Function at 0x405b40
Capabilities:
Read file on windows
Terminate process

Disassembly:
sub esp, 8
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push ebx
push ebp
push esi
mov esi, dword [0x46bb84]
push edi
push ecx
xor ebx, ebx
push edx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov eax, dword [esi + 0x2c]
push ebx
push eax
call fcn.0041c860
mov edi, eax
mov ebp, edx
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], ebp
mov al, byte [esi + 0x140]
test al, al
je 0x405c28
mov ecx, dword [esi + 0x68]
xor eax, eax
mov ax, word [ecx + 0xe]
cmp ax, bx
mov dword [esp + 0x20], eax
je 0x405c03
mov ebx, dword [esi + 0x28]
xor eax, eax
mov ax, word [ecx + 8]
xor edx, edx
shl eax, 5
lea eax, [eax + ebx - 1]
div ebx
mov edx, eax
xor eax, eax
mov al, byte [ecx + 6]
mov ebx, eax
mov eax, dword [esp + 0x20]
and eax, 0xffff
imul ebx, eax
xor eax, eax
mov ax, word [ecx + 4]
add edx, ebx
add edx, eax
imul edx, dword [esi + 0x28]
cmp dword [esi + 0x74], edx
je 0x405c03
push str.Vcb__AllocationSupport.FileAreaLbo__Vcb__pBpb__FatsVcb__pBpb__SectorsPerFatVcb__pBpb__ReservedSectors_Vcb__BytesPerSector____Vcb__pBpb__RootEntries32_Vcb__BytesPerSector_1___Vcb__BytesPerSector_Vcb__BytesPerSector_
push 0x10f
push str.E:_srcundeleteRawIO.cpp
call fcn.004025a0
add esp, 0xc
cmp eax, 1
jne 0x405bf5
push eax
call fcn.0041c4fb
mov edi, dword [esp + 0x10]
mov ebp, dword [esp + 0x14]
mov esi, dword [0x46bb84]
mov ecx, dword [esi + 0x74]
add edi, ecx
mov ebx, 0
adc ebp, ebx
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], ebp
mov edx, dword [esi + 0x2c]
shl edx, 1
sub edi, edx
sbb ebp, ebx
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], ebp
cmp dword [0x46b158], 2
je 0x405dc0
mov eax, dword [esi + 0x28]
push ebx
push eax
push ebp
push edi
call fcn.0041c8a0
cmp edx, ebx
jg 0x405c58
jl 0x405c4e
cmp eax, 0x77359400
jae 0x405c58
cmp ebp, ebx
jg 0x405c88
jl 0x405c58
cmp edi, ebx
jae 0x405c88
push str.distanceToMove.QuadPart_Vcb__BytesPerSector___2000000000__distanceToMove.QuadPart___0
push 0x119
push str.E:_srcundeleteRawIO.cpp
call fcn.004025a0
add esp, 0xc
cmp eax, 1
jne 0x405c7a
push eax
call fcn.0041c4fb
mov edi, dword [esp + 0x10]
mov ebp, dword [esp + 0x14]
mov esi, dword [0x46bb84]
mov eax, dword [esi + 0x2c]
xor edx, edx
div dword [esi + 0x28]
mov ebx, dword [esp + 0x2c]
imul eax, ebx
cmp eax, 0xfde8
jae 0x405ca2
test ebx, ebx
jge 0x405cd2
push str._numberToRead_Vcb__BytesPerCluster_Vcb__BytesPerSector_____65000__numberToRead__0
push 0x11a
push str.E:_srcundeleteRawIO.cpp
call fcn.004025a0
add esp, 0xc
cmp eax, 1
jne 0x405cc4
push eax
call fcn.0041c4fb
mov edi, dword [esp + 0x10]
mov ebp, dword [esp + 0x14]
mov esi, dword [0x46bb84]
cmp dword [0x46b14c], 4
jne 0x405d4c
mov eax, dword [0x46b150]
test eax, eax
jne 0x405d4c
mov ecx, dword [0x46b154]
and ecx, 0xffff
cmp ecx, 0x3b6
jne 0x405d4c
mov edx, dword [esp + 0x28]
mov ecx, dword [esi + 0x28]
mov eax, dword [esi + 0x2c]
push edx
xor edx, edx
div ecx
imul eax, ebx
push eax
push 0
push ecx
push ebp
push edi
call fcn.0041c8a0
mov ecx, dword [esi + 0x60]
push eax
xor eax, eax
mov al, byte [esi + 0x64]
sub al, 0x40
push eax
push ecx
call fcn.004142c0
add esp, 0x14
test eax, eax
jne 0x405d44
push 0x10000
push str.fatal_error
push str.ReadLogicalSectors_failed
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov edx, dword [esp + 0x28]
mov ecx, dword [esi + 0x28]
mov eax, dword [esi + 0x2c]
push edx
xor edx, edx
div ecx
imul eax, ebx
push eax
push 0
push ecx
push ebp
push edi
call fcn.0041c8a0
mov ecx, dword [esi + 0x60]
push eax
xor eax, eax
mov al, byte [esi + 0x64]
sub al, 0x40
push eax
push ecx
call fcn.00414350
add esp, 0x14
test eax, eax
jne 0x405d44
mov edx, dword [esp + 0x28]
mov esi, dword [0x46bb84]
mov ecx, dword [esi + 0x28]
mov eax, dword [esi + 0x2c]
push edx
xor edx, edx
div ecx
imul eax, ebx
push eax
mov eax, dword [esp + 0x1c]
push 0
push ecx
mov ecx, dword [esp + 0x20]
push eax
push ecx
call fcn.0041c8a0
xor edx, edx
mov dl, byte [esi + 0x64]
sub dl, 0x40
push eax
mov eax, dword [esi + 0x60]
push edx
push eax
jmp 0x405d22
mov esi, dword [esp + 0x1c]
push ebx
lea ecx, [esp + 0x18]
push ecx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x405ddc
call fcn.004028e0
mov eax, dword [esp + 0x28]
cmp eax, ebx
je 0x405d44
mov ecx, dword [0x46bb84]
mov edi, dword [esp + 0x2c]
push ebx
lea edx, [esp + 0x24]
push edx
mov dword [esp + 0x28], ebx
mov edx, dword [ecx + 0x2c]
imul edx, edi
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x405e14
call fcn.004028e0
mov eax, dword [0x46bb84]
mov ecx, dword [eax + 0x2c]
mov eax, dword [esp + 0x20]
imul ecx, edi
cmp eax, ecx
je 0x405d44
push str.bytesReadVcb__BytesPerClusternumberToRead
push 0x13e
push str.E:_srcundeleteRawIO.cpp
call fcn.004025a0
add esp, 0xc
cmp eax, 1
jne 0x405d44
push eax
call fcn.0041c4fb
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop