Function at 0x14003109b
Capabilities:
Check mutex on windows
Copy file
Delete file
Get common file path
Get session user name
Identify system language via api
Log keystrokes via polling
Move file
Parse pe header
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x638
xor eax, eax
mov qword [rsp + 0x680], rcx
lea rbp, [rsp + 0x528]
mov qword [rsp + 0x690], r8
mov dword [rsp + 0x94], eax
mov dword [rsp + 0x98], eax
mov dword [rsp + 0x9c], eax
call qword [sym.imp.KERNEL32.DLL_GetUserDefaultUILanguage]
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rbp
xor r8d, r8d
movzx eax, ax
mov r9d, 0x20019
mov dword [rsp + 0xa0], 1
lea rdx, str.SoftwareMicrosoftVisualStudio
mov dword [rsp + 0x60], eax
xor eax, eax
mov qword [rsp + 0x528], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov rcx, qword [rsp + 0x528]
mov dword [rsp + 0x70], eax
test rcx, rcx
je 0x140031138
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, 0x41
lea rdi, [rsp + 0x320]
mov dword [rsp + 0xac], 4
mov dword [rsp + 0xa8], eax
xor eax, eax
lea rsi, str.extra_devs
rep stosd dword [rdi], eax
lea rdi, [rsp + 0x424]
mov ecx, 0x41
mov word [rsp + 0x91], 0x6272
rep stosd dword [rdi], eax
mov ecx, 0x41
mov rdi, rbp
mov byte [rsp + 0x93], 0
rep stosd dword [rdi], eax
lea rdi, [rsp + 0x120]
mov ecx, 0x40
rep movsd dword [rdi], dword [rsi]
lea rcx, [0x140091192]
call qword [sym.imp.KERNEL32.DLL_SetDllDirectoryA]
mov ecx, 0x800
call qword [sym.imp.KERNEL32.DLL_SetDefaultDllDirectories]
lea rcx, str._Rufus_init__n
call fcn.140036717
lea rdx, [rsp + 0xac]
lea rcx, [rsp + 0xa8]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x1400311ec
xor eax, eax
cmp dword [rsp + 0xa8], 0x6c696e
sete al
mov edx, 2
mov ecx, 0x104
mov dword [0x14010e064], eax
mov dword [0x14010e080], 1
call sub.msvcrt.dll_calloc
mov r13, qword [sym.imp.KERNEL32.DLL_GetLastError]
test rax, rax
mov rbx, rax
jne 0x14003122a
mov ecx, 0xe
call qword [sym.imp.KERNEL32.DLL_SetLastError]
jmp 0x1400312bd
mov r8d, 0x104
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
mov edi, eax
call r13
mov esi, eax
test edi, edi
je 0x1400312a9
lea eax, [rdi - 1]
add rax, rax
add rax, rbx
cmp rax, rbx
je 0x14003126a
cmp word [rax], 0x5c
lea rdx, [rax - 2]
jne 0x140031265
mov word [rax], 0
jmp 0x14003126a
mov rax, rdx
jmp 0x14003124f
xor eax, eax
mov dword [rsp + 0x28], 0x104
or r9d, 0xffffffff
xor edx, edx
mov qword [rsp + 0x38], rax
mov r8, rbx
mov ecx, 0xfde9
mov qword [rsp + 0x30], rax
lea rax, [0x14010ddc0]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
mov edi, eax
test eax, eax
jne 0x1400312a9
call r13
mov esi, eax
mov rcx, rbx
call sub.msvcrt.dll_free
mov ecx, esi
call qword [sym.imp.KERNEL32.DLL_SetLastError]
test edi, edi
jne 0x1400312d8
call fcn.140036bd7
lea rcx, str.Could_not_get_current_directory:__s
mov rdx, rax
call fcn.140036717
mov byte [0x14010ddc0], 0
cmp byte [0x14010ddc1], 0x3a
jne 0x1400312f3
cmp byte [0x14010ddc2], 0
jne 0x1400312f3
mov word [0x14010ddc2], 0x5c
mov edx, 2
mov ecx, 0x104
lea r12, [0x14010dca0]
call sub.msvcrt.dll_calloc
mov edx, 0x104
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
mov ebx, eax
call r13
test ebx, ebx
mov esi, eax
je 0x14003135d
xor eax, eax
mov dword [rsp + 0x28], 0x104
or r9d, 0xffffffff
xor edx, edx
mov qword [rsp + 0x38], rax
mov r8, rdi
mov ecx, 0xfde9
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
mov ebx, eax
test eax, eax
jne 0x14003135d
call r13
mov esi, eax
test rdi, rdi
je 0x14003136a
mov rcx, rdi
call sub.msvcrt.dll_free
mov r14, qword [sym.imp.KERNEL32.DLL_SetLastError]
mov ecx, esi
call r14
test ebx, ebx
jne 0x1400313ba
call fcn.140036bd7
lea rcx, str.Could_not_get_system_directory:__s
mov rdx, rax
call fcn.140036717
movabs rax, 0x6f646e69575c3a43
movabs rdx, 0x65747379535c7377
mov dword [0x14010dcb0], 0x32336d
mov qword [0x14010dca0], rax
mov qword [0x14010dca8], rdx
mov edx, 2
mov ecx, 0x104
call sub.msvcrt.dll_calloc
mov ecx, 0x104
mov rdx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.DLL_GetTempPathW]
mov ebx, eax
call r13
mov esi, eax
test ebx, ebx
je 0x140031425
xor r15d, r15d
lea rax, [0x14010db80]
or r9d, 0xffffffff
xor edx, edx
mov qword [rsp + 0x38], r15
mov r8, rdi
mov ecx, 0xfde9
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x104
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
mov ebx, eax
test eax, eax
jne 0x140031425
call r13
mov esi, eax
test rdi, rdi
je 0x140031432
mov rcx, rdi
call sub.msvcrt.dll_free
mov ecx, esi
call r14
test ebx, ebx
jne 0x14003145f
call fcn.140036bd7
lea rcx, str.Could_not_get_temp_directory:__s
mov rdx, rax
call fcn.140036717
mov byte [0x14010db82], 0
mov word [0x14010db80], 0x5c2e
lea rbx, [0x14010d940]
mov edx, 0x1c
mov rcx, rbx
call fcn.1400291f7
test eax, eax
jne 0x1400314c3
call fcn.140036bd7
lea r13, [0x14010db80]
lea rcx, str.Could_not_get_app_data_directory:__s
mov rdi, rbx
mov rdx, rax
mov rsi, r13
call fcn.140036717
mov rcx, r13
call sub.msvcrt.dll_strlen
lea ecx, [rax + 1]
rep movsb byte [rdi], byte [rsi]
mov rcx, r13
call sub.msvcrt.dll_strlen
lea rdx, [rbx + 0x103]
cmp rax, 0x103
je 0x1400314c0
lea rdx, [rax + rbx]
mov byte [rdx], 0
lea rbx, [0x14010d820]
mov edx, 0x28
mov rcx, rbx
call fcn.1400291f7
test eax, eax
jne 0x140031527
call fcn.140036bd7
lea r13, [0x14010db80]
lea rcx, str.Could_not_get_user_directory:__s
mov rdi, rbx
mov rdx, rax
mov rsi, r13
call fcn.140036717
mov rcx, r13
call sub.msvcrt.dll_strlen
lea ecx, [rax + 1]
rep movsb byte [rdi], byte [rsi]
mov rcx, r13
call sub.msvcrt.dll_strlen
lea rdx, [rbx + 0x103]
cmp rax, 0x103
je 0x140031524
lea rdx, [rax + rbx]
mov byte [rdx], 0
mov rcx, r12
lea rbx, [0x14010da60]
mov rsi, r12
call sub.msvcrt.dll_strlen
mov rdi, rbx
lea ecx, [rax + 1]
rep movsb byte [rdi], byte [rsi]
mov rcx, r12
call sub.msvcrt.dll_strlen
lea rdx, [rbx + 0x103]
cmp rax, 0x103
je 0x14003155c
lea rdx, [rax + rbx]
mov byte [rdx], 0
lea r9, [0x14010ddc0]
mov edx, 0x104
mov rcx, rbp
lea r8, str._s_rufus.app
call qword [sym.imp.msvcrt.dll__snprintf]
mov rcx, rbp
mov byte [rsp + 0x62b], 0
call fcn.140029274
mov dword [rsp + 0x80], eax
test eax, eax
je 0x1400315c5
xor ebx, ebx
xor esi, esi
xor r11d, r11d
xor r15d, r15d
mov qword [rsp + 0x48], rbx
xor ebp, ebp
xor ebx, ebx
mov dword [0x14010e008], 1
mov qword [rsp + 0x50], r11
mov dword [rsp + 0x58], esi
mov dword [rsp + 0x5c], esi
jmp 0x140031d84
cmp qword [0x14010e9d8], 0
jne 0x1400315f2
lea rcx, str.Msvcrt
call fcn.14002768d
lea rdx, str.__wgetmainargs
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov qword [0x14010e9d8], rax
mov rax, qword [0x14010e9d8]
test rax, rax
je 0x140031d73
lea r8, [rsp + 0x9c]
lea rdx, [rsp + 0xb8]
mov r9d, 1
mov qword [rsp + 0x20], r8
lea rcx, [rsp + 0x98]
lea r8, [rsp + 0xb0]
call rax
movsxd rcx, dword [rsp + 0x98]
mov edx, 8
call sub.msvcrt.dll_calloc
mov r15, rax
test rax, rax
jne 0x14003166a
xor r9d, r9d
xor r10d, r10d
xor ebp, ebp
xor ebx, ebx
mov dword [rsp + 0x58], r9d
xor r15d, r15d
mov dword [rsp + 0x5c], r9d
mov qword [rsp + 0x50], r10
jmp 0x14003171d
xor eax, eax
xor ebx, ebx
lea rdi, [0x1400928b6]
xor esi, esi
mov dword [rsp + 0x58], eax
lea r12, [0x1400928b9]
lea r13, str.__gui
cmp dword [rsp + 0x98], esi
jle 0x140031733
mov rax, qword [rsp + 0xb8]
mov rcx, qword [rax + rsi*8]
call fcn.14002779b
mov rdx, rdi
mov qword [r15 + rsi*8], rax
mov rcx, rax
mov rbp, rax
call sub.msvcrt.dll_strcmp
mov rdx, r12
mov rcx, rbp
test eax, eax
mov eax, 0x96
cmove ebx, eax
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x140031729
mov rdx, r13
mov rcx, rbp
call sub.msvcrt.dll_strcmp
test eax, eax
mov eax, 1
cmovne eax, dword [rsp + 0x58]
mov dword [rsp + 0x58], eax
mov rcx, rbp
lea rdx, str._InvokerPRAID
inc rsi
call sub.msvcrt.dll__stricmp_1
mov ebp, eax
test eax, eax
jne 0x140031689
mov dword [0x14010e008], 1
xor ecx, ecx
xor r8d, r8d
mov dword [rsp + 0x5c], ecx
mov qword [rsp + 0x50], r8
xor edx, edx
mov qword [rsp + 0x48], rdx
jmp 0x140031d84
mov dword [rsp + 0x58], 1
jmp 0x1400316ed
mov rdi, qword [r15]
mov rcx, rdi
call sub.msvcrt.dll_strlen
lea rsi, [rdi + rax - 1]
cmp rdi, rsi
jae 0x140031752
cmp byte [rsi], 0x5c
je 0x140031752
dec rsi
jmp 0x140031743
mov edx, 0x70
mov rcx, rsi
call sub.msvcrt.dll_strchr
test rax, rax
jne 0x14003177c
mov edx, 0x50
mov rcx, rsi
call sub.msvcrt.dll_strchr
test rax, rax
je 0x140031784
cmp byte [rax + 1], 0x48
je 0x140031784
mov byte [rsp + 0x91], 0x61
cmp dword [rsp + 0x58], 0
jne 0x14003196e
or ecx, 0xffffffff
call qword [sym.imp.KERNEL32.DLL_AttachConsole]
test eax, eax
je 0x14003196e
lea rcx, str.Enabling_console_line_hogger
lea rbp, [0x1400928f6]
call fcn.140036717
mov rdi, qword [fcn.1400761c0]
xor ecx, ecx
lea rsi, str.CONOUT_
call rdi
lea rdx, [0x1400928ed]
lea rcx, str.CONIN_
mov r8, rax
call sub.msvcrt.dll_freopen
mov ecx, 1
call rdi
mov rdx, rbp
mov rcx, rsi
mov r8, rax
call sub.msvcrt.dll_freopen
mov ecx, 2
call rdi
mov rdx, rbp
mov rcx, rsi
mov r8, rax
call sub.msvcrt.dll_freopen
call qword [sym.imp.msvcrt.dll__flushall]
xor eax, eax
mov edx, 0x1f5
mov rcx, qword [0x14010e160]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0xf0]
lea r9, str.rufus.com
mov r8d, 0xa
mov qword [rsp + 0x20], rax
call fcn.140035786
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140031964
lea r8, [0x14009290a]
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateMutexA]
mov dword [rsp + 0x28], pe_nt_image_headers64
xor r9d, r9d
mov r8d, 1
mov rsi, rax
xor eax, eax
mov dword [rsp + 0x20], 2
mov edx, 0xc0000000
mov qword [rsp + 0x30], rax
lea rcx, str.rufus.com
call qword [sym.imp.KERNEL32.DLL_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400318d4
xor eax, eax
mov rdx, qword [rsp + 0x50]
mov rcx, rdi
mov r8d, dword [rsp + 0xf0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x220]
call qword [sym.imp.KERNEL32.DLL_WriteFile]
lea rax, [rdi - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400318d4
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov edx, 0x28
mov ecx, 0xa
call sub.msvcrt.dll_calloc
mov rdi, rax
test rax, rax
je 0x14003194b
lea rdx, str.rufus.com
lea rcx, [rax + 0x168]
movsx r8w, byte [rdx]
mov dword [rax], 1
add rax, 0x28
inc rdx
mov dword [rax - 0x1c], 4
mov word [rax - 0x1e], r8w
cmp rax, rcx
jne 0x1400318f9
mov ecx, 0xa
mov r8d, 0x28
mov rdx, rdi
mov dword [rdi + 0x168], 1
mov word [rdi + 0x170], 0xd
call qword [sym.imp.USER32.dll_SendInput]
mov rcx, rdi
call sub.msvcrt.dll_free
test rsi, rsi
jne 0x140031957
mov qword [rsp + 0x50], rsi
jmp 0x140031964
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x140031950
mov dword [rsp + 0x5c], 1
jmp 0x14003197e
xor r10d, r10d
xor r11d, r11d
mov dword [rsp + 0x5c], r10d
mov qword [rsp + 0x50], r11
xor r9d, r9d
lea rax, [rsp + 0x120]
xor edi, edi
xor ebp, ebp
mov qword [rsp + 0x48], r9
lea r12, [0x1400932dc]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x94]
mov r9, qword [rsp + 0x78]
mov rdx, r15
mov ecx, dword [rsp + 0x98]
mov qword [rsp + 0x20], rax
lea r8, str.ghxf:i:l:w:z:
call fcn.140075970
cmp eax, 0xffffffff
je 0x140031d40
sub eax, 0x61
cmp eax, 0x19
ja case.0x1400319e2.98
movsxd rax, dword [r12 + rax*4]
add rax, r12
jmp rax
mov dword [0x14010e060], 1
jmp case.0x1400319e2.97
mov rcx, qword [0x14010cf30]
call sub.msvcrt.dll_free
mov edx, 0x104
mov ecx, 1
call sub.msvcrt.dll_calloc
test rax, rax
mov qword [0x14010cf30], rax
mov qword [rsp + 0x88], rax
je case.0x1400319e2.97
mov rax, qword [0x1400b1ba0]
mov rcx, qword [rax]
call fcn.14002790d
mov edx, 2
mov ecx, 0x104
mov r14, rax
call sub.msvcrt.dll_calloc
mov edx, 0x104
lea r9, [rsp + 0x220]
mov rcx, r14
mov r8, rax
mov r13, rax
call qword [sym.imp.KERNEL32.DLL_GetFullPathNameW]
mov rsi, qword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [rsp + 0x84], eax
call rsi
mov edx, dword [rsp + 0x84]
mov r10, qword [rsp + 0x88]
mov dword [rsp + 0x68], eax
test edx, edx
je 0x140031abe
xor eax, eax
or r9d, 0xffffffff
xor edx, edx
mov dword [rsp + 0x28], 0x104
mov qword [rsp + 0x38], rax
mov r8, r13
mov ecx, 0xfde9
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x20], r10
call qword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
test eax, eax
jne 0x140031abe
call rsi
mov dword [rsp + 0x68], eax
test r13, r13
je 0x140031acb
mov rcx, r13
call sub.msvcrt.dll_free
test r14, r14
je 0x140031ad8
mov rcx, r14
call sub.msvcrt.dll_free
mov ecx, dword [rsp + 0x68]
call qword [sym.imp.KERNEL32.DLL_SetLastError]
mov rcx, qword [0x14010cf30]
call fcn.140028596
test al, 0x10
je 0x140031b20
mov rdx, qword [0x14010cf30]
lea rcx, str.Could_not_find_image__s_n
xor r13d, r13d
call sub.msvcrt.dll_printf
mov rcx, qword [0x14010cf30]
call sub.msvcrt.dll_free
mov qword [0x14010cf30], r13
jmp case.0x1400319e2.97
mov dword [0x14010ebc0], 1
jmp case.0x1400319e2.97
mov rsi, qword [0x1400b1ba0]
mov rcx, qword [rsi]
movzx eax, byte [rcx]
sub eax, 0x30
cmp eax, 9
ja 0x140031b57
xor r8d, r8d
xor edx, edx
call sub.msvcrt.dll_strtol
mov dword [rsp + 0x60], eax
jmp case.0x1400319e2.97
mov rcx, qword [rsp + 0x48]
call sub.msvcrt.dll_free
mov rax, qword [rsi]
mov qword [rsp + 0x48], rax
test rax, rax
je case.0x1400319e2.97
mov rcx, rax
call qword [sym.imp.msvcrt.dll__strdup]
mov qword [rsp + 0x48], rax
jmp case.0x1400319e2.97
mov rsi, qword [0x1400b1ba0]
mov rcx, qword [rsi]
movzx eax, byte [rcx]
sub eax, 0x30
cmp eax, 9
ja 0x140031bac
xor r8d, r8d
xor edx, edx
call sub.msvcrt.dll_strtol
mov dword [0x14007d230], eax
jmp 0x140031bee
xor r13d, r13d
lea r14, [0x14009109f]
mov rax, qword [0x1400b10f0]
mov rcx, qword [rsi]
mov rdx, qword [rax + r13*8]
test rdx, rdx
cmove rdx, r14
test rcx, rcx
cmove rcx, r14
call qword [sym.imp.msvcrt.dll__stricmp]
test eax, eax
jne 0x140031be5
mov dword [0x14007d230], r13d
jmp 0x140031bee
inc r13
cmp r13, 9
jne 0x140031bb6
mov eax, dword [0x14007d230]
inc eax
cmp eax, 9
jbe 0x140031c05
mov dword [0x14007d230], 0xffffffff
mov eax, dword [0x14007d230]
mov dword [0x14007d234], eax
jmp case.0x1400319e2.97
mov rax, qword [0x1400b1ba0]
mov rcx, qword [rax]
call sub.msvcrt.dll_atoi
mov ebx, eax
jmp case.0x1400319e2.97
lea rbx, [rsp + 0x220]
xor esi, esi
xor r8d, r8d
xor edx, edx
mov r9, rbx
mov qword [rsp + 0x20], rsi
mov rcx, qword [r15]
xor esi, esi
call qword [sym.imp.msvcrt.dll__splitpath]
mov rdx, rbx
lea rcx, str._nUsage:__s___x____g____h____f_FILESYSTEM____i_PATH____l_LOCALE____w_TIMEOUT__n
xor ebx, ebx
call sub.msvcrt.dll_printf
lea rcx, str.___x____extra_devs
call sub.msvcrt.dll_puts
lea rcx, str._____List_extra_devices__such_as_USB_HDDs
call sub.msvcrt.dll_puts
lea rcx, str.___g____gui
call sub.msvcrt.dll_puts
lea rcx, str._____Start_in_GUI_mode__disable_the_rufus.com_commandline_hogger_
call sub.msvcrt.dll_puts
lea rcx, str.___i_PATH____isoPATH
call sub.msvcrt.dll_puts
lea rcx, str._____Select_the_ISO_image_pointed_by_PATH_to_be_used_on_startup
call sub.msvcrt.dll_puts
lea rcx, str.___l_LOCALE____localeLOCALE
call sub.msvcrt.dll_puts
lea rcx, str._____Select_the_locale_to_be_used_on_startup
call sub.msvcrt.dll_puts
lea rcx, str.___f_FILESYSTEM____filesystemFILESYSTEM
call sub.msvcrt.dll_puts
lea rcx, str._____Preselect_the_file_system_to_be_preferred_when_formatting
call sub.msvcrt.dll_puts
lea rcx, str.___w_TIMEOUT____waitTIMEOUT
call sub.msvcrt.dll_puts
lea rcx, str._____Wait_TIMEOUT_tens_of_seconds_for_the_global_application_mutex_to_be_released.
call sub.msvcrt.dll_puts
lea rcx, str._____Used_when_launching_a_newer_version_of_Rufus_from_a_running_application.
call sub.msvcrt.dll_puts
lea rcx, str.___h____help
call sub.msvcrt.dll_puts
lea rcx, str._____This_usage_guide.
call sub.msvcrt.dll_puts
jmp 0x1400337e9
mov rax, qword [0x1400b1ba0]
mov r8d, 0x10
xor edx, edx
mov rcx, qword [rax]
call sub.msvcrt.dll_strtol
mov ebp, eax
jmp case.0x1400319e2.97
mov edi, 1
jmp case.0x1400319e2.97
test edi, edi
je 0x140031d84
lea rcx, str.Command_line_arguments:
xor esi, esi
lea rdi, [0x1400910a6]
call fcn.140036717
inc rsi
cmp dword [rsp + 0x98], esi
jle 0x140031d84
mov rdx, qword [r15 + rsi*8]
mov rcx, rdi
call fcn.140036717
jmp 0x140031d59
lea rcx, str.Could_not_access_UTF_16_args
call fcn.140036717
jmp 0x140031649
cmp dword [0x14010e008], 0
je 0x140031d99
lea rcx, str.AppStore_version_detected
call fcn.140036717
lea rsi, [rsp + 0x528]
lea r9, [0x14010ddc0]
mov edx, 0x104
lea r8, str._s_rufus.ini
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__snprintf]
lea rdx, [rsp + 0x91]
mov rcx, rsi
mov byte [rsp + 0x62b], 0
call fcn.1400290c0
xor edx, edx
xor ecx, ecx
xor r8d, r8d
mov r12, rax
call fcn.14002441f
mov rcx, rax
mov rax, qword [0x1400b1660]
mov rdx, qword [rax]
test rdx, rdx
jne 0x140031dfd
lea rdx, [0x14009109f]
test rcx, rcx
jne 0x140031e09
lea rcx, [0x14009109f]
call sub.msvcrt.dll_strcmp
mov r14d, eax
test r12, r12
je 0x140031e69
lea rcx, [0x14010ddc0]
mov qword [0x14010cf38], rsi
lea r13, [0x14010d940]
call sub.msvcrt.dll_strlen
mov rdi, r13
lea rsi, [0x14010ddc0]
lea ecx, [rax + 1]
rep movsb byte [rdi], byte [rsi]
lea rcx, [0x14010ddc0]
call sub.msvcrt.dll_strlen
lea rdx, [r13 + 0x103]
cmp rax, 0x103
je 0x140031e5e
lea rdx, [rax + r13]
mov byte [rdx], 0
mov rcx, r12
call sub.msvcrt.dll_fclose
cmp qword [0x14010cf38], 0
lea rax, str.INI_file
lea rdx, str.registry
cmovne rdx, rax
lea rcx, str.Will_use_settings_from__s
call fcn.140036717
mov rdx, qword [0x14010cf38]
test rdx, rdx
je 0x140031f19
mov r8d, 1
lea rcx, str.Locale
mov byte [0x14010e600], 0
lea r13, [0x14010e600]
call fcn.14002284a
mov r12, rax
test rax, rax
je 0x140031f10
mov rcx, rax
mov rdi, r13
mov rsi, r12
call sub.msvcrt.dll_strlen
lea rcx, [rax + 1]
mov eax, 0x200
cmp rcx, rax
cmova rcx, rax
mov ecx, ecx
rep movsb byte [rdi], byte [rsi]
mov rcx, r12
call sub.msvcrt.dll_strlen
lea rdx, [r13 + 0x1ff]
lea rcx, [rax + 1]
cmp rcx, 0x1ff
ja 0x140031f05
lea rdx, [rax + r13]
mov byte [rdx], 0
mov rcx, r12
call sub.msvcrt.dll_free
lea rcx, [0x14010e600]
jmp 0x140031f4f
mov dword [rsp + 0x20], 0x1ff
mov rcx, 0xffffffff80000001
lea r9, [0x14010e400]
mov r8d, 1
lea rdx, str.Locale
mov byte [0x14010e400], 0
call fcn.140029d56
lea rcx, [0x14010e400]
cmp byte [rcx], 0
je 0x140031f6e
call qword [sym.imp.msvcrt.dll__strdup]
lea rcx, str.found_locale__s
mov rdx, rax
mov qword [rsp + 0x48], rax
call fcn.140036717
lea rcx, str.ShowAdvancedDriveProperties
call fcn.140029f46
lea rcx, str.ShowAdvancedFormatOptions
mov dword [0x14010e054], eax
call fcn.140029f46
lea rcx, str.PreserveTimestamps
mov dword [0x14010e050], eax
call fcn.140029f46
lea rcx, str.UseProperSizeUnits
mov dword [0x14010e034], eax
call fcn.140029f46
test eax, eax
sete al
xor ecx, ecx
movzx eax, al
mov dword [0x14010e038], eax
call fcn.14000d09d
lea rcx, str.UseVds
mov dword [0x14007d1f8], eax
call fcn.140029f46
test eax, eax
je 0x140031fe7
xor eax, eax
cmp dword [0x14007d1f8], 0
setne al
lea rcx, str.EnableUsbDebug
mov dword [0x14010e010], eax
call fcn.140029f46
mov rdx, qword [0x1400b1650]
lea rcx, str.DisableFakeDrivesCheck
cmp eax, 1
mov dword [0x14010e03c], eax
sbb eax, eax
and eax, 2
inc eax
mov dword [rdx], eax
call fcn.140029f46
lea rcx, str.EnableWindowsDualUefiBiosMode
test eax, eax
sete al
movzx eax, al
mov dword [0x14010e048], eax
call fcn.140029f46
lea rcx, str.ForceLargeFat32Formatting
mov dword [0x14010e04c], eax
call fcn.140029f46
lea rcx, str.EnableVmdkDetection
mov dword [0x14010e040], eax
call fcn.140029f46
lea rcx, str.EnableFileIndexing
mov dword [0x14010e044], eax
call fcn.140029f46
lea rcx, str.DisableVHDs
mov dword [0x14010e020], eax
call fcn.140029f46
lea rcx, str.EnableExtraHashes
test eax, eax
sete al
movzx eax, al
mov dword [0x14007d1fc], eax
call fcn.140029f46
mov rdx, qword [0x1400b1770]
lea rcx, str.IgnoreBootMarker
mov dword [rdx], eax
call fcn.140029f46
lea rcx, str.PersistentLog
mov dword [0x14010e00c], eax
call fcn.140029f46
lea rcx, str.WindowsUserExperienceOptions
mov dword [0x14010e004], eax
call fcn.140029f77
mov ecx, eax
mov edx, eax
shr ecx, 0x10
je 0x1400320f1
mov r8, qword [0x1400b1d60]
mov eax, ecx
and ecx, edx
not eax
and eax, dword [r8]
or eax, ecx
mov dword [r8], eax
lea rcx, str.DefaultThreadPriority
call fcn.140029f77
xor ecx, ecx
inc eax
mov dword [0x14007d1e8], eax
call qword [sym.imp.USER32.dll_GetDC]
mov edx, 0x58
mov rsi, rax
mov rcx, rax
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
cvtsi2ss xmm0, eax
lea rax, [rsi - 1]
divss xmm0, dword [0x140093468]
movss dword [0x14007d1f4], xmm0
cmp rax, 0xfffffffffffffffd
ja 0x140032147
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
xor ecx, ecx
lea rsi, [rsp + 0x424]
call fcn.14001d31c
lea rax, str.rufus.loc
mov edx, 0x104
mov rcx, rsi
lea r9, [0x14010ddc0]
lea r8, [0x140092da1]
mov qword [rsp + 0x20], rax
mov r13, qword [sym.imp.msvcrt.dll__snprintf]
call r13
mov rcx, rsi
mov byte [rsp + 0x527], 0
call fcn.140028596
inc eax
jne 0x140032338
lea rcx, str.loc_file_not_found_in_current_directory___embedded_one_will_be_used
call fcn.140036717
xor r8d, r8d
lea rax, [rsp + 0xa4]
mov rcx, qword [0x14010e160]
mov dword [rsp + 0x28], r8d
mov edx, 0x1f4
lea r9, str.embedded.loc
mov r8d, 0xa
mov qword [rsp + 0x20], rax
call fcn.140035786
mov rcx, rsi
mov rdi, rax
call fcn.14002911a
test eax, eax
je 0x1400321f2
cmp byte [rsp + 0x424], 0
jne 0x14003221f
call fcn.140036bd7
lea rcx, str.FATAL:_Unable_to_create_temp_loc_file:__s
mov rdx, rax
call fcn.140036717
mov r9d, 0x1010
lea r8, str.Fatal_error
lea rdx, str.Unable_to_create_temporary_localization_file._This_application_will_now_exit.
jmp 0x1400322ee
mov rcx, rsi
call fcn.14002790d
xor ecx, ecx
xor r9d, r9d
mov r8d, 1
mov qword [rsp + 0x30], rcx
mov edx, 0xc0000000
mov rcx, rax
mov r13, rax
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.DLL_CreateFileW]
mov rsi, rax
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov r12d, eax
test r13, r13
je 0x140032271
mov rcx, r13
call sub.msvcrt.dll_free
mov ecx, r12d
lea r12, [rsi - 1]
call qword [sym.imp.KERNEL32.DLL_SetLastError]
cmp rsi, 0xffffffffffffffff
jne 0x1400322b1
call fcn.140036bd7
lea rdx, [rsp + 0x424]
lea rcx, str.FATAL:_Unable_to_extract_loc_file__s:__s
mov r8, rax
call fcn.140036717
cmp r12, 0xfffffffffffffffd
ja 0x1400322da
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x1400322da
mov dword [rsp + 0x20], 4
mov r8d, dword [rsp + 0xa4]
mov rdx, rdi
mov rcx, rsi
lea r9, [rsp + 0xac]
call fcn.14003810a
test eax, eax
je 0x140032284
jmp 0x140032308
mov r9d, 0x1010
lea r8, str.Fatal_error
lea rdx, str.Unable_to_extract_localization_file._This_application_will_now_exit.
xor ecx, ecx
xor esi, esi
xor ebx, ebx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor edx, edx
mov dword [rsp + 0x80], edx
jmp 0x1400337e9
lea rdx, [rsp + 0x424]
lea rcx, str.localization:_extracted_data_to__s
call fcn.140036717
cmp r12, 0xfffffffffffffffd
jbe 0x14003232d
xor eax, eax
mov dword [rsp + 0x80], eax
jmp 0x140032392
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x140032322
mov r12, qword [0x1400b1d20]
mov rdi, qword [0x1400b1d10]
mov edx, 0xffc
mov r9, rsi
lea r8, str.Using_external_loc_file__s
mov rcx, qword [r12]
sub rdx, rcx
add rcx, rdi
call r13
mov rcx, rdi
mov byte [rdi + 0xffb], 0
call sub.msvcrt.dll_strlen
mov dword [rsp + 0x80], 1
lea rdx, [rax + 2]
mov byte [rdi + rax], 0xd
mov qword [r12], rdx
mov byte [rdi + rax + 1], 0xa
mov byte [rdi + rax + 2], 0
lea rdi, [rsp + 0x424]
mov rcx, rdi
call fcn.140022050
test eax, eax
jne 0x1400323d3
lea rcx, str.FATAL:_Could_not_access_locale_
call fcn.140036717
mov r9d, 0x1010
lea r8, str.Fatal_error
xor ecx, ecx
lea rdx, str.The_locale_data_is_missing_or_invalid._This_application_will_now_exit.
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x1400337e5
cmp qword [rsp + 0x48], 0
mov edx, 1
jne 0x1400323eb
mov ecx, dword [rsp + 0x60]
call fcn.14001d92b
jmp 0x1400323f5
mov rcx, qword [rsp + 0x48]
call fcn.14001d9ab
mov qword [0x14010e100], rax
test rax, rax
je 0x1400323a6
mov rcx, rax
call fcn.14001dccf
mov rsi, qword [0x1400b12c0]
mov word [0x14007d208], ax
mov rcx, rsi
call fcn.140034798
cmp dword [rsi], 0x61
jbe 0x14003242a
test ebp, ebp
je 0x14003242a
mov dword [rsi], ebp
cmp dword [rsi], 0x61
ja 0x1400324b5
mov rdx, qword [0x14010e100]
mov rcx, rdi
call fcn.1400223f1
mov rax, qword [0x14010e100]
mov ecx, 0xcdd
movzx edi, word [0x14007d208]
mov eax, dword [rax + 4]
and eax, 1
cmp eax, 1
mov dword [0x14010e06c], eax
sbb r9d, r9d
and r9d, 0xffe80000
add r9d, 0x181010
mov dword [rsp + 0x60], r9d
call fcn.14001d5c1
mov ecx, 0xcde
mov rbx, rax
xor eax, eax
cmp dword [rsi], 0x61
sete al
mov edx, eax
lea r8d, [rax*4 + 0x12]
add edx, 2
call fcn.14001d5c1
mov dword [rsp + 0x20], edi
mov r9d, dword [rsp + 0x60]
mov r8, rbx
mov rdx, rax
jmp 0x14003253a
call fcn.140036110
test eax, eax
jne 0x140032546
lea rcx, str.FATAL:_No_administrative_privileges_
call fcn.140036717
mov rdx, qword [0x14010e100]
mov rcx, rdi
call fcn.1400223f1
mov rax, qword [0x14010e100]
mov ecx, 0xcd8
movzx ebx, word [0x14007d208]
mov eax, dword [rax + 4]
and eax, 1
cmp eax, 1
mov dword [0x14010e06c], eax
sbb r9d, r9d
and r9d, 0xffe80000
add r9d, 0x181010
mov dword [rsp + 0x68], r9d
call fcn.14001d5c1
mov ecx, 0xcd9
mov qword [rsp + 0x60], rax
call fcn.14001d5c1
mov dword [rsp + 0x20], ebx
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0x60]
mov rdx, rax
xor ecx, ecx
call fcn.140028514
jmp 0x1400337e5
cmp qword [rsp + 0x690], 0
je 0x14003257d
mov rcx, qword [rsp + 0x690]
call sub.msvcrt.dll_strlen
cmp rax, 2
jne 0x14003257d
mov rax, qword [rsp + 0x690]
cmp byte [rax], 0x2f
jne 0x14003257d
cmp byte [rax + 1], 0x57
mov eax, 0x96
cmove ebx, eax
lea r8, str.Global_Rufus
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateMutexA]
mov r13, qword [sym.imp.KERNEL32.DLL_GetLastError]
mov r12, qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov rbp, qword [sym.imp.KERNEL32.DLL_Sleep]
mov rsi, rax
test ebx, ebx
jle 0x1400325b4
test rsi, rsi
jne 0x1400325bb
jmp 0x1400325fa
test rsi, rsi
jne 0x1400325ed
jmp 0x1400325fa
call r13
cmp eax, 0xb7
jne 0x1400325ed
mov rcx, rsi
dec ebx
call r12
mov ecx, 0x64
call rbp
lea r8, str.Global_Rufus
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateMutexA]
mov rsi, rax
jmp 0x1400325a9
call qword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xb7
jne 0x140032672
mov rdx, qword [0x14010e100]
mov rcx, rdi
call fcn.1400223f1
mov rax, qword [0x14010e100]
mov ecx, 0xbb9
movzx ebx, word [0x14007d208]
mov eax, dword [rax + 4]
and eax, 1
cmp eax, 1
mov dword [0x14010e06c], eax
sbb r9d, r9d
and r9d, 0xffe80000
add r9d, 0x181010
mov dword [rsp + 0x68], r9d
call fcn.14001d5c1
mov ecx, 0xbba
mov qword [rsp + 0x60], rax
call fcn.14001d5c1
mov dword [rsp + 0x20], ebx
mov r9d, dword [rsp + 0x68]
xor ecx, ecx
mov r8, qword [rsp + 0x60]
mov rdx, rax
call fcn.140028514
jmp 0x1400337e7
mov rax, qword [rsp + 0x680]
xor ecx, ecx
mov edx, 6
mov qword [0x14010e160], rax
call qword [sym.imp.ole32.dll_CoInitializeEx]
lea rcx, str.Riched20
call fcn.14002768d
test rax, rax
jne 0x1400326b3
call fcn.140036bd7
lea rcx, str.Could_not_load_RichEdit_library___some_dialogs_may_not_display:__s_n
mov rdx, rax
call fcn.140036717
call fcn.140026699
mov dword [rsp + 0x20], 0x9e
xor ecx, ecx
lea r9, str.NoDriveTypeAutorun
lea r8, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
lea rdx, [0x14010ebc8]
call fcn.140035d4b
lea rcx, [rsp + 0xa0]
mov ebx, eax
call fcn.14000c822
test eax, eax
jne 0x140032708
lea rcx, str.Could_not_get_AutoMount_status
call fcn.140036717
mov dword [rsp + 0xa0], 1
jmp 0x140032738
cmp dword [rsp + 0xa0], 0
jne 0x140032738
lea rcx, str.AutoMount_was_detected_as_disabled___temporarily_re_enabling_it
call fcn.140036717
mov ecx, 1
call fcn.14000c792
test eax, eax
jne 0x140032738
lea rcx, str.Failed_to_enable_AutoMount
call fcn.140036717
test r14d, r14d
sete dil
cmp dword [rsp + 0x70], 0
sete al
xor r13d, r13d
xor r14d, r14d
xor r12d, r12d
or edi, eax
call fcn.140006c50
mov rdx, qword [0x1400b1670]
movzx edi, dil
mov dword [rdx], eax
call fcn.140006c74
mov rdx, qword [0x1400b1680]
mov dword [rdx], eax
xor eax, eax
mov dword [rsp + 0x60], eax
mov rax, qword [0x1400b1d20]
mov rbp, qword [0x1400b1d10]
mov edx, 0xffc
lea r8, str.Localization_set_to__s
mov rcx, qword [rax]
mov rax, qword [0x14010e100]
sub rdx, rcx
mov r9, qword [rax + 0x18]
add rcx, rbp
call qword [sym.imp.msvcrt.dll__snprintf]
mov rcx, rbp
mov byte [rbp + 0xffb], 0
call sub.msvcrt.dll_strlen
mov rcx, qword [0x1400b1d20]
mov byte [0x14007d20a], 1
lea rdx, [rax + 2]
mov byte [rbp + rax], 0xd
mov byte [rbp + rax + 1], 0xa
mov byte [rbp + rax + 2], 0
mov rax, qword [0x14010e100]
mov qword [rcx], rdx
mov rcx, qword [0x14010ce80]
mov eax, dword [rax + 4]
mov byte [0x14010cea0], 0
and eax, 1
mov dword [0x14010e06c], eax
xor eax, eax
mov dword [0x14010eb64], eax
call sub.msvcrt.dll_free
xor eax, eax
xor ecx, ecx
cmp dword [0x14010e06c], 0
setne cl
mov qword [0x14010ce80], rax
call qword [sym.imp.USER32.dll_SetProcessDefaultLayout]
mov rdx, qword [0x14010e100]
lea rcx, [rsp + 0x424]
call fcn.1400223f1
test eax, eax
je 0x14003288f
mov rax, qword [0x14010e100]
mov r8, qword [0x14010cf38]
mov rbp, qword [rax + 0x18]
test r8, r8
je 0x140032868
mov rdx, rbp
lea rcx, str.Locale
call fcn.14002295b
jmp 0x14003288f
xor r9d, r9d
test rbp, rbp
je 0x14003287b
mov rcx, rbp
call sub.msvcrt.dll_strlen
mov r9d, eax
mov r8, rbp
mov edx, 1
lea rcx, str.Locale
call fcn.140029bb6
test edi, edi
je 0x1400328a3
test r13, r13
je 0x140032902
mov rcx, r13
call qword [sym.imp.USER32.dll_DestroyWindow]
jmp 0x140032902
cmp dword [0x14010e06c], 1
movzx edi, word [0x14007d208]
mov ecx, 0xcdf
sbb r9d, r9d
and r9d, 0xffe80000
add r9d, 0x181034
mov dword [rsp + 0x70], r9d
call fcn.14001d5c1
mov ecx, 0xce0
mov qword [rsp + 0x68], rax
call fcn.14001d5c1
mov dword [rsp + 0x20], edi
mov r9d, dword [rsp + 0x70]
xor ecx, ecx
mov r8, qword [rsp + 0x68]
mov rdx, rax
call fcn.140028514
cmp eax, 6
je 0x140032893
jmp 0x1400337e9
mov rcx, qword [rsp + 0x680]
lea r9, [0x14002d55f]
xor r8d, r8d
mov edx, 0x65
call fcn.14003ced0
mov r13, rax
test rax, rax
jne 0x140032960
movzx edx, word [0x14007d208]
cmp dword [0x14010e06c], 1
lea r8, str.DialogBox_failure
sbb eax, eax
xor ecx, ecx
mov dword [rsp + 0x20], edx
and eax, 0xffe80000
lea rdx, str.Could_not_create_Window
lea r9d, [rax + 0x181010]
call fcn.140028514
jmp 0x1400337e9
mov r8d, dword [0x14007d220]
cmp r8d, 0xffff0001
jl 0x14003299d
mov r9d, dword [0x14007d224]
cmp r9d, 0xffff0001
jl 0x14003299d
xor eax, eax
mov dword [rsp + 0x30], 1
xor edx, edx
mov rcx, r13
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_SetWindowPos]
xor r9d, r9d
mov rdi, qword [sym.imp.USER32.dll_ChangeWindowMessageFilterEx]
mov edx, 0x233
mov rcx, r13
mov r8d, 1
call rdi
xor r9d, r9d
mov r8d, 1
mov edx, 0x4a
mov rcx, r13
call rdi
xor r9d, r9d
mov r8d, 1
mov edx, 0x49
mov rcx, r13
call rdi
call fcn.14003e0c2
call fcn.14003e2da
test eax, eax
jne 0x1400329f7
lea rcx, str.Warning:_Could_not_set_alert_prompt_hook
call fcn.140036717
mov edx, 1
mov rcx, r13
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, r13
call qword [sym.imp.USER32.dll_UpdateWindow]
mov rax, qword [sym.imp.USER32.dll_GetMessageW]
mov qword [rsp + 0x70], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rax, qword [rsp + 0x70]
lea rcx, [rsp + 0xf0]
call rax
test eax, eax
je 0x140033796
xor edi, edi
cmp dword [rsp + 0xf8], 0x104
jne 0x140032a66
mov rdi, qword [rsp + 0x108]
shr rdi, 0x1d
xor rdi, 1
and edi, 1
cmp qword [rsp + 0x100], 0x12
jne 0x140032a7f
mov ecx, 0x12
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
mov eax, 1
cmovs r12d, eax
jmp 0x140032a85
mov r14d, 1
mov rcx, qword [0x14010e0a0]
call qword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x140032ad6
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x140032ad6
cmp dword [rsp + 0xf8], 0x100
jne 0x140032ad6
cmp qword [rsp + 0x100], 0x41
jne 0x140032ad6
mov rcx, qword [0x14010e0b0]
or r9, 0xffffffffffffffff
xor r8d, r8d
mov edx, 0xb1
jmp 0x140032bad
test edi, edi
je 0x140032af1
cmp qword [rsp + 0x100], 0x11
jne 0x140032af1
mov eax, dword [0x14007d200]
mov dword [0x14010e9d0], eax
cmp dword [0x14010e9d0], 0
je 0x140032b2b
cmp qword [rsp + 0x100], 0x4c
jne 0x140032bb8
xor ebp, ebp
xor r9d, r9d
mov r8d, 0x41e
mov edx, 0x111
mov dword [0x14010e9d0], ebp
mov rcx, qword [0x14010e158]
jmp 0x140032bad
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x140032bb8
cmp dword [rsp + 0xf8], 0x100
jne 0x140032bb8
jmp 0x140032afa
cmp rax, 0x49
jne 0x140033044
mov rax, qword [0x1400b1790]
xor edi, edi
mov ecx, 0xcbe
cmp dword [rax], 0
sete dil
mov dword [rax], edi
call fcn.14001d5c1
mov edx, edi
mov rcx, rax
call fcn.140026fa3
cmp qword [0x14010cf30], 0
je 0x140032a1a
mov dword [0x14010ebc0], 1
xor r9d, r9d
mov r8d, 0x3f6
mov rcx, r13
mov dword [0x14010ebb4], 1
mov edx, 0x111
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x140032a1a
cmp dword [0x14010e9d0], 0
je 0x140032bfa
cmp qword [rsp + 0x100], 0x50
jne 0x140032c17
xor edx, edx
cmp dword [0x14010e004], 0
lea rcx, str.PersistentLog
sete dl
mov dword [0x14010e004], edx
call fcn.140029d23
mov edi, dword [0x14010e004]
mov ecx, 0xd08
jmp 0x140033782
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x140032c17
cmp dword [rsp + 0xf8], 0x100
je 0x140032bc1
test edi, edi
jne 0x140032c30
mov edx, dword [rsp + 0xf8]
cmp edx, 0x104
jne 0x140032d0a
jmp 0x140032c4c
cmp qword [rsp + 0x100], 0x11
je 0x140032a1a
xor edi, edi
mov dword [0x14010e9d0], edi
jmp 0x140032a1a
mov rax, qword [rsp + 0x100]
lea rcx, [rax - 0x6b]
test rcx, 0xfffffffffffffffd
je 0x140032c75
lea rcx, [rax - 0xbb]
test rcx, 0xfffffffffffffffd
jne 0x140032d0a
mov ecx, dword [0x14007d1e8]
cmp rax, 0xbb
je 0x140032c89
cmp rax, 0x6b
jne 0x140032c95
cmp ecx, 1
jg 0x140032ce6
mov edx, 1
jmp 0x140032c9d
or edx, 0xffffffff
cmp ecx, 0xffffffff
jl 0x140032ce6
add edx, ecx
lea rcx, str.DefaultThreadPriority
mov dword [0x14007d1e8], edx
dec edx
call fcn.14002a42b
mov rcx, qword [0x14010eb58]
test rcx, rcx
je 0x140032ccb
mov edx, dword [0x14007d1e8]
call qword [sym.imp.KERNEL32.DLL_SetThreadPriority]
mov rax, qword [0x1400b1e30]
mov edx, dword [0x14007d1e8]
mov rcx, qword [rax]
test rcx, rcx
je 0x140032ce6
call qword [sym.imp.KERNEL32.DLL_SetThreadPriority]
mov eax, dword [0x14007d1e8]
mov r9d, 0xcf6
xor edx, edx
xor ecx, ecx
mov r8d, 0xdac
mov dword [rsp + 0x20], eax
call fcn.14001d77b
jmp 0x140032a1a
cmp dword [0x14007d200], 0
jne 0x140033a5b
cmp edx, 0x104
jne 0x1400335bc
mov rax, qword [rsp + 0x100]
cmp rax, 0xbe
jne 0x140032d76
mov eax, dword [0x14010e03c]
xor edx, edx
mov rcx, qword [0x1400b1650]
test eax, eax
sete dl
cmp eax, 1
sbb eax, eax
mov dword [0x14010e03c], edx
and eax, 0xfffffffe
add eax, 3
mov dword [rcx], eax
lea rcx, str.EnableUsbDebug
call fcn.140029d23
mov edi, dword [0x14010e03c]
mov ecx, 0xcc6
jmp 0x140032ff6
cmp rax, 0xbc
jne 0x140032d9b
xor edi, edi
cmp dword [0x14007d204], 0
mov ecx, 0xcd2
sete dil
mov dword [0x14007d204], edi
jmp 0x140033782
cmp rax, 0x42
jne 0x140032dd5
xor eax, eax
cmp dword [0x14010e048], 0
lea rcx, str.DisableFakeDrivesCheck
setne dl
sete al
movzx edx, dl
mov dword [0x14010e048], eax
call fcn.140029d23
mov edi, dword [0x14010e048]
mov ecx, 0xcb8
jmp 0x140033782
cmp rax, 0x43
jne 0x140032e02
mov rcx, qword [0x14010e0f0]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x147
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, eax
test eax, eax
js 0x140032a1a
jmp 0x1400333d3
cmp rax, 0x44
jne 0x140032f1e
lea rdi, [rsp + 0x320]
lea rax, [0x140091169]
mov edx, 0x104
lea r9, [0x14010d940]
lea r8, [0x140092da1]
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.msvcrt.dll__snprintf]
mov qword [rsp + 0x20], rdi
mov r9d, 0xcc0
xor ecx, ecx
mov r8d, 0xdac
mov edx, 1
mov byte [rsp + 0x423], 0
call fcn.14001d77b
mov rcx, rdi
call sub.msvcrt.dll_strlen
mov edx, 2
add rax, 2
mov rcx, rax
mov qword [rsp + 0x68], rax
call sub.msvcrt.dll_calloc
xor r11d, r11d
xor r8d, r8d
xor r9d, r9d
mov rbp, rax
mov qword [rsp + 0x230], rax
xor r10d, r10d
xor edx, edx
mov eax, dword [rsp + 0x68]
mov ecx, 0xfde9
mov qword [rsp + 0x220], r8
mov r8, rdi
mov qword [rsp + 0x238], r9
or r9d, 0xffffffff
mov dword [rsp + 0x228], 3
mov word [rsp + 0x240], 0x414
mov dword [rsp + 0x244], r10d
mov qword [rsp + 0x248], r11
mov qword [rsp + 0x250], r11
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
lea rcx, [rsp + 0x220]
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
test rbp, rbp
je 0x140032f0f
mov rcx, rbp
call sub.msvcrt.dll_free
mov dword [0x14010eba8], 1
jmp 0x140032a1a
cmp rax, 0x45
jne 0x140032f68
xor edx, edx
cmp dword [0x14010e04c], 0
lea rcx, str.EnableWindowsDualUefiBiosMode
sete dl
mov dword [0x14010e04c], edx
call fcn.140029d23
mov edi, dword [0x14010e04c]
mov ecx, 0xcc2
call fcn.14001d5c1
mov rcx, rax
mov edx, edi
call fcn.140026fa3
xor ecx, ecx
call fcn.140027bdc
jmp 0x140032a1a
cmp rax, 0x46
jne 0x140032fc1
xor edi, edi
cmp dword [0x14010e060], 0
mov ecx, 0xcb5
sete dil
mov dword [0x14010e060], edi
call fcn.14001d5c1
mov edx, edi
mov rcx, rax
call fcn.140026fa3
xor ecx, ecx
call fcn.1400077b9
xor r8d, r8d
mov edx, 0x3fe
cmp dword [0x14010e060], 0
mov rcx, qword [0x14010e158]
setne r8b
call qword [sym.imp.USER32.dll_CheckDlgButton]
jmp 0x140032a1a
cmp rax, 0x47
jne 0x140033011
xor eax, eax
cmp dword [0x14007d1fc], 0
lea rcx, str.DisableVHDs
setne dl
sete al
movzx edx, dl
mov dword [0x14007d1fc], eax
call fcn.140029d23
mov edi, dword [0x14007d1fc]
mov ecx, 0xcec
call fcn.14001d5c1
mov edx, edi
mov rcx, rax
call fcn.140026fa3
xor ecx, ecx
call fcn.1400077b9
jmp 0x140032a1a
cmp rax, 0x48
jne 0x140032b4a
mov rdi, qword [0x1400b1770]
xor edx, edx
lea rcx, str.EnableExtraHashes
cmp dword [rdi], 0
sete dl
mov dword [rdi], edx
call fcn.140029d23
mov edi, dword [rdi]
mov ecx, 0xcf0
jmp 0x140033782
cmp rax, 0x4a
jne 0x140033066
mov rax, qword [0x1400b17a0]
xor edi, edi
mov ecx, 0xcb9
cmp dword [rax], 0
sete dil
mov dword [rax], edi
jmp 0x140033782
cmp rax, 0x4b
jne 0x140033088
mov rax, qword [0x1400b17c0]
xor edi, edi
mov ecx, 0xcba
cmp dword [rax], 0
sete dil
mov dword [rax], edi
jmp 0x140033782
cmp rax, 0x4c
jne 0x1400330bc
xor edx, edx
cmp dword [0x14010e040], 0
lea rcx, str.ForceLargeFat32Formatting
sete dl
mov dword [0x14010e040], edx
call fcn.140029d23
mov edi, dword [0x14010e040]
mov ecx, 0xcb6
jmp 0x140032ff6
cmp rax, 0x4d
jne 0x1400330f0
xor edx, edx
cmp dword [0x14010e00c], 0
lea rcx, str.IgnoreBootMarker
sete dl
mov dword [0x14010e00c], edx
call fcn.140029d23
mov edi, dword [0x14010e00c]
mov ecx, 0xcf7
jmp 0x140033782
cmp rax, 0x4e
jne 0x140033113
xor edi, edi
cmp dword [0x14010e05c], 0
mov ecx, 0xcbc
sete dil
mov dword [0x14010e05c], edi
jmp 0x140033782
cmp rax, 0x4f
jne 0x140033389
movabs rax, 0x616d695f63736964
lea rdi, [rsp + 0x230]
mov ecx, 0x11
movabs rdx, 0x6f73692e6567
mov qword [rsp + 0x220], rax
xor eax, eax
mov qword [rsp + 0x228], rdx
rep stosb byte [rdi], al
lea rax, str..iso
mov ecx, 0xbdc
mov qword [rsp + 0xc0], rax
call fcn.14001d5c1
cmp dword [0x14007d200], 0
mov qword [rsp + 0xd0], 1
mov qword [rsp + 0xc8], rax
lea rax, [rsp + 0x220]
mov qword [rsp + 0xd8], rax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0xe0], rax
lea rax, [rsp + 0xc8]
mov qword [rsp + 0xe8], rax
jne 0x140032a1a
cmp qword [0x14010eb58], 0
jne 0x140032a1a
lea rcx, [0x14010e3c0]
mov dword [0x14010e3c0], 2
call fcn.1400072ed
test eax, eax
jne 0x1400331f5
lea rcx, str.No_dumpable_optical_media_found.
call fcn.140036717
jmp 0x140032a1a
mov rax, qword [0x14010e3d0]
mov edx, 0x80000000
mov dword [0x14010e3c8], 0x2000000
cmp rax, rdx
jg 0x14003322e
cmp rax, 0x40000000
jg 0x140033224
mov dword [0x14010e3c8], 0x800000
jmp 0x14003322e
mov dword [0x14010e3c8], 0x1000000
mov r9, qword [0x14010e3e8]
test r9, r9
je 0x140033262
cmp byte [r9], 0
je 0x140033262
lea rcx, [rsp + 0x220]
lea r8, str._s.iso
mov edx, 0x21
call qword [sym.imp.msvcrt.dll__snprintf]
mov byte [rsp + 0x240], 0
mov rcx, qword [0x14010e3d0]
xor r8d, r8d
xor edx, edx
call fcn.140037ab9
lea rcx, str.ISO_media_size__s
mov rdx, rax
call fcn.140036717
xor r9d, r9d
xor edx, edx
mov ecx, 1
lea r8, [rsp + 0xd0]
call fcn.140039495
mov qword [0x14010e3e0], rax
test rax, rax
je 0x140032a1a
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [0x14010e158]
mov edx, 0x8002
mov rbp, qword [sym.imp.USER32.dll_SendMessageW]
call rbp
mov rdi, qword [0x1400b1100]
xor eax, eax
xor edx, edx
xor ecx, ecx
mov dword [rdi], eax
call fcn.1400296d4
mov ecx, 1
call fcn.140043620
xor edx, edx
xor ecx, ecx
lea r9, [0x14010e3c0]
mov qword [rsp + 0x28], rdx
lea r8, [0x140016476]
xor edx, edx
mov dword [rsp + 0x20], ecx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateThread]
mov qword [0x14010eb58], rax
test rax, rax
je 0x14003334b
lea rcx, str._r_nSave_to_ISO_operation_started
call fcn.140036717
or r9d, 0xffffffff
xor r8d, r8d
xor edx, edx
mov ecx, 1
call fcn.14001d77b
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8009
mov rcx, qword [0x14010e158]
call rbp
jmp 0x140032a1a
lea rcx, str.Unable_to_start_ISO_save_thread
call fcn.140036717
mov rcx, qword [0x14010e3e0]
mov dword [rdi], 0xe0031205
call sub.msvcrt.dll_free
xor eax, eax
xor r9d, r9d
xor r8d, r8d
mov qword [0x14010e3e0], rax
mov rcx, qword [0x14010e158]
mov edx, 0x8000
jmp 0x140033628
cmp rax, 0x50
jne 0x1400333dd
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [0x14010e0f0]
mov rbp, qword [sym.imp.USER32.dll_SendMessageW]
mov edx, 0x147
call rbp
mov rcx, qword [0x14010e0f0]
xor r9d, r9d
mov edx, 0x150
mov edi, eax
movsxd r8, eax
call rbp
xor edx, edx
mov ecx, eax
call fcn.14000f5e0
test eax, eax
je 0x140032a1a
mov ecx, edi
call fcn.140006e67
jmp 0x140032a1a
cmp rax, 0x51
jne 0x140033411
xor edx, edx
cmp dword [0x14010e020], 0
lea rcx, str.EnableFileIndexing
sete dl
mov dword [0x14010e020], edx
call fcn.140029d23
mov edi, dword [0x14010e020]
mov ecx, 0xcda
jmp 0x140033782
cmp rax, 0x52
jne 0x14003344f
lea rcx, [0x14009120a]
call fcn.140029024
mov r8d, 0xdac
neg eax
sbb r9d, r9d
xor ecx, ecx
xor edx, edx
add r9d, 0xcb1
call fcn.14001d77b
lea rcx, [0x1400931d3]
call fcn.140029024
jmp 0x140032a1a
cmp rax, 0x53
jne 0x140033472
xor edi, edi
cmp dword [0x14007d23c], 0
mov ecx, 0xcb4
sete dil
mov dword [0x14007d23c], edi
jmp 0x140032ff6
cmp rax, 0x54
jne 0x1400334a6
xor edx, edx
cmp dword [0x14010e034], 0
lea rcx, str.PreserveTimestamps
sete dl
mov dword [0x14010e034], edx
call fcn.140029d23
mov edi, dword [0x14010e034]
mov ecx, 0xcc5
jmp 0x140033782
cmp rax, 0x55
jne 0x1400334e7
xor eax, eax
cmp dword [0x14010e038], 0
lea rcx, str.UseProperSizeUnits
setne dl
sete al
xor edi, edi
movzx edx, dl
mov dword [0x14010e038], eax
call fcn.140029d23
cmp dword [0x14010e038], 0
mov ecx, 0xcbf
sete dil
jmp 0x140032ff6
cmp rax, 0x56
jne 0x14003352a
cmp dword [0x14007d1f8], 0
je 0x140032a1a
xor edx, edx
cmp dword [0x14010e010], 0
lea rcx, str.UseVds
sete dl
mov dword [0x14010e010], edx
call fcn.140029d23
mov edx, dword [0x14010e010]
lea rcx, [0x1400931e3]
jmp 0x14003378c
cmp rax, 0x57
jne 0x14003355e
xor edx, edx
cmp dword [0x14010e044], 0
lea rcx, str.EnableVmdkDetection
sete dl
mov dword [0x14010e044], edx
call fcn.140029d23
mov edi, dword [0x14010e044]
mov ecx, 0xcc1
jmp 0x140032ff6
cmp rax, 0x58
jne 0x140033586
mov r9d, 0xcb7
mov r8d, 0x7d0
xor edx, edx
xor ecx, ecx
call fcn.14001d77b
xor eax, eax
mov dword [0x14010ebc8], eax
jmp 0x140032a1a
cmp rax, 0x59
jne 0x14003359e
xor edi, edi
cmp dword [0x14010dfe4], 0
setle dil
jmp 0x140033777
cmp rax, 0x5a
jne 0x140033a5b
mov dword [0x14010e028], 1
xor eax, eax
mov dword [0x14010e030], eax
jmp 0x140033617
cmp edx, 0x100
jne 0x140033a5b
cmp qword [rsp + 0x100], 0x5a
je 0x1400335e4
cmp qword [rsp + 0x100], 0x46
jne 0x14003366a
jmp 0x140033646
mov rdi, qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x11
call rdi
test ax, ax
jns 0x140033633
mov ecx, 0x12
call rdi
test ax, ax
jns 0x140033633
mov dword [0x14010e028], 1
mov dword [0x14010e030], 1
xor r9d, r9d
mov r8d, 0x3eb
mov edx, 0x111
mov rcx, r13
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x140032a1a
cmp dword [rsp + 0xf8], 0x100
jne 0x140033a5b
jmp 0x1400335d3
mov rdi, qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x11
call rdi
test ax, ax
js 0x14003367e
cmp dword [rsp + 0xf8], 0x100
jne 0x140033a5b
cmp qword [rsp + 0x100], 0x59
jne 0x140033a5b
jmp 0x140033741
mov ecx, 0x12
call rdi
test ax, ax
jns 0x140033659
xor edx, edx
cmp dword [0x14010e024], 0
mov eax, dword [rsp + 0x60]
sete dl
mov dword [0x14010e024], edx
jne 0x1400336b1
mov eax, dword [0x14010e060]
mov dword [rsp + 0x60], eax
mov eax, 1
xor r8d, r8d
test eax, eax
mov edx, 0x3fe
mov rcx, qword [0x14010e158]
setne r8b
mov dword [0x14010e060], eax
call qword [sym.imp.USER32.dll_CheckDlgButton]
mov edi, dword [0x14010e024]
mov ecx, 0xcd7
call fcn.14001d5c1
mov rcx, rax
mov edx, edi
call fcn.140026fa3
cmp dword [0x14010e024], 0
lea rax, [0x140091192]
lea rdx, str.CAUTION:
cmove rdx, rax
lea r8, str.enabled
lea rax, [0x1400927a8]
cmove r8, rax
lea rcx, str._sListing_of_non_USB_removable_drives__s
call fcn.140036717
cmp dword [0x14010e024], 0
je 0x140033005
lea rcx, str.By_using_this_unofficial_cheat_mode_you_forfeit_ANY_RIGHT_to_complain_if_you_lose_valuable_data_
call fcn.140036717
jmp 0x140033005
mov rdi, qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x11
call rdi
test ax, ax
jns 0x140033a5b
mov ecx, 0x12
call rdi
test ax, ax
jns 0x140033a5b
xor edi, edi
cmp dword [0x14010dfe4], 0
setle dil
add edi, edi
mov dword [0x14010dfe4], edi
mov ecx, 0xcbb
call fcn.14001d5c1
mov edx, edi
mov rcx, rax
call fcn.140026fa3
jmp 0x140032a1a
mov rax, qword [0x1400b1940]
mov rcx, qword [rax]
test rcx, rcx
je 0x1400337b6
xor r9d, r9d
xor r8d, r8d
mov edx, 0x10
call qword [sym.imp.USER32.dll_SendMessageW]
cmp dword [0x14010ebb8], 0
je 0x1400337e9
xor eax, eax
mov ecx, 1
mov edi, 1
mov dword [0x14010ebb8], eax
call fcn.14001d377
mov ecx, 1
call fcn.14001d31c
jmp 0x140032778
xor esi, esi
xor ebx, ebx
mov eax, dword [rsp + 0x58]
xor eax, 1
test dword [rsp + 0x5c], eax
je 0x14003381a
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.DLL_ReleaseMutex]
mov rax, qword [rsp + 0x50]
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x14003381a
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov rax, qword [0x1400b1d90]
mov rcx, qword [rax]
test rcx, rcx
je 0x140033834
mov edx, 1
call qword [sym.imp.KERNEL32.DLL_TerminateThread]
cmp dword [rsp + 0x80], 0
jne 0x140033855
cmp byte [rsp + 0x424], 0
je 0x140033855
lea rcx, [rsp + 0x424]
call fcn.140029fc0
call fcn.14003a349
xor edi, edi
xor ebp, ebp
xor r12d, r12d
call fcn.14003e32e
xor ecx, ecx
xor r13d, r13d
call fcn.14001d377
mov rcx, qword [0x14010cf30]
call sub.msvcrt.dll_free
mov rcx, qword [0x14010cf20]
xor r9d, r9d
mov qword [0x14010cf30], r9
call sub.msvcrt.dll_free
mov rcx, qword [rsp + 0x48]
xor r10d, r10d
mov qword [0x14010cf20], r10
call sub.msvcrt.dll_free
mov rcx, qword [0x14010e190]
call sub.msvcrt.dll_free
mov rcx, qword [0x14010e198]
xor r11d, r11d
mov qword [0x14010e190], r11
call sub.msvcrt.dll_free
mov qword [0x14010e198], rdi
mov rdi, qword [0x1400b18c0]
mov rcx, qword [rdi]
call sub.msvcrt.dll_free
mov rcx, qword [0x14010ce80]
mov qword [rdi], rbp
call sub.msvcrt.dll_free
mov rdi, qword [0x1400b1840]
mov qword [0x14010ce80], r12
mov rcx, qword [rdi]
call sub.msvcrt.dll_free
mov qword [rdi], r13
xor edi, edi
test r15, r15
je 0x140033933
cmp dword [rsp + 0x98], edi
jle 0x14003392b
mov rcx, qword [r15 + rdi*8]
call sub.msvcrt.dll_free
xor r8d, r8d
mov qword [r15 + rdi*8], r8
inc rdi
jmp 0x14003390d
mov rcx, r15
call sub.msvcrt.dll_free
test ebx, ebx
je 0x14003395c
xor ecx, ecx
lea r9, str.NoDriveTypeAutorun
lea r8, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
mov dword [rsp + 0x20], ecx
lea rdx, [0x14010ebc8]
mov ecx, 1
call fcn.140035d4b
cmp dword [rsp + 0xa0], 0
jne 0x14003397d
xor ecx, ecx
call fcn.14000c792
test eax, eax
jne 0x14003397d
lea rcx, str.Failed_to_restore_AutoMount_to_disabled
call fcn.140036717
mov rbx, qword [0x1400b1d20]
cmp qword [rbx], 0
je 0x14003399d
mov rdx, qword [0x1400b1d10]
lea rcx, [0x1400910a6]
call fcn.140036717
xor edx, edx
lea rcx, [0x14010ddc0]
lea rdi, str.rufus.com
mov qword [rbx], rdx
xor ebx, ebx
call fcn.140029f92
mov rbp, qword [sym.imp.KERNEL32.DLL_DeleteFileA]
mov r12, qword [sym.imp.KERNEL32.DLL_Sleep]
mov rcx, rdi
call rbp
test eax, eax
jne 0x1400339df
cmp ebx, 0xb
je 0x1400339df
mov ecx, 0xc8
inc ebx
call r12
jmp 0x1400339c5
mov rcx, rsi
lea rbx, [0x14010e1c0]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rsi, qword [sym.imp.KERNEL32.DLL_FreeLibrary]
mov ax, word [0x14010e1a0]
test ax, ax
je 0x140033a1c
dec eax
mov word [0x14010e1a0], ax
movzx eax, ax
mov rcx, qword [rbx + rax*8]
call rsi
jmp 0x1400339fc
cmp dword [rsp + 0x5c], 0
je 0x140033ae0
call qword [sym.imp.KERNEL32.DLL_GetConsoleWindow]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rax
xor eax, eax
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_SetWindowPos]
call qword [sym.imp.KERNEL32.DLL_FreeConsole]
jmp 0x140033ae0
test r12d, r12d
je 0x140033a96
mov ecx, 0x12
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x140033a96
test r14d, r14d
je 0x140033a7d
xor r14d, r14d
xor r12d, r12d
jmp 0x140033a96
mov rcx, qword [0x1400b1da0]
mov r8d, 3
mov eax, dword [rcx]
inc eax
cdq
idiv r8d
mov dword [rcx], edx
jmp 0x140033a75
lea rdi, [rsp + 0xf0]
mov rbp, qword [sym.imp.USER32.dll_IsDialogMessageW]
mov rcx, r13
mov rdx, rdi
call rbp
test eax, eax
jne 0x140032a1a
mov rcx, qword [0x14010e0a0]
mov rdx, rdi
call rbp
test eax, eax
jne 0x140032a1a
mov rcx, rdi
call qword [sym.imp.USER32.dll_TranslateMessage]
mov rcx, rdi
call qword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x140032a1a
lea rcx, str._Rufus_exit__n
call fcn.140036717
xor eax, eax
add rsp, 0x638
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
push rdi
push rsi
push rbx
sub rsp, 0x90
xor esi, esi
call fcn.1400737d0
call fcn.140075c40
mov rbx, qword [rax]
test rbx, rbx
jne 0x1400770cb
jmp 0x140077141
test cl, cl
je 0x1400770f8
and esi, 1
je 0x1400770e0
mov esi, 1
call sub.msvcrt.dll__ismbblead
test eax, eax
je 0x1400770c7
cmp byte [rbx + 1], 1
sbb rbx, 0xffffffffffffffff
add rbx, 1
movsx ecx, byte [rbx]
cmp cl, 0x20
jle 0x1400770a8
mov eax, esi
xor eax, 1
cmp cl, 0x22
cmove esi, eax
jmp 0x1400770b6
test cl, cl
je 0x1400770f8
nop dword [rax]
movzx eax, byte [rbx + 1]
add rbx, 1
test al, al
je 0x1400770f8
cmp al, 0x20
jle 0x1400770e8
lea rdx, [rsp + 0x20]
xor eax, eax
mov ecx, 0xd
mov rdi, rdx
rep stosq qword [rdi], rax
mov rcx, rdx
call qword [sym.imp.KERNEL32.DLL_GetStartupInfoA]
mov r9d, 0xa
test byte [rsp + 0x5c], 1
je 0x140077126
movzx r9d, word [rsp + 0x60]
mov rcx, qword [0x1400b1300]
mov r8, rbx
xor edx, edx
add rsp, 0x90
pop rbx
pop rsi
pop rdi
jmp 0x14003109b
lea rbx, [0x1400b07e0]
jmp 0x1400770f8