Function at 0x140009d60
Capabilities:
Copy file
Create process on windows
Move file

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x610]
sub rsp, 0x710
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x600], rax
movsxd rbx, ecx
mov r15, rdx
lea rcx, [rbp + 0x201]
xor edx, edx
mov r8d, 0x3ff
mov byte [rbp + 0x200], 0
call fcn.14000fe80
lea rcx, str._real_main__argc___d
mov edx, ebx
call fcn.140005180
lea rdx, [0x14002bc60]
lea rcx, str.program_full_path:___s_
call fcn.140005180
lea rdx, [0x14002bd70]
lea rcx, str.program_dir:___s_
call fcn.140005180
lea rdx, [0x14002bb30]
lea rcx, str.program_name:___s_
call fcn.140005180
lea rcx, str.argc___d
mov edx, ebx
call fcn.140005180
xor edi, edi
mov r14d, edi
mov esi, edi
test rbx, rbx
jle 0x140009e60
nop
mov r8, qword [r15 + rsi*8]
lea rcx, str.argv__d___s_
mov edx, r14d
call fcn.140005180
test r14d, r14d
jle 0x140009e55
lea r8, [0x140024930]
lea rcx, [rbp + 0x200]
mov edx, 0x400
call fcn.14000e484
mov r8, qword [r15 + rsi*8]
lea rcx, [rbp + 0x200]
mov edx, 0x400
call fcn.14000e484
inc rsi
inc r14d
cmp rsi, rbx
jl 0x140009e10
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
lea rcx, [rbp - 0x20]
xor edx, edx
mov r8d, 0x104
call fcn.14000fe80
lea r8, [rbp - 0x20]
mov rdx, r15
call fcn.1400097a0
lea r8, [rbp + 0x200]
lea rdx, [rbp - 0x20]
lea rcx, str.LunchFile__s__CallParam__s_
mov ebx, eax
call fcn.140005180
lea rdx, str.winpeshl.exe
lea rcx, [0x14002bb30]
call fcn.14000d4b0
mov esi, 1
test eax, eax
je 0x140009fa2
lea rdx, [0x14002bb30]
lea rcx, str.ventoy_s
call fcn.1400058b0
test eax, eax
je 0x140009fa2
lea r9, [0x14002bd70]
lea r8, str._sVTOYJUMP.EXE
lea rcx, [rbp + 0xf0]
mov edx, 0x104
call fcn.14000d244
lea rdx, [rbp + 0xf0]
lea rcx, [0x14002bc60]
call qword [sym.imp.KERNEL32.dll_MoveFileA]
lea r8, [rbp + 0xf0]
lea rdx, [0x14002bc60]
lea rcx, str.Move___s__to___s_
call fcn.140005180
lea r9, [0x14002bb30]
lea r8, str.ventoy_s
lea rcx, [rbp + 0xf0]
mov edx, 0x104
call fcn.14000d244
lea rdx, [0x14002bc60]
lea rcx, [rbp + 0xf0]
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_CopyFileA]
lea r8, [0x14002bc60]
lea rdx, [rbp + 0xf0]
lea rcx, str.Copy___s__to___s_
call fcn.140005180
lea r9, [0x14002bc60]
lea r8, [0x140022bfc]
lea rcx, [rbp - 0x20]
mov edx, 0x104
call fcn.14000d244
lea rdx, [rbp - 0x20]
lea rcx, str.Final_lunchFile_is___s_
jmp 0x140009fb0
lea rdx, [0x14002bb30]
lea rcx, str.We_dont_need_to_recover_original___s_
call fcn.140005180
cmp byte [0x14002bc38], 3
jne 0x140009fe8
lea rcx, str.Open_log_for_debug_...
call fcn.140005180
lea r9, str.notepad.exe_ventoy.log
lea r8, [0x140022bfc]
lea rcx, [rbp - 0x20]
mov edx, 0x104
call fcn.14000d244
jmp 0x14000a04c
lea rcx, [rbp - 0x20]
cmp byte [rbp + 0x200], dil
je 0x14000a008
lea r8, [rbp + 0x200]
mov edx, 0x104
call fcn.14000e484
jmp 0x14000a02c
lea rdx, str.setup.exe
call fcn.14000d720
test rax, rax
jne 0x14000a02c
lea rcx, str.Not_setup.exe__hide_windows.
call fcn.140005180
or dword [rbp - 0x54], esi
mov word [rbp - 0x50], di
lea rax, str.success
test ebx, ebx
lea rdx, str.failed
lea rcx, str.Ventoy_jump__s_...
cmove rdx, rax
call fcn.140005180
lea rdx, [rbp - 0x20]
lea rcx, str.Now_launch___s__...
call fcn.140005180
cmp byte [0x14002bc38], 4
jne 0x14000a094
lea rcx, str.Open_cmd_for_debug_...
call fcn.140005180
or dword [rbp - 0x54], esi
lea r9, str.cmd.exe
lea r8, [0x140022bfc]
lea rcx, [rbp - 0x20]
mov edx, 0x104
mov word [rbp - 0x50], si
call fcn.14000d244
lea rcx, str.Backup_log_at_this_point
call fcn.140005180
lea rdx, str.X:Windows_ventoy.backup
lea rcx, str.X:Windows_system32_ventoy.log
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_CopyFileA]
lea rax, [rsp + 0x50]
lea rdx, [rbp - 0x20]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
xor r8d, r8d
xor ecx, ecx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test ebx, ebx
je 0x14000a124
cmp edi, 0x708
jge 0x14000a124
lea rcx, str.Ventoy_hook_failed__now_wait_and_retry_...
call fcn.140005180
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x14002be80]
inc edi
call fcn.140009070
test eax, eax
jne 0x14000a0f3
lea rcx, str.Wait_process...
call fcn.140005180
mov rcx, qword [rsp + 0x50]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rcx, str.vtoyjump_finished
call fcn.140005180
xor eax, eax
mov rcx, qword [rbp + 0x600]
xor rcx, rsp
call fcn.14000d130
mov rbx, qword [rsp + 0x750]
add rsp, 0x710
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret