Function at 0x408dc0
Capabilities:
Accept command line arguments
Allocate or change rwx memory
Create process on windows
Create thread
Get common file path
Inject thread
Resume thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x438064]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov dword [ebp - 0xc8], 0
push 0x4281f8
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0xd8], eax
xor ecx, ecx
mov dword [ebp - 0xec], ecx
mov dword [ebp - 0xe8], ecx
mov dword [ebp - 0xe4], ecx
mov dword [ebp - 0xe0], ecx
push 0x44
push 0
lea edx, [ebp - 0x22c]
push edx
call fcn.0040b6c0
add esp, 0xc
lea ecx, [ebp - 0x1c]
call fcn.00402ee0
lea ecx, [ebp - 0x34]
call fcn.00402ee0
lea ecx, [ebp - 0x64]
call fcn.00402ee0
lea ecx, [ebp - 0x4c]
call fcn.00402ee0
push 0
push 0x104
lea ecx, [ebp - 0x1c]
call fcn.00407cd0
push 0
lea ecx, [ebp - 0x1c]
call fcn.00404160
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov dword [ebp - 0xf0], eax
push 0
mov eax, dword [ebp - 0xf0]
push eax
lea ecx, [ebp - 0x1c]
call fcn.00407cd0
push str._samp.dll
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x94]
push edx
call fcn.00401a30
add esp, 0xc
push eax
lea ecx, [ebp - 0x34]
call fcn.00404040
lea ecx, [ebp - 0x94]
call fcn.00403ba0
push str.imrp.dll
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0xac]
push ecx
call fcn.00401a30
add esp, 0xc
push eax
lea ecx, [ebp - 0x4c]
call fcn.00404040
lea ecx, [ebp - 0xac]
call fcn.00403ba0
push str.gta_sa.exe
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0xc4]
push eax
call fcn.00401a30
add esp, 0xc
push eax
lea ecx, [ebp - 0x64]
call fcn.00404040
lea ecx, [ebp - 0xc4]
call fcn.00403ba0
cmp dword [ebp - 0xd8], 0
je 0x4093ce
push str.LoadLibraryW
mov ecx, dword [ebp - 0xd8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 0
je 0x4093c0
lea edx, [ebp - 0xec]
push edx
lea eax, [ebp - 0x22c]
push eax
push 0
push 0
push 0xc
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0x64]
call fcn.00406680
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4093b2
push 0x40
push 0x3000
lea ecx, [ebp - 0x34]
call fcn.004071f0
lea ecx, [eax + eax + 2]
push ecx
push 0
mov edx, dword [ebp - 0xec]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0
je 0x40905c
push 0
lea ecx, [ebp - 0x34]
call fcn.004071f0
lea eax, [eax + eax + 2]
push eax
lea ecx, [ebp - 0x34]
call fcn.00406680
push eax
mov ecx, dword [ebp - 0xd0]
push ecx
mov edx, dword [ebp - 0xec]
push edx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x409033
push 0
push 4
mov eax, dword [ebp - 0xd0]
push eax
mov ecx, dword [ebp - 0xdc]
push ecx
push 0
push 0
mov edx, dword [ebp - 0xec]
push edx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0
je 0x409025
mov eax, dword [ebp - 0xd4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0xffffffffffffffff
mov ecx, dword [ebp - 0xd4]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x409031
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc8], eax
jmp 0x40903f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc8], eax
push 0x8000
push 0
mov edx, dword [ebp - 0xd0]
push edx
mov eax, dword [ebp - 0xec]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
jmp 0x409068
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc8], eax
push 1
push 0x40
push 0x24
lea ecx, [ebp - 0x4c]
push ecx
lea ecx, [ebp - 0x1e8]
call fcn.00402980
mov edx, dword [ebp - 0x1e8]
mov eax, dword [edx + 4]
lea ecx, [ebp + eax - 0x1e8]
call fcn.00406e10
movzx ecx, al
test ecx, ecx
je 0x40912c
push 0x10
push 0x428264
push str.failed1
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov edx, dword [ebp - 0x1e8]
mov eax, dword [edx + 4]
lea ecx, [ebp + eax - 0x1e8]
call fcn.00407a80
push eax
push str.Opening_the_file_failed:__X_n
call fcn.004094a0
add esp, 8
lea ecx, [ebp - 0x1e8]
call fcn.004068a0
push 0x4282a0
call fcn.0040f550
add esp, 4
mov dword [ebp - 0xf4], 0xfffffffb
lea ecx, [ebp - 0x1e8]
call fcn.00404510
lea ecx, [ebp - 0x4c]
call fcn.00403ba0
lea ecx, [ebp - 0x64]
call fcn.00403ba0
lea ecx, [ebp - 0x34]
call fcn.00403ba0
lea ecx, [ebp - 0x1c]
call fcn.00403ba0
mov eax, dword [ebp - 0xf4]
jmp 0x409448
lea ecx, [ebp - 0x130]
push ecx
lea ecx, [ebp - 0x1e8]
call fcn.00408370
lea ecx, [ebp - 0x130]
call fcn.00404190
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x114], edx
cmp dword [ebp - 0x114], 0
jg 0x4091e9
jl 0x409170
cmp dword [ebp - 0x118], 0x1000
jae 0x4091e9
push 0x10
push 0x4282a8
push str.failed2
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push str.Filesize_invalid._n
call fcn.004094a0
add esp, 4
lea ecx, [ebp - 0x1e8]
call fcn.004068a0
push 0x4282d8
call fcn.0040f550
add esp, 4
mov dword [ebp - 0xf8], 0xfffffffa
lea ecx, [ebp - 0x1e8]
call fcn.00404510
lea ecx, [ebp - 0x4c]
call fcn.00403ba0
lea ecx, [ebp - 0x64]
call fcn.00403ba0
lea ecx, [ebp - 0x34]
call fcn.00403ba0
lea ecx, [ebp - 0x1c]
call fcn.00403ba0
mov eax, dword [ebp - 0xf8]
jmp 0x409448
lea ecx, [ebp - 0x130]
call fcn.00404190
push eax
call fcn.0040a83d
add esp, 4
mov dword [ebp - 0xfc], eax
mov edx, dword [ebp - 0xfc]
mov dword [ebp - 0xcc], edx
cmp dword [ebp - 0xcc], 0
jne 0x409291
push 0x10
push 0x4282e0
push str.failed3
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push str.Cant_allocate_dll_file._n
call fcn.004094a0
add esp, 4
lea ecx, [ebp - 0x1e8]
call fcn.004068a0
push str.PAUSE
call fcn.0040f550
add esp, 4
mov dword [ebp - 0x100], 0xfffffff9
lea ecx, [ebp - 0x1e8]
call fcn.00404510
lea ecx, [ebp - 0x4c]
call fcn.00403ba0
lea ecx, [ebp - 0x64]
call fcn.00403ba0
lea ecx, [ebp - 0x34]
call fcn.00403ba0
lea ecx, [ebp - 0x1c]
call fcn.00403ba0
mov eax, dword [ebp - 0x100]
jmp 0x409448
push 0
push 0
push 0
lea ecx, [ebp - 0x1e8]
call fcn.00407d80
lea ecx, [ebp - 0x130]
call fcn.00404190
push edx
push eax
mov eax, dword [ebp - 0xcc]
push eax
lea ecx, [ebp - 0x1e8]
call fcn.00407aa0
lea ecx, [ebp - 0x1e8]
call fcn.004068a0
push 0
push 1
push 1
push 1
push 1
push 1
lea ecx, [ebp - 0x130]
call fcn.00404190
push eax
mov ecx, dword [ebp - 0xcc]
push ecx
mov edx, dword [ebp - 0xec]
push edx
call fcn.00401070
add esp, 0x24
movzx eax, al
test eax, eax
jne 0x409370
mov ecx, dword [ebp - 0xcc]
mov dword [ebp - 0x104], ecx
mov edx, dword [ebp - 0x104]
push edx
call fcn.0040a846
add esp, 4
push 0x10
push 0x428320
push str.failed
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov dword [ebp - 0x108], 0xfffffff8
lea ecx, [ebp - 0x1e8]
call fcn.00404510
lea ecx, [ebp - 0x4c]
call fcn.00403ba0
lea ecx, [ebp - 0x64]
call fcn.00403ba0
lea ecx, [ebp - 0x34]
call fcn.00403ba0
lea ecx, [ebp - 0x1c]
call fcn.00403ba0
mov eax, dword [ebp - 0x108]
jmp 0x409448
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x10c], eax
mov ecx, dword [ebp - 0x10c]
push ecx
call fcn.0040a846
add esp, 4
mov edx, dword [ebp - 0xe8]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [ebp - 0xec]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x1e8]
call fcn.00404510
jmp 0x4093be
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc8], eax
jmp 0x4093cc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc8], eax
jmp 0x4093da
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 0
je 0x409416
mov ecx, dword [ebp - 0xc8]
push ecx
lea edx, [ebp - 0x7c]
push edx
call fcn.00404960
add esp, 8
push 0x10
push str.Error
lea ecx, [ebp - 0x7c]
call fcn.00406680
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [ebp - 0x7c]
call fcn.00403ba0
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0x110], eax
lea ecx, [ebp - 0x4c]
call fcn.00403ba0
lea ecx, [ebp - 0x64]
call fcn.00403ba0
lea ecx, [ebp - 0x34]
call fcn.00403ba0
lea ecx, [ebp - 0x1c]
call fcn.00403ba0
mov eax, dword [ebp - 0x110]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a84b
mov esp, ebp
pop ebp
ret 0x10