Function at 0x409070
Capabilities:
Get graphical window text
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xdc
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0xa8], 1
push edi
mov edi, dword [0x430260]
xor ebx, ebx
mov dword [ebp - 0xb8], esi
push dword [esi + 0x14]
mov dword [ebp - 0xc8], edi
push dword [esi + 0x10]
mov dword [ebp - 0x9c], 0
mov dword [ebp - 0x90], 0
mov dword [ebp - 0xa4], 0
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0x8c], ebx
mov dword [ebp - 0x94], ebx
call fcn.0040dd80
push eax
lea eax, [esi + 0xa0]
mov ecx, 0x429f3c
push eax
lea eax, [esi + 0x20]
test edi, edi
push eax
push dword [esi + 4]
mov eax, 0x429f38
cmove eax, ecx
push eax
push str.InstallVentoy2FileImage__s_PhyDrive_d____s__s__dGB__
call fcn.0040c4e0
add esp, 0x20
push ebx
push 8
push 0x402
push dword [0x432910]
call dword [sym.imp.USER32.dll_SendMessageW]
movsd xmm0, qword [0x42c3d8]
lea eax, [ebp - 0x88]
sub esp, 8
movsd qword [esp], xmm0
push str.Status____.0lf__
push 0x40
push eax
call fcn.004136cf
add esp, 0x14
lea eax, [ebp - 0x88]
push eax
push dword [0x43297c]
call dword [sym.imp.USER32.dll_SetWindowTextA]
push 0x2105000
call fcn.00413be0
mov edi, eax
add esp, 4
mov dword [ebp - 0xb4], edi
test edi, edi
jne 0x40918e
push 0x2105000
push str.malloc_image_buffer_failed__d.
call fcn.0040c4e0
add esp, 8
jmp 0x409a1f
lea eax, [edi + 0x2104e00]
push 0x200
lea ebx, [eax - 0xc00]
mov dword [ebp - 0xc4], eax
push 0
push eax
mov dword [ebp - 0xbc], ebx
call fcn.004198c0
add esp, 0xc
push 0xc00
push 0
push ebx
call fcn.004198c0
add esp, 0xc
push 0
push 0xd
push 0x402
push dword [0x432910]
call dword [sym.imp.USER32.dll_SendMessageW]
movsd xmm0, qword [0x42c400]
lea eax, [ebp - 0x48]
sub esp, 8
movsd qword [esp], xmm0
push str.Status____.0lf__
push 0x40
push eax
call fcn.004136cf
add esp, 0x14
lea eax, [ebp - 0x48]
push eax
push dword [0x43297c]
call dword [sym.imp.USER32.dll_SetWindowTextA]
push str.Writing_Boot_Image_.............................
call fcn.0040c4e0
add esp, 4
lea eax, [ebp - 0x9c]
xor edx, edx
mov ecx, str.bootcore.img.xz
push eax
lea eax, [ebp - 0x8c]
push eax
call fcn.0040c680
add esp, 8
test eax, eax
je 0x409246
push str.Failed_to_read_stage1_img
jmp 0x409a11
mov edx, dword [ebp - 0x9c]
lea eax, [ebp - 0x90]
push ecx
push eax
push edi
push 0
push ecx
mov ecx, dword [ebp - 0x8c]
call fcn.00413410
mov eax, dword [ebp - 0x8c]
add esp, 0x14
test eax, eax
je 0x409283
push eax
call fcn.00413ba8
add esp, 4
mov dword [ebp - 0x8c], 0
push dword [ebp - 0x90]
push str.bootcore.img.xz
push str.decompress__s_len:_d
call fcn.0040c4e0
add esp, 0xc
cmp dword [ebp - 0xc8], 0
je 0x409393
push 0xfbc00
lea eax, [edi + 0x4400]
mov byte [edi + 0x1f4], 0x23
push edi
push eax
call fcn.004140e0
add esp, 0xc
push 0x4400
push 0
push edi
call fcn.004198c0
add esp, 0xc
push 0x4400
push 0
push edi
call fcn.004198c0
add esp, 0xc
mov ecx, edi
push dword [esi + 0x14]
push dword [esi + 0x10]
call fcn.0040d860
push 0x4200
lea esi, [edi + 0x2100000]
push 0
push esi
mov dword [ebp - 0xb0], esi
call fcn.004198c0
add esp, 0x14
lea eax, [edi + 0x400]
push 0x4000
push eax
push esi
call fcn.00417290
add esp, 0xc
lea edx, [esi + 0x4000]
mov ecx, edi
call fcn.0040db80
mov eax, dword [edi + 0x420]
mov esi, dword [edi + 0x428]
mov ecx, dword [edi + 0x424]
sub esi, eax
mov dword [ebp - 0xcc], eax
mov eax, dword [edi + 0x42c]
sbb eax, ecx
mov dword [ebp - 0xd0], ecx
add esi, 1
mov dword [ebp - 0xac], esi
mov esi, dword [edi + 0x4a0]
adc eax, 0
mov dword [ebp - 0xd8], esi
mov esi, dword [edi + 0x4a4]
push str.Write_GPT_Info_OK_...
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0xd4], esi
call fcn.0040c4e0
add esp, 4
jmp 0x409416
push 0xffe00
lea eax, [edi + 0x200]
push edi
push eax
call fcn.004140e0
add esp, 0xc
push 0x200
push 0
push edi
call fcn.004198c0
add esp, 0xc
xor edx, edx
mov ecx, edi
push dword [esi + 0x14]
push dword [esi + 0x10]
call fcn.0040d490
mov eax, dword [edi + 0x1c6]
mov dword [ebp - 0xcc], eax
mov eax, dword [edi + 0x1ca]
mov dword [ebp - 0xac], eax
mov eax, dword [edi + 0x1d6]
push str.Write_MBR_OK_...
mov dword [ebp - 0xd0], 0
mov dword [ebp - 0xc0], 0
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0xd4], 0
call fcn.0040c4e0
add esp, 0xc
push str.Writing_EFI_part_Image_.............................
call fcn.0040c4e0
add esp, 4
lea eax, [ebp - 0x9c]
xor edx, edx
mov ecx, str.ventoy_ventoy.disk.img.xz
push eax
lea eax, [ebp - 0x8c]
push eax
call fcn.0040c680
add esp, 8
mov dword [ebp - 0xa8], eax
test eax, eax
je 0x409469
push dword [ebp - 0x9c]
mov ebx, dword [ebp - 0x8c]
push ebx
push str.Failed_to_read_img_file__p__u
call fcn.0040c4e0
add esp, 0xc
jmp 0x409a1f
push 0
push 0x29
push 0x402
push dword [0x432910]
call dword [sym.imp.USER32.dll_SendMessageW]
movsd xmm0, qword [0x42c410]
lea eax, [ebp - 0x48]
sub esp, 8
movsd qword [esp], xmm0
push str.Status____.0lf__
push 0x40
push eax
call fcn.004136cf
add esp, 0x14
lea eax, [ebp - 0x48]
push eax
push dword [0x43297c]
call dword [sym.imp.USER32.dll_SetWindowTextA]
push 0x80
push 0
push 0x431180
call fcn.004198c0
mov esi, dword [ebp - 0x9c]
lea ecx, [ebp - 0x90]
add esp, 8
lea eax, [edi + 0x100000]
mov edx, esi
mov dword [ebp - 0xdc], eax
push ecx
push eax
push 0
push ecx
mov ecx, dword [ebp - 0x8c]
call fcn.00413410
add esp, 0x14
cmp dword [ebp - 0x90], esi
jne 0x409a0c
push str.decompress_finished_success
call fcn.0040c4e0
mov esi, dword [0x430254]
lea eax, [edi + 0x100000]
add esp, 4
mov dword [0x431180], eax
push esi
push str.VentoyProcSecureBoot__d_...
call fcn.0040c4e0
add esp, 8
test esi, esi
je 0x40953d
push str.Secure_boot_is_enabled_...
call fcn.0040c4e0
add esp, 4
jmp 0x409542
call fcn.00407b50
push 0x42a030
lea eax, [ebp - 0x94]
push str.VentoySparseImg.vtsi
push eax
call fcn.004147e8
add esp, 0xc
cmp dword [ebp - 0x94], 0
jne 0x40956e
push str.Failed_to_create_Ventoy_img_file
jmp 0x409a11
push str.Writing_stage1_data_.............................
call fcn.0040c4e0
add esp, 4
push dword [ebp - 0x94]
push 0x100000
push 1
push edi
call fcn.00413b26
mov eax, dword [ebp - 0xac]
lea edi, [ebx + 0x10]
mov ecx, dword [ebp - 0xc0]
lea edx, [ebx + 0x18]
add esp, 0x10
mov dword [ebx], 0
add eax, dword [ebp - 0xcc]
mov dword [ebx + 4], 0
adc ecx, dword [ebp - 0xd0]
push 0
push 0x100000
mov dword [ebx + 8], 0x800
mov dword [ebx + 0xc], 0
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [0x432a04], ecx
push ecx
mov ecx, dword [ebp - 0x94]
mov dword [ebp - 0xa0], 0x100000
mov dword [ebp - 0x9c], 0
mov dword [0x432a08], 0xffffffff
mov dword [0x432a00], eax
call fcn.00404620
add esp, 0xc
push str.Formatting_part1_exFAT_...
call fcn.0040c4e0
mov eax, dword [ebp - 0xb8]
add esp, 4
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.004086a0
add esp, 8
test eax, eax
je 0x409664
push str.FormatPart1exFAT_failed.
call fcn.0040c4e0
add esp, 4
lea edx, [ebp - 0xa0]
lea ecx, [ebp - 0xa4]
call fcn.00404670
mov edi, dword [ebp - 0xb4]
jmp 0x409a19
lea edx, [ebp - 0xa0]
lea ecx, [ebp - 0xa4]
call fcn.00404670
mov esi, dword [ebp - 0xa4]
push dword [ebp - 0xa0]
inc esi
push esi
push str.current_segment_number:_d_dataoff:_ld
call fcn.0040c4e0
add esp, 0xc
push str.Writing_part2_data_.............................
call fcn.0040c4e0
add esp, 4
push dword [ebp - 0x94]
push 0x2000000
push 1
push dword [ebp - 0xdc]
call fcn.00413b26
mov eax, dword [ebp - 0xd8]
lea ecx, [esi + esi*2]
mov edx, dword [ebp - 0xa0]
add esp, 0x10
mov dword [ebx + ecx*8], eax
mov eax, dword [ebp - 0xd4]
mov dword [ebx + ecx*8 + 4], eax
mov eax, dword [ebp - 0x9c]
mov dword [ebx + ecx*8 + 8], 0x10000
mov dword [ebx + ecx*8 + 0xc], 0
mov dword [ebx + ecx*8 + 0x10], edx
mov dword [ebx + ecx*8 + 0x14], eax
mov eax, dword [ebx + ecx*8 + 8]
mov ecx, dword [ebx + ecx*8 + 0xc]
shld ecx, eax, 9
shl eax, 9
add edx, eax
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x90], edx
adc eax, ecx
inc esi
cmp dword [ebp - 0xc8], 0
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0xa4], esi
je 0x4097bc
push str.Writing_backup_gpt_table_.............................
call fcn.0040c4e0
add esp, 4
push dword [ebp - 0x94]
push 0x4200
push 1
push dword [ebp - 0xb0]
call fcn.00413b26
mov ecx, dword [ebp - 0xb8]
lea edx, [esi + esi*2]
add esp, 0x10
mov eax, dword [ecx + 0x10]
mov ecx, dword [ecx + 0x14]
shrd eax, ecx, 9
shr ecx, 9
add eax, 0xffffffdf
mov dword [ebx + edx*8], eax
mov eax, dword [ebp - 0x90]
adc ecx, 0xffffffff
mov dword [ebx + edx*8 + 4], ecx
mov ecx, dword [ebp - 0x9c]
mov dword [ebx + edx*8 + 8], 0x21
mov dword [ebx + edx*8 + 0xc], 0
mov dword [ebx + edx*8 + 0x10], eax
mov dword [ebx + edx*8 + 0x14], ecx
mov eax, dword [ebx + edx*8 + 8]
mov ecx, dword [ebx + edx*8 + 0xc]
shld ecx, eax, 9
shl eax, 9
add dword [ebp - 0x90], eax
adc dword [ebp - 0x9c], ecx
inc esi
mov dword [ebp - 0xa4], esi
push str.Writing_segment_metadata_.............................
call fcn.0040c4e0
add esp, 4
test esi, esi
jle 0x409812
xor ebx, ebx
nop
mov esi, dword [edi]
mov ecx, esi
mov edx, dword [edi + 4]
mov eax, edx
shrd ecx, eax, 9
shr eax, 9
push eax
push ecx
push edx
push esi
push dword [edi - 4]
push dword [edi - 8]
push dword [edi - 0xc]
push dword [edi - 0x10]
push ebx
push str.SEG__d_:__PhySector:_llu_SectorNum:_llu_DataOffset:_llu_sector:_llu_
call fcn.0040c4e0
mov esi, dword [ebp - 0xa4]
lea edi, [edi + 0x18]
inc ebx
add esp, 0x28
cmp ebx, esi
jl 0x4097d0
mov ebx, dword [ebp - 0xbc]
push dword [ebp - 0x94]
lea edi, [esi + esi*2]
shl edi, 3
push edi
push 1
push ebx
mov dword [ebp - 0xa8], edi
call fcn.00413b26
add esp, 0x10
and edi, 0x800001ff
jns 0x409840
dec edi
or edi, 0xfffffe00
inc edi
je 0x409869
push dword [ebp - 0x94]
mov eax, 0x200
sub eax, edi
mov edi, dword [ebp - 0xb4]
push eax
push 1
lea eax, [edi + 0xfe000]
push eax
call fcn.00413b26
add esp, 0x10
jmp 0x40986f
mov edi, dword [ebp - 0xb4]
mov ecx, dword [ebp - 0xb8]
xor edx, edx
mov dword [edi + 0x2104e00], 0x544e4556
mov dword [edi + 0x2104e04], 0x594f
mov dword [edi + 0x2104e08], 1
mov eax, dword [ecx + 0x10]
mov dword [edi + 0x2104e0c], eax
mov eax, dword [ecx + 0x14]
mov dword [edi + 0x2104e10], eax
mov eax, dword [ecx + 0x440]
xor ecx, ecx
mov dword [edi + 0x2104e14], eax
mov eax, dword [ebp - 0x90]
mov dword [edi + 0x2104e24], eax
mov eax, dword [ebp - 0x9c]
mov dword [edi + 0x2104e28], eax
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0xac], edx
mov dword [edi + 0x2104e1c], esi
mov dword [ebp - 0xb0], edx
cmp eax, 2
jl 0x409917
dec eax
mov dword [ebp - 0xbc], eax
mov esi, eax
movzx eax, byte [ebx + ecx]
add edx, eax
movzx eax, byte [ebx + ecx + 1]
add dword [ebp - 0xac], eax
add ecx, 2
cmp ecx, esi
jl 0x4098f3
mov esi, dword [ebp - 0xa4]
mov eax, dword [ebp - 0xa8]
cmp ecx, eax
jge 0x409925
movzx eax, byte [ecx + ebx]
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0xac]
xor ebx, ebx
mov ecx, dword [ebp - 0xc4]
add eax, edx
add eax, dword [ebp - 0xb0]
xor edx, edx
not eax
mov edi, pe_nt_image_headers32
mov dword [ecx + 0x20], eax
inc ecx
jmp 0x409950
movzx eax, byte [ecx - 1]
lea ecx, [ecx + 2]
add edx, eax
movzx eax, byte [ecx - 2]
add ebx, eax
dec edi
jne 0x409950
push dword [ebp - 0x9c]
mov edi, dword [ebp - 0x90]
add edx, ebx
mov ebx, dword [ebp - 0xc4]
not edx
push edi
push esi
push str.Writing_footer_segnum__u___segoffset__llu__......................
mov dword [ebx + 0x18], edx
call fcn.0040c4e0
push dword [ebx + 0x28]
push dword [ebx + 0x24]
push dword [ebx + 0x14]
push dword [ebx + 0x10]
push dword [ebx + 0xc]
push str.disk_size_llu_disk_signature_lx_segment_offset_llu
call fcn.0040c4e0
push dword [ebp - 0x94]
push 0x200
push 1
push ebx
call fcn.00413b26
push dword [ebp - 0x94]
call fcn.00414899
mov eax, dword [ebp - 0xa8]
add esp, 0x3c
add eax, 0x1ff
cdq
and edx, 0x1ff
add eax, edx
and eax, 0xfffffe00
cdq
add eax, edi
adc edx, dword [ebp - 0x9c]
add eax, 0x200
adc edx, 0
push edx
push eax
push str.Writing_Ventoy_image_file_finished__the_file_size_should_be__llu_.
call fcn.0040c4e0
mov edi, dword [ebp - 0xb4]
add esp, 0xc
mov dword [ebp - 0xa8], 0
jmp 0x409a19
push str.decompress_finished_failed
call fcn.0040c4e0
add esp, 4
mov ebx, dword [ebp - 0x8c]
push 0
push 0x30
push 0x402
push dword [0x432910]
call dword [sym.imp.USER32.dll_SendMessageW]
movsd xmm0, qword [0x42c428]
lea eax, [ebp - 0x48]
sub esp, 8
movsd qword [esp], xmm0
push str.Status____.0lf__
push 0x40
push eax
call fcn.004136cf
add esp, 0x14
lea eax, [ebp - 0x48]
push eax
push dword [0x43297c]
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov esi, dword [ebp - 0xa8]
push esi
push str.retcode:_d_n
call fcn.0040c4e0
add esp, 8
test edi, edi
je 0x409a88
push edi
call fcn.00413ba8
add esp, 4
test ebx, ebx
je 0x409a95
push ebx
call fcn.00413ba8
add esp, 4
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004136c0
mov esp, ebp
pop ebp
ret