Function at 0x419697
Capabilities:
Create process on windows
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4250ba
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x1134
call fcn.00416990
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
cmp eax, 0xf
je 0x419a38
cmp eax, 0x318
je 0x419a48
xor edi, edi
inc edi
cmp eax, edi
jne 0x41993f
push 0x78
pop esi
push 0x640
call fcn.0040ea8f
pop ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x114c], edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
cmp eax, ebx
je 0x419727
fld dword [0x42bc84]
mov ecx, 0x118
push ecx
push esi
push ecx
fstp dword [esp]
push ebx
push 0x64
push str.Enable_ArcadeCandy_in_all_browsers
push edi
mov ecx, eax
call fcn.004080a9
jmp 0x419729
xor eax, eax
or dword [esp + 0x114c], 0xffffffff
mov esi, dword [ebp + 8]
push 0x1628
mov dword [esi + 0x230], eax
call fcn.0040ea8f
pop ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x114c], 2
cmp eax, ebx
je 0x419787
fld dword [0x42bc84]
push 0xff0000
push ecx
fstp dword [esp]
push ebx
mov ecx, 0x118
push ecx
mov ecx, 0x19f
push ecx
push str.http:__www.arcadecandy.com_BrowserOptimization.ac
push str.Learn_more
mov ecx, edi
mov edx, eax
call fcn.0040796a
or dword [esp + 0x114c], 0xffffffff
push str.msftedit.dll
mov dword [esp + 0x14], str.RichEdit20W
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x4197b0
mov dword [esp + 0x10], str.RICHEDIT50W
jmp 0x4197bb
push str.RichEd20.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea eax, [esp + 0x20]
push eax
push edi
call dword [sym.imp.USER32.dll_GetClientRect]
sub dword [esp + 0x2c], 0x78
sub dword [esp + 0x28], 0x14
push ebx
push dword [esi + 0x218]
push 0xc8
push edi
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push 0x3c
push 0xa
push 0x50201944
push 0x427ffc
push dword [esp + 0x38]
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 0x429944
push 0x78
push dword [esi + 0x218]
mov edi, eax
mov dword [esp + 0x20], edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push dword [esi + 0x218]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push ebx
push 1
push 0x45b
push edi
mov dword [esp + 0x20], eax
call esi
push 0x4000000
push ebx
push 0x445
push edi
call esi
push ebx
push 0x30
push 0x466
push edi
call esi
or dword [esp + 0x1c], 0xffffffff
push 0xbc
lea eax, [esp + 0x84]
push ebx
push eax
mov dword [esp + 0x24], ebx
call fcn.0040cdd0
add esp, 0xc
push 4
pop eax
push dword [esp + 0x10]
mov dword [esp + 0x84], 0xbc
push edi
mov dword [esp + 0x8c], 8
mov word [esp + 0xa0], ax
call dword [sym.imp.USER32.dll_SetWindowTextW]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_FreeResource]
push 1
push 1
push 0x4ca
push edi
call esi
lea eax, [esp + 0x18]
push eax
push ebx
push 0x437
push edi
call esi
lea eax, [esp + 0x80]
push eax
push ebx
push 0x447
push edi
call esi
mov byte [esp + 0x30], bl
push 0x60
pop eax
lea edi, [esp + 0x30]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
call fcn.0040760f
push 0x60
push dword [esp + 0x38]
push 0xc
call dword [sym.imp.KERNEL32.dll_MulDiv]
push 0xc
pop ecx
push ebx
sub ecx, eax
push ecx
push 0x4df
push dword [esp + 0x20]
call esi
lea eax, [esp + 0x18]
push eax
push ebx
push 0x437
push dword [esp + 0x20]
mov dword [esp + 0x2c], ebx
call esi
push 0xffffff
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x23c], eax
mov byte [ecx + 0x22c], bl
jmp 0x419b21
mov esi, dword [ebp + 0x18]
cmp eax, 0x4e
jne 0x4199cc
xor ebx, ebx
cmp esi, ebx
je 0x419a25
cmp dword [esi + 0xc], 0x202
jne 0x419a25
xor eax, eax
push 0xffe
mov word [esp + 0x144], ax
lea eax, [esp + 0x146]
push ebx
push eax
call fcn.0040cdd0
lea eax, [esp + 0x14c]
mov dword [esp + 0x44], eax
mov eax, dword [esi + 0x18]
mov dword [esp + 0x3c], eax
mov eax, dword [esi + 0x1c]
add esp, 0xc
mov dword [esp + 0x34], eax
lea eax, [esp + 0x30]
push eax
push ebx
push 0x44b
push dword [esi]
call dword [sym.imp.USER32.dll_SendMessageW]
push edi
push ebx
push ebx
lea eax, [esp + 0x14c]
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, edi
jmp 0x419b23
cmp eax, 0x138
jne 0x419a0c
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
push edi
push esi
call dword [sym.imp.GDI32.dll_SetBkMode]
push 0xffffff
push esi
call dword [sym.imp.GDI32.dll_SetBkColor]
push 0xff00ff
push esi
call dword [sym.imp.GDI32.dll_SetTextColor]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x23c]
jmp 0x419b23
cmp eax, 0x21
jne 0x419a25
mov ecx, dword [ebp + 8]
cmp byte [ecx + 0x22c], 0
je 0x419a25
push 4
pop eax
jmp 0x419b23
push esi
push dword [ebp + 0x14]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_DefWindowProcW]
jmp 0x419b23
lea eax, [esp + 0x40]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_BeginPaint]
jmp 0x419a4b
mov eax, dword [ebp + 0x14]
push eax
lea esi, [esp + 0x1c]
call fcn.00406be7
xor ebx, ebx
mov dword [esp + 0x114c], ebx
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x238]
mov esi, dword [eax + 4]
call fcn.00406e82
push eax
mov eax, dword [edi + 0x238]
mov esi, dword [eax + 4]
call fcn.00406e62
push eax
mov eax, dword [edi + 0x238]
mov eax, dword [eax + 4]
push ebx
push ebx
lea esi, [esp + 0x28]
call fcn.00406ce4
fld dword [0x42bc80]
fstp dword [esp + 0x20]
sub esp, 0x10
fld dword [0x42bc7c]
mov edi, esp
fstp dword [esp + 0x34]
lea esi, [esp + 0x30]
fld dword [0x42bc78]
or eax, 0xffffffff
fstp dword [esp + 0x38]
push eax
fld dword [0x42bc74]
mov ecx, 0xff000000
fstp dword [esp + 0x40]
movsd dword es:[edi], dword [esi]
fld1
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push ecx
movsd dword es:[edi], dword [esi]
fstp dword [esp]
fld dword [0x42bc70]
push ecx
push ecx
lea eax, [esp + 0x38]
fstp dword [esp]
push str.ArcadeCandy_End_User_Software_License_Terms
push eax
call fcn.0040a2de
add esp, 0x28
lea eax, [esp + 0x30]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_GetClientRect]
lea eax, [esp + 0x40]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_EndPaint]
or dword [esp + 0x114c], 0xffffffff
push dword [esp + 0x18]
call sub.gdiplus.dll_GdipDeleteGraphics
xor eax, eax
mov ecx, dword [esp + 0x1144]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x14