Function at 0x1400187a0
Capabilities:
Accept command line arguments
Block operations on executable memory pages using arbitrary code guard
Create process on windows
Delete file
Enumerate device drivers on windows
Get common file path
Link many functions at runtime
Move file
Set console window title

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x970]
sub rsp, 0xa70
mov rax, qword [0x14006b680]
xor rax, rsp
mov qword [rbp + 0x960], rax
xor edx, edx
mov r8d, 0x1000000
lea rcx, [0x14006d8a8]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSectionEx]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [0x14006d464], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [0x14006d468], rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdi, rax
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [0x14006ca40], rax
lea rdx, str.RtlGetNtVersionNumbers
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14006c8d0], rax
lea rdx, str.NtQuerySystemInformation
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14006c8d8], rax
lea rdx, str.NtQueryInformationProcess
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14006c8c8], rax
lea rdx, str.RtlImageNtHeader
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14006c8c0], rax
lea rdx, str.SetThreadInformation
mov rcx, qword [0x14006ca40]
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14006c860], rax
movabs r10, 0xeccc8eb85e5fa170
lea r8, [0x14006d460]
lea rdx, [0x14006d45c]
lea rcx, [0x14006d458]
mov rax, qword [0x14006c8d0]
call qword [0x14004a4d0]
mov eax, dword [0x14006d460]
and eax, 0x7fff
mov dword [0x14006d460], eax
cmp dword [0x14006d458], 0xa
jne 0x140018906
cmp eax, 0x4a64
jae 0x140018906
lea rcx, str.Update_Windows_10_to_November_2021_Update_or_above__r_n
jmp 0x14001d75d
mov dword ds:[rbp + 0x48], 1
mov r8d, 4
lea rdx, [rbp + 0x48]
mov ecx, 6
call qword [sym.imp.KERNEL32.dll_SetProcessMitigationPolicy]
mov dword ds:[rbp + 0x30], 3
mov r8d, 4
lea rdx, [rbp + 0x30]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_SetProcessMitigationPolicy]
mov dword ds:[rbp + 0x4c], 0xb
mov r8d, 4
lea rdx, [rbp + 0x4c]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_SetProcessMitigationPolicy]
mov dword ds:[rbp + 0x3c], 3
mov r8d, 4
lea rdx, [rbp + 0x3c]
mov ecx, 3
call qword [sym.imp.KERNEL32.dll_SetProcessMitigationPolicy]
mov dword ds:[rbp + 0x38], 1
mov r8d, 4
lea rdx, [rbp + 0x38]
mov ecx, 9
call qword [sym.imp.KERNEL32.dll_SetProcessMitigationPolicy]
mov dword ds:[rbp + 0x34], 0xf
mov r8d, 4
lea rdx, [rbp + 0x34]
mov ecx, 0xe
call qword [sym.imp.KERNEL32.dll_SetProcessMitigationPolicy]
cmp dword [0x14006d460], 0x55f0
jb 0x1400189ee
mov dword [rbp + 0xc], 1
mov r8d, 4
lea rdx, [rbp + 0xc]
mov ecx, 0x10
call qword [sym.imp.KERNEL32.dll_SetProcessMitigationPolicy]
xor r13d, r13d
mov dword [rbp + 0x10], r13d
mov r9d, 4
lea r8, [rbp + 0x10]
mov edx, 1
mov rcx, qword [0x14006d468]
call qword [sym.imp.KERNEL32.dll_GetProcessMitigationPolicy]
mov eax, dword [rbp + 0x10]
test al, 8
jne 0x140018a25
lea rcx, str.ASLR_policy_is_not_allowed___1__r_n
nop
jmp 0x14001d75d
test al, 1
jne 0x140018a35
lea rcx, str.ASLR_policy_is_not_allowed___2__r_n
jmp 0x14001d75d
test al, 2
jne 0x140018a45
lea rcx, str.ASLR_policy_is_not_allowed___3__r_n
jmp 0x14001d75d
test al, 4
jne 0x140018a55
lea rcx, str.ASLR_policy_is_not_allowed___4__r_n
jmp 0x14001d75d
mov dword [rbp + 0x14], r13d
mov r9d, 4
lea r8, [rbp + 0x14]
mov edx, 3
mov rcx, qword [0x14006d468]
call qword [sym.imp.KERNEL32.dll_GetProcessMitigationPolicy]
mov eax, dword [rbp + 0x14]
test al, 2
jne 0x140018a88
lea rcx, str.Handle_check_policy_is_not_allowed___1__r_n
jmp 0x14001d75d
test al, 1
jne 0x140018a98
lea rcx, str.Handle_check_policy_is_not_allowed___2__r_n
jmp 0x14001d75d
mov dword [rbp + 0x18], r13d
mov r9d, 4
lea r8, [rbp + 0x18]
mov edx, 6
mov rcx, qword [0x14006d468]
call qword [sym.imp.KERNEL32.dll_GetProcessMitigationPolicy]
test byte [rbp + 0x18], 1
jne 0x140018aca
lea rcx, str.Extension_point_policy_is_not_allowed__r_n
jmp 0x14001d75d
mov dword [rbp + 0x1c], r13d
mov r9d, 4
lea r8, [rbp + 0x1c]
mov edx, 7
mov rcx, qword [0x14006d468]
call qword [sym.imp.KERNEL32.dll_GetProcessMitigationPolicy]
test byte [rbp + 0x1c], 1
jne 0x140018afc
lea rcx, str.CFG_policy_is_not_allowed__r_n
jmp 0x14001d75d
mov dword [rbp + 0x20], r13d
mov r9d, 4
lea r8, [rbp + 0x20]
mov edx, 9
mov rcx, qword [0x14006d468]
call qword [sym.imp.KERNEL32.dll_GetProcessMitigationPolicy]
test byte [rbp + 0x20], 1
jne 0x140018b2e
lea rcx, str.Font_policy_is_not_allowed__r_n
jmp 0x14001d75d
mov dword [rbp + 0x24], r13d
mov r9d, 4
lea r8, [rbp + 0x24]
mov edx, 0xa
mov rcx, qword [0x14006d468]
call qword [sym.imp.KERNEL32.dll_GetProcessMitigationPolicy]
mov eax, dword [rbp + 0x24]
test al, 2
jne 0x140018b65
lea rcx, str.Process_image_policy_is_not_allowed___1__r_n
nop dword [rax]
jmp 0x14001d75d
test al, 1
jne 0x140018b75
lea rcx, str.Process_image_policy_is_not_allowed___2__r_n
jmp 0x14001d75d
cmp dword [0x14006d460], 0x55f0
nop
jb 0x140018bb8
mov dword ds:[rbp + 8], r13d
mov r9d, 4
lea r8, [rbp + 8]
mov edx, 0x10
mov rcx, qword [0x14006d468]
call qword [sym.imp.KERNEL32.dll_GetProcessMitigationPolicy]
test byte [rbp + 8], 1
jne 0x140018bb8
lea rcx, str.Redirection_trust_policy_is_not_allowed__r_n
jmp 0x14001d75d
mov ecx, 0x4000
call qword [sym.imp.KERNEL32.dll_SetDefaultDllDirectories]
test eax, eax
jne 0x140018bd6
lea rcx, str.Failed_to_set_default_dll_directories__r_n
jmp 0x14001d75d
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
or eax, 1
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
lea rdx, [0x140058f00]
mov ecx, 0x1020
call fcn.14001e91c
mov qword [rbp - 0x20], rax
test rax, rax
je 0x140018c1b
mov rcx, rax
call fcn.1400019f0
mov rdi, rax
jmp 0x140018c1e
mov rdi, r13
nop
test rdi, rdi
jne 0x140018c31
lea rcx, str.Failed_to_allocate_memory_for_commandline_class__r_n
jmp 0x14001d75d
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rdx, rax
mov rcx, rdi
call fcn.140001ca0
lea rdx, str._SubscriptionPatch
mov rcx, rdi
call fcn.140001f00
mov r8d, 4
lea rdx, [rbp + 0xc]
mov ecx, 2
test eax, eax
je 0x14001980b
mov dword [rbp + 0xc], 3
call qword [sym.imp.KERNEL32.dll_SetProcessMitigationPolicy]
mov dword [rbp + 8], r13d
mov r9d, 4
lea r8, [rbp + 8]
mov edx, 2
mov rcx, qword [0x14006d468]
call qword [sym.imp.KERNEL32.dll_GetProcessMitigationPolicy]
mov eax, dword [rbp + 8]
test al, 1
jne 0x140018cc5
mov rcx, rdi
call fcn.140001a40
mov edx, 0x1020
mov rcx, rdi
call fcn.14001e3b8
lea rcx, str.Dynamic_code_policy_is_not_allowed___4__r_n
nop dword [rax + rax]
jmp 0x14001d75d
test al, 2
jne 0x140018cea
mov rcx, rdi
call fcn.140001a40
mov edx, 0x1020
mov rcx, rdi
call fcn.14001e3b8
lea rcx, str.Dynamic_code_policy_is_not_allowed___5__r_n
jmp 0x14001d75d
test al, 4
je 0x140018d11
mov rcx, rdi
call fcn.140001a40
mov edx, 0x1020
mov rcx, rdi
call fcn.14001e3b8
lea rcx, str.Dynamic_code_policy_is_not_allowed___6__r_n
jmp 0x14001d75d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x14006c868], rax
test rax, rax
jne 0x140018d53
mov rcx, rdi
call fcn.140001a40
mov edx, 0x1020
mov rcx, rdi
call fcn.14001e3b8
lea rcx, str.Failed_to_create_patch_event__1___r_n
jmp 0x14001d75d
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r13d
xor r9d, r9d
lea r8, [0x140016060]
xor edx, edx
xor ecx, ecx
call fcn.14002fe28
test rax, rax
jne 0x140018d96
mov rcx, rdi
call fcn.140001a40
mov edx, 0x1020
mov rcx, rdi
call fcn.14001e3b8
lea rcx, str.Failed_to_create_patch_thread__1___r_n
jmp 0x14001d75d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str._Minimized
mov rcx, rdi
call fcn.140001f00
mov dword ds:[rbp + 0xc], eax
lea rdx, str._SavedLogin
mov rcx, rdi
call fcn.140001f00
test eax, eax
je 0x140018dd3
mov dword [0x14006d340], 1
lea rdx, str._NoMasterPassword
mov rcx, rdi
call fcn.140001f00
test eax, eax
je 0x140018df0
mov byte [0x14006c85e], 1
lea rdx, str._SkipUpdateMessages
mov rcx, rdi
call fcn.140001f00
nop
test eax, eax
je 0x140018e0b
mov byte [0x14006c85f], 1
lea rdx, str._no_browser
mov rcx, rdi
call fcn.140001f00
test eax, eax
je 0x140018e25
mov byte [0x14006ca82], 1
lea rdx, str._no_service
mov rcx, rdi
call fcn.140001f00
test eax, eax
je 0x140018e3f
mov byte [0x14006ca83], 1
xor r8d, r8d
lea rdx, str._applaunch
mov rcx, rdi
call fcn.1400020a0
mov dword [0x14006d344], eax
test eax, eax
je 0x140018f82
xor r8d, r8d
lea rdx, str._applaunchOption
mov rcx, rdi
call fcn.1400020a0
mov dword [0x14006d348], eax
xor r8d, r8d
lea rdx, str._LaunchParameters
mov rcx, rdi
call fcn.1400021c0
mov rbx, rax
test rax, rax
je 0x140018f82
mov rcx, 0xffffffffffffffff
nop dword [rax]
inc rcx
cmp word [rax + rcx*2], 0
jne 0x140018ea0
cmp rcx, 1
jbe 0x140018f82
lfence
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x330]
call fcn.140047d20
mov qword [rsp + 0x20], rbx
lea r9, [0x14004ab58]
mov edx, 0x104
mov r8, 0xffffffffffffffff
lea rcx, [rbp + 0x330]
call fcn.1400022c0
cmp eax, 0xfffffffe
jle 0x140018f0b
dec eax
cmp eax, 0x102
ja 0x140018f82
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
mov r9d, 0xffffffff
lea r8, [rbp + 0x330]
mov edx, 0x80
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
nop dword [rax]
test eax, eax
je 0x140018f82
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], eax
lea rax, [0x14006d350]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
lea r8, [rbp + 0x330]
mov edx, 0x80
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov byte [0x14006ca86], 1
lea rdx, str._DisableSteamCloud
mov rcx, rdi
call fcn.140001f00
test eax, eax
je 0x140018f9c
mov byte [0x14006ca84], 1
lea rdx, str._AutoExit
mov rcx, rdi
call fcn.140001f00
test eax, eax
je 0x140018fb6
mov byte [0x14006ca85], 1
mov rcx, rdi
call fcn.140001a40
mov edx, 0x1020
mov rcx, rdi
call fcn.14001e3b8
mov qword [rbp + 0x110], r13
mov qword [rbp - 0x78], r13
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r13
lea rax, [rbp - 0x78]
mov qword [rsp + 0x30], rax
lea rax, [0x14006c9c8]
mov qword [rsp + 0x28], rax
mov byte [rsp + 0x20], 1
mov r9b, 1
movzx r8d, r9b
lea rdx, str.CertGetNameStringW
lea rcx, str.Crypt32.dll
call fcn.1400086a0
movzx edi, al
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
lea rax, [0x14006c9b8]
mov qword [rsp + 0x28], rax
mov byte [rsp + 0x20], 1
mov r9b, 1
movzx r8d, r9b
lea rdx, str.WinVerifyTrust
lea rcx, str.Wintrust.dll
call fcn.1400086a0
movzx ebx, al
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
mov byte [rsp + 0x20], 1
mov r9b, 1
movzx r8d, r9b
xor edx, edx
lea rcx, str.bcryptprimitives.dll
call fcn.1400086a0
movzx esi, al
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
lea rax, [0x14006c9a8]
mov qword [rsp + 0x28], rax
mov byte [rsp + 0x20], 1
mov r9b, 1
movzx r8d, r9b
lea rdx, str.BCryptGenRandom
lea rcx, str.Bcrypt.dll
call fcn.1400086a0
movzx r14d, al
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r13
lea rax, [rbp + 0x110]
mov qword [rsp + 0x30], rax
lea rax, [0x14006ca18]
mov qword [rsp + 0x28], rax
mov byte [rsp + 0x20], 1
mov r9b, 1
movzx r8d, r9b
lea rdx, str.ImageGetCertificateData
lea rcx, str.Imagehlp.dll
call fcn.1400086a0
test dil, dil
je 0x14001d756
test bl, bl
je 0x14001d756
nop dword [rax + rax]
test sil, sil
je 0x14001d756
test r14b, r14b
je 0x14001d756
test al, al
je 0x14001d756
mov rax, qword [0x14006c9c8]
mov qword [0x14006c9c0], rax
mov rax, qword [0x14006c9b8]
mov qword [0x14006c9b0], rax
mov rax, qword [0x14006c9a8]
mov qword [0x14006c9a0], rax
mov rax, qword [0x14006ca18]
mov qword [0x14006ca10], rax
mov qword [rsp + 0x40], r13
mov rdi, qword [rbp + 0x110]
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], r13
lea rax, [0x14006ca28]
mov qword [rsp + 0x28], rax
mov byte [rsp + 0x20], 1
mov r9b, 1
movzx r8d, r9b
lea rdx, str.ImageEnumerateCertificates
lea rcx, str.Imagehlp.dll
call fcn.1400086a0
movzx ebx, al
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], r13
lea rax, [0x14006ca38]
mov qword [rsp + 0x28], rax
mov byte [rsp + 0x20], 1
mov r9b, 1
movzx r8d, r9b
lea rdx, str.ImageGetCertificateHeader
lea rcx, str.Imagehlp.dll
call fcn.1400086a0
movzx esi, al
mov qword [rsp + 0x40], r13
mov rdi, qword [rbp - 0x78]
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], r13
lea rax, [0x14006c9d8]
mov qword [rsp + 0x28], rax
mov byte [rsp + 0x20], 1
mov r9b, 1
movzx r8d, r9b
lea rdx, str.CryptVerifyMessageSignature
lea rcx, str.Crypt32.dll
call fcn.1400086a0
movzx r14d, al
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], r13
lea rax, [0x14006c9e8]
mov qword [rsp + 0x28], rax
mov byte [rsp + 0x20], 1
mov r9b, 1
movzx r8d, r9b
lea rdx, str.CertFreeCertificateContext
lea rcx, str.Crypt32.dll
call fcn.1400086a0
movzx r15d, al
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], r13
lea rax, [0x14006c9f8]
mov qword [rsp + 0x28], rax
mov byte [rsp + 0x20], 1
mov r9b, 1
movzx r8d, r9b
lea rdx, str.CryptProtectData
lea rcx, str.Crypt32.dll
call fcn.1400086a0
movzx r12d, al
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], r13
lea rax, [0x14006ca08]
mov qword [rsp + 0x28], rax
mov byte [rsp + 0x20], 1
mov r9b, 1
movzx r8d, r9b
lea rdx, str.CryptUnprotectData
lea rcx, str.Crypt32.dll
call fcn.1400086a0
test bl, bl
je 0x14001d74a
test sil, sil
je 0x14001d74a
nop dword [rax]
test r14b, r14b
je 0x14001d74a
test r15b, r15b
je 0x14001d74a
test r12b, r12b
je 0x14001d74a
nop dword [rax + rax]
test al, al
je 0x14001d74a
mov rax, qword [0x14006ca28]
mov qword [0x14006ca20], rax
mov rax, qword [0x14006ca38]
mov qword [0x14006ca30], rax
mov rax, qword [0x14006c9d8]
mov qword [0x14006c9d0], rax
mov rax, qword [0x14006c9e8]
mov qword [0x14006c9e0], rax
mov rax, qword [0x14006c9f8]
mov qword [0x14006c9f0], rax
mov rax, qword [0x14006ca08]
mov qword [0x14006ca00], rax
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r13
lea rax, [0x14006ca58]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r13
mov byte [rsp + 0x20], 1
mov r9b, 1
movzx r8d, r9b
xor edx, edx
lea rcx, str.Advapi32.dll
call fcn.1400086a0
movzx edi, al
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
mov byte [rsp + 0x20], 1
mov r9b, 1
movzx r8d, r9b
xor edx, edx
lea rcx, str.GDI32.dll
call fcn.1400086a0
movzx ebx, al
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r13
lea rax, [0x14006ca60]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r13
mov byte [rsp + 0x20], 1
mov r9b, 1
movzx r8d, r9b
xor edx, edx
lea rcx, str.User32.dll
call fcn.1400086a0
movzx esi, al
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
mov byte [rsp + 0x20], 1
mov r9b, 1
movzx r8d, r9b
xor edx, edx
lea rcx, str.Shell32.dll
call fcn.1400086a0
movzx r14d, al
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
mov byte [rsp + 0x20], 1
mov r9b, 1
movzx r8d, r9b
xor edx, edx
lea rcx, [0x140056da0]
call fcn.1400086a0
movzx r15d, al
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
mov byte [rsp + 0x20], 1
mov r9b, 1
movzx r8d, r9b
xor edx, edx
lea rcx, str.WINMM.dll
call fcn.1400086a0
movzx r12d, al
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
mov byte [rsp + 0x20], 1
mov r9b, 1
movzx r8d, r9b
xor edx, edx
lea rcx, str.IPHLPAPI.dll
call fcn.1400086a0
movzx r13d, al
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
mov byte [rsp + 0x20], 1
mov r9b, 1
movzx r8d, r9b
xor edx, edx
lea rcx, str.VERSION.dll
call fcn.1400086a0
mov byte [rsp + 0x60], al
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
mov byte [rsp + 0x20], 1
mov r9b, 1
movzx r8d, r9b
xor edx, edx
lea rcx, str.WS2_32.dll
call fcn.1400086a0
mov byte [rsp + 0x6c], al
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
mov byte [rsp + 0x20], 1
mov r9b, 1
movzx r8d, r9b
xor edx, edx
lea rcx, str.MSWSOCK.dll
call fcn.1400086a0
mov byte [rsp + 0x6d], al
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
mov byte [rsp + 0x20], 1
mov r9b, 1
movzx r8d, r9b
xor edx, edx
lea rcx, str.Secur32.dll
call fcn.1400086a0
mov byte [rsp + 0x6e], al
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
mov byte [rsp + 0x20], 1
mov r9b, 1
movzx r8d, r9b
xor edx, edx
lea rcx, str.WSOCK32.dll
call fcn.1400086a0
mov byte [rsp + 0x6f], al
xor ecx, ecx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rcx
lea rax, [0x14006ca48]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rcx
mov byte [rsp + 0x20], 1
mov r9b, 1
movzx r8d, r9b
xor edx, edx
lea rcx, str.Imm32.dll
call fcn.1400086a0
mov byte ds:[rsp + 0x61], al
xor ecx, ecx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rcx
lea rax, [0x14006ca50]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rcx
mov byte [rsp + 0x20], 1
mov r9b, 1
movzx r8d, r9b
xor edx, edx
lea rcx, str.Psapi.dll
call fcn.1400086a0
mov byte [rsp + 0x62], al
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
mov byte [rsp + 0x20], 1
mov r9b, 1
movzx r8d, r9b
xor edx, edx
lea rcx, str.SETUPAPI.dll
call fcn.1400086a0
mov byte [rsp + 0x63], al
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
mov byte [rsp + 0x20], 1
mov r9b, 1
movzx r8d, r9b
xor edx, edx
lea rcx, str.OLEAUT32.dll
call fcn.1400086a0
mov byte ds:[rsp + 0x64], al
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
mov byte [rsp + 0x20], 1
mov r9b, 1
movzx r8d, r9b
xor edx, edx
lea rcx, [0x140056ec0]
call fcn.1400086a0
test dil, dil
je 0x14001d73e
test bl, bl
je 0x14001d73e
test sil, sil
je 0x14001d73e
nop
test r14b, r14b
je 0x14001d73e
test r15b, r15b
je 0x14001d73e
test r12b, r12b
je 0x14001d73e
nop dword [rax + rax]
test r13b, r13b
je 0x14001d73e
cmp byte [rsp + 0x60], 0
je 0x14001d73e
cmp byte [rsp + 0x6c], 0
je 0x14001d73e
cmp byte [rsp + 0x6d], 0
je 0x14001d73e
cmp byte [rsp + 0x6e], 0
je 0x14001d73e
cmp byte ds:[rsp + 0x6f], 0
je 0x14001d73e
cmp byte [rsp + 0x61], 0
je 0x14001d73e
cmp byte [rsp + 0x62], 0
je 0x14001d73e
cmp byte [rsp + 0x63], 0
je 0x14001d73e
cmp byte [rsp + 0x64], 0
je 0x14001d73e
test al, al
je 0x14001d73e
lea rcx, [0x14000af20]
call fcn.14002ed64
lea rcx, [0x1400094c0]
call fcn.14002f5ec
xor r13d, r13d
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r13d
xor r9d, r9d
lea r8, [0x14000a5c0]
xor edx, edx
xor ecx, ecx
call fcn.14002fe28
mov qword [rbp - 0x20], rax
test rax, rax
jne 0x1400198b3
lea rcx, str.Failed_to_start_thread__r_n
jmp 0x14001d75d
mov dword [rbp + 0xc], 1
call qword [sym.imp.KERNEL32.dll_SetProcessMitigationPolicy]
mov dword [rbp + 8], r13d
mov r9d, 4
lea r8, [rbp + 8]
mov edx, 2
mov rcx, qword [0x14006d468]
call qword [sym.imp.KERNEL32.dll_GetProcessMitigationPolicy]
mov eax, dword [rbp + 8]
test al, 1
jne 0x140019865
mov rcx, rdi
call fcn.140001a40
mov edx, 0x1020
mov rcx, rdi
call fcn.14001e3b8
lea rcx, str.Dynamic_code_policy_is_not_allowed___1__r_n
nop dword [rax + rax]
jmp 0x14001d75d
test al, 2
je 0x14001988a
mov rcx, rdi
call fcn.140001a40
mov edx, 0x1020
mov rcx, rdi
call fcn.14001e3b8
lea rcx, str.Dynamic_code_policy_is_not_allowed___2__r_n
jmp 0x14001d75d
test al, 4
je 0x140018d9f
mov rcx, rdi
call fcn.140001a40
mov edx, 0x1020
mov rcx, rdi
call fcn.14001e3b8
lea rcx, str.Dynamic_code_policy_is_not_allowed___3__r_n
jmp 0x14001d75d
cmp dword [rbp + 0xc], r13d
je 0x1400198cd
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
mov edx, 6
call qword [sym.imp.USER32.dll_ShowWindow]
lea rcx, str.SteamLite64
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
mov word [rbp + 0x50], r13w
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x52], xmm0
mov dword [rbp + 0x62], eax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
lea rdx, [rbp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
cmp eax, 1
jne 0x140019934
mov eax, 0x2329
cmp word [rbp + 0x52], ax
je 0x140019934
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 0x23290078
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferSize]
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x120]
call fcn.140047d20
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x540]
call fcn.140047d20
mov r8d, 0x104
lea rdx, [rbp + 0x120]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x1400199b6
lea r8, str.Unable_to_get_exe_path__1___n
mov ecx, 0xc
mov edx, 7
call fcn.1400172a0
mov dl, 1
movzx ecx, dl
call fcn.1400075a0
lea rcx, str.Press_enter_to_exit_
nop dword [rax]
call fcn.14001d860
lea rcx, [0x14006e990]
call fcn.140018000
jmp 0x14001d765
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
cmp eax, 0x7a
jne 0x1400199ce
lea r8, str.Unable_to_get_exe_path__2___n
jmp 0x14001997c
lea rdx, str.SteamLite64.exe
lea rcx, ds:[rbp + 0x120]
call fcn.140023004
test rax, rax
jne 0x1400199f3
lea r8, str.Unable_to_get_exe_path__3___n
jmp 0x14001997c
lea r8, [rbp + 0x120]
mov edx, 0x104
lea rcx, [rbp + 0x540]
call fcn.14002ee10
mov edx, 0x5c
lea rcx, [rbp + 0x120]
call fcn.140022f54
nop dword [rax]
test rax, rax
je 0x140019a29
mov word [rax], r13w
lea rax, [rbp + 0x120]
mov qword [rsp + 0x20], rax
lea r9, str._sSteamLiteData
mov edx, 0x104
mov r8, 0xffffffffffffffff
lea rcx, [0x14006ca90]
call fcn.1400022c0
lea rax, [rbp + 0x120]
mov qword [rsp + 0x20], rax
lea r9, str._sEncryptedAppTickets
mov edx, 0x104
mov r8, 0xffffffffffffffff
lea rcx, [0x14006ced0]
call fcn.1400022c0
lea rax, [rbp + 0x120]
mov qword [rsp + 0x20], rax
lea r9, str._sAppOwnershipTickets
mov edx, 0x104
mov r8, 0xffffffffffffffff
lea rcx, [0x14006d0e0]
call fcn.1400022c0
mov ecx, 0x208
call fcn.14001e3b0
mov rsi, rax
test rax, rax
je 0x140019ace
xor edx, edx
mov r8d, 0x208
mov rcx, rax
call fcn.140047d20
jmp 0x140019ad1
mov rsi, r13
lea rax, [rbp + 0x120]
mov qword [rsp + 0x20], rax
lea r9, str._sPointerAuthentication64.dll
mov edx, 0x104
mov r8, 0xffffffffffffffff
mov rcx, rsi
call fcn.1400022c0
cmp eax, 0xffffffff
jne 0x140019b09
lea r8, str.Unable_to_get_dll_paths__1___n
jmp 0x14001997c
lea rax, [rbp + 0x120]
mov qword [rsp + 0x20], rax
lea r9, str._sApplist.log
mov edx, 0x104
mov r8, 0xffffffffffffffff
lea rcx, [0x14006d490]
call fcn.1400022c0
lea rcx, [0x14006d490]
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xorps xmm0, xmm0
movups xmmword [rbp + 0x110], xmm0
mov rbx, r13
test rbx, rbx
jne 0x140019b98
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
mov r8d, 1
lea rcx, [rbp + 0x540]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbp + 0x110], rax
jmp 0x140019bce
cmp rbx, 1
jne 0x140019bce
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
mov r8d, ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbp + 0x118], rax
mov rdi, qword ds:[rbp + rbx*8 + 0x110]
nop dword [rax]
cmp rdi, 0xffffffffffffffff
je 0x14001d732
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x330]
call fcn.140047d20
xor r9d, r9d
mov r8d, 0x104
lea rdx, [rbp + 0x330]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFinalPathNameByHandleW]
nop word [rax + rax]
cmp eax, 0x104
jae 0x14001d715
cmp eax, 6
jb 0x14001d6fd
test rbx, rbx
jne 0x140019c42
lea rcx, [rbp + 0x540]
jmp 0x140019c4f
cmp rbx, 1
jne 0x14001d6e5
mov rcx, rsi
lea rdx, [rbp + 0x338]
call fcn.140018460
nop dword [rax + rax]
test al, al
je 0x14001d6e5
lfence
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x68], xmm0
movups xmmword [rbp + 0x78], xmm0
movups xmmword [rbp + 0x88], xmm0
mov dword [rbp + 0x98], eax
lea rdx, [rbp + 0x68]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x14001d6ca
cmp dword [rbp + 0x90], 1
jne 0x14001d6a5
lea rdi, ds:[rbp + 0x68]
xor eax, eax
mov ecx, 0x34
rep stosb byte [rdi], al
inc rbx
cmp rbx, 2
jb 0x140019b53
xor edx, edx
mov r8d, 0x20a
lea rcx, [rbp + 0x750]
call fcn.140047d20
mov dword [rsp + 0x38], 0x105
lea rax, [rbp + 0x750]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x110]
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationByHandleW]
cmp eax, 1
jne 0x140019d45
lea rdx, str.NTFS
lea rcx, [rbp + 0x750]
call fcn.140027074
test eax, eax
je 0x140019d45
mov edx, 7
mov ecx, 0xc
lea r8, str.SteamLite_is_designed_to_run_on_NTFS_drives__n_n
call fcn.1400172a0
mov ecx, 0x208
call fcn.14001e3b0
mov rdi, rax
test rax, rax
je 0x140019d69
xor edx, edx
mov r8d, 0x208
mov rcx, rax
call fcn.140047d20
jmp 0x140019d6c
mov rdi, r13
lea rax, [rbp + 0x120]
mov qword [rsp + 0x20], rax
lea r9, str._spackage_beta
mov edx, 0x104
mov r8, 0xffffffffffffffff
mov rcx, rdi
call fcn.1400022c0
cmp eax, 0xffffffff
jne 0x140019da5
lea r8, str.Unable_to_get_beta_file_path__n
nop
jmp 0x14001997c
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor edx, edx
mov r8d, 1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x140019df3
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 7
mov ecx, 0xc
lea r8, str.You_are_using_Steam_beta_files__SteamLite_might_not_work_correctly__n_n
call fcn.1400172a0
mov rcx, rdi
call fcn.14001e3b8
lea rax, [rbp + 0x120]
mov qword [rsp + 0x20], rax
lea r9, [0x14004ab58]
mov edx, 0x104
mov r8, 0xffffffffffffffff
lea rcx, [0x14006cca0]
call fcn.1400022c0
cmp eax, 0xffffffff
jne 0x140019e37
lea r8, str.Unable_to_build_path_for_file_search__n
jmp 0x14001997c
mov edx, 1
lea rcx, [0x140007de0]
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
mov byte [rsp + 0x60], r13b
lea r8, [rsp + 0x60]
lea rdx, [rbp + 0x120]
lea rcx, [rbp + 0x540]
call fcn.14000c760
cmp byte [rsp + 0x60], 1
jne 0x140019e8e
mov edx, 7
mov ecx, 0xc
lea r8, str.Failed_to_set_environment_variables__n
call fcn.1400172a0
xor edx, edx
mov cl, 1
jmp 0x140019990
mov qword [rbp - 0x70], r13
mov byte [rsp + 0x60], r13b
lea r8, [rbp - 0x70]
lea rdx, [rsp + 0x60]
mov rcx, qword [rbp - 0x78]
call fcn.14000dbc0
test al, al
jne 0x140019f3b
mov rdi, qword [rbp - 0x70]
cmp qword [0x14006ca68], r13
je 0x140019ec5
nop
test rdi, rdi
jne 0x140019ee5
mov edx, 7
mov ecx, 0xc
lea r8, str.SteamLite_update_check_init_error__n_n
call fcn.1400172a0
nop dword [rax + rax]
test rdi, rdi
je 0x140019eff
movabs r10, 0xb2e10636105e9a70
mov rcx, rdi
mov rax, qword [0x14006c970]
call qword [0x14004a4d0]
mov edx, 7
mov ecx, 0xc
lea r8, str.Unable_to_check_for_SteamLite_updates__n
call fcn.1400172a0
cmp byte [rsp + 0x60], 1
jne 0x140019f32
mov edx, 7
mov ecx, 0xc
lea r8, str._nPotential_TLS_man_in_the_middle_attack_detected__n
call fcn.1400172a0
xor edx, edx
mov cl, 1
jmp 0x140019990
mov rbx, r13
mov r15, qword [rbp - 0x70]
nop dword [rax]
nop word [rax + rax]
mov byte [rsp + 0x60], r13b
mov rdi, qword [rbp + rbx*8 + 0x110]
mov r9, rbx
lea r8, [rsp + 0x60]
mov rdx, rdi
mov rcx, r15
call fcn.140016ac0
movzx r14d, al
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [rsp + 0x60], 1
je 0x14001d685
test r14b, r14b
je 0x14001d665
cmp rbx, 1
je 0x140019fab
inc rbx
cmp rbx, 2
jb 0x140019f50
jmp 0x14001a0cf
mov qword ds:[rbp + 0x110], r13
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r13
lea rax, [rbp + 0x110]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r13
mov byte [rsp + 0x20], 1
mov r9b, 1
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call fcn.1400086a0
test al, al
je 0x14001d645
lea rdx, str.Init
mov rdi, qword ds:[rbp + 0x110]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14006c890], rax
lea rdx, str.AllocatePointerHashStorage
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14006c898], rax
lea rdx, str.Keygen
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14006c8a0], rax
lea rdx, str.FreeKeygen
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14006c8a8], rax
lea rdx, str.ProtectPointer
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14006c8b0], rax
lea rdx, str.VerifyPointer
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14006c8b8], rax
cmp qword [0x14006c890], r13
je 0x14001d625
cmp qword [0x14006c898], r13
je 0x14001d625
cmp qword [0x14006c8a0], r13
je 0x14001d625
cmp qword [0x14006c8a8], r13
je 0x14001d625
cmp qword [0x14006c8b0], r13
nop
je 0x14001d625
test rax, rax
je 0x14001d625
mov rcx, rsi
call fcn.14001e3b8
movabs r10, 0xdf949ec45c5ca270
mov rax, qword [0x14006c890]
call qword [0x14004a4d0]
cmp al, 1
jne 0x14001d605
movabs r10, 0x8cd0375c745d7b70
mov ecx, 1
mov rax, qword [0x14006c898]
call qword [0x14004a4d0]
cmp al, 1
jne 0x14001d5e5
movabs r10, 0xc1f99fde70d08370
lea rcx, [0x14006d478]
mov rax, qword [0x14006c8a0]
call qword [0x14004a4d0]
mov qword [0x14006d470], rax
nop
test rax, rax
je 0x14001d5c5
mov rcx, qword [rbp + 0x998]
movabs r10, 0xc1c9afd5565ae170
movzx r8d, word [0x14006d478]
mov rdx, rax
mov rax, qword [0x14006c8b0]
call qword [0x14004a4d0]
test al, al
jne 0x14001a195
mov edx, 7
mov ecx, 0xc
lea r8, str.PointerAuthentication_Protect_Failed__n
call fcn.1400172a0
xor edx, edx
mov cl, 1
jmp 0x140019990
lea rcx, str.SteamLite_Started__n_n
nop dword [rax]
call fcn.14001d860
lea rcx, [rbp + 0x120]
call fcn.1400099c0
mov dword [rbp + 8], eax
mov ecx, 0x208
call fcn.14001e3b0
mov r15, rax
test rax, rax
je 0x14001a1d8
xor edx, edx
mov r8d, 0x208
mov rcx, rax
call fcn.140047d20
jmp 0x14001a1db
mov r15, r13
mov ecx, 0x208
call fcn.14001e3b0
mov qword [rbp - 0x60], rax
test rax, rax
je 0x14001a202
xor edx, edx
mov r8d, 0x208
mov rcx, rax
call fcn.140047d20
nop
jmp 0x14001a206
mov qword [rbp - 0x60], r13
mov ecx, 0x208
call fcn.14001e3b0
mov r12, rax
mov qword [rbp - 0x48], rax
test rax, rax
je 0x14001a22e
xor edx, edx
mov r8d, 0x208
mov rcx, rax
call fcn.140047d20
jmp 0x14001a235
mov r12, r13
mov qword [rbp - 0x48], r13
mov ecx, 0x208
call fcn.14001e3b0
mov rsi, rax
mov qword [rbp - 0x40], rax
test rax, rax
je 0x14001a25d
xor edx, edx
mov r8d, 0x208
mov rcx, rax
call fcn.140047d20
jmp 0x14001a264
mov rsi, r13
mov qword [rbp - 0x40], r13
mov ecx, 0x208
call fcn.14001e3b0
mov qword [rbp - 0x70], rax
test rax, rax
je 0x14001a289
xor edx, edx
mov r8d, 0x208
mov rcx, rax
call fcn.140047d20
jmp 0x14001a28d
mov qword [rbp - 0x70], r13
mov ecx, 0x208
call fcn.14001e3b0
mov qword ds:[rbp - 0x78], rax
test rax, rax
je 0x14001a2b7
xor edx, edx
mov r8d, 0x208
mov rcx, rax
call fcn.140047d20
jmp 0x14001a2bb
mov qword [rbp - 0x78], r13
mov ecx, 0x208
call fcn.14001e3b0
mov rdi, rax
test rax, rax
je 0x14001a2df
xor edx, edx
mov r8d, 0x208
mov rcx, rax
call fcn.140047d20
jmp 0x14001a2e2
mov rdi, r13
mov qword [0x14006ceb0], rdi
mov ecx, 0x208
call fcn.14001e3b0
mov rdi, rax
test rax, rax
je 0x14001a30d
xor edx, edx
mov r8d, 0x208
mov rcx, rax
call fcn.140047d20
jmp 0x14001a310
mov rdi, r13
mov qword [0x14006ceb8], rdi
mov ecx, 0x208
call fcn.14001e3b0
mov r14, rax
mov qword [rbp - 0x38], rax
test rax, rax
je 0x14001a347
xor edx, edx
mov r8d, 0x208
mov rcx, rax
call fcn.140047d20
jmp 0x14001a34e
mov r14, r13
mov qword [rbp - 0x38], r13
mov ecx, 0x208
call fcn.14001e3b0
mov rbx, rax
mov qword [rbp - 0x30], rax
test rax, rax
je 0x14001a377
xor edx, edx
mov r8d, 0x208
mov rcx, rax
call fcn.140047d20
jmp 0x14001a37e
mov rbx, r13
mov qword [rbp - 0x30], rbx
mov ecx, 0x208
call fcn.14001e3b0
mov rdi, rax
mov qword [rbp - 0x28], rax
test rax, rax
je 0x14001a3a7
xor edx, edx
mov r8d, 0x208
mov rcx, rax
call fcn.140047d20
jmp 0x14001a3ae
mov rdi, r13
mov qword [rbp - 0x28], r13
mov ecx, 0x208
call fcn.14001e3b0
mov r13, rax
test rax, rax
je 0x14001a3d7
xor edx, edx
mov r8d, 0x208
mov rcx, rax
call fcn.140047d20
jmp 0x14001a3da
xor r13d, r13d
lea rax, ds:[rbp + 0x120]
mov qword [rsp + 0x20], rax
lea r9, str._s_steamclient64.dll
mov edx, 0x104
mov r8, 0xffffffffffffffff
mov rcx, r15
call fcn.1400022c0
mov dword [rbp + 0xc], eax
lea rax, [rbp + 0x120]
mov qword [rsp + 0x20], rax
lea r9, str._s_vstdlib_s64.dll
mov edx, 0x104
mov r8, 0xffffffffffffffff
mov rcx, qword [rbp - 0x60]
call fcn.1400022c0
mov dword [rbp - 0x80], eax
lea rax, [rbp + 0x120]
mov qword [rsp + 0x20], rax
lea r9, str._s_tier0_s64.dll
mov edx, 0x104
mov r8, 0xffffffffffffffff
mov rcx, r12
call fcn.1400022c0
mov dword [rsp + 0x7c], eax
lea rax, [rbp + 0x120]
mov qword [rsp + 0x20], rax
lea r9, str._s_bin_steamservice.dll
mov edx, 0x104
mov r8, 0xffffffffffffffff
mov rcx, rsi
call fcn.1400022c0
mov dword [rsp + 0x78], eax
lea rax, [rbp + 0x120]
mov qword [rsp + 0x20], rax
lea r9, str._s_bin_secure_desktop_capture.exe
mov edx, 0x104
mov r8, 0xffffffffffffffff
mov rcx, qword [rbp - 0x70]
call fcn.1400022c0
mov dword [rsp + 0x74], eax
lea rax, [rbp + 0x120]
mov qword [rsp + 0x20], rax
lea r9, str._s_bindrivers.exe
mov edx, 0x104
mov r8, 0xffffffffffffffff
mov rcx, qword [rbp - 0x78]
call fcn.1400022c0
mov dword [rsp + 0x70], eax
lea rax, [rbp + 0x120]
mov qword [rsp + 0x20], rax
lea r9, str._s_bingldriverquery.exe
mov edx, 0x104
mov r8, 0xffffffffffffffff
mov rcx, qword [0x14006ceb0]
call fcn.1400022c0
mov dword [rsp + 0x68], eax
lea rax, [rbp + 0x120]
mov qword [rsp + 0x20], rax
lea r9, str._s_bingldriverquery64.exe
mov edx, 0x104
mov r8, 0xffffffffffffffff
mov rcx, qword [0x14006ceb8]
call fcn.1400022c0
mov dword [rbp - 0x54], eax
lea rax, [rbp + 0x120]
mov qword [rsp + 0x20], rax
lea r9, str._s_bin_vulkandriverquery.exe
mov edx, 0x104
mov r8, 0xffffffffffffffff
mov rcx, r14
call fcn.1400022c0
mov dword [rbp - 0x50], eax
lea rax, [rbp + 0x120]
mov qword [rsp + 0x20], rax
lea r9, str._s_bin_vulkandriverquery64.exe
mov edx, 0x104
mov r8, 0xffffffffffffffff
mov rcx, rbx
call fcn.1400022c0
mov dword [rbp - 0x58], eax
lea rax, [rbp + 0x120]
mov qword [rsp + 0x20], rax
lea r9, str._s_bin_steamxboxutil.exe
mov edx, 0x104
mov r8, 0xffffffffffffffff
mov rcx, rdi
call fcn.1400022c0
mov dword ds:[rbp - 0x68], eax
lea rax, [rbp + 0x120]
mov qword [rsp + 0x20], rax
lea r9, str._s_bin_steamxboxutil64.exe
mov edx, 0x104
mov r8, 0xffffffffffffffff
mov rcx, r13
call fcn.1400022c0
mov dword [rbp - 0x64], eax
mov ecx, 0x208
call fcn.14001e3b0
mov rdi, rax
mov qword [rbp + 0x110], rax
test rax, rax
je 0x14001a61a
xor edx, edx
mov r8d, 0x208
mov rcx, rax
call fcn.140047d20
xor r14d, r14d
jmp 0x14001a627
xor r14d, r14d
mov edi, r14d
mov qword [rbp + 0x110], r14
lea rax, [rbp + 0x120]
mov qword [rsp + 0x20], rax
lea r9, str._s_steamclient.dll
mov edx, 0x104
mov r8, 0xffffffffffffffff
mov rcx, rdi
call fcn.1400022c0
mov dword ds:[rbp - 0x18], eax
mov esi, 0xfffffffe
mov ecx, 0x208
call fcn.14001e3b0
mov rbx, rax
test rax, rax
je 0x14001a67f
xor edx, edx
mov r8d, 0x208
mov rcx, rax
call fcn.140047d20
jmp 0x14001a682
mov rbx, r14
mov ecx, 0x208
call fcn.14001e3b0
mov r12, rax
test rax, rax
je 0x14001a6a7
xor edx, edx
mov r8d, 0x208
mov rcx, rax
call fcn.140047d20
jmp 0x14001a6aa
mov r12, r14
mov ecx, 0x208
call fcn.14001e3b0
mov rdi, rax
test rax, rax
je 0x14001a6ce
xor edx, edx
mov r8d, 0x208
mov rcx, rax
call fcn.140047d20
jmp 0x14001a6d1
mov rdi, r14
mov qword [0x14006cea8], rdi
mov edi, dword ds:[rbp + 8]
cmp edi, 1
jne 0x14001a6ee
lea r9, str._s_bincefcef.win7x64_steamwebhelper.exe
jmp 0x14001a6fa
cmp edi, 2
jne 0x14001a71c
lea r9, str._s_bincefcef.win7_steamwebhelper.exe
lea rax, [rbp + 0x120]
mov qword [rsp + 0x20], rax
mov r8, 0xffffffffffffffff
mov edx, 0x104
mov rcx, rbx
call fcn.1400022c0
mov esi, eax
lea rcx, [rbp + 0x120]
call fcn.14000ca60
mov r14d, eax
lea rax, [rbp + 0x120]
mov qword [rsp + 0x20], rax
lea r9, str._s_steam.exe
mov edx, 0x104
mov r8, 0xffffffffffffffff
mov rcx, r12
call fcn.1400022c0
cmp dword [rbp + 0xc], 0xffffffff
je 0x14001d5b9
cmp dword [rbp - 0x80], 0xffffffff
je 0x14001d5b9
cmp dword [rsp + 0x7c], 0xffffffff
je 0x14001d5b9
cmp dword [rsp + 0x78], 0xffffffff
je 0x14001d5b9
cmp dword [rsp + 0x74], 0xffffffff
je 0x14001d5b9
cmp dword [rsp + 0x70], 0xffffffff
je 0x14001d5b9
cmp dword [rsp + 0x68], 0xffffffff
je 0x14001d5b9
cmp dword [rbp - 0x54], 0xffffffff
je 0x14001d5b9
cmp dword [rbp - 0x50], 0xffffffff
je 0x14001d5b9
cmp dword [rbp - 0x58], 0xffffffff
je 0x14001d5b9
cmp dword ds:[rbp - 0x68], 0xffffffff
je 0x14001d5b9
cmp dword [rbp - 0x64], 0xffffffff
je 0x14001d5b9
cmp dword [rbp - 0x18], 0xffffffff
je 0x14001d5b9
mov ecx, 0xc
mov edx, 7
call fcn.1400172a0
xor edx, edx
mov cl, 1
call fcn.1400075a0
lea rcx, str.Press_enter_to_exit_
call fcn.14001d860
lea rcx, [0x14006e990]
call fcn.140018000
mov rcx, qword [rbp + 0x998]
movabs r10, 0xa5599ec1185c3370
mov r9b, 1
movzx r8d, word [0x14006d478]
mov rdx, qword [0x14006d470]
mov rax, qword [0x14006c8b8]
call qword [0x14004a4d0]
jmp 0x14001d765
lea r8, str.Unable_to_get_dll_paths__2___n
jmp 0x14001abaf
mov edx, 7
mov ecx, 0xc
lea r8, str.PointerAuthentication_Keygen_Failed__n
call fcn.1400172a0
xor edx, edx
mov cl, 1
jmp 0x140019990
mov edx, 7
mov ecx, 0xc
lea r8, str.PointerAuthentication_Alloc_Failed__n
call fcn.1400172a0
xor edx, edx
mov cl, 1
jmp 0x140019990
mov edx, 7
mov ecx, 0xc
lea r8, str.PointerAuthentication_Init_Failed__n
call fcn.1400172a0
xor edx, edx
mov cl, 1
jmp 0x140019990
mov edx, 7
mov ecx, 0xc
lea r8, str.Failed_to_get_functions_in_PointerAuthentication_dll__n
call fcn.1400172a0
xor edx, edx
mov cl, 1
jmp 0x140019990
mov edx, 7
mov ecx, 0xc
lea r8, str.Failed_to_load_PointerAuthentication_dll__n
call fcn.1400172a0
xor edx, edx
mov cl, 1
jmp 0x140019990
mov edx, 7
mov ecx, 0xc
lea r8, str.Digital_Signature_Verification_Failed__n
call fcn.1400172a0
xor edx, edx
mov cl, 1
jmp 0x140019990
mov edx, 7
mov ecx, 0xc
lea r8, str.Potential_TLS_man_in_the_middle_attack_detected___2__n
call fcn.1400172a0
xor edx, edx
mov cl, 1
jmp 0x140019990
lfence
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdi, [rbp + 0x68]
xor eax, eax
mov ecx, 0x34
rep stosb byte [rdi], al
lea r8, str.SteamLite_files_has_more_than_one_link___2__n
jmp 0x14001997c
lfence
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, str.Failed_to_get_info_about_SteamLite_files__n
nop dword [rax]
jmp 0x14001997c
lfence
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, str.SteamLite_files_has_more_than_one_link___1__n
jmp 0x14001997c
lfence
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, str.GetFinalPathNameByHandle_Failed___2__n
jmp 0x14001997c
lfence
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, str.GetFinalPathNameByHandle_Failed___1__n
jmp 0x14001997c
lea r8, str.Failed_to_open_SteamLite_files__n
jmp 0x14001997c
lea rcx, str.Unable_to_load_system_dlls__r_n
jmp 0x14001d75d
lea rcx, str.Failed_to_get_functions_from_Imagehlp.dll_or_Crypt32.dll__r_n
jmp 0x14001d75d
lea rcx, str.Failed_to_load_Bcryptprimitives.dll__Bcrypt.dll__Wintrust.dll__Imagehlp.dll_or_Crypt32.dll__r_n
nop dword [rax]
call fcn.1400091e0
xor eax, eax
mov rcx, qword [rbp + 0x960]
xor rcx, rsp
call fcn.14001e390
lea r11, [rsp + 0xa70]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret