Function at 0x402d50
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Enumerate processes
Set console window title
Set registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x419db7
mov eax, dword fs:[0]
push eax
sub esp, 0x6e8
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x62c], 0
push str.color_5F
call fcn.00409c3d
add esp, 4
push str.Neutrino_Injector_V5_by_DroidZero__t.me_darkukrgta__c__2024
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
push str._INFO__Searching_for_MTA:SA..._n
call fcn.004020e0
add esp, 4
push 0xc
call fcn.00404945
add esp, 4
mov dword [ebp - 0x600], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x600], 0
je 0x402df9
xor eax, eax
mov ecx, dword [ebp - 0x600]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
push 0
push 0x41ffe4
push 0x80000002
mov ecx, dword [ebp - 0x600]
call fcn.00401610
mov dword [ebp - 0x628], eax
jmp 0x402e03
mov dword [ebp - 0x628], 0
mov edx, dword [ebp - 0x628]
mov dword [ebp - 0x690], edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x690]
mov dword [ebp - 0x60c], eax
cmp dword [ebp - 0x60c], 0
je 0x4030e6
mov byte [ebp - 0x5d9], 1
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x604], eax
mov dword [ebp - 0x2f8], 0x128
push 0x124
push 0
lea ecx, [ebp - 0x2f4]
push ecx
call fcn.00406000
add esp, 0xc
lea edx, [ebp - 0x2f8]
push edx
mov eax, dword [ebp - 0x604]
push eax
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x402eb7
push 0x420014
lea ecx, [ebp - 0x2d4]
push ecx
call fcn.00405b10
add esp, 8
test eax, eax
je 0x402e9f
mov byte [ebp - 0x5d9], 0
jmp 0x402eb7
lea edx, [ebp - 0x2f8]
push edx
mov eax, dword [ebp - 0x604]
push eax
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x402e7e
mov ecx, dword [ebp - 0x604]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movzx edx, byte [ebp - 0x5d9]
test edx, edx
je 0x403087
push 0
push 0x420024
lea eax, [ebp - 0x15c]
push eax
mov ecx, dword [ebp - 0x60c]
call fcn.004017d0
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x15c]
push ecx
lea edx, [ebp - 0x6f4]
push edx
call fcn.00402c60
add esp, 8
mov dword [ebp - 0x6a0], eax
mov eax, dword [ebp - 0x6a0]
mov dword [ebp - 0x6b8], eax
mov byte [ebp - 4], 2
mov dword [ebp - 0x5ec], str.UKRAINEGTA.exe
mov ecx, dword [ebp - 0x5ec]
add ecx, 1
mov dword [ebp - 0x6a8], ecx
mov edx, dword [ebp - 0x5ec]
mov al, byte [edx]
mov byte [ebp - 0x5da], al
add dword [ebp - 0x5ec], 1
cmp byte [ebp - 0x5da], 0
jne 0x402f38
mov ecx, dword [ebp - 0x5ec]
sub ecx, dword [ebp - 0x6a8]
mov dword [ebp - 0x6ac], ecx
mov edx, dword [ebp - 0x6ac]
mov dword [ebp - 0x6b0], edx
mov eax, dword [ebp - 0x6b0]
mov dword [ebp - 0x6b4], eax
mov ecx, dword [ebp - 0x6b4]
push ecx
push str.UKRAINEGTA.exe
mov ecx, dword [ebp - 0x6b8]
call fcn.00404080
mov dword [ebp - 0x6c0], eax
mov edx, dword [ebp - 0x6c0]
push edx
lea ecx, [ebp - 0x174]
call fcn.00403b10
mov eax, dword [ebp - 0x62c]
or eax, 1
mov dword [ebp - 0x62c], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x6f4]
call fcn.004019b0
lea ecx, [ebp - 0x174]
mov dword [ebp - 0x608], ecx
mov edx, dword [ebp - 0x608]
mov dword [ebp - 0x634], edx
mov eax, dword [ebp - 0x608]
cmp dword [eax + 0x14], 0xf
jbe 0x402ffd
mov dword [ebp - 0x630], 1
jmp 0x403007
mov dword [ebp - 0x630], 0
mov cl, byte [ebp - 0x630]
mov byte [ebp - 0x5db], cl
movzx edx, byte [ebp - 0x5db]
test edx, edx
je 0x403038
mov eax, dword [ebp - 0x608]
mov ecx, dword [eax]
mov dword [ebp - 0x6c4], ecx
mov edx, dword [ebp - 0x6c4]
mov dword [ebp - 0x634], edx
mov eax, dword [ebp - 0x634]
mov dword [ebp - 0x6c8], eax
mov ecx, dword [ebp - 0x6c8]
mov dword [ebp - 0x6cc], ecx
push 5
push 0
push 0
mov edx, dword [ebp - 0x6cc]
push edx
push str.runas
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [ebp - 0x174]
call fcn.004019b0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x15c]
call fcn.004019b0
mov eax, dword [ebp - 0x60c]
mov dword [ebp - 0x5f4], eax
cmp dword [ebp - 0x5f4], 0
je 0x4030dc
mov ecx, dword [ebp - 0x6dc]
mov dword [ebp - 0x664], ecx
mov ecx, dword [ebp - 0x5f4]
call fcn.00401640
mov edx, 1
and edx, 1
je 0x4030ce
push 0xc
mov eax, dword [ebp - 0x5f4]
push eax
call fcn.0040497a
add esp, 8
mov ecx, dword [ebp - 0x5f4]
mov dword [ebp - 0x664], ecx
jmp 0x4030e6
mov dword [ebp - 0x664], 0
push 0xc
call fcn.00404945
add esp, 4
mov dword [ebp - 0x610], eax
mov dword [ebp - 4], 3
cmp dword [ebp - 0x610], 0
je 0x403135
xor edx, edx
mov eax, dword [ebp - 0x610]
mov dword [eax], edx
mov dword [eax + 4], edx
mov dword [eax + 8], edx
push 0
push str.SOFTWAREWOW6432NodeUKRAINEGTA:_GLAB3Common
push 0x80000002
mov ecx, dword [ebp - 0x610]
call fcn.00401610
mov dword [ebp - 0x660], eax
jmp 0x40313f
mov dword [ebp - 0x660], 0
mov ecx, dword [ebp - 0x660]
mov dword [ebp - 0x6d0], ecx
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x6d0]
mov dword [ebp - 0x614], edx
cmp dword [ebp - 0x614], 0
je 0x4039ca
push 0
push str.GTA:SA_Path
lea eax, [ebp - 0x144]
push eax
mov ecx, dword [ebp - 0x614]
call fcn.004017d0
mov dword [ebp - 4], 4
cmp dword [ebp - 0x134], 0
jne 0x4031a0
mov dword [ebp - 0x65c], 1
jmp 0x4031aa
mov dword [ebp - 0x65c], 0
mov cl, byte [ebp - 0x65c]
mov byte [ebp - 0x5dc], cl
movzx edx, byte [ebp - 0x5dc]
test edx, edx
je 0x4031e1
push str._ERROR__Can_t_find_installed_game__n
call fcn.004020e0
add esp, 4
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea eax, [ebp - 0x144]
push eax
lea ecx, [ebp - 0x18c]
call fcn.00403b90
mov byte [ebp - 4], 5
mov dword [ebp - 0x5f0], str.UKRAINE_GTA.exe
mov ecx, dword [ebp - 0x5f0]
add ecx, 1
mov dword [ebp - 0x668], ecx
mov edx, dword [ebp - 0x5f0]
mov al, byte [edx]
mov byte [ebp - 0x5dd], al
add dword [ebp - 0x5f0], 1
cmp byte [ebp - 0x5dd], 0
jne 0x403210
mov ecx, dword [ebp - 0x5f0]
sub ecx, dword [ebp - 0x668]
mov dword [ebp - 0x66c], ecx
mov edx, dword [ebp - 0x66c]
mov dword [ebp - 0x670], edx
mov eax, dword [ebp - 0x670]
mov dword [ebp - 0x674], eax
mov ecx, dword [ebp - 0x674]
push ecx
push str.UKRAINE_GTA.exe
lea ecx, [ebp - 0x144]
call fcn.00404080
mov edx, dword [ebp - 0x614]
mov dword [ebp - 0x5f8], edx
cmp dword [ebp - 0x5f8], 0
je 0x4032c4
mov eax, dword [ebp - 0x6d8]
mov dword [ebp - 0x658], eax
mov ecx, dword [ebp - 0x5f8]
call fcn.00401640
mov ecx, 1
and ecx, 1
je 0x4032b6
push 0xc
mov edx, dword [ebp - 0x5f8]
push edx
call fcn.0040497a
add esp, 8
mov eax, dword [ebp - 0x5f8]
mov dword [ebp - 0x658], eax
jmp 0x4032ce
mov dword [ebp - 0x658], 0
lea ecx, [ebp - 0x144]
mov dword [ebp - 0x618], ecx
mov edx, dword [ebp - 0x618]
mov dword [ebp - 0x640], edx
mov eax, dword [ebp - 0x618]
cmp dword [eax + 0x14], 0xf
jbe 0x4032fe
mov dword [ebp - 0x654], 1
jmp 0x403308
mov dword [ebp - 0x654], 0
mov cl, byte [ebp - 0x654]
mov byte [ebp - 0x5de], cl
movzx edx, byte [ebp - 0x5de]
test edx, edx
je 0x403339
mov eax, dword [ebp - 0x618]
mov ecx, dword [eax]
mov dword [ebp - 0x678], ecx
mov edx, dword [ebp - 0x678]
mov dword [ebp - 0x640], edx
mov eax, dword [ebp - 0x640]
mov dword [ebp - 0x67c], eax
mov ecx, dword [ebp - 0x67c]
mov dword [ebp - 0x680], ecx
mov edx, dword [ebp - 0x680]
push edx
push str._INFO__Found:__s_n_INFO__Starting_UKRAINE_GTA.exe..._n
call fcn.004020e0
add esp, 8
mov dword [ebp - 0x1d0], 0x44
push 0x40
push 0
lea eax, [ebp - 0x1cc]
push eax
call fcn.00406000
add esp, 0xc
push 0x100
push 0
push 0x423400
call fcn.00406000
add esp, 0xc
lea ecx, [ebp - 0x144]
mov dword [ebp - 0x61c], ecx
mov edx, dword [ebp - 0x61c]
mov dword [ebp - 0x64c], edx
mov eax, dword [ebp - 0x61c]
cmp dword [eax + 0x14], 0xf
jbe 0x4033c6
mov dword [ebp - 0x650], 1
jmp 0x4033d0
mov dword [ebp - 0x650], 0
mov cl, byte [ebp - 0x650]
mov byte [ebp - 0x5df], cl
movzx edx, byte [ebp - 0x5df]
test edx, edx
je 0x403401
mov eax, dword [ebp - 0x61c]
mov ecx, dword [eax]
mov dword [ebp - 0x684], ecx
mov edx, dword [ebp - 0x684]
mov dword [ebp - 0x64c], edx
mov eax, dword [ebp - 0x64c]
mov dword [ebp - 0x688], eax
mov ecx, dword [ebp - 0x688]
mov dword [ebp - 0x68c], ecx
mov edx, dword [ebp - 0x68c]
push edx
push str.__s_
push 0x423400
call fcn.00402140
add esp, 0xc
lea eax, [ebp - 0x18c]
mov dword [ebp - 0x620], eax
mov ecx, dword [ebp - 0x620]
mov dword [ebp - 0x63c], ecx
mov edx, dword [ebp - 0x620]
cmp dword [edx + 0x14], 0xf
jbe 0x403462
mov dword [ebp - 0x644], 1
jmp 0x40346c
mov dword [ebp - 0x644], 0
mov al, byte [ebp - 0x644]
mov byte [ebp - 0x5e0], al
movzx ecx, byte [ebp - 0x5e0]
test ecx, ecx
je 0x40349d
mov edx, dword [ebp - 0x620]
mov eax, dword [edx]
mov dword [ebp - 0x6bc], eax
mov ecx, dword [ebp - 0x6bc]
mov dword [ebp - 0x63c], ecx
mov edx, dword [ebp - 0x63c]
mov dword [ebp - 0x694], edx
mov eax, dword [ebp - 0x694]
mov dword [ebp - 0x698], eax
lea ecx, [ebp - 0x308]
push ecx
lea edx, [ebp - 0x1d0]
push edx
mov eax, dword [ebp - 0x698]
push eax
push 0
push 4
push 1
push 0
push 0
push 0x423400
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 0x5d8], eax
cmp dword [ebp - 0x5d8], 0
je 0x403995
push 0x2cc
push 0
lea ecx, [ebp - 0x5d4]
push ecx
call fcn.00406000
add esp, 0xc
mov dword [ebp - 0x5d4], 0x1003f
lea edx, [ebp - 0x5d4]
push edx
mov eax, dword [ebp - 0x304]
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov dword [ebp - 0x5d8], eax
cmp dword [ebp - 0x5d8], 0
je 0x403965
push str._DBG__Saving_entry_point_instruction..._n
call fcn.004020e0
add esp, 4
mov dword [ebp - 0x124], 0
push 4
push 0x3000
push 5
push 0
mov ecx, dword [ebp - 0x308]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x5fc], eax
cmp dword [ebp - 0x5fc], 0
jne 0x4035a2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._nError:_Unable_to_allocate_memory_for_DLL_data__Error:__d__n
call fcn.004020e0
add esp, 8
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov edx, dword [ebp - 0x5fc]
push edx
push str._MEMORY__Allocated_data_region_at_address:_0x_X_n
call fcn.004020e0
add esp, 8
mov byte [ebp - 0x18], 0
mov byte [ebp - 0x17], 0
mov byte [ebp - 0x16], 0
mov byte [ebp - 0x15], 0
mov byte [ebp - 0x14], 0
lea eax, [ebp - 0x124]
push eax
push 5
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x524]
push edx
mov eax, dword [ebp - 0x308]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [ebp - 0x5d8], eax
cmp dword [ebp - 0x5d8], 0
jne 0x403621
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._nError:_Unable_to_read_memory__Last_Error_Code:___d__n
call fcn.004020e0
add esp, 8
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea ecx, [ebp - 0x124]
push ecx
push 5
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x5fc]
push eax
mov ecx, dword [ebp - 0x308]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0x5d8], eax
cmp dword [ebp - 0x5d8], 0
je 0x40394f
push 0xc
call fcn.00404945
add esp, 4
mov dword [ebp - 0x624], eax
mov byte [ebp - 4], 6
cmp dword [ebp - 0x624], 0
je 0x4036a1
xor edx, edx
mov eax, dword [ebp - 0x624]
mov dword [eax], edx
mov dword [eax + 4], edx
mov dword [eax + 8], edx
push 1
push str.SoftwareNeutrino
push 0x80000001
mov ecx, dword [ebp - 0x624]
call fcn.00401610
mov dword [ebp - 0x638], eax
jmp 0x4036ab
mov dword [ebp - 0x638], 0
mov ecx, dword [ebp - 0x638]
mov dword [ebp - 0x69c], ecx
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x69c]
mov dword [ebp - 0x5e8], edx
cmp dword [ebp - 0x5e8], 0
je 0x40394d
mov eax, dword [ebp - 0x5fc]
push eax
push str.StoredData
mov ecx, dword [ebp - 0x5e8]
call fcn.00401880
mov ecx, dword [ebp - 0x524]
push ecx
push str.SpinLock
mov ecx, dword [ebp - 0x5e8]
call fcn.00401880
mov edx, dword [ebp - 0x2fc]
push edx
push str.Thread
mov ecx, dword [ebp - 0x5e8]
call fcn.00401880
push str._DBG__Instruction_writed_to_allocated_memory__n
call fcn.004020e0
add esp, 4
mov eax, dword [ebp - 0x524]
mov dword [ebp - 0x5e4], eax
mov byte [ebp - 0x20], 0xe9
mov byte [ebp - 0x1f], 0x90
mov byte [ebp - 0x1e], 0x90
mov byte [ebp - 0x1d], 0x90
mov byte [ebp - 0x1c], 0x90
mov ecx, dword [ebp - 0x5e4]
push ecx
push str._DBG__Address_of_OEP_for_spinlock:_0x_X_n
call fcn.004020e0
add esp, 8
mov edx, dword [ebp - 0x5e4]
sub edx, dword [ebp - 0x5e4]
sub edx, 5
mov dword [ebp - 0x12c], edx
mov eax, 1
shl eax, 0
mov ecx, dword [ebp - 0x12c]
mov dword [ebp + eax - 0x20], ecx
mov dword [ebp - 0x128], 0
lea edx, [ebp - 0x128]
push edx
push 0x40
push 5
mov eax, dword [ebp - 0x5e4]
push eax
mov ecx, dword [ebp - 0x308]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov dword [ebp - 0x5d8], eax
cmp dword [ebp - 0x5d8], 0
jne 0x4037e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x420260
call fcn.004020e0
add esp, 8
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push str._DBG__Writing_spinlock_shellcode_to_process..._n
call fcn.004020e0
add esp, 4
lea edx, [ebp - 0x124]
push edx
push 5
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x5e4]
push ecx
mov edx, dword [ebp - 0x308]
push edx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0x5d8], eax
cmp dword [ebp - 0x5d8], 0
je 0x403939
push str._SUCCESS__Spinlock_shellcode_successfully_placed__n
call fcn.004020e0
add esp, 4
push 0x100
push 0
lea eax, [ebp - 0x120]
push eax
call fcn.00406000
add esp, 0xc
push 0x100
lea ecx, [ebp - 0x120]
push ecx
call fcn.0040a4bd
add esp, 8
push 0
lea edx, [ebp - 0x120]
push edx
push str.HomeDir
mov eax, dword [ebp - 0x5e8]
push eax
call fcn.00401660
add esp, 0x10
lea ecx, [ebp - 0x128]
push ecx
mov edx, dword [ebp - 0x128]
push edx
push 5
mov eax, dword [ebp - 0x5e4]
push eax
mov ecx, dword [ebp - 0x308]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov dword [ebp - 0x5d8], eax
cmp dword [ebp - 0x5d8], 0
jne 0x4038cf
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._nError:_Unable_to_change_memory_access__Last_Error_Code:___d__n
call fcn.004020e0
add esp, 8
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x6d4], esp
push str.NeutrinoAgent.dll
call fcn.004018e0
mov edx, dword [ebp - 0x308]
push edx
call fcn.00402420
mov eax, dword [ebp - 0x5e8]
mov dword [ebp - 0x648], eax
cmp dword [ebp - 0x648], 0
je 0x40391a
push 1
mov ecx, dword [ebp - 0x648]
call fcn.00403a00
mov dword [ebp - 0x6a4], eax
jmp 0x403924
mov dword [ebp - 0x6a4], 0
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._ERROR__2_Can_t_write_to_process_:__Last_Error_Code:__d_n
call fcn.004020e0
add esp, 8
jmp 0x403963
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._ERROR__1_Can_t_write_to_process_:__Last_Error_Code:__d_n
call fcn.004020e0
add esp, 8
jmp 0x403979
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._ERROR__Can_t_obtain_thread_context._Last_Error_Code:__d_n
call fcn.004020e0
add esp, 8
mov ecx, dword [ebp - 0x304]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x308]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4039a9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._ERROR__Cannot_create_process_:__Last_Error_Code:__d_n
call fcn.004020e0
add esp, 8
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x18c]
call fcn.004019b0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x144]
call fcn.004019b0
mov eax, 1
test eax, eax
je 0x4039dd
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4039ca
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00404932
mov esp, ebp
pop ebp
ret