Function at 0x406260
Capabilities:
Create process on windows
Delete file
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b0
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, ecx
mov dword [ebp - 0x2a8], 0
push edi
push eax
push str.DecompressInjectionArchive__s
mov esi, edx
mov dword [ebp - 0x2ac], eax
mov dword [ebp - 0x2b0], 0
mov dword [ebp - 0x234], 0xc
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x22c], 1
call fcn.004044f0
push esi
push str..PhysicalDrive_d
lea eax, [ebp - 0x110]
push 0x104
push eax
call fcn.0040b3ad
add esp, 0x18
lea eax, [ebp - 0x110]
push 0
push 0
push 3
push 0
push 3
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x406319
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x110]
push eax
push str.Could_not_open_the_disk__s___error:_u
call fcn.004044f0
add esp, 0xc
jmp 0x406630
push 0
lea eax, [ebp - 0x21c]
push eax
push 8
lea eax, [ebp - 0x228]
push eax
push 0
push 0
push 0x7405c
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x406365
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x110]
push eax
push str.Could_not_get_phy_disk__s_size__error:_u
call fcn.004044f0
add esp, 0xc
jmp 0x40662d
mov ecx, edi
mov dword [0x4262bc], edi
call fcn.00405540
push str.Parse_FAT_fs...
mov dword [0x4262e0], eax
mov dword [0x4262e4], edx
call fcn.004044f0
add esp, 4
call fcn.004020f0
call fcn.004021a0
test eax, eax
jne 0x4065ff
mov edx, str.ventoy7za.xz
mov ecx, str._ventoy_7z_32_7za.xz
call fcn.004051e0
lea eax, [ebp - 0x2a4]
mov ecx, str.ventoy7za.xz
push eax
lea edx, [ebp - 0x2b0]
call fcn.00404870
mov esi, dword [ebp - 0x2a4]
add esp, 4
push esi
push str.7za.xz_file_size:_u
call fcn.004044f0
push 0x400000
call fcn.0040b401
add esp, 0xc
mov dword [ebp - 0x2a4], eax
test eax, eax
je 0x406477
push ecx
mov ecx, dword [ebp - 0x2b0]
mov edx, esi
mov dword [0x4250a8], eax
lea eax, [ebp - 0x2a8]
push eax
sub esp, 0xc
mov dword [0x4250a0], 0
call fcn.0040afe0
add esp, 0x14
cmp dword [ebp - 0x2a8], esi
jne 0x406431
push dword [0x4250a0]
push esi
push str.Decompress_success_7za.xz__u_______7za.exe__d_
jmp 0x406438
push esi
push esi
push str.Decompress_failed_7za.xz__u_______7za.exe__u_
call fcn.004044f0
mov esi, dword [ebp - 0x2a4]
add esp, 0xc
mov edx, esi
mov ecx, str.ventoy7za.exe
push dword [0x4250a0]
call fcn.00404a10
add esp, 4
mov dword [0x4250a8], 0
mov dword [0x4250a0], 0
push esi
call fcn.0040b3c9
jmp 0x406481
push str.Failed_to_alloc_4MB_memory
call fcn.004044f0
add esp, 4
lea eax, [ebp - 0x110]
push dword [ebp - 0x2ac]
push str.ventoy7za.exe_x__y__aoa__oX:__s
push 0x104
push eax
call fcn.0040b3ad
push str.extract_inject_to_X:
call fcn.004044f0
add esp, 0x14
lea eax, [ebp - 0x110]
push eax
push str.cmdline:__s_
call fcn.004044f0
add esp, 8
lea eax, [ebp - 0x2a0]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
push 0
push 0x80
push 4
lea eax, [ebp - 0x234]
push eax
push 3
push 4
push str.ventoy7z.log
call dword [sym.imp.KERNEL32.dll_CreateFileA]
or dword [ebp - 0x274], 0x100
mov esi, eax
cmp esi, 0xffffffff
je 0x40650a
mov dword [ebp - 0x260], esi
mov dword [ebp - 0x264], esi
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x2a0]
push eax
push 0
push 0
push 0x8000000
push 1
push 0
push 0
lea eax, [ebp - 0x110]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0xffffffffffffffff
push dword [ebp - 0x244]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 0x2ac]
lea edx, [ebp - 0x218]
call fcn.00406110
test eax, eax
je 0x4065e9
lea eax, [ebp - 0x218]
push eax
push str.Decompress_tar_archive...__s_
call fcn.004044f0
lea eax, [ebp - 0x218]
push eax
push str.ventoy7za.exe_x__y__aoa__oX:__s
lea eax, [ebp - 0x110]
push 0x104
push eax
call fcn.0040b3ad
add esp, 0x18
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x2a0]
push eax
push 0
push 0
push 0x8000000
push 1
push 0
push 0
lea eax, [ebp - 0x110]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0xffffffffffffffff
push dword [ebp - 0x254]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x218]
push eax
push str.Now_delete__s
call fcn.004044f0
add esp, 8
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp esi, 0xffffffff
je 0x4065f9
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
jmp 0x4065ff
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x425090], 0
jne 0x40660d
call fcn.004020f0
mov eax, dword [0x42598c]
test eax, eax
je 0x406618
call eax
mov ecx, 0x425950
call fcn.00403030
mov eax, dword [0x425990]
test eax, eax
je 0x40662d
call eax
push edi
call esi
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
xor ecx, ebp
pop esi
call fcn.0040b2c4
mov esp, ebp
pop ebp
ret