Function at 0x4199ff
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x46dc83
mov eax, dword fs:[0]
push eax
sub esp, 0x190
mov eax, dword [0x486ba4]
xor eax, esp
mov dword [esp + 0x188], eax
push ebx
push esi
push edi
mov eax, dword [0x486ba4]
xor eax, esp
push eax
lea eax, [esp + 0x1a0]
mov dword fs:[0], eax
lea eax, [esp + 0x74]
push eax
call fcn.0040d5df
push 0x479474
xor ebx, ebx
push 0x6a
push ebx
mov dword [esp + 0x1b4], ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
cmp esi, ebx
je 0x419b14
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push ebx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [esp + 0x14], eax
cmp edi, ebx
je 0x419b14
cmp eax, ebx
je 0x419b14
push eax
push edi
call fcn.0040f366
mov esi, eax
xor ecx, ecx
push 2
pop edx
lea eax, [esi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0044b6ce
add esp, 0xc
push dword [esp + 0x14]
mov ebx, eax
push edi
call fcn.0040f366
pop ecx
pop ecx
push esi
push ebx
lea eax, [esp + 0xf0]
call fcn.0040de3a
push ebx
mov byte [esp + 0x1ac], 1
call fcn.0044c11c
cmp dword [esp + 0x104], 8
mov eax, dword [esp + 0xf0]
pop ecx
jae 0x419af6
lea eax, [esp + 0xec]
push eax
lea ebx, [esp + 0x78]
call fcn.0040eb54
test al, al
jne 0x419b4c
push 0
push 1
lea esi, [esp + 0xf0]
call fcn.00401e7e
or dword [esp + 0x1a8], 0xffffffff
lea eax, [esp + 0x74]
push eax
call fcn.0040d625
xor al, al
mov ecx, dword [esp + 0x1a0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x188]
xor ecx, esp
call fcn.0044bafb
mov esp, ebp
pop ebp
ret
xor ebx, ebx
push ecx
mov eax, esp
mov dword [esp + 0xb0], ebx
mov dword [esp + 0xb4], ebx
mov dword [esp + 0xb8], ebx
mov dword [esp + 0xc8], ebx
mov dword [esp + 0xcc], ebx
mov dword [esp + 0xc4], ebx
lea esi, [esp + 0x78]
mov dword [esp + 0x18], esp
mov dword [eax], str.Product
call fcn.0040eeca
cmp al, bl
jne 0x419b98
push ebx
jmp 0x419b06
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x30], esp
push str.ProductSkin
mov edi, 0x48a7bc
call fcn.004070e1
mov ecx, edi
lea edi, [esp + 0x90]
call fcn.0041c7c3
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x30], esp
mov ebx, 0x48a7d8
push str.ProductBrand
mov edi, ebx
call fcn.004070e1
mov ecx, edi
lea edi, [esp + 0x90]
call fcn.0041c7c3
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x30], esp
push 0x47a28c
mov edi, 0x48a7f4
call fcn.004070e1
mov ecx, edi
lea edi, [esp + 0x90]
call fcn.0041c7c3
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x30], esp
push str.ProductExe
mov edi, 0x48a810
call fcn.004070e1
mov ecx, edi
lea edi, [esp + 0x90]
call fcn.0041c7c3
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x30], esp
push ebx
call fcn.00401bcf
lea edi, [esp + 0x3c]
call fcn.00416c81
add esp, 0x1c
push 0xffffffffffffffff
push 0x48ac6c
xor ebx, ebx
mov byte [esp + 0x1b0], 2
call fcn.00401df6
push ebx
push 1
mov esi, edi
mov byte [esp + 0x1b0], 1
call fcn.00401e7e
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x30], esp
mov ebx, 0x48a848
push str.ProductID
mov edi, ebx
call fcn.004070e1
mov ecx, edi
lea edi, [esp + 0x90]
call fcn.0041c7c3
push str.WAE_DOWNTASK_
lea eax, [esp + 0x40]
push 0x48ac6c
push eax
call fcn.0040454f
add esp, 0xc
push ebx
push eax
lea eax, [esp + 0x60]
push eax
mov byte [esp + 0x1b4], 3
call fcn.00411c5b
add esp, 0xc
push str..xml
push eax
lea eax, [esp + 0x28]
push eax
mov byte [esp + 0x1b4], 4
call fcn.0040454f
add esp, 0xc
push 0xffffffffffffffff
push 0x48ac88
xor ebx, ebx
mov byte [esp + 0x1b0], 5
call fcn.00401df6
push ebx
push 1
lea esi, [esp + 0x28]
call fcn.00401e7e
push ebx
push 1
lea esi, [esp + 0x60]
call fcn.00401e7e
push ebx
push 1
lea esi, [esp + 0x44]
mov byte [esp + 0x1b0], 1
call fcn.00401e7e
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x30], esp
push str.AppID
mov edi, 0x48a864
call fcn.004070e1
mov ecx, edi
lea edi, [esp + 0x90]
call fcn.0041c7c3
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x30], esp
push str.Channel
mov edi, 0x48a880
call fcn.004070e1
mov ecx, edi
lea edi, [esp + 0x90]
call fcn.0041c7c3
xor eax, eax
cmp dword [esp + 0xb0], ebx
push ecx
setne al
mov dword [esp + 0xb8], ebx
mov dword [esp + 0xc8], ebx
mov dword [esp + 0xcc], ebx
mov dword [esp + 0x18], esp
mov dword [esp + 0xc4], eax
mov eax, esp
mov dword [eax], str.Downurl
mov eax, edi
call fcn.0040ef1f
cmp al, bl
je 0x419e12
mov eax, edi
call fcn.0040f526
test al, al
je 0x419e12
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x30], esp
push str.OnlyUseLocalUrl
mov edi, 0x48a8b8
call fcn.004070e1
mov ecx, edi
lea edi, [esp + 0x90]
call fcn.0041c7c3
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x30], esp
push str.Url_Down
mov edi, 0x48a8d4
call fcn.004070e1
mov ecx, edi
lea edi, [esp + 0x90]
call fcn.0041c7c3
mov eax, edi
call fcn.0040f558
xor eax, eax
cmp dword [esp + 0xb0], ebx
mov dword [esp + 0xb4], ebx
setne al
mov dword [esp + 0xc4], ebx
mov dword [esp + 0xc8], ebx
mov dword [esp + 0xc0], eax
call fcn.00416dc2
test eax, eax
je 0x419ebd
push ecx
mov eax, esp
mov dword [eax], str.Downurl_x64
lea eax, [esp + 0x78]
mov dword [esp + 0x18], esp
call fcn.0040ef1f
cmp al, bl
je 0x419ebd
lea eax, [esp + 0x74]
call fcn.0040f526
test al, al
je 0x419ebd
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x30], esp
push str.OnlyUseLocalUrl
mov edi, 0x48a8f0
call fcn.004070e1
mov ecx, edi
lea edi, [esp + 0x90]
call fcn.0041c7c3
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x30], esp
push str.Url_Down
mov edi, 0x48a90c
call fcn.004070e1
mov ecx, edi
lea edi, [esp + 0x90]
call fcn.0041c7c3
mov eax, edi
call fcn.0040f558
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x30], esp
push str.InstallTime
mov edi, 0x48a9d0
call fcn.004070e1
mov ecx, edi
lea edi, [esp + 0x90]
call fcn.0041c7c3
xor eax, eax
cmp dword [esp + 0xb0], ebx
push ecx
setne al
mov dword [esp + 0xb8], ebx
mov dword [esp + 0xc8], ebx
mov dword [esp + 0xcc], ebx
mov dword [esp + 0x18], esp
mov dword [esp + 0xc4], eax
mov eax, esp
mov dword [eax], str.Installurl
mov eax, edi
call fcn.0040ef1f
cmp al, bl
je 0x419f81
mov eax, edi
call fcn.0040f526
test al, al
je 0x419f81
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x30], esp
push str.OnlyUseLocalUrl
mov edi, 0x48a960
call fcn.004070e1
mov ecx, edi
lea edi, [esp + 0x90]
call fcn.0041c7c3
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x30], esp
push str.Url_Install
mov edi, 0x48a97c
call fcn.004070e1
mov ecx, edi
lea edi, [esp + 0x90]
call fcn.0041c7c3
mov eax, edi
call fcn.0040f558
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x30], esp
push str.Url_License
mov edi, 0x48a9b4
call fcn.004070e1
mov ecx, edi
lea edi, [esp + 0x90]
call fcn.0041c7c3
cmp dword [0x48a9c8], ebx
jne 0x419fbe
push str.http:__pop.wondershare.com_license.html
push 0x48a9b4
call fcn.00403f75
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x30], esp
push str.Languages
mov edi, 0x48a998
call fcn.004070e1
mov ecx, edi
lea edi, [esp + 0x90]
call fcn.0041c7c3
cmp dword [0x48a9ac], ebx
jne 0x419ffb
push str.English_Deutsch_Fran
push 0x48a998
call fcn.00403f75
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x30], esp
push str.Dotnetminver
mov edi, 0x48a928
call fcn.004070e1
mov ecx, edi
lea edi, [esp + 0x90]
call fcn.0041c7c3
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x30], esp
push str.Dotneturl
mov edi, 0x48a944
call fcn.004070e1
mov ecx, edi
lea edi, [esp + 0x90]
call fcn.0041c7c3
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x30], esp
push str.AgreeUserLicense
mov edi, 0x48a9ec
call fcn.004070e1
mov ecx, edi
lea edi, [esp + 0x90]
call fcn.0041c7c3
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x30], esp
push str.StartupProduct
mov edi, 0x48aa08
call fcn.004070e1
mov ecx, edi
lea edi, [esp + 0x90]
call fcn.0041c7c3
xor eax, eax
cmp dword [esp + 0xb0], ebx
push ecx
setne al
mov dword [esp + 0xb8], ebx
mov dword [esp + 0xc8], ebx
mov dword [esp + 0xcc], ebx
mov dword [esp + 0x18], esp
mov dword [esp + 0xc4], eax
mov eax, esp
mov dword [eax], str.Dependent
mov eax, edi
call fcn.0040ef1f
cmp al, bl
je 0x41a281
mov eax, edi
call fcn.0040f526
test al, al
je 0x41a281
push ecx
mov eax, esp
mov dword [eax], str.item
lea eax, [esp + 0x78]
mov dword [esp + 0x18], esp
call fcn.0040ef1f
cmp al, bl
lea eax, [esp + 0x74]
je 0x41a27c
call fcn.0040f526
test al, al
je 0x41a0e6
xor eax, eax
lea esi, [esp + 0x120]
mov dword [esp + 0x11c], 7
mov dword [esp + 0x118], ebx
mov word [esp + 0x108], ax
call fcn.00401bbc
lea esi, [esp + 0x13c]
call fcn.00401bbc
lea esi, [esp + 0x158]
call fcn.00401bbc
lea esi, [esp + 0x174]
call fcn.00401bbc
sub esp, 0x1c
mov byte [esp + 0x1c4], 6
mov esi, esp
mov dword [esp + 0x30], esp
push str.ProductID
lea edi, [esp + 0x124]
call fcn.004070e1
mov ecx, edi
lea edi, [esp + 0x90]
call fcn.0041c7c3
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x30], esp
push 0x47a28c
lea edi, [esp + 0x140]
call fcn.004070e1
mov ecx, edi
lea edi, [esp + 0x90]
call fcn.0041c7c3
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x30], esp
push str.ProductExe
lea edi, [esp + 0x15c]
call fcn.004070e1
mov ecx, edi
lea edi, [esp + 0x90]
call fcn.0041c7c3
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x30], esp
push str.Url_Down
lea edi, [esp + 0x178]
call fcn.004070e1
mov ecx, edi
lea edi, [esp + 0x90]
call fcn.0041c7c3
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x30], esp
push str.Url_Downx64
lea edi, [esp + 0x194]
call fcn.004070e1
mov ecx, edi
lea edi, [esp + 0x90]
call fcn.0041c7c3
cmp dword [esp + 0x118], ebx
je 0x41a25a
cmp dword [esp + 0x16c], ebx
jne 0x41a248
cmp dword [esp + 0x188], ebx
je 0x41a25a
lea eax, [esp + 0x104]
push eax
mov esi, 0x48aa24
call fcn.0041c8a5
lea eax, [esp + 0x74]
call fcn.0040f558
lea edi, [esp + 0x104]
mov byte [esp + 0x1a8], 1
call fcn.0041a40b
jmp 0x41a0e6
call fcn.0040f558
cmp dword [0x48a860], 8
mov eax, dword [0x48a84c]
jae 0x41a294
mov eax, 0x48a84c
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
push ecx
call fcn.00402676
cmp dword [0x48a898], 8
mov eax, dword [0x48a884]
jae 0x41a2b5
mov eax, 0x48a884
cmp dword [0x48a87c], 8
mov ecx, dword [0x48a868]
jae 0x41a2c9
mov ecx, 0x48a868
push eax
call fcn.0041d852
sub esp, 0x14
mov esi, esp
mov dword [esp + 0x30], esp
push 0x48a848
call fcn.00401bcf
sub esp, 0x1c
mov byte [esp + 0x1e0], 7
mov esi, esp
mov dword [esp + 0x50], esp
push 0x479b10
call fcn.004070e1
mov byte [esp + 0x1e0], 1
call fcn.00413cd2
sub esp, 0x1c
mov edi, esp
mov dword [esp + 0x34], esp
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x4c], esp
push 0x48a7d8
call fcn.00401bcf
mov ecx, edi
call fcn.0041719b
mov byte [esp + 0x1e0], 8
mov esi, esp
mov dword [esp + 0x4c], esp
push 0x479b28
call fcn.004070e1
mov byte [esp + 0x1e0], 1
call fcn.00413cd2
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x34], esp
push 0x48a880
call fcn.00401bcf
sub esp, 0x1c
mov byte [esp + 0x1e0], 9
mov esi, esp
mov dword [esp + 0x4c], esp
push str.channel
call fcn.004070e1
mov byte [esp + 0x1e0], 1
call fcn.00413cd2
lea ecx, [esp + 0x14]
call fcn.0041da18
sub esp, 0x1c
mov byte [esp + 0x1c4], 0xa
mov eax, dword [eax]
mov esi, esp
mov dword [esp + 0x34], esp
push eax
call fcn.004070e1
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x54], esp
push str.defchannel
mov byte [esp + 0x1e4], 0xb
call fcn.004070e1
mov byte [esp + 0x1e0], 0xa
call fcn.00413cd2
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
call fcn.004026f8
push ebx
push 1
lea esi, [esp + 0xf0]
call fcn.00401e7e
or dword [esp + 0x1a8], 0xffffffff
lea eax, [esp + 0x74]
push eax
call fcn.0040d625
mov al, 1
jmp 0x419b28