Function at 0x4147f0
Capabilities:
Create process on windows
Set file attributes

Disassembly:
sub esp, 0x264
push ebx
push ebp
push esi
mov esi, dword [esp + 0x274]
push edi
push esi
mov ebx, 1
push str.entra_instal_oper__d
push ebx
call fcn.0040c720
add esp, 0xc
mov dword [0x42fde8], ebx
test esi, esi
je 0x414834
mov ebp, str.C:WINDOWSLEVTEMP
lea eax, [esp + 0x148]
push ebp
push str._s_files.dat
push eax
jmp 0x414847
mov ebp, 0x42f8d8
lea ecx, [esp + 0x148]
push ebp
push str._s_files.dat
push ecx
call fcn.00416129
add esp, 0xc
lea edx, [esp + 0x148]
push edx
push str.abrira__s
push ebx
call fcn.0040c720
lea eax, [esp + 0x154]
push 0x428954
push eax
call fcn.004163dc
push 0x42f8d8
lea ecx, [esp + 0x160]
mov edi, eax
push str._sconfig.txt
push ecx
mov dword [esp + 0x38], edi
call fcn.00416129
add esp, 0x20
test edi, edi
je 0x415088
lea edx, [esp + 0x148]
push edx
call fcn.00410570
add esp, 4
test eax, eax
je 0x41507f
push str.C:WINDOWSLEVTEMP
call fcn.004103a0
push 0x42f470
mov dword [0x42fde8], ebx
mov dword [0x430ab4], 0
call fcn.00410fa0
add esp, 8
test esi, esi
je 0x414976
mov edi, str.inst2.dax
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x1c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c]
push ecx
push ebp
push 0x4287f4
push 0x42fe34
call fcn.00416129
lea edx, [esp + 0x2c]
push edx
push 0x42f470
push 0x4287f4
push 0x430068
call fcn.00416129
push 0x42fe34
call fcn.00410570
add esp, 0x24
test eax, eax
je 0x414966
push str.copiara_dax2
push 2
call fcn.0040c720
push 0x430068
push 0x42fe34
call fcn.00410920
add esp, 0x10
push 0x80
push 0x430068
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov edi, str.config.txt
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x1c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c]
push ecx
push ebp
push 0x4287f4
push 0x42fe34
call fcn.00416129
lea edx, [esp + 0x2c]
push edx
push 0x42f470
push 0x4287f4
push 0x430068
call fcn.00416129
push 0x430068
push 0x42fe34
call fcn.00410920
call fcn.00411770
push 0x42f470
mov dword [esp + 0x3c], eax
call fcn.004103a0
mov edi, str.version.dat
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x48]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x48]
push ecx
push ebp
push 0x4287f4
push 0x42fe34
call fcn.00416129
lea edx, [esp + 0x58]
push edx
push 0x42f470
push 0x4287f4
push 0x430068
call fcn.00416129
add esp, 0x4c
push 0x430068
push 0x42fe34
call fcn.00410920
mov edi, str.files.dat
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x24]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x24]
push ecx
push ebp
push 0x4287f4
push 0x42fe34
call fcn.00416129
lea edx, [esp + 0x34]
push edx
push 0x42f470
push 0x4287f4
push 0x430068
call fcn.00416129
push 0x430068
push 0x42fe34
call fcn.00410920
push str.copio_3
push ebx
call fcn.0040c720
push 0x429438
call fcn.0040d360
push 0x429438
push str.wp_s
push ebx
call fcn.0040c720
add esp, 0x48
push 0x429438
push str._s_sleepy.exe__kill
push 0x42fe34
call fcn.00416129
push 0x42fe34
push str.Ejecutara__s
push ebx
call fcn.0040c720
mov ebx, dword [sym.imp.KERNEL32.dll_WinExec]
add esp, 0x18
push 5
push 0x42fe34
call ebx
push 0x429438
push str._s_sleepy3.exe__kill
push 0x42fe34
call fcn.00416129
push 0x42fe34
push str.Ejecutara__s
push 1
call fcn.0040c720
add esp, 0x18
push 5
push 0x42fe34
call ebx
push 0x429438
push str._sWinide.exe__kill
push 0x42fe34
call fcn.00416129
push 0x42fe34
push str.Ejecutara__s
push 1
call fcn.0040c720
add esp, 0x18
push 5
push 0x42fe34
call ebx
push 0x429438
push str._shelp.exe__kill
push 0x42fe34
call fcn.00416129
push 0x42fe34
push str.Ejecutara__s
push 1
call fcn.0040c720
add esp, 0x18
push 5
push 0x42fe34
call ebx
push 0x429438
push str._sicodisc.exe__kill
push 0x42fe34
call fcn.00416129
push 0x42fe34
push str.Ejecutara__s
push 1
call fcn.0040c720
add esp, 0x18
push 5
push 0x42fe34
call ebx
push 0x429438
push str._sPrChk.exe__kill
push 0x42fe34
call fcn.00416129
add esp, 0xc
push 5
push 0x42fe34
call ebx
push 0x429438
push str._sNMGMT.exe__kill
push 0x42fe34
call fcn.00416129
push 0x42fe34
push str.Ejecutara__s
push 1
call fcn.0040c720
add esp, 0x18
push 5
push 0x42fe34
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x1388
call esi
push 0x429438
push str._shelp.exe__kill
push 0x42fe34
call fcn.00416129
push 0x42fe34
push str.Ejecutara__s
push 1
call fcn.0040c720
add esp, 0x18
push 5
push 0x42fe34
call ebx
push 0x429438
push str._sicodisc.exe__kill
push 0x42fe34
call fcn.00416129
push 0x42fe34
push str.Ejecutara__s
push 1
call fcn.0040c720
add esp, 0x18
push 5
push 0x42fe34
call ebx
push 0x1388
call esi
push 0x429438
push str._shear_usr.exe__kill
push 0x42fe34
call fcn.00416129
push 0x42fe34
push str.Ejecutara__s
push 1
call fcn.0040c720
add esp, 0x18
push 5
push 0x42fe34
call ebx
push 0x1388
call esi
mov eax, dword [0x43079c]
test eax, eax
je 0x414d10
push 0x429438
push str._scclient.exe__kill
push 0x42fe34
call fcn.00416129
push 0x42fe34
push str.Ejecutara__s
push 1
call fcn.0040c720
add esp, 0x18
push 5
push 0x42fe34
call ebx
mov eax, dword [0x4307a0]
test eax, eax
je 0x414d4a
push 0x429438
push str._shear_usr.exe__kill
push 0x42fe34
call fcn.00416129
push 0x42fe34
push str.Ejecutara__s
push 1
call fcn.0040c720
add esp, 0x18
push 5
push 0x42fe34
call ebx
push ebp
lea eax, [esp + 0x14c]
push str._s_version.dat
push eax
call fcn.00416129
lea ecx, [esp + 0x154]
push ecx
call fcn.00410e10
mov dword [esp + 0x24], eax
mov edi, str.config.txt
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x2c]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x2c]
push ecx
push ebp
push 0x4287f4
push 0x42fe34
call fcn.00416129
lea edx, [esp + 0x3c]
push edx
push 0x42f470
push 0x4287f4
push 0x430068
call fcn.00416129
push 0x430068
push 0x42fe34
call fcn.00410920
mov esi, dword [esp + 0x50]
lea eax, [esp + 0x54]
push esi
push 0x5a
push eax
call fcn.00416798
add esp, 0x44
test eax, eax
je 0x414fc7
lea ecx, [esp + 0x1c]
push ecx
call fcn.004110e0
mov al, byte [esp + 0x20]
add esp, 4
test al, al
je 0x414faf
lea edx, [esp + 0x1c]
push str.cclient.exe
push edx
call fcn.0041f970
add esp, 8
test eax, eax
je 0x414faf
lea eax, [esp + 0x1c]
push str.nclient.exe
push eax
call fcn.0041f970
add esp, 8
test eax, eax
je 0x414faf
lea ecx, [esp + 0x1c]
push 0x42b094
push ecx
call fcn.0041f970
add esp, 8
test eax, eax
je 0x414faf
lea edx, [esp + 0x1c]
push str.nicand.exe
push edx
call fcn.0041f970
add esp, 8
test eax, eax
je 0x414faf
lea eax, [esp + 0x1c]
push str.help.exe
push eax
call fcn.0041f970
add esp, 8
test eax, eax
je 0x414faf
lea ecx, [esp + 0x1c]
push str.sleepy3.exe
push ecx
call fcn.0041f970
add esp, 8
test eax, eax
je 0x414faf
lea edx, [esp + 0x1c]
push str.recorder.exe
push edx
call fcn.0041f970
add esp, 8
test eax, eax
je 0x414faf
lea eax, [esp + 0x1c]
push str.winide.exe
push eax
call fcn.0041f970
add esp, 8
test eax, eax
je 0x414faf
lea ecx, [esp + 0x1c]
push str.process.exe
push ecx
call fcn.0041f970
add esp, 8
test eax, eax
je 0x414faf
lea edx, [esp + 0x1c]
push str.nmgmt.exe
push edx
call fcn.0041f970
add esp, 8
test eax, eax
je 0x414faf
lea eax, [esp + 0x1c]
push str.prchk.exe
push eax
call fcn.0041f970
add esp, 8
test eax, eax
je 0x414faf
lea ecx, [esp + 0x1c]
push str.hear_usr.exe
push ecx
call fcn.0041f970
add esp, 8
test eax, eax
je 0x414faf
lea edx, [esp + 0x1c]
push str.icodisc.exe
push edx
call fcn.0041f970
add esp, 8
test eax, eax
je 0x414faf
lea eax, [esp + 0x1c]
push eax
push 0x42f8d8
push 0x4287f4
push 0x42fe34
call fcn.00416129
lea ecx, [esp + 0x2c]
push ecx
push 0x42f470
push 0x4287f4
push 0x430068
call fcn.00416129
mov edx, dword [esp + 0x34]
push edx
push 0x430068
push 0x42fe34
call fcn.004104c0
add esp, 0x2c
test eax, eax
je 0x414faf
push 0x430068
push 0x42fe34
call fcn.00410920
add esp, 8
push esi
lea eax, [esp + 0x20]
push 0x5a
push eax
call fcn.00416798
add esp, 0xc
test eax, eax
jne 0x414ded
push esi
call fcn.0041627e
mov eax, dword [esp + 0x14]
add esp, 4
test eax, eax
je 0x41502d
mov eax, dword [0x42fde8]
test eax, eax
je 0x414ff0
call fcn.00413b10
push 0
call fcn.004143b0
add esp, 4
push 0x429438
call fcn.0040d360
push 0x429438
lea ecx, [esp + 0x24]
push str._sSoloDisc.exe__end
push ecx
call fcn.00416129
lea edx, [esp + 0x2c]
push edx
push str.ejecutara__s
push 1
call fcn.0040c720
add esp, 0x1c
lea eax, [esp + 0x1c]
push 5
push eax
call ebx
jmp 0x415061
push 0x429438
lea ecx, [esp + 0x20]
push str._sNumInst.dat
push ecx
call fcn.00416129
add esp, 0xc
lea edx, [esp + 0x1c]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [esp + 0x1c]
push eax
call fcn.004105c0
add esp, 4
push 0x42a24c
push str.C:WINDOWSLEVTEMP
call fcn.00410600
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.00410f40
add esp, 0xc
jmp 0x4150a2
push edi
call fcn.0041627e
add esp, 4
test esi, esi
jne 0x4150ed
call fcn.00412900
test eax, eax
mov dword [esp + 0x10], eax
jne 0x4150aa
call fcn.00412900
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4150ba
mov eax, dword [0x42fde8]
test eax, eax
je 0x4150ba
mov eax, 1
jmp 0x4150bc
xor eax, eax
push eax
push str.Aretornara__d
push 1
call fcn.0040c720
mov eax, dword [esp + 0x1c]
add esp, 0xc
test eax, eax
je 0x4150ed
mov eax, dword [0x42fde8]
test eax, eax
je 0x4150ed
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x264
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x264
ret