Function at 0x4052d5
Capabilities:
Extract resource via kernel32 functions
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x86f4
call fcn.004674c0
mov eax, dword [0x490654]
xor eax, esp
mov dword [esp + 0x86f0], eax
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
lea eax, [esp + 0x2d8]
push eax
mov dword [esp + 0x20], esi
call fcn.0040590b
push esi
lea ecx, [esp + 0x2dc]
call fcn.00416e20
push 0x104
lea esi, [esp + 0x82f4]
call fcn.00408680
mov dword [esp], str.onaInstall.log
push 0x478b4c
call fcn.004089f0
push 0x50
mov esi, eax
call fcn.00453217
xor ebx, ebx
add esp, 0xc
cmp eax, ebx
je 0x405359
push esi
mov esi, eax
call fcn.00417620
mov dword [esp + 0x10], eax
jmp 0x40535d
mov dword [esp + 0x10], ebx
mov ecx, dword [esp + 0x10]
push str.___START___
mov edi, str.INFO
push edi
call fcn.00417780
push 0x800
call fcn.0045221e
mov esi, eax
lea eax, [esp + 0x2dc]
mov dword [esp], 0x400
push eax
call fcn.00417150
push esi
push str.ARGS:
lea eax, [esp + 0x84]
call fcn.004025cc
push eax
call fcn.0040260b
call fcn.00402637
mov ecx, dword [esp + 0x10]
push eax
push edi
call fcn.00417780
lea ecx, [esp + 0x7c]
call fcn.004025fd
push esi
call fcn.004531bb
pop ecx
push dword [esp + 0x10]
push ecx
push str.onaFull
push 0x478fb8
call fcn.004089f0
add esp, 0xc
push eax
lea esi, [esp + 0xd0]
call fcn.004050eb
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx esi, ax
mov eax, 0x419
mov dword [esp + 0xc], 0x68
cmp si, ax
jne 0x405412
mov dword [esp + 0xc], 0x67
jmp 0x405424
mov eax, 0x422
cmp si, ax
jne 0x405424
mov dword [esp + 0xc], 0x69
push 0x47a4c4
push 0x47a4cc
mov dword [esp + 0x1c], ebx
call fcn.004089f0
pop ecx
pop ecx
push eax
movzx eax, word [esp + 0x10]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [esp + 0x18], eax
cmp eax, ebx
je 0x405486
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [esp + 0xc], eax
cmp eax, ebx
je 0x405486
push dword [esp + 0x18]
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push eax
push dword [esp + 0x14]
call fcn.004168d0
add esp, 0xc
push dword [esp + 0xc]
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
lea esi, [esp + 0xc8]
call fcn.00405181
test eax, eax
je 0x40550e
mov edi, 0x478fbc
lea ebx, [esp + 0x2d8]
call fcn.00417000
test al, al
jne 0x405507
push 0x10
push 0
push str.NSTALLER_RUNNING_ALREADY
push 0x479010
call fcn.004089f0
mov ebx, dword [esp + 0x24]
pop ecx
pop ecx
call fcn.00416a20
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0xa
pop edi
lea esi, [esp + 0xc8]
call fcn.00405115
lea eax, [esp + 0x2d8]
push eax
call fcn.0040591d
mov ecx, dword [esp + 0x86fc]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00452c94
mov esp, ebp
pop ebp
ret 0x10
mov edi, str.INFO
xor ebx, ebx
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
push 0x10
pop eax
call fcn.00417a00
push 0x24
mov dword [esp + 0x1c], eax
call fcn.00453217
mov esi, eax
pop ecx
cmp esi, ebx
je 0x405572
mov eax, dword [esp + 0x18]
mov dword [esi + 8], eax
mov eax, dword [esp + 0x10]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 0x14]
mov dword [esi + 0x10], eax
mov eax, dword [ebp + 8]
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov dword [esi], eax
call fcn.0045432d
pop ecx
push eax
call fcn.0045431b
pop ecx
mov dword [0x495198], esi
mov dword [esp + 0xc], esi
jmp 0x405576
mov dword [esp + 0xc], ebx
push 0xa598
call fcn.00453217
pop ecx
cmp eax, ebx
je 0x40559b
push dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
push eax
call fcn.0040506f
mov esi, eax
mov dword [esp + 0x14], esi
jmp 0x4055a1
mov dword [esp + 0x14], ebx
mov esi, ebx
mov ecx, esi
call fcn.00420200
mov ecx, dword [esp + 0x10]
push eax
push edi
call fcn.00417780
lea ebx, [esi + 0xb6c]
mov edi, 0x479014
call fcn.00417000
mov byte [esp + 0x18], al
test al, al
jne 0x405701
mov edi, 0x479024
lea ebx, [esp + 0x2d8]
call fcn.00417000
test al, al
jne 0x405699
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x28]
test al, al
je 0x405699
push 4
call fcn.00453217
pop ecx
test eax, eax
je 0x405612
mov esi, eax
call fcn.00405926
mov esi, dword [esp + 0x14]
mov ebx, eax
jmp 0x405614
xor ebx, ebx
mov eax, dword [esp + 0xc]
mov dword [esp + 0xa8], eax
lea eax, [esp + 0xac]
mov dword [esp + 0x98], 0x47b178
mov dword [esp + 0xa4], esi
call fcn.004025a5
push ebx
push esi
lea eax, [esp + 0xa0]
lea esi, [esp + 0x30]
call fcn.00423b80
push dword [esp + 0xc]
mov edi, esi
push ebx
mov dword [esp + 0x30], vtable.ZonaInstalledAlreadyWizard.0
mov dword [esp + 0x34], vtable.ZonaInstalledAlreadyWizard.1.0
mov dword [esp + 0x6c], vtable.ZonaInstalledAlreadyWizard.2.0
call fcn.00405249
pop ecx
pop ecx
call fcn.004165d0
push ebx
call fcn.004531bb
pop ecx
call fcn.0042c3d0
lea ecx, [esp + 0x98]
call fcn.00405936
xor edi, edi
jmp 0x4054d5
mov edi, 0x47903c
lea ebx, [esp + 0x2d8]
call fcn.00417000
test al, al
jne 0x405701
lea esi, [esp + 0xc8]
call fcn.0040511d
push dword [esp + 0x1c]
lea eax, [esp + 0x80]
call fcn.004025cc
push 0x479060
push 0x47905c
lea eax, [esp + 0x84]
push eax
call fcn.0040260b
push eax
call fcn.0040260b
mov ebx, dword [esp + 0x10]
lea eax, [esp + 0x7c]
push eax
call fcn.00407370
pop ecx
lea ecx, [esp + 0x7c]
call fcn.004025fd
jmp 0x405692
mov edi, str._version
lea ebx, [esi + 0xb6c]
call fcn.00417000
test al, al
je 0x405727
mov edi, esi
call fcn.00420230
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x405692
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x10]
push 0x48
mov dword [esp + 0x20], eax
call fcn.00453217
pop ecx
test eax, eax
je 0x40574e
push dword [esp + 0x18]
mov ecx, esi
push eax
call fcn.00401966
mov edi, eax
jmp 0x405750
xor edi, edi
cmp byte [esp + 0x18], 0
je 0x4057ad
mov ecx, dword [esp + 0x10]
push 0x47b190
mov ebx, str.INFO
push ebx
mov dword [esp + 0x84], 0x47b4cc
mov dword [esp + 0x88], esi
mov dword [esp + 0x8c], edi
mov dword [esp + 0x90], ecx
call fcn.00417780
mov eax, dword [edi]
lea ecx, [esp + 0x7c]
push ecx
mov ecx, edi
mov byte [esp + 0x90], 0
call dword [eax + 0x18]
lea esi, [esp + 0x7c]
call fcn.00424930
jmp 0x40588e
mov dword [esp + 0xa4], esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0xac]
mov dword [esp + 0x98], 0x47b178
mov dword [esp + 0xa8], esi
call fcn.004025a5
push dword [esi + 0x10]
lea esi, [esp + 0x24]
call fcn.0040502a
push 0x68
call fcn.00453217
pop ecx
test eax, eax
je 0x405807
mov ebx, dword [esp + 0x14]
mov ecx, esi
push ecx
lea ecx, [esp + 0x9c]
push ecx
push eax
call fcn.0040409d
mov ebx, eax
jmp 0x405809
xor ebx, ebx
push 0x14
call fcn.00453217
pop ecx
test eax, eax
je 0x405835
mov ecx, dword [esp + 0x14]
mov dword [eax + 4], vtable.OffersReadyCallBack.0
mov dword [eax], vtable.PartnerPageCreator.0
mov dword [eax + 4], vtable.PartnerPageCreator.1.0
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ecx
jmp 0x405837
xor eax, eax
mov dword [esp + 0x18], eax
test eax, eax
je 0x405853
mov eax, dword [esp + 0xc]
call fcn.00405f1c
mov esi, eax
lea eax, [esp + 0x18]
call fcn.0044f830
push dword [esp + 0xc]
push edi
mov edi, ebx
call fcn.00405249
pop ecx
mov edi, eax
mov eax, dword [esp + 0x18]
pop ecx
push dword [edi + 4]
call fcn.00404ff4
mov esi, eax
call fcn.0043a060
mov eax, edi
call fcn.004165d0
lea ecx, [esp + 0x98]
call fcn.00405936
mov ebx, str.INFO
cmp dword [esp + 0x1c], 0
je 0x4058c2
mov ecx, dword [esp + 0x10]
push str.Start_wait_initVarThread_....
push ebx
call fcn.00417780
push 0x3a98
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esp + 0x10]
push str.End_wait_initVarThread
push ebx
call fcn.00417780
mov edi, dword [esp + 0x14]
mov esi, dword [edi + 0x14]
jmp 0x4058e6
push dword [esp + 0x10]
mov ecx, dword [esi]
mov eax, dword [ecx]
push 0x100
lea edx, [esp + 0x8500]
push edx
call dword [eax + 4]
add esi, 4
cmp esi, dword [edi + 0x18]
jne 0x4058cb
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [esp + 0x10]
push str.___END___
push ebx
call fcn.00417780
mov edi, dword [edi + 0xa88]
jmp 0x4054d5