Function at 0x394540
Capabilities:
Create process on windows
Get common file path
Get disk information
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x188
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov eax, ecx
mov esi, edx
push eax
push str.VentoyMountISOByImdisk__s
mov dword [ebp - 0x188], eax
mov edi, 1
call fcn.00393880
push esi
push str..PhysicalDrive_d
lea eax, [ebp - 0x110]
push 0x104
push eax
call fcn.00395c7a
add esp, 0x18
lea eax, [ebp - 0x110]
push 0
push 0
push 3
push 0
push 3
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
mov dword [ebp - 0x180], esi
cmp esi, 0xffffffff
jne 0x3945df
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x110]
push eax
push str.Could_not_open_the_disk__s___error:_u
call fcn.00393880
add esp, 0xc
mov eax, edi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.003959f4
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 0x114]
push eax
push 8
lea eax, [ebp - 0x120]
push eax
push 0
push 0
push 0x7405c
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x394625
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x110]
push eax
push str.Could_not_get_phy_disk__s_size__error:_u
call fcn.00393880
add esp, 0xc
jmp 0x3947f0
mov ecx, esi
mov dword [0x3abf8c], esi
call fcn.00394410
push str.Parse_FAT_fs...
mov dword [0x3ac818], eax
mov dword [0x3ac81c], edx
call fcn.00393880
add esp, 4
call fcn.003920f0
call fcn.003921a0
test eax, eax
jne 0x3947c2
mov edx, str.ventoyimdisk.sys
cmp dword [0x3abf78], eax
je 0x394689
mov ecx, str._ventoy_imdisk_64_imdisk.sys
call fcn.00394220
mov edx, str.ventoyimdisk.exe
mov ecx, str._ventoy_imdisk_64_imdisk.exe
call fcn.00394220
mov ecx, str._ventoy_imdisk_64_imdisk.cpl
jmp 0x3946a7
mov ecx, str._ventoy_imdisk_32_imdisk.sys
call fcn.00394220
mov edx, str.ventoyimdisk.exe
mov ecx, str._ventoy_imdisk_32_imdisk.exe
call fcn.00394220
mov ecx, str._ventoy_imdisk_32_imdisk.cpl
mov edx, str.ventoyimdisk.cpl
call fcn.00394220
lea eax, [ebp - 0x110]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push str._ventoyimdisk.sys
lea eax, [ebp - 0x110]
push 0x104
push eax
call fcn.003962a7
add esp, 0xc
lea ecx, [ebp - 0x110]
call fcn.00393980
test eax, eax
jne 0x3947c2
mov dword [ebp - 0x184], eax
mov esi, 0x1000000
mov byte [ebp - 0x179], 0x59
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
push edi
push str.Drives0x_x
call fcn.00393880
mov al, byte [ebp - 0x179]
add esp, 8
lea ecx, [ecx]
test esi, edi
je 0x39472a
dec al
shr esi, 1
jne 0x394720
movsx esi, al
lea eax, [ebp - 0x110]
push esi
push dword [ebp - 0x188]
push str.ventoyimdisk.exe__a__o_ro__f__s__m__C:
push 0x104
push eax
call fcn.00395c7a
add esp, 0x14
lea eax, [ebp - 0x110]
push eax
push esi
push str.mount_iso_to__C:_use_imdisk_cmd___s_
call fcn.00393880
add esp, 0xc
lea eax, [ebp - 0x168]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
or dword [ebp - 0x13c], 1
xor eax, eax
mov word [ebp - 0x138], ax
lea eax, [ebp - 0x178]
push eax
lea eax, [ebp - 0x168]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x110]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0xffffffffffffffff
push dword [ebp - 0x178]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, dword [ebp - 0x180]
mov edi, dword [ebp - 0x184]
cmp dword [0x3abf70], 0
jne 0x3947d0
call fcn.003920f0
mov eax, dword [0x3ac85c]
test eax, eax
je 0x3947db
call eax
mov ecx, 0x3ac820
call fcn.00393000
mov eax, dword [0x3ac860]
test eax, eax
je 0x3947f0
call eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.003959f4
mov esp, ebp
pop ebp
ret