Function at 0x41f10a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x42525e
call fcn.00421088
sub esp, 0x58
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
cmp edi, 0xf
je 0x41f4da
cmp edi, 0x318
je 0x41f4e9
cmp edi, 1
jne 0x41f3e4
push 0xc
call fcn.0040ea8f
pop ecx
mov dword [ebp + 0x14], eax
mov dword [ebp - 4], 2
mov edi, dword [ebp + 8]
xor ebx, ebx
cmp eax, ebx
je 0x41f166
push dword [edi + 0x218]
push 0x70
push eax
call fcn.00406f6a
jmp 0x41f168
xor eax, eax
or dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x23c], eax
call fcn.0040ea8f
pop ecx
mov dword [ebp + 0x14], eax
mov dword [ebp - 4], 3
cmp eax, ebx
je 0x41f198
push dword [edi + 0x218]
push 0x7a
push eax
call fcn.00406f6a
jmp 0x41f19a
xor eax, eax
or dword [ebp - 4], 0xffffffff
push ebx
push dword [edi + 0x218]
mov esi, dword [sym.imp.USER32.dll_CreateWindowExW]
push 0xc8
push dword [ebp + 0xc]
mov dword [edi + 0x240], eax
push 0xf
push 0x1f4
push 0x68
push 0x14
push 0x50000000
push str.Toolbar_installs_in_the_majority_of_browsers._Features_and_appearance_may_vary_by_version_or_browser.
push str.STATIC
push ebx
call esi
push ebx
push dword [edi + 0x218]
mov dword [ebp + 0x10], eax
push 0x64
push dword [ebp + 0xc]
push 0xf
push 0x12c
push 0x7b
push 0x14
push 0x50000003
push str.Make_Ask_my_browser_default_search_provider.
push str.BUTTON
push ebx
call esi
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push 1
push 0xf1
push eax
mov dword [edi + 0x238], eax
call ebx
push 0x429944
push 0x7b
push dword [edi + 0x218]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push dword [edi + 0x218]
mov dword [ebp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push dword [ebp + 0x18]
mov dword [ebp + 0x14], eax
push dword [edi + 0x218]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp + 8], eax
xor eax, eax
cmp dword [ebp + 0x14], eax
je 0x41f293
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
cmp eax, 0x3fffffff
mov dword [ebp + 0x18], eax
jle 0x41f277
xor eax, eax
jmp 0x41f293
add eax, eax
call fcn.00417cb0
mov esi, esp
push 3
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00401043
mov esi, dword [sym.imp.USER32.dll_CreateWindowExW]
mov edx, dword [ebp + 8]
xor ecx, ecx
push ecx
mov word [eax + edx*2], cx
push dword [edi + 0x218]
push 0x65
push dword [ebp + 0xc]
push 0x87
push 0x267
push 0x8f
push 0x14
push 0x503008c4
push eax
push str.EDIT
push 0x200
call esi
push 0
push dword [edi + 0x218]
mov dword [ebp + 0x14], eax
push 0x66
push dword [ebp + 0xc]
push 0x11
push 0x258
push 0x117
push 0x14
push 0x50000003
push str.I_accept_the_terms_of_the_End_User_License_Agreement_and_Privacy_Policy_and_want_to_install_the_free_Ask_Toolbar.
push str.BUTTON
push 0
call esi
push 0
push 1
push 0xf1
push eax
mov dword [edi + 0x230], eax
call ebx
push 0
push dword [edi + 0x218]
push 0x67
push dword [ebp + 0xc]
push 0x11
push 0x12c
push 0x12b
push 0x14
push 0x50000003
push str.Set_Ask_as_my_Start_Page_and_new_tabs_page.
push str.BUTTON
push 0
call esi
push 0
push 1
push 0xf1
push eax
mov dword [edi + 0x234], eax
call ebx
push 0x1628
mov esi, 0x21c
call fcn.0040ea8f
pop ecx
mov dword [ebp + 0x18], eax
mov dword [ebp - 4], 4
test eax, eax
je 0x41f396
fld dword [0x42bc80]
push 0xff0000
push ecx
fstp dword [esp]
push 0
push 0x6b
pop ecx
push ecx
mov ecx, dword [ebp + 0xc]
push esi
push str.http:__about.ask.com_en_docs_about_privacy.shtml
push str.Privacy_Policy
mov edx, eax
call fcn.0040796a
or dword [ebp - 4], 0xffffffff
push 0x11
call dword [sym.imp.GDI32.dll_GetStockObject]
push 0
mov esi, eax
push esi
push 0x30
push dword [edi + 0x238]
call ebx
push 0
push esi
push 0x30
push dword [edi + 0x230]
call ebx
push 0
push esi
push 0x30
push dword [ebp + 0x10]
call ebx
push 0
push esi
push 0x30
push dword [edi + 0x234]
call ebx
push 0
push esi
push 0x30
push dword [ebp + 0x14]
call ebx
jmp 0x41f597
cmp edi, 0x138
jne 0x41f46b
push dword [ebp + 0x18]
mov esi, dword [sym.imp.USER32.dll_GetDlgCtrlID]
call esi
cmp eax, 0x65
je 0x41f43a
mov edi, dword [ebp + 0x14]
push 0xcdbbba
push edi
call dword [sym.imp.GDI32.dll_SetBkColor]
push dword [ebp + 0x18]
call esi
cmp eax, 0xc8
jne 0x41f41b
push 0
jmp 0x41f420
push 0xffffff
push edi
call dword [sym.imp.GDI32.dll_SetTextColor]
push 1
push edi
call dword [sym.imp.GDI32.dll_SetBkMode]
mov eax, dword [0x436134]
jmp 0x41f599
push 0xffffff
push dword [ebp + 0x14]
call dword [sym.imp.GDI32.dll_SetBkColor]
push 0
push dword [ebp + 0x14]
call dword [sym.imp.GDI32.dll_SetTextColor]
push 2
push dword [ebp + 0x14]
call dword [sym.imp.GDI32.dll_SetBkMode]
push 0
call dword [sym.imp.GDI32.dll_GetStockObject]
jmp 0x41f599
cmp edi, 0x111
jne 0x41f4c1
cmp word [ebp + 0x14], 0x66
jne 0x41f4ac
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0
push 0xf0
push 0x66
push dword [ebp + 0xc]
call esi
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
dec eax
neg eax
sbb eax, eax
inc eax
push eax
push 0x64
push dword [ebp + 0xc]
call esi
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push edi
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_DefWindowProcW]
jmp 0x41f599
cmp edi, 0x21
jne 0x41f4ac
mov eax, dword [ebp + 8]
cmp byte [eax + 0xa64], 0
je 0x41f4ac
push 4
pop eax
jmp 0x41f599
lea eax, [ebp - 0x64]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_BeginPaint]
jmp 0x41f4ec
mov eax, dword [ebp + 0x14]
push eax
lea esi, [ebp - 0x14]
call fcn.00406be7
xor ebx, ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_GetClientRect]
push 0xc
call sub.gdiplus.dll_GdipAlloc
mov dword [ebp + 0x14], eax
mov byte [ebp - 4], 1
cmp eax, ebx
je 0x41f528
push 0x434a3c
push eax
call fcn.00406b3c
mov edi, eax
jmp 0x41f52a
xor edi, edi
mov byte [ebp - 4], 0
push dword [ebp - 0x18]
mov eax, edi
push dword [ebp - 0x1c]
lea esi, [ebp - 0x14]
call fcn.00406c11
cmp edi, ebx
je 0x41f54a
mov eax, dword [edi]
push 1
mov ecx, edi
call dword [eax]
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x240]
mov esi, dword [eax + 4]
call fcn.00406e82
push eax
mov eax, dword [edi + 0x240]
mov esi, dword [eax + 4]
call fcn.00406e62
push eax
mov eax, dword [edi + 0x240]
mov eax, dword [eax + 4]
push ebx
push ebx
lea esi, [ebp - 0x14]
call fcn.00406ce4
lea eax, [ebp - 0x64]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_EndPaint]
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x14]
call sub.gdiplus.dll_GdipDeleteGraphics
xor eax, eax
lea esp, [ebp - 0x70]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 0x14