Function at 0x402c10
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Set console window title
Set registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41893f
mov eax, dword fs:[0]
push eax
sub esp, 0x51c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str.color_05
call fcn.004099a8
add esp, 4
push str.PHANTOM__https:__discord.gg_N8XQZKQ3xj
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
push str._INFO__Searching_for_MTA:SA..._n
call fcn.00402090
add esp, 4
push 0xc
call fcn.00403ebb
add esp, 4
mov dword [ebp - 0x4a0], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x4a0], 0
je 0x402caf
xor eax, eax
mov ecx, dword [ebp - 0x4a0]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
push 0
push str.SOFTWAREWOW6432NodeMulti_Theft_Auto:_San_Andreas_All1.6
push 0x80000002
mov ecx, dword [ebp - 0x4a0]
call fcn.00401610
mov dword [ebp - 0x4b8], eax
jmp 0x402cb9
mov dword [ebp - 0x4b8], 0
mov edx, dword [ebp - 0x4b8]
mov dword [ebp - 0x4f0], edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x4f0]
mov dword [ebp - 0x4a4], eax
cmp dword [ebp - 0x4a4], 0
je 0x403544
push 0
push str.Last_Run_Location
lea ecx, [ebp - 0x144]
push ecx
mov ecx, dword [ebp - 0x4a4]
call fcn.004017d0
mov dword [ebp - 4], 1
cmp dword [ebp - 0x134], 0
jne 0x402d1a
mov dword [ebp - 0x4e0], 1
jmp 0x402d24
mov dword [ebp - 0x4e0], 0
mov dl, byte [ebp - 0x4e0]
mov byte [ebp - 0x481], dl
movzx eax, byte [ebp - 0x481]
test eax, eax
je 0x402d5b
push str._ERROR__Can_t_find_installed_game__n
call fcn.00402090
add esp, 4
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea ecx, [ebp - 0x144]
push ecx
lea ecx, [ebp - 0x15c]
call fcn.004035b0
mov byte [ebp - 4], 2
mov dword [ebp - 0x494], str.Multi_Theft_Auto.exe
mov edx, dword [ebp - 0x494]
add edx, 1
mov dword [ebp - 0x4fc], edx
mov eax, dword [ebp - 0x494]
mov cl, byte [eax]
mov byte [ebp - 0x482], cl
add dword [ebp - 0x494], 1
cmp byte [ebp - 0x482], 0
jne 0x402d8a
mov edx, dword [ebp - 0x494]
sub edx, dword [ebp - 0x4fc]
mov dword [ebp - 0x504], edx
mov eax, dword [ebp - 0x504]
mov dword [ebp - 0x508], eax
mov ecx, dword [ebp - 0x508]
mov dword [ebp - 0x50c], ecx
mov edx, dword [ebp - 0x50c]
push edx
push str.Multi_Theft_Auto.exe
lea ecx, [ebp - 0x144]
call fcn.00403700
mov eax, dword [ebp - 0x4a4]
mov dword [ebp - 0x498], eax
cmp dword [ebp - 0x498], 0
je 0x402e3e
mov ecx, dword [ebp - 0x524]
mov dword [ebp - 0x4dc], ecx
mov ecx, dword [ebp - 0x498]
call fcn.00401640
mov edx, 1
and edx, 1
je 0x402e30
push 0xc
mov eax, dword [ebp - 0x498]
push eax
call fcn.00403ef0
add esp, 8
mov ecx, dword [ebp - 0x498]
mov dword [ebp - 0x4dc], ecx
jmp 0x402e48
mov dword [ebp - 0x4dc], 0
lea edx, [ebp - 0x144]
mov dword [ebp - 0x4a8], edx
mov eax, dword [ebp - 0x4a8]
mov dword [ebp - 0x4d4], eax
mov ecx, dword [ebp - 0x4a8]
cmp dword [ecx + 0x14], 0xf
jbe 0x402e78
mov dword [ebp - 0x4d8], 1
jmp 0x402e82
mov dword [ebp - 0x4d8], 0
mov dl, byte [ebp - 0x4d8]
mov byte [ebp - 0x483], dl
movzx eax, byte [ebp - 0x483]
test eax, eax
je 0x402eb3
mov ecx, dword [ebp - 0x4a8]
mov edx, dword [ecx]
mov dword [ebp - 0x510], edx
mov eax, dword [ebp - 0x510]
mov dword [ebp - 0x4d4], eax
mov ecx, dword [ebp - 0x4d4]
mov dword [ebp - 0x514], ecx
mov edx, dword [ebp - 0x514]
mov dword [ebp - 0x518], edx
mov eax, dword [ebp - 0x518]
push eax
push str._INFO__Found:__s_n_INFO__Starting_Multi_Theft_Auto.exe..._n
call fcn.00402090
add esp, 8
mov dword [ebp - 0x1a0], 0x44
push 0x40
push 0
lea ecx, [ebp - 0x19c]
push ecx
call fcn.004052f0
add esp, 0xc
push pe_nt_image_headers32
push 0
push 0x4223f0
call fcn.004052f0
add esp, 0xc
lea edx, [ebp - 0x144]
mov dword [ebp - 0x4ac], edx
mov eax, dword [ebp - 0x4ac]
mov dword [ebp - 0x4cc], eax
mov ecx, dword [ebp - 0x4ac]
cmp dword [ecx + 0x14], 0xf
jbe 0x402f40
mov dword [ebp - 0x4d0], 1
jmp 0x402f4a
mov dword [ebp - 0x4d0], 0
mov dl, byte [ebp - 0x4d0]
mov byte [ebp - 0x484], dl
movzx eax, byte [ebp - 0x484]
test eax, eax
je 0x402f7b
mov ecx, dword [ebp - 0x4ac]
mov edx, dword [ecx]
mov dword [ebp - 0x51c], edx
mov eax, dword [ebp - 0x51c]
mov dword [ebp - 0x4cc], eax
mov ecx, dword [ebp - 0x4cc]
mov dword [ebp - 0x4e4], ecx
mov edx, dword [ebp - 0x4e4]
mov dword [ebp - 0x4e8], edx
mov eax, dword [ebp - 0x4e8]
push eax
push str.__s_
push 0x4223f0
call fcn.004020f0
add esp, 0xc
lea ecx, [ebp - 0x15c]
mov dword [ebp - 0x4b0], ecx
mov edx, dword [ebp - 0x4b0]
mov dword [ebp - 0x4c0], edx
mov eax, dword [ebp - 0x4b0]
cmp dword [eax + 0x14], 0xf
jbe 0x402fdc
mov dword [ebp - 0x4c4], 1
jmp 0x402fe6
mov dword [ebp - 0x4c4], 0
mov cl, byte [ebp - 0x4c4]
mov byte [ebp - 0x485], cl
movzx edx, byte [ebp - 0x485]
test edx, edx
je 0x403017
mov eax, dword [ebp - 0x4b0]
mov ecx, dword [eax]
mov dword [ebp - 0x4ec], ecx
mov edx, dword [ebp - 0x4ec]
mov dword [ebp - 0x4c0], edx
mov eax, dword [ebp - 0x4c0]
mov dword [ebp - 0x520], eax
mov ecx, dword [ebp - 0x520]
mov dword [ebp - 0x4f4], ecx
lea edx, [ebp - 0x1b0]
push edx
lea eax, [ebp - 0x1a0]
push eax
mov ecx, dword [ebp - 0x4f4]
push ecx
push 0
push 4
push 1
push 0
push 0
push 0x4223f0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 0x480], eax
cmp dword [ebp - 0x480], 0
je 0x40350f
push 0x2cc
push 0
lea edx, [ebp - 0x47c]
push edx
call fcn.004052f0
add esp, 0xc
mov dword [ebp - 0x47c], 0x1003f
lea eax, [ebp - 0x47c]
push eax
mov ecx, dword [ebp - 0x1ac]
push ecx
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov dword [ebp - 0x480], eax
cmp dword [ebp - 0x480], 0
je 0x4034df
push str._DBG__Saving_entry_point_instruction..._n
call fcn.00402090
add esp, 4
mov dword [ebp - 0x124], 0
push 4
push 0x3000
push 5
push 0
mov edx, dword [ebp - 0x1b0]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x49c], eax
cmp dword [ebp - 0x49c], 0
jne 0x40311c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._nError:_Unable_to_allocate_memory_for_DLL_data__Error:__d__n
call fcn.00402090
add esp, 8
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebp - 0x49c]
push eax
push str._MEMORY__Allocated_data_region_at_address:_0x_X_n
call fcn.00402090
add esp, 8
mov byte [ebp - 0x18], 0
mov byte [ebp - 0x17], 0
mov byte [ebp - 0x16], 0
mov byte [ebp - 0x15], 0
mov byte [ebp - 0x14], 0
lea ecx, [ebp - 0x124]
push ecx
push 5
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x3cc]
push eax
mov ecx, dword [ebp - 0x1b0]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [ebp - 0x480], eax
cmp dword [ebp - 0x480], 0
jne 0x40319b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._nError:_Unable_to_read_memory__Last_Error_Code:___d__n
call fcn.00402090
add esp, 8
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea edx, [ebp - 0x124]
push edx
push 5
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x49c]
push ecx
mov edx, dword [ebp - 0x1b0]
push edx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0x480], eax
cmp dword [ebp - 0x480], 0
je 0x4034c9
push 0xc
call fcn.00403ebb
add esp, 4
mov dword [ebp - 0x4b4], eax
mov byte [ebp - 4], 3
cmp dword [ebp - 0x4b4], 0
je 0x40321b
xor eax, eax
mov ecx, dword [ebp - 0x4b4]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
push 1
push str.SoftwareAstaroth
push 0x80000001
mov ecx, dword [ebp - 0x4b4]
call fcn.00401610
mov dword [ebp - 0x4c8], eax
jmp 0x403225
mov dword [ebp - 0x4c8], 0
mov edx, dword [ebp - 0x4c8]
mov dword [ebp - 0x4f8], edx
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x4f8]
mov dword [ebp - 0x490], eax
cmp dword [ebp - 0x490], 0
je 0x4034c7
mov ecx, dword [ebp - 0x49c]
push ecx
push str.StoredData
mov ecx, dword [ebp - 0x490]
call fcn.00401880
mov edx, dword [ebp - 0x3cc]
push edx
push str.SpinLock
mov ecx, dword [ebp - 0x490]
call fcn.00401880
mov eax, dword [ebp - 0x1a4]
push eax
push str.Thread
mov ecx, dword [ebp - 0x490]
call fcn.00401880
push str._DBG__Instruction_writed_to_allocated_memory__n
call fcn.00402090
add esp, 4
mov ecx, dword [ebp - 0x3cc]
mov dword [ebp - 0x48c], ecx
mov byte [ebp - 0x20], 0xe9
mov byte [ebp - 0x1f], 0x90
mov byte [ebp - 0x1e], 0x90
mov byte [ebp - 0x1d], 0x90
mov byte [ebp - 0x1c], 0x90
mov edx, dword [ebp - 0x48c]
push edx
push str._DBG__Address_of_OEP_for_spinlock:_0x_X_n
call fcn.00402090
add esp, 8
mov eax, dword [ebp - 0x48c]
sub eax, dword [ebp - 0x48c]
sub eax, 5
mov dword [ebp - 0x12c], eax
mov ecx, 1
shl ecx, 0
mov edx, dword [ebp - 0x12c]
mov dword [ebp + ecx - 0x20], edx
mov dword [ebp - 0x128], 0
lea eax, [ebp - 0x128]
push eax
push 0x40
push 5
mov ecx, dword [ebp - 0x48c]
push ecx
mov edx, dword [ebp - 0x1b0]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov dword [ebp - 0x480], eax
cmp dword [ebp - 0x480], 0
jne 0x40335a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x41ef60
call fcn.00402090
add esp, 8
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push str._DBG__Writing_spinlock_shellcode_to_process..._n
call fcn.00402090
add esp, 4
lea eax, [ebp - 0x124]
push eax
push 5
lea ecx, [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x48c]
push edx
mov eax, dword [ebp - 0x1b0]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0x480], eax
cmp dword [ebp - 0x480], 0
je 0x4034b3
push str._SUCCESS__Spinlock_shellcode_successfully_placed__n
call fcn.00402090
add esp, 4
push pe_nt_image_headers32
push 0
lea ecx, [ebp - 0x120]
push ecx
call fcn.004052f0
add esp, 0xc
push pe_nt_image_headers32
lea edx, [ebp - 0x120]
push edx
call fcn.0040a2d9
add esp, 8
push 0
lea eax, [ebp - 0x120]
push eax
push str.HomeDir
mov ecx, dword [ebp - 0x490]
push ecx
call fcn.00401660
add esp, 0x10
lea edx, [ebp - 0x128]
push edx
mov eax, dword [ebp - 0x128]
push eax
push 5
mov ecx, dword [ebp - 0x48c]
push ecx
mov edx, dword [ebp - 0x1b0]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov dword [ebp - 0x480], eax
cmp dword [ebp - 0x480], 0
jne 0x403449
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._nError:_Unable_to_change_memory_access__Last_Error_Code:___d__n
call fcn.00402090
add esp, 8
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x528], esp
push str.AstarothAgent.dll
call fcn.004018e0
mov eax, dword [ebp - 0x1b0]
push eax
call fcn.004023d0
mov ecx, dword [ebp - 0x490]
mov dword [ebp - 0x4bc], ecx
cmp dword [ebp - 0x4bc], 0
je 0x403494
push 1
mov ecx, dword [ebp - 0x4bc]
call fcn.00403580
mov dword [ebp - 0x500], eax
jmp 0x40349e
mov dword [ebp - 0x500], 0
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._ERROR__2_Can_t_write_to_process_:__Last_Error_Code:__d_n
call fcn.00402090
add esp, 8
jmp 0x4034dd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._ERROR__1_Can_t_write_to_process_:__Last_Error_Code:__d_n
call fcn.00402090
add esp, 8
jmp 0x4034f3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._ERROR__Can_t_obtain_thread_context._Last_Error_Code:__d_n
call fcn.00402090
add esp, 8
mov edx, dword [ebp - 0x1ac]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1b0]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x403523
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._ERROR__Cannot_create_process_:__Last_Error_Code:__d_n
call fcn.00402090
add esp, 8
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x15c]
call fcn.004019b0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x144]
call fcn.004019b0
mov ecx, 1
test ecx, ecx
je 0x403557
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x403544
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00403ea8
mov esp, ebp
pop ebp
ret