Function at 0x402cf0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Set console window title
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4177ef
mov eax, dword fs:[0]
push eax
sub esp, 0x5dc
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str.mine_noaw_xdxdxd
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
push str.searching..._n
call fcn.00402170
add esp, 4
push 0xc
call fcn.00403eeb
add esp, 4
mov dword [ebp - 0x5a8], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x5a8], 0
je 0x402d82
xor eax, eax
mov ecx, dword [ebp - 0x5a8]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
push 0
push str.SOFTWAREWOW6432NodeMulti_Theft_Auto:_San_Andreas_AllCommon
push 0x80000002
mov ecx, dword [ebp - 0x5a8]
call fcn.00401620
mov dword [ebp - 0x5b8], eax
jmp 0x402d8c
mov dword [ebp - 0x5b8], 0
mov edx, dword [ebp - 0x5b8]
mov dword [ebp - 0x5dc], edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x5dc]
mov dword [ebp - 0x5a4], eax
cmp dword [ebp - 0x5a4], 0
je 0x403584
push 0
push str.GTA:SA_Path
lea ecx, [ebp - 0x248]
push ecx
mov ecx, dword [ebp - 0x5a4]
call fcn.004017e0
mov dword [ebp - 4], 1
sub esp, 0x18
mov edx, esp
mov eax, dword [ebp - 0x248]
mov dword [edx], eax
mov ecx, dword [ebp - 0x244]
mov dword [edx + 4], ecx
mov eax, dword [ebp - 0x240]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 0x23c]
mov dword [edx + 0xc], ecx
mov eax, dword [ebp - 0x238]
mov dword [edx + 0x10], eax
mov ecx, dword [ebp - 0x234]
mov dword [edx + 0x14], ecx
push str._nfound_gta_sa:__s_n
call fcn.00402170
add esp, 0x1c
cmp dword [ebp - 0x238], 0
jne 0x402e34
mov dword [ebp - 0x5b4], 1
jmp 0x402e3e
mov dword [ebp - 0x5b4], 0
mov dl, byte [ebp - 0x5b4]
mov byte [ebp - 0x586], dl
movzx eax, byte [ebp - 0x586]
test eax, eax
je 0x402e76
push str.cant_find_da_game_n
call fcn.00402170
add esp, 4
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea ecx, [ebp - 0x248]
push ecx
lea ecx, [ebp - 0x260]
call fcn.00403650
mov byte [ebp - 4], 2
mov dword [ebp - 0x594], str.MTAMulti_Theft_Auto.exe
mov edx, dword [ebp - 0x594]
add edx, 1
mov dword [ebp - 0x5e0], edx
mov eax, dword [ebp - 0x594]
mov cl, byte [eax]
mov byte [ebp - 0x585], cl
add dword [ebp - 0x594], 1
cmp byte [ebp - 0x585], 0
jne 0x402ea5
mov edx, dword [ebp - 0x594]
sub edx, dword [ebp - 0x5e0]
mov dword [ebp - 0x5bc], edx
mov eax, dword [ebp - 0x5bc]
mov dword [ebp - 0x5c0], eax
mov ecx, dword [ebp - 0x5c0]
mov dword [ebp - 0x5c4], ecx
mov edx, dword [ebp - 0x5c4]
push edx
push str.MTAMulti_Theft_Auto.exe
lea ecx, [ebp - 0x248]
call fcn.004037c0
mov dword [ebp - 0x5e4], eax
mov eax, dword [ebp - 0x5a4]
mov dword [ebp - 0x59c], eax
cmp dword [ebp - 0x59c], 0
je 0x402f5f
mov ecx, dword [ebp - 0x59c]
call fcn.00401650
mov ecx, 1
and ecx, 1
je 0x402f45
push 0xc
mov edx, dword [ebp - 0x59c]
push edx
call fcn.00403f20
add esp, 8
mov eax, dword [ebp - 0x59c]
mov dword [ebp - 0x5c8], eax
mov ecx, dword [ebp - 0x5c8]
mov dword [ebp - 0x5cc], ecx
jmp 0x402f69
mov dword [ebp - 0x5cc], 0
lea ecx, [ebp - 0x248]
call fcn.004035f0
push eax
push str.fond:__s_n_startin..._n
call fcn.00402170
add esp, 8
mov dword [ebp - 0x2a4], 0x44
push 0x40
push 0
lea edx, [ebp - 0x2a0]
push edx
call fcn.00405480
add esp, 0xc
push 0x100
push 0
push 0x4213f8
call fcn.00405480
add esp, 0xc
lea ecx, [ebp - 0x248]
call fcn.004035f0
push eax
push str.__s__upd
push 0x4213f8
call fcn.004021d0
add esp, 0xc
push 0x4213f8
push str._ntmps_value:__s_n
call fcn.00402170
add esp, 8
lea eax, [ebp - 0x2b4]
push eax
lea ecx, [ebp - 0x2a4]
push ecx
lea ecx, [ebp - 0x260]
call fcn.004035f0
push eax
push 0
push 4
push 1
push 0
push 0
push 0x4213f8
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 0x584], eax
push 0x104
lea edx, [ebp - 0x224]
push edx
push 0
mov eax, dword [ebp - 0x2b4]
push eax
call dword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExA]
lea ecx, [ebp - 0x224]
push ecx
push str._nprocess_name:__s_n
call fcn.00402170
add esp, 8
cmp dword [ebp - 0x584], 0
je 0x40354d
push 0x2cc
push 0
lea edx, [ebp - 0x580]
push edx
call fcn.00405480
add esp, 0xc
mov dword [ebp - 0x580], 0x1003f
lea eax, [ebp - 0x580]
push eax
mov ecx, dword [ebp - 0x2b0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov dword [ebp - 0x584], eax
cmp dword [ebp - 0x584], 0
je 0x40351c
push str.saving_ep_inst..._n
call fcn.00402170
add esp, 4
mov dword [ebp - 0x228], 0
push 4
push 0x3000
push 5
push 0
mov edx, dword [ebp - 0x2b4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x598], eax
cmp dword [ebp - 0x598], 0
jne 0x403105
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._nunble_to_aloc__Err:__d__n
call fcn.00402170
add esp, 8
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebp - 0x598]
push eax
push str.memory_aloced_at:_0x_X_n
call fcn.00402170
add esp, 8
mov byte [ebp - 0x20], 0
mov byte [ebp - 0x1f], 0
mov byte [ebp - 0x1e], 0
mov byte [ebp - 0x1d], 0
mov byte [ebp - 0x1c], 0
lea ecx, [ebp - 0x228]
push ecx
push 5
lea edx, [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x4d0]
push eax
mov ecx, dword [ebp - 0x2b4]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [ebp - 0x584], eax
mov edx, dword [ebp - 0x4d0]
push edx
push str._naddress_of_eax:__p_n
call fcn.00402170
add esp, 8
cmp dword [ebp - 0x584], 0
jne 0x403199
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._nErr:unable_to_read_br__err:___d__n
call fcn.00402170
add esp, 8
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea eax, [ebp - 0x228]
push eax
push 5
lea ecx, [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x598]
push edx
mov eax, dword [ebp - 0x2b4]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0x584], eax
cmp dword [ebp - 0x584], 0
je 0x403506
push 0xc
call fcn.00403eeb
add esp, 4
mov dword [ebp - 0x5a0], eax
mov byte [ebp - 4], 3
cmp dword [ebp - 0x5a0], 0
je 0x403219
xor ecx, ecx
mov edx, dword [ebp - 0x5a0]
mov dword [edx], ecx
mov dword [edx + 4], ecx
mov dword [edx + 8], ecx
push 1
push str.SOFTWAREminabr
push 0x80000001
mov ecx, dword [ebp - 0x5a0]
call fcn.00401620
mov dword [ebp - 0x5b0], eax
jmp 0x403223
mov dword [ebp - 0x5b0], 0
mov eax, dword [ebp - 0x5b0]
mov dword [ebp - 0x5d0], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x5d0]
mov dword [ebp - 0x590], ecx
cmp dword [ebp - 0x590], 0
je 0x403504
mov edx, dword [ebp - 0x598]
push edx
push str.stor
mov ecx, dword [ebp - 0x590]
call fcn.00401890
mov eax, dword [ebp - 0x4d0]
push eax
push 0x41debc
mov ecx, dword [ebp - 0x590]
call fcn.00401890
mov ecx, dword [ebp - 0x2a8]
push ecx
push 0x41dec0
mov ecx, dword [ebp - 0x590]
call fcn.00401890
push str.instrucaaation_written_to_memo_n
call fcn.00402170
add esp, 4
mov edx, dword [ebp - 0x4d0]
mov dword [ebp - 0x58c], edx
mov byte [ebp - 0x18], 0xe9
mov byte [ebp - 0x17], 0x90
mov byte [ebp - 0x16], 0x90
mov byte [ebp - 0x15], 0x90
mov byte [ebp - 0x14], 0x90
mov eax, dword [ebp - 0x58c]
push eax
push str.awp_addr:_0x_X_n
call fcn.00402170
add esp, 8
mov ecx, dword [ebp - 0x598]
sub ecx, dword [ebp - 0x58c]
sub ecx, 5
mov dword [ebp - 0x230], ecx
mov edx, dword [ebp - 0x230]
push edx
push str._ndelta:__i_n
call fcn.00402170
add esp, 8
mov eax, 1
shl eax, 0
mov ecx, dword [ebp - 0x230]
mov dword [ebp + eax - 0x18], ecx
mov dword [ebp - 0x22c], 0
lea edx, [ebp - 0x22c]
push edx
push 0x40
push 5
mov eax, dword [ebp - 0x58c]
push eax
mov ecx, dword [ebp - 0x2b4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov dword [ebp - 0x584], eax
cmp dword [ebp - 0x584], 0
jne 0x40336d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._nErr:_unabelto_dmorfyi_meotmory_aces__last_ero_codee:___d__n
call fcn.00402170
add esp, 8
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push str.writnig_spklok_to_sporces..._n
call fcn.00402170
add esp, 4
lea edx, [ebp - 0x228]
push edx
push 5
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x58c]
push ecx
mov edx, dword [ebp - 0x2b4]
push edx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0x584], eax
mov eax, dword [ebp - 0x58c]
push eax
push str._nsplokaddr:__p_n
call fcn.00402170
add esp, 8
cmp dword [ebp - 0x584], 0
je 0x4034f0
push str.splok_sukkess__n
call fcn.00402170
add esp, 4
push 0x100
push 0
lea ecx, [ebp - 0x120]
push ecx
call fcn.00405480
add esp, 0xc
push 0x100
lea edx, [ebp - 0x120]
push edx
call fcn.0040a343
add esp, 8
push 0
lea eax, [ebp - 0x120]
push eax
push 0x41df7c
mov ecx, dword [ebp - 0x590]
push ecx
call fcn.00401670
add esp, 0x10
lea edx, [ebp - 0x22c]
push edx
mov eax, dword [ebp - 0x22c]
push eax
push 5
mov ecx, dword [ebp - 0x58c]
push ecx
mov edx, dword [ebp - 0x2b4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov dword [ebp - 0x584], eax
cmp dword [ebp - 0x584], 0
jne 0x403469
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._nErr:_aunbekl_to_cagien_memry_aces_err_ocde:___d__n
call fcn.00402170
add esp, 8
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
nop
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x5e8], esp
push str.minagen.dll
call fcn.004018f0
mov eax, dword [ebp - 0x2b4]
push eax
call fcn.004024c0
mov dword [ebp - 0x5d4], eax
cmp dword [ebp - 0x5d4], 0
je 0x4034a6
push str.mmap_failed
call fcn.00402170
add esp, 4
mov ecx, dword [ebp - 0x590]
mov dword [ebp - 0x5ac], ecx
cmp dword [ebp - 0x5ac], 0
je 0x4034d0
push 1
mov ecx, dword [ebp - 0x5ac]
call fcn.004035c0
mov dword [ebp - 0x5d8], eax
jmp 0x4034da
mov dword [ebp - 0x5d8], 0
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.2acant_write_to_rpaooces__err_:__d_n
call fcn.00402170
add esp, 8
jmp 0x40351a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.1acnt_write_to_rpoo_sr_brces_:__err:__d_n
call fcn.00402170
add esp, 8
jmp 0x403530
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.canti_obtian_theradr_cntext._err:__d_n
call fcn.00402170
add esp, 8
mov edx, dword [ebp - 0x2b0]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x2b4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
jmp 0x403561
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.canti_craetioe_proces_:__err:__d_n
call fcn.00402170
add esp, 8
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x260]
call fcn.004019c0
nop
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x248]
call fcn.004019c0
nop
mov ecx, 1
test ecx, ecx
je 0x403598
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
nop
jmp 0x403584
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00403ed8
mov esp, ebp
pop ebp
ret