Function at 0x41eade
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x425224
call fcn.00421088
sub esp, 0x58
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
cmp esi, 0xf
je 0x41edeb
cmp esi, 0x318
je 0x41edfa
cmp esi, 1
jne 0x41ed54
push 0xc
call sub.gdiplus.dll_GdipAlloc
mov dword [ebp + 0x14], eax
mov dword [ebp - 4], 2
test eax, eax
je 0x41eb31
push 0x434a40
push eax
call fcn.00406b3c
jmp 0x41eb33
xor eax, eax
or dword [ebp - 4], 0xffffffff
push 0xcc8a28
mov dword [0x435fb8], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push 0xc
mov dword [0x436138], eax
call fcn.0040ea8f
pop ecx
mov dword [ebp + 0x14], eax
mov dword [ebp - 4], 3
mov edi, dword [ebp + 8]
test eax, eax
je 0x41eb75
push dword [edi + 0x218]
push 0x7f
push eax
call fcn.00406f6a
jmp 0x41eb77
xor eax, eax
or dword [ebp - 4], 0xffffffff
push 0xa
pop esi
mov ebx, 0x640
push ebx
mov dword [edi + 0x238], eax
call fcn.0040ea8f
pop ecx
mov dword [ebp + 0x14], eax
mov dword [ebp - 4], 4
test eax, eax
je 0x41ebc5
fld dword [0x42bc80]
push 0x66
pop ecx
push ecx
push esi
push ecx
fstp dword [esp]
push 0xffffff
push 0x64
push str.Make_Dogpile.com_my_default_search_provider
push dword [ebp + 0xc]
mov ecx, eax
call fcn.004080a9
jmp 0x41ebc7
xor eax, eax
or dword [ebp - 4], 0xffffffff
mov dword [edi + 0x23c], eax
mov eax, dword [eax + 0x618]
push 0x1628
mov dword [edi + 0x234], eax
mov esi, 0x19a
call fcn.0040ea8f
pop ecx
mov dword [ebp + 0x14], eax
mov dword [ebp - 4], 5
test eax, eax
je 0x41ec25
fld dword [0x42bc80]
push 0xffffff
push ecx
fstp dword [esp]
push 0x67
push 0x66
pop ecx
push ecx
mov ecx, dword [ebp + 0xc]
push esi
push str.http:__www.freecause.com_privacy
push str.Click_Here_to_See_the_Privacy_Policy
mov edx, eax
call fcn.0040796a
or dword [ebp - 4], 0xffffffff
push 0x429944
push 0x80
push dword [edi + 0x218]
mov dword [ebp - 0x14], 0xa
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push dword [edi + 0x218]
mov dword [ebp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push dword [ebp + 0x14]
mov esi, eax
push dword [edi + 0x218]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add esi, 3
mov dword [ebp + 8], eax
je 0x41ec88
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
cmp eax, 0x3fffffff
mov dword [ebp + 0x14], eax
jle 0x41ec8c
xor eax, eax
jmp 0x41eca2
add eax, eax
call fcn.00417cb0
mov eax, esp
push 3
push dword [ebp + 0x14]
push esi
mov esi, eax
call fcn.00401043
mov edx, dword [ebp + 8]
xor ecx, ecx
push ecx
mov word [eax + edx*2 - 6], cx
push dword [edi + 0x218]
push 0x65
push dword [ebp + 0xc]
push 0xa0
push 0x278
push 0x7d
push 0xc
push 0x503008c4
push eax
push str.EDIT
push 0x200
call dword [sym.imp.USER32.dll_CreateWindowExW]
push ebx
mov dword [ebp + 0x14], eax
mov esi, 0x122
call fcn.0040ea8f
pop ecx
mov dword [ebp + 8], eax
mov dword [ebp - 4], 6
test eax, eax
je 0x41ed1f
fld dword [0x42bc80]
push esi
push dword [ebp - 0x14]
push ecx
fstp dword [esp]
push 0xffffff
push 0x66
push str.I_accept_the_terms_of_the_agreement_and_want_to_install_the_Dogpile_toolbar
push dword [ebp + 0xc]
mov ecx, eax
call fcn.004080a9
jmp 0x41ed21
xor eax, eax
or dword [ebp - 4], 0xffffffff
mov dword [edi + 0x240], eax
mov eax, dword [eax + 0x618]
push 0x11
mov dword [edi + 0x230], eax
call dword [sym.imp.GDI32.dll_GetStockObject]
push 0
push eax
push 0x30
push dword [ebp + 0x14]
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
jmp 0x41eeab
cmp esi, 0x138
jne 0x41ed8d
push 0xffffff
push dword [ebp + 0x14]
call dword [sym.imp.GDI32.dll_SetBkColor]
push 0
push dword [ebp + 0x14]
call dword [sym.imp.GDI32.dll_SetTextColor]
push 1
push dword [ebp + 0x14]
call dword [sym.imp.GDI32.dll_SetBkMode]
push 0
call dword [sym.imp.GDI32.dll_GetStockObject]
jmp 0x41eeab
cmp esi, 0x111
jne 0x41edd2
cmp word [ebp + 0x14], 0x66
jne 0x41edbd
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x23c]
mov ecx, dword [ecx + 0x240]
mov cl, byte [ecx + 0x63c]
push eax
mov byte [eax + 0x63d], cl
call fcn.00408074
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push esi
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_DefWindowProcW]
jmp 0x41eeab
cmp esi, 0x21
jne 0x41edbd
mov eax, dword [ebp + 8]
cmp byte [eax + 0x44c], 0
je 0x41edbd
push 4
pop eax
jmp 0x41eeab
lea eax, [ebp - 0x64]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_BeginPaint]
jmp 0x41edfd
mov eax, dword [ebp + 0x14]
push eax
lea esi, [ebp - 0x14]
call fcn.00406be7
xor ebx, ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_GetClientRect]
push 0xc
call sub.gdiplus.dll_GdipAlloc
mov dword [ebp + 0x14], eax
mov byte [ebp - 4], 1
cmp eax, ebx
je 0x41ee39
push 0x434a40
push eax
call fcn.00406b3c
mov edi, eax
jmp 0x41ee3b
xor edi, edi
mov byte [ebp - 4], 0
push dword [ebp - 0x18]
mov eax, edi
push dword [ebp - 0x1c]
lea esi, [ebp - 0x14]
call fcn.00406c11
cmp edi, ebx
je 0x41ee5b
mov eax, dword [edi]
push 1
mov ecx, edi
call dword [eax]
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x238]
mov esi, dword [eax + 4]
call fcn.00406e82
push eax
mov eax, dword [edi + 0x238]
mov esi, dword [eax + 4]
call fcn.00406e62
push eax
mov eax, dword [edi + 0x238]
mov eax, dword [eax + 4]
push ebx
push ebx
lea esi, [ebp - 0x14]
call fcn.00406ce4
lea eax, [ebp - 0x64]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_EndPaint]
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x14]
call sub.gdiplus.dll_GdipDeleteGraphics
xor eax, eax
inc eax
lea esp, [ebp - 0x70]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 0x14