Function at 0x405ac0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2ac
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
xor esi, esi
xor ecx, ecx
mov edx, edi
mov dword [ebp - 0x28c], ecx
mov al, byte [edi]
lea ebx, [ecx + 1]
test al, al
je 0x405b0d
lea ecx, [ecx]
cmp al, 0x5c
je 0x405af8
cmp al, 0x2f
jne 0x405af9
inc esi
mov al, byte [edx + 1]
inc edx
test al, al
jne 0x405af0
cmp esi, 2
cmove ecx, ebx
mov dword [ebp - 0x28c], ecx
push 0x280
lea eax, [ebp - 0x288]
push 0
push eax
call fcn.004126f0
add esp, 0xc
mov dword [ebp - 8], 0
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x405d6f
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push 0
push 0x8008
push ebx
call edi
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [ebp - 8]
push 0
push eax
push 0x20
lea eax, [ebp - 0x288]
push eax
push ebx
call esi
push 0
push 0
push 0x8028
push ebx
mov dword [ebp - 0x2ac], eax
call edi
push 0
lea eax, [ebp - 8]
push eax
push 0x20
lea eax, [ebp - 0x248]
push eax
push ebx
call esi
push 0
push 0
push 0x813e
push ebx
mov dword [ebp - 0x2a8], eax
call edi
push 0
lea eax, [ebp - 8]
push eax
push 0x80
lea eax, [ebp - 0x208]
push eax
push ebx
call esi
push 0
push 0
push 0x81be
push ebx
mov dword [ebp - 0x2a4], eax
call edi
push 0
lea eax, [ebp - 8]
push eax
push 0x80
lea eax, [ebp - 0x108]
push eax
push ebx
call esi
push ebx
mov dword [ebp - 0x2a0], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x405c00
cmp dword [ebp + eax*4 - 0x2ac], 0
je 0x405d6f
inc eax
cmp eax, 4
jl 0x405c00
lea ecx, [ebp - 0x288]
lea edx, [ecx + 1]
lea ecx, [ecx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x405c20
sub ecx, edx
je 0x405c45
lea edx, [ebp - 0x288]
mov al, byte [edx + ecx - 1]
cmp al, 0x20
je 0x405c3d
cmp al, 9
jne 0x405c45
mov byte [edx + ecx - 1], 0
dec ecx
jne 0x405c31
lea ecx, [ebp - 0x248]
lea edx, [ecx + 1]
mov edi, edi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x405c50
sub ecx, edx
je 0x405c7f
jmp 0x405c60
cmp byte [ebp + ecx - 0x249], 0x20
je 0x405c74
cmp byte [ebp + ecx - 0x249], 9
jne 0x405c7f
mov byte [ebp + ecx - 0x249], 0
dec ecx
jne 0x405c60
lea ecx, [ebp - 0x208]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x405c88
sub ecx, edx
je 0x405cb2
cmp byte [ebp + ecx - 0x209], 0x20
je 0x405ca7
cmp byte [ebp + ecx - 0x209], 9
jne 0x405cb2
mov byte [ebp + ecx - 0x209], 0
dec ecx
jne 0x405c93
lea ecx, [ebp - 0x108]
lea edx, [ecx + 1]
jmp 0x405cc0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x405cc0
sub ecx, edx
je 0x405cef
jmp 0x405cd0
cmp byte [ebp + ecx - 0x109], 0x20
je 0x405ce4
cmp byte [ebp + ecx - 0x109], 9
jne 0x405cef
mov byte [ebp + ecx - 0x109], 0
dec ecx
jne 0x405cd0
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x288]
push eax
push str.ISO_ID:_System__s__Volume__s__Pulisher__s__Preparer__s_
call fcn.004044f0
add esp, 0x14
cmp dword [ebp - 0x28c], 0
je 0x405d6f
mov ecx, str.Modified_Win10PEx64
lea eax, [ebp - 0x248]
lea esp, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x405d50
test dl, dl
je 0x405d4c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x405d50
add eax, 2
add ecx, 2
test dl, dl
jne 0x405d30
xor eax, eax
jmp 0x405d55
sbb eax, eax
or eax, 1
test eax, eax
jne 0x405d6f
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040b2c4
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b2c4
mov esp, ebp
pop ebp
ret