Function at 0x404670
Capabilities:
Create process on windows
Persist via run registry key
Set registry value
Terminate process

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x40f201
push eax
mov dword fs:[0], esp
sub esp, 0x9ec
lea eax, [esp + 0x8ec]
push ebx
push ebp
push esi
push edi
push 0xff
push eax
call fcn.004070df
mov edi, str..exe
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [esp + 0xa14]
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edx, ebx
sub edx, ecx
mov edi, ebx
or ecx, 0xffffffff
push str..exe
repne scasb al, byte es:[edi]
not ecx
dec ecx
add edx, ecx
push edx
call fcn.004076c0
add esp, 0x10
test eax, eax
jne 0x4047bf
lea eax, [esp + 0x20]
lea ecx, [esp + 0x1c]
push eax
push ecx
push 0
push 0xf003f
push 0
push 0x414240
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x404773
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov edx, dword [esp + 0x1c]
not ecx
push ecx
push ebx
push 1
push eax
push str.EXEPatch
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, dword [sym.imp.USER32.dll_LoadStringA]
lea eax, [esp + 0x1ec]
push 0x100
push eax
push 1
push 0
call esi
lea ecx, [esp + 0x6c]
push 0x80
push ecx
push 2
push 0
call esi
lea edx, [esp + 0x6c]
push 0
lea eax, [esp + 0x1f0]
push edx
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
call fcn.00404e50
jmp 0x404e29
lea ecx, [esp + 0x1ec]
push 0x100
push ecx
push 7
push 0
call dword [sym.imp.USER32.dll_LoadStringA]
lea edx, [esp + 0x1ec]
push ebx
lea eax, [esp + 0x2f0]
push edx
push eax
call fcn.004071fa
add esp, 0xc
lea ecx, [esp + 0x2ec]
push 0
push str.ERROR
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x404e29
mov edi, str..rtp
or ecx, 0xffffffff
xor eax, eax
mov edx, ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, ebx
sub edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
push str..rtp
add edx, ecx
push edx
call fcn.004076c0
add esp, 8
test eax, eax
jne 0x404c8b
call fcn.004032e0
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
push 1
mov dword [esp + 0x18], eax
push 0
push 0
lea eax, [esp + 0x34]
push 0
push eax
call esi
test eax, eax
je 0x404843
mov ebp, dword [sym.imp.USER32.dll_TranslateMessage]
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
lea ecx, [esp + 0x28]
push ecx
call ebp
lea edx, [esp + 0x28]
push edx
call edi
push 1
push 0
push 0
lea eax, [esp + 0x34]
push 0
push eax
call esi
test eax, eax
jne 0x404822
push str.patchw32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
jne 0x4048b7
mov esi, dword [sym.imp.USER32.dll_LoadStringA]
lea ecx, [esp + 0x2ec]
push 0x100
push ecx
push 9
push eax
call esi
lea edx, [esp + 0x2ec]
push str.patchw32.dll
lea eax, [esp + 0xf0]
push edx
push eax
call fcn.004071fa
add esp, 0xc
lea ecx, [esp + 0x6c]
push 0x80
push ecx
push 8
push 0
call esi
lea edx, [esp + 0x6c]
push 0
lea eax, [esp + 0xf0]
push edx
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0xffffffffffffffff
call fcn.0040700a
push str.RTPatchApply32_12
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebp, eax
test ebp, ebp
jne 0x40490a
mov esi, dword [sym.imp.USER32.dll_LoadStringA]
lea ecx, [esp + 0xec]
push 0x100
push ecx
push 0xa
push eax
call esi
lea edx, [esp + 0x6c]
push 0x80
push edx
push 8
push ebp
call esi
lea eax, [esp + 0x6c]
push ebp
lea ecx, [esp + 0xf0]
push eax
push ecx
push ebp
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x404e29
push ebx
lea edx, [esp + 0x1f0]
push str.__s__.
push edx
call fcn.004071fa
add esp, 0xc
lea eax, [esp + 0x1ec]
push 1
push sym.launcher.exe_void____stdcall_PatchCallBack_unsigned_int__void__
push eax
call ebp
push esi
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push ebx
call fcn.004076a9
mov ecx, dword [esp + 0x18]
add esp, 4
push ecx
call dword [sym.imp.USER32.dll_DestroyWindow]
test ebp, ebp
je 0x404a25
push 0
call fcn.004072d2
lea edx, [esp + 0x18]
mov dword [esp + 0x18], eax
push edx
call fcn.00407666
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x44]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00401c90
test eax, eax
je 0x404e29
push ebp
push str.Patch_error:
push 0x413230
push 0xdb
push 0x41309c
push str.C:devwolAPILauncherpatch.cpp
lea ecx, [esp + 0x5c]
push 0x413208
push ecx
push str.ERR
call fcn.00401c90
mov ecx, eax
call fcn.00405db4
mov ecx, eax
call fcn.00405db4
mov ecx, eax
call fcn.00405db4
mov ecx, eax
call fcn.00405db4
mov ecx, eax
call fcn.00405db4
mov ecx, eax
call fcn.0040600f
mov ecx, eax
call fcn.00405db4
mov ecx, eax
call fcn.00405db4
mov ecx, eax
call fcn.0040600f
push 0x4051a0
push 0xa
mov ecx, eax
call fcn.00405f93
mov ecx, eax
call fcn.00405180
jmp 0x404e29
push 0x5c
push ebx
call fcn.00406510
add esp, 8
test eax, eax
je 0x404a46
lea ebx, [eax + 1]
push 0x5c
push ebx
call fcn.00406510
add esp, 8
test eax, eax
jne 0x404a34
test ebx, ebx
je 0x404a57
push ebx
call fcn.00406623
add esp, 4
mov dword [esp + 0x24], eax
lea ecx, [esp + 0x18]
call fcn.00401ca0
mov edx, dword [esp + 0xa14]
lea eax, [esp + 0x3ec]
push edx
push str.SKU_d
push eax
mov dword [esp + 0xa10], 0
call fcn.004071fa
add esp, 0xc
lea ecx, [esp + 0x18]
lea edx, [esp + 0x3ec]
push ecx
mov ecx, dword [esp + 0xa14]
push edx
call fcn.00401550
test al, al
jne 0x404b80
push 0
call fcn.004072d2
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
push eax
call fcn.00407666
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x44]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00401c90
test eax, eax
je 0x404b67
push str.SKU_is_missing_from_config_file_
push 0x413230
push 0xf4
push 0x41309c
push str.C:devwolAPILauncherpatch.cpp
lea ecx, [esp + 0x58]
push 0x413208
push ecx
push str.ERR
call fcn.00401c90
mov ecx, eax
call fcn.00405db4
mov ecx, eax
call fcn.00405db4
mov ecx, eax
call fcn.00405db4
mov ecx, eax
call fcn.00405db4
mov ecx, eax
call fcn.00405db4
mov ecx, eax
call fcn.0040600f
mov ecx, eax
call fcn.00405db4
mov ecx, eax
call fcn.00405db4
push 0x4051a0
push 0xa
mov ecx, eax
call fcn.00405f93
mov ecx, eax
call fcn.00405180
lea ecx, [esp + 0x18]
mov dword [esp + 0xa04], 0xffffffff
call fcn.00401cd0
jmp 0x404e29
lea ecx, [esp + 0x1c]
call fcn.00401ca0
lea ecx, [esp + 0x10]
mov byte [esp + 0xa04], 1
call fcn.00401ca0
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x18]
push edx
push 0x41309c
push 0
mov byte [esp + 0xa10], 2
call fcn.004021a0
mov esi, eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x14]
call fcn.00401d70
push esi
push 0
lea ecx, [esp + 0x18]
call fcn.00401da0
lea ecx, [esp + 0x10]
call fcn.00401f90
cmp byte [eax], 0x20
jne 0x404bfc
push 1
push 0
lea ecx, [esp + 0x18]
call fcn.00401da0
lea ecx, [esp + 0x10]
call fcn.00401f90
cmp byte [eax], 0x20
je 0x404be1
lea ecx, [esp + 0x20]
push ecx
push 0xf003f
push 0
lea ecx, [esp + 0x1c]
call fcn.00401f90
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x24]
push 4
push edx
push 4
push 0
push str.Version
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [0x414270]
push 0
push 0x404480
push 0
push 0x67
push ecx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
lea ecx, [esp + 0x10]
mov byte [esp + 0xa04], 1
call fcn.00401cd0
lea ecx, [esp + 0x1c]
mov byte [esp + 0xa04], 0
call fcn.00401cd0
lea ecx, [esp + 0x18]
mov dword [esp + 0xa04], 0xffffffff
call fcn.00401cd0
jmp 0x404e29
mov edi, str..exn
or ecx, 0xffffffff
xor eax, eax
mov edx, ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, ebx
sub edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
push str..exn
add edx, ecx
push edx
call fcn.004076c0
add esp, 8
test eax, eax
jne 0x404d45
lea ecx, [esp + 0x5ec]
call fcn.004051b0
mov edi, 0x4131c8
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x5ec]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x6ec]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x5ec]
push ecx
call fcn.004051d0
lea edx, [esp + 0x5f0]
push 0
push edx
call fcn.004052e0
push ebx
call fcn.004076a9
add esp, 0x10
jmp 0x404e29
mov edi, str..web
or ecx, 0xffffffff
xor eax, eax
mov edx, ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, ebx
sub edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
push str..web
add edx, ecx
push edx
call fcn.004076c0
add esp, 8
test eax, eax
jne 0x404e29
mov esi, dword [sym.imp.USER32.dll_LoadStringA]
lea eax, [esp + 0xec]
push 0x100
push eax
push 3
push 0
call esi
lea ecx, [esp + 0x2ec]
push 0x80
push ecx
push 4
push 0
call esi
mov edi, dword [sym.imp.USER32.dll_MessageBoxA]
lea edx, [esp + 0x2ec]
push 0
lea eax, [esp + 0xf0]
push edx
push eax
push 0
call edi
push 0x41318c
push ebx
call fcn.00407424
mov esi, eax
add esp, 8
test esi, esi
je 0x404e1d
push esi
lea ecx, [esp + 0x4f0]
push 0xff
push ecx
call fcn.004065cc
push esi
call fcn.004073ae
add esp, 0x10
lea edx, [esp + 0x4ec]
push 5
push 0x4131c8
push 0
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push ebx
call fcn.004076a9
add esp, 4
push 0
call fcn.0040700a
push 0
push str.Patchfile_vanished_
push ebx
push 0
call edi
mov ecx, dword [esp + 0x9fc]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x9f8
ret