Function at 0x434c10
Capabilities:
Create process on windows
Create thread
Inject dll
Inject thread
Query or enumerate registry value
Resume thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x408
mov eax, dword [0x4c4080]
xor eax, esp
mov dword [esp + 0x404], eax
mov eax, dword [ebp + 0xc]
xorps xmm0, xmm0
push esi
push edi
mov edi, dword [ebp + 8]
push 0x44
mov dword [esp + 0xc], eax
lea eax, [esp + 0x2c]
push 0
push eax
movaps xmmword [esp + 0x1c], xmm0
call fcn.00444a80
add esp, 0xc
mov dword [esp + 0x24], 0x100
lea eax, [esp + 0xc]
push eax
push 0x20019
push 0
push str.SoftwareSAMP
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x30c]
push eax
push 0
push 0
push str.gta_sa_exe
push dword [esp + 0x20]
call esi
test eax, eax
je 0x434cc5
push 0x10
push str.SA:MP_Launcher
push str.Could_not_get_the_location_of_your_GTA:SA_installation._Is_SA_MP_installed_correctly_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor al, al
pop edi
pop esi
mov ecx, dword [esp + 0x404]
xor ecx, esp
call fcn.0044279c
mov esp, ebp
pop ebp
ret 0xc
lea eax, [esp + 0x308]
push eax
lea eax, [esp + 0x18c]
push 0x100
push eax
call fcn.00453139
lea ecx, [esp + 0x194]
add esp, 0xc
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x434cf0
sub ecx, edx
add ecx, 0xfffffff5
cmp ecx, 0x100
jae 0x434f07
mov byte [esp + ecx + 0x188], al
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x74]
mov dword [esp + 0x28], 0x18
push eax
push 0
push 0
push str.PlayerName
push dword [esp + 0x20]
call esi
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
push dword [ebp + 0x10]
lea eax, [esp + 0x290]
push dword [esp + 0x10]
push str._c__h__s__p__d__n__s
push 0x80
push eax
call fcn.00433fa0
add esp, 0x18
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x190]
push eax
push 0
push 0xc
push 0
push 0
push 0
lea eax, [esp + 0x2a8]
push eax
lea eax, [esp + 0x32c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x434cad
push 0xff
lea eax, [esp + 0x8d]
mov byte [esp + 0x8c], 0
push 0
push eax
call fcn.00444a80
add esp, 0xc
lea eax, [esp + 0x188]
push eax
push str._s_samp.dll
lea eax, [esp + 0x90]
push 0x100
push eax
call fcn.00433fa0
add esp, 0x10
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x434ef6
push 0x4bb7a0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [esp + 0x88]
mov edi, eax
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x434e02
push 4
push 0x3000
sub ecx, edx
push ecx
push 0
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov esi, eax
mov dword [esp + 8], esi
test esi, esi
je 0x434ee5
lea ecx, [esp + 0x88]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x434e37
push 0
sub ecx, edx
lea eax, [esp + 0x8c]
push ecx
push eax
push esi
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test edi, edi
je 0x434ed4
push 0
push 4
push esi
push edi
push 0
push 0
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov edi, eax
test edi, edi
je 0x434ec3
mov esi, dword [sym.imp.KERNEL32.dll_ResumeThread]
push edi
call esi
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x8000
push 0
push dword [esp + 0x10]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push dword [esp + 0x14]
call esi
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x40c]
xor al, al
pop edi
pop esi
xor ecx, esp
call fcn.0044279c
mov esp, ebp
pop ebp
ret 0xc
push 0x10
push str.SA:MP_Launcher
push str.the_ID_returned_from_CreateRemoteThread_was_invalid.
jmp 0x434ca5
push 0x10
push str.SA:MP_Launcher
push str.Could_not_find_the_address_of_LoadLibraryA
jmp 0x434ca5
push 0x10
push str.SA:MP_Launcher
push str.Memory_could_not_be_allocated_to_inject_samp.dll
jmp 0x434ca5
push 0x10
push str.SA:MP_Launcher
push str.Could_not_find_kernel32.dll
jmp 0x434ca5
call fcn.00442e6b
int3