Function at 0x404180
Capabilities:
Create process on windows
Persist via run registry key
Set registry value
Terminate process

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x40ff51
push eax
mov dword fs:[0], esp
sub esp, 0x9ec
lea eax, [esp + 0x8ec]
push ebx
push esi
push edi
push 0xff
push eax
call fcn.0040714a
mov edi, str..exe
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [esp + 0xa10]
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edx, ebx
sub edx, ecx
mov edi, ebx
or ecx, 0xffffffff
push str..exe
repne scasb al, byte es:[edi]
not ecx
dec ecx
add edx, ecx
push edx
call fcn.00407720
add esp, 0x10
test eax, eax
jne 0x4042ce
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x14]
push eax
push ecx
push 0
push 0xf003f
push 0
push 0x4171c0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
push 0x80000002
call dword [sym.imp.ADVAPI32.DLL_RegCreateKeyExA]
test eax, eax
jne 0x404282
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov edx, dword [esp + 0x14]
not ecx
push ecx
push ebx
push 1
push eax
push str.EXEPatch
push edx
call dword [sym.imp.ADVAPI32.DLL_RegSetValueExA]
mov esi, dword [sym.imp.USER32.DLL_LoadStringA]
lea eax, [esp + 0x1e8]
push 0x100
push eax
push 1
push 0
call esi
lea ecx, [esp + 0x68]
push pe_nt_image_headers32
push ecx
push 2
push 0
call esi
lea edx, [esp + 0x68]
push 0
lea eax, [esp + 0x1ec]
push edx
push eax
push 0
call dword [sym.imp.USER32.DLL_MessageBoxA]
call fcn.00404880
jmp 0x404861
lea ecx, [esp + 0x1e8]
push 0x100
push ecx
push 7
push 0
call dword [sym.imp.USER32.DLL_LoadStringA]
lea edx, [esp + 0x1e8]
push ebx
lea eax, [esp + 0x2ec]
push edx
push eax
call fcn.00407265
add esp, 0xc
lea ecx, [esp + 0x2e8]
push 0
push str.ERROR
push ecx
push 0
call dword [sym.imp.USER32.DLL_MessageBoxA]
jmp 0x404861
mov edi, str..rtp
or ecx, 0xffffffff
xor eax, eax
mov edx, ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, ebx
sub edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
push str..rtp
add edx, ecx
push edx
call fcn.00407720
add esp, 8
test eax, eax
jne 0x4046c3
call fcn.00402f60
mov esi, dword [sym.imp.USER32.DLL_PeekMessageA]
push 1
mov dword [esp + 0x1c], eax
push 0
push 0
lea eax, [esp + 0x30]
push 0
push eax
call esi
test eax, eax
je 0x404354
mov edi, dword [sym.imp.USER32.DLL_TranslateMessage]
push ebp
mov ebp, dword [sym.imp.USER32.DLL_DispatchMessageA]
lea ecx, [esp + 0x28]
push ecx
call edi
lea edx, [esp + 0x28]
push edx
call ebp
push 1
push 0
push 0
lea eax, [esp + 0x34]
push 0
push eax
call esi
test eax, eax
jne 0x404332
pop ebp
push str.patchw32.dll
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov esi, eax
test esi, esi
jne 0x4043c8
mov esi, dword [sym.imp.USER32.DLL_LoadStringA]
lea ecx, [esp + 0x2e8]
push 0x100
push ecx
push 9
push eax
call esi
lea edx, [esp + 0x2e8]
push str.patchw32.dll
lea eax, [esp + 0xec]
push edx
push eax
call fcn.00407265
add esp, 0xc
lea ecx, [esp + 0x68]
push pe_nt_image_headers32
push ecx
push 8
push 0
call esi
lea edx, [esp + 0x68]
push 0
lea eax, [esp + 0xec]
push edx
push eax
push 0
call dword [sym.imp.USER32.DLL_MessageBoxA]
push 0xffffffffffffffff
call fcn.00407075
push str.RTPatchApply32_12
push esi
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov edi, eax
test edi, edi
jne 0x40441b
mov esi, dword [sym.imp.USER32.DLL_LoadStringA]
lea ecx, [esp + 0xe8]
push 0x100
push ecx
push 0xa
push eax
call esi
lea edx, [esp + 0x68]
push pe_nt_image_headers32
push edx
push 8
push edi
call esi
lea eax, [esp + 0x68]
push edi
lea ecx, [esp + 0xec]
push eax
push ecx
push edi
call dword [sym.imp.USER32.DLL_MessageBoxA]
jmp 0x404861
push ebx
lea edx, [esp + 0x1ec]
push str.__s__.
push edx
call fcn.00407265
add esp, 0xc
lea eax, [esp + 0x1e8]
push 1
push sym.launcher.exe_void____stdcall_PatchCallBack_unsigned_int__void__
push eax
call edi
push esi
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
push ebx
call fcn.00407714
mov ecx, dword [esp + 0x1c]
add esp, 4
push ecx
call dword [sym.imp.USER32.DLL_DestroyWindow]
push 0x5c
push ebx
call fcn.00406510
add esp, 8
test eax, eax
je 0x40447e
lea ebx, [eax + 1]
push 0x5c
push ebx
call fcn.00406510
add esp, 8
test eax, eax
jne 0x40446c
test ebx, ebx
je 0x40448f
push ebx
call fcn.00406623
add esp, 4
mov dword [esp + 0x20], eax
lea ecx, [esp + 0x10]
call fcn.00401ca0
mov edx, dword [esp + 0xa10]
lea eax, [esp + 0x3e8]
push edx
push str.SKU_d
push eax
mov dword [esp + 0xa0c], 0
call fcn.00407265
add esp, 0xc
lea ecx, [esp + 0x10]
lea edx, [esp + 0x3e8]
push ecx
mov ecx, dword [esp + 0xa10]
push edx
call fcn.00401550
test al, al
jne 0x4045b8
push 0
call fcn.0040760e
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
push eax
call fcn.004075f5
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x40]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00401c90
test eax, eax
je 0x40459f
push str.SKU_is_missing_from_config_file_
push 0x414204
push 0xed
push 0x41409c
push str.E:ProjectsWWOnlineAPILauncherpatch.cpp
lea ecx, [esp + 0x54]
push 0x4141d4
push ecx
push str.ERR
call fcn.00401c90
mov ecx, eax
call fcn.00405db4
mov ecx, eax
call fcn.00405db4
mov ecx, eax
call fcn.00405db4
mov ecx, eax
call fcn.00405db4
mov ecx, eax
call fcn.00405db4
mov ecx, eax
call fcn.0040600f
mov ecx, eax
call fcn.00405db4
mov ecx, eax
call fcn.00405db4
push 0x404be0
push 0xa
mov ecx, eax
call fcn.00405f93
mov ecx, eax
call fcn.00404bc0
lea ecx, [esp + 0x10]
mov dword [esp + 0xa00], 0xffffffff
call fcn.00401cb0
jmp 0x404861
lea ecx, [esp + 0x14]
call fcn.00401ca0
lea ecx, [esp + 0xc]
mov byte [esp + 0xa00], 1
call fcn.00401ca0
lea edx, [esp + 0x14]
lea ecx, [esp + 0x10]
push edx
push 0x41409c
push 0
mov byte [esp + 0xa0c], 2
call fcn.00402180
mov esi, eax
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
call fcn.00401d50
push esi
push 0
lea ecx, [esp + 0x14]
call fcn.00401d80
lea ecx, [esp + 0xc]
call fcn.00401f70
cmp byte [eax], 0x20
jne 0x404634
push 1
push 0
lea ecx, [esp + 0x14]
call fcn.00401d80
lea ecx, [esp + 0xc]
call fcn.00401f70
cmp byte [eax], 0x20
je 0x404619
lea ecx, [esp + 0x1c]
push ecx
push 0xf003f
push 0
lea ecx, [esp + 0x18]
call fcn.00401f70
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExA]
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x20]
push 4
push edx
push 4
push 0
push str.Version
push eax
call dword [sym.imp.ADVAPI32.DLL_RegSetValueExA]
mov ecx, dword [0x4171e8]
push 0
push 0x403f90
push 0
push 0x67
push ecx
call dword [sym.imp.USER32.DLL_DialogBoxParamA]
lea ecx, [esp + 0xc]
mov byte [esp + 0xa00], 1
call fcn.00401cb0
lea ecx, [esp + 0x14]
mov byte [esp + 0xa00], 0
call fcn.00401cb0
lea ecx, [esp + 0x10]
mov dword [esp + 0xa00], 0xffffffff
call fcn.00401cb0
jmp 0x404861
mov edi, str..exn
or ecx, 0xffffffff
xor eax, eax
mov edx, ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, ebx
sub edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
push str..exn
add edx, ecx
push edx
call fcn.00407720
add esp, 8
test eax, eax
jne 0x40477d
lea ecx, [esp + 0x5e8]
call fcn.00404bf0
mov edi, 0x4141b8
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x5e8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x6e8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x5e8]
push ecx
call fcn.00404c10
lea edx, [esp + 0x5ec]
push 0
push edx
call fcn.00404d20
push ebx
call fcn.00407714
add esp, 0x10
jmp 0x404861
mov edi, str..web
or ecx, 0xffffffff
xor eax, eax
mov edx, ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, ebx
sub edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
push str..web
add edx, ecx
push edx
call fcn.00407720
add esp, 8
test eax, eax
jne 0x404861
mov esi, dword [sym.imp.USER32.DLL_LoadStringA]
lea eax, [esp + 0xe8]
push 0x100
push eax
push 3
push 0
call esi
lea ecx, [esp + 0x2e8]
push pe_nt_image_headers32
push ecx
push 4
push 0
call esi
mov edi, dword [sym.imp.USER32.DLL_MessageBoxA]
lea edx, [esp + 0x2e8]
push 0
lea eax, [esp + 0xec]
push edx
push eax
push 0
call edi
push 0x41417c
push ebx
call fcn.004073b3
mov esi, eax
add esp, 8
test esi, esi
je 0x404855
push esi
lea ecx, [esp + 0x4ec]
push 0xff
push ecx
call fcn.004065cc
push esi
call fcn.0040733d
add esp, 0x10
lea edx, [esp + 0x4e8]
push 5
push 0x4141b8
push 0
push edx
push 0
push 0
call dword [sym.imp.SHELL32.DLL_ShellExecuteA]
push ebx
call fcn.00407714
add esp, 4
push 0
call fcn.00407075
push 0
push str.Patchfile_vanished_
push ebx
push 0
call edi
mov ecx, dword [esp + 0x9f8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x9f8
ret