Function at 0x5b1aad
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
xor ebx, ebx
mov byte [esp + 0xf], bl
push edi
cmp esi, 0x17
je 0x5b1ae7
test esi, 0xffff0000
je 0x5b1aec
push 0x71f10c
push esi
call fcn.0043bbd7
test eax, eax
je 0x5b1ae7
push 0x71f114
push esi
call fcn.0043bbd7
test eax, eax
jne 0x5b1aec
mov byte [esp + 0x13], 1
push esi
push dword [esp + 0x1c]
push 0
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
mov ebp, eax
mov dword [esp + 0x1c], ebp
test ebp, ebp
je 0x5b1cd4
push ebp
push 0
call dword [sym.imp.KERNEL32.DLL_LoadResource]
test eax, eax
je 0x5b1cd4
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov edi, eax
mov dword [esp + 0x18], edi
cmp esi, 2
jne 0x5b1b7f
mov ebp, dword [esp + 0x20]
push 0xe
pop esi
mov eax, dword [ebp]
add eax, esi
push eax
call fcn.004513b4
push dword [ebp]
mov ebx, eax
push edi
lea eax, [ebx + 0xe]
push eax
call fcn.006661f0
add esp, 0xc
xor edi, edi
push dword [esp + 0x1c]
push edi
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
add eax, esi
mov dword [ebp], eax
mov eax, 0x4d42
mov dword [ebx + 2], edi
mov dword [ebx + 6], edi
mov dword [ebx + 0xa], edi
mov word [ebx], ax
mov eax, dword [ebp]
mov dword [ebx + 2], eax
mov dword [ebx + 0xa], esi
jmp 0x5b1ca8
cmp esi, 0xe
jne 0x5b1c8f
mov ebp, dword [esp + 0x20]
xor esi, esi
push 6
pop eax
mov ecx, eax
mov dword [ebp], eax
xor eax, eax
cmp ax, word [edi + 4]
jae 0x5b1bba
lea edx, [edi + 0xe]
mov eax, dword [ebp]
mov ecx, dword [edx]
add eax, 0x10
add ecx, eax
lea edx, [edx + 0xe]
mov dword [ebp], ecx
inc esi
movzx eax, word [edi + 4]
cmp esi, eax
jl 0x5b1ba1
push ecx
call fcn.004513b4
mov ecx, dword [edi]
lea edx, [edi + 6]
and dword [esp + 0x1c], 0
mov ebx, eax
xor eax, eax
mov dword [ebx], ecx
mov cx, word [edi + 4]
mov word [ebx + 4], cx
lea ecx, [ebx + 6]
cmp ax, word [edi + 4]
jae 0x5b1c04
mov ebp, dword [esp + 0x1c]
mov esi, edx
mov edi, ecx
inc ebp
add edx, 0xe
add ecx, 0x10
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, dword [esp + 0x18]
movzx eax, word [edi + 4]
cmp ebp, eax
jl 0x5b1be5
mov ebp, dword [esp + 0x20]
movzx eax, word [ebx + 4]
xor ecx, ecx
and dword [esp + 0x1c], 0
mov esi, eax
shl esi, 4
add esi, 6
cmp cx, ax
jae 0x5b1ca8
lea eax, [ebx + 0x12]
add edi, 0xe
mov dword [esp + 0x20], eax
movzx eax, word [edi + 4]
push 3
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
test eax, eax
je 0x5b1c7f
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_LoadResource]
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov ecx, dword [esp + 0x20]
mov dword [ecx], esi
push dword [edi]
push eax
lea eax, [esi + ebx]
push eax
call fcn.006661f0
add esi, dword [edi]
add esp, 0xc
mov ecx, dword [esp + 0x1c]
add edi, 0xe
movzx eax, word [ebx + 4]
inc ecx
add dword [esp + 0x20], 0x10
mov dword [esp + 0x1c], ecx
cmp ecx, eax
jl 0x5b1c2a
jmp 0x5b1ca8
and dword [ebp], 0
push 1
push ebx
call fcn.004513a7
xor eax, eax
jmp 0x5b1cd6
push ebp
push 0
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov ebp, dword [esp + 0x20]
push eax
push edi
mov dword [ebp], eax
call fcn.004bfd18
mov ebx, eax
cmp byte [esp + 0x13], 0
je 0x5b1cd4
lea eax, [esp + 0x20]
push eax
push dword [ebp]
push ebx
call fcn.004bfe01
push 1
push ebx
mov esi, eax
call fcn.004513a7
mov ebx, esi
neg esi
sbb esi, esi
and esi, dword [esp + 0x20]
mov dword [ebp], esi
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc