Function at 0x401ca0
Capabilities:
Accept command line arguments
Allocate or change rwx memory
Create process on windows
Create thread
Get common file path
Inject thread
Resume thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
push esi
push edi
lea edi, [ebp - 0x190]
mov ecx, 0x64
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x41fa04]
xor eax, ebp
mov dword [ebp - 4], eax
mov esi, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
cmp esi, esp
call fcn.00404df0
mov dword [ebp - 8], 0
mov esi, esp
push 0x4083e0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp esi, esp
call fcn.00404df0
mov dword [ebp - 0xc], eax
xor ecx, ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
push 0x44
push 0
lea edx, [ebp - 0x74]
push edx
call sub.VCRUNTIME140D.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x9c]
call fcn.004031b0
lea ecx, [ebp - 0xc0]
call fcn.004031b0
lea ecx, [ebp - 0xe4]
call fcn.004031b0
lea ecx, [ebp - 0x108]
call fcn.004031b0
push 0
push 0x104
lea ecx, [ebp - 0x9c]
call fcn.00404aa0
push 0
lea ecx, [ebp - 0x9c]
call fcn.00403470
mov esi, esp
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
cmp esi, esp
call fcn.00404df0
mov dword [ebp - 0x110], eax
push 0
mov eax, dword [ebp - 0x110]
push eax
lea ecx, [ebp - 0x9c]
call fcn.00404aa0
push str._samp.dll
lea ecx, [ebp - 0x9c]
push ecx
lea edx, [ebp - 0x12c]
push edx
call fcn.00402440
add esp, 0xc
push eax
lea ecx, [ebp - 0xc0]
call fcn.004033d0
lea ecx, [ebp - 0x12c]
call fcn.00403340
push str.imrp.dll
lea eax, [ebp - 0x9c]
push eax
lea ecx, [ebp - 0x148]
push ecx
call fcn.00402440
add esp, 0xc
push eax
lea ecx, [ebp - 0x108]
call fcn.004033d0
lea ecx, [ebp - 0x148]
call fcn.00403340
push str.gta_sa.exe
lea edx, [ebp - 0x9c]
push edx
lea eax, [ebp - 0x164]
push eax
call fcn.00402440
add esp, 0xc
push eax
lea ecx, [ebp - 0xe4]
call fcn.004033d0
lea ecx, [ebp - 0x164]
call fcn.00403340
mov dword [ebp - 0x168], 0x14a00
cmp dword [ebp - 0xc], 0
je 0x40203a
mov esi, esp
push str.LoadLibraryW
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp esi, esp
call fcn.00404df0
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x402026
mov esi, esp
lea edx, [ebp - 0x28]
push edx
lea eax, [ebp - 0x74]
push eax
push 0
push 0
push 0xc
push 0
push 0
push 0
mov edi, esp
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
cmp edi, esp
call fcn.00404df0
push eax
lea ecx, [ebp - 0xe4]
call fcn.004047c0
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp esi, esp
call fcn.00404df0
test eax, eax
je 0x402012
mov esi, esp
push 0x40
push 0x3000
lea ecx, [ebp - 0xc0]
call fcn.004048c0
lea ecx, [eax + eax + 2]
push ecx
push 0
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
cmp esi, esp
call fcn.00404df0
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x401fb4
mov esi, esp
push 0
lea ecx, [ebp - 0xc0]
call fcn.004048c0
lea eax, [eax + eax + 2]
push eax
lea ecx, [ebp - 0xc0]
call fcn.004047c0
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp esi, esp
call fcn.00404df0
test eax, eax
je 0x401f82
mov esi, esp
push 0
push 4
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
push 0
push 0
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
cmp esi, esp
call fcn.00404df0
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0
je 0x401f6e
mov esi, esp
mov eax, dword [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp esi, esp
call fcn.00404df0
mov esi, esp
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x7c]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp esi, esp
call fcn.00404df0
jmp 0x401f80
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.00404df0
mov dword [ebp - 8], eax
jmp 0x401f94
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.00404df0
mov dword [ebp - 8], eax
mov esi, esp
push 0x8000
push 0
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
cmp esi, esp
call fcn.00404df0
jmp 0x401fc6
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.00404df0
mov dword [ebp - 8], eax
push 0
push 1
push 1
push 1
push 1
push 1
mov ecx, dword [ebp - 0x168]
push ecx
push section..data
mov edx, dword [ebp - 0x28]
push edx
call section..text
add esp, 0x24
mov esi, esp
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp esi, esp
call fcn.00404df0
mov esi, esp
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.00404df0
jmp 0x402024
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.00404df0
mov dword [ebp - 8], eax
jmp 0x402038
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.00404df0
mov dword [ebp - 8], eax
jmp 0x40204c
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.00404df0
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x402094
mov edx, dword [ebp - 8]
push edx
lea eax, [ebp - 0x188]
push eax
call fcn.004021b0
add esp, 8
mov esi, esp
push 0x10
push str.Error
lea ecx, [ebp - 0x188]
call fcn.004047c0
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp esi, esp
call fcn.00404df0
lea ecx, [ebp - 0x188]
call fcn.00403340
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x190], ecx
lea ecx, [ebp - 0x108]
call fcn.00403340
lea ecx, [ebp - 0xe4]
call fcn.00403340
lea ecx, [ebp - 0xc0]
call fcn.00403340
lea ecx, [ebp - 0x9c]
call fcn.00403340
mov eax, dword [ebp - 0x190]
push edx
mov ecx, ebp
push eax
lea edx, [0x402100]
call fcn.00404d80
pop eax
pop edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404f10
add esp, 0x190
cmp ebp, esp
call fcn.00404df0
mov esp, ebp
pop ebp
ret 0x10