Function at 0x40dfb3
Capabilities:
Create process on windows
Delete file

Disassembly:
push 0x4b4
mov eax, 0x540926
call fcn.004e6a52
mov edi, ecx
push str.Steam.exe
lea ecx, [ebp - 0xe8]
call fcn.004024f3
xor ebx, ebx
lea ecx, [ebp - 0xd0]
push str.SteamService.exe
mov dword [ebp - 4], ebx
call fcn.004024f3
push str.steamwebhelper.exe
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 1
call fcn.004024f3
mov dword [ebp - 4], 2
lea eax, [ebp - 0xa0]
push dword [ebp - 0x49c]
lea ecx, [ebp - 0x4c0]
mov dword [ebp - 0x4c0], ebx
push eax
lea eax, [ebp - 0xe8]
mov dword [ebp - 0x4bc], ebx
push eax
mov dword [ebp - 0x4b8], ebx
call fcn.00413a39
push fcn.004024ae
push 3
push 0x18
pop eax
push eax
lea eax, [ebp - 0xe8]
mov byte [ebp - 4], 4
push eax
call fcn.004e668d
lea ecx, [ebp - 0x4c0]
call fcn.00402029
push 0xffffffffffffffff
push str.edit
lea ecx, [edi + 4]
call fcn.004233d5
push ebx
lea ecx, [ebp - 0x49c]
push ecx
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x3c]
mov byte [ebp - 4], 5
mov esi, dword [eax]
push esi
call fcn.004ff4a6
pop ecx
push eax
lea ebx, [edi + 0x3e8]
push esi
mov ecx, ebx
call fcn.004025b8
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x49c]
add ecx, 0xfffffff4
cmp ecx, dword [section..data]
je 0x40e0af
call fcn.00407915
mov byte [ebp - 4], 4
cmp dword [edi + 0x3f8], 0x14
jae 0x40e166
lea ecx, [ebp - 0x498]
call fcn.00408b9a
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x498]
push dword [edi + 0x248]
call fcn.00427aed
lea ecx, [ebp - 0x498]
call fcn.00427a31
push 0x18
pop ebx
mov esi, dword [ebp - 0x4c0]
test esi, esi
je 0x40e160
mov edi, dword [ebp - 0x4bc]
cmp esi, edi
je 0x40e115
mov ecx, esi
call fcn.0040258a
add esi, ebx
cmp esi, edi
jne 0x40e102
mov esi, dword [ebp - 0x4c0]
mov eax, dword [ebp - 0x4b8]
sub eax, esi
mov dword [ebp - 0x4a0], esi
cdq
idiv ebx
imul eax, eax, 0x18
mov dword [ebp - 0x49c], eax
cmp eax, 0x1000
jb 0x40e157
lea eax, [ebp - 0x49c]
push eax
lea eax, [ebp - 0x4a0]
push eax
call fcn.00401403
mov eax, dword [ebp - 0x49c]
mov esi, dword [ebp - 0x4a0]
pop ecx
pop ecx
push eax
push esi
call fcn.004e6456
pop ecx
pop ecx
call fcn.004e6a01
ret
sub esp, 0x18
xor eax, eax
mov ecx, esp
push ebx
mov dword [ecx], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
call fcn.00402603
lea esi, [edi + 0x400]
mov ecx, edi
push esi
call fcn.00411b44
cmp al, 1
jne 0x40e0eb
sub esp, 0x48
mov ecx, esp
push esi
call fcn.0040a51e
mov ecx, dword [edi + 0x3cc]
call fcn.00409c0d
mov ecx, dword [edi + 0x3cc]
call fcn.00409c8f
mov ecx, dword [edi + 0x3cc]
lea eax, [ebp - 0x4b0]
push eax
call fcn.004098f0
lea ebx, [edi + 0x3a8]
push eax
mov ecx, ebx
call fcn.00412cab
lea ecx, [ebp - 0x4b0]
call fcn.004072c3
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
push 0x18
cdq
pop ebx
idiv ebx
test eax, eax
je 0x40e0ee
xor ebx, ebx
mov dword [ebp - 0x4b0], ebx
mov dword [ebp - 0x4ac], ebx
mov dword [ebp - 0x4a8], ebx
sub esp, 0x18
mov byte [ebp - 4], 8
mov ecx, esp
mov dword [ebp - 0x49c], esp
push str..dll
call fcn.004024f3
sub esp, 0x18
mov byte [ebp - 4], 9
mov ecx, esp
lea eax, [edi + 0x3b4]
lea esi, [ebp - 0x4b0]
push eax
mov dword [ecx], ebx
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], ebx
call fcn.00402603
mov dl, bl
mov byte [ebp - 4], 8
mov ecx, esi
call fcn.00403805
mov ebx, dword [ebp - 0x4ac]
add esp, 0x30
mov esi, dword [ebp - 0x4b0]
mov dword [ebp - 0x4b4], ebx
jmp 0x40e3b4
xor eax, eax
lea ecx, [ebp - 0x28]
push esi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
call fcn.00402603
sub esp, 0x18
mov byte [ebp - 4], 0xa
mov ecx, esp
xor eax, eax
mov byte [ebp - 0x4a1], al
mov dword [ecx], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
lea eax, [ebp - 0x28]
push eax
call fcn.00402603
lea edx, [ebp - 0x4a1]
lea ecx, [ebp - 0x88]
call fcn.00401c9d
add esp, 0x18
lea ecx, [ebp - 0x88]
push 0
push str.Steamtools
call fcn.00404b49
cmp eax, 0xffffffff
je 0x40e2dc
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x40e353
push str.version.dll
call fcn.004ff4a6
mov ebx, dword [ebp - 0x14]
lea ecx, [ebp - 0x28]
push eax
push str.version.dll
push 0
push dword [ebp - 0x18]
cmp ebx, 8
cmovae ecx, dword [ebp - 0x28]
push ecx
call fcn.00406097
add esp, 0x18
cmp eax, 0xffffffff
jne 0x40e33c
push str.hid.dll
call fcn.004ff4a6
mov ebx, dword [ebp - 0x14]
lea ecx, [ebp - 0x28]
push eax
push str.hid.dll
push 0
push dword [ebp - 0x18]
cmp ebx, 8
cmovae ecx, dword [ebp - 0x28]
push ecx
call fcn.00406097
add esp, 0x18
cmp eax, 0xffffffff
je 0x40e34d
cmp ebx, 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebx, dword [ebp - 0x4b4]
lea ecx, [ebp - 0x88]
call fcn.0040258a
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x40e3b1
mov ecx, dword [ebp - 0x28]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x4a0], eax
mov dword [ebp - 0x49c], ecx
cmp eax, 0x1000
jb 0x40e3a8
lea eax, [ebp - 0x4a0]
push eax
lea eax, [ebp - 0x49c]
push eax
call fcn.00401403
mov eax, dword [ebp - 0x4a0]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x49c]
push eax
push ecx
call fcn.004e6456
pop ecx
pop ecx
add esi, 0x18
cmp esi, ebx
jne 0x40e267
push 8
call fcn.0046cf9d
pop ecx
mov dword [ebp - 0x49c], eax
xor ebx, ebx
mov byte [ebp - 4], 0xb
test eax, eax
je 0x40e3ee
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], 0x410aff
push ecx
mov ecx, eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], edi
call fcn.00413574
jmp 0x40e3f0
mov eax, ebx
mov ecx, eax
mov byte [ebp - 4], 8
call fcn.0040ce1e
push 8
call fcn.0046cf9d
pop ecx
mov dword [ebp - 0x49c], eax
mov byte [ebp - 4], 0xc
test eax, eax
je 0x40e42b
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], 0x411057
push ecx
mov ecx, eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], edi
call fcn.00413574
jmp 0x40e42d
mov eax, ebx
mov ecx, eax
mov byte [ebp - 4], 8
call fcn.0040ce1e
push 8
call fcn.0046cf9d
pop ecx
mov dword [ebp - 0x49c], eax
mov byte [ebp - 4], 0xd
test eax, eax
je 0x40e468
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], 0x40d424
push ecx
mov ecx, eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], edi
call fcn.00413574
jmp 0x40e46a
mov eax, ebx
mov ecx, eax
mov byte [ebp - 4], 8
call fcn.0040ce1e
push 8
call fcn.0046cf9d
pop ecx
mov dword [ebp - 0x49c], eax
mov byte [ebp - 4], 0xe
test eax, eax
je 0x40e4a5
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], 0x4115af
push ecx
mov ecx, eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], edi
call fcn.00413574
jmp 0x40e4a7
mov eax, ebx
mov ecx, eax
mov byte [ebp - 4], 8
call fcn.0040cddf
mov ecx, edi
call fcn.0040e808
test al, al
jne 0x40e4d6
mov ecx, edi
call fcn.0040f9b9
test al, al
jne 0x40e4d6
push ebx
push ebx
push 0x577338
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
sub esp, 0xc
lea eax, [edi + 0x3a8]
mov ecx, esp
push eax
call fcn.00412ce0
mov ecx, edi
call fcn.004123ef
mov ecx, edi
call fcn.004128ca
push str._steam.exe
lea eax, [edi + 0x3b4]
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.00406bc5
push 0xf
pop esi
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], esi
mov byte [ebp - 0x40], bl
sub esp, 0xc
mov byte [ebp - 4], 0x10
mov ecx, esp
lea eax, [edi + 0x430]
push eax
mov dword [ecx], ebx
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], ebx
call fcn.00402603
lea ecx, [ebp - 0x40]
call fcn.00407028
add esp, 0x18
cmp dword [ebp - 0x30], 0
jne 0x40e623
mov eax, dword [ebp - 0x2c]
cmp eax, 0x10
jb 0x40e594
mov ecx, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x49c], eax
mov dword [ebp - 0x4a0], ecx
cmp eax, 0x1000
jb 0x40e58b
lea eax, [ebp - 0x49c]
push eax
lea eax, [ebp - 0x4a0]
push eax
call fcn.00401403
mov eax, dword [ebp - 0x49c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x4a0]
push eax
push ecx
call fcn.004e6456
pop ecx
pop ecx
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], esi
mov byte [ebp - 0x40], bl
call fcn.0040258a
mov esi, dword [ebp - 0x4b0]
push 0x18
pop ebx
test esi, esi
je 0x40e0ee
mov edi, dword [ebp - 0x4ac]
cmp esi, edi
je 0x40e5d3
mov ecx, esi
call fcn.0040258a
add esi, ebx
cmp esi, edi
jne 0x40e5c0
mov esi, dword [ebp - 0x4b0]
mov eax, dword [ebp - 0x4a8]
sub eax, esi
mov dword [ebp - 0x4a0], esi
cdq
idiv ebx
imul eax, eax, 0x18
mov dword [ebp - 0x49c], eax
cmp eax, 0x1000
jb 0x40e615
lea eax, [ebp - 0x49c]
push eax
lea eax, [ebp - 0x4a0]
push eax
call fcn.00401403
mov eax, dword [ebp - 0x49c]
mov esi, dword [ebp - 0x4a0]
pop ecx
pop ecx
push eax
push esi
call fcn.004e6456
pop ecx
pop ecx
jmp 0x40e0ee
sub esp, 0x18
lea eax, [ebp - 0x40]
mov ecx, esp
push eax
mov dword [ecx], ebx
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], ebx
call fcn.004055b2
push 0x2c
lea eax, [ebp - 0x1c]
push eax
call fcn.00409ab1
mov byte [ebp - 4], 0x11
mov edx, dword [eax]
cmp dword [edx + 0x14], 0x10
jb 0x40e652
mov edx, dword [edx]
lea ecx, [ebp - 0xa0]
call fcn.00406de6
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x13
call fcn.004072c3
lea eax, [ebp - 0xa0]
mov edx, str._____steam:__install_
push eax
lea ecx, [ebp - 0x88]
call fcn.004134ed
pop ecx
mov esi, eax
push 0x22
mov ecx, esi
mov byte [ebp - 4], 0x14
call fcn.004071ae
push esi
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], ebx
call fcn.0040266b
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 0x16
call fcn.0040258a
lea ecx, [ebp - 0x498]
call fcn.00408b32
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x498]
push dword [edi + 0x248]
call fcn.00427aed
cmp dword [ebp - 0x44], 8
lea ecx, [ebp - 0x58]
push 1
cmovae ecx, dword [ebp - 0x58]
lea eax, [ebp - 0x70]
cmp dword [ebp - 0x5c], 8
push ebx
cmovae eax, dword [ebp - 0x70]
push ecx
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push dword [edi + 0x248]
call dword [sym.imp.USER32.dll_DestroyWindow]
lea ecx, [ebp - 0x498]
call fcn.00427a31
mov eax, dword [ebp - 0x44]
cmp eax, 8
jb 0x40e75e
mov ecx, dword [ebp - 0x58]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x49c], eax
mov dword [ebp - 0x4a0], ecx
cmp eax, 0x1000
jb 0x40e755
lea eax, [ebp - 0x49c]
push eax
lea eax, [ebp - 0x4a0]
push eax
call fcn.00401403
mov eax, dword [ebp - 0x49c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x4a0]
push eax
push ecx
call fcn.004e6456
pop ecx
pop ecx
xor eax, eax
mov dword [ebp - 0x48], ebx
lea ecx, [ebp - 0xa0]
mov dword [ebp - 0x44], 7
mov word [ebp - 0x58], ax
call fcn.0040258a
mov eax, dword [ebp - 0x2c]
cmp eax, 0x10
jb 0x40e7c2
mov ecx, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x49c], eax
mov dword [ebp - 0x4a0], ecx
cmp eax, 0x1000
jb 0x40e7b9
lea eax, [ebp - 0x49c]
push eax
lea eax, [ebp - 0x4a0]
push eax
call fcn.00401403
mov eax, dword [ebp - 0x49c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x4a0]
push eax
push ecx
call fcn.004e6456
pop ecx
pop ecx
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], bl
call fcn.0040258a
mov esi, dword [ebp - 0x4b0]
test esi, esi
je 0x40e0eb
mov edi, dword [ebp - 0x4ac]
push 0x18
pop ebx
cmp esi, edi
je 0x40e5d3
mov ecx, esi
call fcn.0040258a
add esi, ebx
cmp esi, edi
jne 0x40e7f6
jmp 0x40e5cd