Function at 0x404c80
Capabilities:
Create process on windows
Delete file
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2a8
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, ecx
mov dword [ebp - 0x234], 0xc
push edi
push eax
push str.DecompressInjectionArchive__s
mov esi, edx
mov dword [ebp - 0x2a4], eax
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x22c], 1
call fcn.00403880
push esi
push str..PhysicalDrive_d
lea eax, [ebp - 0x110]
push 0x104
push eax
call fcn.00405c7a
add esp, 0x18
lea eax, [ebp - 0x110]
push 0
push 0
push 3
push 0
push 3
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x404d25
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x110]
push eax
push str.Could_not_open_the_disk__s___error:_u
call fcn.00403880
add esp, 0xc
jmp 0x404f70
push 0
lea eax, [ebp - 0x21c]
push eax
push 8
lea eax, [ebp - 0x228]
push eax
push 0
push 0
push 0x7405c
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x404d71
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x110]
push eax
push str.Could_not_get_phy_disk__s_size__error:_u
call fcn.00403880
add esp, 0xc
jmp 0x404f6d
mov ecx, edi
mov dword [0x41bf8c], edi
call fcn.00404410
push str.Parse_FAT_fs...
mov dword [0x41c818], eax
mov dword [0x41c81c], edx
call fcn.00403880
add esp, 4
call fcn.004020f0
call fcn.004021a0
test eax, eax
jne 0x404f3f
mov edx, str.ventoy7za.exe
mov ecx, str._ventoy_7z_64_7za.exe
cmp dword [0x41bf78], eax
jne 0x404dbf
mov ecx, str._ventoy_7z_32_7za.exe
call fcn.00404220
push dword [ebp - 0x2a4]
lea eax, [ebp - 0x110]
push str.ventoy7za.exe_x__y__aoa__oX:__s
push 0x104
push eax
call fcn.00405c7a
push str.extract_inject_to_X:
call fcn.00403880
add esp, 0x14
lea eax, [ebp - 0x110]
push eax
push str.cmdline:__s_
call fcn.00403880
add esp, 8
lea eax, [ebp - 0x2a0]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
push 0
push 0x80
push 4
lea eax, [ebp - 0x234]
push eax
push 3
push 4
push str.ventoy7z.log
call dword [sym.imp.KERNEL32.dll_CreateFileA]
or dword [ebp - 0x274], 0x100
mov esi, eax
cmp esi, 0xffffffff
je 0x404e4a
mov dword [ebp - 0x260], esi
mov dword [ebp - 0x264], esi
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x2a0]
push eax
push 0
push 0
push 0x8000000
push 1
push 0
push 0
lea eax, [ebp - 0x110]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0xffffffffffffffff
push dword [ebp - 0x244]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 0x2a4]
lea edx, [ebp - 0x218]
call fcn.00404b70
test eax, eax
je 0x404f29
lea eax, [ebp - 0x218]
push eax
push str.Decompress_tar_archive...__s_
call fcn.00403880
lea eax, [ebp - 0x218]
push eax
push str.ventoy7za.exe_x__y__aoa__oX:__s
lea eax, [ebp - 0x110]
push 0x104
push eax
call fcn.00405c7a
add esp, 0x18
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x2a0]
push eax
push 0
push 0
push 0x8000000
push 1
push 0
push 0
lea eax, [ebp - 0x110]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0xffffffffffffffff
push dword [ebp - 0x254]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x218]
push eax
push str.Now_delete__s
call fcn.00403880
add esp, 8
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp esi, 0xffffffff
je 0x404f39
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
jmp 0x404f3f
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x41bf70], 0
jne 0x404f4d
call fcn.004020f0
mov eax, dword [0x41c85c]
test eax, eax
je 0x404f58
call eax
mov ecx, 0x41c820
call fcn.00403000
mov eax, dword [0x41c860]
test eax, eax
je 0x404f6d
call eax
push edi
call esi
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
xor ecx, ebp
pop esi
call fcn.004059f4
mov esp, ebp
pop ebp
ret