Function at 0x140007140
Capabilities:
Create process on windows
Delete file
Get disk size

Disassembly:
push rbp
push rbx
push rsi
push r14
push r15
lea rbp, [rsp - 0x260]
sub rsp, 0x360
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x250], rax
xor r15d, r15d
mov ebx, edx
mov r14, rcx
mov rdx, rcx
lea rcx, str.DecompressInjectionArchive__s
mov dword [rsp + 0x60], 0x18
mov dword [rsp + 0x50], r15d
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x68], r15
mov dword [rsp + 0x70], 1
call fcn.140005180
lea r8, str..PhysicalDrive_d
lea rcx, [rbp + 0x30]
mov r9d, ebx
mov edx, 0x104
call fcn.14000d244
mov qword [rsp + 0x30], r15
lea r8d, [r15 + 3]
lea rcx, [rbp + 0x30]
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x140007205
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [rbp + 0x30]
lea rcx, str.Could_not_open_the_disk__s___error:_u
mov r8d, eax
call fcn.140005180
jmp 0x140007511
mov qword [rsp + 0x38], r15
lea rax, [rbp + 0x20]
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x28]
xor r8d, r8d
mov edx, 0x7405c
mov rcx, rsi
mov dword [rsp + 0x28], 8
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x14000725a
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [rbp + 0x30]
lea rcx, str.Could_not_get_phy_disk__s_size__error:_u
mov r8d, eax
call fcn.140005180
jmp 0x140007508
mov rcx, rsi
mov qword [0x14002b728], rsi
call fcn.1400062f0
lea rcx, str.Parse_FAT_fs...
mov qword [0x14002bc58], rax
call fcn.140005180
call fcn.140002510
call fcn.1400025e0
test eax, eax
jne 0x140007503
lea rdx, str.ventoy7za.xz
lea rcx, str._ventoy_7z_64_7za.xz
mov qword [rsp + 0x3a0], rdi
call fcn.140005f40
lea r8, [rsp + 0x54]
lea rdx, [rsp + 0x58]
lea rcx, str.ventoy7za.xz
call fcn.140005560
mov ebx, dword [rsp + 0x54]
lea rcx, str.7za.xz_file_size:_u
mov edx, ebx
call fcn.140005180
mov ecx, 0x400000
call fcn.14000d2a8
mov rdi, rax
test rax, rax
je 0x14000735c
mov rcx, qword [rsp + 0x58]
mov qword [0x14002a9c8], rax
lea rax, [rsp + 0x50]
mov edx, ebx
mov qword [rsp + 0x28], rax
mov dword [0x14002a9b8], r15d
call fcn.14000cad0
mov edx, ebx
cmp dword [rsp + 0x50], ebx
jne 0x14000731f
mov r8d, dword [0x14002a9b8]
lea rcx, str.Decompress_success_7za.xz__u_______7za.exe__d_
jmp 0x140007329
mov r8d, ebx
lea rcx, str.Decompress_failed_7za.xz__u_______7za.exe__u_
call fcn.140005180
mov r8d, dword [0x14002a9b8]
lea rcx, str.ventoy7za.exe
mov rdx, rdi
call fcn.1400056c0
mov rcx, rdi
mov qword [0x14002a9c8], r15
mov dword [0x14002a9b8], r15d
call fcn.14000d268
jmp 0x140007368
lea rcx, str.Failed_to_alloc_4MB_memory
call fcn.140005180
lea r8, str.ventoy7za.exe_x__y__aoa__oX:__s
lea rcx, [rbp + 0x30]
mov r9, r14
mov edx, 0x104
call fcn.14000d244
lea rcx, str.extract_inject_to_X:
call fcn.140005180
lea rdx, [rbp + 0x30]
lea rcx, str.cmdline:__s_
call fcn.140005180
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov edx, 4
mov qword [rsp + 0x30], r15
lea r9, [rsp + 0x60]
lea rcx, str.ventoy7z.log
lea r8d, [rdx - 1]
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateFileA]
or dword [rbp - 0x14], 0x100
mov rdi, qword [rsp + 0x3a0]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400073f6
mov qword [rbp + 0x10], rax
mov qword [rbp + 8], rax
lea rax, [rbp - 0x70]
lea rdx, [rbp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x50]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
xor ecx, ecx
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rcx, qword [rbp - 0x70]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rbp + 0x140]
mov rcx, r14
call fcn.140006f90
test eax, eax
je 0x1400074f4
lea rdx, [rbp + 0x140]
lea rcx, str.Decompress_tar_archive...__s_
call fcn.140005180
lea r9, [rbp + 0x140]
lea r8, str.ventoy7za.exe_x__y__aoa__oX:__s
lea rcx, [rbp + 0x30]
mov edx, 0x104
call fcn.14000d244
lea rax, [rsp + 0x78]
lea rdx, [rbp + 0x30]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x50]
xor r9d, r9d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
xor r8d, r8d
xor ecx, ecx
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rcx, qword [rsp + 0x78]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rbp + 0x140]
lea rcx, str.Now_delete__s
call fcn.140005180
lea rcx, [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp rbx, 0xffffffffffffffff
je 0x140007503
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.140002650
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rcx, qword [rbp + 0x250]
xor rcx, rsp
call fcn.14000d130
add rsp, 0x360
pop r15
pop r14
pop rsi
pop rbx
pop rbp
ret