Function at 0x4044b0
Capabilities:
Create process on windows
Create thread
Hide graphical window
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x453a8a
mov eax, dword fs:[0]
push eax
sub esp, 0x9a8
mov eax, dword [0x468740]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x888], eax
mov dword [ebp - 0x984], 0
mov esi, dword [sym.imp.USER32.dll_RegisterWindowMessageW]
push str.WM_INCREMENT_PROGRESS
mov dword [0x46c9f0], eax
call esi
push str.WM_PATCHING_DONE
mov dword [0x46c9e4], eax
call esi
push str.WM_SET_PROGRESS
mov dword [0x46c9cc], eax
call esi
push str.WM_SET_ERROR
mov dword [0x46c9f4], eax
call esi
push str.WM_SET_STAGE
mov dword [0x46c9ec], eax
call esi
lea ecx, [ebp - 0x92c]
mov dword [0x46c9f8], eax
call fcn.004035e0
mov dword [ebp - 4], 0
lea edx, [ebp - 0x884]
mov byte [ebp - 0x984], 0
lea ecx, [ebp - 0x99c]
push dword [ebp - 0x984]
mov dword [ebp - 0x884], str.tw_update.log
call fcn.00407590
lea eax, [ebp - 0x99c]
mov byte [ebp - 4], 1
push eax
lea edx, [ebp - 0x92c]
lea ecx, [ebp - 0x8fc]
call fcn.00402000
add esp, 8
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x988]
cmp ecx, 7
jbe 0x4045d3
mov edx, dword [ebp - 0x99c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4045c9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404d08
push ecx
push edx
call fcn.0043c29e
add esp, 8
xor eax, eax
mov dword [ebp - 0x98c], 0
mov word [ebp - 0x99c], ax
lea ecx, [ebp - 0x8e4]
lea eax, [ebp - 0x8fc]
mov dword [ebp - 0x988], 7
push eax
call fcn.00406280
mov dword [ebp - 0x984], 8
cmp dword [ebp - 0x8d0], 7
lea eax, [ebp - 0x8e4]
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
cmova eax, dword [ebp - 0x8e4]
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
push eax
call edi
mov esi, eax
mov dword [ebp - 0x898], esi
mov byte [ebp - 4], 5
cmp esi, 0xffffffff
jne 0x4048b9
lea ecx, [ebp - 0x914]
call fcn.00403450
mov byte [ebp - 4], 6
lea edx, [ebp - 0x884]
mov byte [ebp - 0x88c], 0
lea ecx, [ebp - 0x9b4]
push dword [ebp - 0x88c]
call fcn.00407590
add esp, 4
lea eax, [ebp - 0x914]
mov byte [ebp - 4], 8
push eax
lea ecx, [ebp - 0x99c]
call fcn.00406280
lea eax, [ebp - 0x9b4]
mov dword [ebp - 0x984], 0x208
push eax
lea ecx, [ebp - 0x99c]
call fcn.00401d40
lea eax, [ebp - 0x99c]
push eax
lea ecx, [ebp - 0x914]
call fcn.004061f0
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x988]
cmp ecx, 7
jbe 0x404708
mov edx, dword [ebp - 0x99c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4046fe
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404d0d
push ecx
push edx
call fcn.0043c29e
add esp, 8
xor eax, eax
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x9a0]
mov dword [ebp - 0x98c], 0
mov dword [ebp - 0x988], 7
mov word [ebp - 0x99c], ax
cmp ecx, 7
jbe 0x404769
mov edx, dword [ebp - 0x9b4]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40475f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404d0d
push ecx
push edx
call fcn.0043c29e
add esp, 8
lea eax, [ebp - 0x914]
push eax
lea ecx, [ebp - 0x8cc]
call fcn.00406280
cmp dword [ebp - 0x8b8], 7
lea eax, [ebp - 0x8cc]
push 0
cmova eax, dword [ebp - 0x8cc]
push 0x80
push 2
push 0
push 1
push 0x40000000
push eax
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x404812
push 0x800
lea eax, [ebp - 0x880]
push 0
push eax
call fcn.0043d910
mov edi, dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x880]
add esp, 0xc
push 0x400
push eax
push 0x7d
push dword [0x46c9f0]
call edi
push 0x40
lea eax, [ebp - 0x80]
push 0
push eax
call fcn.0043d910
add esp, 0xc
lea eax, [ebp - 0x80]
push 0x20
push eax
push 0x7c
push dword [0x46c9f0]
call edi
push 0x10
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x880]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp - 0x8b8]
mov dword [ebp - 0x898], esi
cmp ecx, 7
jbe 0x404858
mov edx, dword [ebp - 0x8cc]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40484e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404d12
push ecx
push edx
call fcn.0043c29e
add esp, 8
xor eax, eax
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x900]
mov dword [ebp - 0x8bc], 0
mov dword [ebp - 0x8b8], 7
mov word [ebp - 0x8cc], ax
cmp ecx, 7
jbe 0x4048b9
mov edx, dword [ebp - 0x914]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4048af
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404d12
push ecx
push edx
call fcn.0043c29e
add esp, 8
push 0
lea eax, [ebp - 0x88c]
mov dword [0x46c9d8], esi
push eax
push 2
lea eax, [ebp - 0x884]
mov word [ebp - 0x884], 0xfeff
push eax
push esi
mov dword [ebp - 0x88c], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
push str.Log_file_created.
call fcn.004037d0
add esp, 4
push 0
push fcn.00403930
push 0
push 0x67
push dword [ebp - 0x888]
call dword [sym.imp.USER32.dll_CreateDialogParamW]
push 5
push eax
mov dword [0x46c9e0], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov edi, dword [sym.imp.USER32.dll_PeekMessageW]
lea eax, [ebp - 0x8b4]
push 1
push 0
push 0
push 0
push eax
call edi
test eax, eax
je 0x404996
nop dword [eax + eax]
push dword [0x46c9e0]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x404967
lea eax, [ebp - 0x8b4]
push eax
push dword [0x46c9e0]
call dword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
jne 0x404981
lea eax, [ebp - 0x8b4]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x8b4]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 1
push 0
push 0
push 0
lea eax, [ebp - 0x8b4]
push eax
call edi
test eax, eax
jne 0x404940
push 4
call fcn.0043c26e
mov dword [ebp - 0x888], eax
mov dword [eax], 0x405ff0
lea ecx, [ebp - 0x890]
mov byte [ebp - 4], 9
push ecx
push 0
push eax
push 0x407820
push 0
push 0
call fcn.0043f61f
add esp, 0x1c
mov dword [ebp - 0x894], eax
test eax, eax
je 0x404cf7
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x890]
test ecx, ecx
je 0x404d26
push ecx
push eax
call fcn.0043b662
add esp, 8
test eax, eax
jne 0x404d26
push eax
push eax
push eax
lea eax, [ebp - 0x8b4]
xorps xmm0, xmm0
push eax
movlpd qword [ebp - 0x894], xmm0
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x404acc
mov edi, dword [sym.imp.USER32.dll_IsWindow]
cmp eax, 0xffffffff
je 0x404acc
mov eax, dword [ebp - 0x8b0]
cmp eax, dword [0x46c9e4]
je 0x404a99
cmp eax, dword [0x46c9cc]
je 0x404a99
cmp eax, dword [0x46c9f4]
je 0x404a99
cmp eax, dword [0x46c9f8]
je 0x404a99
cmp eax, dword [0x46c9ec]
je 0x404a99
push dword [0x46c9e0]
call edi
test eax, eax
je 0x404a7d
lea eax, [ebp - 0x8b4]
push eax
push dword [0x46c9e0]
call dword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
jne 0x404ab1
lea eax, [ebp - 0x8b4]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x8b4]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x404ab1
push dword [ebp - 0x8a8]
push dword [ebp - 0x8ac]
push eax
push dword [0x46c9e0]
call fcn.00403930
push 0
push 0
push 0
lea eax, [ebp - 0x8b4]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x404a23
push str.Update_is_complete__starting_the_game...
call fcn.004037d0
mov eax, dword [0x46c9e0]
add esp, 4
test eax, eax
je 0x404af3
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [0x46c9e0], 0
mov byte [ebp - 0x888], 0
lea ecx, [ebp - 0x9b4]
push dword [ebp - 0x888]
call fcn.004075d0
add esp, 4
lea ecx, [ebp - 0x9b4]
mov byte [ebp - 4], 0xb
call fcn.004031b0
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x9a0]
cmp ecx, 7
jbe 0x404b61
mov edx, dword [ebp - 0x9b4]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x404b57
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404d17
push ecx
push edx
call fcn.0043c29e
add esp, 8
push 0x44
lea eax, [ebp - 0x980]
push 0
push eax
call fcn.0043d910
add esp, 0xc
lea eax, [ebp - 0x93c]
xorps xmm0, xmm0
movups xmmword [ebp - 0x93c], xmm0
movups xmm0, xmmword [str.WoW.exe]
push eax
lea eax, [ebp - 0x980]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
lea eax, [ebp - 0x40]
movups xmmword [ebp - 0x40], xmm0
push eax
xorps xmm0, xmm0
push 0
movups xmmword [ebp - 0x30], xmm0
movups xmmword [ebp - 0x20], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x404bcb
push str.ERROR:_Cant_start_WoW.exe
call fcn.004037d0
add esp, 4
cmp dword [ebp - 0x890], 0
jne 0x404d1c
cmp esi, 0xffffffff
je 0x404be4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x8d0]
cmp ecx, 7
jbe 0x404c24
mov edx, dword [ebp - 0x8e4]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x404c1a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404d21
push ecx
push edx
call fcn.0043c29e
add esp, 8
mov ecx, dword [ebp - 0x8e8]
xor eax, eax
mov dword [ebp - 0x8d4], 0
mov dword [ebp - 0x8d0], 7
mov word [ebp - 0x8e4], ax
cmp ecx, 7
jbe 0x404c81
mov edx, dword [ebp - 0x8fc]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x404c77
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404d21
push ecx
push edx
call fcn.0043c29e
add esp, 8
mov ecx, dword [ebp - 0x918]
xor eax, eax
mov dword [ebp - 0x8ec], 0
mov dword [ebp - 0x8e8], 7
mov word [ebp - 0x8fc], ax
cmp ecx, 7
jbe 0x404cda
mov edx, dword [ebp - 0x92c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x404cd0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404d21
push ecx
push edx
call fcn.0043c29e
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043c260
mov esp, ebp
pop ebp
ret
push 6
mov dword [ebp - 0x890], 0
call fcn.0043b492
call fcn.0043fb9d
call fcn.0043fb9d
call fcn.0043fb9d
call fcn.0043fb9d
call fcn.0043f6b0
call fcn.0043fb9d
push 1
call fcn.0043b492
int3