Function at 0x14000a470
Capabilities:
Check mutex on windows
Copy file
Create process on windows
Get common file path
Write and execute a file
Write file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0x718
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x700], rax
movsxd rbp, ecx
mov rsi, rdx
lea rcx, [rsp + 0x301]
xor edx, edx
mov r8d, 0x3ff
mov byte [rsp + 0x300], 0
call fcn.14000fe80
lea r8, str.VTOYLOG_LOCK
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
lea r8, str.VTOYINS_LOCK
xor edx, edx
xor ecx, ecx
mov qword [0x14002a9b0], rax
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
lea rcx, str._VentoyJump__dbit_
mov edx, 0x40
mov qword [0x14002a9c0], rax
call fcn.140005180
cmp ebp, 1
jle 0x14000a516
mov rcx, qword [rsi + 8]
lea rdx, str.VTLRI_SRV
call fcn.14001cb60
test eax, eax
jne 0x14000a516
mov rdx, rsi
call fcn.14000a2d0
jmp 0x14000a8c5
mov qword [rsp + 0x740], rbx
lea rdx, [rsp + 0x1f0]
mov ecx, 0x104
mov qword [rsp + 0x748], rdi
mov qword [rsp + 0x710], r14
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea rdx, [rsp + 0x1f0]
lea rcx, str.Current_directory_is___s_
call fcn.140005180
lea rdx, [0x14002bc60]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call fcn.140004f20
lea r9, [0x14002bb30]
lea r8, [0x14002bd70]
lea rdx, [0x14002bc60]
lea rcx, str.EXE_path:___s__dir:__s__name:__s_
call fcn.140005180
lea rcx, str.X:Windows_system32_vtoy_wimboot
call fcn.1400058b0
xor r14d, r14d
lea edi, [r14 + 1]
test eax, eax
je 0x14000a65a
lea rcx, str.This_is_wimboot_mode_...
call fcn.140005180
lea rcx, str.X:Windows_system32_vtoy_wimboot_done
mov dword [0x14002a9bc], edi
call fcn.1400058b0
test eax, eax
jne 0x14000a666
call fcn.14000a180
lea rdx, str.X:Windows_system32_vtoy_wimboot_done
lea rcx, str.SaveBuffer2File___s__len:_u
mov r8d, edi
call fcn.140005180
mov qword [rsp + 0x30], r14
lea r8d, [r14 + 3]
lea rcx, str.X:Windows_system32_vtoy_wimboot_done
xor r9d, r9d
mov edx, 0xc0000000
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14000a632
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Could_not_create_new_file__error:_u
mov edx, eax
call fcn.140005180
jmp 0x14000a666
lea r9, [rsp + 0x68]
lea rdx, [0x14002bc60]
mov r8d, edi
mov rcx, rax
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000a666
lea rcx, str.This_is_normal_mode_...
call fcn.140005180
lea rdx, str.WinLogon.exe
lea rcx, [0x14002bb30]
call fcn.14000d4b0
test eax, eax
jne 0x14000a6af
lea rcx, str.This_time_is_rejump_back_...
call fcn.140005180
mov r8, qword [rsi + 8]
lea rcx, [0x14002bc60]
mov edx, 0x104
call fcn.14000d1e0
call fcn.140004f20
lea ecx, [rbp - 1]
lea rdx, [rsi + 8]
jmp 0x14000a8a8
lea rdx, str.PECMD.exe
lea rcx, [0x14002bb30]
call fcn.14000d4b0
test eax, eax
jne 0x14000a86e
lea r8, [0x14002bd70]
lea rcx, [rsp + 0xe0]
mov edx, 0x104
call fcn.14000d1e0
cmp byte [rsp + 0xe0], r14b
je 0x14000a709
lea rbx, [rsp + 0xe0]
movsx ecx, byte [rbx]
call fcn.14000e1f4
lea rbx, [rbx + 1]
mov byte [rbx - 1], al
cmp byte [rbx], r14b
jne 0x14000a6f5
lea rdx, str.SYSTEM32
lea rcx, [rsp + 0xe0]
call fcn.14000d720
test rax, rax
jne 0x14000a759
lea rcx, str.X:Windows_system32VTOYJUMP.EXE
call fcn.1400058b0
test eax, eax
je 0x14000a759
lea rcx, str.Just_call_original_pecmd.exe
call fcn.140005180
lea r8, str.X:Windows_system32PECMD.EXE
lea rcx, [rsp + 0x300]
mov edx, 0x400
call fcn.14000d1e0
jmp 0x14000a7a1
lea rcx, str.We_need_to_rejump_for_pecmd_...
call fcn.140005180
call fcn.140009730
lea rdx, str.ventoyWinLogon.exe
lea rcx, [0x14002bc60]
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_CopyFileA]
lea r9, [0x14002bc60]
lea r8, str.ventoyWinLogon.exe__s
lea rcx, [rsp + 0x300]
mov edx, 0x400
call fcn.14000d244
cmp rdi, rbp
jge 0x14000a7e7
nop word [rax + rax]
lea r8, [0x140024930]
lea rcx, [rsp + 0x300]
mov edx, 0x400
call fcn.14000e484
mov r8, qword [rsi + rdi*8]
lea rcx, [rsp + 0x300]
mov edx, 0x400
call fcn.14000e484
inc rdi
cmp rdi, rbp
jl 0x14000a7b0
lea rdx, [rsp + 0x300]
lea rcx, str.Now_rejump_to___s__...
call fcn.140005180
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
lea rax, [rsp + 0x50]
lea rdx, [rsp + 0x300]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
xor r8d, r8d
xor ecx, ecx
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
lea rcx, str.Wait_rejump_process...
call fcn.140005180
mov rcx, qword [rsp + 0x50]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rcx, str.rejump_finished
call fcn.140005180
xor eax, eax
jmp 0x14000a8ad
lea rcx, str.We_dont_need_to_rejump_...
call fcn.140005180
call fcn.140009730
lea r8, [0x14002bc60]
lea rcx, [rsp + 0xe0]
mov edx, 0x104
call fcn.14000d1e0
lea rax, [rsp + 0xe0]
mov rdx, rsi
mov qword [rsi], rax
mov ecx, ebp
call fcn.140009d60
mov rdi, qword [rsp + 0x748]
mov rbx, qword [rsp + 0x740]
mov r14, qword [rsp + 0x710]
mov rcx, qword [rsp + 0x700]
xor rcx, rsp
call fcn.14000d130
add rsp, 0x718
pop rsi
pop rbp
ret