Function at 0x4085b0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, edx
mov dword [ebp - 0x120], eax
lea eax, [ebp - 0x110]
xor edi, edi
mov ebx, 1
mov dword [ebp - 0x118], edi
mov dword [ebp - 0x114], edi
push dword [esi]
push 0x41f478
push 0x104
push eax
call fcn.0040b3ad
lea eax, [ebp - 0x110]
push eax
push 0x41f478
call fcn.00404bf0
add esp, 0x18
test eax, eax
jne 0x408676
lea eax, [ebp - 0x110]
push eax
push eax
push str.File__s_NOT_exist__now_try__s.exe
call fcn.004044f0
add esp, 0xc
lea eax, [ebp - 0x110]
push dword [esi]
push str._s.exe
push 0x104
push eax
call fcn.0040b3ad
lea eax, [ebp - 0x110]
push eax
push 0x41f478
call fcn.00404bf0
test eax, eax
mov edx, 0x420ea8
mov ecx, 0x420ea4
lea eax, [ebp - 0x110]
cmove ecx, edx
push ecx
push eax
push str.File__s_exist____s
call fcn.004044f0
add esp, 0x24
lea eax, [ebp - 0x11c]
push eax
lea edx, [ebp - 0x114]
lea ecx, [ebp - 0x110]
call fcn.00404870
add esp, 4
test eax, eax
jne 0x40877c
push 0x20
push str.VentoyJump__dbit
call fcn.004044f0
mov eax, dword [0x4250a4]
add esp, 8
test eax, eax
je 0x4086c2
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, eax
mov dword [ebp - 0x118], eax
call fcn.00408550
mov esi, eax
mov eax, dword [0x4250a4]
test eax, eax
je 0x4086dd
test edi, edi
jne 0x4086dd
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test esi, esi
jne 0x40877c
mov edi, dword [ebp - 0x11c]
xor ebx, ebx
test edi, edi
je 0x40876a
mov ecx, dword [ebp - 0x114]
mov eax, 0xfffffcff
sub eax, ecx
mov dword [ebp - 0x124], eax
lea esi, [ecx + 0x501]
lea ebx, [ebx]
lea ecx, [esi - 0x501]
call fcn.00404990
test eax, eax
je 0x408760
cmp byte [esi - 0x301], 0
lea ecx, [esi + 0xff]
je 0x408749
mov edx, dword [esi]
test edx, edx
je 0x408749
mov eax, dword [ebp - 0x124]
add eax, 0x43c
add eax, edx
add eax, esi
cmp eax, edi
jae 0x408749
add ecx, edx
cmp byte [ecx], 0x4d
jne 0x408760
cmp byte [ecx + 1], 0x5a
jne 0x408760
mov eax, dword [ecx + 0x3c]
cmp dword [ecx + eax], 0x4550
je 0x4087a2
add ebx, 0x10
add esi, 0x10
cmp ebx, edi
jb 0x408710
push str.OS_param_not_found
call fcn.004044f0
mov ebx, 1
add esp, 4
mov eax, dword [ebp - 0x114]
test eax, eax
je 0x40878f
push eax
call fcn.0040b3c9
add esp, 4
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b2c4
mov esp, ebp
pop ebp
ret
push ebx
push str.Find_os_pararm_at__u
call fcn.004044f0
mov eax, dword [ebp - 0x114]
mov ecx, 0x80
add eax, ebx
mov edi, 0x426500
mov esi, eax
rep movsd dword es:[edi], dword [esi]
lea esi, [eax + 0x200]
mov ecx, 0x100
mov edi, 0x425db8
rep movsd dword es:[edi], dword [esi]
push dword [eax + 0x501]
lea esi, [eax + 0x200]
xor edi, edi
push esi
push str.ExtractWindowsDataFile:_auto_install___s:_d_
call fcn.004044f0
add esp, 0x14
cmp byte [esi], 0
je 0x40881a
mov eax, dword [esi + 0x301]
test eax, eax
je 0x40881a
push eax
lea edx, [esi + 0x400]
mov ecx, str.X:_vtoy_auto_install
call fcn.00404a10
mov edi, dword [esi + 0x301]
add esp, 4
movdqu xmm1, xmmword [0x4266c1]
movdqu xmm0, xmmword [0x4266d1]
movd eax, xmm1
movdqu xmmword [0x4262c0], xmm1
movdqu xmmword [0x4262d0], xmm0
cmp al, 1
jne 0x40884c
push str.break_here_for_debug_.....
jmp 0x40876f
xor eax, eax
mov edi, edi
mov cl, byte [eax + 0x42652d]
test cl, cl
je 0x40886e
cmp cl, 0x2f
jne 0x408866
mov byte [eax + 0x42652d], 0x5c
inc eax
cmp eax, 0x180
jb 0x408850
lea eax, [ebp - 0x110]
add edi, 0x600
push 0x41f3f0
push eax
add edi, ebx
call fcn.0040b800
add esp, 8
test eax, eax
je 0x4088c1
lea ecx, [ebp - 0x110]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x408897
sub ecx, edx
test ecx, ecx
jle 0x4088c1
lea edx, [ebp - 0x110]
lea ebx, [ebx]
mov al, byte [edx + ecx - 1]
cmp al, 0x2f
je 0x4088fd
cmp al, 0x5c
je 0x4088fd
dec ecx
test ecx, ecx
jg 0x4088b0
lea eax, [ebp - 0x110]
mov esi, dword [ebp - 0x120]
push eax
push str.ventoy_s
push 0x104
push esi
call fcn.0040b3ad
mov eax, dword [0x4250a4]
add esp, 0x10
test eax, eax
je 0x408907
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebx, eax
mov dword [ebp - 0x118], ebx
jmp 0x40890d
lea eax, [ebp - 0x110]
add eax, ecx
jmp 0x4088c7
mov ebx, dword [ebp - 0x118]
push esi
push 0x41f478
call fcn.00404bf0
add esp, 8
test eax, eax
je 0x408954
push str.vtoyjump_multiple_call_...
call fcn.004044f0
mov eax, dword [0x4250a4]
add esp, 4
xor ebx, ebx
test eax, eax
je 0x40877c
cmp dword [ebp - 0x118], ebx
jne 0x40877c
push eax
mov eax, dword [sym.imp.KERNEL32.dll_ReleaseMutex]
call eax
jmp 0x40877c
mov esi, dword [ebp - 0x11c]
mov eax, esi
mov edx, dword [ebp - 0x114]
sub eax, edi
mov ecx, dword [ebp - 0x120]
push eax
lea edx, [edi + edx]
call fcn.00404a10
mov eax, dword [0x4250a4]
add esp, 4
test eax, eax
je 0x40898b
test ebx, ebx
jne 0x40898b
push eax
mov eax, dword [sym.imp.KERNEL32.dll_ReleaseMutex]
call eax
cmp edi, esi
jae 0x40876a
cmp byte [0x4262c0], 2
jne 0x4089b0
push str.skip_hook_for_debug_.....
call fcn.004044f0
add esp, 4
xor ebx, ebx
jmp 0x40877c
mov ecx, 0x426500
call fcn.00407e40
mov ebx, eax
jmp 0x40877c