Function at 0x4089d0
Capabilities:
Copy file
Create process on windows
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x674
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x3ff
lea eax, [ebp - 0x617]
mov byte [ebp - 0x618], 0
push 0
push eax
mov ebx, edx
mov edi, ecx
call fcn.004126f0
add esp, 0xc
push edi
push str._real_main__argc___d
call fcn.004044f0
push 0x4262f0
push str.program_full_path:___s_
call fcn.004044f0
push 0x4263f8
push str.program_dir:___s_
call fcn.004044f0
push 0x4261b8
push str.program_name:___s_
call fcn.004044f0
push edi
push str.argc___d
call fcn.004044f0
add esp, 0x28
xor esi, esi
test edi, edi
jle 0x408a9d
push dword [ebx + esi*4]
push esi
push str.argv__d___s_
call fcn.004044f0
add esp, 0xc
test esi, esi
jle 0x408a98
push 0x420fdc
lea eax, [ebp - 0x618]
push 0x400
push eax
call fcn.0040c56c
add esp, 0xc
lea eax, [ebp - 0x618]
push dword [ebx + esi*4]
push 0x400
push eax
call fcn.0040c56c
add esp, 0xc
inc esi
cmp esi, edi
jl 0x408a53
lea eax, [ebp - 0x660]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
push 0x104
lea eax, [ebp - 0x110]
push 0
push eax
call fcn.004126f0
add esp, 0xc
lea eax, [ebp - 0x110]
mov edx, ebx
push eax
call fcn.004085b0
add esp, 4
mov edi, eax
lea eax, [ebp - 0x618]
push eax
lea eax, [ebp - 0x110]
push eax
push str.LunchFile__s__CallParam__s_
call fcn.004044f0
add esp, 0xc
push str.winpeshl.exe
push 0x4261b8
call fcn.0040b5b0
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileA]
add esp, 8
test eax, eax
je 0x408be9
push 0x4261b8
push str.ventoy_s
call fcn.00404bf0
add esp, 8
test eax, eax
je 0x408be9
push 0x4263f8
push str._sVTOYJUMP.EXE
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.0040b3ad
add esp, 0x10
lea eax, [ebp - 0x218]
push eax
push 0x4262f0
call dword [sym.imp.KERNEL32.dll_MoveFileA]
lea eax, [ebp - 0x218]
push eax
push 0x4262f0
push str.Move___s__to___s_
call fcn.004044f0
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x4261b8
push str.ventoy_s
push 0x104
push eax
call fcn.0040b3ad
add esp, 0x10
lea eax, [ebp - 0x218]
push 1
push 0x4262f0
push eax
call esi
push 0x4262f0
lea eax, [ebp - 0x218]
push eax
push str.Copy___s__to___s_
call fcn.004044f0
add esp, 0xc
lea eax, [ebp - 0x110]
push 0x4262f0
push 0x41f478
push 0x104
push eax
call fcn.0040b3ad
lea eax, [ebp - 0x110]
push eax
push str.Final_lunchFile_is___s_
call fcn.004044f0
add esp, 0x18
jmp 0x408bfb
push 0x4261b8
push str.We_dont_need_to_recover_original___s_
call fcn.004044f0
add esp, 8
cmp byte [0x4262c0], 3
jne 0x408c31
push str.Open_log_for_debug_...
call fcn.004044f0
add esp, 4
lea eax, [ebp - 0x110]
push str.notepad.exe_ventoy.log
push 0x41f478
push 0x104
push eax
call fcn.0040b3ad
add esp, 0x10
jmp 0x408ca9
cmp byte [ebp - 0x618], 0
je 0x408c57
lea eax, [ebp - 0x618]
push eax
lea eax, [ebp - 0x110]
push 0x104
push eax
call fcn.0040c56c
add esp, 0xc
jmp 0x408c8c
lea eax, [ebp - 0x110]
push str.setup.exe
push eax
call fcn.0040b800
add esp, 8
test eax, eax
jne 0x408c8c
push str.Not_setup.exe__hide_windows.
call fcn.004044f0
or dword [ebp - 0x634], 1
add esp, 4
xor eax, eax
mov word [ebp - 0x630], ax
mov ecx, str.failed
test edi, edi
mov eax, str.success
cmovne eax, ecx
push eax
push str.Ventoy_jump__s_...
call fcn.004044f0
add esp, 8
lea eax, [ebp - 0x110]
push eax
push str.Now_launch___s__...
call fcn.004044f0
add esp, 8
cmp byte [0x4262c0], 4
jne 0x408d04
push str.Open_cmd_for_debug_...
call fcn.004044f0
or dword [ebp - 0x634], 1
add esp, 4
mov eax, 1
mov word [ebp - 0x630], ax
lea eax, [ebp - 0x110]
push str.cmd.exe
push 0x41f478
push 0x104
push eax
call fcn.0040b3ad
add esp, 0x10
push str.Backup_log_at_this_point
call fcn.004044f0
add esp, 4
push 1
push str.X:Windows_ventoy.backup
push str.X:Windows_system32_ventoy.log
call esi
lea eax, [ebp - 0x670]
push eax
lea eax, [ebp - 0x660]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x110]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
xor esi, esi
test edi, edi
je 0x408d7f
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, 0x708
jge 0x408d7f
push str.Ventoy_hook_failed__now_wait_and_retry_...
call fcn.004044f0
add esp, 4
push 0x3e8
call edi
mov ecx, 0x426500
inc esi
call fcn.00407e40
test eax, eax
jne 0x408d54
push str.Wait_process...
call fcn.004044f0
add esp, 4
push 0xffffffffffffffff
push dword [ebp - 0x670]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push str.vtoyjump_finished
call fcn.004044f0
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
xor eax, eax
pop edi
pop esi
pop ebx
call fcn.0040b2c4
mov esp, ebp
pop ebp
ret