Function at 0x401000
Capabilities:
Check if file exists
Create process on windows
Create process suspended
Get file attributes
Query or enumerate registry value
Read .ini file
Resume thread
Set environment variable
Set registry value
Terminate process

Disassembly:
mov eax, 0x3914
call fcn.00401810
mov eax, dword [0x418004]
xor eax, esp
mov dword [esp + 0x3910], eax
push ebx
push edi
push 0x104
lea eax, [esp + 0x7c]
push 0
push eax
call fcn.00402370
push 0x104
lea eax, [esp + 0x394]
push 0
push eax
call fcn.00402370
push 0x104
lea eax, [esp + 0x29c]
push 0
push eax
call fcn.00402370
push 0x104
lea eax, [esp + 0x1a4]
push 0
push eax
call fcn.00402370
push 0x104
lea eax, [esp + 0x640]
push 0
push eax
call fcn.00402370
push 0x1000
lea eax, [esp + 0x958]
push 0
push eax
call fcn.00402370
add esp, 0x48
lea eax, [esp + 0x488]
push 0x80
push 0
push eax
call fcn.00402370
push 0x40
lea eax, [esp + 0x48]
mov dword [esp + 0x44], 0x44
push 0
push eax
call fcn.00402370
add esp, 0x18
lea eax, [esp + 0x78]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
inc eax
test eax, eax
jle 0x4010ff
cmp byte [esp + eax + 0x78], 0x5c
je 0x4010f1
dec eax
test eax, eax
jg 0x4010e3
jmp 0x4010ff
lea ecx, [esp + 0x79]
push str.ColdClientLoader.ini
add eax, ecx
push eax
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
lea eax, [esp + 0x78]
push eax
call ebx
cmp eax, 0xffffffff
jne 0x40112a
push 0x10
push 0x4111b8
push str.Couldnt_find_the_configuration_file_ColdClientLoader.ini_.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x401755
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [esp + 0x7c]
push eax
push 0x104
lea eax, [esp + 0x390]
push eax
push 0x4111b5
push str.SteamClient64Dll
push 0x41121c
call esi
lea eax, [esp + 0x7c]
push eax
push 0x104
lea eax, [esp + 0x28c]
push eax
push 0x4111b6
push 0x411228
push 0x411238
call esi
lea eax, [esp + 0x7c]
push eax
push 0x104
lea eax, [esp + 0x188]
push eax
push 0
push 0x411244
push 0x411248
call esi
lea eax, [esp + 0x7c]
push eax
push 0x104
lea eax, [esp + 0x618]
push eax
push 0
push str.ExeRunDir
push 0x411260
call esi
lea eax, [esp + 0x7c]
push eax
push 0x1000
lea eax, [esp + 0x924]
push eax
push 0
push str.ExeCommandLine
push 0x41127c
call esi
lea eax, [esp + 0x7c]
push eax
push 0x80
lea eax, [esp + 0x494]
push eax
push 0
push str.AppId
push str.SteamClient
call esi
cmp byte [esp + 0x48c], 0
je 0x401225
mov esi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
lea eax, [esp + 0x48c]
push eax
push str.SteamAppId
call esi
lea eax, [esp + 0x48c]
push eax
push str.SteamGameId
call esi
push ebp
push 0x104
lea eax, [esp + 0x514]
push 0
push eax
call fcn.00402370
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [esp + 0x398]
add esp, 0xc
push eax
call ebp
mov esi, dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test eax, eax
jle 0x40126f
nop word [eax + eax]
cmp byte [esp + eax + 0x38c], 0x5c
je 0x4012b1
dec eax
test eax, eax
jg 0x401260
lea eax, [esp + 0x38c]
push eax
lea eax, [esp + 0x514]
push eax
call edi
push 0x104
lea eax, [esp + 0x390]
push 0
push eax
call fcn.00402370
add esp, 0xc
lea eax, [esp + 0x38c]
push 0
push eax
push 0x104
lea eax, [esp + 0x51c]
push eax
call esi
lea eax, [esp + 0x288]
push eax
call ebp
test eax, eax
jle 0x4012cf
nop
cmp byte [esp + eax + 0x288], 0x5c
je 0x401311
dec eax
test eax, eax
jg 0x4012c0
lea eax, [esp + 0x288]
push eax
lea eax, [esp + 0x514]
push eax
call edi
push 0x104
lea eax, [esp + 0x28c]
push 0
push eax
call fcn.00402370
add esp, 0xc
lea eax, [esp + 0x288]
push 0
push eax
push 0x104
lea eax, [esp + 0x51c]
push eax
call esi
lea eax, [esp + 0x184]
push eax
call ebp
test eax, eax
jle 0x40132f
nop
cmp byte [esp + eax + 0x184], 0x5c
je 0x401371
dec eax
test eax, eax
jg 0x401320
lea eax, [esp + 0x184]
push eax
lea eax, [esp + 0x514]
push eax
call edi
push 0x104
lea eax, [esp + 0x188]
push 0
push eax
call fcn.00402370
add esp, 0xc
lea eax, [esp + 0x184]
push 0
push eax
push 0x104
lea eax, [esp + 0x51c]
push eax
call esi
lea eax, [esp + 0x614]
push eax
call ebp
test eax, eax
jle 0x40138f
nop
cmp byte [esp + eax + 0x614], 0x5c
je 0x4013d1
dec eax
test eax, eax
jg 0x401380
lea eax, [esp + 0x614]
push eax
lea eax, [esp + 0x514]
push eax
call edi
push 0x104
lea eax, [esp + 0x618]
push 0
push eax
call fcn.00402370
add esp, 0xc
lea eax, [esp + 0x614]
push 0
push eax
push 0x104
lea eax, [esp + 0x51c]
push eax
call esi
lea eax, [esp + 0x38c]
push eax
call ebx
cmp eax, 0xffffffff
jne 0x4013f1
push 0x10
push 0x4112b4
push str.Couldnt_find_the_requested_SteamClient64Dll.
jmp 0x40174b
lea eax, [esp + 0x288]
push eax
call ebx
cmp eax, 0xffffffff
jne 0x401411
push 0x10
push 0x4112f8
push str.Couldnt_find_the_requested_SteamClientDll.
jmp 0x40174b
lea eax, [esp + 0x184]
push eax
call ebx
cmp eax, 0xffffffff
jne 0x401431
push 0x10
push 0x411338
push str.Couldnt_find_the_requested_Exe_file.
jmp 0x40174b
lea eax, [esp + 0x920]
push eax
lea eax, [esp + 0x188]
push eax
push str.__s___s
lea eax, [esp + 0x192c]
push 0x2000
push eax
call fcn.004017c0
add esp, 0x14
cmp byte [esp + 0x184], 0
je 0x40173f
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x61c]
push eax
push 0
push 4
push 1
push 0
push 0
lea eax, [esp + 0x1940]
push eax
lea eax, [esp + 0x1a8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40173f
mov dword [esp + 0x24], 0x771f810d
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0x104
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x71c]
push 0
push eax
mov byte [esp + 0x23], 0
mov dword [esp + 0x24], 1
call fcn.00402370
push 0x104
lea eax, [esp + 0x82c]
push 0
push eax
call fcn.00402370
add esp, 0x18
mov dword [esp + 0x1c], 0x104
lea eax, [esp + 0x10]
mov dword [esp + 0x20], 0x104
push eax
push 0xf003f
push 0
push 0x4113b8
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4015ca
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x71c]
mov byte [esp + 0x1b], 1
push eax
lea eax, [esp + 0x20]
push eax
push 0
push 0x4113dc
push dword [esp + 0x24]
call esi
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x820]
push eax
lea eax, [esp + 0x20]
push eax
push 0
push 0x4113ec
push dword [esp + 0x24]
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea eax, [esp + 0x24]
push 4
push eax
push 4
push 0
push str.ActiveUser
push dword [esp + 0x24]
call edi
push 4
lea eax, [esp + 0x2c]
push eax
push 4
push 0
push 0x411488
push dword [esp + 0x24]
call edi
lea eax, [esp + 0x288]
push eax
call ebx
cmp eax, 0xffffffff
je 0x40161b
lea eax, [esp + 0x288]
push eax
call ebp
inc eax
push eax
lea eax, [esp + 0x28c]
push eax
push 1
push 0
push 0x41148c
jmp 0x40162b
push 0
lea eax, [esp + 0x14]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push 0x411400
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x40156a
push 0x10
push str.ColdClientLoader
push str.Unable_to_patch_Steam_process_informations_on_the_Windows_registry.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
push dword [esp + 0x30]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x401753
push 0
push 0x4111b7
push 1
push 0
push 0x41149c
push dword [esp + 0x24]
call edi
lea eax, [esp + 0x38c]
push eax
call ebx
cmp eax, 0xffffffff
je 0x40165f
lea eax, [esp + 0x38c]
push eax
call ebp
inc eax
push eax
lea eax, [esp + 0x390]
push eax
push 1
push 0
push 0x4114ac
jmp 0x40166f
push 0
push 0x4111c9
push 1
push 0
push 0x4114c0
push dword [esp + 0x24]
call edi
push 0x4114d4
call ebp
inc eax
push eax
push str.Public
push 1
push 0
push str.Universe
push dword [esp + 0x24]
call edi
push dword [esp + 0x10]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call ebx
push dword [esp + 0x30]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0xffffffffffffffff
push dword [esp + 0x34]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esp + 0x2c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0x30]
call esi
cmp byte [esp + 0x17], 0
je 0x401753
lea eax, [esp + 0x10]
push eax
push 0xf003f
push 0
push str.SoftwareValveSteamActiveProcess
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401753
lea eax, [esp + 0x718]
push eax
call ebp
inc eax
push eax
lea eax, [esp + 0x71c]
push eax
push 1
push 0
push str.SteamClientDll
push dword [esp + 0x24]
call edi
lea eax, [esp + 0x81c]
push eax
call ebp
inc eax
push eax
lea eax, [esp + 0x820]
push eax
push 1
push 0
push str.SteamClientDll64
push dword [esp + 0x24]
call edi
push dword [esp + 0x10]
call ebx
jmp 0x401753
push 0x10
push 0x41137c
push str.Unable_to_load_the_requested_EXE_file.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop ebp
pop esi
mov ecx, dword [esp + 0x3918]
xor eax, eax
pop edi
pop ebx
xor ecx, esp
call fcn.004017f2
add esp, 0x3914
ret 0x10