Function at 0x402cb0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Set console window title
Set registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4189af
mov eax, dword fs:[0]
push eax
sub esp, 0x4d4
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str.color_5F
call fcn.00409a28
add esp, 4
push 0x41ecdc
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
push str._INFO__Searching_for_NEXTRP..._n
call fcn.00402170
add esp, 4
push 0xc
call fcn.00403ddb
add esp, 4
mov dword [ebp - 0x4a4], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x4a4], 0
je 0x402d4f
xor eax, eax
mov ecx, dword [ebp - 0x4a4]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
push 0
push str.SOFTWAREWOW6432NodeNEXTRP_AllCommon
push 0x80000002
mov ecx, dword [ebp - 0x4a4]
call fcn.00401620
mov dword [ebp - 0x4b4], eax
jmp 0x402d59
mov dword [ebp - 0x4b4], 0
mov edx, dword [ebp - 0x4b4]
mov dword [ebp - 0x4d0], edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x4d0]
mov dword [ebp - 0x4a0], eax
cmp dword [ebp - 0x4a0], 0
je 0x40347a
push 0
push str.GTA:SA_Path
lea ecx, [ebp - 0x144]
push ecx
mov ecx, dword [ebp - 0x4a0]
call fcn.004017e0
mov dword [ebp - 4], 1
cmp dword [ebp - 0x134], 0
jne 0x402dba
mov dword [ebp - 0x4b0], 1
jmp 0x402dc4
mov dword [ebp - 0x4b0], 0
mov dl, byte [ebp - 0x4b0]
mov byte [ebp - 0x482], dl
movzx eax, byte [ebp - 0x482]
test eax, eax
je 0x402dfc
push str._ERROR__Can_t_find_installed_game__n
call fcn.00402170
add esp, 4
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea ecx, [ebp - 0x144]
push ecx
lea ecx, [ebp - 0x15c]
call fcn.00403540
mov byte [ebp - 4], 2
mov dword [ebp - 0x490], str.NEXTRP.exe
mov edx, dword [ebp - 0x490]
add edx, 1
mov dword [ebp - 0x4d8], edx
mov eax, dword [ebp - 0x490]
mov cl, byte [eax]
mov byte [ebp - 0x481], cl
add dword [ebp - 0x490], 1
cmp byte [ebp - 0x481], 0
jne 0x402e2b
mov edx, dword [ebp - 0x490]
sub edx, dword [ebp - 0x4d8]
mov dword [ebp - 0x4b8], edx
mov eax, dword [ebp - 0x4b8]
mov dword [ebp - 0x4bc], eax
mov ecx, dword [ebp - 0x4bc]
mov dword [ebp - 0x4c0], ecx
mov edx, dword [ebp - 0x4c0]
push edx
push str.NEXTRP.exe
lea ecx, [ebp - 0x144]
call fcn.004036b0
mov dword [ebp - 0x4dc], eax
mov eax, dword [ebp - 0x4a0]
mov dword [ebp - 0x494], eax
cmp dword [ebp - 0x494], 0
je 0x402ee5
mov ecx, dword [ebp - 0x494]
call fcn.00401650
mov ecx, 1
and ecx, 1
je 0x402ecb
push 0xc
mov edx, dword [ebp - 0x494]
push edx
call fcn.00403e10
add esp, 8
mov eax, dword [ebp - 0x494]
mov dword [ebp - 0x4c4], eax
mov ecx, dword [ebp - 0x4c4]
mov dword [ebp - 0x4c8], ecx
jmp 0x402eef
mov dword [ebp - 0x4c8], 0
lea ecx, [ebp - 0x144]
call fcn.004034e0
push eax
push str._INFO__Found:__s_n_INFO__Starting_NEXTRP.exe..._n
call fcn.00402170
add esp, 8
mov dword [ebp - 0x1a0], 0x44
push 0x40
push 0
lea edx, [ebp - 0x19c]
push edx
call fcn.00405370
add esp, 0xc
push pe_nt_image_headers32
push 0
push 0x4223f8
call fcn.00405370
add esp, 0xc
lea ecx, [ebp - 0x144]
call fcn.004034e0
push eax
push str.__s__upd
push 0x4223f8
call fcn.004021d0
add esp, 0xc
lea eax, [ebp - 0x1b0]
push eax
lea ecx, [ebp - 0x1a0]
push ecx
lea ecx, [ebp - 0x15c]
call fcn.004034e0
push eax
push 0
push 4
push 1
push 0
push 0
push 0x4223f8
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 0x480], eax
cmp dword [ebp - 0x480], 0
je 0x403443
push 0x2cc
push 0
lea edx, [ebp - 0x47c]
push edx
call fcn.00405370
add esp, 0xc
mov dword [ebp - 0x47c], 0x1003f
lea eax, [ebp - 0x47c]
push eax
mov ecx, dword [ebp - 0x1ac]
push ecx
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov dword [ebp - 0x480], eax
cmp dword [ebp - 0x480], 0
je 0x403412
push str._DBG__Saving_entry_point_instruction..._n
call fcn.00402170
add esp, 4
mov dword [ebp - 0x128], 0
push 4
push 0x3000
push 5
push 0
mov edx, dword [ebp - 0x1b0]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x498], eax
cmp dword [ebp - 0x498], 0
jne 0x40304a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._nError:_Unable_to_allocate_memory_for_DLL_data__Error:__d__n
call fcn.00402170
add esp, 8
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebp - 0x498]
push eax
push str._MEMORY__Allocated_data_region_at_address:_0x_X_n
call fcn.00402170
add esp, 8
mov byte [ebp - 0x20], 0
mov byte [ebp - 0x1f], 0
mov byte [ebp - 0x1e], 0
mov byte [ebp - 0x1d], 0
mov byte [ebp - 0x1c], 0
lea ecx, [ebp - 0x128]
push ecx
push 5
lea edx, [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x3cc]
push eax
mov ecx, dword [ebp - 0x1b0]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [ebp - 0x480], eax
cmp dword [ebp - 0x480], 0
jne 0x4030ca
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._nError:_Unable_to_read_memory__Last_Error_Code:___d__n
call fcn.00402170
add esp, 8
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea edx, [ebp - 0x128]
push edx
push 5
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x498]
push ecx
mov edx, dword [ebp - 0x1b0]
push edx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0x480], eax
cmp dword [ebp - 0x480], 0
je 0x4033fc
push 0xc
call fcn.00403ddb
add esp, 4
mov dword [ebp - 0x49c], eax
mov byte [ebp - 4], 3
cmp dword [ebp - 0x49c], 0
je 0x40314a
xor eax, eax
mov ecx, dword [ebp - 0x49c]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
push 1
push str.SoftwareNeutrino
push 0x80000001
mov ecx, dword [ebp - 0x49c]
call fcn.00401620
mov dword [ebp - 0x4ac], eax
jmp 0x403154
mov dword [ebp - 0x4ac], 0
mov edx, dword [ebp - 0x4ac]
mov dword [ebp - 0x4cc], edx
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x4cc]
mov dword [ebp - 0x48c], eax
cmp dword [ebp - 0x48c], 0
je 0x4033fa
mov ecx, dword [ebp - 0x498]
push ecx
push str.StoredData
mov ecx, dword [ebp - 0x48c]
call fcn.00401890
mov edx, dword [ebp - 0x3cc]
push edx
push str.SpinLock
mov ecx, dword [ebp - 0x48c]
call fcn.00401890
mov eax, dword [ebp - 0x1a4]
push eax
push str.Thread
mov ecx, dword [ebp - 0x48c]
call fcn.00401890
push str._DBG__Instruction_writed_to_allocated_memory__n
call fcn.00402170
add esp, 4
mov ecx, dword [ebp - 0x3cc]
mov dword [ebp - 0x488], ecx
mov byte [ebp - 0x18], 0xe9
mov byte [ebp - 0x17], 0x90
mov byte [ebp - 0x16], 0x90
mov byte [ebp - 0x15], 0x90
mov byte [ebp - 0x14], 0x90
mov edx, dword [ebp - 0x488]
push edx
push str._DBG__Address_of_OEP_for_spinlock:_0x_X_n
call fcn.00402170
add esp, 8
mov eax, dword [ebp - 0x488]
sub eax, dword [ebp - 0x488]
sub eax, 5
mov dword [ebp - 0x12c], eax
mov ecx, 1
shl ecx, 0
mov edx, dword [ebp - 0x12c]
mov dword [ebp + ecx - 0x18], edx
mov dword [ebp - 0x124], 0
lea eax, [ebp - 0x124]
push eax
push 0x40
push 5
mov ecx, dword [ebp - 0x488]
push ecx
mov edx, dword [ebp - 0x1b0]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov dword [ebp - 0x480], eax
cmp dword [ebp - 0x480], 0
jne 0x40328a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x41ef14
call fcn.00402170
add esp, 8
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push str._DBG__Writing_spinlock_shellcode_to_process..._n
call fcn.00402170
add esp, 4
lea eax, [ebp - 0x128]
push eax
push 5
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x488]
push edx
mov eax, dword [ebp - 0x1b0]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0x480], eax
cmp dword [ebp - 0x480], 0
je 0x4033e6
push str._SUCCESS__Spinlock_shellcode_successfully_placed__n
call fcn.00402170
add esp, 4
push pe_nt_image_headers32
push 0
lea ecx, [ebp - 0x120]
push ecx
call fcn.00405370
add esp, 0xc
push pe_nt_image_headers32
lea edx, [ebp - 0x120]
push edx
call fcn.0040a359
add esp, 8
push 0
lea eax, [ebp - 0x120]
push eax
push str.HomeDir
mov ecx, dword [ebp - 0x48c]
push ecx
call fcn.00401670
add esp, 0x10
lea edx, [ebp - 0x124]
push edx
mov eax, dword [ebp - 0x124]
push eax
push 5
mov ecx, dword [ebp - 0x488]
push ecx
mov edx, dword [ebp - 0x1b0]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov dword [ebp - 0x480], eax
cmp dword [ebp - 0x480], 0
jne 0x40337a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._nError:_Unable_to_change_memory_access__Last_Error_Code:___d__n
call fcn.00402170
add esp, 8
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x4e0], esp
push str.NeutrinoAgent.dll
call fcn.004018f0
mov eax, dword [ebp - 0x1b0]
push eax
call fcn.004024c0
nop
mov ecx, dword [ebp - 0x48c]
mov dword [ebp - 0x4a8], ecx
cmp dword [ebp - 0x4a8], 0
je 0x4033c6
push 1
mov ecx, dword [ebp - 0x4a8]
call fcn.004034b0
mov dword [ebp - 0x4d4], eax
jmp 0x4033d0
mov dword [ebp - 0x4d4], 0
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._ERROR__2_Can_t_write_to_process_:__Last_Error_Code:__d_n
call fcn.00402170
add esp, 8
jmp 0x403410
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._ERROR__1_Can_t_write_to_process_:__Last_Error_Code:__d_n
call fcn.00402170
add esp, 8
jmp 0x403426
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._ERROR__Can_t_obtain_thread_context._Last_Error_Code:__d_n
call fcn.00402170
add esp, 8
mov edx, dword [ebp - 0x1ac]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1b0]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
jmp 0x403457
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._ERROR__Cannot_create_process_:__Last_Error_Code:__d_n
call fcn.00402170
add esp, 8
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x15c]
call fcn.004019c0
nop
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x144]
call fcn.004019c0
nop
mov ecx, 1
test ecx, ecx
je 0x40348e
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
nop
jmp 0x40347a
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00403dc8
mov esp, ebp
pop ebp
ret