Function at 0x409010
Capabilities:
Check mutex on windows
Copy file
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x674
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x670], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
lea eax, [esp + 0x279]
push 0x3ff
push 0
push eax
mov byte [esp + 0x284], 0
call fcn.004126f0
mov esi, dword [sym.imp.KERNEL32.dll_CreateMutexA]
add esp, 0xc
push str.VTOYLOG_LOCK
push 0
push 0
call esi
push str.VTOYINS_LOCK
push 0
push 0
mov dword [0x42509c], eax
call esi
push 0x20
push str._VentoyJump__dbit_
mov dword [0x4250a4], eax
call fcn.004044f0
mov ebx, dword [ebp + 8]
add esp, 8
cmp ebx, 1
jle 0x4090d9
mov eax, dword [edi + 4]
mov ecx, str.VTLRI_SRV
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4090b4
test dl, dl
je 0x4090b0
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4090b4
add eax, 2
add ecx, 2
test dl, dl
jne 0x409094
xor eax, eax
jmp 0x4090b9
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4090d9
mov edx, edi
call fcn.00408ed0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x670]
xor ecx, esp
call fcn.0040b2c4
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x170]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [esp + 0x170]
push eax
push str.Current_directory_is___s_
call fcn.004044f0
add esp, 8
push 0x104
push 0x4262f0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push ecx
call fcn.00404320
add esp, 4
push 0x4261b8
push 0x4263f8
push 0x4262f0
push str.EXE_path:___s__dir:__s__name:__s_
call fcn.004044f0
push str.X:Windows_system32_vtoy_wimboot
call fcn.00404bf0
add esp, 0x14
test eax, eax
je 0x409186
push str.This_is_wimboot_mode_...
call fcn.004044f0
add esp, 4
mov dword [0x4250ac], 1
push str.X:Windows_system32_vtoy_wimboot_done
call fcn.00404bf0
add esp, 4
test eax, eax
jne 0x409193
call fcn.00408dc0
push 1
mov edx, 0x4262f0
mov ecx, str.X:Windows_system32_vtoy_wimboot_done
call fcn.00404a10
jmp 0x409190
push str.This_is_normal_mode_...
call fcn.004044f0
add esp, 4
push str.WinLogon.exe
push 0x4261b8
call fcn.0040b5b0
add esp, 8
test eax, eax
jne 0x4091de
push str.This_time_is_rejump_back_...
call fcn.004044f0
add esp, 4
push dword [edi + 4]
push 0x104
push 0x4262f0
call fcn.0040b358
add esp, 8
call fcn.00404320
add esp, 4
lea ecx, [ebx - 1]
lea edx, [edi + 4]
jmp 0x4093bf
push str.PECMD.exe
push 0x4261b8
call fcn.0040b5b0
add esp, 8
test eax, eax
jne 0x40938c
push 0x4263f8
lea eax, [esp + 0x6c]
push 0x104
push eax
call fcn.0040b358
add esp, 0xc
cmp byte [esp + 0x68], 0
je 0x409236
lea esi, [esp + 0x68]
lea ebx, [ebx]
movsx eax, byte [esi]
push eax
call fcn.0040c2f0
mov byte [esi], al
lea esi, [esi + 1]
add esp, 4
cmp byte [esi], 0
jne 0x409220
lea eax, [esp + 0x68]
push str.SYSTEM32
push eax
call fcn.0040b800
add esp, 8
test eax, eax
jne 0x409286
push str.X:Windows_system32VTOYJUMP.EXE
call fcn.00404bf0
add esp, 4
test eax, eax
je 0x409286
push str.Just_call_original_pecmd.exe
call fcn.004044f0
add esp, 4
lea eax, [esp + 0x278]
push str.X:Windows_system32PECMD.EXE
push 0x400
push eax
call fcn.0040b358
add esp, 0xc
jmp 0x4092c9
push str.We_need_to_rejump_for_pecmd_...
call fcn.004044f0
add esp, 4
call fcn.00408550
push 1
push str.ventoyWinLogon.exe
push 0x4262f0
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 0x4262f0
push str.ventoyWinLogon.exe__s
lea eax, [esp + 0x280]
push 0x400
push eax
call fcn.0040b3ad
add esp, 0x10
mov esi, 1
cmp ebx, esi
jle 0x409309
push 0x420fdc
lea eax, [esp + 0x27c]
push 0x400
push eax
call fcn.0040c56c
add esp, 0xc
lea eax, [esp + 0x278]
push dword [edi + esi*4]
push 0x400
push eax
call fcn.0040c56c
inc esi
add esp, 0xc
cmp esi, ebx
jl 0x4092d2
lea eax, [esp + 0x278]
push eax
push str.Now_rejump_to___s__...
call fcn.004044f0
add esp, 8
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x24]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x298]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push str.Wait_rejump_process...
call fcn.004044f0
add esp, 4
push 0xffffffffffffffff
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push str.rejump_finished
call fcn.004044f0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x670]
xor ecx, esp
call fcn.0040b2c4
mov esp, ebp
pop ebp
ret
push str.We_dont_need_to_rejump_...
call fcn.004044f0
add esp, 4
call fcn.00408550
push 0x4262f0
lea eax, [esp + 0x6c]
push 0x104
push eax
call fcn.0040b358
lea eax, [esp + 0x74]
add esp, 0xc
mov dword [edi], eax
mov edx, edi
mov ecx, ebx
call fcn.004089d0
mov ecx, dword [esp + 0x67c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040b2c4
mov esp, ebp
pop ebp
ret