Function at 0x401e20
Capabilities:
Accept command line arguments
Allocate or change rwx memory
Create process on windows
Create thread
Get common file path
Inject thread
Resume thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
push esi
push edi
lea edi, [ebp - 0x190]
mov ecx, 0x64
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x40da04]
xor eax, ebp
mov dword [ebp - 4], eax
mov esi, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
cmp esi, esp
call fcn.00404f70
mov dword [ebp - 8], 0
mov esi, esp
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp esi, esp
call fcn.00404f70
mov dword [ebp - 0xc], eax
xor ecx, ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
push 0x44
push 0
lea edx, [ebp - 0x74]
push edx
call sub.VCRUNTIME140D.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x9c]
call fcn.00403300
lea ecx, [ebp - 0xc0]
call fcn.00403300
lea ecx, [ebp - 0xe4]
call fcn.00403300
lea ecx, [ebp - 0x108]
call fcn.00403300
push 0
push 0x104
lea ecx, [ebp - 0x9c]
call fcn.00404c20
push 0
lea ecx, [ebp - 0x9c]
call fcn.004035c0
mov esi, esp
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
cmp esi, esp
call fcn.00404f70
mov dword [ebp - 0x110], eax
push 0
mov eax, dword [ebp - 0x110]
push eax
lea ecx, [ebp - 0x9c]
call fcn.00404c20
push str._samp.dll
lea ecx, [ebp - 0x9c]
push ecx
lea edx, [ebp - 0x12c]
push edx
call fcn.00402590
add esp, 0xc
push eax
lea ecx, [ebp - 0xc0]
call fcn.00403520
lea ecx, [ebp - 0x12c]
call fcn.00403490
push str.imrp.dll
lea eax, [ebp - 0x9c]
push eax
lea ecx, [ebp - 0x148]
push ecx
call fcn.00402590
add esp, 0xc
push eax
lea ecx, [ebp - 0x108]
call fcn.00403520
lea ecx, [ebp - 0x148]
call fcn.00403490
push str.gta_sa.exe
lea edx, [ebp - 0x9c]
push edx
lea eax, [ebp - 0x164]
push eax
call fcn.00402590
add esp, 0xc
push eax
lea ecx, [ebp - 0xe4]
call fcn.00403520
lea ecx, [ebp - 0x164]
call fcn.00403490
mov dword [ebp - 0x168], 0x2a00
cmp dword [ebp - 0xc], 0
je 0x402196
mov esi, esp
push str.LoadLibraryW
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp esi, esp
call fcn.00404f70
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x402182
mov esi, esp
lea edx, [ebp - 0x28]
push edx
lea eax, [ebp - 0x74]
push eax
push 0
push 0
push 0xc
push 0
push 0
push 0
mov edi, esp
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
cmp edi, esp
call fcn.00404f70
push eax
lea ecx, [ebp - 0xe4]
call fcn.00404920
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp esi, esp
call fcn.00404f70
test eax, eax
je 0x40216e
mov esi, esp
push 0x40
push 0x3000
lea ecx, [ebp - 0xc0]
call fcn.00404a40
lea ecx, [eax + eax + 2]
push ecx
push 0
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
cmp esi, esp
call fcn.00404f70
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x402134
mov esi, esp
push 0
lea ecx, [ebp - 0xc0]
call fcn.00404a40
lea eax, [eax + eax + 2]
push eax
lea ecx, [ebp - 0xc0]
call fcn.00404920
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp esi, esp
call fcn.00404f70
test eax, eax
je 0x402102
mov esi, esp
push 0
push 4
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
push 0
push 0
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
cmp esi, esp
call fcn.00404f70
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0
je 0x4020ee
mov esi, esp
mov eax, dword [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp esi, esp
call fcn.00404f70
mov esi, esp
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x7c]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp esi, esp
call fcn.00404f70
jmp 0x402100
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.00404f70
mov dword [ebp - 8], eax
jmp 0x402114
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.00404f70
mov dword [ebp - 8], eax
mov esi, esp
push 0x8000
push 0
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
cmp esi, esp
call fcn.00404f70
jmp 0x402146
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.00404f70
mov dword [ebp - 8], eax
mov esi, esp
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp esi, esp
call fcn.00404f70
mov esi, esp
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.00404f70
jmp 0x402180
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.00404f70
mov dword [ebp - 8], eax
jmp 0x402194
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.00404f70
mov dword [ebp - 8], eax
jmp 0x4021a8
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.00404f70
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4021f0
mov eax, dword [ebp - 8]
push eax
lea ecx, [ebp - 0x188]
push ecx
call fcn.00402300
add esp, 8
mov esi, esp
push 0x10
push str.Error
lea ecx, [ebp - 0x188]
call fcn.00404920
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp esi, esp
call fcn.00404f70
lea ecx, [ebp - 0x188]
call fcn.00403490
mov edx, dword [ebp - 8]
mov dword [ebp - 0x190], edx
lea ecx, [ebp - 0x108]
call fcn.00403490
lea ecx, [ebp - 0xe4]
call fcn.00403490
lea ecx, [ebp - 0xc0]
call fcn.00403490
lea ecx, [ebp - 0x9c]
call fcn.00403490
mov eax, dword [ebp - 0x190]
push edx
mov ecx, ebp
push eax
lea edx, [0x40225c]
call fcn.00404f00
pop eax
pop edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405090
add esp, 0x190
cmp ebp, esp
call fcn.00404f70
mov esp, ebp
pop ebp
ret 0x10