Function at 0x401230
Capabilities:
Check if file exists
Create thread
Enumerate process modules
Enumerate processes
Get common file path
Get file attributes
Inject thread
Read .ini file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x764
mov eax, dword [0x405004]
xor eax, esp
mov dword [esp + 0x760], eax
push ebx
push esi
push edi
lea eax, [esp + 0x360]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea ecx, [esp + 0x360]
dec ecx
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x401268
mov eax, dword [str.config.ini]
mov dword [ecx], eax
mov eax, dword [0x403188]
mov dword [ecx + 4], eax
mov eax, dword [0x40318c]
mov dword [ecx + 8], eax
lea eax, [esp + 0x360]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x401533
test al, 0x10
jne 0x401533
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [esp + 0x360]
push eax
push 0xff
lea eax, [esp + 0x670]
push eax
push 0
push str.process
push str.Options
call esi
lea eax, [esp + 0x360]
push eax
push 0xff
lea eax, [esp + 0x468]
push eax
push 0
push 0x4032b8
push str.Options
call esi
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x401576
lea eax, [esp + 0x238]
mov dword [esp + 0x238], 0x128
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x40156f
mov edi, dword [sym.imp.KERNEL32.dll_Process32Next]
nop dword [eax]
nop word [eax + eax]
lea ecx, [esp + 0x668]
lea eax, [esp + 0x25c]
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x401370
test dl, dl
je 0x40136c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x401370
add eax, 2
add ecx, 2
test dl, dl
jne 0x401350
xor eax, eax
jmp 0x401375
sbb eax, eax
or eax, 1
test eax, eax
je 0x40138e
lea eax, [esp + 0x238]
push eax
push esi
call edi
test eax, eax
je 0x40156f
jmp 0x401340
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call ebx
mov esi, dword [esp + 0x240]
test esi, esi
je 0x401576
push 0
lea eax, [esp + 0x564]
push eax
push 0x104
lea eax, [esp + 0x46c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test eax, eax
je 0x401585
cmp eax, 0x104
ja 0x401594
lea eax, [esp + 0x560]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4015ee
test al, 0x10
jne 0x4015ee
push esi
push 8
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x401468
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
je 0x401465
mov edi, dword [sym.imp.KERNEL32.dll_Module32Next]
nop dword [eax + eax]
lea ecx, [esp + 0x460]
lea eax, [esp + 0x30]
nop dword [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x401450
test dl, dl
je 0x40144c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x401450
add eax, 2
add ecx, 2
test dl, dl
jne 0x401430
xor eax, eax
jmp 0x401455
sbb eax, eax
or eax, 1
test eax, eax
je 0x401488
lea eax, [esp + 0x10]
push eax
push esi
call edi
test eax, eax
jne 0x401420
push esi
call ebx
push dword [esp + 0x240]
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x4015a3
jmp 0x401498
push esi
call ebx
cmp dword [esp + 0x24], 0
jne 0x4015b2
jmp 0x401468
push 4
push 0x3000
push 0x104
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov edi, eax
test edi, edi
je 0x4015c1
push 0
push 0x104
lea eax, [esp + 0x568]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x4015d0
push 0
push 0
push edi
push dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test eax, eax
je 0x4015df
push esi
call ebx
push 0x8000
push 0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push 0x40
push str.LoadLibraryOne
push str.Enjoy
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x76c]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040178c
mov esp, ebp
pop ebp
ret 0x10
push 0
push 0x80
push 1
push 0
push 2
push 0x40000000
lea eax, [esp + 0x378]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
test eax, eax
je 0x401560
cmp eax, 0xffffffff
jne 0x4015fd
mov edx, str.Config_file_not_found._An_attempt_to_create_a_config_file_was_also_unsuccessful
mov ecx, str.Ini_file
call fcn.00401100
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, str.PlutoT6_Not_Find
mov ecx, str.ProcessID
call fcn.00401100
mov edx, 0x403168
mov ecx, str.GetFullPathName
call fcn.00401100
mov edx, str.Path_Length_too_short
mov ecx, str.GetFullPathName
call fcn.00401100
mov edx, 0x403168
mov ecx, 0x40334c
call fcn.00401100
mov edx, str.You_already_Load_The_Cheat
mov ecx, str.GrabModule
call fcn.00401100
mov edx, 0x403168
mov ecx, 0x403358
call fcn.00401100
mov edx, 0x403168
mov ecx, 0x403368
call fcn.00401100
mov edx, 0x403168
mov ecx, 0x40337c
call fcn.00401100
mov edx, str.ToolX.dll_Not_Find
mov ecx, str.FileExists
call fcn.00401100
push 0
push 0
push 0x5d
push str._Options__r_nprocess_plutonium_bootstrapper_win32.exe__r_ndll_ImGui_DirectX_11_Kiero_Hook.dll_
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, str.Config_file_not_found._A_default_config_file_has_been_created_in_the_current_directory.
mov ecx, str.Ini_file
call fcn.00401100
int3