Function at 0x140011541
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
jmp 0x1400199a0
push rbp
push rdi
sub rsp, 0x7b8
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x14a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14002a040]
xor rax, rbp
mov qword [rbp + 0x758], rax
lea rcx, [0x1400310f3]
call fcn.14001177b
nop
lea rax, str.SOFTWAREValveSteam
mov qword [rbp + 0x28], rax
lea rax, str.SteamPath
mov qword [rbp + 0x48], rax
mov dword [rbp + 0x64], 0x104
lea rax, [rbp + 8]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp + 0x28]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140019cdb
lea rax, [rbp + 0x64]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x90]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbp + 0x48]
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140019caa
lea rdx, str.SteamPath:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140011429
lea rdx, [rbp + 0x90]
mov rcx, rax
call fcn.1400113e3
lea rdx, [0x1400113b1]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
lea rcx, [rbp + 0x2b8]
call fcn.1400115e6
nop
lea rcx, [rbp + 0x2f8]
call fcn.1400115e6
nop
lea rdx, str.teq7880
lea rcx, [rbp + 0x2b8]
call fcn.14001182f
nop
lea rdx, str.Dcb094782
lea rcx, [rbp + 0x2f8]
call fcn.14001182f
nop
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 0x338]
call fcn.140011271
nop
lea r8, [rbp + 0x2b8]
lea rdx, str._steam.exe__rememberpassword__windowed___login
lea rcx, [rbp + 0x678]
call fcn.1400117f8
mov qword [rbp + 0x728], rax
mov rax, qword [rbp + 0x728]
mov qword [rbp + 0x730], rax
lea r8, [0x140025b98]
mov rdx, qword [rbp + 0x730]
lea rcx, [rbp + 0x6b8]
call fcn.14001148d
mov qword [rbp + 0x738], rax
mov rax, qword [rbp + 0x738]
mov qword [rbp + 0x740], rax
lea r8, [rbp + 0x2f8]
mov rdx, qword [rbp + 0x740]
lea rcx, [rbp + 0x6f8]
call fcn.1400117d0
mov qword [rbp + 0x748], rax
mov rax, qword [rbp + 0x748]
mov qword [rbp + 0x750], rax
mov rdx, qword [rbp + 0x750]
lea rcx, [rbp + 0x338]
call fcn.1400116d6
nop
lea rcx, [rbp + 0x6f8]
call fcn.1400116ae
nop
lea rcx, [rbp + 0x6b8]
call fcn.1400116ae
nop
lea rcx, [rbp + 0x678]
call fcn.1400116ae
nop
mov dword [rbp + 0x380], 0x68
lea rax, [rbp + 0x388]
mov rdi, rax
xor eax, eax
mov ecx, 0x60
rep stosb byte [rdi], al
xor edx, edx
lea rcx, [rbp + 0x338]
call fcn.1400110eb
lea rcx, [rbp + 0x408]
mov qword [rsp + 0x48], rcx
lea rcx, [rbp + 0x380]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x140019c65
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x724], eax
lea rdx, str.Steam_ba
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.1400113e3
mov ecx, dword [rbp + 0x724]
mov edx, ecx
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
lea rdx, [0x1400113b1]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
jmp 0x140019c81
mov rcx, qword [rbp + 0x408]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, qword [rbp + 0x410]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rbp + 0x338]
call fcn.1400116ae
nop
lea rcx, [rbp + 0x2f8]
call fcn.1400116ae
nop
lea rcx, [rbp + 0x2b8]
call fcn.1400116ae
nop
jmp 0x140019cce
lea rdx, [0x140025c80]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400110e1
lea rdx, [0x140011055]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
jmp 0x140019cff
lea rdx, str.Anahtar_a
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400110e1
lea rdx, [0x140011055]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
xor eax, eax
mov edi, eax
lea rcx, [rbp - 0x50]
lea rdx, [0x140025310]
call fcn.140011663
mov eax, edi
mov rcx, qword [rbp + 0x758]
xor rcx, rbp
call fcn.1400113a7
lea rsp, [rbp + 0x768]
pop rdi
pop rbp
ret