Function at 0x416c20
Capabilities:
Create process on windows
Set file attributes

Disassembly:
sub esp, 0x4bc
push ebx
push ebp
push esi
mov esi, dword [esp + 0x4cc]
push edi
push esi
mov ebx, 1
push str.entra_instal_oper__d
push ebx
call fcn.0040d050
add esp, 0xc
mov dword [0x433b30], ebx
test esi, esi
je 0x416c64
mov ebp, str.C:WINDOWSLEVTEMP
lea eax, [esp + 0x148]
push ebp
push str._s_files.dat
push eax
jmp 0x416c77
mov ebp, 0x433620
lea ecx, [esp + 0x148]
push ebp
push str._s_files.dat
push ecx
call fcn.00418db9
add esp, 0xc
lea edx, [esp + 0x148]
push edx
push str.abrira__s
push ebx
call fcn.0040d050
lea eax, [esp + 0x154]
push 0x42b9c8
push eax
call fcn.0041906c
push 0x433620
lea ecx, [esp + 0x160]
mov edi, eax
push str._sconfig.txt
push ecx
mov dword [esp + 0x38], edi
call fcn.00418db9
add esp, 0x20
test edi, edi
je 0x4175d6
lea edx, [esp + 0x148]
push edx
call fcn.00411f30
add esp, 4
test eax, eax
je 0x4175cd
push str.C:WINDOWSLEVTEMP
call fcn.00411cb0
push 0x4331b8
mov dword [0x433b30], ebx
mov dword [0x43480c], 0
call fcn.00412b10
add esp, 8
test esi, esi
je 0x416da6
mov edi, str.inst2.dax
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x1c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c]
push ecx
push ebp
push 0x42b858
push 0x433b7c
call fcn.00418db9
lea edx, [esp + 0x2c]
push edx
push 0x4331b8
push 0x42b858
push 0x433db0
call fcn.00418db9
push 0x433b7c
call fcn.00411f30
add esp, 0x24
test eax, eax
je 0x416d96
push str.copiara_dax2
push 2
call fcn.0040d050
push 0x433db0
push 0x433b7c
call fcn.00412320
add esp, 0x10
push 0x80
push 0x433db0
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov edi, str.config.txt
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x1c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c]
push ecx
push ebp
push 0x42b858
push 0x433b7c
call fcn.00418db9
lea edx, [esp + 0x2c]
push edx
push 0x4331b8
push 0x42b858
push 0x433db0
call fcn.00418db9
push 0x433db0
push 0x433b7c
call fcn.00412320
call fcn.004133b0
push eax
push str.rvll_d
push 2
mov dword [esp + 0x44], eax
call fcn.0040d050
push 0x4331b8
call fcn.00411cb0
mov edi, str.version.dat
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x54]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x54]
push ecx
push ebp
push 0x42b858
push 0x433b7c
call fcn.00418db9
add esp, 0x48
lea edx, [esp + 0x1c]
push edx
push 0x4331b8
push 0x42b858
push 0x433db0
call fcn.00418db9
push 0x433db0
push 0x433b7c
call fcn.00412320
mov edi, str.versionB.dat
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x34]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x34]
push ecx
push ebp
push 0x42b858
push 0x433b7c
call fcn.00418db9
lea edx, [esp + 0x44]
push edx
push 0x4331b8
push 0x42b858
push 0x433db0
call fcn.00418db9
push 0x433db0
push 0x433b7c
call fcn.00412320
mov edi, str.files.dat
or ecx, 0xffffffff
xor eax, eax
add esp, 0x40
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x1c]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c]
push ecx
push ebp
push 0x42b858
push 0x433b7c
call fcn.00418db9
lea edx, [esp + 0x2c]
push edx
push 0x4331b8
push 0x42b858
push 0x433db0
call fcn.00418db9
push 0x433db0
push 0x433b7c
call fcn.00412320
push str.copio_3
push ebx
call fcn.0040d050
push 0x42c4e0
call fcn.0040df40
push 0x42c4e0
push str.wp_s
push ebx
call fcn.0040d050
add esp, 0x40
push 0x42c4e0
push str._s_sleepy.exe__kill
push 0x433b7c
call fcn.00418db9
push 0x433b7c
push str.Ejecutara__s
push ebx
call fcn.0040d050
mov ebx, dword [sym.imp.KERNEL32.dll_WinExec]
add esp, 0x18
push 5
push 0x433b7c
call ebx
push 0x42c4e0
push str._s_sleepy3.exe__kill
push 0x433b7c
call fcn.00418db9
push 0x433b7c
push str.Ejecutara__s
push 1
call fcn.0040d050
add esp, 0x18
push 5
push 0x433b7c
call ebx
mov eax, dword [0x4344f8]
test eax, eax
je 0x417021
push 0x42c4e0
push str._sWinide.exe__kill
push 0x433b7c
call fcn.00418db9
push 0x433b7c
push str.Ejecutara__s
push 1
call fcn.0040d050
add esp, 0x18
push 5
push 0x433b7c
call ebx
push 0x42c4e0
push str._shelp.exe__kill
push 0x433b7c
call fcn.00418db9
push 0x433b7c
push str.Ejecutara__s
push 1
call fcn.0040d050
add esp, 0x18
push 5
push 0x433b7c
call ebx
push 0x42c4e0
push str._sicodisc.exe__kill
push 0x433b7c
call fcn.00418db9
push 0x433b7c
push str.Ejecutara__s
push 1
call fcn.0040d050
add esp, 0x18
push 5
push 0x433b7c
call ebx
push 0x42c4e0
push str._sPrChk.exe__kill
push 0x433b7c
call fcn.00418db9
add esp, 0xc
push 5
push 0x433b7c
call ebx
push 0x42c4e0
push str._sNMGMT.exe__kill
push 0x433b7c
call fcn.00418db9
push 0x433b7c
push str.Ejecutara__s
push 1
call fcn.0040d050
add esp, 0x18
push 5
push 0x433b7c
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x1388
call esi
push 0x42c4e0
push str._shelp.exe__kill
push 0x433b7c
call fcn.00418db9
push 0x433b7c
push str.Ejecutara__s
push 1
call fcn.0040d050
add esp, 0x18
push 5
push 0x433b7c
call ebx
push 0x42c4e0
push str._sicodisc.exe__kill
push 0x433b7c
call fcn.00418db9
push 0x433b7c
push str.Ejecutara__s
push 1
call fcn.0040d050
add esp, 0x18
push 5
push 0x433b7c
call ebx
push 0x1388
call esi
push 0x42c4e0
push str._shear_usr.exe__kill
push 0x433b7c
call fcn.00418db9
push 0x433b7c
push str.Ejecutara__s
push 1
call fcn.0040d050
add esp, 0x18
push 5
push 0x433b7c
call ebx
push 0x1388
call esi
push 0x42c4e0
push str._sleveback.exe__kill
push 0x433b7c
call fcn.00418db9
push 0x433b7c
push str.Ejecutara__s
push 1
call fcn.0040d050
add esp, 0x18
push 5
push 0x433b7c
call ebx
push 0x1388
call esi
mov eax, dword [0x4344ec]
test eax, eax
je 0x4171f4
push 0x42c4e0
push str._scclient.exe__kill
push 0x433b7c
call fcn.00418db9
push 0x433b7c
push str.Ejecutara__s
push 1
call fcn.0040d050
add esp, 0x18
push 5
push 0x433b7c
call ebx
mov eax, dword [0x4344f0]
test eax, eax
je 0x41722e
push 0x42c4e0
push str._shear_usr.exe__kill
push 0x433b7c
call fcn.00418db9
push 0x433b7c
push str.Ejecutara__s
push 1
call fcn.0040d050
add esp, 0x18
push 5
push 0x433b7c
call ebx
push ebp
lea eax, [esp + 0x14c]
push str._s_version.dat
push eax
call fcn.00418db9
lea ecx, [esp + 0x154]
push ecx
call fcn.00412810
push str.versionB.dat
push str.C:WINDOWSLEVTEMP
lea edx, [esp + 0x160]
mov esi, eax
push 0x42b858
push edx
mov dword [esp + 0x34], esi
call fcn.00418db9
lea eax, [esp + 0x168]
push esi
push eax
call fcn.00412950
push 0x42e9f0
push 2
call fcn.0040d050
mov edi, str.config.txt
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x4c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x4c]
push ecx
push ebp
push 0x42b858
push 0x433b7c
call fcn.00418db9
add esp, 0x40
lea edx, [esp + 0x1c]
push edx
push 0x4331b8
push 0x42b858
push 0x433db0
call fcn.00418db9
push 0x433db0
push 0x433b7c
call fcn.00412320
push 0x42e9ec
push 2
call fcn.0040d050
mov esi, dword [esp + 0x38]
lea eax, [esp + 0x3c]
push esi
push 0x5a
push eax
call fcn.00419458
add esp, 0x2c
test eax, eax
je 0x4174ad
lea ecx, [esp + 0x1c]
push ecx
call fcn.00412c50
mov al, byte [esp + 0x20]
add esp, 4
test al, al
je 0x417495
lea edx, [esp + 0x1c]
push edx
push 0x433620
push 0x42b858
push 0x433b7c
call fcn.00418db9
lea eax, [esp + 0x2c]
push eax
push 0x4331b8
push 0x42b858
push 0x433db0
call fcn.00418db9
mov ecx, dword [esp + 0x34]
push ecx
push 0x433db0
push 0x433b7c
call fcn.00411de0
add esp, 0x2c
test eax, eax
je 0x417495
lea edx, [esp + 0x1c]
push str.cclient.exe
push edx
call fcn.00422610
add esp, 8
test eax, eax
je 0x4173c4
lea eax, [esp + 0x1c]
push str.Nclient.exe
push eax
call fcn.00422610
add esp, 8
test eax, eax
je 0x4173c4
lea ecx, [esp + 0x1c]
push str.Oclient.exe
push ecx
call fcn.00422610
add esp, 8
test eax, eax
jne 0x417413
push 0x433db0
lea edx, [esp + 0x278]
push str._s__kill
push edx
call fcn.00418db9
lea eax, [esp + 0x280]
mov dword [0x4344ec], 1
push eax
push str.Ejecutara__s
push 1
call fcn.0040d050
add esp, 0x18
lea ecx, [esp + 0x274]
push 5
push ecx
call ebx
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [esp + 0x1c]
push 0x42e9b0
push edx
call fcn.00422610
add esp, 8
test eax, eax
jne 0x417433
mov dword [0x4344ec], 1
lea eax, [esp + 0x1c]
push str.Winide.exe
push eax
call fcn.00422610
add esp, 8
test eax, eax
jne 0x417483
push 0x42c4e0
lea ecx, [esp + 0x3a4]
push str._sWinide.exe__kill
push ecx
call fcn.00418db9
lea edx, [esp + 0x3ac]
push edx
push str.Ejecutara__s
push 1
call fcn.0040d050
add esp, 0x18
lea eax, [esp + 0x3a0]
push 5
push eax
call ebx
push 0x433db0
push 0x433b7c
call fcn.00412320
add esp, 8
push esi
lea ecx, [esp + 0x20]
push 0x5a
push ecx
call fcn.00419458
add esp, 0xc
test eax, eax
jne 0x417318
push 0x42c4e0
push str._sPrChk.exe__kill
push 0x433b7c
call fcn.00418db9
add esp, 0xc
push 0
push 0x433b7c
call ebx
push esi
call fcn.00418f0e
push str.INSTALL.EXE
push 0x42c4e0
push 0x42b858
push 0x433b7c
call fcn.00418db9
push str.NICAND.EXE
push 0x42c4e0
push 0x42b858
push 0x433db0
call fcn.00418db9
add esp, 0x24
call fcn.00414e20
mov esi, dword [esp + 0x10]
test esi, esi
je 0x41757b
mov eax, dword [0x433b30]
test eax, eax
je 0x41752d
call fcn.00415da0
push 0
call fcn.004166e0
add esp, 4
push 0x42c4e0
call fcn.0040df40
add esp, 4
call fcn.0040cd10
test eax, eax
je 0x417548
call fcn.0040f470
push 0x42c4e0
lea edx, [esp + 0x20]
push str._s_nicand.exe__end
push edx
call fcn.00418db9
lea eax, [esp + 0x28]
push eax
push str.ejecutara__s
push 1
call fcn.0040d050
add esp, 0x18
lea ecx, [esp + 0x1c]
push 5
push ecx
call ebx
jmp 0x4175af
push 0x42c4e0
lea edx, [esp + 0x20]
push str._sNumInst.dat
push edx
call fcn.00418db9
add esp, 0xc
lea eax, [esp + 0x1c]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [esp + 0x1c]
push ecx
call fcn.00411fc0
add esp, 4
push 0x42d5a4
push str.C:WINDOWSLEVTEMP
call fcn.00412000
mov edx, dword [esp + 0x1c]
push edx
call fcn.00412ab0
add esp, 0xc
jmp 0x417604
push edi
call fcn.00418f0e
add esp, 4
test esi, esi
jne 0x417647
call fcn.00414990
test eax, eax
mov dword [esp + 0x10], eax
jne 0x4175f0
call fcn.00414990
mov dword [esp + 0x10], eax
push eax
push str.instppi_d
push 2
call fcn.0040d050
mov esi, dword [esp + 0x1c]
add esp, 0xc
test esi, esi
je 0x417618
mov eax, dword [0x433b30]
test eax, eax
je 0x417618
mov eax, 1
jmp 0x41761a
xor eax, eax
push eax
push str.Aretornara__d
push 1
call fcn.0040d050
add esp, 0xc
test esi, esi
je 0x417647
mov eax, dword [0x433b30]
test eax, eax
je 0x417647
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x4bc
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x4bc
ret