
push r13
lea rbp, [rsp - 0x103f0]
mov eax, 0x104f0
call fcn.1400139f0
sub rsp, rax
mov rax, qword [0x14004a0e8]
xor rax, rsp
mov qword [rbp + 0x103d0], rax
cmp qword [0x14004b680], 8
lea rdi, [0x14004b668]
mov rcx, rdi
mov qword [rbp - 0x70], r8
cmovae rcx, qword [0x14004b668]
call fcn.1400111d0
lea r13, [0x14004b648]
mov rcx, r13
call fcn.140010b20
test al, al
jne 0x14000d447
mov rcx, qword [0x14004b678]
movabs r13, 0x7ffffffffffffffe
sub r13, rcx
cmp r13, 0x26
jb 0x14000fa3c
cmp qword [0x14004b680], 8
lea r9, str.Couldnt_find_the_configuration_file:
movzx edx, byte [rsp + 0x50]
mov rax, rdi
cmovae rax, qword [0x14004b668]
mov r8, rdi
mov qword [rsp + 0x30], rcx
lea rcx, [rbp + 0xc0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x26
call fcn.140003f30
lea rcx, [rbp + 0xc0]
call fcn.140007040
lea rcx, [rbp + 0xc0]
call fcn.140007ac0
mov r9d, 0x10
lea r8, [0x140036f00]
lea rdx, str.Couldnt_find_the_configuration_file_ColdClientLoader.ini.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
call fcn.140007040
mov eax, 1
jmp 0x14000fa15
lea rcx, [rbp + 0x2a0]
mov qword [rsp + 0x10510], rbx
call fcn.14000fb70
xor r9d, r9d
lea r8, str.SteamClient64Dll
lea rdx, str.SteamClient
mov rdi, rax
lea rcx, [rbp + 0x200]
call fcn.14000a6c0
mov r8, rdi
lea rcx, [rbp + 0x1a0]
mov rdx, rax
call fcn.140010eb0
lea rcx, [rbp + 0x200]
call fcn.140007ac0
lea rcx, [rbp + 0x2a0]
call fcn.140007ac0
lea rcx, [rbp + 0x200]
call fcn.14000fb70
xor r9d, r9d
lea r8, str.SteamClientDll
lea rdx, str.SteamClient
mov rdi, rax
lea rcx, [rbp + 0x1c0]
call fcn.14000a6c0
mov r8, rdi
lea rcx, [rbp + 0x140]
mov rdx, rax
call fcn.140010eb0
mov r8, qword [rbp + 0x1d8]
cmp r8, 8
jb 0x14000d506
mov rdx, qword [rbp + 0x1c0]
lea rcx, [rbp + 0x1c0]
inc r8
call fcn.140009b50
movdqa xmm0, xmmword [0x140037c20]
lea rcx, [rbp + 0x200]
xor ebx, ebx
movdqu xmmword [rbp + 0x1d0], xmm0
mov word [rbp + 0x1c0], bx
call fcn.140007ac0
lea rcx, [rbp + 0xc0]
call fcn.14000fb70
xor r9d, r9d
lea r8, [0x140036fb8]
lea rdx, str.SteamClient
mov rdi, rax
lea rcx, [rbp + 0x200]
call fcn.14000a6c0
mov r8, rdi
lea rcx, [rbp + 0x100]
mov rdx, rax
call fcn.140010eb0
lea rcx, [rbp + 0x200]
call fcn.140007ac0
mov rdx, qword [rbp + 0xd8]
cmp rdx, 8
jb 0x14000d5bb
mov rcx, qword [rbp + 0xc0]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d5b6
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fa42
call fcn.14001368c
lea rcx, [rbp + 0xc0]
call fcn.14000fb70
xor r9d, r9d
lea r8, str.ExeRunDir
lea rdx, str.SteamClient
mov rdi, rax
lea rcx, [rbp + 0x80]
call fcn.14000a6c0
mov r8, rdi
lea rcx, [rbp + 0x120]
mov rdx, rax
call fcn.140010eb0
mov rdx, qword [rbp + 0x98]
cmp rdx, 8
jb 0x14000d63f
mov rcx, qword [rbp + 0x80]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d63a
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fa48
call fcn.14001368c
mov rdx, qword [rbp + 0xd8]
movdqa xmm0, xmmword [0x140037c20]
mov word [rbp + 0x80], bx
movdqu xmmword [rbp + 0x90], xmm0
cmp rdx, 8
jb 0x14000d69c
mov rcx, qword [rbp + 0xc0]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d697
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fa48
call fcn.14001368c
mov qword [rsp + 0x10518], rsi
mov ecx, 0x10025
mov qword [rsp + 0x10528], r12
mov qword [rsp + 0x104e8], r14
mov qword [rsp + 0x104e0], r15
call fcn.140013650
test rax, rax
je 0x14000fa36
lea rbx, [rax + 0x27]
xor edx, edx
and rbx, 0xffffffffffffffe0
mov r8d, 0xfffe
mov rcx, rbx
mov qword [rbp + 0xa0], rbx
lea r14, [rbx + 0xfffe]
mov qword [rbx - 8], rax
mov qword [rbp + 0xb0], r14
call fcn.140015cc0
cmp qword [0x14004b660], 8
lea rdx, str.ExeCommandLine
mov rax, r13
mov qword [rbp + 0xa8], r14
cmovae rax, qword [0x14004b648]
lea rcx, str.SteamClient
mov qword [rsp + 0x28], rax
mov r9, rbx
xor r8d, r8d
mov dword [rsp + 0x20], 0x7fff
mov rsi, r14
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov r15d, 3
mov r12d, r15d
cmp eax, 0x7ffe
jne 0x14000d82a
nop dword [rax + rax]
test r12d, r12d
jle 0x14000d82a
mov rcx, rsi
sub rcx, rbx
sar rcx, 1
lea rdi, [rcx + rcx]
cmp rdi, rcx
jae 0x14000d781
lea rsi, [rbx + rdi*2]
jmp 0x14000d7d2
jbe 0x14000d7d9
mov rax, r14
sub rax, rbx
sar rax, 1
cmp rdi, rax
jbe 0x14000d7bc
lea r8, [rsp + 0x50]
mov rdx, rdi
lea rcx, [rbp + 0xa0]
call fcn.140002b30
mov r14, qword [rbp + 0xb0]
mov rsi, qword [rbp + 0xa8]
mov rbx, qword [rbp + 0xa0]
jmp 0x14000d7d9
sub rdi, rcx
xor edx, edx
add rdi, rdi
mov rcx, rsi
mov r8, rdi
call fcn.140015cc0
add rsi, rdi
mov qword [rbp + 0xa8], rsi
cmp qword [0x14004b660], 8
lea rdx, str.ExeCommandLine
mov rax, r13
lea rcx, str.SteamClient
cmovae rax, qword [0x14004b648]
mov rdi, rsi
mov qword [rsp + 0x28], rax
sub rdi, rbx
sar rdi, 1
mov r9, rbx
xor r8d, r8d
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ecx, eax
dec r12d
lea rdx, [rdi - 1]
cmp rcx, rdx
je 0x14000d760
xorps xmm0, xmm0
mov r8d, eax
xor r12d, r12d
lea rcx, [rbp + 0x160]
mov rdx, rbx
mov qword [rbp + 0x170], r12
movups xmmword [rbp + 0x160], xmm0
mov qword [rbp + 0x178], r12
call fcn.1400018e0
test rbx, rbx
je 0x14000d895
sub r14, rbx
mov rax, rbx
sar r14, 1
add r14, r14
cmp r14, 0x1000
jb 0x14000d88a
mov rbx, qword [rbx - 8]
add r14, 0x27
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fa36
mov rdx, r14
mov rcx, rbx
call fcn.14001368c
xor r9d, r9d
lea r8, str.AppId
lea rdx, str.SteamClient
lea rcx, [rbp + 0xe0]
call fcn.14000a6c0
mov ecx, 0x10025
call fcn.140013650
test rax, rax
je 0x14000fa36
lea rbx, [rax + 0x27]
xor edx, edx
and rbx, 0xffffffffffffffe0
mov r8d, 0xfffe
mov rcx, rbx
mov qword [rbp + 0xa0], rbx
lea r14, [rbx + 0xfffe]
mov qword [rbx - 8], rax
mov qword [rbp + 0xb0], r14
call fcn.140015cc0
cmp qword [0x14004b660], 8
lea rdx, str.ForceInjectSteamClient
mov rax, r13
mov qword [rbp + 0xa8], r14
cmovae rax, qword [0x14004b648]
lea rcx, str.SteamClient
mov qword [rsp + 0x28], rax
mov r9, rbx
xor r8d, r8d
mov dword [rsp + 0x20], 0x7fff
mov rsi, r14
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp eax, 0x7ffe
jne 0x14000da0f
test r15d, r15d
jle 0x14000da0f
mov rcx, rsi
sub rcx, rbx
sar rcx, 1
lea rdi, [rcx + rcx]
cmp rdi, rcx
jae 0x14000d966
lea rsi, [rbx + rdi*2]
jmp 0x14000d9b7
jbe 0x14000d9be
mov rax, r14
sub rax, rbx
sar rax, 1
cmp rdi, rax
jbe 0x14000d9a1
lea r8, [rsp + 0x50]
mov rdx, rdi
lea rcx, [rbp + 0xa0]
call fcn.140002b30
mov r14, qword [rbp + 0xb0]
mov rsi, qword [rbp + 0xa8]
mov rbx, qword [rbp + 0xa0]
jmp 0x14000d9be
sub rdi, rcx
xor edx, edx
add rdi, rdi
mov rcx, rsi
mov r8, rdi
call fcn.140015cc0
add rsi, rdi
mov qword [rbp + 0xa8], rsi
cmp qword [0x14004b660], 8
lea rdx, str.ForceInjectSteamClient
mov rax, r13
lea rcx, str.SteamClient
cmovae rax, qword [0x14004b648]
mov rdi, rsi
mov qword [rsp + 0x28], rax
sub rdi, rbx
sar rdi, 1
mov r9, rbx
xor r8d, r8d
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ecx, eax
dec r15d
lea rdx, [rdi - 1]
cmp rcx, rdx
je 0x14000d945
xorps xmm0, xmm0
mov r8d, eax
mov rdx, rbx
mov qword [rbp + 0x1f0], r12
lea rcx, [rbp + 0x1e0]
mov qword [rbp + 0x1f8], r12
movups xmmword [rbp + 0x1e0], xmm0
call fcn.1400018e0
test rbx, rbx
je 0x14000da77
sub r14, rbx
mov rax, rbx
sar r14, 1
add r14, r14
cmp r14, 0x1000
jb 0x14000da6c
mov rbx, qword [rbx - 8]
add r14, 0x27
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fa36
mov rdx, r14
mov rcx, rbx
call fcn.14001368c
xor r9d, r9d
lea r8, str.ResumeByDebugger
lea rdx, str.Debug
lea rcx, [rbp + 0x240]
call fcn.14000a6c0
lea rcx, [rbp + 0xc0]
call fcn.14000fb70
xor r9d, r9d
lea r8, str.DllsToInjectFolder
lea rdx, str.Extra
mov rdi, rax
lea rcx, [rbp + 0x80]
call fcn.14000a6c0
mov r8, rdi
lea rcx, [rbp + 0x180]
mov rdx, rax
call fcn.140010eb0
mov rdx, qword [rbp + 0x98]
cmp rdx, 8
jb 0x14000db18
mov rcx, qword [rbp + 0x80]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000db13
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fa4e
call fcn.14001368c
mov rdx, qword [rbp + 0xd8]
movdqa xmm0, xmmword [0x140037c20]
mov word [rbp + 0x80], r12w
movdqu xmmword [rbp + 0x90], xmm0
cmp rdx, 8
jb 0x14000db76
mov rcx, qword [rbp + 0xc0]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000db71
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fa4e
call fcn.14001368c
lea r9, [0x140036e90]
lea r8, str.IgnoreInjectionError
lea rdx, str.Extra
lea rcx, [rbp + 0x220]
call fcn.14000a6c0
lea r9, [0x1400370d4]
lea r8, [0x1400370d8]
lea rdx, str.Extra
lea rcx, [rbp + 0x260]
call fcn.14000a6c0
lea rcx, [rbp + 0x240]
call fcn.14000c1d0
lea rcx, [rbp + 0x1e0]
call fcn.14000c1d0
lea rcx, [rbp + 0x220]
call fcn.14000c1d0
lea rcx, [rbp + 0x260]
call fcn.14000c1d0
mov r15, qword [rbp + 0x110]
movabs r13, 0x7ffffffffffffffe
mov rax, r13
sub rax, r15
cmp rax, 0x12
jb 0x14000fa54
cmp qword [rbp + 0x118], 8
lea r14, [rbp + 0x100]
mov edi, 7
lea rsi, [r15 + 0x12]
cmovae r14, qword [rbp + 0x100]
lea rbx, [rbp + 0x60]
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rbp + 0x60], xmm0
lea eax, [rdi + 3]
movdqu xmmword [rbp + 0x70], xmm1
cmp rsi, rdi
jbe 0x14000dc70
mov rdi, rsi
or rdi, 7
cmp rdi, r13
jbe 0x14000dc55
mov rdi, r13
jmp 0x14000dc5c
cmp rdi, rax
cmovb rdi, rax
lea rdx, [rdi + 1]
lea rcx, [rbp + 0x60]
call fcn.140007c10
mov rbx, rax
mov qword [rbp + 0x60], rax
movups xmm0, xmmword [str.SteamClient::Exe:]
mov qword [rbp + 0x70], rsi
lea r8, [r15 + r15]
mov qword [rbp + 0x78], rdi
mov rdx, r14
movups xmmword [rbx], xmm0
movups xmm1, xmmword [0x140037120]
movups xmmword [rbx + 0x10], xmm1
mov ecx, dword [0x140037130]
mov dword [rbx + 0x20], ecx
lea rcx, [rbx + 0x24]
call fcn.140015620
lea rcx, [rbp + 0x60]
mov word [rbx + rsi*2], r12w
call fcn.140007040
mov rdx, qword [rbp + 0x78]
cmp rdx, 8
jb 0x14000dcf4
mov rcx, qword [rbp + 0x60]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000dcef
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fa5a
call fcn.14001368c
mov r14, qword [rbp + 0x130]
mov rax, r13
sub rax, r14
cmp rax, 0x18
jb 0x14000fa60
cmp qword [rbp + 0x138], 8
lea r15, [rbp + 0x120]
lea rsi, [r14 + 0x18]
mov edi, 7
cmovae r15, qword [rbp + 0x120]
lea rbx, [rbp + 0x60]
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rbp + 0x60], xmm0
movdqu xmmword [rbp + 0x70], xmm1
cmp rsi, rdi
jbe 0x14000dd75
mov rdi, rsi
or rdi, 7
cmp rdi, r13
jbe 0x14000dd54
mov rdi, r13
jmp 0x14000dd61
cmp rdi, 0xa
mov eax, 0xa
cmovb rdi, rax
lea rdx, [rdi + 1]
lea rcx, [rbp + 0x60]
call fcn.140007c10
mov rbx, rax
mov qword [rbp + 0x60], rax
movups xmm0, xmmword [str.SteamClient::ExeRunDir:]
mov qword [rbp + 0x70], rsi
lea r8, [r14 + r14]
mov qword [rbp + 0x78], rdi
lea rcx, [rbx + 0x30]
movups xmmword [rbx], xmm0
mov rdx, r15
movups xmm1, xmmword [0x140037148]
movups xmmword [rbx + 0x10], xmm1
movups xmm0, xmmword [0x140037158]
movups xmmword [rbx + 0x20], xmm0
call fcn.140015620
lea rcx, [rbp + 0x60]
mov word [rbx + rsi*2], r12w
call fcn.140007040
mov rdx, qword [rbp + 0x78]
cmp rdx, 8
jb 0x14000ddfb
mov rcx, qword [rbp + 0x60]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ddf6
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fa66
call fcn.14001368c
mov r14, qword [rbp + 0x170]
mov rax, r13
sub rax, r14
cmp rax, 0x1d
jb 0x14000fa6c
cmp qword [rbp + 0x178], 8
lea r15, [rbp + 0x160]
lea rsi, [r14 + 0x1d]
mov edi, 7
cmovae r15, qword [rbp + 0x160]
lea rbx, [rbp + 0x60]
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rbp + 0x60], xmm0
movdqu xmmword [rbp + 0x70], xmm1
cmp rsi, rdi
jbe 0x14000de7c
mov rdi, rsi
or rdi, 7
cmp rdi, r13
jbe 0x14000de5b
mov rdi, r13
jmp 0x14000de68
cmp rdi, 0xa
mov eax, 0xa
cmovb rdi, rax
lea rdx, [rdi + 1]
lea rcx, [rbp + 0x60]
call fcn.140007c10
mov rbx, rax
mov qword [rbp + 0x60], rax
movups xmm0, xmmword [str.SteamClient::ExeCommandLine:]
mov qword [rbp + 0x70], rsi
lea r8, [r14 + r14]
mov qword [rbp + 0x78], rdi
lea rcx, [rbx + 0x3a]
movups xmmword [rbx], xmm0
mov rdx, r15
movups xmm1, xmmword [0x140037180]
movups xmmword [rbx + 0x10], xmm1
movups xmm0, xmmword [0x140037190]
movups xmmword [rbx + 0x20], xmm0
movsd xmm0, qword [0x1400371a0]
movsd qword [rbx + 0x30], xmm0
movzx eax, word [0x1400371a8]
mov word [rbx + 0x38], ax
call fcn.140015620
lea rcx, [rbp + 0x60]
mov word [rbx + rsi*2], r12w
call fcn.140007040
mov rdx, qword [rbp + 0x78]
cmp rdx, 8
jb 0x14000df1a
mov rcx, qword [rbp + 0x60]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000df15
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fa72
call fcn.14001368c
mov rcx, qword [rbp + 0xf0]
mov rax, r13
sub rax, rcx
cmp rax, 0x14
jb 0x14000fa78
cmp qword [rbp + 0xf8], 8
lea rax, [rbp + 0xe0]
movzx edx, byte [rsp + 0x50]
lea r9, str.SteamClient::AppId:
cmovae rax, qword [rbp + 0xe0]
lea r8, [rbp + 0xe0]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp + 0x80]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x14
call fcn.140003f30
lea rcx, [rbp + 0x80]
call fcn.140007040
mov r8, qword [rbp + 0x98]
cmp r8, 8
jb 0x14000dfa9
mov rdx, qword [rbp + 0x80]
lea rcx, [rbp + 0x80]
inc r8
call fcn.140009b50
mov rcx, qword [rbp + 0x150]
mov rax, r13
sub rax, rcx
cmp rax, 0x1a
jb 0x14000fa7e
cmp qword [rbp + 0x158], 8
lea rax, [rbp + 0x140]
movzx edx, byte [rsp + 0x50]
lea r9, str.SteamClient::SteamClient:
cmovae rax, qword [rbp + 0x140]
lea r8, [rbp + 0x140]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp + 0x80]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x1a
call fcn.140003f30
lea rcx, [rbp + 0x80]
call fcn.140007040
mov r8, qword [rbp + 0x98]
cmp r8, 8
jb 0x14000e038
mov rdx, qword [rbp + 0x80]
lea rcx, [rbp + 0x80]
inc r8
call fcn.140009b50
mov rcx, qword [rbp + 0x1b0]
mov rax, r13
sub rax, rcx
cmp rax, 0x1f
jb 0x14000fa84
cmp qword [rbp + 0x1b8], 8
lea rax, [rbp + 0x1a0]
movzx edx, byte [rsp + 0x50]
lea r9, str.SteamClient::SteamClient64Dll:
cmovae rax, qword [rbp + 0x1a0]
lea r8, [rbp + 0x1a0]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp + 0x80]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x1f
call fcn.140003f30
lea rcx, [rbp + 0x80]
call fcn.140007040
mov r8, qword [rbp + 0x98]
cmp r8, 8
jb 0x14000e0c7
mov rdx, qword [rbp + 0x80]
lea rcx, [rbp + 0x80]
inc r8
call fcn.140009b50
mov rcx, qword [rbp + 0x1f0]
mov rax, r13
sub rax, rcx
cmp rax, 0x25
jb 0x14000fa8a
cmp qword [rbp + 0x1f8], 8
lea rax, [rbp + 0x1e0]
movzx edx, byte [rsp + 0x50]
lea r9, str.SteamClient::ForceInjectSteamClient:
cmovae rax, qword [rbp + 0x1e0]
lea r8, [rbp + 0x1e0]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp + 0x80]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x25
call fcn.140003f30
lea rcx, [rbp + 0x80]
call fcn.140007040
mov r8, qword [rbp + 0x98]
cmp r8, 8
jb 0x14000e156
mov rdx, qword [rbp + 0x80]
lea rcx, [rbp + 0x80]
inc r8
call fcn.140009b50
mov rcx, qword [rbp + 0x250]
mov rax, r13
sub rax, rcx
cmp rax, 0x19
jb 0x14000fa90
cmp qword [rbp + 0x258], 8
lea rax, [rbp + 0x240]
movzx edx, byte [rsp + 0x50]
lea r9, str.Debug::ResumeByDebugger:
cmovae rax, qword [rbp + 0x240]
lea r8, [rbp + 0x240]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp + 0x80]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x19
call fcn.140003f30
lea rcx, [rbp + 0x80]
call fcn.140007040
mov r8, qword [rbp + 0x98]
cmp r8, 8
jb 0x14000e1e5
mov rdx, qword [rbp + 0x80]
lea rcx, [rbp + 0x80]
inc r8
call fcn.140009b50
mov rcx, qword [rbp + 0x190]
mov rax, r13
sub rax, rcx
cmp rax, 0x1b
jb 0x14000fa96
cmp qword [rbp + 0x198], 8
lea rax, [rbp + 0x180]
movzx edx, byte [rsp + 0x50]
lea r9, str.Extra::DllsToInjectFolder:
cmovae rax, qword [rbp + 0x180]
lea r8, [rbp + 0x180]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp + 0x80]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x1b
call fcn.140003f30
lea rcx, [rbp + 0x80]
call fcn.140007040
mov r8, qword [rbp + 0x98]
cmp r8, 8
jb 0x14000e274
mov rdx, qword [rbp + 0x80]
lea rcx, [rbp + 0x80]
inc r8
call fcn.140009b50
mov rcx, qword [rbp + 0x230]
mov rax, r13
sub rax, rcx
cmp rax, 0x1d
jb 0x14000fa9c
cmp qword [rbp + 0x238], 8
lea rax, [rbp + 0x220]
movzx edx, byte [rsp + 0x50]
lea r9, str.Extra::IgnoreInjectionError:
cmovae rax, qword [rbp + 0x220]
lea r8, [rbp + 0x220]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp + 0x80]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x1d
call fcn.140003f30
lea rcx, [rbp + 0x80]
call fcn.140007040
mov r8, qword [rbp + 0x98]
cmp r8, 8
jb 0x14000e303
mov rdx, qword [rbp + 0x80]
lea rcx, [rbp + 0x80]
inc r8
call fcn.140009b50
mov rcx, qword [rbp + 0x270]
mov rax, r13
sub rax, rcx
cmp rax, 0x23
jb 0x14000faa2
cmp qword [rbp + 0x278], 8
lea rax, [rbp + 0x260]
movzx edx, byte [rsp + 0x50]
lea r9, str.Extra::IgnoreLoaderArchDifference:
cmovae rax, qword [rbp + 0x260]
lea r8, [rbp + 0x260]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp + 0x80]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x23
call fcn.140003f30
lea rcx, [rbp + 0x80]
call fcn.140007040
mov r8, qword [rbp + 0x98]
cmp r8, 8
jb 0x14000e392
mov rdx, qword [rbp + 0x80]
lea rcx, [rbp + 0x80]
inc r8
call fcn.140009b50
cmp qword [rbp + 0xf0], r12
je 0x14000f624
mov rdi, qword [rbp + 0xf8]
lea rax, [rbp + 0xe0]
mov rcx, qword [rbp + 0xe0]
cmp rdi, 8
cmovae rax, rcx
cmp word [rax], r12w
je 0x14000f624
cmp rdi, 8
lea rdx, [rbp + 0xe0]
cmovae rdx, rcx
lea rcx, str.SteamAppId
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
cmp qword [rbp + 0xf8], 8
lea rdx, [rbp + 0xe0]
lea rcx, str.SteamGameId
cmovae rdx, qword [rbp + 0xe0]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
cmp qword [rbp + 0xf8], 8
lea rdx, [rbp + 0xe0]
lea rcx, str.SteamOverlayGameId
cmovae rdx, qword [rbp + 0xe0]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rcx, [rbp + 0x100]
call fcn.140010b20
test al, al
jne 0x14000e46c
lea rcx, str.Couldnt_find_the_requested_Exe_file
call fcn.140011430
mov r9d, 0x10
lea r8, [0x140036f00]
lea rdx, str.Couldnt_find_the_requested_Exe_file.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
call fcn.140007040
jmp 0x14000f64c
cmp qword [rbp + 0x130], r12
jne 0x14000e64d
cmp qword [rbp + 0x118], 8
lea rdx, [rbp + 0x100]
mov r8, qword [rbp + 0x110]
lea rcx, [rbp + 0x280]
cmovae rdx, qword [rbp + 0x100]
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rbp + 0x280], xmm0
movdqu xmmword [rbp + 0x290], xmm1
call fcn.1400018e0
mov rax, qword [rbp + 0x290]
lea rbx, [rbp + 0x280]
cmp qword [rbp + 0x298], 8
cmovae rbx, qword [rbp + 0x280]
mov rcx, rbx
lea rdi, [rbx + rax*2]
mov rdx, rdi
call fcn.140005fd0
cmp rax, rdi
je 0x14000e55c
nop word [rax + rax]
movzx ecx, word [rax]
cmp cx, 0x5c
je 0x14000e4ff
cmp cx, 0x2f
jne 0x14000e508
add rax, 2
cmp rax, rdi
jne 0x14000e4f0
cmp rax, rdi
je 0x14000e55c
nop dword [rax]
movzx ecx, word [rdi - 2]
lea rdx, [rdi - 2]
cmp cx, 0x5c
je 0x14000e52e
cmp cx, 0x2f
je 0x14000e52e
mov rdi, rdx
cmp rax, rdx
jne 0x14000e510
jmp 0x14000e55c
cmp rax, rdi
je 0x14000e55c
nop dword [rax]
nop word [rax + rax]
movzx ecx, word [rdi - 2]
lea rdx, [rdi - 2]
cmp cx, 0x5c
je 0x14000e554
cmp cx, 0x2f
jne 0x14000e55c
mov rdi, rdx
cmp rax, rdx
jne 0x14000e540
xorps xmm0, xmm0
lea rcx, [rbp + 0x60]
xorps xmm1, xmm1
sub rdi, rbx
sar rdi, 1
mov rdx, rbx
mov r8, rdi
movups xmmword [rbp + 0x60], xmm0
movdqu xmmword [rbp + 0x70], xmm1
call fcn.1400018e0
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 0xc0]
call fcn.140003ca0
lea rdx, [rbp + 0xc0]
lea rcx, [rbp + 0x120]
call fcn.140005020
lea rcx, [rbp + 0xc0]
call fcn.140007ac0
mov r8, qword [rbp + 0x78]
cmp r8, 8
jb 0x14000e5c9
mov rdx, qword [rbp + 0x60]
lea rcx, [rbp + 0x60]
inc r8
call fcn.140009b50
lea rcx, [rbp + 0x280]
call fcn.140007ac0
mov rcx, qword [rbp + 0x130]
mov rax, r13
sub rax, rcx
cmp rax, 0x16
jb 0x14000faa8
cmp qword [rbp + 0x138], 8
lea rax, [rbp + 0x120]
movzx edx, byte [rsp + 0x50]
lea r9, str.Setting_ExeRunDir_to:
cmovae rax, qword [rbp + 0x120]
lea r8, [rbp + 0x120]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp + 0xc0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x16
call fcn.140003f30
lea rcx, [rbp + 0xc0]
call fcn.140007040
lea rcx, [rbp + 0xc0]
call fcn.140007ac0
lea rcx, [rbp + 0x120]
call fcn.1400109c0
test al, al
jne 0x14000e68f
lea rcx, str.Couldnt_find_the_requested_Exe_run_dir
call fcn.140011430
mov r9d, 0x10
lea r8, [0x140036f00]
lea rdx, str.Couldnt_find_the_requested_Exe_run_dir.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
call fcn.140007040
jmp 0x14000f64c
lea rcx, [rbp + 0x1a0]
call fcn.140010b20
test al, al
jne 0x14000e6d1
lea rcx, str.Couldnt_find_the_requested_SteamClient64Dll
call fcn.140011430
mov r9d, 0x10
lea r8, [0x140036f00]
lea rdx, str.Couldnt_find_the_requested_SteamClient64Dll.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
call fcn.140007040
jmp 0x14000f64c
lea rcx, [rbp + 0x140]
call fcn.140010b20
test al, al
jne 0x14000e713
lea rcx, str.Couldnt_find_the_requested_SteamClientDll
call fcn.140011430
mov r9d, 0x10
lea r8, [0x140036f00]
lea rdx, str.Couldnt_find_the_requested_SteamClientDll.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
call fcn.140007040
jmp 0x14000f64c
cmp qword [rbp + 0x190], r12
je 0x14000e75e
lea rcx, [rbp + 0x180]
call fcn.1400109c0
test al, al
jne 0x14000e75e
lea rcx, str.Couldnt_find_the_requested_folder_of_dlls_to_inject
call fcn.140011430
mov r9d, 0x10
lea r8, [0x140036f00]
lea rdx, str.Couldnt_find_the_requested_folder_of_dlls_to_inject.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
call fcn.140007040
jmp 0x14000f64c
lea rdx, [rbp + 0x100]
lea rcx, [rbp - 0x30]
call fcn.14000a8f0
mov rdi, qword [rbp - 0x30]
cmp rdi, qword [rbp - 0x28]
jne 0x14000e790
lea rcx, str.Couldnt_read_the_exe_header
call fcn.140011430
lea rdx, str.Couldnt_read_the_exe_header.
jmp 0x14000ea1e
mov rcx, rdi
call fcn.140010410
mov rcx, rdi
movzx r15d, al
call fcn.140010430
test r15b, r15b
jne 0x14000ea03
test al, al
je 0x14000ea0b
lea rax, str.Detected_exe_arch:_x64
test r15b, r15b
lea rcx, str.Detected_exe_arch:_x32
cmove rcx, rax
call fcn.140011430
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
call fcn.140010410
xor ecx, ecx
movzx edi, al
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
call fcn.140010410
test al, al
lea rdx, str.Detected_loader_arch:_x64
lea rcx, str.Detected_loader_arch:_x32
cmove rcx, rdx
call fcn.140011430
cmp dil, r15b
je 0x14000e83e
lea rcx, str.Arch_of_loader_and_requested_exe_are_different__it_is_advised_to_use_the_appropriate_one
call fcn.140011430
cmp qword [rbp + 0x270], r12
jne 0x14000e83e
xor r9d, r9d
lea r8, [0x140036f00]
lea rdx, str.Arch_of_loader_and_requested_exe_are_different__nit_is_advised_to_use_the_appropriate_one.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xorps xmm0, xmm0
mov qword [rsp + 0x78], r12
mov ebx, 1
movdqu xmmword [rsp + 0x68], xmm0
cmp qword [rbp + 0x190], r12
je 0x14000ea65
movups xmmword [rbp + 0x60], xmm0
lea r9, [rbp + 0x60]
mov word [rbp + 0x60], r12w
movzx r8d, r15b
mov qword [rbp + 0x70], r12
lea rdx, [rbp + 0x180]
mov qword [rbp + 0x78], 7
lea rcx, [rbp + 0xa0]
call fcn.140008260
mov rsi, rax
lea rax, [rsp + 0x68]
cmp rax, rsi
je 0x14000e90d
mov rdi, qword [rsp + 0x68]
test rdi, rdi
je 0x14000e8e8
mov r14, qword [rsp + 0x70]
cmp rdi, r14
je 0x14000e8c6
nop
mov rcx, rdi
call fcn.140007ac0
add rdi, 0x20
cmp rdi, r14
jne 0x14000e8b0
mov rdi, qword [rsp + 0x68]
mov r8, qword [rsp + 0x78]
lea rcx, [rsp + 0x68]
sub r8, rdi
mov rdx, rdi
sar r8, 5
call fcn.140009b00
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x70], xmm0
mov rax, qword [rsi]
mov qword [rsp + 0x68], rax
mov rax, qword [rsi + 8]
mov qword [rsp + 0x70], rax
mov rax, qword [rsi + 0x10]
mov qword [rsp + 0x78], rax
mov qword [rsi], r12
mov qword [rsi + 8], r12
mov qword [rsi + 0x10], r12
lea rcx, [rbp + 0xa0]
call fcn.140007a30
mov rcx, qword [rbp + 0x70]
test rcx, rcx
je 0x14000ea4b
cmp qword [rbp + 0x230], r12
jne 0x14000ea4b
mov rax, r13
sub rax, rcx
cmp rax, 0x27
jb 0x14000faae
cmp qword [rbp + 0x78], 8
lea rax, [rbp + 0x60]
movzx edx, byte [rsp + 0x50]
lea r9, str.The_following_dlls_cannot_be_injected:_n
cmovae rax, qword [rbp + 0x60]
lea r8, [rbp + 0x60]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp + 0xc0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x27
call fcn.140003f30
lea r8, str._nContinue__
lea rdx, [rbp + 0xc0]
lea rcx, [rbp + 0x200]
call fcn.140001700
cmp qword [rax + 0x18], 8
jb 0x14000e9a4
mov rax, qword [rax]
mov r9d, 4
lea r8, str.ColdClientLoader
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
lea rcx, [rbp + 0x200]
mov edi, eax
call fcn.140007ac0
lea rcx, [rbp + 0xc0]
call fcn.140007ac0
cmp edi, 6
je 0x14000ea4b
call fcn.140007040
mov r8, qword [rbp + 0x78]
cmp r8, 8
jb 0x14000f60f
mov rdx, qword [rbp + 0x60]
lea rcx, [rbp + 0x60]
inc r8
call fcn.140009b50
jmp 0x14000f60f
test al, al
je 0x14000e7b5
lea rcx, str.The_requested_exe_is_invalid__neither_32_nor_64_bit_
call fcn.140011430
lea rdx, str.The_requested_exe_is_invalid__neither_32_nor_64_bit_
mov r9d, 0x10
lea r8, [0x140036f00]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
call fcn.140007040
lea rcx, [rbp - 0x30]
mov ebx, 1
call fcn.140004cf0
jmp 0x14000f651
mov r8, qword [rbp + 0x78]
cmp r8, 8
jb 0x14000ea65
mov rdx, qword [rbp + 0x60]
lea rcx, [rbp + 0x60]
inc r8
call fcn.140009b50
mov qword [rsp + 0x58], r12
mov dword [rbp - 0x50], 0x771f810d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
mov byte [rsp + 0x50], r12b
mov r8d, 0x4000
mov dword [rbp - 0x4c], eax
lea rcx, [rbp + 0x3d0]
mov dword [rbp - 0x80], ebx
call fcn.140015cc0
xor edx, edx
lea rcx, [rbp + 0x43d0]
mov r8d, 0x4000
call fcn.140015cc0
lea rax, [rsp + 0x58]
mov dword [rbp - 0x7c], 0x2000
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp - 0x78], 0x2000
lea rdx, str.SoftwareValveSteamActiveProcess
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000edb0
mov rcx, qword [rsp + 0x58]
lea rax, [rbp - 0x7c]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x80]
lea rax, [rbp + 0x3d0]
mov byte [rsp + 0x50], bl
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SteamClientDll
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x58]
lea rax, [rbp - 0x78]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x80]
lea rax, [rbp + 0x43d0]
xor r8d, r8d
lea rdx, str.SteamClientDll64
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x58]
lea rax, [rbp - 0x50]
mov dword [rsp + 0x28], 4
lea rdx, str.ActiveUser
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
lea rax, [rbp - 0x4c]
mov dword [rsp + 0x28], 4
lea rdx, [0x1400379a4]
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [rbp + 0x150]
lea rcx, [rbp + 0x140]
cmp qword [rbp + 0x158], 8
lea rdx, str.SteamClientDll
mov r9d, ebx
cmovae rcx, qword [rbp + 0x140]
xor r8d, r8d
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [rbp + 0x1b0]
lea rcx, [rbp + 0x1a0]
cmp qword [rbp + 0x1b8], 8
lea rdx, str.SteamClientDll64
mov r9d, ebx
cmovae rcx, qword [rbp + 0x1a0]
xor r8d, r8d
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x58]
lea rax, str.Public
mov dword [rsp + 0x28], 7
lea rdx, str.Universe
mov r9d, ebx
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xorps xmm0, xmm0
lea rdi, [rbp - 0x10]
xor eax, eax
mov ecx, 0x68
movups xmmword [rbp - 0xc], xmm0
mov dword [rbp + 0x54], eax
xor edx, edx
movups xmmword [rbp + 4], xmm0
mov qword [rbp - 0x58], rax
mov r8d, 0x8000
movups xmmword [rbp + 0x14], xmm0
movups xmmword [rbp + 0x24], xmm0
movups xmmword [rbp + 0x34], xmm0
movups xmmword [rbp + 0x44], xmm0
rep stosb byte [rdi], al
movups xmmword [rbp - 0x68], xmm0
lea rdi, [rbp - 0x68]
mov dword [rbp - 0x10], 0x68
mov ecx, 0x18
rep stosb byte [rdi], al
lea rcx, [rbp + 0x83d0]
call fcn.140015cc0
cmp qword [rbp + 0x178], 8
lea rax, [rbp + 0x160]
mov rcx, qword [rbp - 0x70]
lea r9, [rbp + 0x100]
cmovae rax, qword [rbp + 0x160]
cmp qword [rbp + 0x118], 8
mov qword [rsp + 0x28], rcx
cmovae r9, qword [rbp + 0x100]
mov qword [rsp + 0x20], rax
lea r8, str.__ls___ls__ls
mov edx, 0x4000
lea rcx, [rbp + 0x83d0]
call fcn.14000d2e0
cmp qword [rbp + 0x138], 8
lea rdx, [rbp - 0x68]
mov qword [rsp + 0x48], rdx
lea rax, [rbp + 0x120]
cmovae rax, qword [rbp + 0x120]
lea rdx, [rbp - 0x10]
cmp qword [rbp + 0x118], 8
lea rcx, [rbp + 0x100]
mov qword [rsp + 0x40], rdx
lea rdx, [rbp + 0x83d0]
cmovae rcx, qword [rbp + 0x100]
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x14000ee49
lea rcx, str.Unable_to_load_the_requested_EXE_file
call fcn.140011430
lea rdx, str.Unable_to_load_the_requested_EXE_file.
mov r9d, 0x10
lea r8, [0x140036f00]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
call fcn.140007040
jmp 0x14000f60f
mov qword [rsp + 0x40], r12
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea rdx, str.SoftwareValveSteamActiveProcess
mov qword [rsp + 0x30], r12
xor r9d, r9d
mov dword [rsp + 0x28], 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x14000eb47
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x2a0]
call fcn.14000c350
mov r8, rax
lea rdx, str.Unable_to_patch_Steam_process_informations_on_the_Windows_registry__ActiveProcess___error_
lea rcx, [rbp + 0x200]
call fcn.1400015d0
mov rcx, rax
call fcn.140007040
lea rcx, [rbp + 0x200]
call fcn.140004c10
lea rcx, [rbp + 0x2a0]
call fcn.140004c10
lea rdx, str.Unable_to_patch_Steam_process_informations_on_the_Windows_registry.
jmp 0x14000ed91
cmp qword [rbp + 0x1f0], r12
je 0x14000ee78
mov r8, qword [rsp + 0x68]
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x68]
lea r9, [rbp + 0x140]
test r15b, r15b
jne 0x14000ee73
lea r9, [rbp + 0x1a0]
call fcn.14000acb0
mov rax, qword [rsp + 0x70]
mov r12, qword [rsp + 0x68]
mov qword [rbp - 0x40], rax
cmp r12, rax
je 0x14000f392
movzx edi, byte [rsp + 0x50]
movzx ebx, byte [rsp + 0x50]
movzx esi, byte [rsp + 0x50]
movzx r14d, byte [rsp + 0x50]
movzx r15d, byte [rsp + 0x50]
nop word [rax + rax]
mov rcx, qword [r12 + 0x10]
mov rax, r13
sub rax, rcx
cmp rax, 0x10
jb 0x14000fac6
cmp qword [r12 + 0x18], 8
mov rax, r12
jb 0x14000eed4
mov rax, qword [r12]
mov qword [rsp + 0x30], rcx
lea r9, str.Injecting_dll:_
mov qword [rsp + 0x28], rax
lea rcx, [rbp + 0xc0]
mov r8, r12
mov qword [rsp + 0x20], 0x10
movzx edx, dil
call fcn.140003f30
mov r8d, 5
lea rdx, str._...
lea rcx, [rbp + 0xc0]
call fcn.140007d10
xor ecx, ecx
xorps xmm0, xmm0
mov qword [rbp + 0x70], rcx
mov qword [rbp + 0x78], rcx
movups xmmword [rbp + 0x60], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x70], xmm1
mov qword [rax + 0x10], rcx
mov word [rax], cx
lea rcx, [rbp + 0x60]
mov qword [rax + 0x18], 7
call fcn.140007040
mov rdx, qword [rbp + 0x78]
cmp rdx, 8
jb 0x14000ef92
mov rcx, qword [rbp + 0x60]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ef8d
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fab4
call fcn.14001368c
xor eax, eax
mov qword [rbp + 0x78], 7
lea rcx, [rbp + 0xc0]
mov qword [rbp + 0x70], rax
mov word [rbp + 0x60], ax
call fcn.140007ac0
mov rcx, qword [rbp - 0x68]
lea r8, [rbp - 0x70]
xor eax, eax
mov rdx, r12
mov qword [rbp - 0x70], rax
call fcn.140010450
mov dword [rbp - 0x48], eax
test eax, eax
je 0x14000f373
mov edx, eax
lea rcx, [rbp + 0x3ca]
call fcn.140002c30
lea r9, [rsp + 0x60]
mov rdx, rax
lea r8, [rbp + 0x3ca]
lea rcx, [rbp + 0x200]
call fcn.1400014d0
mov edx, dword [rbp - 0x48]
lea rcx, [rbp + 0x2e0]
call fcn.1400101d0
mov rdx, rax
lea rcx, [rbp + 0x2c0]
call fcn.140010d60
mov rdx, qword [rbp - 0x70]
xorps xmm0, xmm0
mov qword [rbp - 0x38], rax
mov r8, 0xffffffffffffffff
xor eax, eax
mov qword [rbp + 0xb0], rax
mov qword [rbp + 0xb8], rax
movups xmmword [rbp + 0xa0], xmm0
inc r8
cmp byte [rdx + r8], al
jne 0x14000f041
lea rcx, [rbp + 0xa0]
call fcn.140001820
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0x380]
call fcn.140010d60
mov rdx, qword [r12 + 0x10]
mov rcx, r13
sub rcx, rdx
mov qword [rbp - 0x48], rax
cmp rcx, 0x1a
jb 0x14000fac0
cmp qword [r12 + 0x18], 8
mov rcx, r12
jb 0x14000f091
mov rcx, qword [r12]
mov qword [rsp + 0x30], rdx
lea r9, str.Failed_to_inject_the_dll:
mov qword [rsp + 0x28], rcx
mov r8, r12
lea rcx, [rbp + 0x2a0]
mov qword [rsp + 0x20], 0x1a
movzx edx, bl
call fcn.140003f30
mov r8d, 1
lea rdx, [0x140036ca4]
lea rcx, [rbp + 0x2a0]
call fcn.140007d10
mov r9, qword [rbp - 0x48]
lea r8, [rbp + 0x80]
xor ecx, ecx
movzx edx, r14b
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
mov qword [rax + 0x10], rcx
mov word [rax], cx
lea rcx, [rbp + 0x340]
movups xmmword [rbp + 0x80], xmm0
mov qword [rax + 0x18], 7
movups xmmword [rbp + 0x90], xmm1
call fcn.140003d70
lea r8, [0x140036ca4]
lea rdx, [rbp + 0x340]
lea rcx, [rbp + 0x360]
call fcn.140001700
mov r9, qword [rbp - 0x38]
lea rcx, [rbp + 0x320]
mov r8, rax
movzx edx, sil
call fcn.140003d70
mov r8d, 1
lea rdx, [0x140036ca4]
lea rcx, [rbp + 0x320]
call fcn.140007d10
xor ecx, ecx
lea rdx, str.Error_code_
mov qword [rbp + 0x1d0], rcx
xorps xmm0, xmm0
mov qword [rbp + 0x1d8], rcx
movups xmmword [rbp + 0x1c0], xmm0
lea r8d, [rcx + 0xd]
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x1c0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x1d0], xmm1
mov qword [rax + 0x10], rcx
mov word [rax], cx
lea rcx, [rbp + 0x1c0]
mov qword [rax + 0x18], 7
call fcn.140007d10
xor ecx, ecx
lea r9, [rbp + 0x200]
lea r8, [rbp + 0xc0]
movzx edx, r15b
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
mov qword [rax + 0x10], rcx
mov word [rax], cx
lea rcx, [rbp + 0x300]
movups xmmword [rbp + 0xc0], xmm0
mov qword [rax + 0x18], 7
movups xmmword [rbp + 0xd0], xmm1
call fcn.140003d70
mov r8d, 1
lea rdx, [0x140036ca4]
lea rcx, [rbp + 0x300]
call fcn.140007d10
xor ecx, ecx
xorps xmm0, xmm0
movups xmmword [rbp + 0x60], xmm0
mov qword [rbp + 0x70], rcx
mov qword [rbp + 0x78], rcx
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x70], xmm1
mov qword [rax + 0x10], rcx
mov word [rax], cx
lea rcx, [rbp + 0x300]
mov qword [rax + 0x18], 7
call fcn.140007ac0
lea rcx, [rbp + 0xc0]
call fcn.140007ac0
lea rcx, [rbp + 0x1c0]
call fcn.140007ac0
lea rcx, [rbp + 0x320]
call fcn.140007ac0
lea rcx, [rbp + 0x360]
call fcn.140007ac0
lea rcx, [rbp + 0x340]
call fcn.140007ac0
mov r8, qword [rbp + 0x98]
cmp r8, 8
jb 0x14000f2ad
mov rdx, qword [rbp + 0x80]
lea rcx, [rbp + 0x80]
inc r8
call fcn.140009b50
lea rcx, [rbp + 0x2a0]
call fcn.140007ac0
lea rcx, [rbp + 0x380]
call fcn.140007ac0
mov rdx, qword [rbp + 0xb8]
cmp rdx, 0x10
jb 0x14000f306
mov rcx, qword [rbp + 0xa0]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f301
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000faba
call fcn.14001368c
xor eax, eax
mov qword [rbp + 0xb8], 0xf
lea rcx, [rbp + 0x2c0]
mov qword [rbp + 0xb0], rax
mov byte [rbp + 0xa0], al
call fcn.140007ac0
lea rcx, [rbp + 0x2e0]
call fcn.140004c10
lea rcx, [rbp + 0x200]
call fcn.140007ac0
lea rcx, [rbp + 0x60]
call fcn.140007040
cmp qword [rbp + 0x230], 0
je 0x14000f3ae
mov r8, qword [rbp + 0x78]
cmp r8, 8
jb 0x14000f37f
mov rdx, qword [rbp + 0x60]
lea rcx, [rbp + 0x60]
inc r8
call fcn.140009b50
jmp 0x14000f37f
lea rcx, str.Injected_
call fcn.140011430
add r12, 0x20
cmp r12, qword [rbp - 0x40]
jne 0x14000eeb0
mov ebx, 1
cmp qword [rbp + 0x250], 0
jne 0x14000f41b
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
xor r12d, r12d
jmp 0x14000f501
mov rcx, qword [rbp - 0x68]
mov ebx, 1
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rbp + 0x78], 8
lea rdx, [rbp + 0x60]
lea r9d, [rbx + 0xf]
cmovae rdx, qword [rbp + 0x60]
lea r8, str.ColdClientLoader
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
call fcn.140007040
mov r8, qword [rbp + 0x78]
cmp r8, 8
jb 0x14000f413
mov rdx, qword [rbp + 0x60]
lea rcx, [rbp + 0x60]
inc r8
call fcn.140009b50
xor r12d, r12d
jmp 0x14000f60f
mov edx, dword [rbp - 0x58]
lea rcx, [rbp + 0x2c0]
call fcn.14000c350
mov r8, rax
lea rdx, str.Attach_a_debugger_now_to_PID
lea rcx, [rbp + 0x2e0]
call fcn.1400015d0
mov r8d, 0x1b
lea rdx, str._and_resume_its_main_thread
mov rcx, rax
call fcn.140007c80
xorps xmm0, xmm0
lea rcx, [rbp + 0x2e0]
movups xmmword [rbp + 0x60], xmm0
xor r12d, r12d
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x70], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x70], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], r12b
call fcn.140004c10
lea rcx, [rbp + 0x2c0]
call fcn.140004c10
lea rcx, [rbp + 0x60]
call fcn.140007040
cmp qword [rbp + 0x78], 0x10
lea rdx, [rbp + 0x60]
lea r8, [0x140036f00]
cmovae rdx, qword [rbp + 0x60]
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rdx, qword [rbp + 0x78]
cmp rdx, 0x10
jb 0x14000f501
mov rcx, qword [rbp + 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f4fc
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fa30
call fcn.14001368c
mov rcx, qword [rbp - 0x60]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [rsp + 0x50], 0
je 0x14000f607
lea rax, [rsp + 0x58]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareValveSteamActiveProcess
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000f5bd
mov eax, dword [rbp - 0x7c]
lea rdx, str.SteamClientDll
mov rcx, qword [rsp + 0x58]
mov r9d, ebx
mov dword [rsp + 0x28], eax
xor r8d, r8d
lea rax, [rbp + 0x3d0]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [rbp - 0x78]
lea rdx, str.SteamClientDll64
mov rcx, qword [rsp + 0x58]
mov r9d, ebx
mov dword [rsp + 0x28], eax
xor r8d, r8d
lea rax, [rbp + 0x43d0]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14000f607
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x2c0]
call fcn.14000c350
mov r8, rax
lea rdx, str.Unable_to_restore_the_original_Steam_process_informations_in_the_Windows_registry__error_
lea rcx, [rbp + 0x2e0]
call fcn.1400015d0
mov rcx, rax
call fcn.140007040
lea rcx, [rbp + 0x2e0]
call fcn.140004c10
lea rcx, [rbp + 0x2c0]
call fcn.140004c10
call fcn.140007040
mov ebx, r12d
lea rcx, [rsp + 0x68]
call fcn.140007a30
lea rcx, [rbp - 0x30]
call fcn.140004cf0
jmp 0x14000f651
lea rcx, str.You_forgot_to_set_the_AppId
call fcn.140011430
mov r9d, 0x10
lea r8, [0x140036f00]
lea rdx, str.You_forgot_to_set_the_AppId.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ebx, 1
mov rdx, qword [rbp + 0x278]
cmp rdx, 8
jb 0x14000f697
mov rcx, qword [rbp + 0x260]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f692
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fa36
call fcn.14001368c
mov rdx, qword [rbp + 0x238]
cmp rdx, 8
jb 0x14000f6dd
mov rcx, qword [rbp + 0x220]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f6d8
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fa36
call fcn.14001368c
mov rdx, qword [rbp + 0x198]
cmp rdx, 8
jb 0x14000f723
mov rcx, qword [rbp + 0x180]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f71e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fa36
call fcn.14001368c
mov rdx, qword [rbp + 0x258]
mov qword [rbp + 0x190], r12
mov qword [rbp + 0x198], 7
mov word [rbp + 0x180], r12w
cmp rdx, 8
jb 0x14000f783
mov rcx, qword [rbp + 0x240]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f77e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fa36
call fcn.14001368c
mov rdx, qword [rbp + 0x1f8]
cmp rdx, 8
jb 0x14000f7c9
mov rcx, qword [rbp + 0x1e0]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f7c4
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fa36
call fcn.14001368c
mov rdx, qword [rbp + 0xf8]
cmp rdx, 8
jb 0x14000f80f
mov rcx, qword [rbp + 0xe0]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f80a
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fa36
call fcn.14001368c
mov rdx, qword [rbp + 0x178]
mov qword [rbp + 0xf0], r12
mov qword [rbp + 0xf8], 7
mov word [rbp + 0xe0], r12w
cmp rdx, 8
jb 0x14000f86f
mov rcx, qword [rbp + 0x160]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f86a
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fa36
call fcn.14001368c
mov rdx, qword [rbp + 0x138]
mov qword [rbp + 0x170], r12
mov qword [rbp + 0x178], 7
mov word [rbp + 0x160], r12w
cmp rdx, 8
jb 0x14000f8cf
mov rcx, qword [rbp + 0x120]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f8ca
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fa36
call fcn.14001368c
mov rdx, qword [rbp + 0x118]
mov qword [rbp + 0x130], r12
mov qword [rbp + 0x138], 7
mov word [rbp + 0x120], r12w
cmp rdx, 8
jb 0x14000f92f
mov rcx, qword [rbp + 0x100]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f92a
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fa36
call fcn.14001368c
mov rdx, qword [rbp + 0x158]
mov qword [rbp + 0x110], r12
mov qword [rbp + 0x118], 7
mov word [rbp + 0x100], r12w
cmp rdx, 8
jb 0x14000f98f
mov rcx, qword [rbp + 0x140]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f98a
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fa36
call fcn.14001368c
mov rdx, qword [rbp + 0x1b8]
mov qword [rbp + 0x150], r12
mov qword [rbp + 0x158], 7
mov word [rbp + 0x140], r12w
cmp rdx, 8
jb 0x14000f9eb
mov rcx, qword [rbp + 0x1a0]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f9e6
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fa36
call fcn.14001368c
mov r14, qword [rsp + 0x104e8]
mov eax, ebx
mov rbx, qword [rsp + 0x10510]
mov r12, qword [rsp + 0x10528]
mov rsi, qword [rsp + 0x10518]
mov r15, qword [rsp + 0x104e0]
mov rcx, qword [rbp + 0x103d0]
xor rcx, rsp
call fcn.140013a50
add rsp, 0x104f0
pop r13
pop rdi
pop rbp
ret
call fcn.140019fd4
int3
call fcn.140019fd4
int3
call fcn.140007b50
int3
call fcn.140019fd4
int3
call fcn.140019fd4
int3
call fcn.140019fd4
int3
call fcn.140007b50
int3
call fcn.140019fd4
int3
call fcn.140007b50
int3
call fcn.140019fd4
int3
call fcn.140007b50
int3
call fcn.140019fd4
int3
call fcn.140007b50
int3
call fcn.140007b50
int3
call fcn.140007b50
int3
call fcn.140007b50
int3
call fcn.140007b50
int3
call fcn.140007b50
int3
call fcn.140007b50
int3
call fcn.140007b50
int3
call fcn.140007b50
int3
call fcn.140007b50
int3
call fcn.140019fd4
int3
call fcn.140019fd4
int3
call fcn.140007b50
int3
call fcn.140007b50
int3