Function at 0x394c80
Capabilities:
Create process on windows
Delete file
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2a8
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, ecx
mov dword [ebp - 0x234], 0xc
push edi
push eax
push str.DecompressInjectionArchive__s
mov esi, edx
mov dword [ebp - 0x2a4], eax
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x22c], 1
call fcn.00393880
push esi
push str..PhysicalDrive_d
lea eax, [ebp - 0x110]
push 0x104
push eax
call fcn.00395c7a
add esp, 0x18
lea eax, [ebp - 0x110]
push 0
push 0
push 3
push 0
push 3
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x394d25
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x110]
push eax
push str.Could_not_open_the_disk__s___error:_u
call fcn.00393880
add esp, 0xc
jmp 0x394f70
push 0
lea eax, [ebp - 0x21c]
push eax
push 8
lea eax, [ebp - 0x228]
push eax
push 0
push 0
push 0x7405c
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x394d71
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x110]
push eax
push str.Could_not_get_phy_disk__s_size__error:_u
call fcn.00393880
add esp, 0xc
jmp 0x394f6d
mov ecx, edi
mov dword [0x3abf8c], edi
call fcn.00394410
push str.Parse_FAT_fs...
mov dword [0x3ac818], eax
mov dword [0x3ac81c], edx
call fcn.00393880
add esp, 4
call fcn.003920f0
call fcn.003921a0
test eax, eax
jne 0x394f3f
mov edx, str.ventoy7za.exe
mov ecx, str._ventoy_7z_64_7za.exe
cmp dword [0x3abf78], eax
jne 0x394dbf
mov ecx, str._ventoy_7z_32_7za.exe
call fcn.00394220
push dword [ebp - 0x2a4]
lea eax, [ebp - 0x110]
push str.ventoy7za.exe_x__y__aoa__oX:__s
push 0x104
push eax
call fcn.00395c7a
push str.extract_inject_to_X:
call fcn.00393880
add esp, 0x14
lea eax, [ebp - 0x110]
push eax
push str.cmdline:__s_
call fcn.00393880
add esp, 8
lea eax, [ebp - 0x2a0]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
push 0
push 0x80
push 4
lea eax, [ebp - 0x234]
push eax
push 3
push 4
push str.ventoy7z.log
call dword [sym.imp.KERNEL32.dll_CreateFileA]
or dword [ebp - 0x274], 0x100
mov esi, eax
cmp esi, 0xffffffff
je 0x394e4a
mov dword [ebp - 0x260], esi
mov dword [ebp - 0x264], esi
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x2a0]
push eax
push 0
push 0
push 0x8000000
push 1
push 0
push 0
lea eax, [ebp - 0x110]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0xffffffffffffffff
push dword [ebp - 0x244]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 0x2a4]
lea edx, [ebp - 0x218]
call fcn.00394b70
test eax, eax
je 0x394f29
lea eax, [ebp - 0x218]
push eax
push str.Decompress_tar_archive...__s_
call fcn.00393880
lea eax, [ebp - 0x218]
push eax
push str.ventoy7za.exe_x__y__aoa__oX:__s
lea eax, [ebp - 0x110]
push 0x104
push eax
call fcn.00395c7a
add esp, 0x18
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x2a0]
push eax
push 0
push 0
push 0x8000000
push 1
push 0
push 0
lea eax, [ebp - 0x110]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0xffffffffffffffff
push dword [ebp - 0x254]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x218]
push eax
push str.Now_delete__s
call fcn.00393880
add esp, 8
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp esi, 0xffffffff
je 0x394f39
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
jmp 0x394f3f
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x3abf70], 0
jne 0x394f4d
call fcn.003920f0
mov eax, dword [0x3ac85c]
test eax, eax
je 0x394f58
call eax
mov ecx, 0x3ac820
call fcn.00393000
mov eax, dword [0x3ac860]
test eax, eax
je 0x394f6d
call eax
push edi
call esi
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
xor ecx, ebp
pop esi
call fcn.003959f4
mov esp, ebp
pop ebp
ret