Function at 0x404440
Capabilities:
Create process on windows
Persist via run registry key
Set registry value
Terminate process

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x40fcf1
push eax
mov dword fs:[0], esp
sub esp, 0x9ec
lea eax, [esp + 0x8ec]
push ebx
push esi
push edi
push 0xff
push eax
call fcn.00406edd
mov edi, str..exe
or ecx, 0xffffffff
xor eax, eax
mov esi, dword [esp + 0xa10]
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edx, esi
sub edx, ecx
mov edi, esi
or ecx, 0xffffffff
push str..exe
repne scasb al, byte es:[edi]
not ecx
dec ecx
add edx, ecx
push edx
call fcn.004074c0
add esp, 0x10
test eax, eax
jne 0x40458e
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x18]
push eax
push ecx
push 0
push 0xf003f
push 0
push 0x4162c4
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x404542
mov edi, esi
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov edx, dword [esp + 0x18]
not ecx
push ecx
push esi
push 1
push eax
push str.EXEPatch
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, dword [sym.imp.USER32.dll_LoadStringA]
lea eax, [esp + 0x2e8]
push 0x100
push eax
push 1
push 0
call esi
lea ecx, [esp + 0x68]
push 0x80
push ecx
push 2
push 0
call esi
lea edx, [esp + 0x68]
push 0
lea eax, [esp + 0x2ec]
push edx
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
call fcn.00404c00
jmp 0x404bde
lea ecx, [esp + 0x2e8]
push 0x100
push ecx
push 7
push 0
call dword [sym.imp.USER32.dll_LoadStringA]
lea edx, [esp + 0x2e8]
push esi
lea eax, [esp + 0x1ec]
push edx
push eax
call fcn.00406ff8
add esp, 0xc
lea ecx, [esp + 0x1e8]
push 0
push str.ERROR
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x404bde
mov edi, str..rtp
or ecx, 0xffffffff
xor eax, eax
mov edx, esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, esi
sub edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
push str..rtp
add edx, ecx
push edx
call fcn.004074c0
add esp, 8
test eax, eax
jne 0x404a6a
call fcn.00403250
mov edi, dword [sym.imp.USER32.dll_PeekMessageA]
push 1
mov dword [esp + 0x14], eax
push 0
push 0
lea eax, [esp + 0x30]
push 0
push eax
call edi
test eax, eax
je 0x404614
mov ebx, dword [sym.imp.USER32.dll_TranslateMessage]
push ebp
mov ebp, dword [sym.imp.USER32.dll_DispatchMessageA]
lea ecx, [esp + 0x28]
push ecx
call ebx
lea edx, [esp + 0x28]
push edx
call ebp
push 1
push 0
push 0
lea eax, [esp + 0x34]
push 0
push eax
call edi
test eax, eax
jne 0x4045f2
pop ebp
push str.patchw32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
jne 0x404685
mov esi, dword [sym.imp.USER32.dll_LoadStringA]
lea ecx, [esp + 0x1e8]
push 0x100
push ecx
push 9
push eax
call esi
lea edx, [esp + 0x1e8]
push str.patchw32.dll
lea eax, [esp + 0xec]
push edx
push eax
call fcn.00406ff8
add esp, 0xc
lea ecx, [esp + 0x68]
push 0x80
push ecx
push 8
push edi
call esi
lea edx, [esp + 0x68]
push edi
lea eax, [esp + 0xec]
push edx
push eax
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0xffffffffffffffff
call fcn.00406e08
push str.RTPatchApply32_12
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
test ebx, ebx
jne 0x4046d8
mov esi, dword [sym.imp.USER32.dll_LoadStringA]
lea ecx, [esp + 0xe8]
push 0x100
push ecx
push 0xa
push eax
call esi
lea edx, [esp + 0x68]
push 0x80
push edx
push 8
push ebx
call esi
lea eax, [esp + 0x68]
push ebx
lea ecx, [esp + 0xec]
push eax
push ecx
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x404bde
push esi
lea edx, [esp + 0x2ec]
push str.__s__.
push edx
call fcn.00406ff8
add esp, 0xc
lea eax, [esp + 0x2e8]
push 1
push sym.generals.exe_void____stdcall_PatchCallBack_unsigned_int__void__
push eax
call ebx
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push esi
call fcn.004074a7
mov ecx, dword [esp + 0x14]
add esp, 4
push ecx
call dword [sym.imp.USER32.dll_DestroyWindow]
test ebx, ebx
je 0x4047de
push 0
call fcn.004070d0
lea edx, [esp + 0x14]
mov dword [esp + 0x14], eax
push edx
call fcn.00407464
add esp, 8
lea edx, [esp + 0x40]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
test cl, cl
jne 0x404740
call fcn.00401c80
test eax, eax
je 0x404bde
push ebx
push str.Patch_error:
push 0x413274
push 0xdb
push 0x4130b8
push str.C:projectsRTScodeToolsLauncherpatch.cpp
lea eax, [esp + 0x58]
push 0x413240
push eax
push str.ERR
call fcn.00401c80
mov ecx, eax
call fcn.00405b74
mov ecx, eax
call fcn.00405b74
mov ecx, eax
call fcn.00405b74
mov ecx, eax
call fcn.00405b74
mov ecx, eax
call fcn.00405b74
mov ecx, eax
call fcn.00405dcf
mov ecx, eax
call fcn.00405b74
mov ecx, eax
call fcn.00405b74
mov ecx, eax
call fcn.00405dcf
push 0x404f50
push 0xa
mov ecx, eax
call fcn.00405d53
mov ecx, eax
call fcn.00404f30
jmp 0x404bde
push 0x5c
push esi
call fcn.004062d0
add esp, 8
test eax, eax
je 0x4047ff
lea esi, [eax + 1]
push 0x5c
push esi
call fcn.004062d0
add esp, 8
test eax, eax
jne 0x4047ed
test esi, esi
je 0x404810
push esi
call fcn.004063e3
add esp, 4
mov dword [esp + 0x20], eax
lea ecx, [esp + 0x14]
call fcn.00401c90
mov ecx, dword [esp + 0xa10]
lea edx, [esp + 0x6f8]
push ecx
push str.SKU_d
push edx
mov dword [esp + 0xa0c], 0
call fcn.00406ff8
add esp, 0xc
lea eax, [esp + 0x14]
lea ecx, [esp + 0x6f8]
push eax
push ecx
mov ecx, dword [esp + 0xa14]
call fcn.00401540
test al, al
jne 0x404924
push 0
call fcn.004070d0
lea edx, [esp + 0x14]
mov dword [esp + 0x14], eax
push edx
call fcn.00407464
add esp, 8
lea edx, [esp + 0x40]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
test cl, cl
jne 0x40487e
call fcn.00401c80
test eax, eax
je 0x40490b
push str.SKU_is_missing_from_config_file_
push 0x413274
push 0xf4
push 0x4130b8
push str.C:projectsRTScodeToolsLauncherpatch.cpp
lea eax, [esp + 0x54]
push 0x413240
push eax
push str.ERR
call fcn.00401c80
mov ecx, eax
call fcn.00405b74
mov ecx, eax
call fcn.00405b74
mov ecx, eax
call fcn.00405b74
mov ecx, eax
call fcn.00405b74
mov ecx, eax
call fcn.00405b74
mov ecx, eax
call fcn.00405dcf
mov ecx, eax
call fcn.00405b74
mov ecx, eax
call fcn.00405b74
push 0x404f50
push 0xa
mov ecx, eax
call fcn.00405d53
mov ecx, eax
call fcn.00404f30
lea ecx, [esp + 0x14]
mov dword [esp + 0xa00], 0xffffffff
call fcn.00401cc0
jmp 0x404bde
lea ecx, [esp + 0x18]
call fcn.00401c90
lea ecx, [esp + 0xc]
mov byte [esp + 0xa00], 1
call fcn.00401c90
lea ecx, [esp + 0x18]
mov byte [esp + 0xa00], 2
push ecx
push 0x4130b8
push 0
lea ecx, [esp + 0x20]
call fcn.00402140
lea edx, [esp + 0x14]
lea ecx, [esp + 0xc]
push edx
mov esi, eax
call fcn.00401d60
push esi
push 0
lea ecx, [esp + 0x14]
call fcn.00401d90
lea ecx, [esp + 0xc]
call fcn.00401f40
cmp byte [eax], 0x20
jne 0x4049a0
push 1
push 0
lea ecx, [esp + 0x14]
call fcn.00401d90
lea ecx, [esp + 0xc]
call fcn.00401f40
cmp byte [eax], 0x20
je 0x404985
lea eax, [esp + 0x1c]
lea ecx, [esp + 0xc]
push eax
push 0xf003f
push 0
call fcn.00401f40
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x20]
push 4
push ecx
push 4
push 0
push str.Version
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea ecx, [esp + 0x3e8]
call fcn.00404f60
xor eax, eax
mov cl, byte [eax + 0x413208]
mov byte [esp + eax + 0x3e8], cl
inc eax
test cl, cl
jne 0x4049ea
xor eax, eax
mov cl, byte [eax + str.notepad]
mov byte [esp + eax + 0x4e8], cl
inc eax
test cl, cl
jne 0x4049fe
xor eax, eax
mov cl, byte [eax + str._launcher.txt]
mov byte [esp + eax + 0x5e8], cl
inc eax
test cl, cl
jne 0x404a12
lea eax, [esp + 0x3e8]
push eax
call fcn.00404f80
lea ecx, [esp + 0x3ec]
push 0
push ecx
call fcn.00405080
add esp, 0xc
lea ecx, [esp + 0xc]
mov byte [esp + 0xa00], 1
call fcn.00401cc0
lea ecx, [esp + 0x18]
mov byte [esp + 0xa00], 0
call fcn.00401cc0
jmp 0x40490b
mov edi, str..exn
or ecx, 0xffffffff
xor eax, eax
mov edx, esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, esi
sub edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
push str..exn
add edx, ecx
push edx
call fcn.004074c0
add esp, 8
test eax, eax
jne 0x404afa
lea ecx, [esp + 0x3e8]
call fcn.00404f60
xor eax, eax
mov cl, byte [eax + 0x413208]
mov byte [esp + eax + 0x3e8], cl
inc eax
test cl, cl
jne 0x404aa9
lea edx, [esp + 0x4e8]
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x404ac6
lea eax, [esp + 0x3e8]
push eax
call fcn.00404f80
lea ecx, [esp + 0x3ec]
push 0
push ecx
call fcn.00405080
push esi
call fcn.004074a7
add esp, 0x10
jmp 0x404bde
mov edi, str..web
or ecx, 0xffffffff
xor eax, eax
mov edx, esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, esi
sub edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
push str..web
add edx, ecx
push edx
call fcn.004074c0
add esp, 8
test eax, eax
jne 0x404bde
mov edi, dword [sym.imp.USER32.dll_LoadStringA]
lea eax, [esp + 0xe8]
push 0x100
push eax
push 3
push 0
call edi
lea ecx, [esp + 0x1e8]
push 0x80
push ecx
push 4
push 0
call edi
mov ebx, dword [sym.imp.USER32.dll_MessageBoxA]
lea edx, [esp + 0x1e8]
push 0
lea eax, [esp + 0xec]
push edx
push eax
push 0
call ebx
push 0x4131a8
push esi
call fcn.00407222
mov edi, eax
add esp, 8
test edi, edi
je 0x404bd2
push edi
lea ecx, [esp + 0x7fc]
push 0xff
push ecx
call fcn.0040638c
push edi
call fcn.004071ac
add esp, 0x10
lea edx, [esp + 0x7f8]
push 5
push 0x413208
push 0
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push esi
call fcn.004074a7
add esp, 4
push 0
call fcn.00406e08
push 0
push str.Patchfile_vanished_
push esi
push 0
call ebx
mov ecx, dword [esp + 0x9f8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x9f8
ret