Function at 0x401000
Capabilities:
Check if file exists
Create process on windows
Create process suspended
Get file attributes
Query or enumerate registry value
Read .ini file
Resume thread
Set environment variable
Set registry value
Terminate process

Disassembly:
mov eax, 0x71b4
call fcn.00401840
mov eax, dword [0x418004]
xor eax, esp
mov dword [esp + 0x71b0], eax
push ebx
push edi
push 0x208
lea eax, [esp + 0x7c]
push 0
push eax
call fcn.004023c0
push 0x208
lea eax, [esp + 0x6a0]
push 0
push eax
call fcn.004023c0
push 0x208
lea eax, [esp + 0x4a4]
push 0
push eax
call fcn.004023c0
push 0x208
lea eax, [esp + 0x2a8]
push 0
push eax
call fcn.004023c0
push 0x208
lea eax, [esp + 0xbd4]
push 0
push eax
call fcn.004023c0
push 0x2000
lea eax, [esp + 0x11f8]
push 0
push eax
call fcn.004023c0
add esp, 0x48
lea eax, [esp + 0x898]
push pe_nt_image_headers32
push 0
push eax
call fcn.004023c0
push 0x40
lea eax, [esp + 0x48]
mov dword [esp + 0x44], 0x44
push 0
push eax
call fcn.004023c0
add esp, 0x18
lea eax, [esp + 0x78]
push 0x208
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
inc eax
test eax, eax
jle 0x401101
cmp word [esp + eax*2 + 0x78], 0x5c
je 0x4010f2
dec eax
test eax, eax
jg 0x4010e3
jmp 0x401101
lea ecx, [esp + 0x7a]
push str.ColdClientLoader.ini
lea eax, [ecx + eax*2]
push eax
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [esp + 0x78]
push eax
call ebx
cmp eax, 0xffffffff
jne 0x40112c
push 0x10
push 0x4111cc
push str.Couldnt_find_the_configuration_file_ColdClientLoader.ini_.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x4013f7
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [esp + 0x7c]
push eax
push 0x104
lea eax, [esp + 0x69c]
push eax
push 0x41121c
push str.SteamClient64Dll
push 0x411244
call esi
lea eax, [esp + 0x7c]
push eax
push 0x104
lea eax, [esp + 0x494]
push eax
push 0x41125c
push 0x411260
push 0x411280
call esi
lea eax, [esp + 0x7c]
push eax
push 0x104
lea eax, [esp + 0x28c]
push eax
push 0
push 0x411298
push 0x4112a0
call esi
lea eax, [esp + 0x7c]
push eax
push 0x104
lea eax, [esp + 0xbac]
push eax
push 0
push str.ExeRunDir
push 0x4112cc
call esi
lea eax, [esp + 0x7c]
push eax
push 0x1000
lea eax, [esp + 0x11c4]
push eax
push 0
push str.ExeCommandLine
push 0x411304
call esi
lea eax, [esp + 0x7c]
push eax
push pe_nt_image_headers32
lea eax, [esp + 0x8a4]
push eax
push 0
push str.AppId
push str.SteamClient
call esi
cmp word [esp + 0x89c], 0
je 0x401779
mov esi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea eax, [esp + 0x89c]
push ebp
push eax
push str.SteamAppId
call esi
lea eax, [esp + 0x8a0]
push eax
push str.SteamGameId
call esi
push 0x208
lea eax, [esp + 0x9a4]
push 0
push eax
call fcn.004023c0
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [esp + 0x6a4]
add esp, 0xc
push eax
call ebp
mov esi, dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
jle 0x401270
nop
cmp word [esp + eax*2 + 0x698], 0x5c
je 0x4012b2
dec eax
test eax, eax
jg 0x401260
lea eax, [esp + 0x698]
push eax
lea eax, [esp + 0x9a4]
push eax
call edi
push 0x208
lea eax, [esp + 0x69c]
push 0
push eax
call fcn.004023c0
add esp, 0xc
lea eax, [esp + 0x698]
push 0
push eax
push 0x104
lea eax, [esp + 0x9ac]
push eax
call esi
lea eax, [esp + 0x490]
push eax
call ebp
test eax, eax
jle 0x4012d0
cmp word [esp + eax*2 + 0x490], 0x5c
je 0x401312
dec eax
test eax, eax
jg 0x4012c0
lea eax, [esp + 0x490]
push eax
lea eax, [esp + 0x9a4]
push eax
call edi
push 0x208
lea eax, [esp + 0x494]
push 0
push eax
call fcn.004023c0
add esp, 0xc
lea eax, [esp + 0x490]
push 0
push eax
push 0x104
lea eax, [esp + 0x9ac]
push eax
call esi
lea eax, [esp + 0x288]
push eax
call ebp
test eax, eax
jle 0x401330
cmp word [esp + eax*2 + 0x288], 0x5c
je 0x401372
dec eax
test eax, eax
jg 0x401320
lea eax, [esp + 0x288]
push eax
lea eax, [esp + 0x9a4]
push eax
call edi
push 0x208
lea eax, [esp + 0x28c]
push 0
push eax
call fcn.004023c0
add esp, 0xc
lea eax, [esp + 0x288]
push 0
push eax
push 0x104
lea eax, [esp + 0x9ac]
push eax
call esi
lea eax, [esp + 0xba8]
push eax
call ebp
test eax, eax
jle 0x401390
cmp word [esp + eax*2 + 0xba8], 0x5c
je 0x4013d2
dec eax
test eax, eax
jg 0x401380
lea eax, [esp + 0xba8]
push eax
lea eax, [esp + 0x9a4]
push eax
call edi
push 0x208
lea eax, [esp + 0xbac]
push 0
push eax
call fcn.004023c0
add esp, 0xc
lea eax, [esp + 0xba8]
push 0
push eax
push 0x104
lea eax, [esp + 0x9ac]
push eax
call esi
lea eax, [esp + 0x698]
push eax
call ebx
cmp eax, 0xffffffff
jne 0x401412
push 0x10
push 0x4113a4
push str.Couldnt_find_the_requested_SteamClient64Dll.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop ebp
pop esi
mov ecx, dword [esp + 0x71b8]
xor eax, eax
pop edi
pop ebx
xor ecx, esp
call fcn.00401822
add esp, 0x71b4
ret 0x10
lea eax, [esp + 0x490]
push eax
call ebx
cmp eax, 0xffffffff
jne 0x40142f
push 0x10
push 0x4113e8
push str.Couldnt_find_the_requested_SteamClientDll.
jmp 0x4013ed
lea eax, [esp + 0x288]
push eax
call ebx
cmp eax, 0xffffffff
jne 0x40144c
push 0x10
push 0x411428
push str.Couldnt_find_the_requested_Exe_file.
jmp 0x4013ed
lea eax, [esp + 0x11c0]
push eax
lea eax, [esp + 0x28c]
push eax
push str.__ls___ls
lea eax, [esp + 0x31cc]
push 0x2000
push eax
call fcn.004017f0
add esp, 0x14
cmp word [esp + 0x288], 0
je 0x401768
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0xbb0]
push eax
push 0
push 4
push 1
push 0
push 0
lea eax, [esp + 0x31e0]
push eax
lea eax, [esp + 0x2ac]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x401768
mov dword [esp + 0x24], 0x771f810d
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0x208
mov dword [esp + 0x2c], eax
lea eax, [esp + 0xdb4]
push 0
push eax
mov byte [esp + 0x23], 0
mov dword [esp + 0x24], 1
call fcn.004023c0
push 0x208
lea eax, [esp + 0xfc8]
push 0
push eax
call fcn.004023c0
add esp, 0x18
mov dword [esp + 0x1c], 0x104
lea eax, [esp + 0x10]
mov dword [esp + 0x20], 0x104
push eax
push 0xf003f
push 0
push 0x4114d8
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4015ec
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0xdb4]
mov byte [esp + 0x1b], 1
push eax
lea eax, [esp + 0x20]
push eax
push 0
push 0x411520
push dword [esp + 0x24]
call esi
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0xfbc]
push eax
lea eax, [esp + 0x20]
push eax
push 0
push 0x4114b4
push dword [esp + 0x24]
call esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea eax, [esp + 0x24]
push 4
push eax
push 4
push 0
push str.ActiveUser
push dword [esp + 0x24]
call esi
push 4
lea eax, [esp + 0x2c]
push eax
push 4
push 0
push 0x4115ec
push dword [esp + 0x24]
call esi
lea eax, [esp + 0x490]
push eax
call ebx
cmp eax, 0xffffffff
je 0x40163d
lea eax, [esp + 0x490]
push eax
call ebp
lea eax, [eax*2 + 1]
push eax
lea eax, [esp + 0x494]
push eax
push 1
push 0
push 0x4115f0
jmp 0x40164d
push 0
lea eax, [esp + 0x14]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push 0x411540
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x401586
push 0x10
push str.ColdClientLoader
push str.Unable_to_patch_Steam_process_informations_on_the_Windows_registry.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
push dword [esp + 0x30]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x4013f5
push 0
push 0x4111ca
push 1
push 0
push 0x411610
push dword [esp + 0x24]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
call edi
lea eax, [esp + 0x698]
push eax
call ebx
cmp eax, 0xffffffff
je 0x40168d
lea eax, [esp + 0x698]
push eax
call ebp
lea eax, [eax*2 + 1]
push eax
lea eax, [esp + 0x69c]
push eax
push 1
push 0
push 0x411630
jmp 0x40169d
push 0
push 0x4111cb
push 1
push 0
push 0x411654
push dword [esp + 0x24]
call edi
push 0x411678
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push str.Public
push 1
push 0
push str.Universe
push dword [esp + 0x24]
call esi
push dword [esp + 0x10]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call ebx
push dword [esp + 0x30]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0xffffffffffffffff
push dword [esp + 0x34]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esp + 0x2c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0x30]
call esi
cmp byte [esp + 0x17], 0
je 0x4013f5
lea eax, [esp + 0x10]
push eax
push 0xf003f
push 0
push str.SoftwareValveSteamActiveProcess
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4013f5
push dword [esp + 0x1c]
lea eax, [esp + 0xdb4]
push eax
push 1
push 0
push str.SteamClientDll
push dword [esp + 0x24]
call edi
push dword [esp + 0x20]
lea eax, [esp + 0xfbc]
push eax
push 1
push 0
push str.SteamClientDll64
push dword [esp + 0x24]
call edi
push dword [esp + 0x10]
call ebx
jmp 0x4013f5
push 0x10
push 0x411478
push str.Unable_to_load_the_requested_EXE_file.
jmp 0x4013ed
push 0x10
push 0x411370
push str.You_forgot_to_set_the_AppId.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x4013f6