Function at 0x40aaa0
Capabilities:
Get graphical window text
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x43d004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x43e380]
push ebx
mov ebx, ecx
mov dword [ebp - 0x64], eax
push esi
push edi
mov dword [ebp - 0x5c], ebx
mov esi, 1
mov edi, dword [ebx + 0x10]
mov ecx, edi
mov edx, dword [ebx + 0x14]
mov dword [ebp - 0x60], 1
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x58], 0
call fcn.0042c390
movsd xmm1, qword [0x43b198]
movaps xmm2, xmm0
divsd xmm2, xmm1
mov eax, edi
and eax, 0x3fffffff
or eax, 0
divsd xmm2, xmm1
divsd xmm2, xmm1
jne 0x40ab2b
mov eax, dword [ebx + 0x14]
shrd edi, eax, 0x1e
jmp 0x40ab78
movsd xmm3, qword [0x43b130]
xor eax, eax
nop word [eax + eax]
movd xmm1, esi
cvtdq2pd xmm1, xmm1
comisd xmm1, xmm2
jbe 0x40ab57
movaps xmm0, xmm1
subsd xmm0, xmm2
jmp 0x40ab5e
movaps xmm0, xmm2
subsd xmm0, xmm1
divsd xmm0, xmm1
comisd xmm3, xmm0
ja 0x40ab76
inc eax
add esi, esi
cmp eax, 0xc
jl 0x40ab40
cvttsd2si edi, xmm2
jmp 0x40ab78
mov edi, esi
cmp dword [ebp - 0x64], 0
lea eax, [ebx + 0xa0]
push edi
push eax
lea eax, [ebx + 0x20]
mov ecx, 0x437b0c
push eax
push dword [ebx + 4]
mov eax, 0x437b08
cmove eax, ecx
push eax
push str.InstallVentoy2FileImage__s_PhyDrive_d____s__s__dGB__
call fcn.0040f530
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
add esp, 0x18
push 0
push 8
push 0x402
push dword [0x43fc40]
call esi
movsd xmm0, qword [0x43b138]
lea eax, [ebp - 0x48]
sub esp, 8
movsd qword [esp], xmm0
push str.Status____.0lf__
push 0x40
push eax
call fcn.00401010
add esp, 0x14
lea eax, [ebp - 0x48]
push eax
push dword [0x43fc48]
call dword [sym.imp.USER32.dll_SetWindowTextA]
push 0x2105000
call fcn.0041c36a
mov ebx, eax
add esp, 4
mov dword [ebp - 0x6c], ebx
test ebx, ebx
jne 0x40ac1d
push 0x2105000
push str.malloc_image_buffer_failed__d.
call fcn.0040f530
add esp, 8
jmp 0x40b434
lea eax, [ebx + 0x2104e00]
push 0x200
lea edi, [eax - 0xc00]
push 0
push eax
mov dword [ebp - 0x70], edi
call fcn.00418c40
add esp, 0xc
push 0xc00
push 0
push edi
call fcn.00418c40
add esp, 0xc
push 0
push 0xd
push 0x402
push dword [0x43fc40]
call esi
movsd xmm0, qword [0x43b160]
lea eax, [ebp - 0x48]
sub esp, 8
movsd qword [esp], xmm0
push str.Status____.0lf__
push 0x40
push eax
call fcn.00401010
add esp, 0x14
lea eax, [ebp - 0x48]
push eax
push dword [0x43fc48]
call dword [sym.imp.USER32.dll_SetWindowTextA]
push str.Writing_Boot_Image_.............................
call fcn.0040f530
add esp, 4
lea eax, [ebp - 0x54]
xor edx, edx
mov ecx, str.bootcore.img.xz
push eax
lea eax, [ebp - 0x4c]
push eax
call fcn.0040f6f0
add esp, 8
test eax, eax
je 0x40acc2
push str.Failed_to_read_stage1_img
jmp 0x40b42c
mov esi, dword [ebp - 0x4c]
lea eax, [ebp - 0x50]
mov edx, dword [ebp - 0x54]
push ecx
push eax
push ebx
push 0
push ecx
mov ecx, esi
call fcn.00417370
add esp, 0x14
test esi, esi
je 0x40acef
push esi
call fcn.0041bffb
add esp, 4
mov dword [ebp - 0x4c], 0
push dword [ebp - 0x50]
push str.bootcore.img.xz
push str.decompress__s_len:_d
call fcn.0040f530
add esp, 0xc
cmp dword [ebp - 0x64], 0
je 0x40add2
push 0xfbc00
lea eax, [ebx + 0x4400]
mov byte [ebx + 0x1f4], 0x23
push ebx
push eax
call fcn.004192f0
add esp, 0xc
push 0x4400
push 0
push ebx
call fcn.00418c40
mov esi, dword [ebp - 0x5c]
add esp, 0xc
mov ecx, ebx
push dword [esi + 0x14]
push dword [esi + 0x10]
call fcn.00410820
push 0x4200
lea esi, [ebx + 0x2100000]
push 0
push esi
mov dword [ebp - 0x68], esi
call fcn.00418c40
add esp, 0x14
lea eax, [ebx + 0x400]
push 0x4000
push eax
push esi
call fcn.004192f0
add esp, 0xc
lea edx, [esi + 0x4000]
mov ecx, ebx
call fcn.00410b80
mov eax, dword [ebx + 0x420]
mov esi, dword [ebx + 0x428]
mov ecx, dword [ebx + 0x424]
sub esi, eax
mov dword [ebp - 0x78], eax
mov eax, dword [ebx + 0x42c]
sbb eax, ecx
mov dword [ebp - 0x80], ecx
add esi, 1
mov dword [ebp - 0x74], esi
mov esi, dword [ebx + 0x4a0]
adc eax, 0
mov dword [ebp - 0x84], esi
mov esi, dword [ebx + 0x4a4]
mov dword [ebp - 0x7c], eax
mov eax, str.Write_GPT_Info_OK_...
mov dword [ebp - 0x88], esi
jmp 0x40ae47
push 0xffe00
lea eax, [ebx + 0x200]
push ebx
push eax
call fcn.004192f0
add esp, 0xc
push 0x200
push 0
push ebx
call fcn.00418c40
mov ecx, dword [ebp - 0x5c]
add esp, 0xc
xor edx, edx
push dword [ecx + 0x14]
push dword [ecx + 0x10]
mov ecx, ebx
call fcn.004105f0
mov eax, dword [ebx + 0x1c6]
add esp, 8
mov dword [ebp - 0x78], eax
mov eax, dword [ebx + 0x1ca]
mov dword [ebp - 0x74], eax
mov eax, dword [ebx + 0x1d6]
mov dword [ebp - 0x84], eax
mov eax, str.Write_MBR_OK_...
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x88], 0
push eax
call fcn.0040f530
add esp, 4
push str.Writing_EFI_part_Image_.............................
call fcn.0040f530
add esp, 4
lea eax, [ebp - 0x54]
xor edx, edx
mov ecx, str.ventoy_ventoy.disk.img.xz
push eax
lea eax, [ebp - 0x4c]
push eax
call fcn.0040f6f0
add esp, 8
mov dword [ebp - 0x60], eax
test eax, eax
je 0x40ae94
push dword [ebp - 0x54]
mov esi, dword [ebp - 0x4c]
push esi
push str.Failed_to_read_img_file__p__u
call fcn.0040f530
add esp, 0xc
jmp 0x40b437
push 0
push 0x29
push 0x402
push dword [0x43fc40]
call dword [sym.imp.USER32.dll_SendMessageW]
movsd xmm0, qword [0x43b170]
lea eax, [ebp - 0x48]
sub esp, 8
movsd qword [esp], xmm0
push str.Status____.0lf__
push 0x40
push eax
call fcn.00401010
add esp, 0x14
lea eax, [ebp - 0x48]
push eax
push dword [0x43fc48]
call dword [sym.imp.USER32.dll_SetWindowTextA]
push 0x80
push 0
push 0x43f3d0
call fcn.00418c40
mov esi, dword [ebp - 0x54]
lea ecx, [ebp - 0x50]
add esp, 8
lea eax, [ebx + 0x100000]
mov edx, esi
mov dword [ebp - 0x8c], eax
push ecx
push eax
push 0
push ecx
mov ecx, dword [ebp - 0x4c]
call fcn.00417370
add esp, 0x14
cmp dword [ebp - 0x50], esi
jne 0x40b427
push str.decompress_finished_success
call fcn.0040f530
add esp, 4
lea eax, [ebx + 0x100000]
mov dword [0x43f3d0], eax
call fcn.00409150
push 0x437c00
lea eax, [ebp - 0x58]
push str.VentoySparseImg.vtsi
push eax
call fcn.0041cec7
add esp, 0xc
cmp dword [ebp - 0x58], 0
jne 0x40af60
push str.Failed_to_create_Ventoy_img_file
jmp 0x40b42c
push str.Writing_stage1_data_.............................
call fcn.0040f530
add esp, 4
push dword [ebp - 0x58]
push 0x100000
push 1
push ebx
call fcn.0041c307
mov eax, dword [ebp - 0x74]
lea ebx, [edi + 8]
add eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x7c]
adc ecx, dword [ebp - 0x80]
push 0xbe8
mov dword [0x43fce4], ecx
lea ecx, [edi + 0x18]
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [ebx], 0x800
mov dword [ebx + 4], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [0x43fce0], eax
mov eax, dword [ebp - 0x58]
push 0
push ecx
mov dword [0x43fce8], 0xffffffff
mov dword [0x43e34c], eax
mov dword [0x43e348], ecx
call fcn.00418c40
add esp, 0x1c
mov dword [0x43d8b0], 0xffffffff
mov dword [0x43e350], 0x100000
mov dword [0x43e354], 0
push str.Formatting_part1_exFAT_...
call fcn.0040f530
mov eax, dword [ebp - 0x5c]
add esp, 4
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.00409e50
add esp, 8
test eax, eax
je 0x40b065
push str.FormatPart1exFAT_failed.
call fcn.0040f530
mov ebx, dword [ebp - 0x6c]
xorps xmm0, xmm0
mov dword [0x43e34c], 0
mov dword [0x43e348], 0
mov dword [0x43d8b0], 0xffffffff
movlpd qword [0x43e350], xmm0
jmp 0x40b431
mov esi, dword [0x43d8b0]
xorps xmm0, xmm0
mov eax, dword [0x43e350]
add esi, 2
mov ecx, dword [0x43e354]
push eax
push esi
push str.current_segment_number:_d_dataoff:_ld
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], ecx
mov dword [0x43e34c], 0
mov dword [0x43e348], 0
mov dword [0x43d8b0], 0xffffffff
movlpd qword [0x43e350], xmm0
call fcn.0040f530
add esp, 0xc
push str.Writing_part2_data_.............................
call fcn.0040f530
add esp, 4
push dword [ebp - 0x58]
push 0x2000000
push 1
push dword [ebp - 0x8c]
call fcn.0041c307
mov ecx, dword [ebp - 0x84]
lea eax, [esi + esi*2]
mov edx, dword [ebp - 0x50]
add esp, 0x10
mov dword [edi + eax*8], ecx
mov ecx, dword [ebp - 0x88]
mov dword [edi + eax*8 + 4], ecx
mov ecx, dword [ebp - 0x54]
mov dword [edi + eax*8 + 0x10], ecx
add ecx, 0x2000000
mov dword [edi + eax*8 + 0x14], edx
adc edx, 0
mov dword [edi + eax*8 + 8], 0x10000
inc esi
mov dword [edi + eax*8 + 0xc], 0
cmp dword [ebp - 0x64], 0
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x60], esi
je 0x40b19b
push str.Writing_backup_gpt_table_.............................
call fcn.0040f530
add esp, 4
push dword [ebp - 0x58]
push 0x4200
push 1
push dword [ebp - 0x68]
call fcn.0041c307
mov ecx, dword [ebp - 0x5c]
lea edx, [esi + esi*2]
add esp, 0x10
mov eax, dword [ecx + 0x10]
mov ecx, dword [ecx + 0x14]
shrd eax, ecx, 9
mov dword [edi + edx*8 + 8], 0x21
shr ecx, 9
add eax, 0xffffffdf
mov dword [edi + edx*8], eax
mov eax, dword [ebp - 0x54]
adc ecx, 0xffffffff
mov dword [edi + edx*8 + 4], ecx
mov ecx, dword [ebp - 0x50]
mov dword [edi + edx*8 + 0x10], eax
add eax, 0x4200
mov dword [edi + edx*8 + 0x14], ecx
adc ecx, 0
mov dword [edi + edx*8 + 0xc], 0
inc esi
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x60], esi
push str.Writing_segment_metadata_.............................
call fcn.0040f530
add esp, 4
test esi, esi
jle 0x40b1ec
xor edi, edi
nop
mov esi, dword [ebx + 8]
mov ecx, esi
mov edx, dword [ebx + 0xc]
mov eax, edx
shrd ecx, eax, 9
shr eax, 9
push eax
push ecx
push edx
push esi
push dword [ebx + 4]
push dword [ebx]
push dword [ebx - 4]
push dword [ebx - 8]
push edi
push str.SEG__d_:__PhySector:_llu_SectorNum:_llu_DataOffset:_llu_sector:_llu_
call fcn.0040f530
mov esi, dword [ebp - 0x60]
lea ebx, [ebx + 0x18]
inc edi
add esp, 0x28
cmp edi, esi
jl 0x40b1b0
mov edi, dword [ebp - 0x70]
push dword [ebp - 0x58]
lea ebx, [esi + esi*2]
shl ebx, 3
push ebx
push 1
push edi
mov dword [ebp - 0x64], ebx
call fcn.0041c307
add esp, 0x10
and ebx, 0x800001ff
jns 0x40b216
dec ebx
or ebx, 0xfffffe00
add ebx, 1
je 0x40b239
push dword [ebp - 0x58]
mov eax, 0x200
sub eax, ebx
mov ebx, dword [ebp - 0x6c]
push eax
push 1
lea eax, [ebx + 0xfe000]
push eax
call fcn.0041c307
add esp, 0x10
jmp 0x40b23c
mov ebx, dword [ebp - 0x6c]
mov edx, dword [ebp - 0x5c]
lea esi, [ebx + 0x2104e00]
mov dword [esi], 0x544e4556
mov dword [esi + 4], 0x594f
mov dword [esi + 8], 1
mov eax, dword [edx + 0x10]
mov ecx, dword [edx + 0x14]
mov dword [esi + 0x10], ecx
mov ecx, dword [ebp - 0x50]
mov dword [esi + 0xc], eax
mov eax, dword [edx + 0x440]
mov edx, dword [ebp - 0x60]
mov dword [esi + 0x28], ecx
mov ecx, dword [ebp - 0x64]
mov dword [esi + 0x14], eax
mov eax, dword [ebp - 0x54]
mov dword [esi + 0x1c], edx
mov dword [esi + 0x24], eax
test ecx, ecx
jle 0x40b2e3
cmp ecx, 8
jb 0x40b2e3
xor eax, eax
xorps xmm3, xmm3
xorps xmm2, xmm2
movd xmm1, dword [eax + edi]
xorps xmm0, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
paddd xmm3, xmm1
movd xmm1, dword [eax + edi + 4]
punpcklbw xmm1, xmm0
add eax, 8
punpcklwd xmm1, xmm0
paddd xmm2, xmm1
cmp eax, ecx
jl 0x40b294
paddd xmm2, xmm3
movaps xmm0, xmm2
psrldq xmm0, 8
paddd xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 4
paddd xmm2, xmm0
movd edi, xmm2
jmp 0x40b342
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x68], 0
test ecx, ecx
jle 0x40b340
mov eax, dword [ebp - 0x64]
xor ecx, ecx
cmp eax, 2
jl 0x40b333
dec eax
xor ebx, ebx
mov edx, eax
movzx eax, byte [ecx + edi]
add dword [ebp - 0x5c], eax
movzx eax, byte [ecx + edi + 1]
add ecx, 2
add ebx, eax
cmp ecx, edx
jl 0x40b304
mov eax, dword [ebp - 0x5c]
mov edx, dword [ebp - 0x60]
mov dword [ebp - 0x68], ebx
mov ebx, dword [ebp - 0x6c]
cmp ecx, dword [ebp - 0x64]
jl 0x40b335
add eax, dword [ebp - 0x68]
xor edi, edi
mov edi, eax
jmp 0x40b342
mov eax, ecx
movzx edi, byte [ecx + edi]
add eax, dword [ebp - 0x68]
add edi, eax
jmp 0x40b342
xor edi, edi
not edi
xor eax, eax
mov dword [esi + 0x20], edi
xorps xmm2, xmm2
xorps xmm3, xmm3
nop
movd xmm1, dword [eax + esi]
xorps xmm0, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
paddd xmm2, xmm1
movd xmm1, dword [eax + esi + 4]
punpcklbw xmm1, xmm0
add eax, 8
punpcklwd xmm1, xmm0
paddd xmm3, xmm1
cmp eax, 0x200
jb 0x40b350
push dword [ebp - 0x50]
mov edi, dword [ebp - 0x54]
paddd xmm3, xmm2
movaps xmm0, xmm3
psrldq xmm0, 8
paddd xmm3, xmm0
movups xmm0, xmm3
psrldq xmm0, 4
paddd xmm3, xmm0
movd eax, xmm3
push edi
push edx
not eax
push str.Writing_footer_segnum__u___segoffset__llu__......................
mov dword [esi + 0x18], eax
call fcn.0040f530
push dword [esi + 0x28]
push dword [esi + 0x24]
push dword [esi + 0x14]
push dword [esi + 0x10]
push dword [esi + 0xc]
push str.disk_size_llu_disk_signature_lx_segment_offset_llu
call fcn.0040f530
push dword [ebp - 0x58]
push 0x200
push 1
push esi
call fcn.0041c307
push dword [ebp - 0x58]
call fcn.0041cd8c
mov eax, dword [ebp - 0x64]
add esp, 0x3c
add eax, 0x1ff
cdq
and edx, 0x1ff
add eax, edx
and eax, 0xfffffe00
cdq
add eax, edi
adc edx, dword [ebp - 0x50]
add eax, 0x200
adc edx, 0
push edx
push eax
push str.Writing_Ventoy_image_file_finished__the_file_size_should_be__llu_.
call fcn.0040f530
add esp, 0xc
mov dword [ebp - 0x60], 0
jmp 0x40b434
push str.decompress_finished_failed
call fcn.0040f530
add esp, 4
mov esi, dword [ebp - 0x4c]
push 0
push 0x30
push 0x402
push dword [0x43fc40]
call dword [sym.imp.USER32.dll_SendMessageW]
movsd xmm0, qword [0x43b188]
lea eax, [ebp - 0x48]
sub esp, 8
movsd qword [esp], xmm0
push str.Status____.0lf__
push 0x40
push eax
call fcn.00401010
add esp, 0x14
lea eax, [ebp - 0x48]
push eax
push dword [0x43fc48]
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov edi, dword [ebp - 0x60]
push edi
push str.retcode:_d_n
call fcn.0040f530
add esp, 8
test ebx, ebx
je 0x40b49d
push ebx
call fcn.0041bffb
add esp, 4
test esi, esi
je 0x40b4aa
push esi
call fcn.0041bffb
add esp, 4
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00417710
mov esp, ebp
pop ebp
ret