Function at 0x140049030
Capabilities:
Authenticate hmac
Check if file exists
Extract resource via kernel32 functions
Move file

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xf8]
sub rsp, 0x1c0
movaps xmmword [rax - 0x48], xmm6
movaps xmmword [rax - 0x58], xmm7
movaps xmmword [rax - 0x68], xmm8
movaps xmmword [rax - 0x78], xmm9
movaps xmmword [rax - 0x88], xmm10
movaps xmmword [rax - 0x98], xmm11
mov rax, qword [0x140193440]
xor rax, rsp
mov qword [rbp + 0x50], rax
xor r12d, r12d
mov qword [rsp + 0x68], rcx
cmp byte [0x1401e8f56], r12b
mov r15d, 1
mov qword [rsp + 0x48], r12
jne 0x1400490a9
cmp dword [0x1401a0460], r12d
je 0x140049c01
mov qword [rsp + 0x28], rdx
lea r9, [0x14015be8c]
mov qword [rsp + 0x20], rcx
mov edx, 0x40
lea rcx, [rbp + 0x10]
mov r8, 0xffffffffffffffff
call fcn.140004fd0
lea rdx, [rsp + 0x48]
mov byte [rbp + 0x4f], r12b
lea rcx, [rbp + 0x10]
call fcn.14004f550
mov dword [rsp + 0x50], eax
mov r13d, eax
test eax, eax
je 0x140049c01
cmp dword [0x1401a0470], r12d
mov esi, r12d
mov r14, qword [rsp + 0x48]
jbe 0x140049465
mov r12d, 0x57
movabs r13, 0x7e0000007e03ff
mov r8, qword [0x1401a0468]
xor edx, edx
mov edi, esi
mov rax, 0xffffffffffffffff
mov rcx, qword [r8 + rdi*8]
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], dl
jne 0x140049130
test eax, eax
je 0x14004916f
nop dword [rax]
mov rcx, qword [r8 + rdi*8]
cmp byte [rcx + rdx], 0x5c
jne 0x140049155
mov byte [rcx + rdx], 0x2f
mov r8, qword [0x1401a0468]
mov rcx, qword [r8 + rdi*8]
inc edx
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x140049162
cmp edx, eax
jb 0x140049140
mov rdx, qword [r8 + rdi*8]
mov rcx, r14
add rdx, 2
call fcn.1400b4230
mov rbx, rax
test rax, rax
je 0x14004944f
test r15d, r15d
je 0x1400491a3
lea rdx, [rbp + 0x10]
lea rcx, str.Updating__s:
call fcn.14004f2f0
xor r15d, r15d
mov rcx, qword [0x1401a0468]
mov rdx, qword [rcx + rdi*8]
lea rcx, [0x140164260]
add rdx, 2
call fcn.14004f2f0
mov rdx, qword [0x1401a0468]
lea r8, [rbp]
xor ecx, ecx
sub rbx, r14
mov rdx, qword [rdx + rdi*8]
call fcn.140047330
test rbx, rbx
jle 0x1400491f3
lea rax, [r14 - 1]
add rax, rbx
cmp byte [rax], 0xa
je 0x1400491f3
dec rbx
dec rax
test rbx, rbx
jg 0x1400491e3
movzx eax, byte [rbx + r14]
sub al, 0x30
cmp al, 0x36
ja 0x140049204
bt r13, rax
jb 0x14004921d
mov r8d, 0x880
lea rdx, str.D:_a_rufus_rufus_srchash.c
lea rcx, str.IS_HEXASCII_md5_data_pos__
call fcn.1400fbe54
mov r10d, 3
lea r11, [rbp + 2]
nop word [rax + rax]
movzx r8d, byte [r11 - 2]
lea r9d, [r10*2 - 6]
movzx ecx, r8b
mov edx, r9d
add rdx, rbx
shr cl, 4
cmp cl, 0xa
mov eax, 0x30
cmovae eax, r12d
and r8b, 0xf
add al, cl
mov byte [rdx + r14], al
cmp r8b, 0xa
mov eax, 0x30
cmovae eax, r12d
add al, r8b
movzx r8d, byte [r11 - 1]
mov byte [rdx + r14 + 1], al
movzx ecx, r8b
shr cl, 4
lea edx, [r9 + 2]
add rdx, rbx
mov eax, 0x30
cmp cl, 0xa
cmovae eax, r12d
and r8b, 0xf
add al, cl
mov byte [rdx + r14], al
cmp r8b, 0xa
mov eax, 0x30
cmovae eax, r12d
add al, r8b
movzx r8d, byte [r11]
mov byte [rdx + r14 + 1], al
movzx ecx, r8b
shr cl, 4
lea edx, [r10*2 - 2]
add rdx, rbx
mov eax, 0x30
cmp cl, 0xa
cmovae eax, r12d
and r8b, 0xf
add al, cl
mov byte [rdx + r14], al
cmp r8b, 0xa
mov eax, 0x30
cmovae eax, r12d
add al, r8b
movzx r8d, byte [r11 + 1]
mov byte [rdx + r14 + 1], al
movzx ecx, r8b
shr cl, 4
lea edx, [r10 + r10]
add rdx, rbx
mov eax, 0x30
cmp cl, 0xa
cmovae eax, r12d
and r8b, 0xf
add al, cl
mov byte [rdx + r14], al
cmp r8b, 0xa
mov eax, 0x30
cmovae eax, r12d
add al, r8b
movzx r8d, byte [r11 + 2]
mov byte [rdx + r14 + 1], al
movzx ecx, r8b
shr cl, 4
lea edx, [r10*2 + 2]
add rdx, rbx
mov eax, 0x30
cmp cl, 0xa
cmovae eax, r12d
and r8b, 0xf
add al, cl
mov byte [rdx + r14], al
cmp r8b, 0xa
mov eax, 0x30
cmovae eax, r12d
add al, r8b
mov byte [rdx + r14 + 1], al
movzx r8d, byte [r11 + 3]
lea edx, [r10*2 + 4]
add rdx, rbx
lea r11, [r11 + 8]
movzx ecx, r8b
mov eax, 0x30
shr cl, 4
cmp cl, 0xa
cmovae eax, r12d
and r8b, 0xf
add al, cl
mov byte [rdx + r14], al
cmp r8b, 0xa
mov eax, 0x30
cmovae eax, r12d
add al, r8b
movzx r8d, byte [r11 - 4]
mov byte [rdx + r14 + 1], al
movzx ecx, r8b
shr cl, 4
lea edx, [r10*2 + 6]
add rdx, rbx
mov eax, 0x30
cmp cl, 0xa
cmovae eax, r12d
and r8b, 0xf
add al, cl
mov byte [rdx + r14], al
cmp r8b, 0xa
mov eax, 0x30
cmovae eax, r12d
add al, r8b
movzx r8d, byte [r11 - 3]
mov byte [rdx + r14 + 1], al
movzx ecx, r8b
shr cl, 4
lea edx, [r10*2 + 8]
add rdx, rbx
lea r10d, [r10 + 8]
cmp cl, 0xa
mov eax, 0x30
cmovae eax, r12d
and r8b, 0xf
add al, cl
mov byte [rdx + r14], al
cmp r8b, 0xa
mov eax, 0x30
cmovae eax, r12d
add al, r8b
mov byte [rdx + r14 + 1], al
lea eax, [r10 - 3]
cmp eax, 0x10
jb 0x140049230
inc esi
cmp esi, dword [0x1401a0470]
jb 0x140049115
mov r13d, dword [rsp + 0x50]
xor r12d, r12d
cmp dword [0x1401a0460], 0
je 0x140049aff
lea eax, [r13 + 0x400]
mov edi, r13d
mov ecx, eax
mov qword [rsp + 0x58], rdi
mov ebx, eax
call fcn.1400e8c84
mov qword [rsp + 0x78], rax
mov r15, rax
test rax, rax
jne 0x1400494b5
mov r8d, 0x88b
lea rdx, str.D:_a_rufus_rufus_srchash.c
lea rcx, str.new_data___NULL
call fcn.1400fbe54
jmp 0x140049c01
mov r9, qword [0x1401e79b0]
test r9, r9
je 0x14004950f
lea r8, str._md5sum_totalbytes__0x_llx_n
mov rdx, rbx
mov rcx, r15
call fcn.140041420
mov rdi, 0xffffffffffffffff
nop word [rax + rax]
inc rdi
cmp byte [r15 + rdi], 0
jne 0x1400494e0
add edi, r13d
mov rsi, 0xffffffffffffffff
mov qword [rsp + 0x58], rdi
nop dword [rax]
inc rsi
cmp byte [r15 + rsi], 0
jne 0x140049500
add rsi, r15
jmp 0x140049512
mov rsi, r15
movsd xmm9, qword [0x140176fe0]
lea rbx, str.boot.efi
movsd xmm8, qword [0x140176f68]
mov eax, 1
movsd xmm10, qword [0x140176fc0]
mov r12, r14
movsd xmm11, qword [0x140176f90]
mov r14d, 0x258
mov dword [rsp + 0x40], eax
nop
mov r13d, eax
lea r9, str._sefi_boot_s
mov edx, 0x40
lea rcx, [rbp - 0x80]
mov r8, 0xffffffffffffffff
mov rax, qword [rbx + r13*8]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x20], rax
call fcn.140004fd0
lea rcx, [rbp - 0x80]
mov byte [rbp - 0x41], 0
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x140049966
movzx eax, word [rsp + 0x40]
xor r15d, r15d
mov r13, qword [rbx + r13*8]
add ax, r14w
mov rbx, qword [0x1401e87b8]
mov r8d, 0xa
movzx edx, ax
mov rcx, rbx
mov qword [rsp + 0x70], r15
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov r14, rax
test rax, rax
jne 0x1400495e7
call fcn.14004fba0
mov r8, rax
lea rcx, str.Could_not_locate_resource__s:__s
mov rdx, r13
call fcn.14004f2f0
jmp 0x140049635
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r15, rax
test rax, rax
jne 0x140049619
call fcn.14004fba0
mov r8, rax
lea rcx, str.Could_not_load_resource__s:__s
mov rdx, r13
call fcn.14004f2f0
mov r15, qword [rsp + 0x70]
jmp 0x140049635
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, r15
mov dword [rsp + 0x60], eax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r15, rax
lea rcx, [rbp - 0x80]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x140049640
inc rax
lea rdx, [rbp - 0x80]
mov ebx, 0x40
lea rcx, [rbp - 0x40]
cmp rax, rbx
cmovb rbx, rax
mov r8, rbx
call fcn.140135ea0
lea rcx, [rbp - 0x40]
mov byte [rbp + rbx - 0x41], 0
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x140049680
sub rax, 4
cmp rax, 0x40
jae 0x140049c9f
mov r9, 0xffffffffffffffff
mov byte [rbp + rax - 0x40], 0
lea r8, str._original.efi
mov edx, 0x40
lea rcx, [rbp - 0x40]
call fcn.1400e8d6c
test r15, r15
je 0x140049945
lea rcx, [rbp - 0x80]
call fcn.1400414c0
lea rcx, [rbp - 0x40]
mov rbx, rax
call fcn.1400414c0
mov rdx, rax
mov rcx, rbx
mov r14, rax
call qword [sym.imp.KERNEL32.dll_MoveFileW]
mov r13d, eax
test r14, r14
je 0x1400496f5
mov rcx, r14
call fcn.1400e8c70
test rbx, rbx
je 0x140049702
mov rcx, rbx
call fcn.1400e8c70
test r13d, r13d
je 0x140049945
lea r8, [rbp - 0x40]
lea rdx, [rbp - 0x80]
lea rcx, str.Renamed:__s___s
call fcn.14004f2f0
mov qword [rsp + 0x30], 0
lea rcx, [rbp - 0x80]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
mov edx, 0xc0000000
mov dword [rsp + 0x20], 2
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x1400498ed
mov r14d, dword [rsp + 0x60]
xor r9d, r9d
mov r8d, r14d
mov rdx, r15
mov rcx, rax
call fcn.140050980
test eax, eax
jne 0x1400497e3
call fcn.14004fba0
mov r8, rax
lea rdx, [rbp - 0x80]
lea rcx, str.Could_not_write__s:__s.
call fcn.14004f2f0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp - 0x40]
call fcn.1400414c0
lea rcx, [rbp - 0x80]
mov rbx, rax
call fcn.1400414c0
mov rdx, rax
mov rcx, rbx
mov r14, rax
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test r14, r14
je 0x1400497cd
mov rcx, r14
call fcn.1400e8c70
test rbx, rbx
je 0x140049959
mov rcx, rbx
call fcn.1400e8c70
jmp 0x140049959
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x14019f590], 0
lea rax, [0x1401564ce]
mov rcx, r14
xorps xmm7, xmm7
lea r14, [0x140166140]
cmove r14, rax
test rcx, rcx
js 0x140049817
cvtsi2sd xmm7, rcx
jmp 0x14004982c
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2sd xmm7, rax
addsd xmm7, xmm7
mov r15, qword [0x14019f560]
xor ebx, ebx
comisd xmm9, xmm7
ja 0x14004984a
inc rbx
mulsd xmm7, xmm8
cmp rbx, 5
jl 0x140049835
test rbx, rbx
jne 0x140049871
mov rax, qword [r15 + 0xa0]
lea r9, str._s_d_s__s
mov qword [rsp + 0x38], rax
cvttsd2si ecx, xmm7
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], ecx
jmp 0x1400498b9
movaps xmm6, xmm7
movaps xmm0, xmm7
mulsd xmm6, xmm10
call fcn.140135bc0
lea rax, str._s_0.0f_s__s
mulsd xmm0, xmm10
lea r9, str._s_0.1f_s__s
subsd xmm6, xmm0
comisd xmm11, xmm6
cmova r9, rax
mov rax, qword [r15 + rbx*8 + 0xa0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
movsd qword [rsp + 0x28], xmm7
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x20], r14
mov edx, 0x20
lea rcx, [0x1401e2e30]
call fcn.140004fd0
lea r8, [0x1401e2e30]
mov byte [0x1401e2e4f], 0
lea rcx, str.Created:__s___s_
jmp 0x140049950
call fcn.14004fba0
mov r8, rax
lea rdx, [rbp - 0x80]
lea rcx, str.Could_not_create__s:__s.
call fcn.14004f2f0
lea rcx, [rbp - 0x40]
call fcn.1400414c0
lea rcx, [rbp - 0x80]
mov rbx, rax
call fcn.1400414c0
mov rdx, rax
mov rcx, rbx
mov r14, rax
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test r14, r14
je 0x140049936
mov rcx, r14
call fcn.1400e8c70
test rbx, rbx
je 0x140049959
mov rcx, rbx
call fcn.1400e8c70
jmp 0x140049959
lea r8, [rbp - 0x40]
lea rcx, str.Could_not_rename:__s___s
lea rdx, [rbp - 0x80]
call fcn.14004f2f0
mov r14d, 0x258
lea rbx, str.boot.efi
mov eax, dword [rsp + 0x40]
inc eax
mov dword [rsp + 0x40], eax
cmp eax, 0xa
jb 0x140049550
mov rbx, qword [rsp + 0x48]
lea rdx, str._._efi_boot_boot
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrStrIA]
mov r14, rax
test rax, rax
je 0x140049ad6
nop word [rax + rax]
lea r15, str.bootia32.efi
mov r13d, 9
nop dword [rax]
mov rdx, qword [r15]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
cmp byte [rdx + rax + 1], 0
lea rax, [rax + 1]
jne 0x1400499c0
cmp byte [rax + r14 + 0xc], 0xa
jne 0x140049aa1
mov rax, 0xffffffffffffffff
nop
cmp byte [rdx + rax + 1], 0
lea rax, [rax + 1]
jne 0x1400499e0
lea rcx, [r14 + 0xc]
mov byte [rax + r14 + 0xc], 0
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x140049a83
mov rdi, qword [r15]
mov rcx, 0xffffffffffffffff
nop dword [rax]
inc rcx
cmp byte [rdi + rcx], 0
jne 0x140049a10
add rcx, 8
mov rax, r14
sub rax, r12
mov rdx, r12
add rax, rcx
mov rcx, rsi
mov r8d, eax
mov ebx, eax
call fcn.140135ea0
movsd xmm0, qword [str._original.efi_n]
add rsi, rbx
add dword [rsp + 0x58], 9
movsd qword [rsi], xmm0
mov eax, dword [0x1401643f0]
mov dword [rsi + 8], eax
movzx eax, word [0x1401643f4]
mov word [rsi + 0xc], ax
movzx eax, byte [0x1401643f6]
mov byte [rsi + 0xe], al
add rsi, 0xe
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rdi + rax], 0
jne 0x140049a73
lea r12, [r14 + 0xd]
add r12, rax
mov rcx, qword [r15]
mov rax, 0xffffffffffffffff
nop dword [rax]
cmp byte [rcx + rax + 1], 0
lea rax, [rax + 1]
jne 0x140049a90
mov byte [rax + r14 + 0xc], 0xa
add r15, 8
sub r13, 1
jne 0x1400499b0
lea rcx, [r14 + 0xc]
lea rdx, str._._efi_boot_boot
call qword [sym.imp.SHLWAPI.dll_StrStrIA]
mov r14, rax
test rax, rax
jne 0x1400499a0
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x48]
mov r8d, dword [rsp + 0x50]
mov rdx, r12
sub r8, r12
mov rcx, rsi
add r8, rbx
call fcn.140135ea0
mov rcx, rbx
call fcn.1400e8c70
mov r14, qword [rsp + 0x78]
xor r12d, r12d
mov r13d, edi
lea rcx, [rbp + 0x10]
mov qword [rsp + 0x48], r12
call fcn.14004ef90
mov r9d, 0xffffffff
mov dword [rsp + 0x28], r12d
lea r8, [0x14015be94]
mov qword [rsp + 0x20], r12
xor edx, edx
mov ecx, 0xfde9
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rdi, eax
cmp edi, 1
jle 0x140049b80
mov rcx, rdi
mov edx, 2
call fcn.1400c4f6c
mov rbx, rax
test rax, rax
je 0x140049b80
mov dword [rsp + 0x28], edi
lea r8, [0x14015be94]
mov r9d, 0xffffffff
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, edi
je 0x140049b83
mov rcx, rbx
call fcn.1400e8c70
mov rbx, r12
mov r8, rbx
lea rcx, [rsp + 0x48]
mov rdx, rsi
call fcn.1400e90a0
test rsi, rsi
je 0x140049ba0
mov rcx, rsi
call fcn.1400e8c70
test rbx, rbx
je 0x140049bad
mov rcx, rbx
call fcn.1400e8c70
mov rbx, qword [rsp + 0x48]
test rbx, rbx
jne 0x140049bc9
lea rdx, [rbp + 0x10]
lea rcx, str.Error:_Cant_create__s
call fcn.14004f2f0
jmp 0x140049bf9
mov r8d, r13d
mov r9, rbx
mov edx, 1
mov rcx, r14
call fcn.140109c90
cmp eax, r13d
je 0x140049bf1
lea rdx, [rbp + 0x10]
lea rcx, str.Error:_Cant_write__s
call fcn.14004f2f0
mov rcx, rbx
call fcn.1400e9320
mov rcx, r14
call fcn.1400e8c70
mov rcx, qword [0x1401a0468]
test rcx, rcx
je 0x140049c4e
cmp dword [0x1401a0470], 0
mov edi, r12d
jbe 0x140049c47
nop dword [rax]
mov ebx, edi
mov rcx, qword [rcx + rbx*8]
call fcn.1400e8c70
mov rax, qword [0x1401a0468]
inc edi
mov qword [rax + rbx*8], r12
cmp edi, dword [0x1401a0470]
mov rcx, qword [0x1401a0468]
jb 0x140049c20
mov dword [0x1401a0470], r12d
call fcn.1400e8c70
mov qword [0x1401a0468], r12
mov rcx, qword [rbp + 0x50]
xor rcx, rsp
call fcn.1400b2a30
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x50]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1400b2b58
int3