Function at 0x417690
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x2c0
lea eax, [esp + 0x130]
push ebx
push ebp
push eax
push str.COUNTSOFT
call fcn.00413020
mov ebp, dword [sym.imp.KERNEL32.dll_WinExec]
add esp, 8
test eax, eax
jle 0x4176d7
push 0x42c4e0
lea ecx, [esp + 0x10]
push str._sWinide.exe
push ecx
call fcn.00418db9
add esp, 0xc
lea edx, [esp + 0xc]
push 0
push edx
call ebp
lea eax, [esp + 0x138]
push eax
push str.COUNTNET
call fcn.00413020
add esp, 8
test eax, eax
jle 0x417721
push 0x42c4e0
lea ecx, [esp + 0x10]
push str._sNMGMT.exe
push ecx
call fcn.00418db9
lea edx, [esp + 0x18]
push edx
push str.ejecutara__s
push 1
call fcn.0040d050
add esp, 0x18
lea eax, [esp + 0xc]
push 0
push eax
call ebp
lea ecx, [esp + 0x138]
push ecx
push str.HELPDESK
call fcn.00413020
add esp, 8
test eax, eax
jle 0x41775a
push 0x42c4e0
lea edx, [esp + 0x10]
push str._shelp.exe
push edx
call fcn.00418db9
add esp, 0xc
lea eax, [esp + 0xc]
push 0
push eax
call ebp
lea ecx, [esp + 0x138]
push ecx
push str.ICONDISC
call fcn.00413020
add esp, 8
test eax, eax
jle 0x417793
push 0x42c4e0
lea edx, [esp + 0x10]
push str._sicodisc.exe
push edx
call fcn.00418db9
add esp, 0xc
lea eax, [esp + 0xc]
push 0
push eax
call ebp
lea ecx, [esp + 0x138]
push ecx
push str.REMOTSERV
call fcn.00413020
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 8
test eax, eax
jle 0x4177d9
push 0x42c4e0
lea edx, [esp + 0x10]
push str._scclient.exe__install
push edx
call fcn.00418db9
add esp, 0xc
lea eax, [esp + 0xc]
push 0
push eax
call ebp
push 0x7d0
call ebx
lea ecx, [esp + 0x138]
push 0x5a
push ecx
push str.REMOT
call fcn.0040dea0
add esp, 0xc
test eax, eax
jle 0x417863
call fcn.0040ce10
test eax, eax
jne 0x417832
call fcn.0040cd90
test eax, eax
jne 0x417832
push str.no_es_56
push 2
call fcn.0040d050
push 0x42c4e0
lea edx, [esp + 0x18]
push str._scclient.exe__no_per
push edx
call fcn.00418db9
add esp, 0x14
lea eax, [esp + 0xc]
push 0
push eax
jmp 0x417861
push str.es_56
push 2
call fcn.0040d050
add esp, 8
push 0x2328
call ebx
lea ecx, [esp + 0xc]
push str.NET_START_CHEAR
push ecx
call fcn.00418db9
add esp, 8
lea edx, [esp + 0xc]
push 0
push edx
call ebp
push esi
lea eax, [esp + 0x10]
push str.NET_START_SLEEPYN1
push eax
call fcn.00418db9
add esp, 8
lea ecx, [esp + 0x10]
push 0
push ecx
call ebp
push 0x7d0
call ebx
push 0x42c4e0
lea edx, [esp + 0x14]
push str._s_sleepy3.exe
push edx
call fcn.00418db9
add esp, 0xc
lea eax, [esp + 0x10]
push 0
push eax
call ebp
push 0x42c4e0
lea ecx, [esp + 0x14]
push str._sconfig.txt
push ecx
call fcn.00418db9
lea edx, [esp + 0x1c]
push 0x42b9c8
push edx
call fcn.0041906c
mov esi, eax
add esp, 0x14
test esi, esi
mov dword [esp + 0xc], esi
je 0x4179e2
push esi
lea eax, [esp + 0x14]
push 0x122
push eax
call fcn.00419458
add esp, 0xc
test eax, eax
je 0x4179d9
push edi
mov edi, str.EXEC
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
lea ecx, [esp + 0x18]
push str.EXEC
push ecx
call fcn.0041daf0
add esp, 0xc
test eax, eax
jne 0x4179bd
mov edi, str.EXEC
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp byte [esp + ecx + 0x14], 0x3d
jne 0x4179bd
mov edi, str.EXEC
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x1a4]
lea edx, [esp + ecx + 0x15]
push edx
push eax
call fcn.00412bf0
mov al, byte [esp + 0x1ac]
add esp, 8
cmp al, 0x7e
jne 0x417988
lea ecx, [esp + 0x1a5]
lea edx, [esp + 0x14]
push ecx
push 0x42c4e0
push str._s_s
push edx
call fcn.00418db9
add esp, 0x10
jmp 0x4179b4
lea edi, [esp + 0x1a4]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x14]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push 5
push ecx
call ebp
push esi
lea edx, [esp + 0x18]
push 0x122
push edx
call fcn.00419458
add esp, 0xc
test eax, eax
jne 0x4178f6
pop edi
push esi
call fcn.00418f0e
add esp, 4
push 0x42c4e0
lea eax, [esp + 0x14]
push str._squmov.exe__normal
push eax
call fcn.00418db9
lea ecx, [esp + 0x1c]
push ecx
push str.ejecutara__s
push 1
call fcn.0040d050
add esp, 0x18
lea edx, [esp + 0x10]
push 5
push edx
call ebp
push 0x7d0
call ebx
lea eax, [esp + 0x13c]
push eax
push str.COUNTSOFT
call fcn.00413020
add esp, 8
test eax, eax
pop esi
jle 0x417a5b
push 0x2710
call ebx
push 0x42c4e0
lea ecx, [esp + 0x10]
push str._sWinide.exe
push ecx
call fcn.00418db9
add esp, 0xc
lea edx, [esp + 0xc]
push 0
push edx
call ebp
push 0x42c4e0
lea eax, [esp + 0x10]
push str._shear_usr.exe
push eax
call fcn.00418db9
lea ecx, [esp + 0x18]
push ecx
push str.ejecutara__s
push 1
call fcn.0040d050
add esp, 0x18
lea edx, [esp + 0xc]
push 5
push edx
call ebp
push 0x7d0
call ebx
pop ebp
pop ebx
add esp, 0x2c0
ret