Function at 0x404640
Capabilities:
Create process on windows
Persist via run registry key
Set registry value
Terminate process

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x40f301
push eax
mov dword fs:[0], esp
sub esp, 0x9ec
lea eax, [esp + 0x8ec]
push ebx
push ebp
push esi
push edi
push 0xff
push eax
call fcn.004071df
mov edi, str..exe
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [esp + 0xa14]
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edx, ebx
sub edx, ecx
mov edi, ebx
or ecx, 0xffffffff
push str..exe
repne scasb al, byte es:[edi]
not ecx
dec ecx
add edx, ecx
push edx
call fcn.004077c0
add esp, 0x10
test eax, eax
jne 0x40478f
lea eax, [esp + 0x20]
lea ecx, [esp + 0x1c]
push eax
push ecx
push 0
push 0xf003f
push 0
push 0x4142f0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x404743
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov edx, dword [esp + 0x1c]
not ecx
push ecx
push ebx
push 1
push eax
push str.EXEPatch
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, dword [sym.imp.USER32.dll_LoadStringA]
lea eax, [esp + 0x2ec]
push 0x100
push eax
push 1
push 0
call esi
lea ecx, [esp + 0x6c]
push 0x80
push ecx
push 2
push 0
call esi
lea edx, [esp + 0x6c]
push 0
lea eax, [esp + 0x2f0]
push edx
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
call fcn.00404ea0
jmp 0x404e87
lea ecx, [esp + 0x2ec]
push 0x100
push ecx
push 7
push 0
call dword [sym.imp.USER32.dll_LoadStringA]
lea edx, [esp + 0x2ec]
push ebx
lea eax, [esp + 0x1f0]
push edx
push eax
call fcn.004072fa
add esp, 0xc
lea ecx, [esp + 0x1ec]
push 0
push str.ERROR
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x404e87
mov edi, str..rtp
or ecx, 0xffffffff
xor eax, eax
mov edx, ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, ebx
sub edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
push str..rtp
add edx, ecx
push edx
call fcn.004077c0
add esp, 8
test eax, eax
jne 0x404ce9
call fcn.004032e0
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
push 1
mov dword [esp + 0x18], eax
push 0
push 0
lea eax, [esp + 0x34]
push 0
push eax
call esi
test eax, eax
je 0x404813
mov ebp, dword [sym.imp.USER32.dll_TranslateMessage]
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
lea ecx, [esp + 0x28]
push ecx
call ebp
lea edx, [esp + 0x28]
push edx
call edi
push 1
push 0
push 0
lea eax, [esp + 0x34]
push 0
push eax
call esi
test eax, eax
jne 0x4047f2
push str.patchw32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
jne 0x404887
mov esi, dword [sym.imp.USER32.dll_LoadStringA]
lea ecx, [esp + 0x1ec]
push 0x100
push ecx
push 9
push eax
call esi
lea edx, [esp + 0x1ec]
push str.patchw32.dll
lea eax, [esp + 0xf0]
push edx
push eax
call fcn.004072fa
add esp, 0xc
lea ecx, [esp + 0x6c]
push 0x80
push ecx
push 8
push 0
call esi
lea edx, [esp + 0x6c]
push 0
lea eax, [esp + 0xf0]
push edx
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0xffffffffffffffff
call fcn.0040710a
push str.RTPatchApply32_12
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebp, eax
test ebp, ebp
jne 0x4048da
mov esi, dword [sym.imp.USER32.dll_LoadStringA]
lea ecx, [esp + 0xec]
push 0x100
push ecx
push 0xa
push eax
call esi
lea edx, [esp + 0x6c]
push 0x80
push edx
push 8
push ebp
call esi
lea eax, [esp + 0x6c]
push ebp
lea ecx, [esp + 0xf0]
push eax
push ecx
push ebp
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x404e87
push ebx
lea edx, [esp + 0x2f0]
push str.__s__.
push edx
call fcn.004072fa
add esp, 0xc
lea eax, [esp + 0x2ec]
push 1
push sym.generals.exe_void____stdcall_PatchCallBack_unsigned_int__void__
push eax
call ebp
push esi
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push ebx
call fcn.004077a9
mov ecx, dword [esp + 0x18]
add esp, 4
push ecx
call dword [sym.imp.USER32.dll_DestroyWindow]
test ebp, ebp
je 0x4049f5
push 0
call fcn.004073d2
lea edx, [esp + 0x18]
mov dword [esp + 0x18], eax
push edx
call fcn.00407766
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x44]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00401c90
test eax, eax
je 0x404e87
push ebp
push str.Patch_error:
push 0x413270
push 0xdb
push 0x4130b8
push str.D:dev1mdcodeToolsLauncherpatch.cpp
lea ecx, [esp + 0x5c]
push 0x413240
push ecx
push str.ERR
call fcn.00401c90
mov ecx, eax
call fcn.00405eb4
mov ecx, eax
call fcn.00405eb4
mov ecx, eax
call fcn.00405eb4
mov ecx, eax
call fcn.00405eb4
mov ecx, eax
call fcn.00405eb4
mov ecx, eax
call fcn.0040610f
mov ecx, eax
call fcn.00405eb4
mov ecx, eax
call fcn.00405eb4
mov ecx, eax
call fcn.0040610f
push 0x405220
push 0xa
mov ecx, eax
call fcn.00406093
mov ecx, eax
call fcn.00405200
jmp 0x404e87
push 0x5c
push ebx
call fcn.00406610
add esp, 8
test eax, eax
je 0x404a16
lea ebx, [eax + 1]
push 0x5c
push ebx
call fcn.00406610
add esp, 8
test eax, eax
jne 0x404a04
test ebx, ebx
je 0x404a27
push ebx
call fcn.00406723
add esp, 4
mov dword [esp + 0x24], eax
lea ecx, [esp + 0x18]
call fcn.00401ca0
mov edx, dword [esp + 0xa14]
lea eax, [esp + 0x6fc]
push edx
push str.SKU_d
push eax
mov dword [esp + 0xa10], 0
call fcn.004072fa
add esp, 0xc
lea ecx, [esp + 0x18]
lea edx, [esp + 0x6fc]
push ecx
mov ecx, dword [esp + 0xa14]
push edx
call fcn.00401550
test al, al
jne 0x404b50
push 0
call fcn.004073d2
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
push eax
call fcn.00407766
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x44]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00401c90
test eax, eax
je 0x404b37
push str.SKU_is_missing_from_config_file_
push 0x413270
push 0xf4
push 0x4130b8
push str.D:dev1mdcodeToolsLauncherpatch.cpp
lea ecx, [esp + 0x58]
push 0x413240
push ecx
push str.ERR
call fcn.00401c90
mov ecx, eax
call fcn.00405eb4
mov ecx, eax
call fcn.00405eb4
mov ecx, eax
call fcn.00405eb4
mov ecx, eax
call fcn.00405eb4
mov ecx, eax
call fcn.00405eb4
mov ecx, eax
call fcn.0040610f
mov ecx, eax
call fcn.00405eb4
mov ecx, eax
call fcn.00405eb4
push 0x405220
push 0xa
mov ecx, eax
call fcn.00406093
mov ecx, eax
call fcn.00405200
lea ecx, [esp + 0x18]
mov dword [esp + 0xa04], 0xffffffff
call fcn.00401cd0
jmp 0x404e87
lea ecx, [esp + 0x1c]
call fcn.00401ca0
lea ecx, [esp + 0x10]
mov byte [esp + 0xa04], 1
call fcn.00401ca0
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x18]
push edx
push 0x4130b8
push 0
mov byte [esp + 0xa10], 2
call fcn.004021a0
mov esi, eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x14]
call fcn.00401d70
push esi
push 0
lea ecx, [esp + 0x18]
call fcn.00401da0
lea ecx, [esp + 0x10]
call fcn.00401f90
cmp byte [eax], 0x20
jne 0x404bcc
push 1
push 0
lea ecx, [esp + 0x18]
call fcn.00401da0
lea ecx, [esp + 0x10]
call fcn.00401f90
cmp byte [eax], 0x20
je 0x404bb1
lea ecx, [esp + 0x20]
push ecx
push 0xf003f
push 0
lea ecx, [esp + 0x1c]
call fcn.00401f90
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x24]
push 4
push edx
push 4
push 0
push str.Version
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea ecx, [esp + 0x3ec]
call fcn.00405230
mov edi, 0x413208
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x3ec]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x4ec]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.notepad
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x5ec]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str._launcher.txt
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x3ec]
push ecx
call fcn.00405250
lea edx, [esp + 0x3f0]
push 0
push edx
call fcn.00405360
add esp, 0xc
lea ecx, [esp + 0x10]
mov byte [esp + 0xa04], 1
call fcn.00401cd0
lea ecx, [esp + 0x1c]
mov byte [esp + 0xa04], 0
call fcn.00401cd0
mov dword [esp + 0xa04], 0xffffffff
lea ecx, [esp + 0x18]
call fcn.00401cd0
jmp 0x404e87
mov edi, str..exn
or ecx, 0xffffffff
xor eax, eax
mov edx, ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, ebx
sub edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
push str..exn
add edx, ecx
push edx
call fcn.004077c0
add esp, 8
test eax, eax
jne 0x404da3
lea ecx, [esp + 0x3ec]
call fcn.00405230
mov edi, 0x413208
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x3ec]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x4ec]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x3ec]
push ecx
call fcn.00405250
lea edx, [esp + 0x3f0]
push 0
push edx
call fcn.00405360
push ebx
call fcn.004077a9
add esp, 0x10
jmp 0x404e87
mov edi, str..web
or ecx, 0xffffffff
xor eax, eax
mov edx, ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, ebx
sub edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
push str..web
add edx, ecx
push edx
call fcn.004077c0
add esp, 8
test eax, eax
jne 0x404e87
mov esi, dword [sym.imp.USER32.dll_LoadStringA]
lea eax, [esp + 0xec]
push 0x100
push eax
push 3
push 0
call esi
lea ecx, [esp + 0x1ec]
push 0x80
push ecx
push 4
push 0
call esi
mov edi, dword [sym.imp.USER32.dll_MessageBoxA]
lea edx, [esp + 0x1ec]
push 0
lea eax, [esp + 0xf0]
push edx
push eax
push 0
call edi
push 0x4131a8
push ebx
call fcn.00407524
mov esi, eax
add esp, 8
test esi, esi
je 0x404e7b
push esi
lea ecx, [esp + 0x800]
push 0xff
push ecx
call fcn.004066cc
push esi
call fcn.004074ae
add esp, 0x10
lea edx, [esp + 0x7fc]
push 5
push 0x413208
push 0
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push ebx
call fcn.004077a9
add esp, 4
push 0
call fcn.0040710a
push 0
push str.Patchfile_vanished_
push ebx
push 0
call edi
mov ecx, dword [esp + 0x9fc]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x9f8
ret