Function at 0x4159e0
Capabilities:
Accept command line arguments
Block operations on executable memory pages using arbitrary code guard
Create process on windows
Create thread
Delete file
Enumerate device drivers on windows
Get common file path
Link many functions at runtime
Set console window title
Terminate process

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x440db0
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0xa18
mov eax, dword [0x45c040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x1000000
push 0
push 0x45e7c0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionEx]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [0x45f6a4], eax
nop
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push str.ntdll.dll
mov dword [0x45e590], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.Kernel32.dll
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.RtlGetNtVersionNumbers
push esi
mov dword [0x45eb50], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtQuerySystemInformation
push esi
mov dword [0x45edb4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtQueryInformationProcess
push esi
mov dword [0x45eb9c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.RtlImageNtHeader
push esi
mov dword [0x45eb30], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.SetThreadInformation
push dword [0x45eb50]
mov dword [0x45e5a8], eax
nop word [eax + eax]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, dword [0x45edb4]
mov ecx, esi
push 0x45f8d4
push 0x45f408
push 0x45f680
mov dword [0x45e8dc], eax
call dword [0x442244]
call esi
mov eax, dword [0x45f8d4]
and eax, 0x7fff
cmp dword [0x45f680], 0xa
mov dword [0x45f8d4], eax
jne 0x415b13
cmp eax, 0x4a64
jae 0x415b13
push str.Update_Windows_10_to_November_2021_Update_or_above__r_n
jmp 0x419cd5
push 4
lea eax, [ebp - 0x880]
mov dword [ebp - 0x880], 1
push eax
push 6
call dword [sym.imp.KERNEL32.dll_SetProcessMitigationPolicy]
push 4
lea eax, [ebp - 0x88c]
mov dword [ebp - 0x88c], 3
push eax
push 0xa
call dword [sym.imp.KERNEL32.dll_SetProcessMitigationPolicy]
push 4
lea eax, [ebp - 0x87c]
mov dword [ebp - 0x87c], 0xb
push eax
push 1
call dword [sym.imp.KERNEL32.dll_SetProcessMitigationPolicy]
push 4
lea eax, [ebp - 0x878]
mov dword [ebp - 0x878], 3
push eax
push 3
call dword [sym.imp.KERNEL32.dll_SetProcessMitigationPolicy]
push 4
lea eax, [ebp - 0x874]
mov dword [ebp - 0x874], 1
push eax
push 9
call dword [sym.imp.KERNEL32.dll_SetProcessMitigationPolicy]
push 4
lea eax, [ebp - 0x890]
mov dword [ebp - 0x890], 0xf
push eax
push 0xe
call dword [sym.imp.KERNEL32.dll_SetProcessMitigationPolicy]
cmp dword [0x45f8d4], 0x55f0
jb 0x415bed
push 4
lea eax, [ebp - 0x850]
mov dword [ebp - 0x850], 1
push eax
push 0x10
call dword [sym.imp.KERNEL32.dll_SetProcessMitigationPolicy]
push 4
lea eax, [ebp - 0x86c]
mov dword [ebp - 0x86c], 0
push eax
push 1
push dword [0x45e590]
call dword [sym.imp.KERNEL32.dll_GetProcessMitigationPolicy]
mov eax, dword [ebp - 0x86c]
test al, 8
jne 0x415c25
push str.ASLR_policy_is_not_allowed___1__r_n
nop dword [eax]
jmp 0x419cd5
test al, 1
jne 0x415c33
push str.ASLR_policy_is_not_allowed___2__r_n
jmp 0x419cd5
test al, 2
jne 0x415c45
push str.ASLR_policy_is_not_allowed___3__r_n
nop dword [eax]
jmp 0x419cd5
push 4
lea eax, [ebp - 0x858]
mov dword [ebp - 0x858], 0
push eax
push 3
push dword [0x45e590]
call dword [sym.imp.KERNEL32.dll_GetProcessMitigationPolicy]
mov eax, dword [ebp - 0x858]
test al, 2
jne 0x415c7a
push str.Handle_check_policy_is_not_allowed___1__r_n
jmp 0x419cd5
test al, 1
jne 0x415c88
push str.Handle_check_policy_is_not_allowed___2__r_n
jmp 0x419cd5
push 4
lea eax, [ebp - 0x85c]
mov dword [ebp - 0x85c], 0
push eax
push 6
push dword [0x45e590]
call dword [sym.imp.KERNEL32.dll_GetProcessMitigationPolicy]
test byte [ebp - 0x85c], 1
jne 0x415cbc
push str.Extension_point_policy_is_not_allowed__r_n
jmp 0x419cd5
push 4
lea eax, [ebp - 0x860]
mov dword [ebp - 0x860], 0
push eax
push 7
push dword [0x45e590]
call dword [sym.imp.KERNEL32.dll_GetProcessMitigationPolicy]
test byte [ebp - 0x860], 1
jne 0x415cf0
push str.CFG_policy_is_not_allowed__r_n
jmp 0x419cd5
push 4
lea eax, [ebp - 0x868]
mov dword [ebp - 0x868], 0
push eax
push 9
push dword [0x45e590]
call dword [sym.imp.KERNEL32.dll_GetProcessMitigationPolicy]
test byte [ebp - 0x868], 1
jne 0x415d25
push str.Font_policy_is_not_allowed__r_n
nop
jmp 0x419cd5
push 4
lea eax, [ebp - 0x854]
mov dword [ebp - 0x854], 0
push eax
push 0xa
push dword [0x45e590]
call dword [sym.imp.KERNEL32.dll_GetProcessMitigationPolicy]
mov eax, dword [ebp - 0x854]
test al, 2
jne 0x415d5a
push str.Process_image_policy_is_not_allowed___1__r_n
jmp 0x419cd5
test al, 1
jne 0x415d68
push str.Process_image_policy_is_not_allowed___2__r_n
jmp 0x419cd5
cmp dword [0x45f8d4], 0x55f0
jb 0x415da8
push 4
lea eax, [ebp - 0x84c]
mov dword [ebp - 0x84c], 0
push eax
push 0x10
push dword [0x45e590]
call dword [sym.imp.KERNEL32.dll_GetProcessMitigationPolicy]
test byte [ebp - 0x84c], 1
jne 0x415da8
push str.Redirection_trust_policy_is_not_allowed__r_n
jmp 0x419cd5
push 0x4000
call dword [sym.imp.KERNEL32.dll_SetDefaultDllDirectories]
test eax, eax
jne 0x415dc5
push str.Failed_to_set_default_dll_directories__r_n
nop dword [eax]
jmp 0x419cd5
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
or eax, 1
push eax
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0x442724
push 0x810
call fcn.0041b590
mov esi, eax
add esp, 8
mov dword [ebp - 0x9e0], esi
test esi, esi
je 0x419cd0
push 0x400
lea eax, [esi + 0xc]
mov dword [esi], 0
push 0
push eax
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call fcn.00440bb0
add esp, 0xc
lea eax, [esi + 0x40c]
push 0x400
push 0
push eax
call fcn.00440bb0
add esp, 0xc
mov byte [esi + 0x80c], 1
test esi, esi
je 0x419cd0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
mov ecx, esi
call fcn.00401660
cmp byte [esi + 0x80c], 0
jne 0x415e7c
push str.CommandlineLib_is_not_initialized___5__r_n
call fcn.00407f00
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
int3
lea eax, [esi + 8]
mov edi, 1
mov dword [ebp - 0x850], eax
cmp dword [eax], edi
jle 0x415ecd
lea eax, [esi + 0x10]
mov dword [ebp - 0x84c], eax
mov ecx, dword [eax]
test ecx, ecx
je 0x415eb9
push ecx
push str._SubscriptionPatch
call fcn.0042251d
add esp, 8
test eax, eax
je 0x415f85
mov eax, dword [ebp - 0x84c]
mov ecx, dword [ebp - 0x850]
inc edi
add eax, 4
mov dword [ebp - 0x84c], eax
cmp edi, dword [ecx]
jl 0x415e97
push 4
lea eax, [ebp - 0x850]
mov dword [ebp - 0x850], 1
push eax
push 2
call dword [sym.imp.KERNEL32.dll_SetProcessMitigationPolicy]
push 4
lea eax, [ebp - 0x84c]
mov dword [ebp - 0x84c], 0
push eax
push 2
push dword [0x45e590]
call dword [sym.imp.KERNEL32.dll_GetProcessMitigationPolicy]
mov eax, dword [ebp - 0x84c]
test al, 1
jne 0x4162ca
mov ecx, esi
mov dword [ebp - 4], 5
call fcn.00401b00
mov ecx, dword [esi]
mov byte [esi + 0x80c], 0
test ecx, ecx
je 0x415f5f
mov eax, dword [esi + 4]
test eax, eax
je 0x415f5f
add eax, eax
push eax
push 0
push ecx
call fcn.00440bb0
add esp, 0xc
push dword [esi]
call fcn.0041b33a
add esp, 4
mov dword [esi], 0
mov dword [esi + 4], 0
push 0x810
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.0041b836
push str.Dynamic_code_policy_is_not_allowed___1__r_n
call fcn.00407f00
add esp, 0xc
jmp 0x419cdd
test edi, edi
je 0x415ecd
push 4
lea eax, [ebp - 0x850]
mov dword [ebp - 0x850], 3
push eax
push 2
call dword [sym.imp.KERNEL32.dll_SetProcessMitigationPolicy]
push 4
lea eax, [ebp - 0x84c]
mov dword [ebp - 0x84c], 0
push eax
push 2
push dword [0x45e590]
call dword [sym.imp.KERNEL32.dll_GetProcessMitigationPolicy]
mov eax, dword [ebp - 0x84c]
test al, 1
jne 0x416045
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.00401b00
mov ecx, dword [esi]
mov byte [esi + 0x80c], 0
test ecx, ecx
je 0x41601f
mov eax, dword [esi + 4]
test eax, eax
je 0x41601f
add eax, eax
push eax
push 0
push ecx
call fcn.00440bb0
add esp, 0xc
push dword [esi]
call fcn.0041b33a
add esp, 4
mov dword [esi], 0
mov dword [esi + 4], 0
push 0x810
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.0041b836
push str.Dynamic_code_policy_is_not_allowed___4__r_n
call fcn.00407f00
add esp, 0xc
jmp 0x419cdd
test al, 2
jne 0x4160b9
mov ecx, esi
mov dword [ebp - 4], 1
call fcn.00401b00
mov ecx, dword [esi]
mov byte [esi + 0x80c], 0
test ecx, ecx
je 0x416095
mov eax, dword [esi + 4]
test eax, eax
je 0x416095
add eax, eax
push eax
push 0
push ecx
call fcn.00440bb0
add esp, 0xc
push dword [esi]
call fcn.0041b33a
add esp, 4
mov dword [esi], 0
mov dword [esi + 4], 0
push 0x810
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.0041b836
push str.Dynamic_code_policy_is_not_allowed___5__r_n
call fcn.00407f00
add esp, 0xc
jmp 0x419cdd
test al, 4
je 0x41612d
mov ecx, esi
mov dword [ebp - 4], 2
call fcn.00401b00
mov ecx, dword [esi]
mov byte [esi + 0x80c], 0
test ecx, ecx
je 0x416104
mov eax, dword [esi + 4]
test eax, eax
je 0x416104
add eax, eax
push eax
push 0
push ecx
call fcn.00440bb0
add esp, 0xc
push dword [esi]
call fcn.0041b33a
add esp, 4
mov dword [esi], 0
mov dword [esi + 4], 0
push 0x810
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.0041b836
push str.Dynamic_code_policy_is_not_allowed___6__r_n
nop dword [eax + eax]
call fcn.00407f00
add esp, 0xc
jmp 0x419cdd
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x45f690], eax
test eax, eax
jne 0x4161af
mov ecx, esi
mov dword [ebp - 4], 3
call fcn.00401b00
mov ecx, dword [esi]
mov byte [esi + 0x80c], 0
test ecx, ecx
je 0x41618b
mov eax, dword [esi + 4]
test eax, eax
je 0x41618b
add eax, eax
push eax
push 0
push ecx
call fcn.00440bb0
add esp, 0xc
push dword [esi]
call fcn.0041b33a
add esp, 4
mov dword [esi], 0
mov dword [esi + 4], 0
push 0x810
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.0041b836
push str.Failed_to_create_patch_event__1___r_n
call fcn.00407f00
add esp, 0xc
jmp 0x419cdd
push 0
push 0
push 0
push 0x414880
push 0
push 0
call fcn.0042954c
add esp, 0x18
test eax, eax
jne 0x416239
mov ecx, esi
mov dword [ebp - 4], 4
call fcn.00401b00
mov ecx, dword [esi]
mov byte [esi + 0x80c], 0
test ecx, ecx
je 0x416215
mov eax, dword [esi + 4]
test eax, eax
je 0x416215
add eax, eax
push eax
push 0
push ecx
call fcn.00440bb0
add esp, 0xc
push dword [esi]
call fcn.0041b33a
add esp, 4
mov dword [esi], 0
mov dword [esi + 4], 0
push 0x810
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.0041b836
push str.Failed_to_create_patch_thread__1___r_n
call fcn.00407f00
add esp, 0xc
jmp 0x419cdd
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [esi + 0x80c], 0
mov byte [ebp - 0x984], 0
jne 0x416278
push str.CommandlineLib_is_not_initialized___5__r_n
nop dword [eax + eax]
call fcn.00407f00
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
int3
mov edi, 1
cmp dword [esi + 8], edi
jle 0x4163d2
lea eax, [esi + 0x10]
mov dword [ebp - 0x84c], eax
mov ecx, dword [eax]
test ecx, ecx
je 0x4162b6
push ecx
push str._Minimized
call fcn.0042251d
add esp, 8
test eax, eax
je 0x4163b9
mov eax, dword [ebp - 0x84c]
inc edi
add eax, 4
mov dword [ebp - 0x84c], eax
cmp edi, dword [esi + 8]
jl 0x416292
jmp 0x4163d2
test al, 2
je 0x416339
mov ecx, esi
mov dword [ebp - 4], 6
call fcn.00401b00
mov ecx, dword [esi]
mov byte [esi + 0x80c], 0
test ecx, ecx
je 0x416315
mov eax, dword [esi + 4]
test eax, eax
je 0x416315
add eax, eax
push eax
push 0
push ecx
call fcn.00440bb0
add esp, 0xc
push dword [esi]
call fcn.0041b33a
add esp, 4
mov dword [esi], 0
mov dword [esi + 4], 0
push 0x810
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.0041b836
push str.Dynamic_code_policy_is_not_allowed___2__r_n
call fcn.00407f00
add esp, 0xc
jmp 0x419cdd
nop dword [eax]
test al, 4
je 0x416246
mov ecx, esi
mov dword [ebp - 4], 7
call fcn.00401b00
mov ecx, dword ds:[esi]
mov byte [esi + 0x80c], 0
test ecx, ecx
je 0x416395
mov eax, dword [esi + 4]
test eax, eax
je 0x416395
add eax, eax
push eax
push 0
push ecx
call fcn.00440bb0
add esp, 0xc
push dword [esi]
call fcn.0041b33a
add esp, 4
mov dword [esi], 0
mov dword [esi + 4], 0
push 0x810
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.0041b836
push str.Dynamic_code_policy_is_not_allowed___3__r_n
call fcn.00407f00
add esp, 0xc
jmp 0x419cdd
mov eax, dword [ebp - 0x984]
test edi, edi
movzx eax, al
mov ecx, 1
cmovne eax, ecx
mov dword [ebp - 0x984], eax
cmp byte [esi + 0x80c], 0
jne 0x4163f8
push str.CommandlineLib_is_not_initialized___5__r_n
call fcn.00407f00
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
int3
mov edi, 1
cmp dword [esi + 8], edi
jle 0x416455
lea eax, [esi + 0x10]
mov dword [ebp - 0x84c], eax
nop
mov ecx, dword [eax]
test ecx, ecx
je 0x416432
push ecx
push str._SavedLogin
call fcn.0042251d
add esp, 8
test eax, eax
je 0x416447
mov eax, dword [ebp - 0x84c]
inc edi
add eax, 4
mov dword [ebp - 0x84c], eax
cmp edi, dword [esi + 8]
jl 0x416410
jmp 0x416455
test edi, edi
je 0x416455
mov dword [0x45eb14], 1
cmp byte [esi + 0x80c], 0
jne 0x41647b
push str.CommandlineLib_is_not_initialized___5__r_n
call fcn.00407f00
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
int3
mov edi, 1
cmp dword [esi + 8], edi
jle 0x4164d2
lea eax, [esi + 0x10]
mov dword [ebp - 0x84c], eax
nop
mov ecx, dword [eax]
test ecx, ecx
je 0x4164b2
push ecx
push str._NoMasterPassword
call fcn.0042251d
add esp, 8
test eax, eax
je 0x4164c7
mov eax, dword [ebp - 0x84c]
inc edi
add eax, 4
mov dword [ebp - 0x84c], eax
cmp edi, dword [esi + 8]
jl 0x416490
jmp 0x4164d2
test edi, edi
je 0x4164d2
mov byte [0x45eb1d], 1
cmp byte [esi + 0x80c], 0
jne 0x4164f8
push str.CommandlineLib_is_not_initialized___5__r_n
call fcn.00407f00
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
int3
mov edi, 1
cmp dword [esi + 8], edi
jle 0x416552
lea eax, [esi + 0x10]
mov dword [ebp - 0x84c], eax
nop
mov ecx, dword [eax]
test ecx, ecx
je 0x416532
push ecx
push str._SkipUpdateMessages
call fcn.0042251d
add esp, 8
test eax, eax
je 0x416547
mov eax, dword [ebp - 0x84c]
inc edi
add eax, 4
mov dword [ebp - 0x84c], eax
cmp edi, dword [esi + 8]
jl 0x416510
jmp 0x416552
test edi, edi
je 0x416552
mov byte [0x45edb0], 1
cmp byte [esi + 0x80c], 0
jne 0x416578
push str.CommandlineLib_is_not_initialized___5__r_n
call fcn.00407f00
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
int3
mov edi, 1
cmp dword [esi + 8], edi
jle 0x4165d2
lea eax, [esi + 0x10]
mov dword [ebp - 0x84c], eax
nop
mov ecx, dword [eax]
test ecx, ecx
je 0x4165b2
push ecx
push str._no_browser
call fcn.0042251d
add esp, 8
test eax, eax
je 0x4165c7
mov eax, dword [ebp - 0x84c]
inc edi
add eax, 4
mov dword [ebp - 0x84c], eax
cmp edi, dword [esi + 8]
jl 0x416590
jmp 0x4165d2
test edi, edi
je 0x4165d2
mov byte [0x45eb96], 1
cmp byte [esi + 0x80c], 0
jne 0x4165f8
push str.CommandlineLib_is_not_initialized___5__r_n
call fcn.00407f00
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
int3
mov edi, 1
cmp dword [esi + 8], edi
jle 0x416652
lea eax, [esi + 0x10]
mov dword [ebp - 0x84c], eax
nop
mov ecx, dword [eax]
test ecx, ecx
je 0x416632
push ecx
push str._no_service
call fcn.0042251d
add esp, 8
test eax, eax
je 0x416647
mov eax, dword [ebp - 0x84c]
inc edi
add eax, 4
mov dword [ebp - 0x84c], eax
cmp edi, dword [esi + 8]
jl 0x416610
jmp 0x416652
test edi, edi
je 0x416652
mov byte [0x45f1f6], 1
cmp byte [esi + 0x80c], 0
jne 0x41669f
push str.CommandlineLib_is_not_initialized___8__r_n
call fcn.00407f00
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
int3
mov edi, 1
cmp dword [esi + 8], edi
jle 0x4166e9
lea eax, [esi + 0x10]
mov dword [ebp - 0x84c], eax
mov ecx, dword [eax]
mov dword [ebp - 0x970], esi
test ecx, ecx
je 0x4166da
push ecx
push str._applaunch
call fcn.0042251d
add esp, 8
test eax, eax
je 0x41676a
mov eax, dword [ebp - 0x84c]
inc edi
add eax, 4
mov dword [ebp - 0x84c], eax
cmp edi, dword [esi + 8]
jl 0x4166b2
mov dword [0x45f8bc], 0
cmp byte [esi + 0x80c], 0
jne 0x416719
push str.CommandlineLib_is_not_initialized___5__r_n
call fcn.00407f00
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
int3
mov edi, 1
cmp dword [esi + 8], edi
jle 0x416a50
lea eax, [esi + 0x10]
mov dword [ebp - 0x84c], eax
mov ecx, dword [eax]
test ecx, ecx
je 0x416756
push ecx
push str._DisableSteamCloud
call fcn.0042251d
add esp, 8
test eax, eax
je 0x416a45
mov eax, dword [ebp - 0x84c]
inc edi
add eax, 4
mov dword [ebp - 0x84c], eax
cmp edi, dword [esi + 8]
jl 0x416732
jmp 0x416a50
test edi, edi
je 0x4166e9
mov eax, dword [esi + 8]
dec eax
cmp edi, eax
je 0x4166e9
mov ecx, dword [esi + edi*4 + 0x10]
movzx eax, word [ecx]
mov edx, eax
cmp eax, 0x2d
je 0x4166e9
cmp edx, 0x2b
je 0x4166e9
push 0xa
push 0
push ecx
call fcn.00423575
add esp, 0xc
mov edi, eax
call fcn.00428feb
cmp dword [eax], 0x22
je 0x4166e9
nop dword [eax + eax]
test edi, edi
je 0x4166e9
mov eax, dword [ebp - 0x970]
mov dword [0x45f8bc], edi
cmp byte [eax + 0x80c], 0
jne 0x41682d
push str.CommandlineLib_is_not_initialized___8__r_n
call fcn.00407f00
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
int3
mov edi, 1
mov esi, eax
cmp dword [eax + 8], edi
jle 0x4168b4
lea ecx, [eax + 0x10]
mov dword [ebp - 0x84c], ecx
mov edx, dword [ecx]
test edx, edx
je 0x41686a
push edx
push str._applaunchOption
call fcn.0042251d
add esp, 8
test eax, eax
je 0x41687b
mov eax, dword [ebp - 0x970]
mov ecx, dword [ebp - 0x84c]
inc edi
add ecx, 4
mov dword [ebp - 0x84c], ecx
cmp edi, dword [eax + 8]
jl 0x416846
jmp 0x4168b4
test edi, edi
je 0x4168b4
mov eax, dword [esi + 8]
dec eax
cmp edi, eax
je 0x4168b4
mov ecx, dword [esi + edi*4 + 0x10]
movzx eax, word [ecx]
mov edx, eax
cmp eax, 0x2d
je 0x4168b4
cmp edx, 0x2b
je 0x4168b4
push 0xa
push 0
push ecx
call fcn.00423575
add esp, 0xc
mov edi, eax
call fcn.00428feb
cmp dword [eax], 0x22
jne 0x4168b6
xor edi, edi
cmp byte [esi + 0x80c], 0
mov dword [0x45e5a0], edi
jne 0x41690e
push str.CommandlineLib_is_not_initialized___7__r_n
call fcn.00407f00
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
int3
mov edi, 1
cmp dword [esi + 8], edi
jle 0x4166f3
lea eax, [esi + 0x10]
mov dword [ebp - 0x84c], eax
mov ecx, dword [eax]
test ecx, ecx
je 0x416943
push ecx
push str._LaunchParameters
call fcn.0042251d
add esp, 8
test eax, eax
je 0x416957
mov eax, dword [ebp - 0x84c]
inc edi
add eax, 4
mov dword [ebp - 0x84c], eax
cmp edi, dword [esi + 8]
jl 0x416925
jmp 0x4166f3
test edi, edi
je 0x4166f3
mov eax, dword [esi + 8]
sub eax, 2
cmp edi, eax
jne 0x4166f3
mov edi, dword [esi + edi*4 + 0x10]
test edi, edi
je 0x4166f3
mov ecx, edi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x416980
sub ecx, edx
sar ecx, 1
cmp ecx, 1
jbe 0x4166f3
push 0x208
lea eax, [ebp - 0x428]
push 0
push eax
lfence
call fcn.0041f350
add esp, 0xc
lea eax, [ebp - 0x428]
push edi
push 0x44a9fc
push 0xffffffffffffffff
push 0x104
push eax
call fcn.00401640
add esp, 0x14
test eax, eax
je 0x4166f3
cmp eax, 0xffffffff
je 0x4166f3
nop
cmp eax, 0x104
jge 0x4166f3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
lea eax, [ebp - 0x428]
push eax
push 0x80
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x4166f3
push 0
push 0
push eax
push 0x45e7d8
push 0xffffffffffffffff
lea eax, [ebp - 0x428]
push eax
push 0x80
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov byte [0x45e34d], 1
nop
jmp 0x4166f3
test edi, edi
je 0x416a50
mov byte [0x45ede1], 1
cmp byte [esi + 0x80c], 0
jne 0x416a78
push str.CommandlineLib_is_not_initialized___5__r_n
nop
call fcn.00407f00
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
int3
mov edi, 1
cmp dword [esi + 8], edi
jle 0x416ad2
lea eax, [esi + 0x10]
mov dword [ebp - 0x84c], eax
nop
mov ecx, dword [eax]
test ecx, ecx
je 0x416ab2
push ecx
push str._AutoExit
call fcn.0042251d
add esp, 8
test eax, eax
je 0x416ac7
mov eax, dword [ebp - 0x84c]
inc edi
add eax, 4
mov dword [ebp - 0x84c], eax
cmp edi, dword [esi + 8]
jl 0x416a90
jmp 0x416ad2
test edi, edi
je 0x416ad2
mov byte [0x45eb1e], 1
mov ecx, esi
mov dword [ebp - 4], 8
call fcn.00401b00
mov ecx, dword [esi]
mov byte [esi + 0x80c], 0
test ecx, ecx
je 0x416b1f
mov eax, dword [esi + 4]
test eax, eax
je 0x416b1f
add eax, eax
push eax
push 0
push ecx
call fcn.00440bb0
add esp, 0xc
push dword [esi]
call fcn.0041b33a
add esp, 4
mov dword [esi], 0
mov dword [esi + 4], 0
push 0x810
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.0041b836
add esp, 8
mov dword [ebp - 0x84c], 0
lea eax, [ebp - 0x98c]
mov dword [ebp - 0x98c], 0
mov edx, str.CertGetNameStringW
mov ecx, str.Crypt32.dll
push 0
push 0
push eax
push 0x45eda8
sub esp, 8
push 1
call fcn.00407a00
add esp, 0x1c
mov byte [ebp - 0x969], al
mov edx, str.WinVerifyTrust
mov ecx, str.Wintrust.dll
push 0
push 0
push 0
push 0x45e7b8
sub esp, 8
push 1
call fcn.00407a00
add esp, 0x1c
mov byte [ebp - 0x978], al
xor edx, edx
mov ecx, str.bcryptprimitives.dll
push 0
push 0
push 0
push 0
sub esp, 8
push 1
call fcn.00407a00
add esp, 0x1c
mov byte [ebp - 0x979], al
mov edx, str.BCryptGenRandom
mov ecx, str.Bcrypt.dll
push 0
push 0
push 0
push 0x45e8e0
sub esp, 8
push 1
call fcn.00407a00
add esp, 0x1c
mov byte [ebp - 0x971], al
lea eax, [ebp - 0x84c]
mov edx, str.ImageGetCertificateData
mov ecx, str.Imagehlp.dll
push 0
push 0
push eax
push 0x45eb08
sub esp, 8
push 1
call fcn.00407a00
add esp, 0x1c
cmp byte [ebp - 0x969], 0
je 0x419cc6
cmp byte [ebp - 0x978], 0
je 0x419cc6
cmp byte [ebp - 0x979], 0
je 0x419cc6
cmp byte ds:[ebp - 0x971], 0
je 0x419cc6
test al, al
je 0x419cc6
mov esi, dword [ebp - 0x84c]
mov edx, str.ImageEnumerateCertificates
mov eax, dword [0x45eda8]
mov ecx, str.Imagehlp.dll
push 0
push esi
push 0
mov dword [0x45e5ac], eax
mov eax, dword [0x45e7b8]
push 0x45eb54
mov dword [0x45edcc], eax
sub esp, 8
mov eax, dword [0x45e8e0]
mov dword [0x45eb2c], eax
mov eax, dword [0x45eb08]
push 1
mov dword [0x45eb58], eax
call fcn.00407a00
add esp, 0x1c
mov byte [ebp - 0x971], al
mov edx, str.ImageGetCertificateHeader
mov ecx, str.Imagehlp.dll
push 0
push esi
push 0
push 0x45e35c
sub esp, 8
push 1
call fcn.00407a00
mov esi, dword [ebp - 0x98c]
add esp, 0x1c
mov edx, str.CryptVerifyMessageSignature
mov byte [ebp - 0x979], al
mov ecx, str.Crypt32.dll
push 0
push esi
push 0
push 0x45eb44
sub esp, 8
push 1
call fcn.00407a00
add esp, 0x1c
mov byte [ebp - 0x978], al
mov edx, str.CertFreeCertificateContext
mov ecx, str.Crypt32.dll
push 0
push esi
push 0
push 0x45e358
sub esp, 8
push 1
call fcn.00407a00
add esp, 0x1c
mov byte [ebp - 0x969], al
mov edx, str.CryptProtectData
mov ecx, str.Crypt32.dll
push 0
push esi
push 0
push 0x45eb6c
sub esp, 8
push 1
call fcn.00407a00
add esp, 0x1c
mov byte [ebp - 0x97a], al
mov edx, str.CryptUnprotectData
mov ecx, str.Crypt32.dll
push 0
push esi
push 0
push 0x45f8c4
sub esp, 8
push 1
call fcn.00407a00
add esp, 0x1c
cmp byte [ebp - 0x971], 0
je 0x419cbc
cmp byte [ebp - 0x979], 0
je 0x419cbc
cmp byte [ebp - 0x978], 0
je 0x419cbc
cmp byte ds:[ebp - 0x969], 0
je 0x419cbc
cmp byte [ebp - 0x97a], 0
je 0x419cbc
test al, al
je 0x419cbc
mov eax, dword [0x45eb54]
xor edx, edx
push 0
mov dword [0x45edd4], eax
mov ecx, str.Advapi32.dll
mov eax, dword [0x45e35c]
push 0
mov dword [0x45f6a0], eax
mov eax, dword [0x45eb44]
push 0x45edbc
mov dword [0x45eb0c], eax
mov eax, dword [0x45e358]
push 0
mov dword [0x45f8d0], eax
sub esp, 8
mov eax, dword [0x45eb6c]
mov dword [0x45eaf8], eax
mov eax, dword [0x45f8c4]
push 1
mov dword [0x45f634], eax
call fcn.00407a00
add esp, 0x1c
mov byte [ebp - 0x97a], al
xor edx, edx
mov ecx, str.GDI32.dll
push 0
push 0
push 0
push 0
sub esp, 8
push 1
call fcn.00407a00
add esp, 0x1c
mov byte [ebp - 0x971], al
xor edx, edx
mov ecx, str.User32.dll
push 0
push 0
push 0x45f69c
push 0
sub esp, 8
push 1
call fcn.00407a00
add esp, 0x1c
mov byte [ebp - 0x979], al
xor edx, edx
mov ecx, str.Shell32.dll
push 0
push 0
push 0
push 0
sub esp, 8
push 1
call fcn.00407a00
add esp, 0x1c
mov byte [ebp - 0x978], al
xor edx, edx
mov ecx, str.ole32.dll
push 0
push 0
push 0
push 0
sub esp, 8
push 1
call fcn.00407a00
add esp, 0x1c
mov byte [ebp - 0x969], al
xor edx, edx
mov ecx, str.WINMM.dll
push 0
push 0
push 0
push 0
sub esp, 8
push 1
call fcn.00407a00
add esp, 0x1c
mov byte [ebp - 0x985], al
push 0
push 0
push 0
push 0
sub esp, 8
xor edx, edx
mov ecx, str.IPHLPAPI.dll
push 1
call fcn.00407a00
add esp, 0x1c
mov byte [ebp - 0x987], al
xor edx, edx
mov ecx, str.VERSION.dll
push 0
push 0
push 0
push 0
sub esp, 8
push 1
call fcn.00407a00
add esp, 0x1c
mov byte [ebp - 0x986], al
xor edx, edx
mov ecx, str.WS2_32.dll
push 0
push 0
push 0
push 0
sub esp, 8
push 1
call fcn.00407a00
add esp, 0x1c
mov byte [ebp - 0x97b], al
xor edx, edx
mov ecx, str.MSWSOCK.dll
push 0
push 0
push 0
push 0
sub esp, 8
push 1
call fcn.00407a00
add esp, 0x1c
mov byte [ebp - 0x972], al
xor edx, edx
mov ecx, str.Secur32.dll
push 0
push 0
push 0
push 0
sub esp, 8
push 1
call fcn.00407a00
add esp, 0x1c
mov byte [ebp - 0x973], al
xor edx, edx
mov ecx, str.WSOCK32.dll
push 0
push 0
push 0
push 0
sub esp, 8
push 1
call fcn.00407a00
add esp, 0x1c
mov byte [ebp - 0x974], al
xor edx, edx
mov ecx, str.Imm32.dll
push 0
push 0
push 0x45eb48
push 0
sub esp, 8
push 1
call fcn.00407a00
add esp, 0x1c
mov byte [ebp - 0x977], al
push 0
push 0
push 0x45eb3c
push 0
sub esp, 8
xor edx, edx
push 1
mov ecx, str.Psapi.dll
call fcn.00407a00
add esp, 0x1c
mov byte [ebp - 0x975], al
xor edx, edx
mov ecx, str.SETUPAPI.dll
push 0
push 0
push 0
push 0
sub esp, 8
push 1
call fcn.00407a00
add esp, 0x1c
mov byte [ebp - 0x976], al
xor edx, edx
mov ecx, str.OLEAUT32.dll
push 0
push 0
push 0
push 0
sub esp, 8
push 1
call fcn.00407a00
add esp, 0x1c
mov byte [ebp - 0x96a], al
xor edx, edx
mov ecx, str.SHLWAPI.dll
push 0
push 0
push 0
push 0
sub esp, 8
push 1
call fcn.00407a00
add esp, 0x1c
cmp byte [ebp - 0x97a], 0
je 0x419cb2
cmp byte ds:[ebp - 0x971], 0
je 0x419cb2
cmp byte [ebp - 0x979], 0
je 0x419cb2
cmp byte ds:[ebp - 0x978], 0
je 0x419cb2
cmp byte [ebp - 0x969], 0
je 0x419cb2
cmp byte ds:[ebp - 0x985], 0
je 0x419cb2
cmp byte [ebp - 0x987], 0
je 0x419cb2
cmp byte ds:[ebp - 0x986], 0
je 0x419cb2
cmp byte [ebp - 0x97b], 0
je 0x419cb2
cmp byte ds:[ebp - 0x972], 0
je 0x419cb2
cmp byte [ebp - 0x973], 0
je 0x419cb2
cmp byte ds:[ebp - 0x974], 0
je 0x419cb2
cmp byte [ebp - 0x977], 0
je 0x419cb2
cmp byte ds:[ebp - 0x975], 0
je 0x419cb2
cmp byte [ebp - 0x976], 0
je 0x419cb2
cmp byte ds:[ebp - 0x96a], 0
je 0x419cb2
test al, al
je 0x419cb2
push 0x415950
call fcn.00429882
add esp, 4
push 0x415980
call fcn.0042a100
add esp, 4
push 0
push 0
push 0
push 0x4154e0
push 0
push 0
call fcn.0042954c
add esp, 0x18
mov dword [ebp - 0x9e0], eax
test eax, eax
jne 0x417193
push str.Failed_to_start_thread__r_n
jmp 0x419cd5
cmp byte [ebp - 0x984], 1
jne 0x4171ad
push 6
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push str.SteamLite
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
xor eax, eax
xorps xmm0, xmm0
mov word [ebp - 0x8a8], ax
mov dword [ebp - 0x896], eax
lea eax, [ebp - 0x8a8]
push eax
push 0xfffffffffffffff5
movups xmmword [ebp - 0x8a6], xmm0
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
cmp eax, 1
jne 0x417228
mov ecx, 0x2329
cmp word [ebp - 0x8a6], cx
je 0x417228
push 0xfffffffffffffff5
mov dword [ebp - 0x84c], 0x23290078
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push dword [ebp - 0x84c]
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferSize]
push 0x208
lea eax, [ebp - 0x220]
push 0
push eax
call fcn.0041f350
add esp, 0xc
lea eax, [ebp - 0x630]
push 0x208
push 0
push eax
call fcn.0041f350
add esp, 0xc
lea eax, [ebp - 0x220]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x41729e
push str.Unable_to_get_exe_path__1___n
mov ecx, 0xc
call fcn.00414e80
mov dl, 1
add esp, 4
mov cl, dl
call fcn.004097c0
push str.Press_enter_to_exit_
call fcn.00403aa0
add esp, 4
call fcn.00419d20
jmp 0x419cdd
nop
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x4172b2
push str.Unable_to_get_exe_path__2___n
jmp 0x417271
lea eax, ds:[ebp - 0x220]
push str.SteamLite.exe
push eax
call fcn.0041ea9c
add esp, 8
test eax, eax
jne 0x4172d3
push str.Unable_to_get_exe_path__3___n
jmp 0x417271
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x630]
push 0x104
push eax
call fcn.00429d55
add esp, 0xc
lea eax, [ebp - 0x220]
push 0x5c
push eax
call fcn.0041ed20
add esp, 8
test eax, eax
je 0x417309
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x220]
push eax
push str._sSteamLiteData
push 0xffffffffffffffff
push 0x104
push 0x45e8f0
call fcn.00401640
add esp, 0x14
lea eax, [ebp - 0x220]
push eax
push str._sEncryptedAppTickets
push 0xffffffffffffffff
push 0x104
push 0x45e5b0
call fcn.00401640
add esp, 0x14
lea eax, [ebp - 0x220]
push eax
push str._sAppOwnershipTickets
push 0xffffffffffffffff
push 0x104
push 0x45f420
call fcn.00401640
add esp, 0x14
push 0x208
call fcn.0041b33f
add esp, 4
mov edi, eax
mov dword [ebp - 0x980], edi
push 0x208
push 0
push edi
call fcn.0041f350
add esp, 0xc
lea eax, [ebp - 0x220]
push eax
push str._sPointerAuthentication.dll
push 0xffffffffffffffff
push 0x104
push edi
call fcn.00401640
add esp, 0x14
cmp eax, 0xffffffff
jne 0x4173b9
push str.Unable_to_get_dll_paths__1___n
jmp 0x417271
lea eax, [ebp - 0x220]
push eax
push str._sApplist.log
push 0xffffffffffffffff
push 0x104
push 0x45e378
call fcn.00401640
add esp, 0x14
push 0x45e378
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x208
call fcn.0041b33f
add esp, 4
mov esi, eax
push 0x208
push 0
push esi
call fcn.0041f350
add esp, 0xc
lea eax, [ebp - 0x220]
push eax
push str._spackage_beta
push 0xffffffffffffffff
push 0x104
push esi
call fcn.00401640
add esp, 0x14
cmp eax, 0xffffffff
jne 0x417437
push str.Unable_to_get_beta_file_path__n
jmp 0x417271
push 0
push 0x80
push 3
push 0
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x41746b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.You_are_using_Steam_beta_files__SteamLite_might_not_work_correctly__n_n
mov ecx, 0xc
call fcn.00414e80
add esp, 4
push esi
call fcn.0041b33a
add esp, 4
lea eax, [ebp - 0x220]
push eax
push 0x44a9fc
push 0xffffffffffffffff
push 0x104
push 0x45eba0
call fcn.00401640
add esp, 0x14
cmp eax, 0xffffffff
jne 0x4174a5
push str.Unable_to_build_path_for_file_search__n
nop
jmp 0x417271
push 1
push 0x4159a0
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
lea eax, [ebp - 0x969]
mov byte [ebp - 0x969], 0
push eax
lea edx, [ebp - 0x220]
lea ecx, [ebp - 0x630]
call fcn.004151c0
add esp, 4
cmp byte [ebp - 0x969], 1
jne 0x4174f8
push str.Failed_to_set_environment_variables__n
mov ecx, 0xc
call fcn.00414e80
add esp, 4
xor dl, dl
mov cl, 1
jmp 0x417282
mov ecx, dword ds:[ebp - 0x98c]
lea eax, [ebp - 0x970]
push eax
lea edx, [ebp - 0x969]
mov dword [ebp - 0x970], 0
mov byte [ebp - 0x969], 0
call fcn.0040aa00
add esp, 4
test al, al
jne 0x417594
cmp dword [0x45f404], 0
mov esi, dword [ebp - 0x970]
je 0x417544
nop
test esi, esi
jne 0x41755a
push str.SteamLite_update_check_init_error__n_n
mov ecx, 0xc
call fcn.00414e80
add esp, 4
test esi, esi
je 0x41756b
push esi
mov esi, dword [0x45eb18]
mov ecx, esi
call dword [0x442244]
call esi
push str.Unable_to_check_for_SteamLite_updates__n
mov ecx, 0xc
call fcn.00414e80
add esp, 4
cmp byte [ebp - 0x969], 1
jne 0x4174ef
push str._nPotential_TLS_man_in_the_middle_attack_detected__n
jmp 0x4174e2
xorps xmm0, xmm0
xor esi, esi
movlpd qword [ebp - 0x848], xmm0
jmp 0x4175a9
mov edi, dword [ebp - 0x980]
test esi, esi
jne 0x4175d1
push esi
push 0x80
push 3
push esi
push esi
push 0x80000000
lea eax, [ebp - 0x630]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x848], eax
jmp 0x4175f5
cmp esi, 1
jne 0x4175f5
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x844], eax
mov edi, dword ds:[ebp + esi*4 - 0x848]
cmp edi, 0xffffffff
je 0x419c92
push 0x208
lea eax, [ebp - 0x428]
push 0
push eax
call fcn.0041f350
add esp, 0xc
lea eax, [ebp - 0x428]
push 0
push 0x104
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFinalPathNameByHandleW]
cmp eax, 0x104
jae 0x419c66
nop
cmp eax, 6
jb 0x419c39
test esi, esi
jne 0x417655
lea ecx, [ebp - 0x630]
jmp 0x417664
cmp esi, 1
jne 0x419c12
mov ecx, dword [ebp - 0x980]
lea edx, [ebp - 0x420]
call fcn.00404f80
test al, al
je 0x419c12
push 0x34
lea eax, [ebp - 0x8dc]
push 0
push eax
call fcn.0041f350
add esp, 0xc
lea eax, [ebp - 0x8dc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
nop dword [eax + eax]
test eax, eax
je 0x419be5
cmp dword [ebp - 0x8b4], 1
jne 0x419ba9
push 0x34
lea eax, [ebp - 0x8dc]
push 0
push eax
call fcn.00440bb0
inc esi
add esp, 0xc
cmp esi, 2
jb 0x4175a3
push 0x20a
lea eax, [ebp - 0x840]
push 0
push eax
call fcn.0041f350
add esp, 0xc
lea eax, [ebp - 0x840]
push 0x105
push eax
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x848]
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationByHandleW]
cmp eax, 1
jne 0x41773e
lea eax, ds:[ebp - 0x840]
push str.NTFS
push eax
call fcn.0042251d
add esp, 8
test eax, eax
je 0x41773e
push str.SteamLite_is_designed_to_run_on_NTFS_drives__n_n
mov ecx, 0xc
call fcn.00414e80
add esp, 4
xor edi, edi
mov esi, dword ds:[ebp + edi*4 - 0x848]
lea eax, [ebp - 0x969]
mov ecx, dword [ebp - 0x970]
mov edx, esi
push edi
push eax
mov byte [ebp - 0x969], 0
call fcn.0040a5a0
add esp, 8
mov byte [ebp - 0x96a], al
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte ds:[ebp - 0x969], 1
je 0x419b88
cmp byte [ebp - 0x96a], 0
je 0x419b67
cmp edi, 1
je 0x4177a5
inc edi
cmp edi, 2
jb 0x417740
nop
jmp 0x41789b
mov ecx, dword [ebp - 0x980]
lea eax, [ebp - 0x84c]
push 0
push 0
push eax
push 0
sub esp, 8
mov dword [ebp - 0x84c], 0
xor edx, edx
push 0
call fcn.00407a00
add esp, 0x1c
test al, al
je 0x419b46
mov esi, dword [ebp - 0x84c]
push str.Init
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.AllocatePointerHashStorage
push esi
mov dword [0x45f654], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.Keygen
push esi
mov dword [0x45f8c8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.FreeKeygen
push esi
mov dword [0x45eb64], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.ProtectPointer
push esi
mov dword [0x45f400], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.VerifyPointer
push esi
mov dword [0x45f650], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp dword [0x45f654], 0
mov dword [0x45edc4], eax
je 0x419b25
cmp dword [0x45f8c8], 0
nop
je 0x419b25
cmp dword [0x45eb64], 0
je 0x419b25
cmp dword [0x45f400], 0
nop word [eax + eax]
je 0x419b25
cmp dword [0x45f650], 0
je 0x419b25
test eax, eax
je 0x419b25
push dword [ebp - 0x980]
call fcn.0041b33a
mov esi, dword ds:[ebp - 0x970]
lea edx, [ebp - 0x969]
add esp, 4
mov byte [ebp - 0x969], 0
mov ecx, esi
call fcn.00406c80
push esi
mov esi, dword [0x45eb18]
mov ecx, esi
mov byte [ebp - 0x96a], al
call dword [0x442244]
call esi
cmp byte [ebp - 0x969], 1
jne 0x4178ef
push str.Potential_TLS_man_in_the_middle_attack_detected___3__n
jmp 0x4174e2
cmp byte [ebp - 0x96a], 0
jne 0x417905
push str.Failed_to_get_WVT_Policy__n
nop dword [eax]
jmp 0x4174e2
mov esi, dword [0x45f654]
mov ecx, esi
call dword [0x442244]
call esi
cmp al, 1
jne 0x419b19
mov esi, dword [0x45f8c8]
mov ecx, esi
push 1
call dword [0x442244]
call esi
add esp, 4
cmp al, 1
jne 0x419b0f
mov esi, dword [0x45eb64]
mov ecx, esi
push 0x45f630
call dword [0x442244]
call esi
add esp, 4
mov dword [0x45f65c], eax
test eax, eax
je 0x419b05
movzx ecx, word [0x45f630]
mov esi, dword [0x45f650]
push ecx
push eax
mov eax, dword [ebx + 4]
mov ecx, esi
push eax
call dword [0x442244]
call esi
add esp, 0xc
test al, al
jne 0x41798e
push str.PointerAuthentication_Protect_Failed__n
jmp 0x4174e2
push str.SteamLite_Started__n_n
call fcn.00403aa0
add esp, 4
lea ecx, [ebp - 0x220]
call fcn.00414f60
push 0x208
mov dword [ebp - 0x980], eax
call fcn.0041b33f
add esp, 4
mov esi, eax
mov dword [ebp - 0x98c], esi
push 0x208
push 0
push esi
call fcn.0041f350
add esp, 0xc
push 0x208
call fcn.0041b33f
add esp, 4
mov dword [ebp - 0x9c8], eax
push 0x208
push 0
push eax
call fcn.0041f350
add esp, 0xc
push 0x208
call fcn.0041b33f
add esp, 4
mov dword [ebp - 0x9c4], eax
push 0x208
push 0
push eax
call fcn.0041f350
add esp, 0xc
push 0x208
call fcn.0041b33f
add esp, 4
mov edi, eax
mov dword [ebp - 0x9e4], edi
push 0x208
push 0
push edi
call fcn.0041f350
add esp, 0xc
push 0x208
call fcn.0041b33f
add esp, 4
mov dword [ebp - 0x9c0], eax
push 0x208
push 0
push eax
call fcn.0041f350
add esp, 0xc
push 0x208
call fcn.0041b33f
add esp, 4
mov dword [ebp - 0x9bc], eax
push 0x208
push 0
push eax
call fcn.0041f350
add esp, 0xc
push 0x208
call fcn.0041b33f
add esp, 4
mov dword [ebp - 0x9b8], eax
push 0x208
push 0
push eax
call fcn.0041f350
add esp, 0xc
push 0x208
call fcn.0041b33f
add esp, 4
mov dword [ebp - 0x9b4], eax
push 0x208
push 0
push eax
call fcn.0041f350
add esp, 0xc
push 0x208
call fcn.0041b33f
add esp, 4
mov dword [ebp - 0x9ac], eax
push 0x208
push 0
push eax
call fcn.0041f350
add esp, 0xc
push 0x208
call fcn.0041b33f
add esp, 4
mov dword [ebp - 0x9a8], eax
push 0x208
push 0
push eax
call fcn.0041f350
add esp, 0xc
push 0x208
call fcn.0041b33f
add esp, 4
mov dword [ebp - 0x9a4], eax
push 0x208
push 0
push eax
call fcn.0041f350
add esp, 0xc
push 0x208
call fcn.0041b33f
add esp, 4
mov dword [ebp - 0x9cc], eax
push 0x208
push 0
push eax
call fcn.0041f350
add esp, 0xc
push 0x208
call fcn.0041b33f
add esp, 4
mov dword [ebp - 0x9a0], eax
push 0x208
push 0
push eax
call fcn.0041f350
add esp, 0xc
push 0x208
call fcn.0041b33f
add esp, 4
mov dword [ebp - 0x99c], eax
push 0x208
push 0
push eax
call fcn.0041f350
add esp, 0xc
push 0x208
call fcn.0041b33f
add esp, 4
mov dword [ebp - 0x998], eax
push 0x208
push 0
push eax
call fcn.0041f350
add esp, 0xc
push 0x208
call fcn.0041b33f
add esp, 4
mov dword [ebp - 0x994], eax
push 0x208
push 0
push eax
call fcn.0041f350
add esp, 0xc
push 0x208
call fcn.0041b33f
add esp, 4
mov dword [ebp - 0x990], eax
push 0x208
push 0
push eax
call fcn.0041f350
add esp, 0xc
push 0x208
call fcn.0041b33f
add esp, 4
mov dword [ebp - 0x9b0], eax
push 0x208
push 0
push eax
call fcn.0041f350
add esp, 0xc
push 0x208
call fcn.0041b33f
add esp, 4
mov dword [ebp - 0x9dc], eax
push 0x208
push 0
push eax
call fcn.0041f350
add esp, 0xc
push 0x208
call fcn.0041b33f
add esp, 4
mov dword [ebp - 0x84c], eax
push 0x208
push 0
push eax
call fcn.0041f350
add esp, 0xc
lea eax, [ebp - 0x220]
push eax
push str._s_steamclient.dll
push 0xffffffffffffffff
push 0x104
push esi
call fcn.00401640
add esp, 0x14
mov dword [ebp - 0x92c], eax
lea eax, [ebp - 0x220]
push eax
push str._s_vstdlib_s.dll
push 0xffffffffffffffff
push 0x104
push dword [ebp - 0x9c8]
call fcn.00401640
add esp, 0x14
mov dword [ebp - 0xa1c], eax
lea eax, [ebp - 0x220]
push eax
push str._s_tier0_s.dll
push 0xffffffffffffffff
push 0x104
push dword [ebp - 0x9c4]
call fcn.00401640
add esp, 0x14
mov dword [ebp - 0xa18], eax
lea eax, [ebp - 0x220]
push eax
push str._sSDL3.dll
push 0xffffffffffffffff
push 0x104
push dword [ebp - 0x9a0]
call fcn.00401640
add esp, 0x14
mov dword [ebp - 0xa10], eax
lea eax, [ebp - 0x220]
push eax
push str._s_video.dll
push 0xffffffffffffffff
push 0x104
push dword [ebp - 0x99c]
call fcn.00401640
add esp, 0x14
mov dword [ebp - 0xa0c], eax
lea eax, [ebp - 0x220]
push eax
push str._slibavcodec_61.dll
push 0xffffffffffffffff
push 0x104
push dword [ebp - 0x998]
call fcn.00401640
mov dword [ebp - 0xa08], eax
add esp, 0x14
lea eax, [ebp - 0x220]
push eax
push str._slibavformat_61.dll
push 0xffffffffffffffff
push 0x104
push dword [ebp - 0x994]
call fcn.00401640
add esp, 0x14
mov dword [ebp - 0xa04], eax
lea eax, [ebp - 0x220]
push eax
push str._slibswresample_5.dll
push 0xffffffffffffffff
push 0x104
push dword [ebp - 0x990]
call fcn.00401640
add esp, 0x14
mov dword [ebp - 0xa24], eax
lea eax, [ebp - 0x220]
push eax
push str._slibavutil_59.dll
push 0xffffffffffffffff
push 0x104
push dword [ebp - 0x9b0]
call fcn.00401640
add esp, 0x14
mov dword [ebp - 0xa00], eax
lea eax, [ebp - 0x220]
push eax
push str._slibswscale_8.dll
push 0xffffffffffffffff
push 0x104
push dword [ebp - 0x9dc]
call fcn.00401640
add esp, 0x14
mov dword [ebp - 0xa14], eax
lea eax, [ebp - 0x220]
push eax
push str._slibavfilter_10.dll
push 0xffffffffffffffff
push 0x104
push dword [ebp - 0x84c]
call fcn.00401640
add esp, 0x14
mov dword [ebp - 0x9f4], eax
lea eax, [ebp - 0x220]
push eax
push str._s_bin_steamservice.dll
push 0xffffffffffffffff
push 0x104
push edi
call fcn.00401640
add esp, 0x14
mov dword [ebp - 0x9f8], eax
lea eax, [ebp - 0x220]
push eax
push str._s_bin_secure_desktop_capture.exe
push 0xffffffffffffffff
push 0x104
push dword [ebp - 0x9c0]
call fcn.00401640
add esp, 0x14
mov dword [ebp - 0x9fc], eax
lea eax, [ebp - 0x220]
push eax
push str._s_bindrivers.exe
push 0xffffffffffffffff
push 0x104
push dword [ebp - 0x9bc]
call fcn.00401640
add esp, 0x14
mov dword [ebp - 0xa20], eax
lea eax, [ebp - 0x220]
push eax
push str._s_bingldriverquery.exe
push 0xffffffffffffffff
push 0x104
push dword [ebp - 0x9b8]
call fcn.00401640
mov dword [ebp - 0x9e8], eax
add esp, 0x14
lea eax, [ebp - 0x220]
push eax
push str._s_bingldriverquery64.exe
push 0xffffffffffffffff
push 0x104
push dword [ebp - 0x9b4]
call fcn.00401640
add esp, 0x14
mov dword [ebp - 0x9ec], eax
lea eax, [ebp - 0x220]
push eax
push str._s_bin_vulkandriverquery.exe
push 0xffffffffffffffff
push 0x104
push dword [ebp - 0x9ac]
call fcn.00401640
add esp, 0x14
mov dword [ebp - 0x9f0], eax
lea eax, [ebp - 0x220]
push eax
push str._s_bin_vulkandriverquery64.exe
push 0xffffffffffffffff
push 0x104
push dword [ebp - 0x9a8]
call fcn.00401640
add esp, 0x14
mov dword [ebp - 0x9d0], eax
lea eax, [ebp - 0x220]
push eax
push str._s_bin_steamxboxutil.exe
push 0xffffffffffffffff
push 0x104
push dword [ebp - 0x9a4]
call fcn.00401640
add esp, 0x14
mov dword [ebp - 0x9d4], eax
lea eax, [ebp - 0x220]
push eax
push str._s_bin_steamxboxutil64.exe
push 0xffffffffffffffff
push 0x104
push dword [ebp - 0x9cc]
call fcn.00401640
add esp, 0x14
mov dword [ebp - 0x9d8], eax
push 0x208
call fcn.0041b33f
add esp, 4
mov esi, eax
mov dword [ebp - 0x850], esi
push 0x208
push 0
push esi
call fcn.0041f350
add esp, 0xc
lea eax, [ebp - 0x220]
push eax
push str._s_steamclient64.dll
push 0xffffffffffffffff
push 0x104
push esi
call fcn.00401640
add esp, 0x14
mov dword [ebp - 0x844], eax
push 0x208
call fcn.0041b33f
add esp, 4
mov edi, eax
mov dword [ebp - 0x970], edi
push 0x208
push 0
push edi
call fcn.0041f350
add esp, 0xc
push 0x208
call fcn.0041b33f
add esp, 4
mov dword [ebp - 0x984], eax
push 0x208
push 0
push eax
call fcn.0041f350
add esp, 0xc
push 0x208
call fcn.0041b33f
add esp, 4
mov esi, eax
push 0x208
push 0
push esi
call fcn.0041f350
mov eax, dword [ebp - 0x980]
add esp, 0xc
mov dword [0x45f644], esi
cmp eax, 1
jne 0x418079
lea eax, [ebp - 0x220]
push eax
push str._s_bincefcef.win7x64_steamwebhelper.exe
push 0xffffffffffffffff
push 0x104
push edi
call fcn.00401640
add esp, 0x14
mov esi, eax
jmp 0x418091
cmp eax, 2
jne 0x41808c
lea eax, [ebp - 0x220]
push eax
push str._s_bincefcef.win7_steamwebhelper.exe
jmp 0x418065
mov esi, 0xfffffffe
lea ecx, [ebp - 0x220]
call fcn.00415080
mov edi, eax
lea eax, [ebp - 0x220]
push eax
push str._s_steam.exe
push 0xffffffffffffffff
push 0x104
push dword [ebp - 0x984]
mov dword [ebp - 0x930], edi
call fcn.00401640
add esp, 0x14
cmp dword [ebp - 0x92c], 0xffffffff
je 0x419af8
cmp dword ds:[ebp - 0xa1c], 0xffffffff
je 0x419af8
cmp dword [ebp - 0xa18], 0xffffffff
je 0x419af8
cmp dword ds:[ebp - 0xa10], 0xffffffff
je 0x419af8
cmp dword [ebp - 0xa0c], 0xffffffff
je 0x419af8
cmp dword ds:[ebp - 0xa08], 0xffffffff
je 0x419af8
cmp dword [ebp - 0xa04], 0xffffffff
je 0x419af8
cmp dword ds:[ebp - 0xa24], 0xffffffff
je 0x419af8
cmp dword [ebp - 0xa00], 0xffffffff
je 0x419af8
cmp dword ds:[ebp - 0xa14], 0xffffffff
je 0x419af8
cmp dword [ebp - 0x9f4], 0xffffffff
je 0x419af8
cmp dword ds:[ebp - 0x9f8], 0xffffffff
je 0x419af8
cmp dword [ebp - 0x9fc], 0xffffffff
je 0x419af8
cmp dword ds:[ebp - 0xa20], 0xffffffff
je 0x419af8
cmp dword [ebp - 0x9e8], 0xffffffff
je 0x419af8
cmp dword ds:[ebp - 0x9ec], 0xffffffff
je 0x419af8
cmp dword [ebp - 0x9f0], 0xffffffff
je 0x419af8
mov ecx, 0xc
call fcn.00414e80
add esp, 4
xor dl, dl
mov cl, 1
call fcn.004097c0
push str.Press_enter_to_exit_
call fcn.00403aa0
add esp, 4
call fcn.00419d20
movzx eax, word [0x45f630]
push 1
push eax
push dword [0x45f65c]
mov eax, dword [ebx + 4]
mov esi, dword [0x45edc4]
mov ecx, esi
push eax
call dword [0x442244]
call esi
add esp, 0x10
jmp 0x419cdd
push str.Unable_to_get_dll_paths__2___n
nop dword [eax]
jmp 0x418450
push str.PointerAuthentication_Keygen_Failed__n
jmp 0x4174e2
push str.PointerAuthentication_Alloc_Failed__n
jmp 0x4174e2
push str.PointerAuthentication_Init_Failed__n
nop
jmp 0x4174e2
mov esi, dword [ebp - 0x970]
push esi
mov esi, dword [0x45eb18]
mov ecx, esi
call dword [0x442244]
call esi
push str.Failed_to_get_functions_in_PointerAuthentication_dll__n
jmp 0x4174e2
mov esi, dword [ebp - 0x970]
push esi
mov esi, dword [0x45eb18]
mov ecx, esi
call dword [0x442244]
call esi
push str.Failed_to_load_PointerAuthentication_dll__n
jmp 0x4174e2
mov esi, dword [ebp - 0x970]
push esi
mov esi, dword [0x45eb18]
mov ecx, esi
call dword [0x442244]
call esi
push str.Digital_Signature_Verification_Failed__n
jmp 0x4174e2
mov esi, dword [ebp - 0x970]
push esi
mov esi, dword [0x45eb18]
mov ecx, esi
call dword [0x442244]
call esi
push str.Potential_TLS_man_in_the_middle_attack_detected___2__n
jmp 0x4174e2
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword ds:[ebp - 0x970]
mov esi, dword [0x45eb18]
mov ecx, esi
call dword [0x442244]
call esi
push 0x34
lea eax, [ebp - 0x8dc]
push 0
push eax
call fcn.00440bb0
add esp, 0xc
push str.SteamLite_files_has_more_than_one_link___2__n
jmp 0x417271
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword ds:[ebp - 0x970]
mov esi, dword [0x45eb18]
mov ecx, esi
call dword [0x442244]
call esi
push str.Failed_to_get_info_about_SteamLite_files__n
jmp 0x417271
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x970]
mov esi, dword [0x45eb18]
mov ecx, esi
call dword [0x442244]
call esi
push str.SteamLite_files_has_more_than_one_link___1__n
jmp 0x417271
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x970]
mov esi, dword [0x45eb18]
mov ecx, esi
call dword [0x442244]
call esi
push str.GetFinalPathNameByHandle_Failed___2__n
jmp 0x417271
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword ds:[ebp - 0x970]
mov esi, dword [0x45eb18]
mov ecx, esi
call dword [0x442244]
call esi
push str.GetFinalPathNameByHandle_Failed___1__n
jmp 0x417271
push dword [ebp - 0x970]
mov esi, dword [0x45eb18]
mov ecx, esi
call dword [0x442244]
call esi
push str.Failed_to_open_SteamLite_files__n
jmp 0x417271
push str.Unable_to_load_system_dlls__r_n
jmp 0x419cd5
push str.Failed_to_get_functions_from_Imagehlp.dll_or_Crypt32.dll__r_n
jmp 0x419cd5
push str.Failed_to_load_Bcryptprimitives.dll__Bcrypt.dll__Wintrust.dll__Imagehlp.dll_or_Crypt32.dll__r_n
jmp 0x419cd5
push str.Failed_to_allocate_memory_for_commandline_class__r_n
call fcn.00407f00
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041b32c
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret