Function at 0x404cd0
Capabilities:
Check os version
Create directory
Create process on windows
Extract resource via kernel32 functions
Hide graphical window
Inspect load icon resource
Read .ini file
Set current directory

Disassembly:
sub esp, 0x2c
push ebx
push esi
push edi
push ebp
push str.Herosoft
push 0
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenEventA]
test eax, eax
je 0x404d00
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x2c
ret 0x10
push str.Herosoft
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, dword [esp + 0x40]
mov dword [esp + 0x10], eax
mov dword [0x41d308], esi
mov dword [0x41d304], esi
call dword [sym.imp.KERNEL32.dll_GetVersion]
xor ecx, ecx
test eax, 0x80000000
sete cl
mov dword [0x41d2f8], ecx
test ecx, ecx
jne 0x404db1
cmp al, 4
ja 0x404db1
cmp ah, 0xa
jae 0x404db1
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x200
push 0x41ff90
call fcn.00403fc0
add esp, 8
push str.W95SETUP.EXE
push 0x41ff90
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push pe_nt_image_headers32
mov ebp, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x4202a0
push esi
call ebp
push 0x4202a0
push 0x41ff90
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 5
push 0x41ff90
call dword [sym.imp.KERNEL32.dll_WinExec]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x2c
ret 0x10
call fcn.00401100
push 0x10
mov eax, dword [0x41d304]
push 0x41f7d8
mov ebx, dword [sym.imp.USER32.dll_LoadStringA]
push 0x24
push eax
call ebx
push 0x41f7d8
call fcn.00404ca0
add esp, 4
mov edi, eax
push 0x2a
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x404dfe
call dword [sym.imp.KERNEL32.dll_GetACP]
cmp eax, edi
jne 0x404dfe
mov dword [0x41d2fc], 1
jmp 0x404e08
mov dword [0x41d2fc], 0
push 0xff0000
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov dword [0x420190], eax
call fcn.00405840
call fcn.00404100
mov eax, dword [0x41d2fc]
test eax, eax
je 0x404e45
push str.STHVCD.INI
push 0x41d810
push str.CodePage
push str.UNINSTALL
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push str.STHVCD.INI
push 0x200
push 0x41ff90
push 0x40a064
push str.INSTALLPATH
push str.INSTALL
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x404e9a
push 0x41ff90
push str.C:HerosoftHero2000_
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.C:HerosoftHero2000_
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov cl, byte [eax + 0x41d34f]
cmp cl, 0x5c
jne 0x404e9a
mov byte [eax + 0x41d34f], 0
push pe_nt_image_headers32
push 0x4202a0
call fcn.00403fc0
add esp, 8
push 0x4202a0
push 0x41ff10
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.FULLDATA_
push 0x41ff10
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x4202a0
push 0x420220
xor ebp, ebp
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.C:HerosoftHero2000_
push 0x4201a0
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [0x41d540], 1
mov ecx, dword [esp + 0x44]
test ecx, ecx
jne 0x404f5f
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
push 0x65
mov eax, dword [0x41d304]
push eax
mov edi, dword [sym.imp.USER32.dll_LoadIconA]
mov dword [esp + 0x1c], 0x23
mov dword [esp + 0x20], 0x404130
mov dword [esp + 0x2c], esi
call edi
mov dword [esp + 0x28], eax
push 0x7f00
push ebp
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ebp
lea eax, [esp + 0x14]
mov dword [esp + 0x34], ebp
push eax
mov ebp, dword [sym.imp.USER32.dll_RegisterClassA]
mov dword [esp + 0x3c], str.SETUP
call ebp
jmp 0x404f65
mov edi, dword [sym.imp.USER32.dll_LoadIconA]
push 0x41d310
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push 0x68
mov eax, dword [0x41d304]
push eax
mov ebp, dword [sym.imp.USER32.dll_LoadBitmapA]
call ebp
push 0
mov ecx, dword [0x41d314]
push esi
mov dword [0x41d30c], eax
push 0
mov eax, dword [0x41d31c]
push 0
sub eax, ecx
push eax
mov edx, dword [0x41d310]
mov eax, dword [0x41d318]
sub eax, edx
push eax
push ecx
push edx
push 0x80800000
push str.SETUP
push str.SETUP
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
push 5
mov ebp, dword [sym.imp.USER32.dll_ShowWindow]
push eax
mov dword [0x41d300], eax
call ebp
mov ecx, dword [0x41d300]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0x4041b0
mov ecx, dword [0x41d300]
push 0x1f4
mov ebp, dword [sym.imp.USER32.dll_SetTimer]
push 0x38e
push ecx
call ebp
mov ebp, dword [sym.imp.USER32.dll_wsprintfA]
mov esi, dword [sym.imp.USER32.dll_MessageBoxA]
push 0
mov eax, dword [0x41d300]
push 0x403440
mov ecx, dword [0x41d2fc]
push eax
cmp ecx, 1
sbb eax, eax
mov ecx, dword [0x41d304]
mov dword [0x41d340], 0
and eax, 0x289d
add eax, 0x71
push eax
push ecx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
test eax, eax
je 0x4057f1
push str.C:HerosoftHero2000_
call fcn.00404ba0
add esp, 4
push str.C:HerosoftHero2000_
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x4050d1
push 0
push str.C:HerosoftHero2000_
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
mov eax, dword [0x41d304]
jne 0x4050d1
push 0x100
push 0x41f7f0
push 0xd
push eax
call ebx
push 0x200
mov eax, dword [0x41d304]
push 0x41f8f0
push 0xe
push eax
call ebx
push str.C:HerosoftHero2000_
push 0x41f8f0
push 0x41ff90
call ebp
add esp, 0xc
mov eax, dword [0x41d300]
push 0
push 0x41f7f0
push 0x41ff90
push eax
call esi
jmp 0x40500f
call fcn.00402f50
test eax, eax
mov eax, dword [0x41d304]
jne 0x40512f
push 0x100
push 0x41f7f0
push 0x11
push eax
call ebx
push 0x200
mov eax, dword [0x41d304]
push 0x41f8f0
push 0x12
push eax
call ebx
push str.C:HerosoftHero2000_
push 0x41f8f0
push 0x41ff90
call ebp
add esp, 0xc
mov eax, dword [0x41d300]
push 0
push 0x41f7f0
push 0x41ff90
push eax
call esi
jmp 0x40500f
push str.STHVCD.INI
push 0
push str.Monitor
push str.SETTING
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov esi, eax
test esi, esi
je 0x405167
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x405167
push 0
push 0x10
push 0x4c88
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
push str.C:HerosoftHero2000_
push 0x4201a0
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x4201a0
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov cl, byte [eax + 0x42019f]
cmp cl, 0x5c
je 0x40519d
push 0x40a04c
push 0x4201a0
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, dword [0x41d33c]
push eax
call fcn.00405be0
add esp, 4
mov eax, dword [0x41d304]
push 0x65
push eax
call edi
push 0x66
mov dword [0x420520], eax
mov eax, dword [0x41d304]
push eax
call edi
push 0x67
mov dword [0x420524], eax
mov eax, dword [0x41d304]
push eax
call edi
push 0x68
mov dword [0x420528], eax
mov eax, dword [0x41d304]
push eax
call edi
push 0x69
mov dword [0x42052c], eax
mov eax, dword [0x41d304]
push eax
call edi
push 0x6a
mov dword [0x420530], eax
mov eax, dword [0x41d304]
push eax
call edi
push 0x6b
mov dword [0x420534], eax
mov eax, dword [0x41d304]
push eax
call edi
push 0x6c
mov dword [0x420538], eax
mov eax, dword [0x41d304]
push eax
call edi
push 0x6d
mov dword [0x42053c], eax
mov eax, dword [0x41d304]
push eax
call edi
push 0x6e
mov dword [0x420540], eax
mov eax, dword [0x41d304]
push eax
call edi
push 0x6f
mov dword [0x420544], eax
mov eax, dword [0x41d304]
push eax
call edi
push str.RT_RCDATA
mov dword [0x420548], eax
push 0x514
mov eax, dword [0x41d304]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
mov ecx, dword [0x41d304]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
mov ebx, eax
mov ebp, dword [sym.imp.KERNEL32.dll_LockResource]
call ebp
add eax, dword [0x41e7f4]
push 0
push 0x4047a0
mov ecx, dword [0x41d300]
push ecx
mov edx, dword [0x41d2fc]
mov dword [0x41ff08], eax
cmp edx, 1
sbb eax, eax
mov ecx, dword [0x41d304]
mov dword [0x41d340], 3
and eax, 0xffffd763
add eax, 0x2906
push eax
push ecx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov ecx, dword [0x420190]
mov ebp, dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [0x41d340], 4
push ecx
call ebp
mov ecx, dword [0x420520]
mov ebx, dword [sym.imp.USER32.dll_DestroyIcon]
push ecx
call ebx
mov ecx, dword [0x420524]
push ecx
call ebx
mov eax, dword [0x420528]
push eax
call ebx
mov eax, dword [0x42052c]
push eax
call ebx
mov eax, dword [0x420530]
push eax
call ebx
mov eax, dword [0x420534]
push eax
call ebx
mov eax, dword [0x420538]
push eax
call ebx
mov eax, dword [0x42053c]
push eax
call ebx
mov eax, dword [0x420540]
push eax
call ebx
mov eax, dword [0x420544]
push eax
call ebx
mov eax, dword [0x420548]
push eax
call ebx
test edi, edi
jne 0x40535d
push str.STHVCD.INI
call fcn.00404b40
add esp, 4
jmp 0x4057f7
push 0x200
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push 0x41ff90
push 0x4201a0
call ebx
push str.STHVCD.INI
push 0x41ff90
push str.INSTALLPATH
push str.INSTALL
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push 0x4201a0
push 0x41ff90
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.SYSEXPLR.EXE
push 0x41ff90
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, dword [0x41d324]
test eax, eax
je 0x4053c4
push 0x41ff90
call fcn.00402a80
add esp, 4
push 0x200
push 0x41ff90
push 0x4201a0
call ebx
push str.STHVCD.INI
push 0x41ff90
push str.INSTALLPATH
push str.INSTALL
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push str.STHVCD.INI
push 0x41ff90
push str.UNINSTALLPATH
push str.UNINSTALL
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push 0x41ff90
push 0x41f8f0
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.LOGOBMP.BMP
push 0x41f8f0
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push str.STHVCD.INI
push 0x41f8f0
push str.LOGOBITMAP
push str.SETTING
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push str.STHVCD.INI
push 0x41f8f0
push str.MultiMonLogo
push str.SETTING
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push 0x41ff90
push 0x41f8f0
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.FACEBMP.BMP
push 0x41f8f0
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push str.STHVCD.INI
push 0x41f8f0
push str.FACEBITMAP
push str.SETTING
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
call fcn.00402640
push str.STHVCD.INI
push 0x41d778
push str.INSTALLSTHSVCD
push str.INSTALL
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
call fcn.00404ad0
push str.STHVCD.INI
push 0x50
push 0x40b210
push 0x40a064
push str.GROUP
push str.INSTALL
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov edi, eax
mov eax, dword [0x41d540]
push eax
push 0x420220
call fcn.00404c40
add esp, 8
mov al, byte [0x4202a0]
mov cl, byte [0x4202a1]
mov dl, byte [0x4202a2]
push str.STHVCD.INI
push 0x41ff90
mov byte [0x41ff90], al
push str.SOURCEPATH
mov byte [0x41ff91], cl
push str.INSTALL
mov byte [0x41ff92], dl
mov byte [0x41ff93], 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
call fcn.00401500
call fcn.004059e0
call fcn.00401540
push 0
mov ecx, dword [0x41d300]
push 0x4038e0
mov edx, dword [0x41d2fc]
push ecx
cmp edx, 1
sbb eax, eax
mov ecx, dword [0x41d304]
and eax, 0xffffd763
add eax, 0x290b
push eax
push ecx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push 0x4201a0
call fcn.00402940
add esp, 4
push 0x4201a0
push 0x41ff90
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.UNINST32.EXE
push 0x41ff90
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x41ff90
push 0x41f8f0
push str.Herosoft2000
call fcn.004029c0
add esp, 0xc
push str.RUNDLL32.EXE_setupapi.dll_InstallHinfSection_DefaultInstall_132
push 0x41ff90
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x200
push 0x41f8f0
push 0x4201a0
call ebx
push 0x41f8f0
push 0x41ff90
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push str.DIVX.INF
push 0x41ff90
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 5
mov ebx, dword [sym.imp.KERNEL32.dll_WinExec]
push 0x41ff90
call ebx
push 0
push 0x403a50
mov ecx, dword [0x41d300]
mov eax, dword [0x41d2fc]
push ecx
cmp eax, 1
sbb eax, eax
mov ecx, dword [0x41d304]
and eax, 0xffffd764
add eax, 0x2907
push eax
push ecx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
test edi, edi
je 0x405640
test esi, esi
je 0x405672
push 0x4201a0
push 0x41ff90
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.SysEXPLR.EXE
push 0x41ff90
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, dword [0x41d324]
test eax, eax
je 0x405672
push 5
push 0x41ff90
call ebx
mov eax, dword [0x41d2fc]
test eax, eax
je 0x405695
push str.STHVCD.INI
push 0x41f7d8
push str.CodePage
push str.INSTALL
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push str.STHVCD.INI
push str.2000
push str.VERSION
push str.INSTALL
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
call fcn.00405ab0
push 0x4201a0
push 0x41ff90
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.STHMP3AUDIO.INI
push 0x41ff90
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x41ff90
call fcn.00401b50
add esp, 4
push 0x4201a0
push 0x41ff90
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.DLLFILEDLLCONFIG.INI
push 0x41ff90
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x41ff90
call fcn.00401b50
add esp, 4
push 0x4201a0
push 0x41ff90
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.VISPLUGVISPLUG.INI
push 0x41ff90
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x41ff90
call fcn.00401b50
add esp, 4
push 0x4201a0
push 0x41ff90
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.FACEEDIT.INI
push 0x41ff90
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x41ff90
call fcn.00401b50
add esp, 4
push 0x4201a0
push 0x41ff90
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.FACEPLUG.INI
push 0x41ff90
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x41ff90
call fcn.00401b50
add esp, 4
push 0x4201a0
push 0x41ff90
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.VFACEPLUG.INI
push 0x41ff90
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x41ff90
call fcn.00401b50
add esp, 4
push 0x4201a0
push 0x41ff90
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.EQSAVE.
push 0x41ff90
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x41ff90
call fcn.00401b50
add esp, 4
jmp 0x4057f7
mov ebp, dword [sym.imp.GDI32.dll_DeleteObject]
call dword [sym.imp.ole32.dll_CoUninitialize]
push 0x38e
mov eax, dword [0x41d300]
push eax
call dword [sym.imp.USER32.dll_KillTimer]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov eax, dword [0x41d30c]
push eax
call ebp
call fcn.00403e30
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x2c
ret 0x10