Function at 0x407e40
Capabilities:
Create process on windows
Get disk information
Self delete

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x69c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov eax, ecx
push esi
push edi
mov dword [ebp - 0x690], eax
lea ebx, [eax + 0x2d]
push ebx
push str.VentoyHook_Path:__s_
mov dword [ebp - 0x698], ebx
call fcn.004044f0
add esp, 8
xor eax, eax
mov cl, byte [eax + ebx]
test cl, cl
je 0x407e9a
cmp cl, 0x7f
ja 0x407e8d
inc eax
cmp eax, 0x104
jl 0x407e77
jmp 0x407e9a
push str.This_file_is_UTF8_encoding
call fcn.004044f0
add esp, 4
xor edi, edi
lea esp, [esp]
mov byte [ebp - 0x68a], 0x41
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ebx, eax
push ebx
push str.Logic_Drives:_0x_x
call fcn.004044f0
add esp, 8
test ebx, ebx
je 0x4080fc
mov al, byte [ebp - 0x68a]
jmp 0x407ed0
test bl, 1
je 0x4080ec
push dword [ebp - 0x698]
movsx esi, al
lea eax, [ebp - 0x120]
push esi
push 0x4209fc
push 0x104
push eax
call fcn.0040b3ad
add esp, 0x14
lea eax, [ebp - 0x120]
push eax
push 0x41f478
call fcn.00404bf0
add esp, 8
push esi
test eax, eax
je 0x4080d9
push str.File_exist_under__C:
call fcn.004044f0
mov cl, byte [ebp - 0x68a]
lea eax, [ebp - 0x640]
xorps xmm0, xmm0
lea edx, [ebp - 0x14]
push eax
push 0
movdqu xmmword [ebp - 0x14], xmm0
movdqu xmmword [ebp - 0x640], xmm0
movq qword [ebp - 0x630], xmm0
call fcn.00404d30
add esp, 0x10
test eax, eax
jne 0x4080e6
mov eax, dword [ebp - 0x690]
lea edx, [ebp - 0x14]
add eax, 0x11
mov esi, 0xc
mov edi, edi
mov ecx, dword [edx]
cmp ecx, dword [eax]
jne 0x4080e6
add edx, 4
add eax, 4
sub esi, 4
jae 0x407f70
push str.Disk_UUID_match
call fcn.004044f0
add esp, 4
lea eax, [ebp - 0x120]
push eax
push str.Find_ISO_file___s_
call fcn.004044f0
add esp, 8
cmp byte [0x4262c6], 1
jne 0x40815d
mov esi, dword [0x4262c7]
xor edi, edi
mov dword [ebp - 0x694], esi
mov dword [ebp - 0x690], edi
jmp 0x407fd0
mov byte [ebp - 0x689], 0x41
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ebx, eax
push esi
push ebx
push str.Logic_Drives:_0x_x__VentoySig:_08X
call fcn.004044f0
add esp, 0xc
test ebx, ebx
je 0x4080aa
mov al, byte [ebp - 0x689]
lea esp, [esp]
test bl, 1
je 0x40808e
lea ecx, [ebp - 0x640]
mov dword [ebp - 0x69c], 0
push ecx
lea ecx, [ebp - 0x69c]
xorps xmm0, xmm0
push ecx
lea edx, [ebp - 0x14]
movq qword [ebp - 0x630], xmm0
mov cl, al
movdqu xmmword [ebp - 0x14], xmm0
movdqu xmmword [ebp - 0x640], xmm0
call fcn.00404d30
add esp, 8
test eax, eax
jne 0x408088
push dword [ebp - 0x634]
mov edi, dword [ebp - 0x638]
mov esi, dword [ebp - 0x69c]
push edi
push esi
push str.DiskSig_08X_PartStart_lld
call fcn.004044f0
add esp, 0x10
cmp esi, dword [ebp - 0x694]
jne 0x408088
cmp edi, 0x100000
jne 0x408088
cmp dword [ebp - 0x634], 0
je 0x408141
mov al, byte [ebp - 0x689]
inc al
shr ebx, 1
mov byte [ebp - 0x689], al
jne 0x408000
mov esi, dword [ebp - 0x694]
mov edi, dword [ebp - 0x690]
push str.Now_wait_and_retry_...
call fcn.004044f0
add esp, 4
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
inc edi
mov dword [ebp - 0x690], edi
cmp edi, 5
jl 0x407fd0
push str.Failed_to_find_ventoy_disk
jmp 0x408123
push str.File_NOT_exist_under__C:
call fcn.004044f0
add esp, 8
mov al, byte [ebp - 0x68a]
inc al
shr ebx, 1
mov byte [ebp - 0x68a], al
jne 0x407ed0
push str.Now_wait_and_retry_...
call fcn.004044f0
add esp, 4
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 5
jl 0x407ea0
push str.Failed_to_find_ISO_file
call fcn.004044f0
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040b2c4
mov esp, ebp
pop ebp
ret
push str.Ventoy_Disk_Sig_match
call fcn.004044f0
movsx edi, byte [ebp - 0x689]
add esp, 4
push edi
push str.Find_Ventoy_Letter:__C
jmp 0x40816a
movsx edi, byte [ebp - 0x68a]
push edi
push str.No_vlnk_mode__C
call fcn.004044f0
mov esi, dword [ebp - 0x640]
add esp, 8
mov ecx, esi
call fcn.00407a90
push esi
test eax, eax
je 0x408536
push edi
push str.Disk_check_OK__C:__u
call fcn.004044f0
mov ebx, dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
add esp, 0xc
mov dword [0x4262e8], esi
call ebx
push eax
push str.Drives_before_mount:_0x_x
mov dword [ebp - 0x694], eax
call fcn.004044f0
add esp, 8
lea edx, [ebp - 0x228]
lea ecx, [ebp - 0x120]
call fcn.00407bb0
test eax, eax
je 0x4081e9
push str.This_is_lenovo_recovery_image__mount_VTLRI_file.
call fcn.004044f0
add esp, 4
lea ecx, [ebp - 0x228]
mov edx, esi
call fcn.00407d50
jmp 0x408203
push str.This_is_normal_image__mount_ISO_file.
call fcn.004044f0
add esp, 4
lea ecx, [ebp - 0x120]
mov edx, esi
call fcn.00405d90
mov dword [ebp - 0x690], eax
call ebx
mov ebx, eax
xor ebx, dword [ebp - 0x694]
push ebx
push eax
push str.Drives_after_mount:_0x_x__0x_x_
call fcn.004044f0
add esp, 0xc
mov al, 0x41
mov byte [ebp - 0x689], al
test ebx, ebx
je 0x408263
mov edi, edi
test bl, 1
jne 0x408243
inc al
shr ebx, 1
mov byte [ebp - 0x689], al
jne 0x408230
jmp 0x408263
movsx eax, al
push eax
test ebx, 0xfffffffe
jne 0x408256
push str.The_ISO_file_is_mounted_at__C:
jmp 0x40825b
push str.Maybe_the_ISO_file_is_mounted_at__C:
call fcn.004044f0
add esp, 8
cmp dword [ebp - 0x690], 0
mov ecx, str.FAILED
mov eax, str.SUCCESS
cmovne eax, ecx
push eax
push str.Mount_ISO_FILE:__s
call fcn.004044f0
mov cl, byte [0x4260b8]
add esp, 8
mov al, byte [0x4260bd]
cmp cl, 1
je 0x408299
cmp al, 1
jne 0x4082b9
mov bl, byte [ebp - 0x689]
movzx eax, al
mov dl, bl
push eax
movzx eax, cl
lea ecx, [ebp - 0x120]
push eax
call fcn.00407860
add esp, 8
jmp 0x4082bf
mov bl, byte [ebp - 0x689]
mov ecx, esi
call fcn.00405f30
test eax, eax
mov ecx, str.NO_NEED
mov eax, str.SUCCESS
cmovne eax, ecx
push eax
push str.Delete_ventoy_mountpoint:__s
call fcn.004044f0
add esp, 8
cmp byte [0x425db8], 0
je 0x408333
push str.X:_vtoy_auto_install
push 0x41f478
call fcn.00404bf0
add esp, 8
test eax, eax
je 0x40831d
push str.X:_vtoy_auto_install
push str.use_auto_install_script__s...
call fcn.004044f0
add esp, 8
mov edx, esi
call fcn.004072e0
jmp 0x408340
lea eax, [ebp - 0x120]
push eax
push str.auto_install_script__s_not_exist
call fcn.004044f0
add esp, 8
jmp 0x408340
push str.auto_install_no_need
call fcn.004044f0
add esp, 4
cmp byte [0x425f38], 0
je 0x408516
push 0x425f38
push edi
push str._C:_s
lea eax, [ebp - 0x120]
push 0x104
push eax
call fcn.0040b3ad
add esp, 0x14
lea eax, [ebp - 0x120]
push eax
push 0x41f478
call fcn.00404bf0
add esp, 8
test eax, eax
lea eax, [ebp - 0x120]
push eax
je 0x4084f6
push str.decompress_injection_archive__s...
call fcn.004044f0
mov edx, esi
lea ecx, [ebp - 0x120]
call fcn.00406260
push str.X:VentoyAutoRun.bat
push 0x41f478
call fcn.00404bf0
add esp, 0x10
push str.X:VentoyAutoRun.bat
test eax, eax
je 0x4084d6
push str._s_exist__now_run_it...
mov dword [ebp - 0x10], 0xc
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 1
call fcn.004044f0
add esp, 8
lea eax, [ebp - 0x688]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
push 0
push 0x80
push 4
lea eax, [ebp - 0x10]
push eax
push 3
push 4
push str.X:VentoyAutoRun.log
call dword [sym.imp.KERNEL32.dll_CreateFileA]
or dword [ebp - 0x65c], 0x100
mov esi, eax
cmp esi, 0xffffffff
je 0x40842d
mov dword [ebp - 0x648], esi
mov dword [ebp - 0x64c], esi
push dword [ebp - 0x698]
movsx eax, byte [ebp - 0x68a]
push eax
push 0x4209fc
lea eax, [ebp - 0x120]
push 0x104
push eax
call fcn.0040b3ad
add esp, 0x14
movsx eax, bl
push eax
lea eax, [ebp - 0x120]
push eax
push str.X:VentoyAutoRun.bat
push str.cmd.exe__c__s___s___C
lea eax, [ebp - 0x628]
push 0x400
push eax
call fcn.0040b3ad
add esp, 0x18
lea eax, [ebp - 0x638]
push eax
lea eax, [ebp - 0x688]
push eax
push 0
push 0
push 0x8000000
push 1
push 0
push 0
lea eax, [ebp - 0x628]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0xffffffffffffffff
push dword [ebp - 0x638]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp esi, 0xffffffff
je 0x408523
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040b2c4
mov esp, ebp
pop ebp
ret
push str._s_not_exist...
call fcn.004044f0
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040b2c4
mov esp, ebp
pop ebp
ret
push str.injection_archive__s_not_exist
call fcn.004044f0
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040b2c4
mov esp, ebp
pop ebp
ret
push str.no_injection_archive_found
call fcn.004044f0
add esp, 4
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b2c4
mov esp, ebp
pop ebp
ret
push str.Failed_to_check_ventoy_disk__u
call fcn.004044f0
add esp, 8
jmp 0x40812b