Function at 0x425820
Capabilities:
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56b1fd
mov eax, dword fs:[0]
push eax
sub esp, 0xdac
mov eax, dword [0x5d2640]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xc18], ecx
mov dword [ebp - 0xc90], 0
movzx eax, byte [ebp - 0xc39]
push eax
lea ecx, [ebp - 0xec]
call fcn.00409420
mov dword [ebp - 4], 0
mov dword [ebp - 0xc34], str.Steam.exe
mov ecx, dword [ebp - 0xc34]
add ecx, 2
mov dword [ebp - 0xca4], ecx
mov edx, dword [ebp - 0xc34]
mov ax, word [edx]
mov word [ebp - 0xc40], ax
add dword [ebp - 0xc34], 2
cmp word [ebp - 0xc40], 0
jne 0x42588e
mov ecx, dword [ebp - 0xc34]
sub ecx, dword [ebp - 0xca4]
sar ecx, 1
mov dword [ebp - 0xca8], ecx
mov edx, dword [ebp - 0xca8]
mov dword [ebp - 0xcac], edx
mov eax, dword [ebp - 0xcac]
mov dword [ebp - 0xcb0], eax
mov ecx, dword [ebp - 0xcb0]
push ecx
push str.Steam.exe
lea ecx, [ebp - 0xec]
call fcn.00403cb0
mov dword [ebp - 4], 1
movzx edx, byte [ebp - 0xc3a]
push edx
lea ecx, [ebp - 0xd4]
call fcn.00409420
mov byte [ebp - 4], 2
mov dword [ebp - 0xc30], str.SteamService.exe
mov eax, dword [ebp - 0xc30]
add eax, 2
mov dword [ebp - 0xd74], eax
mov ecx, dword [ebp - 0xc30]
mov dx, word [ecx]
mov word [ebp - 0xc42], dx
add dword [ebp - 0xc30], 2
cmp word [ebp - 0xc42], 0
jne 0x425929
mov eax, dword [ebp - 0xc30]
sub eax, dword [ebp - 0xd74]
sar eax, 1
mov dword [ebp - 0xd70], eax
mov ecx, dword [ebp - 0xd70]
mov dword [ebp - 0xd6c], ecx
mov edx, dword [ebp - 0xd6c]
mov dword [ebp - 0xd68], edx
mov eax, dword [ebp - 0xd68]
push eax
push str.SteamService.exe
lea ecx, [ebp - 0xd4]
call fcn.00403cb0
mov byte [ebp - 4], 3
movzx ecx, byte [ebp - 0xc3b]
push ecx
lea ecx, [ebp - 0xbc]
call fcn.00409420
mov byte [ebp - 4], 4
mov dword [ebp - 0xc2c], str.steamwebhelper.exe
mov edx, dword [ebp - 0xc2c]
add edx, 2
mov dword [ebp - 0xd64], edx
mov eax, dword [ebp - 0xc2c]
mov cx, word [eax]
mov word [ebp - 0xc44], cx
add dword [ebp - 0xc2c], 2
cmp word [ebp - 0xc44], 0
jne 0x4259c1
mov edx, dword [ebp - 0xc2c]
sub edx, dword [ebp - 0xd64]
sar edx, 1
mov dword [ebp - 0xd60], edx
mov eax, dword [ebp - 0xd60]
mov dword [ebp - 0xd5c], eax
mov ecx, dword [ebp - 0xd5c]
mov dword [ebp - 0xd58], ecx
mov edx, dword [ebp - 0xd58]
push edx
push str.steamwebhelper.exe
lea ecx, [ebp - 0xbc]
call fcn.00403cb0
mov dword [ebp - 4], 5
lea eax, [ebp - 0xec]
mov dword [ebp - 0xd3c], eax
lea ecx, [ebp - 0xa4]
mov dword [ebp - 0xd38], ecx
lea edx, [ebp - 0xc3c]
push edx
mov eax, dword [ebp - 0xd38]
push eax
mov ecx, dword [ebp - 0xd3c]
push ecx
lea ecx, [ebp - 0xca0]
call fcn.00436860
mov byte [ebp - 4], 7
push fcn.004046e0
push 3
push 0x18
lea edx, [ebp - 0xec]
push edx
call fcn.0050f7fb
lea eax, [ebp - 0xca0]
push eax
call fcn.00401ec0
add esp, 4
push 0xffffffffffffffff
push 0x57a89c
mov ecx, dword [ebp - 0xc18]
add ecx, 4
call fcn.0044ac7d
mov dword [ebp - 0xc64], eax
push 0
lea ecx, [ebp - 0xcbc]
push ecx
mov edx, dword [ebp - 0xc64]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xc64]
mov edx, dword [eax + 0x3c]
call edx
mov dword [ebp - 0xd54], eax
mov eax, dword [ebp - 0xd54]
mov dword [ebp - 0xd50], eax
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0xd50]
mov edx, dword [ecx]
mov dword [ebp - 0xc6c], edx
mov eax, dword [ebp - 0xc6c]
mov dword [ebp - 0xc28], eax
mov ecx, dword [ebp - 0xc28]
add ecx, 2
mov dword [ebp - 0xd2c], ecx
mov edx, dword [ebp - 0xc28]
mov ax, word [edx]
mov word [ebp - 0xc58], ax
add dword [ebp - 0xc28], 2
cmp word [ebp - 0xc58], 0
jne 0x425b02
mov ecx, dword [ebp - 0xc28]
sub ecx, dword [ebp - 0xd2c]
sar ecx, 1
mov dword [ebp - 0xd40], ecx
mov edx, dword [ebp - 0xd40]
mov dword [ebp - 0xcb4], edx
mov eax, dword [ebp - 0xcb4]
mov dword [ebp - 0xcb8], eax
mov ecx, dword [ebp - 0xcb8]
push ecx
mov edx, dword [ebp - 0xc6c]
push edx
mov ecx, dword [ebp - 0xc18]
add ecx, 0x3e8
call fcn.00406030
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xcbc]
call fcn.00419970
mov eax, dword [ebp - 0xc18]
mov ecx, dword [eax + 0x3f8]
mov dword [ebp - 0xcc0], ecx
cmp dword [ebp - 0xcc0], 0x14
jae 0x425bea
lea ecx, [ebp - 0x864]
call fcn.00419540
mov byte [ebp - 4], 9
mov edx, dword [ebp - 0xc18]
mov eax, dword [edx + 0x248]
push eax
lea ecx, [ebp - 0x864]
call fcn.00454b3d
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x864]
call fcn.00454a86
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xca0]
call fcn.00418a30
jmp 0x4264ad
mov ecx, dword [ebp - 0xc18]
add ecx, 0x400
push ecx
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xd98], esp
mov edx, dword [ebp - 0xc18]
add edx, 0x3e8
push edx
call fcn.00404350
mov ecx, dword [ebp - 0xc18]
call fcn.0042cda0
mov byte [ebp - 0xc19], al
mov al, byte [ebp - 0xc19]
mov byte [ebp - 0xc1a], al
movzx ecx, byte [ebp - 0xc1a]
cmp ecx, 1
jne 0x425c7e
sub esp, 0x48
mov ecx, esp
mov dword [ebp - 0xd9c], esp
mov edx, dword [ebp - 0xc18]
add edx, 0x400
push edx
call fcn.0041eb80
mov eax, dword [ebp - 0xc18]
mov ecx, dword [eax + 0x3cc]
call fcn.0041d600
mov ecx, dword [ebp - 0xc18]
mov ecx, dword [ecx + 0x3cc]
call fcn.0041d720
jmp 0x425ccb
lea ecx, [ebp - 0x4b4]
call fcn.00419540
mov byte [ebp - 4], 0xa
mov edx, dword [ebp - 0xc18]
mov eax, dword [edx + 0x248]
push eax
lea ecx, [ebp - 0x4b4]
call fcn.00454b3d
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x4b4]
call fcn.00454a86
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xca0]
call fcn.00418a30
jmp 0x4264ad
mov ecx, dword [ebp - 0xc18]
mov ecx, dword [ecx + 0x3cc]
call fcn.0041d5e0
mov dword [ebp - 0xda0], eax
lea edx, [ebp - 0xdb8]
push edx
mov eax, dword [ebp - 0xc18]
mov ecx, dword [eax + 0x3cc]
call fcn.0041dfc0
mov dword [ebp - 0xcc4], eax
mov ecx, dword [ebp - 0xcc4]
push ecx
mov ecx, dword [ebp - 0xc18]
add ecx, 0x3a8
call fcn.00437570
lea ecx, [ebp - 0xdb8]
call fcn.004188f0
mov edx, dword [ebp - 0xc18]
add edx, 0x3a8
mov dword [ebp - 0xc70], edx
mov eax, dword [ebp - 0xc70]
mov ecx, dword [ebp - 0xc70]
mov eax, dword [eax + 4]
sub eax, dword [ecx]
cdq
mov ecx, 0x18
idiv ecx
mov dword [ebp - 0xcc8], eax
cmp dword [ebp - 0xcc8], 0
jbe 0x42649b
lea edx, [ebp - 0xd4c]
mov dword [ebp - 0xccc], edx
mov ecx, dword [ebp - 0xccc]
call fcn.004184d0
mov byte [ebp - 4], 0xb
sub esp, 0x18
mov eax, esp
mov dword [ebp - 0xd7c], esp
mov dword [ebp - 0xc74], eax
movzx ecx, byte [ebp - 0xc3d]
push ecx
mov ecx, dword [ebp - 0xc74]
call fcn.00409420
mov byte [ebp - 4], 0xc
mov dword [ebp - 0xc24], str..dll
mov edx, dword [ebp - 0xc24]
add edx, 2
mov dword [ebp - 0xcd0], edx
mov eax, dword [ebp - 0xc24]
mov cx, word [eax]
mov word [ebp - 0xc56], cx
add dword [ebp - 0xc24], 2
cmp word [ebp - 0xc56], 0
jne 0x425dbd
mov edx, dword [ebp - 0xc24]
sub edx, dword [ebp - 0xcd0]
sar edx, 1
mov dword [ebp - 0xcd4], edx
mov eax, dword [ebp - 0xcd4]
mov dword [ebp - 0xcd8], eax
mov ecx, dword [ebp - 0xcd8]
mov dword [ebp - 0xcdc], ecx
mov edx, dword [ebp - 0xcdc]
push edx
push str..dll
mov ecx, dword [ebp - 0xc74]
call fcn.00403cb0
mov byte [ebp - 4], 0xb
mov byte [ebp - 4], 0xd
push 0
lea eax, [ebp - 0xd4c]
push eax
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xd80], esp
mov edx, dword [ebp - 0xc18]
add edx, 0x3b4
push edx
call fcn.00404350
mov byte [ebp - 4], 0xb
call fcn.00408cd0
add esp, 0x38
lea eax, [ebp - 0xd4c]
mov dword [ebp - 0xc78], eax
mov ecx, dword [ebp - 0xc78]
mov edx, dword [ecx]
mov dword [ebp - 0xc38], edx
mov eax, dword [ebp - 0xc78]
mov ecx, dword [eax + 4]
mov dword [ebp - 0xce0], ecx
jmp 0x425e95
mov edx, dword [ebp - 0xc38]
add edx, 0x18
mov dword [ebp - 0xc38], edx
mov eax, dword [ebp - 0xc38]
cmp eax, dword [ebp - 0xce0]
je 0x425ff4
mov ecx, dword [ebp - 0xc38]
push ecx
lea ecx, [ebp - 0x28]
call fcn.00404350
mov byte [ebp - 4], 0xe
mov byte [ebp - 0xc1b], 0
lea edx, [ebp - 0xc1b]
push edx
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xd84], esp
lea eax, [ebp - 0x28]
push eax
call fcn.00404350
lea ecx, [ebp - 0x70]
push ecx
call fcn.00402fc0
add esp, 0x20
mov dword [ebp - 0xd88], eax
push 0
push str.Steamtools
lea ecx, [ebp - 0x70]
call fcn.00410030
cmp eax, 0xffffffff
je 0x425f22
lea ecx, [ebp - 0x28]
call fcn.00405cb0
mov dword [ebp - 0xce4], eax
mov edx, dword [ebp - 0xce4]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x425fdb
push 0
push str.version.dll
lea ecx, [ebp - 0x28]
call fcn.00410030
cmp eax, 0xffffffff
jne 0x425f4e
push 0
push str.hid.dll
lea ecx, [ebp - 0x28]
call fcn.00410030
cmp eax, 0xffffffff
je 0x425fdb
lea eax, [ebp - 0x28]
mov dword [ebp - 0xc50], eax
mov ecx, dword [ebp - 0xc50]
mov dword [ebp - 0xc80], ecx
mov edx, dword [ebp - 0xc50]
cmp dword [edx + 0x14], 7
jbe 0x425f7b
mov dword [ebp - 0xc7c], 1
jmp 0x425f85
mov dword [ebp - 0xc7c], 0
mov al, byte [ebp - 0xc7c]
mov byte [ebp - 0xc1c], al
movzx ecx, byte [ebp - 0xc1c]
test ecx, ecx
je 0x425fb6
mov edx, dword [ebp - 0xc50]
mov eax, dword [edx]
mov dword [ebp - 0xce8], eax
mov ecx, dword [ebp - 0xce8]
mov dword [ebp - 0xc80], ecx
mov edx, dword [ebp - 0xc80]
mov dword [ebp - 0xcec], edx
mov eax, dword [ebp - 0xcec]
mov dword [ebp - 0xcf0], eax
mov ecx, dword [ebp - 0xcf0]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x70]
call fcn.00405e70
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x28]
call fcn.00405e70
jmp 0x425e86
mov ecx, dword [ebp - 0xc18]
call fcn.0042bea0
mov ecx, dword [ebp - 0xc18]
call fcn.0042a780
mov ecx, dword [ebp - 0xc18]
call fcn.0042b2a0
mov ecx, dword [ebp - 0xc18]
call fcn.0042ed70
mov ecx, dword [ebp - 0xc18]
call fcn.00427060
movzx edx, al
test edx, edx
jne 0x42607f
push 0
push 0
push 0x57a8f8
mov eax, dword [ebp - 0xc18]
mov ecx, dword [eax + 0x248]
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp - 0xc18]
call fcn.00424f50
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xd4c]
call fcn.00418a30
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xca0]
call fcn.00418a30
jmp 0x4264ad
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 0xd8c], esp
mov edx, dword [ebp - 0xc18]
add edx, 0x3a8
push edx
call fcn.004367e0
mov ecx, dword [ebp - 0xc18]
call fcn.0042dbc0
mov ecx, dword [ebp - 0xc18]
call fcn.0042ca80
push str._steam.exe
mov eax, dword [ebp - 0xc18]
add eax, 0x3b4
push eax
lea ecx, [ebp - 0x58]
push ecx
call fcn.004146d0
add esp, 0xc
mov byte [ebp - 4], 0xf
movzx edx, byte [ebp - 0xc3e]
push edx
lea ecx, [ebp - 0x40]
call fcn.00409420
lea ecx, [ebp - 0x40]
call fcn.0040f620
mov byte [ebp - 4], 0x10
lea eax, [ebp - 0x40]
push eax
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xd90], esp
mov edx, dword [ebp - 0xc18]
add edx, 0x430
push edx
call fcn.00404350
call fcn.004159d0
add esp, 0x1c
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xcf4], eax
cmp dword [ebp - 0xcf4], 0
jne 0x426168
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x40]
call fcn.0040f520
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x58]
call fcn.00405e70
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xd4c]
call fcn.00418a30
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xca0]
call fcn.00418a30
jmp 0x4264ad
push 0x2c
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xd94], esp
lea edx, [ebp - 0x40]
push edx
call fcn.0040bf50
lea eax, [ebp - 0xdac]
push eax
mov ecx, dword [ebp - 0xc18]
call fcn.0042ebb0
mov dword [ebp - 0xcf8], eax
mov ecx, dword [ebp - 0xcf8]
mov dword [ebp - 0xcfc], ecx
mov byte [ebp - 4], 0x11
mov edx, dword [ebp - 0xcfc]
mov dword [ebp - 0xd00], edx
xor eax, eax
imul ecx, eax, 0x18
mov edx, dword [ebp - 0xd00]
add ecx, dword [edx]
mov dword [ebp - 0xd04], ecx
mov eax, dword [ebp - 0xd04]
mov dword [ebp - 0xd08], eax
mov ecx, dword [ebp - 0xd08]
mov dword [ebp - 0xc4c], ecx
mov edx, dword [ebp - 0xc4c]
mov dword [ebp - 0xc88], edx
mov eax, dword [ebp - 0xc4c]
cmp dword [eax + 0x14], 0xf
jbe 0x426201
mov dword [ebp - 0xc84], 1
jmp 0x42620b
mov dword [ebp - 0xc84], 0
mov cl, byte [ebp - 0xc84]
mov byte [ebp - 0xc1d], cl
movzx edx, byte [ebp - 0xc1d]
test edx, edx
je 0x42623c
mov eax, dword [ebp - 0xc4c]
mov ecx, dword [eax]
mov dword [ebp - 0xd0c], ecx
mov edx, dword [ebp - 0xd0c]
mov dword [ebp - 0xc88], edx
mov eax, dword [ebp - 0xc88]
mov dword [ebp - 0xd10], eax
mov ecx, dword [ebp - 0xd10]
mov dword [ebp - 0xd14], ecx
mov edx, dword [ebp - 0xd14]
push edx
lea eax, [ebp - 0xa0]
push eax
call fcn.00417010
add esp, 8
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0xdac]
call fcn.004188f0
lea ecx, [ebp - 0xa0]
push ecx
push str._____steam:__install_
lea edx, [ebp - 0x104]
push edx
call fcn.00430220
add esp, 0xc
mov dword [ebp - 0xd18], eax
mov eax, dword [ebp - 0xd18]
mov dword [ebp - 0xc8c], eax
mov byte [ebp - 4], 0x14
push 0x22
mov ecx, dword [ebp - 0xc8c]
call fcn.00418ca0
mov ecx, dword [ebp - 0xc8c]
mov dword [ebp - 0xd1c], ecx
mov edx, dword [ebp - 0xd1c]
push edx
lea ecx, [ebp - 0x88]
call fcn.004042e0
mov eax, dword [ebp - 0xc90]
or eax, 4
mov dword [ebp - 0xc90], eax
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x104]
call fcn.00405e70
lea ecx, [ebp - 0xc14]
call fcn.004194c0
mov byte [ebp - 4], 0x17
mov ecx, dword [ebp - 0xc18]
mov edx, dword [ecx + 0x248]
push edx
lea ecx, [ebp - 0xc14]
call fcn.00454b3d
lea eax, [ebp - 0x88]
mov dword [ebp - 0xc54], eax
mov ecx, dword [ebp - 0xc54]
mov dword [ebp - 0xc60], ecx
mov edx, dword [ebp - 0xc54]
cmp dword [edx + 0x14], 7
jbe 0x42634a
mov dword [ebp - 0xc5c], 1
jmp 0x426354
mov dword [ebp - 0xc5c], 0
mov al, byte [ebp - 0xc5c]
mov byte [ebp - 0xc1e], al
movzx ecx, byte [ebp - 0xc1e]
test ecx, ecx
je 0x426385
mov edx, dword [ebp - 0xc54]
mov eax, dword [edx]
mov dword [ebp - 0xd20], eax
mov ecx, dword [ebp - 0xd20]
mov dword [ebp - 0xc60], ecx
mov edx, dword [ebp - 0xc60]
mov dword [ebp - 0xd24], edx
mov eax, dword [ebp - 0xd24]
mov dword [ebp - 0xd30], eax
lea ecx, [ebp - 0x58]
mov dword [ebp - 0xc48], ecx
mov edx, dword [ebp - 0xc48]
mov dword [ebp - 0xc68], edx
mov eax, dword [ebp - 0xc48]
cmp dword [eax + 0x14], 7
jbe 0x4263ca
mov dword [ebp - 0xc94], 1
jmp 0x4263d4
mov dword [ebp - 0xc94], 0
mov cl, byte [ebp - 0xc94]
mov byte [ebp - 0xc1f], cl
movzx edx, byte [ebp - 0xc1f]
test edx, edx
je 0x426405
mov eax, dword [ebp - 0xc48]
mov ecx, dword [eax]
mov dword [ebp - 0xd28], ecx
mov edx, dword [ebp - 0xd28]
mov dword [ebp - 0xc68], edx
mov eax, dword [ebp - 0xc68]
mov dword [ebp - 0xd78], eax
mov ecx, dword [ebp - 0xd78]
mov dword [ebp - 0xd34], ecx
push 1
push 0
mov edx, dword [ebp - 0xd30]
push edx
mov eax, dword [ebp - 0xd34]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 0xc18]
call fcn.00424f50
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0xc14]
call fcn.00454a86
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x88]
call fcn.00405e70
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0xa0]
call fcn.00405e70
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x40]
call fcn.0040f520
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x58]
call fcn.00405e70
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xd4c]
call fcn.00418a30
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xca0]
call fcn.00418a30
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050f496
mov esp, ebp
pop ebp
ret