Function at 0x1400110af
Capabilities:
Check if file exists
Create process on windows
Create process suspended
Get file attributes
Query or enumerate registry value
Read .ini file
Resume thread
Set environment variable
Set registry value
Terminate process

Disassembly:
jmp 0x140011b60
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
mov eax, 0x7b18
call fcn.1400110aa
sub rsp, rax
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x1d32
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x7b38]
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x7ab8], rax
lea rcx, [0x14002506b]
call fcn.1400113d9
nop
lea rax, [rbp + 0x10]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rax, [rbp + 0x240]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rax, [rbp + 0x470]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rax, [rbp + 0x6a0]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rax, [rbp + 0x8d0]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rax, [rbp + 0xb00]
mov rdi, rax
xor eax, eax
mov ecx, 0x2000
rep stosb byte [rdi], al
lea rax, [rbp + 0x2b20]
mov rdi, rax
xor eax, eax
mov ecx, 0x100
rep stosb byte [rdi], al
mov dword [rbp + 0x2c40], 0x68
lea rax, [rbp + 0x2c48]
mov rdi, rax
xor eax, eax
mov ecx, 0x60
rep stosb byte [rdi], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r8d, 0x208
lea rdx, [rbp + 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
inc eax
mov dword [rbp + 0x2cf4], eax
mov eax, dword [rbp + 0x2cf4]
mov dword [rbp + 0x2d14], eax
jmp 0x140011c9d
mov eax, dword [rbp + 0x2d14]
dec eax
mov dword [rbp + 0x2d14], eax
cmp dword [rbp + 0x2d14], 0
jle 0x140011cdb
movsxd rax, dword [rbp + 0x2d14]
movzx eax, word [rbp + rax*2 + 0x10]
cmp eax, 0x5c
jne 0x140011cd9
mov eax, dword [rbp + 0x2d14]
inc eax
cdqe
lea rax, [rbp + rax*2 + 0x10]
lea rdx, str.Loader.ini
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
nop
jmp 0x140011cdb
jmp 0x140011c8f
lea rcx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140011d0e
mov r9d, 0x10
lea r8, str.Loader
lea rdx, str.Couldnt_find_the_configuration_file_Loader.ini_.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
nop
xor eax, eax
jmp 0x1400125b8
lea rax, [rbp + 0x10]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x104
lea r9, [rbp + 0x240]
lea r8, [0x14001c37c]
lea rdx, str.SteamClient64Dll
lea rcx, str.SteamClient
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
nop
lea rax, [rbp + 0x10]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x104
lea r9, [rbp + 0x470]
lea r8, [0x14001c37c]
lea rdx, str.SteamClientDll
lea rcx, str.SteamClient
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
nop
lea rax, [rbp + 0x10]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x104
lea r9, [rbp + 0x6a0]
xor r8d, r8d
lea rdx, [0x14001c3f0]
lea rcx, str.SteamClient
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
nop
lea rax, [rbp + 0x10]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x104
lea r9, [rbp + 0x8d0]
xor r8d, r8d
lea rdx, str.ExeRunDir
lea rcx, str.SteamClient
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
nop
lea rax, [rbp + 0x10]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x1000
lea r9, [rbp + 0xb00]
xor r8d, r8d
lea rdx, str.ExeCommandLine
lea rcx, str.SteamClient
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
nop
lea rax, [rbp + 0x10]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x100
lea r9, [rbp + 0x2b20]
xor r8d, r8d
lea rdx, str.AppId
lea rcx, str.SteamClient
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
nop
mov eax, 2
imul rax, rax, 0
movzx eax, word [rbp + rax + 0x2b20]
test eax, eax
je 0x140011e77
lea rdx, [rbp + 0x2b20]
lea rcx, str.SteamAppId
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
nop
lea rdx, [rbp + 0x2b20]
lea rcx, str.SteamGameId
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
nop
jmp 0x140011e9b
mov r9d, 0x10
lea r8, str.Loader
lea rdx, str.You_forgot_to_set_the_AppId.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
nop
xor eax, eax
jmp 0x1400125b8
lea rax, [rbp + 0x2d40]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
xor edx, edx
lea rcx, [rbp + 0x240]
call fcn.1400113f7
movzx eax, al
test eax, eax
jne 0x140011f0a
lea rdx, [rbp + 0x240]
lea rcx, [rbp + 0x2d40]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
nop
mov r8d, 0x208
xor edx, edx
lea rcx, [rbp + 0x240]
call fcn.14001130c
nop
xor r9d, r9d
lea r8, [rbp + 0x240]
mov edx, 0x104
lea rcx, [rbp + 0x2d40]
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
nop
xor edx, edx
lea rcx, [rbp + 0x470]
call fcn.1400113f7
movzx eax, al
test eax, eax
jne 0x140011f66
lea rdx, [rbp + 0x470]
lea rcx, [rbp + 0x2d40]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
nop
mov r8d, 0x208
xor edx, edx
lea rcx, [rbp + 0x470]
call fcn.14001130c
nop
xor r9d, r9d
lea r8, [rbp + 0x470]
mov edx, 0x104
lea rcx, [rbp + 0x2d40]
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
nop
xor edx, edx
lea rcx, [rbp + 0x6a0]
call fcn.1400113f7
movzx eax, al
test eax, eax
jne 0x140011fc2
lea rdx, [rbp + 0x6a0]
lea rcx, [rbp + 0x2d40]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
nop
mov r8d, 0x208
xor edx, edx
lea rcx, [rbp + 0x6a0]
call fcn.14001130c
nop
xor r9d, r9d
lea r8, [rbp + 0x6a0]
mov edx, 0x104
lea rcx, [rbp + 0x2d40]
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
nop
xor edx, edx
lea rcx, [rbp + 0x8d0]
call fcn.1400113f7
movzx eax, al
test eax, eax
jne 0x14001201e
lea rdx, [rbp + 0x8d0]
lea rcx, [rbp + 0x2d40]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
nop
mov r8d, 0x208
xor edx, edx
lea rcx, [rbp + 0x8d0]
call fcn.14001130c
nop
xor r9d, r9d
lea r8, [rbp + 0x8d0]
mov edx, 0x104
lea rcx, [rbp + 0x2d40]
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
nop
lea rcx, [rbp + 0x240]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140012054
mov r9d, 0x10
lea r8, str.Loader
lea rdx, str.Couldnt_find_the_requested_SteamClient64Dll.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
nop
xor eax, eax
jmp 0x1400125b8
lea rcx, [rbp + 0x470]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14001208a
mov r9d, 0x10
lea r8, str.Loader
lea rdx, str.Couldnt_find_the_requested_SteamClientDll.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
nop
xor eax, eax
jmp 0x1400125b8
lea rcx, [rbp + 0x6a0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400120c0
mov r9d, 0x10
lea r8, str.Loader
lea rdx, str.Couldnt_find_the_requested_Exe_file.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
nop
xor eax, eax
jmp 0x1400125b8
lea rax, [rbp + 0xb00]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x6a0]
lea r8, str.__ls___ls
mov edx, 0x2000
lea rcx, [rbp + 0x2f70]
call fcn.1400113b6
nop
mov eax, 2
imul rax, rax, 0
movzx eax, word [rbp + rax + 0x6a0]
test eax, eax
je 0x14001215c
lea rax, [rbp + 0x2cc8]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x2c40]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x8d0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x2f70]
lea rcx, [rbp + 0x6a0]
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x140012180
mov r9d, 0x10
lea r8, str.Loader
lea rdx, str.Unable_to_load_the_requested_EXE_file.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
nop
xor eax, eax
jmp 0x1400125b8
mov dword [rbp + 0x6fa4], 0x771f810d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rbp + 0x6fc4], eax
mov byte [rbp + 0x6fe4], 0
mov dword [rbp + 0x7004], 1
lea rax, [rbp + 0x7030]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rax, [rbp + 0x7260]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov dword [rbp + 0x7484], 0x104
mov dword [rbp + 0x74a4], 0x104
lea rax, [rbp + 0x6f88]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SoftwareValveSteamActiveProcess
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140012288
mov byte [rbp + 0x6fe4], 1
lea rax, [rbp + 0x7484]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x7030]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x7004]
xor r8d, r8d
lea rdx, str.SteamClientDll
mov rcx, qword [rbp + 0x6f88]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop
lea rax, [rbp + 0x74a4]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x7260]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x7004]
xor r8d, r8d
lea rdx, str.SteamClientDll64
mov rcx, qword [rbp + 0x6f88]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop
jmp 0x140012308
mov qword [rsp + 0x40], 0
lea rax, [rbp + 0x6f88]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareValveSteamActiveProcess
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x140012308
mov r9d, 0x10
lea r8, str.Loader
lea rdx, str.Unable_to_patch_Steam_process_informations_on_the_Windows_registry.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
nop
xor edx, edx
mov rcx, qword [rbp + 0x2cc8]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
xor eax, eax
jmp 0x1400125b8
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x6fa4]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.ActiveUser
mov rcx, qword [rbp + 0x6f88]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
nop
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x6fc4]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, [0x14001c688]
mov rcx, qword [rbp + 0x6f88]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
nop
lea rcx, [rbp + 0x470]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400123c2
lea rcx, [rbp + 0x470]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cdqe
shl rax, 1
inc eax
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x470]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.SteamClientDll
mov rcx, qword [rbp + 0x6f88]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
jmp 0x1400123f4
mov dword [rsp + 0x28], 0
lea rax, [0x14001c68c]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.SteamClientDll
mov rcx, qword [rbp + 0x6f88]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
lea rcx, [rbp + 0x240]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14001244a
lea rcx, [rbp + 0x240]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cdqe
shl rax, 1
inc eax
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x240]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.SteamClientDll64
mov rcx, qword [rbp + 0x6f88]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
jmp 0x14001247c
mov dword [rsp + 0x28], 0
lea rax, [0x14001c68c]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.SteamClientDll64
mov rcx, qword [rbp + 0x6f88]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
lea rcx, str.Public
call qword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
mov dword [rsp + 0x28], eax
lea rax, str.Public
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.Universe
mov rcx, qword [rbp + 0x6f88]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
nop
mov rcx, qword [rbp + 0x6f88]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rcx, qword [rbp + 0x2cd0]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
nop
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x2cd0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
mov rcx, qword [rbp + 0x2cc8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, qword [rbp + 0x2cd0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
movzx eax, byte [rbp + 0x6fe4]
test eax, eax
je 0x1400125b6
lea rax, [rbp + 0x6f88]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SoftwareValveSteamActiveProcess
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400125b6
mov eax, dword [rbp + 0x7484]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x7030]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.SteamClientDll
mov rcx, qword [rbp + 0x6f88]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
mov eax, dword [rbp + 0x74a4]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x7260]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.SteamClientDll64
mov rcx, qword [rbp + 0x6f88]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
mov rcx, qword [rbp + 0x6f88]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x50]
lea rdx, [0x14001c160]
call fcn.14001135c
mov rax, rdi
mov rcx, qword [rbp + 0x7ab8]
xor rcx, rbp
call fcn.1400111ea
lea rsp, [rbp + 0x7ac8]
pop rdi
pop rbp
ret