Function at 0x401000
Capabilities:
Accept command line arguments
Allocate or change rwx memory
Create process on windows
Create thread
Get common file path
Inject thread
Resume thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
push esi
push edi
lea edi, [ebp - 0x190]
mov ecx, 0x64
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x40da04]
xor eax, ebp
mov dword [ebp - 4], eax
mov esi, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
cmp esi, esp
call fcn.004041d0
mov dword [ebp - 8], 0
mov esi, esp
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp esi, esp
call fcn.004041d0
mov dword [ebp - 0xc], eax
xor ecx, ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
push 0x44
push 0
lea edx, [ebp - 0x74]
push edx
call sub.VCRUNTIME140D.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x9c]
call fcn.004024e0
lea ecx, [ebp - 0xc0]
call fcn.004024e0
lea ecx, [ebp - 0xe4]
call fcn.004024e0
lea ecx, [ebp - 0x108]
call fcn.004024e0
push 0
push 0x104
lea ecx, [ebp - 0x9c]
call fcn.00403e20
push 0
lea ecx, [ebp - 0x9c]
call fcn.004027a0
mov esi, esp
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
cmp esi, esp
call fcn.004041d0
mov dword [ebp - 0x110], eax
push 0
mov eax, dword [ebp - 0x110]
push eax
lea ecx, [ebp - 0x9c]
call fcn.00403e20
push str._samp.dll
lea ecx, [ebp - 0x9c]
push ecx
lea edx, [ebp - 0x12c]
push edx
call fcn.00401770
add esp, 0xc
push eax
lea ecx, [ebp - 0xc0]
call fcn.00402700
lea ecx, [ebp - 0x12c]
call fcn.00402670
push str.imrp.dll
lea eax, [ebp - 0x9c]
push eax
lea ecx, [ebp - 0x148]
push ecx
call fcn.00401770
add esp, 0xc
push eax
lea ecx, [ebp - 0x108]
call fcn.00402700
lea ecx, [ebp - 0x148]
call fcn.00402670
push str.gta_sa.exe
lea edx, [ebp - 0x9c]
push edx
lea eax, [ebp - 0x164]
push eax
call fcn.00401770
add esp, 0xc
push eax
lea ecx, [ebp - 0xe4]
call fcn.00402700
lea ecx, [ebp - 0x164]
call fcn.00402670
mov dword [ebp - 0x168], 0x2a00
cmp dword [ebp - 0xc], 0
je 0x401376
mov esi, esp
push str.LoadLibraryW
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp esi, esp
call fcn.004041d0
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x401362
mov esi, esp
lea edx, [ebp - 0x28]
push edx
lea eax, [ebp - 0x74]
push eax
push 0
push 0
push 0xc
push 0
push 0
push 0
mov edi, esp
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
cmp edi, esp
call fcn.004041d0
push eax
lea ecx, [ebp - 0xe4]
call fcn.00403b20
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp esi, esp
call fcn.004041d0
test eax, eax
je 0x40134e
mov esi, esp
push 0x40
push 0x3000
lea ecx, [ebp - 0xc0]
call fcn.00403c40
lea ecx, [eax + eax + 2]
push ecx
push 0
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
cmp esi, esp
call fcn.004041d0
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x401314
mov esi, esp
push 0
lea ecx, [ebp - 0xc0]
call fcn.00403c40
lea eax, [eax + eax + 2]
push eax
lea ecx, [ebp - 0xc0]
call fcn.00403b20
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp esi, esp
call fcn.004041d0
test eax, eax
je 0x4012e2
mov esi, esp
push 0
push 4
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
push 0
push 0
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
cmp esi, esp
call fcn.004041d0
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0
je 0x4012ce
mov esi, esp
mov eax, dword [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp esi, esp
call fcn.004041d0
mov esi, esp
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x7c]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp esi, esp
call fcn.004041d0
jmp 0x4012e0
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.004041d0
mov dword [ebp - 8], eax
jmp 0x4012f4
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.004041d0
mov dword [ebp - 8], eax
mov esi, esp
push 0x8000
push 0
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
cmp esi, esp
call fcn.004041d0
jmp 0x401326
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.004041d0
mov dword [ebp - 8], eax
mov esi, esp
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp esi, esp
call fcn.004041d0
mov esi, esp
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.004041d0
jmp 0x401360
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.004041d0
mov dword [ebp - 8], eax
jmp 0x401374
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.004041d0
mov dword [ebp - 8], eax
jmp 0x401388
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.004041d0
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4013d0
mov eax, dword [ebp - 8]
push eax
lea ecx, [ebp - 0x188]
push ecx
call fcn.004014e0
add esp, 8
mov esi, esp
push 0x10
push str.Error
lea ecx, [ebp - 0x188]
call fcn.00403b20
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp esi, esp
call fcn.004041d0
lea ecx, [ebp - 0x188]
call fcn.00402670
mov edx, dword [ebp - 8]
mov dword [ebp - 0x190], edx
lea ecx, [ebp - 0x108]
call fcn.00402670
lea ecx, [ebp - 0xe4]
call fcn.00402670
lea ecx, [ebp - 0xc0]
call fcn.00402670
lea ecx, [ebp - 0x9c]
call fcn.00402670
mov eax, dword [ebp - 0x190]
push edx
mov ecx, ebp
push eax
lea edx, [0x40143c]
call fcn.00404160
pop eax
pop edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404210
add esp, 0x190
cmp ebp, esp
call fcn.004041d0
mov esp, ebp
pop ebp
ret 0x10