Function at 0x10002fa1
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x24], 0
push 0
push 0
push 0
push SysStringLen
push 0
push 0x1004026d
push 0x80000301
push 0
push 3
push 3
mov ebx, 0x698
call fcn.1001e8c0
add esp, 0x28
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x10003030
push ebx
call fcn.1001d96c
add esp, 4
pop eax
mov dword [ebp - 4], eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
mov ebx, 6
call fcn.10002efc
push SysStringLen
push 0
push 0x10040209
push SysStringLen
push 0
push 0x1004028c
push SysStringLen
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x10003075
mov eax, 0x1004020b
push eax
push 6
mov ebx, 0x180
call fcn.1001ea20
add esp, 0x4c
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x1000309f
push ebx
call fcn.1001d96c
add esp, 4
pop eax
mov dword [ebp - 4], eax
push 0
mov ebx, 0x104
call fcn.1001ebf0
add esp, 4
mov dword [ebp - 0x28], eax
push str.cbtff.dll
push dword [ebp - 0x28]
mov ecx, 2
call fcn.10001128
add esp, 8
mov dword [ebp - 0x2c], eax
mov ebx, dword [ebp - 0x28]
test ebx, ebx
je 0x100030e0
push ebx
call fcn.1001d96c
add esp, 4
mov eax, dword [ebp - 0x2c]
push eax
mov ebx, dword [0x10042ada]
test ebx, ebx
je 0x100030f7
push ebx
call fcn.1001d96c
add esp, 4
pop eax
mov dword [0x10042ada], eax
push 0x1004020b
push dword [ebp - 4]
call fcn.10002f04
add esp, 8
cmp eax, 0
jne 0x100031f1
push 0
push 0
push 0
push SysStringLen
push 0
push str.SoftwareClasses_steamShellOpenCommand_
push 0x80000301
push 0
push 4
push 3
mov ebx, 0x698
call fcn.1001e8c0
add esp, 0x28
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], 0
push 0
push dword [ebp - 0x2c]
mov dword [ebp - 0x30], 0
push 0
push dword [ebp - 0x30]
mov eax, 0x100402c4
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x34]
push eax
mov eax, 0x100402c4
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.100039d2
mov dword [ebp - 0x3c], eax
mov ebx, dword [ebp - 0x28]
test ebx, ebx
je 0x10003195
push ebx
call fcn.1001d96c
add esp, 4
mov ebx, dword [ebp - 0x38]
test ebx, ebx
je 0x100031a5
push ebx
call fcn.1001d96c
add esp, 4
mov ebx, dword [ebp - 0x34]
test ebx, ebx
je 0x100031b5
push ebx
call fcn.1001d96c
add esp, 4
mov eax, dword [ebp - 0x3c]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x100031c9
push ebx
call fcn.1001d96c
add esp, 4
pop eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
call fcn.10003c70
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x100031ed
push ebx
call fcn.1001d96c
add esp, 4
pop eax
mov dword [ebp - 4], eax
push str.package_beta
push dword [ebp - 4]
mov ecx, 2
call fcn.10001128
add esp, 8
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
call fcn.100042e7
mov dword [ebp - 0x2c], eax
mov ebx, dword [ebp - 0x28]
test ebx, ebx
je 0x10003225
push ebx
call fcn.1001d96c
add esp, 4
cmp dword [ebp - 0x2c], 0
je 0x100032d3
push str.package_beta
push dword [ebp - 4]
mov ecx, 2
call fcn.10001128
add esp, 8
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
call fcn.10004744
mov ebx, dword [ebp - 0x28]
test ebx, ebx
je 0x10003260
push ebx
call fcn.1001d96c
add esp, 4
push str._aom.dll
push dword [ebp - 4]
mov ecx, 2
call fcn.10001128
add esp, 8
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
call fcn.10004744
mov ebx, dword [ebp - 0x28]
test ebx, ebx
je 0x10003291
push ebx
call fcn.1001d96c
add esp, 4
push str._avif_16.dll
push dword [ebp - 4]
mov ecx, 2
call fcn.10001128
add esp, 8
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
call fcn.10004744
mov ebx, dword [ebp - 0x28]
test ebx, ebx
je 0x100032c2
push ebx
call fcn.1001d96c
add esp, 4
mov dword [ebp - 0x28], 0
push 0
push dword [ebp - 0x28]
call fcn.10004786
push str._steamui_sounds_steam_ui86.wav
push dword [ebp - 4]
mov ecx, 2
call fcn.10001128
add esp, 8
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
push eax
mov ebx, dword [0x10042ade]
test ebx, ebx
je 0x10003302
push ebx
call fcn.1001d96c
add esp, 4
pop eax
mov dword [0x10042ade], eax
mov eax, 0x10040209
push eax
mov ebx, dword [0x10042ae2]
test ebx, ebx
je 0x10003321
push ebx
call fcn.1001d96c
add esp, 4
pop eax
mov dword [0x10042ae2], eax
push 0
push 0
push 0
push SysStringLen
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_FoldersLocal_AppData
push 0x80000301
push 0
push 3
push 3
mov ebx, 0x698
call fcn.1001e8c0
add esp, 0x28
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x1000336e
push ebx
call fcn.1001d96c
add esp, 4
pop eax
mov dword [ebp - 8], eax
push 0x10040358
push dword [0x10042ae2]
push str.Tencent
push dword [0x10042ae2]
push str.Microsoft
push dword [0x10042ae2]
push dword [ebp - 8]
mov ecx, 7
call fcn.10001128
add esp, 0x1c
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
push eax
mov ebx, dword [0x10042ae6]
test ebx, ebx
je 0x100033bd
push ebx
call fcn.1001d96c
add esp, 4
pop eax
mov dword [0x10042ae6], eax
push 0x10042ade
call fcn.100042e7
test eax, eax
je 0x100033f3
push 0x10042ae6
call fcn.100042e7
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x100033f3
mov eax, 1
jmp 0x100033f8
mov eax, 0
test eax, eax
je 0x1000341b
mov dword [ebp - 0x28], 0
push 0
push dword [ebp - 0x28]
push 0x10042ae6
push 0x10042ade
call fcn.10004893
push 0x10042ade
call fcn.100042e7
test eax, eax
je 0x10003446
push 0x10042ada
call fcn.100042e7
test eax, eax
je 0x10003446
mov eax, 1
jmp 0x1000344b
mov eax, 0
test eax, eax
je 0x100036dc
mov dword [ebp - 0x28], 0
push 0
lea eax, [ebp - 0x28]
push eax
push 1
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0x2c], 0
push 0
lea eax, [ebp - 0x2c]
push eax
push 0x10042ae6
call fcn.100048dd
mov ebx, dword [ebp - 0x2c]
test ebx, ebx
je 0x1000348d
push ebx
call fcn.1001d96c
add esp, 4
mov ebx, dword [ebp - 0x28]
test ebx, ebx
je 0x1000349d
push ebx
call fcn.1001d96c
add esp, 4
mov dword [ebp - 0x28], 0
push 0
lea eax, [ebp - 0x28]
push eax
push 1
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x2c], 0
push 0
lea eax, [ebp - 0x2c]
push eax
push 0x10042ade
call fcn.100048dd
mov ebx, dword [ebp - 0x2c]
test ebx, ebx
je 0x100034d7
push ebx
call fcn.1001d96c
add esp, 4
mov ebx, dword [ebp - 0x28]
test ebx, ebx
je 0x100034e7
push ebx
call fcn.1001d96c
add esp, 4
push 0
push 0
push 0
push 0x80000301
push 0
push 1
push SysStringLen
push 0
mov eax, dword [0x10042ada]
test eax, eax
jne 0x1000350e
mov eax, 0x1004020b
push eax
push 3
mov ebx, 0x270
call fcn.1001ec90
add esp, 0x28
mov dword [ebp - 0x14], eax
push 0
push 0
push 0
push 0x80000301
push 0
push dword [ebp - 0x14]
push 2
mov ebx, 0x29c
call fcn.1001f040
add esp, 0x1c
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
push eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x1000355d
push ebx
call fcn.1001d96c
add esp, 4
pop eax
mov dword [ebp - 0x18], eax
push SysStringLen
push 0
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x10003574
mov eax, 0x1004020b
push eax
push 1
mov ebx, 0x160
call fcn.1001fa70
add esp, 0x10
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
push SysStringLen
push 0
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x100035a0
mov eax, 0x1004020b
push eax
push 1
mov ebx, 0x160
call fcn.1001fa70
add esp, 0x10
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], edx
push SysStringLen
push 0
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x100035cc
mov eax, 0x1004020b
push eax
push 1
mov ebx, 0x160
call fcn.1001fa70
add esp, 0x10
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], edx
push 0x80000301
push 0
push 7
push SysStringLen
push dword [ebp - 0x30]
push dword [ebp - 0x34]
push SysStringLen
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push 3
mov ebx, 0x1e0
call fcn.1001faf0
add esp, 0x28
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], edx
fld qword [ebp - 0x44]
fsub qword [0x1004036e]
fcomp qword [0x10040376]
fnstsw ax
test ah, 0x41
jne 0x100036b4
push SysStringLen
push 0
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x1000364c
mov eax, 0x1004020b
push eax
push 1
mov ebx, 0x160
call fcn.1001fa70
add esp, 0x10
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], edx
push 0x80000301
push 0
push 7
push SysStringLen
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
push SysStringLen
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push 3
mov ebx, 0x1e0
call fcn.1001faf0
add esp, 0x28
push edx
push eax
call fcn.10005ae1
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 2
jle 0x100036b4
mov eax, 1
jmp 0x100036b9
mov eax, 0
test eax, eax
je 0x100036dc
mov dword [ebp - 0x28], 0
push 0
push dword [ebp - 0x28]
push 0x10042ae6
push 0x10042ade
call fcn.10004893
mov dword [ebp - 0x28], esp
push 0x1004037e
xor eax, eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
nop
nop
cmp dword [ebp - 0x28], esp
je 0x1000370a
push 0x853
push 0x4010001
push 6
call fcn.1001d972
add esp, 0xc
mov dword [ebp - 0x28], esp
push 2
push 0x6f
xor eax, eax
call dword [0x10042b0a]
add esp, 8
nop
nop
cmp dword [ebp - 0x28], esp
je 0x10003740
push 0x877
push 0x4010001
push 6
call fcn.1001d972
add esp, 0xc
mov dword [ebp - 0x28], esp
push str.hid_jie.dll
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
nop
nop
cmp dword [ebp - 0x28], esp
je 0x1000376e
push 0x8b5
push 0x4010001
push 6
call fcn.1001d972
add esp, 0xc
mov dword [ebp - 0x24], eax
fild dword [ebp - 0x24]
fstp qword [ebp - 0x2c]
fld qword [ebp - 0x2c]
fadd qword [0x10040396]
fstp qword [ebp - 0x34]
mov dword [ebp - 0x38], 0
push 0
lea eax, [ebp - 0x38]
push eax
push 1
push 0
push 2
push 6
push 0x10005cc7
fld qword [ebp - 0x34]
call fcn.100018c1
push eax
push 0x10042aea
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 8]
mov ebx, dword [ebp - 0x38]
test ebx, ebx
je 0x100037ce
push ebx
call fcn.1001d96c
add esp, 4
push 0x1000a43e
mov eax, 0x1004039e
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
mov eax, 0x1004037e
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x2c]
push eax
push 0x10042aee
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0xc]
mov dword [ebp - 0x30], eax
mov ebx, dword [ebp - 0x2c]
test ebx, ebx
je 0x1000380d
push ebx
call fcn.1001d96c
add esp, 4
mov ebx, dword [ebp - 0x28]
test ebx, ebx
je 0x1000381d
push ebx
call fcn.1001d96c
add esp, 4
cmp dword [ebp - 0x30], 0
je 0x1000396d
push 0x100119cf
mov eax, str.RegOpenKeyExA
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
mov eax, str.kernelBase.dll
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x2c]
push eax
push 0x10042af2
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0xc]
mov dword [ebp - 0x30], eax
mov ebx, dword [ebp - 0x2c]
test ebx, ebx
je 0x10003866
push ebx
call fcn.1001d96c
add esp, 4
mov ebx, dword [ebp - 0x28]
test ebx, ebx
je 0x10003876
push ebx
call fcn.1001d96c
add esp, 4
cmp dword [ebp - 0x30], 0
je 0x1000396d
push str.ohid
push dword [0x10042ae2]
push str.steamactive
push dword [0x10042ae2]
push dword [ebp - 8]
mov ecx, 5
call fcn.10001128
add esp, 0x14
mov dword [ebp - 0x28], eax
push SysStringLen
push 0
mov eax, dword [ebp - 0x28]
test eax, eax
jne 0x100038bc
mov eax, 0x1004020b
push eax
push 1
mov ebx, 0x234
call fcn.1001fde0
add esp, 0x10
mov ebx, dword [ebp - 0x28]
test ebx, ebx
je 0x100038df
push ebx
call fcn.1001d96c
add esp, 4
push str.ohid
push dword [0x10042ae2]
push str.steamactive
push dword [0x10042ae2]
push dword [ebp - 8]
mov ecx, 5
call fcn.10001128
add esp, 0x14
mov dword [ebp - 0x28], eax
push 0x80000301
push 0
push 7
push SysStringLen
push 0
mov eax, dword [ebp - 0x28]
test eax, eax
jne 0x10003927
mov eax, 0x1004020b
push eax
push 2
mov ebx, 0x260
call fcn.1001fe10
add esp, 0x1c
mov ebx, dword [ebp - 0x28]
test ebx, ebx
je 0x1000394a
push ebx
call fcn.1001d96c
add esp, 4
mov dword [ebp - 0x28], 0
push 0
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x2c], 0
push 0
push dword [ebp - 0x2c]
push 0x10011a42
call fcn.10005b55
call fcn.10005bee
mov eax, 0
jmp 0x1000397c
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x1000398d
push ebx
call fcn.1001d96c
add esp, 4
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x1000399d
push ebx
call fcn.1001d96c
add esp, 4
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x100039ad
push ebx
call fcn.1001d96c
add esp, 4
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x100039bd
push ebx
call fcn.1001d96c
add esp, 4
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x100039cd
push ebx
call fcn.1001d96c
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret