Function at 0x401d54
Capabilities:
Check if file exists
Create process on windows
Delete file
Get file attributes
Hide graphical window
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push 5
push dword [0x4043e4]
call sub.user32.dll_ShowWindow
push 0
push dword [0x4043e8]
call sub.user32.dll_ShowWindow
push 0
push 0
push 0x184
push dword [0x4043e4]
call sub.user32.dll_SendMessageA
push str.START_PATCHING
call fcn.00401118
push 0x404235
call fcn.00401118
push 1
push 3
call fcn.00401440
test eax, eax
je 0x401f47
mov dword [ebp - 4], eax
jmp 0x401dc9
inc ecx
push ecx
push 3
call fcn.00401440
or eax, eax
je 0x401dc4
cmp eax, dword [ebp - 4]
jne 0x401dc9
jmp 0x401f47
mov dword [ebp - 8], 0
mov ecx, dword [0x404845]
push ecx
mov esi, eax
lea eax, [esi + 0x22]
push str._OFFSET_PATCH_
call fcn.00401118
movzx ebx, byte [esi + 1]
push ebx
push dword [esi + 6]
push eax
call fcn.0040122c
test eax, eax
je 0x401efd
mov eax, dword [esi + 2]
or eax, eax
je 0x401e28
cmp dword [0x404830], eax
je 0x401e1c
push 0x4040db
call fcn.00401118
jmp 0x401efd
push 0x4040fe
call fcn.00401118
jmp 0x401e32
push 0x40410b
call fcn.00401118
cmp dword [esi + 0xa], 0
je 0x401e6b
push dword [0x404834]
push dword [0x404830]
call section..text
cmp dword [esi + 0xa], eax
je 0x401e5f
push 0x4040a3
call fcn.00401118
jmp 0x401efd
push 0x4040b7
call fcn.00401118
jmp 0x401e75
push str.CRC32_
call fcn.00401118
cmp byte [esi + 1], 1
jne 0x401ec4
mov eax, 0x226
add eax, dword [0x404841]
push esi
push eax
push 3
push dword [0x404834]
call fcn.00402254
or eax, eax
jne 0x401eb1
push 0x40414b
call fcn.00401118
push dword [0x404830]
pop dword [0x40483c]
jmp 0x401ec2
push 0x404160
call fcn.00401118
mov dword [ebp - 8], 1
jmp 0x401efd
mov eax, dword [esi + 0x16]
lea esi, [eax + esi]
mov edi, dword [0x404834]
cmp dword [esi], 0
jne 0x401edc
cmp word [esi + 4], 0
je 0x401efd
lodsd eax, dword [esi]
xchg ecx, eax
lodsb al, byte [esi]
cmp byte [ecx + edi], al
je 0x401ef0
push 0x404123
call fcn.00401118
jmp 0x401efd
lodsb al, byte [esi]
mov byte [ecx + edi], al
mov dword [ebp - 8], 1
jmp 0x401ed0
cmp dword [ebp - 8], 0
jne 0x401f1b
push dword [0x404830]
pop dword [0x40483c]
push 0x4041c1
call fcn.00401118
jmp 0x401f25
push 0x4041d2
call fcn.00401118
push dword [ebp - 8]
call fcn.004013e0
push 0x40422c
call fcn.00401118
push 0x404235
call fcn.00401118
pop ecx
jmp 0x401db2
push 1
push 4
call fcn.00401440
test eax, eax
je 0x402093
mov dword [ebp - 4], eax
jmp 0x401f74
inc ecx
push ecx
push 4
call fcn.00401440
or eax, eax
je 0x401f6f
cmp eax, dword [ebp - 4]
jne 0x401f74
jmp 0x402093
mov dword [ebp - 8], 0
mov ecx, dword [0x404845]
push ecx
mov esi, eax
lea eax, [esi + 0x22]
push str._SEARCH__REPLACE_PATCH_
call fcn.00401118
movzx ebx, byte [esi + 1]
push ebx
push dword [esi + 6]
push eax
call fcn.0040122c
test eax, eax
je 0x402055
cmp byte [esi + 1], 1
jne 0x401ff6
mov eax, 0x226
add eax, dword [0x404841]
push esi
push eax
push 4
push dword [0x404834]
call fcn.00402254
or eax, eax
jne 0x401fe3
push 0x40414b
call fcn.00401118
push dword [0x404830]
pop dword [0x40483c]
jmp 0x401ff4
push 0x404160
call fcn.00401118
mov dword [ebp - 8], 1
jmp 0x402055
mov eax, dword [esi + 0x16]
lea esi, [eax + esi]
mov ecx, dword [esi]
mov ebx, dword [esi + 4]
push ebx
push dword [0x404830]
push ecx
lea eax, [esi + ecx*2 + 8]
add eax, ecx
push eax
lea eax, [esi + ecx*2 + 8]
push eax
lea eax, [ecx + esi + 8]
push eax
lea eax, [esi + 8]
push eax
push dword [0x404834]
call fcn.00402394
pushal
test eax, eax
jne 0x402044
cmp dword [esi + ecx*4 + 8], 0
je 0x402041
push 0x404171
call fcn.00401118
jmp 0x40204b
popal
jmp 0x402055
mov dword [ebp - 8], 1
popal
lea esi, [esi + ecx*4 + 8]
cmp dword [esi], 0
jne 0x401ffc
cmp dword [ebp - 8], 0
jne 0x402067
push 0x4041c1
call fcn.00401118
jmp 0x402071
push 0x4041d2
call fcn.00401118
push dword [ebp - 8]
call fcn.004013e0
push 0x40422c
call fcn.00401118
push 0x404235
call fcn.00401118
pop ecx
jmp 0x401f5d
push 1
push 5
call fcn.00401440
test eax, eax
je 0x40214f
mov dword [ebp - 4], eax
xor esi, esi
jmp 0x4020c2
inc ecx
push ecx
push 5
call fcn.00401440
or eax, eax
je 0x4020bd
cmp eax, dword [ebp - 4]
jne 0x4020c2
jmp 0x40214f
mov ecx, dword [0x404845]
push ecx
mov esi, eax
lea eax, [esi + 9]
push str._REGISTRY_PATCH_
call fcn.00401118
push dword [esi + 1]
push eax
push str.c:_regpatch.reg
call fcn.0040274c
test eax, eax
je 0x402115
mov edi, 0x404428
mov byte [edi], 0
push str.regedit.exe__s
push edi
call sub.kernel32.dll_lstrcatA
push str.c:_regpatch.reg
push edi
call sub.kernel32.dll_lstrcatA
push 0
push edi
call sub.kernel32.dll_WinExec
cmp eax, 0x1f
ja 0x402121
push 0x404197
call fcn.00401118
jmp 0x40212b
push 0x4041ae
call fcn.00401118
push str.c:_regpatch.reg
call sub.kernel32.dll_DeleteFileA
push 0x40422c
call fcn.00401118
push 0x404235
call fcn.00401118
pop ecx
jmp 0x4020ab
push 1
push 7
call fcn.00401440
test eax, eax
je 0x402234
mov dword [ebp - 4], eax
jmp 0x40217c
inc ecx
push ecx
push 7
call fcn.00401440
or eax, eax
je 0x402177
cmp eax, dword [ebp - 4]
jne 0x40217c
jmp 0x402234
mov ecx, dword [0x404845]
push ecx
mov esi, eax
lea edi, [esi + 0xd]
mov ebx, dword [esi + 5]
lea ebx, [ebx + esi]
push 0x200
push 0x404428
push edi
call sub.kernel32.dll_ExpandEnvironmentStringsA
mov edi, 0x404428
push str._EXPORT_FILE_
call fcn.00401118
push edi
call fcn.00401118
push edi
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x4021f6
cmp byte [0x4048f2], 0
jne 0x4021dc
push 0x24
push edi
push 0x40433e
push dword [0x4043cc]
call sub.user32.dll_MessageBoxA
jmp 0x4021f1
cmp byte [0x4048f4], 1
jne 0x4021ec
mov eax, 6
jmp 0x4021f1
mov eax, 7
cmp eax, 7
je 0x40221a
push dword [esi + 1]
push ebx
push edi
call fcn.0040274c
or eax, eax
jne 0x402210
push 0x404205
call fcn.00401118
jmp 0x40221a
push 0x40421c
call fcn.00401118
push 0x40422c
call fcn.00401118
push 0x404235
call fcn.00401118
pop ecx
jmp 0x402165
push str.PATCHING_DONE
call fcn.00401118
push 1
push 0
push 0
push dword [0x4043cc]
call sub.user32.dll_RedrawWindow
leave
ret