Function at 0x5b56c0
Capabilities:
Extract resource via kernel32 functions
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x624726
mov eax, dword fs:[0]
push eax
sub esp, 0x3d0
mov eax, dword [0x6c6060]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x14]
test edi, edi
jne 0x5b59bd
call fcn.005979d0
push eax
lea ecx, [ebp - 0x94]
call fcn.0059e6e0
mov dword [ebp - 4], edi
call fcn.005979f0
mov ecx, eax
call fcn.0059f230
test al, al
je 0x5b580b
push dword [ebp + 8]
lea ecx, [ebp - 0x94]
call fcn.0059ea30
push edi
push 0x80
push 3
push edi
push 1
push accept
lea ecx, [ebp - 0x94]
call fcn.0061e850
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x5b576e
lea ecx, [ebp - 0x94]
mov dword [ebp - 4], eax
call fcn.0059e860
jmp 0x5b5a36
mov esi, dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
push ebx
call esi
mov edi, eax
test edi, edi
jne 0x5b5796
lea ecx, [ebp - 0x94]
mov dword [ebp - 4], 0xffffffff
call fcn.0059e860
jmp 0x5b5a3c
push edi
mov dword [ebp - 0x3d8], 0
call fcn.0045b6ad
mov esi, eax
add esp, 4
test esi, esi
jne 0x5b57c6
lea ecx, [ebp - 0x94]
mov dword [ebp - 4], 0xffffffff
call fcn.0059e860
jmp 0x5b5a36
push 0
lea eax, [ebp - 0x3d8]
push eax
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x3d8], edi
je 0x5b59a9
push esi
call fcn.0045b6a8
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.0059e860
jmp 0x5b5a36
call fcn.005979f0
push eax
lea ecx, [ebp - 0x94]
call fcn.0059ea10
call fcn.00597a10
push eax
lea ecx, [ebp - 0x19c]
call fcn.0059e6e0
mov byte [ebp - 4], 1
call fcn.00597d90
test al, al
je 0x5b5843
call fcn.00597a00
mov ebx, eax
jmp 0x5b587f
push 0
lea ecx, [ebp - 0x19c]
call fcn.0061e850
push eax
call fcn.0059dc70
add esp, 8
lea ecx, [ebp - 0x94]
mov esi, eax
push esi
call fcn.0061e850
push eax
call fcn.005a7e30
add esp, 8
mov ebx, eax
test esi, esi
je 0x5b587f
push esi
call fcn.0045b6a8
add esp, 4
test ebx, ebx
jne 0x5b58a5
lea ecx, [ebp - 0x19c]
call fcn.0059e860
lea ecx, [ebp - 0x94]
mov dword [ebp - 4], 0xffffffff
call fcn.0059e860
jmp 0x5b5a36
push 0xffffffffffffffff
push dword [ebp + 8]
lea ecx, [ebp - 0x118]
mov dword [ebp - 0x3dc], 0
call fcn.0059e710
push 0x695a08
push 0x6b38b4
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 2
call fcn.0059f480
lea eax, [ebp - 0x3cc]
push eax
lea eax, [ebp - 0x3dc]
push eax
push 1
lea ecx, [ebp - 0x118]
call fcn.0061e850
push eax
push ebx
call fcn.005a76f0
add esp, 0x14
test eax, eax
je 0x5b5911
lea ecx, [ebp - 0x118]
call fcn.0059e860
jmp 0x5b5883
mov edi, dword [ebp - 0x1a0]
test edi, edi
jne 0x5b592b
lea ecx, [ebp - 0x118]
call fcn.0059e860
jmp 0x5b5883
push edi
call fcn.0045b6ad
mov esi, eax
add esp, 4
test esi, esi
je 0x5b5981
push edi
push esi
push dword [ebp - 0x3dc]
push ebx
call fcn.005a8380
add esp, 0x10
test eax, eax
je 0x5b5981
cmp eax, 0x600
je 0x5b5981
push esi
call fcn.0045b6a8
add esp, 4
call fcn.00597d90
test al, al
jne 0x5b5971
push ebx
call fcn.005a7410
add esp, 4
lea ecx, [ebp - 0x118]
call fcn.0059e860
jmp 0x5b5883
call fcn.00597d90
test al, al
jne 0x5b5993
push ebx
call fcn.005a7410
add esp, 4
lea ecx, [ebp - 0x118]
call fcn.0059e860
lea ecx, [ebp - 0x19c]
call fcn.0059e860
lea ecx, [ebp - 0x94]
mov dword [ebp - 4], 0xffffffff
call fcn.0059e860
jmp 0x5b5a2e
test esi, esi
jne 0x5b59c8
call fcn.005979c0
mov esi, eax
push edi
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x5b5a36
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x3d4], eax
push ebx
test eax, eax
jne 0x5b59f4
call dword [sym.imp.KERNEL32.dll_FreeResource]
jmp 0x5b5a36
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
je 0x5b5a36
push edi
call fcn.0045b6ad
mov esi, eax
add esp, 4
test esi, esi
je 0x5b5a27
push edi
push dword [ebp - 0x3d4]
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
push esi
call fcn.005fce10
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
test esi, esi
jne 0x5b5ad2
mov esi, dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
push 0x80
push 3
push 0
push 1
push accept
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x5b5ab0
push 0
push ebx
call esi
mov edi, eax
test edi, edi
je 0x5b5ab0
push edi
mov dword [ebp - 0x3d0], 0
call fcn.0045b6ad
mov esi, eax
add esp, 4
test esi, esi
je 0x5b5a94
push 0
lea eax, [ebp - 0x3d0]
push eax
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x3d0], edi
je 0x5b5ace
test esi, esi
je 0x5b5ab0
push esi
call fcn.0045b6a8
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045b08a
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x5b5ab0
push edi
push esi
call fcn.005b4ae0
push esi
mov edi, eax
call fcn.0045b6a8
add esp, 0xc
test edi, edi
je 0x5b5ab0
push 0xa0
call fcn.0045b09b
mov esi, eax
add esp, 4
mov dword [ebp - 0x3d4], esi
mov dword [ebp - 4], 3
test esi, esi
je 0x5b5b12
lea ecx, [esi + 0x18]
call fcn.0059e740
jmp 0x5b5b14
xor esi, esi
lea eax, [ebp - 0x3d0]
mov dword [esi + 4], 0
push eax
mov dword [esi + 8], 0
mov dword [esi], edi
push dword [edi + 4]
mov dword [ebp - 0x3d0], 0
call sub.gdiplus.dll_GdipGetImageWidth
test eax, eax
je 0x5b5b44
mov dword [edi + 8], eax
mov eax, dword [ebp - 0x3d0]
mov dword [esi + 0xc], eax
lea eax, [ebp - 0x3d4]
push eax
push dword [edi + 4]
mov dword [ebp - 0x3d4], 0
call sub.gdiplus.dll_GdipGetImageHeight
test eax, eax
je 0x5b5b6d
mov dword [edi + 8], eax
mov ecx, dword [ebp - 0x3d4]
mov eax, esi
mov dword [esi + 0x10], ecx
mov byte [esi + 0x14], 1
jmp 0x5b5ab2