Function at 0x40d6d5
Capabilities:
Create process on windows
Delete file
Print debug messages

Disassembly:
push 0x4bc
mov eax, 0x54080b
call fcn.004e6a52
mov edi, ecx
mov dword [ebp - 0x4a8], edi
xor ebx, ebx
lea ecx, [ebp - 0xec]
push str.Steam.exe
mov dword [ebp - 4], ebx
call fcn.004024f3
push str.SteamService.exe
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 1
call fcn.004024f3
push str.steamwebhelper.exe
lea ecx, [ebp - 0xbc]
mov byte [ebp - 4], 2
call fcn.004024f3
mov byte [ebp - 4], 3
lea eax, [ebp - 0xa4]
push dword [ebp - 0x4a8]
lea ecx, [ebp - 0x4b8]
mov dword [ebp - 0x4b8], ebx
push eax
lea eax, [ebp - 0xec]
mov dword [ebp - 0x4b4], ebx
push eax
mov dword [ebp - 0x4b0], ebx
call fcn.00413a39
push fcn.004024ae
push 3
push 0x18
pop eax
push eax
lea eax, [ebp - 0xec]
mov byte [ebp - 4], 5
push eax
call fcn.004e668d
lea ecx, [ebp - 0x4b8]
call fcn.00402029
lea eax, [ebp + 8]
lea esi, [edi + 0x3e8]
push eax
mov ecx, esi
call fcn.00405436
cmp dword [edi + 0x3f8], 0x14
jae 0x40d866
lea ecx, [ebp - 0x49c]
call fcn.00408b9a
push ebx
lea ecx, [ebp - 0x49c]
mov byte [ebp - 4], 6
call fcn.00427aed
lea ecx, [ebp - 0x49c]
call fcn.00427a31
mov esi, dword [ebp - 0x4b8]
test esi, esi
je 0x40d856
mov edi, dword [ebp - 0x4b4]
cmp esi, edi
je 0x40d7f6
mov ecx, esi
call fcn.0040258a
push 0x18
pop eax
add esi, eax
cmp esi, edi
jne 0x40d7e0
mov esi, dword [ebp - 0x4b8]
push 0x18
pop ecx
mov eax, dword [ebp - 0x4b0]
sub eax, esi
mov dword [ebp - 0x4a4], esi
cdq
idiv ecx
imul eax, eax, 0x18
mov dword [ebp - 0x4a0], eax
cmp eax, 0x1000
jb 0x40d83b
lea eax, [ebp - 0x4a0]
push eax
lea eax, [ebp - 0x4a4]
push eax
call fcn.00401403
mov esi, dword [ebp - 0x4a4]
mov eax, dword [ebp - 0x4a0]
pop ecx
pop ecx
push eax
push esi
call fcn.004e6456
pop ecx
mov dword [ebp - 0x4b0], ebx
mov dword [ebp - 0x4b4], ebx
mov dword [ebp - 0x4b8], ebx
pop ecx
lea ecx, [ebp + 8]
call fcn.0040258a
call fcn.004e6a01
ret 0x18
sub esp, 0x18
mov ecx, esp
push esi
mov dword [ecx], ebx
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], ebx
call fcn.00402603
lea esi, [edi + 0x400]
mov ecx, edi
push esi
call fcn.00411b44
cmp al, 1
jne 0x40d7c8
sub esp, 0x48
mov ecx, esp
push esi
call fcn.0040a51e
mov ecx, dword [edi + 0x3cc]
call fcn.00409c0d
mov ecx, dword [edi + 0x3cc]
call fcn.00409c8f
mov ecx, dword [edi + 0x3cc]
lea eax, [ebp - 0x4c4]
push eax
call fcn.004098f0
lea ebx, [edi + 0x3a8]
push eax
mov ecx, ebx
call fcn.00412cab
lea ecx, [ebp - 0x4c4]
call fcn.004072c3
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
xor ebx, ebx
push 0x18
cdq
pop ecx
idiv ecx
test eax, eax
je 0x40df7c
mov dword [ebp - 0x4c4], ebx
mov dword [ebp - 0x4c0], ebx
mov dword [ebp - 0x4bc], ebx
sub esp, 0x18
mov byte [ebp - 4], 7
mov ecx, esp
mov dword [ebp - 0x4a0], esp
push str..dll
call fcn.004024f3
sub esp, 0x18
mov byte [ebp - 4], 8
mov ecx, esp
lea eax, [edi + 0x3b4]
lea esi, [ebp - 0x4c4]
push eax
mov dword [ecx], ebx
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], ebx
call fcn.00402603
mov dl, bl
mov byte [ebp - 4], 7
mov ecx, esi
call fcn.00403805
mov ebx, dword [ebp - 0x4c0]
add esp, 0x30
mov esi, dword [ebp - 0x4c4]
mov dword [ebp - 0x4c8], ebx
cmp esi, ebx
je 0x40dac7
push 0x18
pop edi
xor eax, eax
lea ecx, [ebp - 0x2c]
push esi
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
call fcn.00402603
sub esp, 0x18
mov byte [ebp - 4], 9
mov ecx, esp
xor eax, eax
mov byte [ebp - 0x4a9], al
mov dword [ecx], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
lea eax, [ebp - 0x2c]
push eax
call fcn.00402603
lea edx, [ebp - 0x4a9]
lea ecx, [ebp - 0x8c]
call fcn.00401c9d
add esp, 0x18
lea ecx, [ebp - 0x8c]
push 0
push str.Steamtools
call fcn.00404b49
cmp eax, 0xffffffff
je 0x40d9e0
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x40da59
push str.version.dll
call fcn.004ff4a6
mov ebx, dword [ebp - 0x18]
cmp ebx, 8
pop ecx
push eax
push str.version.dll
push 0
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x2c]
cmovae ecx, dword [ebp - 0x2c]
push ecx
call fcn.00406097
add esp, 0x14
cmp eax, 0xffffffff
jne 0x40da42
push str.hid.dll
call fcn.004ff4a6
mov ebx, dword [ebp - 0x18]
cmp ebx, 8
pop ecx
push eax
push str.hid.dll
push 0
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x2c]
cmovae ecx, dword [ebp - 0x2c]
push ecx
call fcn.00406097
add esp, 0x14
cmp eax, 0xffffffff
je 0x40da53
cmp ebx, 8
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebx, dword [ebp - 0x4c8]
lea ecx, [ebp - 0x8c]
call fcn.0040258a
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x18]
cmp eax, 8
jb 0x40dab7
mov ecx, dword [ebp - 0x2c]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x4a4], eax
mov dword [ebp - 0x4a0], ecx
cmp eax, 0x1000
jb 0x40daae
lea eax, [ebp - 0x4a4]
push eax
lea eax, [ebp - 0x4a0]
push eax
call fcn.00401403
mov eax, dword [ebp - 0x4a4]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x4a0]
push eax
push ecx
call fcn.004e6456
pop ecx
pop ecx
add esi, edi
cmp esi, ebx
jne 0x40d96b
mov edi, dword [ebp - 0x4a8]
push 0x577328
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 8
pop esi
push esi
call fcn.0046cf9d
pop ecx
mov dword [ebp - 0x4a8], eax
xor ebx, ebx
mov byte [ebp - 4], 0xa
test eax, eax
je 0x40db06
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x24], 0x411057
push ecx
mov ecx, eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], edi
call fcn.00413574
jmp 0x40db08
mov eax, ebx
mov ecx, eax
mov byte [ebp - 4], 7
call fcn.0040ce1e
push esi
call fcn.0046cf9d
pop ecx
mov dword [ebp - 0x4a8], eax
mov byte [ebp - 4], 0xb
test eax, eax
je 0x40db42
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x24], 0x410aff
push ecx
mov ecx, eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], edi
call fcn.00413574
jmp 0x40db44
mov eax, ebx
mov ecx, eax
mov byte [ebp - 4], 7
call fcn.0040ce1e
push esi
call fcn.0046cf9d
pop ecx
mov dword [ebp - 0x4a8], eax
mov byte [ebp - 4], 0xc
test eax, eax
je 0x40db7e
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x24], 0x40d424
push ecx
mov ecx, eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], edi
call fcn.00413574
jmp 0x40db80
mov eax, ebx
mov ecx, eax
mov byte [ebp - 4], 7
call fcn.0040ce1e
push esi
call fcn.0046cf9d
pop ecx
mov dword [ebp - 0x4a8], eax
mov byte [ebp - 4], 0xd
test eax, eax
je 0x40dbba
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x24], 0x4115af
push ecx
mov ecx, eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], edi
call fcn.00413574
jmp 0x40dbbc
mov eax, ebx
mov ecx, eax
mov byte [ebp - 4], 7
call fcn.0040cddf
mov ecx, edi
call fcn.0040e808
test al, al
jne 0x40dbeb
mov ecx, edi
call fcn.0040f9b9
test al, al
jne 0x40dbeb
push ebx
push ebx
push 0x577338
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
sub esp, 0xc
lea eax, [edi + 0x3a8]
mov ecx, esp
push eax
call fcn.00412ce0
mov ecx, edi
call fcn.004123ef
mov ecx, edi
call fcn.004128ca
push str._steam.exe
lea eax, [edi + 0x3b4]
push eax
lea eax, [ebp - 0x74]
push eax
call fcn.00406bc5
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], 0xf
mov byte [ebp - 0x44], bl
sub esp, 0xc
mov byte [ebp - 4], 0xf
mov ecx, esp
lea eax, [edi + 0x430]
push eax
mov dword [ecx], ebx
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], ebx
call fcn.00402603
lea ecx, [ebp - 0x44]
call fcn.00407028
add esp, 0x18
cmp dword [ebp - 0x34], 0
jne 0x40dd52
mov eax, dword [ebp - 0x30]
cmp eax, 0x10
jb 0x40dcaa
mov ecx, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x4a0], eax
mov dword [ebp - 0x4a4], ecx
cmp eax, 0x1000
jb 0x40dca1
lea eax, [ebp - 0x4a0]
push eax
lea eax, [ebp - 0x4a4]
push eax
call fcn.00401403
mov eax, dword [ebp - 0x4a0]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x4a4]
push eax
push ecx
call fcn.004e6456
pop ecx
pop ecx
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], 0xf
mov byte [ebp - 0x44], bl
call fcn.0040258a
mov esi, dword [ebp - 0x4c4]
test esi, esi
je 0x40d7c8
mov edi, dword [ebp - 0x4c0]
cmp esi, edi
je 0x40dced
mov ecx, esi
call fcn.0040258a
push 0x18
pop eax
add esi, eax
cmp esi, edi
jne 0x40dcd7
mov esi, dword [ebp - 0x4c4]
mov eax, dword [ebp - 0x4bc]
sub eax, esi
mov dword [ebp - 0x4a4], esi
push 0x18
cdq
pop ecx
idiv ecx
imul eax, eax, 0x18
mov dword [ebp - 0x4a0], eax
cmp eax, 0x1000
jb 0x40dd32
lea eax, [ebp - 0x4a0]
push eax
lea eax, [ebp - 0x4a4]
push eax
call fcn.00401403
mov eax, dword [ebp - 0x4a0]
mov esi, dword [ebp - 0x4a4]
pop ecx
pop ecx
push eax
push esi
call fcn.004e6456
pop ecx
pop ecx
mov dword [ebp - 0x4c4], ebx
mov dword [ebp - 0x4c0], ebx
mov dword [ebp - 0x4bc], ebx
jmp 0x40d7c8
sub esp, 0x18
lea eax, [ebp - 0x44]
mov ecx, esp
push eax
mov dword [ecx], ebx
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], ebx
call fcn.004055b2
push 0x2c
lea eax, [ebp - 0x20]
push eax
call fcn.00409ab1
mov byte [ebp - 4], 0x10
mov edx, dword [eax]
cmp dword [edx + 0x14], 0x10
jb 0x40dd81
mov edx, dword [edx]
lea ecx, [ebp - 0xa4]
call fcn.00406de6
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x12
call fcn.004072c3
lea eax, [ebp - 0xa4]
mov edx, str._____steam:__install_
push eax
lea ecx, [ebp - 0x8c]
call fcn.004134ed
pop ecx
mov esi, eax
push 0x22
mov ecx, esi
mov byte [ebp - 4], 0x13
call fcn.004071ae
push esi
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
call fcn.0040266b
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 0x15
call fcn.0040258a
lea ecx, [ebp - 0x49c]
call fcn.00408b32
push ebx
lea ecx, [ebp - 0x49c]
mov byte [ebp - 4], 0x16
call fcn.00427aed
cmp dword [ebp - 0x48], 8
lea ecx, [ebp - 0x5c]
push 1
cmovae ecx, dword [ebp - 0x5c]
lea eax, [ebp - 0x74]
cmp dword [ebp - 0x60], 8
push ebx
cmovae eax, dword [ebp - 0x74]
push ecx
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push dword [edi + 0x248]
call dword [sym.imp.USER32.dll_DestroyWindow]
lea ecx, [ebp - 0x49c]
call fcn.00427a31
mov eax, dword [ebp - 0x48]
cmp eax, 8
jb 0x40de88
mov ecx, dword [ebp - 0x5c]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x4a0], eax
mov dword [ebp - 0x4a4], ecx
cmp eax, 0x1000
jb 0x40de7f
lea eax, [ebp - 0x4a0]
push eax
lea eax, [ebp - 0x4a4]
push eax
call fcn.00401403
mov eax, dword [ebp - 0x4a0]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x4a4]
push eax
push ecx
call fcn.004e6456
pop ecx
pop ecx
xor eax, eax
mov dword [ebp - 0x4c], ebx
lea ecx, [ebp - 0xa4]
mov dword [ebp - 0x48], 7
mov word [ebp - 0x5c], ax
call fcn.0040258a
mov eax, dword [ebp - 0x30]
cmp eax, 0x10
jb 0x40deec
mov ecx, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x4a0], eax
mov dword [ebp - 0x4a4], ecx
cmp eax, 0x1000
jb 0x40dee3
lea eax, [ebp - 0x4a0]
push eax
lea eax, [ebp - 0x4a4]
push eax
call fcn.00401403
mov eax, dword [ebp - 0x4a0]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x4a4]
push eax
push ecx
call fcn.004e6456
pop ecx
pop ecx
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], 0xf
mov byte [ebp - 0x44], bl
call fcn.0040258a
mov esi, dword [ebp - 0x4c4]
test esi, esi
je 0x40df79
mov edi, dword [ebp - 0x4c0]
cmp esi, edi
je 0x40df2b
mov ecx, esi
call fcn.0040258a
push 0x18
pop eax
add esi, eax
cmp esi, edi
jne 0x40df15
mov esi, dword [ebp - 0x4c4]
mov eax, dword [ebp - 0x4bc]
sub eax, esi
mov dword [ebp - 0x4a4], esi
push 0x18
cdq
pop ecx
idiv ecx
imul eax, eax, 0x18
mov dword [ebp - 0x4a0], eax
cmp eax, 0x1000
jb 0x40df70
lea eax, [ebp - 0x4a0]
push eax
lea eax, [ebp - 0x4a4]
push eax
call fcn.00401403
mov eax, dword [ebp - 0x4a0]
mov esi, dword [ebp - 0x4a4]
pop ecx
pop ecx
push eax
push esi
call fcn.004e6456
pop ecx
pop ecx
push 0x18
pop ecx
mov esi, dword [ebp - 0x4b8]
test esi, esi
je 0x40d856
mov edi, dword [ebp - 0x4b4]
cmp esi, edi
je 0x40d7f9
mov ecx, esi
call fcn.0040258a
push 0x18
pop ecx
add esi, ecx
cmp esi, edi
jne 0x40df98
mov esi, dword [ebp - 0x4b8]
jmp 0x40d7f9