Function at 0x402cf0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Set console window title
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4178cc
mov eax, dword fs:[0]
push eax
sub esp, 0x5f0
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str.mine_noaw_xdxdxd
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
push str.searching..._n
call fcn.00402170
add esp, 4
push 0xc
call fcn.00403fa1
add esp, 4
mov dword [ebp - 0x5c0], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x5c0], 0
je 0x402d82
xor eax, eax
mov ecx, dword [ebp - 0x5c0]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
push 0
push str.SOFTWAREWOW6432NodeMulti_Theft_Auto:_San_Andreas_AllCommon
push 0x80000002
mov ecx, dword [ebp - 0x5c0]
call fcn.00401620
mov dword [ebp - 0x5d4], eax
jmp 0x402d8c
mov dword [ebp - 0x5d4], 0
mov edx, dword [ebp - 0x5d4]
mov dword [ebp - 0x5dc], edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x5dc]
mov dword [ebp - 0x5b4], eax
cmp dword [ebp - 0x5b4], 0
je 0x40362f
push 0
push str.GTA:SA_Path
lea ecx, [ebp - 0x248]
push ecx
mov ecx, dword [ebp - 0x5b4]
call fcn.004017e0
mov dword [ebp - 4], 1
sub esp, 0x18
mov edx, esp
mov eax, dword [ebp - 0x248]
mov dword [edx], eax
mov ecx, dword [ebp - 0x244]
mov dword [edx + 4], ecx
mov eax, dword [ebp - 0x240]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 0x23c]
mov dword [edx + 0xc], ecx
mov eax, dword [ebp - 0x238]
mov dword [edx + 0x10], eax
mov ecx, dword [ebp - 0x234]
mov dword [edx + 0x14], ecx
push str._nfound_gta_sa:__s_n
call fcn.00402170
add esp, 0x1c
cmp dword [ebp - 0x238], 0
jne 0x402e34
mov dword [ebp - 0x5d0], 1
jmp 0x402e3e
mov dword [ebp - 0x5d0], 0
mov dl, byte [ebp - 0x5d0]
mov byte [ebp - 0x59e], dl
movzx eax, byte [ebp - 0x59e]
test eax, eax
je 0x402e76
push str.cant_find_da_game_n
call fcn.00402170
add esp, 4
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea ecx, [ebp - 0x248]
push ecx
lea ecx, [ebp - 0x278]
call fcn.004037c0
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x5b4]
mov dword [ebp - 0x5b0], edx
cmp dword [ebp - 0x5b0], 0
je 0x402ee1
mov ecx, dword [ebp - 0x5b0]
call fcn.00401650
mov eax, 1
and eax, 1
je 0x402ec7
push 0xc
mov ecx, dword [ebp - 0x5b0]
push ecx
call fcn.00403fd6
add esp, 8
mov edx, dword [ebp - 0x5b0]
mov dword [ebp - 0x5e0], edx
mov eax, dword [ebp - 0x5e0]
mov dword [ebp - 0x5e4], eax
jmp 0x402eeb
mov dword [ebp - 0x5e4], 0
push 0xc
call fcn.00403fa1
add esp, 4
mov dword [ebp - 0x5bc], eax
mov byte [ebp - 4], 3
cmp dword [ebp - 0x5bc], 0
je 0x402f37
xor ecx, ecx
mov edx, dword [ebp - 0x5bc]
mov dword [edx], ecx
mov dword [edx + 4], ecx
mov dword [edx + 8], ecx
push 0
push str.SOFTWAREWOW6432NodeMulti_Theft_Auto:_San_Andreas_All1.6
push 0x80000002
mov ecx, dword [ebp - 0x5bc]
call fcn.00401620
mov dword [ebp - 0x5cc], eax
jmp 0x402f41
mov dword [ebp - 0x5cc], 0
mov eax, dword [ebp - 0x5cc]
mov dword [ebp - 0x5e8], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x5e8]
mov dword [ebp - 0x5ec], ecx
cmp dword [ebp - 0x5ec], 0
je 0x403014
push 0
push str.Last_Run_Path
lea edx, [ebp - 0x260]
push edx
mov ecx, dword [ebp - 0x5b4]
call fcn.004017e0
mov byte [ebp - 4], 4
cmp dword [ebp - 0x250], 0
jne 0x402f9c
mov dword [ebp - 0x5c8], 1
jmp 0x402fa6
mov dword [ebp - 0x5c8], 0
mov al, byte [ebp - 0x5c8]
mov byte [ebp - 0x59d], al
movzx ecx, byte [ebp - 0x59d]
test ecx, ecx
je 0x402fde
push str.cant_find_mta_n
call fcn.00402170
add esp, 4
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea ecx, [ebp - 0x248]
call fcn.00403670
push eax
call fcn.00402170
add esp, 4
lea edx, [ebp - 0x260]
push edx
lea ecx, [ebp - 0x248]
call fcn.00403700
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x260]
call fcn.004019c0
nop
lea ecx, [ebp - 0x248]
call fcn.00403670
push eax
push str.fond:__s_n_startin..._n
call fcn.00402170
add esp, 8
mov dword [ebp - 0x2bc], 0x44
push 0x40
push 0
lea eax, [ebp - 0x2b8]
push eax
call fcn.00405530
add esp, 0xc
push 0x100
push 0
push 0x4213f8
call fcn.00405530
add esp, 0xc
lea ecx, [ebp - 0x248]
call fcn.00403670
push eax
push str.__s__upd
push 0x4213f8
call fcn.004021d0
add esp, 0xc
push 0x4213f8
push str._ntmps_value:__s_n
call fcn.00402170
add esp, 8
lea ecx, [ebp - 0x2cc]
push ecx
lea edx, [ebp - 0x2bc]
push edx
lea ecx, [ebp - 0x278]
call fcn.00403670
push eax
push 0
push 4
push 1
push 0
push 0
push 0x4213f8
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 0x59c], eax
push 0x104
lea eax, [ebp - 0x224]
push eax
push 0
mov ecx, dword [ebp - 0x2cc]
push ecx
call dword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExA]
lea edx, [ebp - 0x224]
push edx
push str._nprocess_name:__s_n
call fcn.00402170
add esp, 8
cmp dword [ebp - 0x59c], 0
je 0x4035f8
push 0x2cc
push 0
lea eax, [ebp - 0x598]
push eax
call fcn.00405530
add esp, 0xc
mov dword [ebp - 0x598], 0x1003f
lea ecx, [ebp - 0x598]
push ecx
mov edx, dword [ebp - 0x2c8]
push edx
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov dword [ebp - 0x59c], eax
cmp dword [ebp - 0x59c], 0
je 0x4035c7
push str.saving_ep_inst..._n
call fcn.00402170
add esp, 4
mov dword [ebp - 0x228], 0
push 4
push 0x3000
push 5
push 0
mov eax, dword [ebp - 0x2cc]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x5ac], eax
cmp dword [ebp - 0x5ac], 0
jne 0x4031b0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._nunble_to_aloc__Err:__d__n
call fcn.00402170
add esp, 8
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 0x5ac]
push ecx
push str.memory_aloced_at:_0x_X_n
call fcn.00402170
add esp, 8
mov byte [ebp - 0x20], 0
mov byte [ebp - 0x1f], 0
mov byte [ebp - 0x1e], 0
mov byte [ebp - 0x1d], 0
mov byte [ebp - 0x1c], 0
lea edx, [ebp - 0x228]
push edx
push 5
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x4e8]
push ecx
mov edx, dword [ebp - 0x2cc]
push edx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [ebp - 0x59c], eax
mov eax, dword [ebp - 0x4e8]
push eax
push str._naddress_of_eax:__p_n
call fcn.00402170
add esp, 8
cmp dword [ebp - 0x59c], 0
jne 0x403244
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._nErr:unable_to_read_br__err:___d__n
call fcn.00402170
add esp, 8
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea ecx, [ebp - 0x228]
push ecx
push 5
lea edx, [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x5ac]
push eax
mov ecx, dword [ebp - 0x2cc]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0x59c], eax
cmp dword [ebp - 0x59c], 0
je 0x4035b1
push 0xc
call fcn.00403fa1
add esp, 4
mov dword [ebp - 0x5b8], eax
mov byte [ebp - 4], 5
cmp dword [ebp - 0x5b8], 0
je 0x4032c4
xor edx, edx
mov eax, dword [ebp - 0x5b8]
mov dword [eax], edx
mov dword [eax + 4], edx
mov dword [eax + 8], edx
push 1
push str.SOFTWAREminabr
push 0x80000001
mov ecx, dword [ebp - 0x5b8]
call fcn.00401620
mov dword [ebp - 0x5c4], eax
jmp 0x4032ce
mov dword [ebp - 0x5c4], 0
mov ecx, dword [ebp - 0x5c4]
mov dword [ebp - 0x5f0], ecx
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x5f0]
mov dword [ebp - 0x5a8], edx
cmp dword [ebp - 0x5a8], 0
je 0x4035af
mov eax, dword [ebp - 0x5ac]
push eax
push str.stor
mov ecx, dword [ebp - 0x5a8]
call fcn.00401890
mov ecx, dword [ebp - 0x4e8]
push ecx
push 0x41defc
mov ecx, dword [ebp - 0x5a8]
call fcn.00401890
mov edx, dword [ebp - 0x2c0]
push edx
push 0x41df00
mov ecx, dword [ebp - 0x5a8]
call fcn.00401890
push str.instrucaaation_written_to_memo_n
call fcn.00402170
add esp, 4
mov eax, dword [ebp - 0x4e8]
mov dword [ebp - 0x5a4], eax
mov byte [ebp - 0x18], 0xe9
mov byte [ebp - 0x17], 0x90
mov byte [ebp - 0x16], 0x90
mov byte [ebp - 0x15], 0x90
mov byte [ebp - 0x14], 0x90
mov ecx, dword [ebp - 0x5a4]
push ecx
push str.awp_addr:_0x_X_n
call fcn.00402170
add esp, 8
mov edx, dword [ebp - 0x5ac]
sub edx, dword [ebp - 0x5a4]
sub edx, 5
mov dword [ebp - 0x230], edx
mov eax, dword [ebp - 0x230]
push eax
push str._ndelta:__i_n
call fcn.00402170
add esp, 8
mov ecx, 1
shl ecx, 0
mov edx, dword [ebp - 0x230]
mov dword [ebp + ecx - 0x18], edx
mov dword [ebp - 0x22c], 0
lea eax, [ebp - 0x22c]
push eax
push 0x40
push 5
mov ecx, dword [ebp - 0x5a4]
push ecx
mov edx, dword [ebp - 0x2cc]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov dword [ebp - 0x59c], eax
cmp dword [ebp - 0x59c], 0
jne 0x403418
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._nErr:_unabelto_dmorfyi_meotmory_aces__last_ero_codee:___d__n
call fcn.00402170
add esp, 8
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push str.writnig_spklok_to_sporces..._n
call fcn.00402170
add esp, 4
lea eax, [ebp - 0x228]
push eax
push 5
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x5a4]
push edx
mov eax, dword [ebp - 0x2cc]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0x59c], eax
mov ecx, dword [ebp - 0x5a4]
push ecx
push str._nsplokaddr:__p_n
call fcn.00402170
add esp, 8
cmp dword [ebp - 0x59c], 0
je 0x40359b
push str.splok_sukkess__n
call fcn.00402170
add esp, 4
push 0x100
push 0
lea edx, [ebp - 0x120]
push edx
call fcn.00405530
add esp, 0xc
push 0x100
lea eax, [ebp - 0x120]
push eax
call fcn.0040a3f3
add esp, 8
push 0
lea ecx, [ebp - 0x120]
push ecx
push 0x41dfbc
mov edx, dword [ebp - 0x5a8]
push edx
call fcn.00401670
add esp, 0x10
lea eax, [ebp - 0x22c]
push eax
mov ecx, dword [ebp - 0x22c]
push ecx
push 5
mov edx, dword [ebp - 0x5a4]
push edx
mov eax, dword [ebp - 0x2cc]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov dword [ebp - 0x59c], eax
cmp dword [ebp - 0x59c], 0
jne 0x403514
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._nErr:_aunbekl_to_cagien_memry_aces_err_ocde:___d__n
call fcn.00402170
add esp, 8
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
nop
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x5fc], esp
push str.minagen.dll
call fcn.004018f0
mov ecx, dword [ebp - 0x2cc]
push ecx
call fcn.004024c0
mov dword [ebp - 0x5f4], eax
cmp dword [ebp - 0x5f4], 0
je 0x403551
push str.mmap_failed
call fcn.00402170
add esp, 4
mov edx, dword [ebp - 0x5a8]
mov dword [ebp - 0x5d8], edx
cmp dword [ebp - 0x5d8], 0
je 0x40357b
push 1
mov ecx, dword [ebp - 0x5d8]
call fcn.004036d0
mov dword [ebp - 0x5f8], eax
jmp 0x403585
mov dword [ebp - 0x5f8], 0
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.2acant_write_to_rpaooces__err_:__d_n
call fcn.00402170
add esp, 8
jmp 0x4035c5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.1acnt_write_to_rpoo_sr_brces_:__err:__d_n
call fcn.00402170
add esp, 8
jmp 0x4035db
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.canti_obtian_theradr_cntext._err:__d_n
call fcn.00402170
add esp, 8
mov eax, dword [ebp - 0x2c8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x2cc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
jmp 0x40360c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.canti_craetioe_proces_:__err:__d_n
call fcn.00402170
add esp, 8
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x278]
call fcn.004019c0
nop
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x248]
call fcn.004019c0
nop
mov edx, 1
test edx, edx
je 0x403643
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
nop
jmp 0x40362f
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00403f8e
mov esp, ebp
pop ebp
ret