Function at 0x430372
Capabilities:
Extract resource via kernel32 functions
Hide graphical window
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, ecx
mov eax, dword [0x6f4e3c]
xor eax, ebp
mov dword [esp + 0x58], eax
mov eax, dword [ecx + 0x24]
mov ecx, dword [eax]
push 0x60
push eax
call dword [ecx + 0x24]
mov eax, dword [esi + 0x24]
mov ecx, dword [eax]
push 3
push eax
call dword [ecx + 0x1c]
mov dword [esp + 0xc], esi
lea ecx, [esi + 4]
xor edi, edi
mov dword [esp + 0x18], ecx
push edi
push edi
push 0xc00000
call fcn.004269e0
lea esi, [esp + 0x38]
mov dword [esi], edi
mov dword [esi + 4], edi
mov ecx, esi
push str.DEFAULT_SKIN
push str.SKIN
call fcn.00426a48
cmp dword [esi], edi
jne 0x4303e2
mov dword [1], 0
mov eax, dword [esp + 0x3c]
test eax, eax
jne 0x4303f4
mov dword [2], 0
mov edi, dword [0x770ec4]
mov ecx, dword [esp + 0xc]
lea ebx, [ecx + 0x2c]
push eax
push dword [0x900108]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
push dword [esp + 0x38]
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [edi]
push ebx
push 0x647d8c
push esi
push eax
push 0x648818
push edi
call dword [ecx + 0x14]
test eax, eax
jns 0x43043b
mov dword [3], 0
mov eax, dword [ebx]
test eax, eax
jne 0x43044d
mov dword [4], 0
mov eax, dword [ebx]
mov dword [esp + 0x10], ebx
mov ebx, dword [esp + 0xc]
lea ecx, [ebx + 0x48]
mov edx, dword [eax]
mov esi, 0x647d8c
push ecx
push esi
mov esi, 0x647d8c
push str.installDisabled
push eax
call dword [edx + 0xb4]
mov eax, dword [ebx + 0x48]
mov ecx, dword [eax]
xor edi, edi
inc edi
mov edx, 0x3ff
push edi
push edx
push eax
call dword [ecx + pe_nt_image_headers32]
lea edx, [ebx + 0x38]
mov eax, dword [ebx + 0x2c]
mov ecx, dword [eax]
mov dword [esp + 0x14], edx
push edx
push esi
push 0x6485e0
push eax
call dword [ecx + 0xb4]
mov eax, dword [ebx + 0x38]
mov ecx, dword [eax]
xor esi, esi
push esi
mov edx, 0x3ff
push edx
push eax
call dword [ecx + pe_nt_image_headers32]
mov eax, dword [ebx + 0x38]
mov ecx, dword [eax]
push edi
push 0x3fc
push eax
call dword [ecx + 0x8c]
lea eax, [ebx + 0x3c]
mov ecx, dword [ebx + 0x2c]
mov edx, dword [ecx]
push eax
mov eax, 0x647d8c
push eax
push str.SmallInstall
push ecx
call dword [edx + 0xb4]
mov eax, dword [ebx + 0x3c]
mov ecx, dword [eax]
push edi
mov edx, 0x3ff
push edx
push eax
call dword [ecx + pe_nt_image_headers32]
lea eax, [ebx + 0x40]
mov ecx, dword [ebx + 0x2c]
mov edx, dword [ecx]
push eax
mov edi, 0x647d8c
push edi
push str.SmallDisabledInstall
push ecx
call dword [edx + 0xb4]
mov eax, dword [ebx + 0x40]
mov ecx, dword [eax]
push esi
mov edx, 0x3ff
push edx
push eax
call dword [ecx + pe_nt_image_headers32]
lea eax, [ebx + 0x44]
mov ecx, dword [ebx + 0x2c]
mov edx, dword [ecx]
push eax
push edi
push str.SmallCancel
push ecx
call dword [edx + 0xb4]
mov eax, dword [ebx + 0x44]
mov ecx, dword [eax]
push esi
mov edx, 0x3ff
push edx
push eax
call dword [ecx + pe_nt_image_headers32]
lea eax, [ebx + 0x4c]
mov ecx, dword [ebx + 0x2c]
mov edx, dword [ecx]
push eax
push edi
push str.close
push ecx
call dword [edx + 0xb4]
lea eax, [ebx + 0x50]
mov ecx, dword [ebx + 0x2c]
mov edx, dword [ecx]
push eax
push edi
push 0x6486d6
push ecx
call dword [edx + 0xb4]
lea eax, [ebx + 0x34]
mov ecx, dword [ebx + 0x2c]
mov edx, dword [ecx]
push eax
push edi
push str.custom
push ecx
call dword [edx + 0xb4]
lea eax, [ebx + 0x74]
mov ecx, dword [ebx + 0x2c]
mov edx, dword [ecx]
push eax
push edi
push str.custompanel
push ecx
call dword [edx + 0xb4]
lea eax, [ebx + 0x80]
mov ecx, dword [ebx + 0x2c]
mov edx, dword [ecx]
push eax
push edi
push str.pathEdit
push ecx
call dword [edx + 0xb4]
lea eax, [ebx + 0x6c]
mov ecx, dword [ebx + 0x2c]
mov edx, dword [ecx]
push eax
push edi
mov edi, 0x647d8c
push str.protocol
push ecx
call dword [edx + 0xb4]
lea eax, [ebx + 0x90]
mov ecx, dword [ebx + 0x2c]
mov edx, dword [ecx]
push eax
push edi
push str.privacy_protocol
push ecx
call dword [edx + 0xb4]
lea edi, [ebx + 0x94]
mov eax, dword [ebx + 0x2c]
mov ecx, dword [eax]
push edi
mov edx, 0x647d8c
push edx
push str.accept_text
push eax
call dword [ecx + 0xb4]
cmp dword [ebx + 0x94], esi
je 0x430656
call fcn.00488190
cmp eax, 1
jg 0x430656
mov eax, dword [edi]
mov ecx, dword [eax]
mov edx, 0x397
lea ebx, [esp + 0x40]
push edx
push ebx
push eax
call dword [ecx + 0x50]
mov eax, dword [ebx + 4]
mov ecx, 0x20000
add ecx, dword [ebx]
mov edx, dword [edi]
mov dword [ebx + 4], eax
mov dword [ebx], ecx
mov eax, dword [edx]
sub esp, 0x10
movsd xmm0, qword [ebx]
movsd qword [esp + 8], xmm0
mov ecx, 0x397
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [eax + 0x74]
mov edi, dword [esp + 0xc]
lea eax, [edi + 0x70]
mov ecx, dword [edi + 0x2c]
mov edx, dword [ecx]
push eax
mov eax, 0x647d8c
push eax
mov ebx, 0x647d8c
push str.Private
push ecx
call dword [edx + 0xb4]
lea eax, [edi + 0x54]
mov ecx, dword [edi + 0x2c]
mov edx, dword [ecx]
push eax
push ebx
push str.ChangeFolder
push ecx
call dword [edx + 0xb4]
lea eax, [edi + 0x58]
mov ecx, dword [edi + 0x2c]
mov edx, dword [ecx]
push eax
push ebx
push str.AddDesktopShortcut
push ecx
call dword [edx + 0xb4]
lea eax, [edi + 0x60]
mov ecx, dword [edi + 0x2c]
mov edx, dword [ecx]
push eax
push ebx
push str.AddTaskBar
push ecx
call dword [edx + 0xb4]
lea eax, [edi + 0x8c]
mov ecx, dword [edi + 0x2c]
mov edx, dword [ecx]
push eax
push ebx
push str.read_accept
push ecx
call dword [edx + 0xb4]
lea eax, [edi + 0x5c]
mov ecx, dword [edi + 0x2c]
mov edx, dword [ecx]
push eax
push ebx
push str.SetHomepage
push ecx
call dword [edx + 0xb4]
lea eax, [edi + 0x64]
mov ecx, dword [edi + 0x2c]
mov edx, dword [ecx]
push eax
push ebx
push str.SetDefaultBrowser
push ecx
call dword [edx + 0xb4]
lea eax, [edi + 0x68]
mov ecx, dword [edi + 0x2c]
mov edx, dword [ecx]
push eax
push ebx
push str.AddUserExpericence
push ecx
call dword [edx + 0xb4]
lea eax, [edi + 0x78]
mov ecx, dword [edi + 0x2c]
mov edx, dword [ecx]
push eax
push ebx
push str.customgrid
push ecx
call dword [edx + 0xb4]
lea eax, [edi + 0xe0]
mov ecx, dword [edi + 0x2c]
mov edx, dword [ecx]
push eax
push ebx
push str.LoadingPngs
push ecx
call dword [edx + 0xb4]
lea eax, [edi + 0x398]
mov ecx, dword [edi + 0x2c]
mov edx, dword [ecx]
push eax
push ebx
push str.circle_core
push ecx
call dword [edx + 0xb4]
lea eax, [edi + 0x39c]
mov ecx, dword [edi + 0x2c]
mov edx, dword [ecx]
push eax
push ebx
mov ebx, 0x647d8c
push str.installing_circle
push ecx
call dword [edx + 0xb4]
mov eax, dword [edi + 0x39c]
mov ecx, dword [eax]
xor edx, edx
inc edx
push edx
mov edx, 0x3ff
push edx
push eax
call dword [ecx + pe_nt_image_headers32]
lea eax, [edi + 0x3a0]
mov ecx, dword [edi + 0x2c]
mov edx, dword [ecx]
push eax
push ebx
push str.logocn
push ecx
call dword [edx + 0xb4]
lea eax, [edi + 0x3a4]
mov ecx, dword [edi + 0x2c]
mov edx, dword [ecx]
push eax
push ebx
push str.logoen
push ecx
call dword [edx + 0xb4]
lea eax, [edi + 0x3a8]
mov ecx, dword [edi + 0x2c]
mov edx, dword [ecx]
push eax
push ebx
push str.bgbottom
push ecx
call dword [edx + 0xb4]
lea eax, [edi + 0x3ac]
mov ecx, dword [edi + 0x2c]
mov edx, dword [ecx]
push eax
push ebx
mov ebx, 0x647d8c
push str.bluemask
push ecx
call dword [edx + 0xb4]
mov eax, dword [edi + 0x3ac]
mov ecx, dword [eax]
push 0
mov edx, 0x3ff
push edx
push eax
call dword [ecx + pe_nt_image_headers32]
lea eax, [edi + 0x3b0]
mov ecx, dword [edi + 0x2c]
mov edx, dword [ecx]
push eax
push ebx
push str.shadow
push ecx
call dword [edx + 0xb4]
mov eax, dword [edi + 0x80]
mov ecx, dword [eax]
mov edx, 0x3fc
xor ebx, ebx
inc ebx
push ebx
push edx
push eax
call dword [ecx + 0x8c]
mov eax, dword [edi + 0x80]
mov ecx, dword [eax]
push 0xb4b4b4
push 0x404
push eax
call dword [ecx + pe_nt_image_headers32]
mov eax, dword [edi + 0x54]
mov ecx, dword [eax]
push ebx
mov edx, 0x3fc
push edx
push eax
call dword [ecx + 0x8c]
lea eax, [edi + 0x3f4]
mov ecx, dword [edi + 0x2c]
mov edx, dword [ecx]
push eax
mov eax, 0x647d8c
push eax
push str.progressbar_bg
push ecx
call dword [edx + 0xb4]
mov eax, dword [edi + 0x3f4]
mov ecx, dword [eax]
push ebx
mov edx, 0x3ff
push edx
push eax
call dword [ecx + pe_nt_image_headers32]
lea eax, [edi + 0x3f8]
mov ecx, dword [edi + 0x2c]
mov edx, dword [ecx]
push eax
mov eax, 0x647d8c
push eax
push str.progressbar
push ecx
call dword [edx + 0xb4]
mov eax, dword [edi + 0x3f8]
mov ecx, dword [eax]
push ebx
mov edx, 0x3ff
push edx
push eax
call dword [ecx + pe_nt_image_headers32]
lea eax, [edi + 0x3e4]
mov ecx, dword [edi + 0x2c]
mov edx, dword [ecx]
push eax
mov eax, 0x647d8c
push eax
push str.tens_place
push ecx
call dword [edx + 0xb4]
mov eax, dword [edi + 0x3e4]
mov ecx, dword [eax]
push ebx
mov edx, 0x3ff
push edx
push eax
call dword [ecx + pe_nt_image_headers32]
lea eax, [edi + 0x3e8]
mov ecx, dword [edi + 0x2c]
mov edx, dword [ecx]
push eax
mov eax, 0x647d8c
push eax
push str.units_place
push ecx
call dword [edx + 0xb4]
mov eax, dword [edi + 0x3e8]
mov ecx, dword [eax]
push ebx
mov edx, 0x3ff
push edx
push eax
call dword [ecx + pe_nt_image_headers32]
lea eax, [edi + 0x3ec]
mov ecx, dword [edi + 0x2c]
mov edx, dword [ecx]
push eax
mov eax, 0x647d8c
push eax
push str.percent
push ecx
call dword [edx + 0xb4]
mov eax, dword [edi + 0x3ec]
mov ecx, dword [eax]
push ebx
mov edx, 0x3ff
push edx
push eax
call dword [ecx + pe_nt_image_headers32]
lea eax, [edi + 0x3f0]
mov ecx, dword [edi + 0x2c]
mov edx, dword [ecx]
push eax
mov eax, 0x647d8c
push eax
push str.install_text
push ecx
call dword [edx + 0xb4]
mov eax, dword [edi + 0x3f0]
mov ecx, dword [eax]
push ebx
mov edx, 0x3ff
push edx
push eax
call dword [ecx + pe_nt_image_headers32]
mov edx, 0x3fc
add edx, edi
mov eax, dword [edi + 0x2c]
mov ecx, dword [eax]
push edx
mov edx, 0x647d8c
push edx
push str.finish100
push eax
call dword [ecx + 0xb4]
mov eax, dword [edi + 0x3fc]
mov ecx, dword [eax]
push ebx
mov edx, 0x3ff
push edx
push eax
call dword [ecx + pe_nt_image_headers32]
lea eax, [edi + 0x3e0]
mov ecx, dword [edi + 0x2c]
mov edx, dword [ecx]
push eax
mov eax, 0x647d8c
push eax
push str.tip_place
push ecx
call dword [edx + 0xb4]
mov eax, dword [edi + 0x3e0]
mov ecx, dword [eax]
push ebx
mov edx, 0x3ff
push edx
push eax
call dword [ecx + pe_nt_image_headers32]
lea ebx, [edi + 0x3b4]
lea edi, [esp + 0x40]
xorps xmm0, xmm0
movaps xmmword [esp + 0x40], xmm0
mov word [esp + 0x50], 0
push esi
push str.number_d
push edi
call fcn.00428e62
add esp, 0xc
mov dword [esp + 0x28], 0
mov eax, dword [esp + 0x10]
mov eax, dword [eax]
mov ecx, dword [eax]
lea edx, [esp + 0x28]
push edx
push 0x648588
push eax
call dword [ecx]
test eax, eax
js 0x430a51
mov eax, dword [esp + 0x28]
mov ecx, dword [eax]
push ebx
push 0x6484a4
push edi
push eax
call dword [ecx + 0x124]
mov eax, dword [esp + 0x28]
test eax, eax
je 0x430a5f
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
inc esi
add ebx, 4
cmp esi, 0xa
jne 0x4309fe
mov ebx, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0xc
call ebx
mov esi, eax
push 0xb
call ebx
xor ecx, ecx
mov edx, 0x100
push ecx
push esi
push eax
xor eax, eax
inc eax
push eax
mov esi, eax
push edx
push dword [0x900108]
call dword [sym.imp.USER32.dll_LoadImageW]
mov ecx, 0x80
push eax
push esi
push ecx
mov ebx, dword [esp + 0x24]
push dword [ebx]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x32
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov esi, eax
push 0x31
call dword [sym.imp.USER32.dll_GetSystemMetrics]
xor ecx, ecx
push ecx
push esi
push eax
xor eax, eax
inc eax
push eax
mov eax, 0x100
push eax
push dword [0x900108]
call dword [sym.imp.USER32.dll_LoadImageW]
push eax
xor eax, eax
push eax
mov eax, 0x80
push eax
push dword [ebx]
call dword [sym.imp.USER32.dll_SendMessageW]
push edi
call fcn.00426c3e
add esp, 4
cmp byte [esp + 0x4b], 0
jns 0x430afc
mov edi, dword [esp + 0x40]
push edi
push dword [ebx]
call dword [sym.imp.USER32.dll_SetWindowTextW]
cmp byte [esp + 0x4b], 0
jns 0x430b18
push dword [esp + 0x40]
call fcn.00517bd6
add esp, 4
mov edi, dword [esp + 0xc]
mov ecx, edi
lea esi, [esp + 0x28]
push esi
call fcn.004313e8
mov eax, esi
cmp byte [esp + 0x33], 0
jns 0x430b35
mov eax, dword [esp + 0x28]
lea esi, [esp + 0x40]
mov word [esi], 0
mov ecx, esi
push eax
call fcn.00427328
cmp byte [esp + 0x33], 0
jns 0x430b59
push dword [esp + 0x28]
call fcn.00517bd6
add esp, 4
mov eax, dword [edi + 0x38]
mov ecx, dword [eax]
push esi
push 0x3e9
push eax
call dword [ecx + 0x2c]
mov eax, dword [edi + 0x8c]
mov ecx, dword [eax]
push 0x9ce
push eax
call dword [ecx + 0x54]
cmp eax, 1
sete byte [edi + 0x42d]
mov eax, dword [edi + 0x48]
mov ecx, dword [eax]
mov ecx, dword [ecx + 0x78]
mov esi, 0x3ff
jne 0x430ba4
push 1
push esi
push eax
call ecx
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
mov ecx, dword [eax]
push 0
jmp 0x430bb4
push 0
push esi
push eax
call ecx
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
mov ecx, dword [eax]
push 1
push esi
push eax
call dword [ecx + pe_nt_image_headers32]
mov ecx, edi
call fcn.0042f9d6
call fcn.00418a10
mov ecx, eax
call fcn.00418be6
test al, al
jne 0x430c32
call fcn.00418a10
mov ecx, eax
call fcn.00418c06
test al, al
jne 0x430c32
xor esi, esi
lea edi, [esp + 0x28]
mov dword [edi], esi
mov eax, dword [esp + 0x10]
mov eax, dword [eax]
mov ecx, dword [eax]
push edi
push 0x647d8c
push str.SetHomepage
push eax
call dword [ecx + 0xb4]
mov eax, dword [edi]
mov ecx, dword [eax]
push esi
push 0x9ce
push eax
call dword [ecx + pe_nt_image_headers32]
mov eax, dword [edi]
test eax, eax
je 0x430c28
mov dword [esp + 0x28], 0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x28]
test eax, eax
je 0x430c32
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea edi, [esp + 0x1c]
push 0x13ee
push edi
call fcn.00498905
add esp, 8
cmp byte [edi + 0xb], 0
jns 0x430c4e
mov edi, dword [esp + 0x1c]
lea esi, [esp + 0x28]
mov word [esi], 0
mov ecx, esi
push edi
call fcn.00427328
lea edi, [esp + 0x40]
mov ecx, edi
push esi
call fcn.00431442
push esi
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
cmp byte [esp + 0x27], 0
jns 0x430c85
push dword [esp + 0x1c]
call fcn.00517bd6
add esp, 4
mov ebx, dword [esp + 0xc]
mov eax, dword [ebx + 0x8c]
mov ecx, dword [eax]
push edi
push 0x3e9
push eax
call dword [ecx + 0x2c]
call fcn.00407788
mov ecx, dword [ebx + 0x64]
mov edx, dword [ecx]
xor al, 1
movzx eax, al
push eax
push 0x9ce
push ecx
call dword [edx + pe_nt_image_headers32]
xor edi, edi
push edi
push 0xa
push 0x64
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetTimer]
mov eax, dword [ebx + 0x2c]
mov ecx, dword [eax]
push edi
push dword [ebx + 0x390]
push 0x1450
push eax
call dword [ecx + 0x44]
mov eax, dword [ebx + 0x2c]
mov ecx, dword [eax]
push edi
push dword [ebx + 0x394]
push 0x13a3
push eax
call dword [ecx + 0x44]
mov eax, dword [ebx + 0x24]
mov ecx, dword [eax]
push dword [ebx + 0x2c]
push eax
call dword [ecx + 0x18]
call fcn.004175be
mov ecx, eax
push esi
call fcn.00417e5c
cmp byte [esp + 0x33], 0
jns 0x430d12
mov esi, dword [esp + 0x28]
mov eax, dword [ebx + 0x80]
mov ecx, dword [eax]
push esi
push 0xbb8
push eax
call dword [ecx + 0x94]
cmp byte [esp + 0x33], 0
jns 0x430d3a
push dword [esp + 0x28]
call fcn.00517bd6
add esp, 4
mov eax, dword [esp + 0x10]
mov eax, dword [eax]
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc4]
mov esi, dword [esp + 0x18]
mov ecx, esi
push 0
call fcn.00426a8c
push 5
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [esp + 0x38]
test eax, eax
je 0x430d84
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
xor esi, esi
inc esi
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.00517c1a
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x10