Function at 0x140008e70
Capabilities:
Contain obfuscated stackstrings
Get disk information
Get disk information via ioctl
Read file on windows
Set registry value

Disassembly:
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x1260]
mov eax, 0x1360
call fcn.1400b3400
sub rsp, rax
mov rax, qword [0x140193440]
xor rax, rsp
mov qword [rbp + 0x1250], rax
mov edi, ecx
mov dword [rsp + 0x78], ecx
xor esi, esi
mov dword [rsp + 0x74], 0x5c3a53
lea rcx, [rbp + 0x50]
xor edx, edx
mov r8d, 0x1000
mov r12d, esi
mov r15d, 0xffffffff
call fcn.140136540
cmp dword [0x1401d0500], 0xa0
mov r14d, esi
mov dword [rbp - 0x60], 0x5441460b
mov dword [rbp - 0x5c], 0x20202020
mov dword [rbp - 0x58], 0x41460120
mov dword [rbp - 0x54], 0x20323154
mov dword [rbp - 0x50], 0x460e2020
mov dword [rbp - 0x4c], 0x36315441
mov dword [rbp - 0x48], 0xc202020
mov dword [rbp - 0x44], 0x33544146
mov dword [rbp - 0x40], 0x20202032
jae 0x140008f2e
lea rcx, str.ESP_toggling_is_only_available_for_Windows_10_or_later
call fcn.14004f2f0
xor eax, eax
jmp 0x140009675
mov qword [rsp + 0x1398], rbx
mov ecx, edi
mov qword [rsp + 0x13a0], r13
call fcn.140005f90
mov r9d, 1
xor edx, edx
mov r8d, r9d
mov rcx, rax
mov rbx, rax
call fcn.140005bf0
mov rcx, rbx
mov r13, rax
call fcn.1400e8c70
cmp r13, 0xffffffffffffffff
jne 0x140008f73
xor eax, eax
jmp 0x140009665
mov qword [rsp + 0x38], rsi
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], rax
xor r9d, r9d
lea rax, [rbp + 0x50]
mov dword [rsp + 0x28], 0x1000
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0x70050
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x14000963f
cmp dword [rsp + 0x70], esi
jbe 0x14000963f
mov r9d, dword [rbp + 0x54]
mov edx, esi
test r9d, r9d
jle 0x140009034
mov r8d, dword [rbp + 0x50]
mov r10, qword [0x140157a68]
mov r11, qword [0x140157a60]
movsxd rbx, edx
test r8d, r8d
jne 0x140008ff4
lea rdi, [rbx + rbx*8]
shl rdi, 4
cmp byte [rbp + rdi + 0xa0], 0xef
je 0x1400091b0
cmp r8d, 1
jne 0x14000902d
lea rdi, [rbx + rbx*8]
shl rdi, 4
lea rax, [rbp + 0xa0]
add rax, rdi
je 0x14000902d
mov rcx, qword [rax]
sub rcx, r11
jne 0x14000901d
mov rcx, qword [rax + 8]
sub rcx, r10
test rcx, rcx
mov eax, esi
sete al
test eax, eax
jne 0x1400091b0
inc edx
cmp edx, r9d
jl 0x140008fd6
mov ebx, dword [rsp + 0x70]
mov edi, 1
nop dword [rax]
test r15d, r15d
jns 0x140009231
movzx eax, dil
lea r9, str.ToggleEsp_02u
mov edx, 0x10
mov dword [rsp + 0x20], eax
mov r8, 0xffffffffffffffff
lea rcx, [rbp - 0x38]
call fcn.140004fd0
lea rcx, [rbp - 0x38]
mov byte [rbp - 0x29], sil
call fcn.140005830
test rax, rax
je 0x1400093a0
lea rcx, [0x1401e2d27]
mov qword [rsp + 0x60], rcx
lea r9, [0x1401e2d1c]
lea rcx, [0x1401e2d26]
mov qword [rsp + 0x58], rcx
lea r8, [0x1401e2d18]
lea rcx, [0x1401e2d25]
mov qword [rsp + 0x50], rcx
lea rdx, str._08X__04X__04X__02X_02X__02X_02X_02X_02X_02X_02X
lea rcx, [0x1401e2d24]
mov qword [rsp + 0x48], rcx
lea rcx, [0x1401e2d23]
mov qword [rsp + 0x40], rcx
lea rcx, [0x1401e2d22]
mov qword [rsp + 0x38], rcx
lea rcx, [0x1401e2d21]
mov qword [rsp + 0x30], rcx
lea rcx, [0x1401e2d20]
mov qword [rsp + 0x28], rcx
lea rcx, [0x1401e2d1e]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400033a0
cmp eax, 0xb
jne 0x1400093a0
mov ebx, esi
cmp dword [rbp + 0x54], esi
jle 0x1400093a0
movups xmm0, xmmword [0x140157a60]
mov edx, dword [rbp + 0x50]
nop word [rax + rax]
test r15d, r15d
jns 0x1400093a0
cmp edx, 1
jne 0x14000934c
movsxd rax, ebx
lea r14, [rbp + 0xb0]
lea rcx, [rax + rax*8]
shl rcx, 4
add r14, rcx
test r14, r14
je 0x140009395
mov rcx, qword [0x1401e2d18]
sub rcx, qword [r14]
jne 0x140009177
mov rcx, qword [0x1401e2d20]
sub rcx, qword [r14 + 8]
test rcx, rcx
mov eax, esi
sete al
test eax, eax
je 0x140009395
mov r12d, 1
mov r15d, ebx
cmp edx, r12d
jne 0x14000937c
movsxd rax, ebx
lea rcx, [rax + rax*8]
add rcx, rcx
movups xmmword [rbp + rcx*8 + 0xa0], xmm0
jmp 0x140009392
mov r15d, edx
test edx, edx
js 0x140009034
cmp r8d, 1
jne 0x1400091e3
lea rdx, [rbp + 0xc8]
add rdx, rdi
lea rcx, str.ESP_name:__S
call fcn.14004f2f0
lea rcx, [rbp + 0xb0]
add rcx, rdi
jmp 0x1400091fc
mov eax, dword [rbp + 0x58]
lea rcx, [rbp - 0x70]
mov dword [rbp - 0x70], eax
mov rax, qword [rbp + rdi + 0x88]
mov qword [rbp - 0x68], rax
mov dword [rbp - 0x6c], esi
call fcn.1400088c0
test eax, eax
jne 0x140009216
lea rcx, str.ESP_toggling_data_could_not_be_stored
call fcn.14004f2f0
jmp 0x140009655
mov eax, dword [rbp + 0x50]
cmp eax, 1
jne 0x14000928e
movups xmm0, xmmword [0x140158030]
movups xmmword [rbp + rdi + 0xa0], xmm0
mov ebx, dword [rsp + 0x70]
mov r9d, dword [rsp + 0x70]
lea r8, [rbp + 0x50]
mov qword [rsp + 0x38], rsi
mov edx, 0x7c054
movsxd rax, r15d
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
lea rcx, [rax + rax*8]
add rcx, rcx
mov byte [rbp + rcx*8 + 0x9c], 1
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x1400093c7
call fcn.14004fba0
mov rdx, rax
lea rcx, str.Could_not_set_drive_layout:__s
call fcn.14004f2f0
jmp 0x140009655
test eax, eax
jne 0x14000922d
mov rdx, qword [rbp + rdi + 0x88]
xor r9d, r9d
xor r8d, r8d
mov byte [rbp + rdi + 0xa0], 0xb
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14000922d
lea r9, [rbp - 0x78]
mov qword [rsp + 0x20], rsi
mov r8d, 0x200
lea rdx, [rbp + 0x1050]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14000922d
cmp dword [rbp - 0x78], 0x200
jne 0x14000922d
lea r8, [rbp + 0x1086]
mov r9d, 2
nop word [rax + rax]
mov ecx, esi
nop dword [rax]
nop word [rax + rax]
movsxd rax, ecx
lea rdx, [rax + rax*8]
mov rax, qword [r8]
cmp rax, qword [rbp + rdx - 0x5f]
je 0x14000932a
inc ecx
cmp ecx, 4
jb 0x140009310
jmp 0x14000933d
movzx eax, byte [rbp + rdx - 0x60]
lea rcx, [rbx + rbx*8]
add rcx, rcx
mov byte [rbp + rcx*8 + 0xa0], al
add r8, 0x1c
sub r9, 1
jne 0x140009300
jmp 0x14000922d
test edx, edx
jne 0x140009157
mov eax, dword [rbp + 0x58]
lea r14, [rbp - 0x70]
mov dword [rbp - 0x70], eax
movsxd rax, ebx
mov dword [rbp - 0x6c], esi
lea rax, [rax + rax*8]
add rax, rax
mov rax, qword [rbp + rax*8 + 0x88]
mov qword [rbp - 0x68], rax
jmp 0x140009160
test edx, edx
jne 0x140009395
movsxd rax, ebx
lea rcx, [rax + rax*8]
add rcx, rcx
mov byte [rbp + rcx*8 + 0xa0], 0xef
mov edx, dword [rbp + 0x50]
inc ebx
cmp ebx, dword [rbp + 0x54]
jl 0x140009130
inc edi
mov eax, r15d
cmp edi, 8
jle 0x140009040
test eax, eax
jns 0x140009231
lea rcx, str.No_partition_to_toggle
call fcn.14004f2f0
jmp 0x140009655
mov qword [rsp + 0x38], rsi
xor r9d, r9d
mov qword [rsp + 0x30], rsi
xor r8d, r8d
mov dword [rsp + 0x28], esi
mov edx, 0x70140
mov rcx, r13
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x140009406
call fcn.14004fba0
mov rdx, rax
lea rcx, str.Could_not_refresh_drive_layout:__s
call fcn.14004f2f0
test r12d, r12d
je 0x140009563
movzx eax, bl
lea r9, str.ToggleEsp_02u
mov edx, 0x10
mov dword [rsp + 0x20], eax
mov r8, 0xffffffffffffffff
lea rcx, [rbp - 0x38]
call fcn.140004fd0
cmp qword [0x14019f580], rsi
lea rcx, [rbp - 0x38]
mov byte [rbp - 0x29], sil
je 0x140009459
lea rdx, [0x1401564ce]
call fcn.140026fa0
mov esi, 1
jmp 0x140009655
mov edx, 0x5c
mov qword [rbp - 0x80], rsi
mov qword [rbp - 0x70], rsi
call fcn.1400b41b4
test rax, rax
je 0x140009489
mov r8d, 0x91
lea rdx, str.D:_a_rufus_rufus_src_registry.h
lea rcx, str.strchr_key_name_____NULL
call fcn.1400fbe54
mov edx, 0x5c
lea rcx, [rbp - 0x38]
call fcn.1400b41b4
test rax, rax
jne 0x140009638
lea rax, [rbp - 0x80]
mov r9d, 0x2001d
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1400094cb
mov qword [rbp - 0x80], rsi
jmp 0x140009546
mov rcx, qword [rbp - 0x80]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x40], rax
lea rdx, str.SOFTWAREAkeo_ConsultingRufus
lea rax, [rbp - 0x70]
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 7
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x140009510
mov qword [rbp - 0x70], rsi
jmp 0x140009537
mov rcx, qword [rbp - 0x70]
lea rax, [0x1401564ce]
mov dword [rsp + 0x28], esi
lea rdx, [rbp - 0x38]
mov r9d, 1
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x140009546
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x140009638
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, 1
jmp 0x140009655
movzx edi, byte [rsp + 0x74]
lea rdx, [rbp - 0x20]
mov ecx, 0x69
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
test eax, eax
jne 0x140009599
call fcn.14004fba0
mov rdx, rax
lea rcx, str.GetLogicalDriveStrings_failed:__s
call fcn.14004f2f0
mov esi, 1
jmp 0x140009655
cmp eax, 0x69
jbe 0x1400095bc
mov r8d, 0x69
lea rcx, str.GetLogicalDriveStrings:_Buffer_too_small__required__lu_vs.__zu_
mov edx, eax
call fcn.14004f2f0
mov esi, 1
jmp 0x140009655
movzx eax, byte [rbp - 0x20]
lea rbx, [rbp - 0x20]
test al, al
je 0x1400095fc
movsx ecx, al
call fcn.1400fc5e0
cmp dil, al
je 0x140009638
test rbx, rbx
jne 0x1400095df
mov rax, rsi
jmp 0x1400095ef
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rbx + rax], sil
jne 0x1400095e6
inc rbx
add rbx, rax
movzx eax, byte [rbx]
test al, al
jne 0x1400095c8
mov ecx, dword [rsp + 0x78]
xor r9d, r9d
movsxd rax, r15d
mov r8d, 1
lea rdx, [rax + rax*8]
add rdx, rdx
mov rdx, qword [rbp + rdx*8 + 0x88]
call fcn.140006090
mov rdx, rax
lea rcx, [rsp + 0x74]
mov rbx, rax
call fcn.14000aad0
mov rcx, rbx
call fcn.1400e8c70
mov esi, 1
jmp 0x140009655
call fcn.14004fba0
mov r8, rax
lea rcx, str.Could_not_get_layout_for_drive_0x_02x:__s
mov edx, edi
call fcn.14004f2f0
test r13, r13
je 0x140009663
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov rbx, qword [rsp + 0x1398]
mov r13, qword [rsp + 0x13a0]
mov rcx, qword [rbp + 0x1250]
xor rcx, rsp
call fcn.1400b2a30
mov rsi, qword [rsp + 0x13a8]
add rsp, 0x1360
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret