Function at 0x5b5310
Capabilities:
Extract resource via kernel32 functions
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6241f6
mov eax, dword fs:[0]
push eax
sub esp, 0x3d0
mov eax, dword [0x6c6060]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x14]
test edi, edi
jne 0x5b560d
call fcn.00597640
push eax
lea ecx, [ebp - 0x94]
call fcn.0059e300
mov dword [ebp - 4], edi
call fcn.00597660
mov ecx, eax
call fcn.0059ee60
test al, al
je 0x5b545b
push dword [ebp + 8]
lea ecx, [ebp - 0x94]
call fcn.0059e650
push edi
push 0x80
push 3
push edi
push 1
push connect
lea ecx, [ebp - 0x94]
call fcn.0059ebe0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x5b53be
lea ecx, [ebp - 0x94]
mov dword [ebp - 4], eax
call fcn.0059e480
jmp 0x5b5686
mov esi, dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
push ebx
call esi
mov edi, eax
test edi, edi
jne 0x5b53e6
lea ecx, [ebp - 0x94]
mov dword [ebp - 4], 0xffffffff
call fcn.0059e480
jmp 0x5b568c
push edi
mov dword [ebp - 0x3d8], 0
call fcn.0045b2cd
mov esi, eax
add esp, 4
test esi, esi
jne 0x5b5416
lea ecx, [ebp - 0x94]
mov dword [ebp - 4], 0xffffffff
call fcn.0059e480
jmp 0x5b5686
push 0
lea eax, [ebp - 0x3d8]
push eax
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x3d8], edi
je 0x5b55f9
push esi
call fcn.0045b2c8
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.0059e480
jmp 0x5b5686
call fcn.00597660
push eax
lea ecx, [ebp - 0x94]
call fcn.0059e630
call fcn.00597680
push eax
lea ecx, [ebp - 0x19c]
call fcn.0059e300
mov byte [ebp - 4], 1
call fcn.00597a00
test al, al
je 0x5b5493
call fcn.00597670
mov ebx, eax
jmp 0x5b54cf
push 0
lea ecx, [ebp - 0x19c]
call fcn.0059ebe0
push eax
call fcn.005b5c20
add esp, 8
lea ecx, [ebp - 0x94]
mov esi, eax
push esi
call fcn.0059ebe0
push eax
call fcn.005a7ad0
add esp, 8
mov ebx, eax
test esi, esi
je 0x5b54cf
push esi
call fcn.0045b2c8
add esp, 4
test ebx, ebx
jne 0x5b54f5
lea ecx, [ebp - 0x19c]
call fcn.0059e480
lea ecx, [ebp - 0x94]
mov dword [ebp - 4], 0xffffffff
call fcn.0059e480
jmp 0x5b5686
push 0xffffffffffffffff
push dword [ebp + 8]
lea ecx, [ebp - 0x118]
mov dword [ebp - 0x3dc], 0
call fcn.0059e330
push 0x6959f8
push 0x6b3894
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 2
call fcn.0059f0b0
lea eax, [ebp - 0x3cc]
push eax
lea eax, [ebp - 0x3dc]
push eax
push 1
lea ecx, [ebp - 0x118]
call fcn.0059ebe0
push eax
push ebx
call fcn.005a7390
add esp, 0x14
test eax, eax
je 0x5b5561
lea ecx, [ebp - 0x118]
call fcn.0059e480
jmp 0x5b54d3
mov edi, dword [ebp - 0x1a0]
test edi, edi
jne 0x5b557b
lea ecx, [ebp - 0x118]
call fcn.0059e480
jmp 0x5b54d3
push edi
call fcn.0045b2cd
mov esi, eax
add esp, 4
test esi, esi
je 0x5b55d1
push edi
push esi
push dword [ebp - 0x3dc]
push ebx
call fcn.005a8020
add esp, 0x10
test eax, eax
je 0x5b55d1
cmp eax, 0x600
je 0x5b55d1
push esi
call fcn.0045b2c8
add esp, 4
call fcn.00597a00
test al, al
jne 0x5b55c1
push ebx
call fcn.005a70b0
add esp, 4
lea ecx, [ebp - 0x118]
call fcn.0059e480
jmp 0x5b54d3
call fcn.00597a00
test al, al
jne 0x5b55e3
push ebx
call fcn.005a70b0
add esp, 4
lea ecx, [ebp - 0x118]
call fcn.0059e480
lea ecx, [ebp - 0x19c]
call fcn.0059e480
lea ecx, [ebp - 0x94]
mov dword [ebp - 4], 0xffffffff
call fcn.0059e480
jmp 0x5b567e
test esi, esi
jne 0x5b5618
call fcn.00597630
mov esi, eax
push edi
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x5b5686
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x3d4], eax
push ebx
test eax, eax
jne 0x5b5644
call dword [sym.imp.KERNEL32.dll_FreeResource]
jmp 0x5b5686
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
je 0x5b5686
push edi
call fcn.0045b2cd
mov esi, eax
add esp, 4
test esi, esi
je 0x5b5677
push edi
push dword [ebp - 0x3d4]
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
push esi
call fcn.005fcac0
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
test esi, esi
jne 0x5b5722
mov esi, dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
push 0x80
push 3
push 0
push 1
push connect
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x5b5700
push 0
push ebx
call esi
mov edi, eax
test edi, edi
je 0x5b5700
push edi
mov dword [ebp - 0x3d0], 0
call fcn.0045b2cd
mov esi, eax
add esp, 4
test esi, esi
je 0x5b56e4
push 0
lea eax, [ebp - 0x3d0]
push eax
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x3d0], edi
je 0x5b571e
test esi, esi
je 0x5b5700
push esi
call fcn.0045b2c8
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045acaa
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x5b5700
push edi
push esi
call fcn.005b4730
push esi
mov edi, eax
call fcn.0045b2c8
add esp, 0xc
test edi, edi
je 0x5b5700
push 0xa0
call fcn.0045acbb
mov esi, eax
add esp, 4
mov dword [ebp - 0x3d4], esi
mov dword [ebp - 4], 3
test esi, esi
je 0x5b5762
lea ecx, [esi + 0x18]
call fcn.0059e360
jmp 0x5b5764
xor esi, esi
lea eax, [ebp - 0x3d0]
mov dword [esi + 4], 0
push eax
mov dword [esi + 8], 0
mov dword [esi], edi
push dword [edi + 4]
mov dword [ebp - 0x3d0], 0
call sub.gdiplus.dll_GdipGetImageWidth
test eax, eax
je 0x5b5794
mov dword [edi + 8], eax
mov eax, dword [ebp - 0x3d0]
mov dword [esi + 0xc], eax
lea eax, [ebp - 0x3d4]
push eax
push dword [edi + 4]
mov dword [ebp - 0x3d4], 0
call sub.gdiplus.dll_GdipGetImageHeight
test eax, eax
je 0x5b57bd
mov dword [edi + 8], eax
mov ecx, dword [ebp - 0x3d4]
mov eax, esi
mov dword [esi + 0x10], ecx
mov byte [esi + 0x14], 1
jmp 0x5b5702