Function at 0x403f80
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Set console window title
Set registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42743f
mov eax, dword fs:[0]
push eax
sub esp, 0x51c
mov eax, dword [0x433040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str.Sharingan_Injector_by_SirAbuser___ABUSERMTA
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
push str._INFO__Searching_for_MTA:SA..._n
call fcn.00402230
add esp, 4
push 0xc
call fcn.0040948b
add esp, 4
mov dword [ebp - 0x4a0], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x4a0], 0
je 0x404012
xor eax, eax
mov ecx, dword [ebp - 0x4a0]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
push 0
push str.SOFTWAREWOW6432NodeMulti_Theft_Auto:_San_Andreas_All1.6
push 0x80000002
mov ecx, dword [ebp - 0x4a0]
call fcn.00401770
mov dword [ebp - 0x4b8], eax
jmp 0x40401c
mov dword [ebp - 0x4b8], 0
mov edx, dword [ebp - 0x4b8]
mov dword [ebp - 0x4f0], edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x4f0]
mov dword [ebp - 0x4a4], eax
cmp dword [ebp - 0x4a4], 0
je 0x4048a7
push 0
push str.Last_Run_Location
lea ecx, [ebp - 0x144]
push ecx
mov ecx, dword [ebp - 0x4a4]
call fcn.00401930
mov dword [ebp - 4], 1
cmp dword [ebp - 0x134], 0
jne 0x40407d
mov dword [ebp - 0x4e0], 1
jmp 0x404087
mov dword [ebp - 0x4e0], 0
mov dl, byte [ebp - 0x4e0]
mov byte [ebp - 0x481], dl
movzx eax, byte [ebp - 0x481]
test eax, eax
je 0x4040be
push str._ERROR__Can_t_find_installed_game__n
call fcn.00402230
add esp, 4
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea ecx, [ebp - 0x144]
push ecx
lea ecx, [ebp - 0x15c]
call fcn.00404bd0
mov byte [ebp - 4], 2
mov dword [ebp - 0x494], str.Multi_Theft_Auto.exe
mov edx, dword [ebp - 0x494]
add edx, 1
mov dword [ebp - 0x4fc], edx
mov eax, dword [ebp - 0x494]
mov cl, byte [eax]
mov byte [ebp - 0x482], cl
add dword [ebp - 0x494], 1
cmp byte [ebp - 0x482], 0
jne 0x4040ed
mov edx, dword [ebp - 0x494]
sub edx, dword [ebp - 0x4fc]
mov dword [ebp - 0x504], edx
mov eax, dword [ebp - 0x504]
mov dword [ebp - 0x508], eax
mov ecx, dword [ebp - 0x508]
mov dword [ebp - 0x50c], ecx
mov edx, dword [ebp - 0x50c]
push edx
push str.Multi_Theft_Auto.exe
lea ecx, [ebp - 0x144]
call fcn.00404cd0
mov eax, dword [ebp - 0x4a4]
mov dword [ebp - 0x498], eax
cmp dword [ebp - 0x498], 0
je 0x4041a1
mov ecx, dword [ebp - 0x524]
mov dword [ebp - 0x4dc], ecx
mov ecx, dword [ebp - 0x498]
call fcn.004017a0
mov edx, 1
and edx, 1
je 0x404193
push 0xc
mov eax, dword [ebp - 0x498]
push eax
call fcn.004094c0
add esp, 8
mov ecx, dword [ebp - 0x498]
mov dword [ebp - 0x4dc], ecx
jmp 0x4041ab
mov dword [ebp - 0x4dc], 0
lea edx, [ebp - 0x144]
mov dword [ebp - 0x4a8], edx
mov eax, dword [ebp - 0x4a8]
mov dword [ebp - 0x4d4], eax
mov ecx, dword [ebp - 0x4a8]
cmp dword [ecx + 0x14], 0xf
jbe 0x4041db
mov dword [ebp - 0x4d8], 1
jmp 0x4041e5
mov dword [ebp - 0x4d8], 0
mov dl, byte [ebp - 0x4d8]
mov byte [ebp - 0x483], dl
movzx eax, byte [ebp - 0x483]
test eax, eax
je 0x404216
mov ecx, dword [ebp - 0x4a8]
mov edx, dword [ecx]
mov dword [ebp - 0x510], edx
mov eax, dword [ebp - 0x510]
mov dword [ebp - 0x4d4], eax
mov ecx, dword [ebp - 0x4d4]
mov dword [ebp - 0x514], ecx
mov edx, dword [ebp - 0x514]
mov dword [ebp - 0x518], edx
mov eax, dword [ebp - 0x518]
push eax
push str._INFO__Found:__s_n_INFO__Starting_Multi_Theft_Auto.exe..._n
call fcn.00402230
add esp, 8
mov dword [ebp - 0x1a0], 0x44
push 0x40
push 0
lea ecx, [ebp - 0x19c]
push ecx
call fcn.0040af10
add esp, 0xc
push 0x100
push 0
push 0x434db8
call fcn.0040af10
add esp, 0xc
lea edx, [ebp - 0x144]
mov dword [ebp - 0x4ac], edx
mov eax, dword [ebp - 0x4ac]
mov dword [ebp - 0x4cc], eax
mov ecx, dword [ebp - 0x4ac]
cmp dword [ecx + 0x14], 0xf
jbe 0x4042a3
mov dword [ebp - 0x4d0], 1
jmp 0x4042ad
mov dword [ebp - 0x4d0], 0
mov dl, byte [ebp - 0x4d0]
mov byte [ebp - 0x484], dl
movzx eax, byte [ebp - 0x484]
test eax, eax
je 0x4042de
mov ecx, dword [ebp - 0x4ac]
mov edx, dword [ecx]
mov dword [ebp - 0x51c], edx
mov eax, dword [ebp - 0x51c]
mov dword [ebp - 0x4cc], eax
mov ecx, dword [ebp - 0x4cc]
mov dword [ebp - 0x4e4], ecx
mov edx, dword [ebp - 0x4e4]
mov dword [ebp - 0x4e8], edx
mov eax, dword [ebp - 0x4e8]
push eax
push str.__s_
push 0x434db8
call fcn.00402290
add esp, 0xc
lea ecx, [ebp - 0x15c]
mov dword [ebp - 0x4b0], ecx
mov edx, dword [ebp - 0x4b0]
mov dword [ebp - 0x4c0], edx
mov eax, dword [ebp - 0x4b0]
cmp dword [eax + 0x14], 0xf
jbe 0x40433f
mov dword [ebp - 0x4c4], 1
jmp 0x404349
mov dword [ebp - 0x4c4], 0
mov cl, byte [ebp - 0x4c4]
mov byte [ebp - 0x485], cl
movzx edx, byte [ebp - 0x485]
test edx, edx
je 0x40437a
mov eax, dword [ebp - 0x4b0]
mov ecx, dword [eax]
mov dword [ebp - 0x4ec], ecx
mov edx, dword [ebp - 0x4ec]
mov dword [ebp - 0x4c0], edx
mov eax, dword [ebp - 0x4c0]
mov dword [ebp - 0x520], eax
mov ecx, dword [ebp - 0x520]
mov dword [ebp - 0x4f4], ecx
lea edx, [ebp - 0x1b0]
push edx
lea eax, [ebp - 0x1a0]
push eax
mov ecx, dword [ebp - 0x4f4]
push ecx
push 0
push 4
push 1
push 0
push 0
push 0x434db8
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 0x480], eax
cmp dword [ebp - 0x480], 0
je 0x404872
push 0x2cc
push 0
lea edx, [ebp - 0x47c]
push edx
call fcn.0040af10
add esp, 0xc
mov dword [ebp - 0x47c], 0x1003f
lea eax, [ebp - 0x47c]
push eax
mov ecx, dword [ebp - 0x1ac]
push ecx
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov dword [ebp - 0x480], eax
cmp dword [ebp - 0x480], 0
je 0x404842
push str._DBG__Saving_entry_point_instruction..._n
call fcn.00402230
add esp, 4
mov dword [ebp - 0x124], 0
push 4
push 0x3000
push 5
push 0
mov edx, dword [ebp - 0x1b0]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x49c], eax
cmp dword [ebp - 0x49c], 0
jne 0x40447f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._nError:_Unable_to_allocate_memory_for_DLL_data__Error:__d__n
call fcn.00402230
add esp, 8
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebp - 0x49c]
push eax
push str._MEMORY__Allocated_data_region_at_address:_0x_X_n
call fcn.00402230
add esp, 8
mov byte [ebp - 0x18], 0
mov byte [ebp - 0x17], 0
mov byte [ebp - 0x16], 0
mov byte [ebp - 0x15], 0
mov byte [ebp - 0x14], 0
lea ecx, [ebp - 0x124]
push ecx
push 5
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x3cc]
push eax
mov ecx, dword [ebp - 0x1b0]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [ebp - 0x480], eax
cmp dword [ebp - 0x480], 0
jne 0x4044fe
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._nError:_Unable_to_read_memory__Last_Error_Code:___d__n
call fcn.00402230
add esp, 8
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea edx, [ebp - 0x124]
push edx
push 5
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x49c]
push ecx
mov edx, dword [ebp - 0x1b0]
push edx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0x480], eax
cmp dword [ebp - 0x480], 0
je 0x40482c
push 0xc
call fcn.0040948b
add esp, 4
mov dword [ebp - 0x4b4], eax
mov byte [ebp - 4], 3
cmp dword [ebp - 0x4b4], 0
je 0x40457e
xor eax, eax
mov ecx, dword [ebp - 0x4b4]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
push 1
push str.SoftwareSharingan
push 0x80000001
mov ecx, dword [ebp - 0x4b4]
call fcn.00401770
mov dword [ebp - 0x4c8], eax
jmp 0x404588
mov dword [ebp - 0x4c8], 0
mov edx, dword [ebp - 0x4c8]
mov dword [ebp - 0x4f8], edx
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x4f8]
mov dword [ebp - 0x490], eax
cmp dword [ebp - 0x490], 0
je 0x40482a
mov ecx, dword [ebp - 0x49c]
push ecx
push str.StoredData
mov ecx, dword [ebp - 0x490]
call fcn.004019e0
mov edx, dword [ebp - 0x3cc]
push edx
push str.SpinLock
mov ecx, dword [ebp - 0x490]
call fcn.004019e0
mov eax, dword [ebp - 0x1a4]
push eax
push str.Thread
mov ecx, dword [ebp - 0x490]
call fcn.004019e0
push str._DBG__Instruction_writed_to_allocated_memory__n
call fcn.00402230
add esp, 4
mov ecx, dword [ebp - 0x3cc]
mov dword [ebp - 0x48c], ecx
mov byte [ebp - 0x20], 0xe9
mov byte [ebp - 0x1f], 0x90
mov byte [ebp - 0x1e], 0x90
mov byte [ebp - 0x1d], 0x90
mov byte [ebp - 0x1c], 0x90
mov edx, dword [ebp - 0x48c]
push edx
push str._DBG__Address_of_OEP_for_spinlock:_0x_X_n
call fcn.00402230
add esp, 8
mov eax, dword [ebp - 0x48c]
sub eax, dword [ebp - 0x48c]
sub eax, 5
mov dword [ebp - 0x12c], eax
mov ecx, 1
shl ecx, 0
mov edx, dword [ebp - 0x12c]
mov dword [ebp + ecx - 0x20], edx
mov dword [ebp - 0x128], 0
lea eax, [ebp - 0x128]
push eax
push 0x40
push 5
mov ecx, dword [ebp - 0x48c]
push ecx
mov edx, dword [ebp - 0x1b0]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov dword [ebp - 0x480], eax
cmp dword [ebp - 0x480], 0
jne 0x4046bd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x43009c
call fcn.00402230
add esp, 8
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push str._DBG__Writing_spinlock_shellcode_to_process..._n
call fcn.00402230
add esp, 4
lea eax, [ebp - 0x124]
push eax
push 5
lea ecx, [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x48c]
push edx
mov eax, dword [ebp - 0x1b0]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0x480], eax
cmp dword [ebp - 0x480], 0
je 0x404816
push str._SUCCESS__Spinlock_shellcode_successfully_placed__n
call fcn.00402230
add esp, 4
push 0x100
push 0
lea ecx, [ebp - 0x120]
push ecx
call fcn.0040af10
add esp, 0xc
push 0x100
lea edx, [ebp - 0x120]
push edx
call fcn.004115f0
add esp, 8
push 0
lea eax, [ebp - 0x120]
push eax
push str.HomeDir
mov ecx, dword [ebp - 0x490]
push ecx
call fcn.004017c0
add esp, 0x10
lea edx, [ebp - 0x128]
push edx
mov eax, dword [ebp - 0x128]
push eax
push 5
mov ecx, dword [ebp - 0x48c]
push ecx
mov edx, dword [ebp - 0x1b0]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov dword [ebp - 0x480], eax
cmp dword [ebp - 0x480], 0
jne 0x4047ac
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._nError:_Unable_to_change_memory_access__Last_Error_Code:___d__n
call fcn.00402230
add esp, 8
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x528], esp
push str.SharinganAgent.dll
call fcn.00401a40
mov eax, dword [ebp - 0x1b0]
push eax
call fcn.004025d0
mov ecx, dword [ebp - 0x490]
mov dword [ebp - 0x4bc], ecx
cmp dword [ebp - 0x4bc], 0
je 0x4047f7
push 1
mov ecx, dword [ebp - 0x4bc]
call fcn.004048e0
mov dword [ebp - 0x500], eax
jmp 0x404801
mov dword [ebp - 0x500], 0
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._ERROR__2_Can_t_write_to_process_:__Last_Error_Code:__d_n
call fcn.00402230
add esp, 8
jmp 0x404840
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._ERROR__1_Can_t_write_to_process_:__Last_Error_Code:__d_n
call fcn.00402230
add esp, 8
jmp 0x404856
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._ERROR__Can_t_obtain_thread_context._Last_Error_Code:__d_n
call fcn.00402230
add esp, 8
mov edx, dword [ebp - 0x1ac]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1b0]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x404886
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._ERROR__Cannot_create_process_:__Last_Error_Code:__d_n
call fcn.00402230
add esp, 8
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x15c]
call fcn.00401b10
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x144]
call fcn.00401b10
mov ecx, 1
test ecx, ecx
je 0x4048ba
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4048a7
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00409478
mov esp, ebp
pop ebp
ret