Function at 0x140009070
Capabilities:
Create process on windows
Get disk information
Self delete

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0x630]
sub rsp, 0x730
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x620], rax
lea r13, [rcx + 0x2d]
mov rsi, rcx
lea rcx, str.VentoyHook_Path:__s_
mov rdx, r13
mov qword [rsp + 0x58], r13
call fcn.140005180
mov rcx, r13
mov rdx, r13
neg rcx
movzx eax, byte [rdx]
test al, al
je 0x1400090ee
cmp al, 0x7f
ja 0x1400090e2
inc rdx
lea rax, [rcx + rdx]
cmp rax, 0x104
jl 0x1400090c6
jmp 0x1400090ee
lea rcx, str.This_file_is_UTF8_encoding
call fcn.140005180
xor r14d, r14d
mov r15b, 0x41
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
lea rcx, str.Logic_Drives:_0x_x
mov edx, eax
mov ebx, eax
call fcn.140005180
test ebx, ebx
je 0x140009304
test bl, 1
je 0x1400092f9
movsx edi, r15b
lea r8, [0x1400242ec]
lea rcx, [rbp]
mov edx, 0x104
mov r9d, edi
mov qword [rsp + 0x20], r13
call fcn.14000d244
lea rdx, [rbp]
lea rcx, [0x140022bfc]
call fcn.1400058b0
mov edx, edi
test eax, eax
je 0x1400092ed
lea rcx, str.File_exist_under__C:
call fcn.140005180
xor eax, eax
lea r9, [rsp + 0x60]
lea rdx, [rsp + 0x78]
xor r8d, r8d
movzx ecx, r15b
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
call fcn.140005a70
test eax, eax
jne 0x1400092f9
mov rax, qword [rsp + 0x78]
cmp rax, qword [rsi + 0x11]
jne 0x1400092f9
mov rax, qword [rbp - 0x80]
cmp rax, qword [rsi + 0x19]
jne 0x1400092f9
lea rcx, str.Disk_UUID_match
mov qword [rsp + 0x768], r12
call fcn.140005180
lea rdx, [rbp]
lea rcx, str.Find_ISO_file___s_
call fcn.140005180
cmp byte [0x14002bc3e], 1
jne 0x140009361
mov r12d, dword [0x14002bc3f]
xor r13d, r13d
mov sil, 0x41
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
lea rcx, str.Logic_Drives:_0x_x__VentoySig:_08X
mov edx, eax
mov r8d, r12d
mov edi, eax
call fcn.140005180
test edi, edi
je 0x140009285
test dil, 1
je 0x14000927e
xor eax, eax
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x78]
movzx ecx, sil
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x50], eax
call fcn.140005a70
test eax, eax
jne 0x14000927e
mov r14, qword [rsp + 0x68]
mov edx, dword [rsp + 0x50]
lea rcx, str.DiskSig_08X_PartStart_lld
mov r8, r14
call fcn.140005180
cmp dword [rsp + 0x50], r12d
jne 0x14000927e
cmp r14, 0x100000
je 0x14000933b
inc sil
shr edi, 1
jne 0x140009212
lea rcx, str.Now_wait_and_retry_...
call fcn.140005180
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
inc r13d
cmp r13d, 5
jl 0x1400091f2
lea rcx, str.Failed_to_find_ventoy_disk
call fcn.140005180
mov eax, 1
mov r12, qword [rsp + 0x768]
mov rcx, qword [rbp + 0x620]
xor rcx, rsp
call fcn.14000d130
lea r11, [rsp + 0x730]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rbp
ret
lea rcx, str.File_NOT_exist_under__C:
call fcn.140005180
inc r15b
shr ebx, 1
jne 0x140009112
lea rcx, str.Now_wait_and_retry_...
call fcn.140005180
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
inc r14d
cmp r14d, 5
jl 0x1400090f1
lea rcx, str.Failed_to_find_ISO_file
call fcn.140005180
mov eax, 1
jmp 0x1400092c2
lea rcx, str.Ventoy_Disk_Sig_match
call fcn.140005180
movsx r14d, sil
lea rcx, str.Find_Ventoy_Letter:__C
mov edx, r14d
call fcn.140005180
mov r13, qword [rsp + 0x58]
jmp 0x140009374
movsx r14d, r15b
lea rcx, str.No_vlnk_mode__C
mov edx, r14d
call fcn.140005180
mov esi, dword [rsp + 0x60]
mov ecx, esi
call fcn.140008ba0
test eax, eax
je 0x14000971a
lea rcx, str.Disk_check_OK__C:__u
mov r8d, esi
mov edx, r14d
call fcn.140005180
mov dword [0x14002bc34], esi
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
lea rcx, str.Drives_before_mount:_0x_x
mov edx, eax
mov edi, eax
call fcn.140005180
lea rdx, [rbp + 0x110]
lea rcx, [rbp]
call fcn.140008cd0
test eax, eax
je 0x1400093e5
lea rcx, str.This_is_lenovo_recovery_image__mount_VTLRI_file.
call fcn.140005180
lea rcx, [rbp + 0x110]
mov edx, esi
call fcn.140008f40
jmp 0x14000941e
lea rcx, str.This_is_normal_image__mount_ISO_file.
call fcn.140005180
lea rcx, [rbp]
call fcn.140006960
test eax, eax
je 0x140009413
lea rdx, [rbp]
lea rcx, str.Skip_mount_ISO_file_for___s_
call fcn.140005180
xor r12d, r12d
jmp 0x140009421
lea rcx, [rbp]
mov edx, esi
call fcn.140006c40
mov r12d, eax
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
lea rcx, str.Drives_after_mount:_0x_x__0x_x_
mov ebx, eax
mov edx, eax
xor ebx, edi
mov r8d, ebx
call fcn.140005180
mov dil, 0x41
test ebx, ebx
je 0x140009470
test bl, 1
jne 0x140009451
inc dil
shr ebx, 1
jne 0x140009443
jmp 0x140009470
movsx edx, dil
lea rcx, str.The_ISO_file_is_mounted_at__C:
test ebx, 0xfffffffe
je 0x14000946b
lea rcx, str.Maybe_the_ISO_file_is_mounted_at__C:
call fcn.140005180
lea rbx, str.SUCCESS
lea rdx, str.FAILED
test r12d, r12d
lea rcx, str.Mount_ISO_FILE:__s
cmove rdx, rbx
call fcn.140005180
movzx r8d, byte [0x14002ba30]
movzx r9d, byte [0x14002ba35]
cmp r8b, 1
je 0x1400094ad
cmp r9b, 1
jne 0x1400094ba
lea rcx, [rbp]
movzx edx, dil
call fcn.140008840
mov ecx, esi
call fcn.140006d90
lea rdx, str.NO_NEED
lea rcx, str.Delete_ventoy_mountpoint:__s
test eax, eax
cmove rdx, rbx
call fcn.140005180
cmp byte [0x14002b730], 0
je 0x140009528
lea rdx, str.X:_vtoy_auto_install
lea rcx, [0x140022bfc]
call fcn.1400058b0
test eax, eax
je 0x140009516
lea rdx, str.X:_vtoy_auto_install
lea rcx, str.use_auto_install_script__s...
call fcn.140005180
mov edx, esi
call fcn.140008270
jmp 0x140009534
lea rdx, [rbp]
lea rcx, str.auto_install_script__s_not_exist
call fcn.140005180
jmp 0x140009534
lea rcx, str.auto_install_no_need
call fcn.140005180
cmp byte [0x14002b8b0], 0
je 0x140009707
lea rax, [0x14002b8b0]
lea r8, str._C:_s
lea rcx, [rbp]
mov r9d, r14d
mov edx, 0x104
mov qword [rsp + 0x20], rax
call fcn.14000d244
lea rdx, [rbp]
lea rcx, [0x140022bfc]
call fcn.1400058b0
lea rdx, [rbp]
test eax, eax
je 0x1400096f4
lea rcx, str.decompress_injection_archive__s...
call fcn.140005180
lea rcx, [rbp]
mov edx, esi
call fcn.140007140
lea rdx, str.X:VentoyAutoRun.bat
lea rcx, [0x140022bfc]
call fcn.1400058b0
lea rdx, str.X:VentoyAutoRun.bat
test eax, eax
je 0x1400096e1
lea rcx, str._s_exist__now_run_it...
xor esi, esi
mov dword [rsp + 0x60], 0x18
mov qword [rsp + 0x68], rsi
mov dword [rsp + 0x70], 1
call fcn.140005180
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov qword [rsp + 0x30], rsi
lea r9, [rsp + 0x60]
lea edx, [rsi + 4]
lea r8d, [rsi + 3]
lea rcx, str.X:VentoyAutoRun.log
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateFileA]
or dword [rbp - 0x34], 0x100
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14000962d
mov qword [rbp - 0x10], rax
mov qword [rbp - 0x18], rax
lea r8, [0x1400242ec]
lea rcx, [rbp]
movsx r9d, r15b
mov edx, 0x104
mov qword [rsp + 0x20], r13
call fcn.14000d244
movsx eax, dil
lea r9, str.X:VentoyAutoRun.bat
mov dword [rsp + 0x28], eax
lea rax, [rbp]
lea r8, str.cmd.exe__c__s___s___C
lea rcx, [rbp + 0x220]
mov edx, 0x400
mov qword [rsp + 0x20], rax
call fcn.14000d244
lea rax, [rsp + 0x78]
lea rdx, [rbp + 0x220]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x70]
xor r9d, r9d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
xor r8d, r8d
xor ecx, ecx
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rcx, qword [rsp + 0x78]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp rbx, 0xffffffffffffffff
je 0x140009713
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1400092ba
lea rcx, str._s_not_exist...
call fcn.140005180
xor eax, eax
jmp 0x1400092ba
lea rcx, str.injection_archive__s_not_exist
call fcn.140005180
xor eax, eax
jmp 0x1400092ba
lea rcx, str.no_injection_archive_found
call fcn.140005180
xor eax, eax
jmp 0x1400092ba
lea rcx, str.Failed_to_check_ventoy_disk__u
mov edx, esi
call fcn.140005180
jmp 0x1400092b5