Function at 0x4377af
Capabilities:
Check mutex on windows
Copy file
Delete file
Get common file path
Get session user name
Identify system language via api
Log keystrokes via polling
Move file
Parse pe header
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
xor edi, edi
push esi
xor esi, esi
push ebx
xor ebx, ebx
sub esp, 0x52c
mov dword [ebp - 0x4e4], ebx
mov dword [ebp - 0x4e0], ebx
mov dword [ebp - 0x4dc], ebx
call dword [sym.imp.KERNEL32.DLL_GetUserDefaultUILanguage]
mov dword [ebp - 0x11c], esi
mov dword [ebp - 0x4d8], 1
movzx eax, ax
mov dword [ebp - 0x4fc], eax
lea eax, [ebp - 0x11c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], edi
mov dword [esp + 4], str.SoftwareMicrosoftVisualStudio
mov dword [esp], 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov eax, dword [ebp - 0x11c]
sub esp, 0x14
test eax, eax
je 0x437834
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
xor eax, eax
lea edi, [ebp - 0x324]
mov ecx, 0x41
xor ebx, ebx
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x220]
mov ecx, 0x41
mov esi, 0x48fae0
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x11c]
mov ecx, 0x41
mov dword [ebp - 0x4d0], ebx
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x4a4]
mov ecx, 0x20
mov dword [ebp - 0x4cc], 4
rep movsd dword es:[edi], dword [esi]
mov byte [ebp - 0x4e5], 0
mov word [ebp - 0x4e7], 0x6272
mov dword [esp], 0x4a22f4
call dword [sym.imp.KERNEL32.DLL_SetDllDirectoryA]
push esi
mov dword [esp], 0x4a3a00
call dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
push edi
mov dword [esp + 4], str.SetDefaultDllDirectories
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push edx
push edx
test eax, eax
je 0x4378ce
mov dword [esp], 0x800
call eax
push ecx
mov dword [esp], str._Rufus_7_init__n
call fcn.0043d9e0
lea eax, [ebp - 0x4cc]
mov dword [esp + 4], eax
lea eax, [ebp - 0x4d0]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
push edx
push edx
test eax, eax
je 0x437908
xor eax, eax
cmp dword [ebp - 0x4d0], 0x6c696e
sete al
mov dword [0x52412c], eax
xor eax, eax
mov dword [0x524144], eax
mov dword [esp + 4], 2
mov dword [esp], 0x104
call sub.msvcrt.dll_calloc
mov edi, eax
test eax, eax
jne 0x437941
mov dword [esp], 0xe
call dword [sym.imp.KERNEL32.DLL_SetLastError]
push eax
jmp 0x4379db
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 8], 0x104
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
sub esp, 0xc
mov ebx, eax
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov esi, eax
test ebx, ebx
je 0x4379c5
dec ebx
test ebx, ebx
je 0x43797b
cmp word [edi + ebx*2], 0x5c
jne 0x437969
mov word [edi + ebx*2], 0
xor eax, eax
mov dword [esp + 0x14], 0x104
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0x10], 0x523e80
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], edi
mov dword [esp + 4], eax
mov dword [esp], 0xfde9
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
sub esp, 0x20
mov ebx, eax
test eax, eax
jne 0x4379c5
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov esi, eax
mov dword [esp], edi
call sub.msvcrt.dll_free
mov dword [esp], esi
call dword [sym.imp.KERNEL32.DLL_SetLastError]
push esi
test ebx, ebx
jne 0x437a0d
call fcn.0043df77
mov dword [esp], str.Could_not_get_application_directory:__s
mov dword [esp + 4], eax
call fcn.0043d9e0
mov ecx, 0x4a3a71
mov edx, 0x104
mov dword [esp], 3
mov eax, 0x523e80
call fcn.0042cf04
jmp 0x437a32
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], 0x4a3a74
mov dword [esp + 4], 0x104
mov dword [esp], 0x523e80
call dword [sym.imp.msvcrt.dll_strncat_s]
mov ecx, 0x4a3a71
mov edx, 0x104
mov eax, 0x5237c0
mov dword [esp], 3
call fcn.0042cf04
mov ecx, 3
mov edx, 0x80000000
mov dword [esp], 0x2000000
mov eax, 0x5237c0
call fcn.0042f089
mov ebx, eax
cmp eax, 0xffffffff
jne 0x437aac
call fcn.0043df77
mov dword [esp + 4], 0x5237c0
mov dword [esp + 8], eax
mov dword [esp], str.Could_not_get_current_directory_from__s:__s
call fcn.0043d9e0
mov ecx, 0x4a3a71
mov edx, 0x104
mov dword [esp], 3
mov eax, 0x5237c0
call fcn.0042cf04
jmp 0x437b3d
mov edx, 0x5237c0
call fcn.0042ee0b
test eax, eax
je 0x437a6f
mov dword [esp + 4], 0x4a3aa4
mov dword [esp], 0x5237c0
call sub.msvcrt.dll_strstr
cmp eax, 0x5237c0
je 0x437af4
mov dword [esp + 4], 0x4a3aa9
mov dword [esp], 0x5237c0
call sub.msvcrt.dll_strstr
cmp eax, 0x5237c0
jne 0x437a6f
mov dword [esp], 0x5237c4
call sub.msvcrt.dll_strlen
mov ecx, 0x5237c4
mov edx, 0x104
inc eax
mov dword [esp], eax
mov eax, 0x5237c0
call fcn.0042cf04
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], 0x4a3a74
mov dword [esp + 4], 0x104
mov dword [esp], 0x5237c0
call dword [sym.imp.msvcrt.dll_strncat_s]
lea eax, [ebx - 1]
cmp eax, 0xfffffffd
ja 0x437b4f
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push ecx
mov dword [esp + 4], 2
mov dword [esp], 0x104
call sub.msvcrt.dll_calloc
mov dword [esp], 0x104
mov dword [esp + 4], eax
mov edi, eax
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
mov ebx, eax
mov eax, dword [sym.imp.KERNEL32.DLL_GetLastError]
push edx
push edx
mov dword [ebp - 0x4ec], eax
call eax
mov esi, eax
test ebx, ebx
je 0x437bd9
xor eax, eax
mov dword [esp + 0x14], 0x104
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0x10], 0x523c40
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], edi
mov dword [esp + 4], eax
mov dword [esp], 0xfde9
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
sub esp, 0x20
mov ebx, eax
test eax, eax
jne 0x437bd9
mov eax, dword [ebp - 0x4ec]
call eax
mov esi, eax
test edi, edi
je 0x437be5
mov dword [esp], edi
call sub.msvcrt.dll_free
mov dword [esp], esi
call dword [sym.imp.KERNEL32.DLL_SetLastError]
push esi
test ebx, ebx
jne 0x437c31
call fcn.0043df77
mov dword [esp], str.Could_not_get_temp_directory:__s
mov dword [esp + 4], eax
call fcn.0043d9e0
mov dword [esp], 0x5237c0
call sub.msvcrt.dll_strlen
mov ecx, 0x5237c0
mov edx, 0x104
inc eax
mov dword [esp], eax
mov eax, 0x523c40
call fcn.0042cf04
jmp 0x437d3c
mov ecx, 3
mov edx, 0x80000000
mov eax, 0x523c40
mov dword [esp], 0x2000000
call fcn.0042f089
mov ebx, eax
cmp eax, 0xffffffff
jne 0x437c99
call fcn.0043df77
mov dword [esp + 4], 0x523c40
mov dword [esp + 8], eax
mov dword [esp], str.Could_not_get_actual_temp_directory_from__s:__s
call fcn.0043d9e0
mov dword [esp], 0x5237c0
call sub.msvcrt.dll_strlen
mov ecx, 0x5237c0
mov edx, 0x104
inc eax
mov dword [esp], eax
mov eax, 0x523c40
call fcn.0042cf04
jmp 0x437d2a
mov edx, 0x523c40
call fcn.0042ee0b
test eax, eax
je 0x437c53
mov dword [esp + 4], 0x4a3aa4
mov dword [esp], 0x523c40
call sub.msvcrt.dll_strstr
cmp eax, 0x523c40
je 0x437ce1
mov dword [esp + 4], 0x4a3aa9
mov dword [esp], 0x523c40
call sub.msvcrt.dll_strstr
cmp eax, 0x523c40
jne 0x437c53
mov dword [esp], 0x523c44
call sub.msvcrt.dll_strlen
mov ecx, 0x523c44
mov edx, 0x104
inc eax
mov dword [esp], eax
mov eax, 0x523c40
call fcn.0042cf04
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], 0x4a3a74
mov dword [esp + 4], 0x104
mov dword [esp], 0x523c40
call dword [sym.imp.msvcrt.dll_strncat_s]
lea eax, [ebx - 1]
cmp eax, 0xfffffffd
ja 0x437d3c
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push ecx
mov dword [esp + 4], 2
mov dword [esp], 0x104
call sub.msvcrt.dll_calloc
mov dword [esp + 4], 0x104
mov dword [esp], eax
mov edi, eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
mov ebx, eax
mov eax, dword [sym.imp.KERNEL32.DLL_GetLastError]
push edx
push edx
mov dword [ebp - 0x4ec], eax
call eax
mov esi, eax
test ebx, ebx
je 0x437dc6
xor eax, eax
mov dword [esp + 0x14], 0x104
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0x10], 0x523d60
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], edi
mov dword [esp + 4], eax
mov dword [esp], 0xfde9
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
sub esp, 0x20
mov ebx, eax
test eax, eax
jne 0x437dc6
mov eax, dword [ebp - 0x4ec]
call eax
mov esi, eax
test edi, edi
je 0x437dd2
mov dword [esp], edi
call sub.msvcrt.dll_free
mov dword [esp], esi
call dword [sym.imp.KERNEL32.DLL_SetLastError]
push esi
test ebx, ebx
jne 0x437e10
call fcn.0043df77
mov dword [esp], str.Could_not_get_system_directory:__s
mov dword [esp + 4], eax
call fcn.0043d9e0
mov ecx, str.C:WindowsSystem32
mov edx, 0x104
mov dword [esp], 0x14
mov eax, 0x523d60
call fcn.0042cf04
mov edx, 0x1c
mov eax, 0x523a00
call fcn.0042efbd
test eax, eax
jne 0x437e5c
call fcn.0043df77
mov dword [esp], str.Could_not_get_app_data_directory:__s
mov dword [esp + 4], eax
call fcn.0043d9e0
mov dword [esp], 0x523c40
call sub.msvcrt.dll_strlen
mov ecx, 0x523c40
mov edx, 0x104
inc eax
mov dword [esp], eax
mov eax, 0x523a00
call fcn.0042cf04
mov edx, 0x28
mov eax, 0x5238e0
call fcn.0042efbd
test eax, eax
jne 0x437ea8
call fcn.0043df77
mov dword [esp], str.Could_not_get_user_directory:__s
mov dword [esp + 4], eax
call fcn.0043d9e0
mov dword [esp], 0x523c40
call sub.msvcrt.dll_strlen
mov ecx, 0x523c40
mov edx, 0x104
inc eax
mov dword [esp], eax
mov eax, 0x5238e0
call fcn.0042cf04
mov dword [esp], 0x523d60
call sub.msvcrt.dll_strlen
mov edx, 0x104
mov ecx, 0x523d60
inc eax
mov dword [esp], eax
mov eax, 0x523b20
call fcn.0042cf04
xor ecx, ecx
mov dword [ebp - 0x424], ecx
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
lea edx, [ebp - 0x424]
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_IsWow64Process]
push ebx
push ebx
cmp dword [ebp - 0x424], 0
je 0x437ff5
mov dword [esp + 4], 2
mov dword [esp], 0x104
call sub.msvcrt.dll_calloc
mov dword [esp + 4], 0x104
mov dword [esp], eax
mov edi, eax
call dword [sym.imp.KERNEL32.DLL_GetSystemWindowsDirectoryW]
mov ebx, eax
mov eax, dword [sym.imp.KERNEL32.DLL_GetLastError]
push edx
push edx
mov dword [ebp - 0x4ec], eax
call eax
mov esi, eax
test ebx, ebx
je 0x437f86
xor eax, eax
mov dword [esp + 0x14], 0x104
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0x10], 0x523b20
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], edi
mov dword [esp + 4], eax
mov dword [esp], 0xfde9
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
sub esp, 0x20
mov ebx, eax
test eax, eax
jne 0x437f86
mov eax, dword [ebp - 0x4ec]
call eax
mov esi, eax
test edi, edi
je 0x437f92
mov dword [esp], edi
call sub.msvcrt.dll_free
mov dword [esp], esi
call dword [sym.imp.KERNEL32.DLL_SetLastError]
push esi
test ebx, ebx
jne 0x437fd0
call fcn.0043df77
mov dword [esp], str.Could_not_get_Windows_directory:__s
mov dword [esp + 4], eax
call fcn.0043d9e0
mov ecx, str.C:Windows
mov edx, 0x104
mov dword [esp], 0xb
mov eax, 0x523b20
call fcn.0042cf04
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], str.Sysnative
mov dword [esp + 4], 0x104
mov dword [esp], 0x523b20
call dword [sym.imp.msvcrt.dll_strncat_s]
mov dword [esp + 4], 0x5237c0
lea ebx, [ebp - 0x324]
mov dword [esp], str.Cur_dir:__s
call fcn.0043d9e0
mov dword [esp + 4], 0x523e80
mov dword [esp], str.App_dir:__s
call fcn.0043d9e0
mov dword [esp + 4], 0x523b20
mov dword [esp], str.Sys_dir:__s
call fcn.0043d9e0
mov dword [esp + 4], 0x5238e0
mov dword [esp], str.Usr_dir:__s
call fcn.0043d9e0
mov dword [esp + 4], 0x523a00
mov dword [esp], str.Dat_dir:__s
call fcn.0043d9e0
mov dword [esp + 4], 0x523c40
mov dword [esp], str.Tmp_dir:__s
call fcn.0043d9e0
mov dword [esp + 0x10], 0x523e80
mov dword [esp + 0xc], str._srufus.app
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], 0x104
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll__snprintf_s]
mov eax, ebx
mov byte [ebp - 0x221], 0
call fcn.0042f05a
mov dword [ebp - 0x504], eax
test eax, eax
je 0x4380e3
mov dword [0x5240d0], 1
xor ecx, ecx
mov dword [ebp - 0x4f4], ecx
mov dword [ebp - 0x4f0], ecx
mov dword [ebp - 0x4ec], ecx
mov dword [ebp - 0x500], ecx
mov dword [ebp - 0x4f8], ecx
jmp 0x438911
cmp dword [0x524840], 0
jne 0x43810e
mov eax, str.Msvcrt
call fcn.0042cf92
mov dword [esp + 4], str.__wgetmainargs
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push edx
push edx
mov dword [0x524840], eax
mov eax, dword [0x524840]
test eax, eax
je 0x438900
lea edx, [ebp - 0x4dc]
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], edx
lea edx, [ebp - 0x4c8]
mov dword [esp + 8], edx
lea edx, [ebp - 0x4c4]
mov dword [esp + 4], edx
lea edx, [ebp - 0x4e0]
mov dword [esp], edx
call eax
mov dword [esp + 4], 4
mov eax, dword [ebp - 0x4e0]
mov dword [esp], eax
call sub.msvcrt.dll_calloc
mov dword [ebp - 0x4f0], eax
test eax, eax
jne 0x438244
xor edi, edi
mov dword [ebp - 0x500], edi
mov dword [ebp - 0x4f8], edi
mov dword [ebp - 0x4f4], edi
mov dword [ebp - 0x4f0], edi
jmp 0x438237
inc esi
cmp dword [ebp - 0x4e0], esi
jle 0x43825c
mov eax, dword [ebp - 0x4c4]
mov eax, dword [eax + esi*4]
call fcn.0042dfd9
mov edi, eax
mov eax, dword [ebp - 0x4f0]
mov dword [eax + esi*4], edi
mov dword [esp + 4], 0x4a3c2e
mov dword [esp], edi
call sub.msvcrt.dll_strcmp
test eax, eax
mov eax, 0x96
cmovne eax, dword [ebp - 0x4f8]
mov dword [ebp - 0x4f8], eax
mov dword [esp + 4], 0x4a3c31
mov dword [esp], edi
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x438255
mov dword [esp + 4], str.__gui
mov dword [esp], edi
call sub.msvcrt.dll_strcmp
test eax, eax
mov eax, 1
cmove ebx, eax
mov dword [esp + 4], str._InvokerPRAID
mov dword [esp], edi
call sub.msvcrt.dll__stricmp_1
mov dword [ebp - 0x500], eax
test eax, eax
jne 0x43818f
mov dword [0x5240d0], 1
xor esi, esi
mov dword [ebp - 0x4f4], esi
xor ebx, ebx
mov dword [ebp - 0x4ec], ebx
jmp 0x438911
xor ecx, ecx
xor ebx, ebx
xor esi, esi
mov dword [ebp - 0x4f8], ecx
jmp 0x438190
mov ebx, 1
jmp 0x438207
mov eax, dword [ebp - 0x4f0]
mov edi, dword [eax]
mov dword [esp], edi
call sub.msvcrt.dll_strlen
lea esi, [edi + eax - 1]
cmp edi, esi
jae 0x43827c
cmp byte [esi], 0x5c
je 0x43827c
dec esi
jmp 0x438270
mov dword [esp + 4], 0x70
mov dword [esp], esi
call sub.msvcrt.dll_strchr
test eax, eax
jne 0x4382aa
mov dword [esp + 4], 0x50
mov dword [esp], esi
call sub.msvcrt.dll_strchr
test eax, eax
je 0x4382b1
cmp byte [eax + 1], 0x48
je 0x4382b1
mov byte [ebp - 0x4e7], 0x61
test ebx, ebx
jne 0x4384cb
mov dword [esp], 0xffffffff
call dword [sym.imp.KERNEL32.DLL_AttachConsole]
push edx
test eax, eax
je 0x4384cb
mov dword [esp], str.Enabling_console_line_hogger
call fcn.0043d9e0
xor eax, eax
mov esi, dword [fcn.00487040]
mov dword [esp], eax
call esi
mov dword [esp + 4], 0x4a3c65
mov dword [esp + 8], eax
mov dword [esp], str.CONIN_
call sub.msvcrt.dll_freopen
mov dword [esp], 1
call esi
mov dword [esp + 4], 0x4a3c6e
mov dword [esp + 8], eax
mov dword [esp], str.CONOUT_
call sub.msvcrt.dll_freopen
mov dword [esp], 2
call esi
mov dword [esp + 4], 0x4a3c6e
mov dword [esp + 8], eax
mov dword [esp], str.CONOUT_
call sub.msvcrt.dll_freopen
call dword [sym.imp.msvcrt.dll__flushall]
xor eax, eax
mov dword [esp + 0xc], str.rufus.com
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x4c0]
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0xa
mov dword [esp + 4], 0x1f5
mov eax, dword [0x5241b8]
mov dword [esp], eax
call fcn.0043c5a4
mov dword [ebp - 0x4f4], eax
test eax, eax
je 0x4384bf
xor ecx, ecx
mov dword [esp + 8], 0x4a3c82
xor edi, edi
mov dword [esp], ecx
mov dword [esp + 4], 1
call dword [sym.imp.KERNEL32.DLL_CreateMutexA]
sub esp, 0xc
mov esi, eax
xor eax, eax
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], eax
mov dword [esp + 8], 1
mov dword [esp + 4], 0xc0000000
mov dword [esp], str.rufus.com
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
sub esp, 0x1c
mov edi, eax
cmp eax, 0xffffffff
je 0x438430
xor edx, edx
lea eax, [ebp - 0x424]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x4c0]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x4f4]
mov dword [esp], edi
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
lea eax, [edi - 1]
sub esp, 0x14
cmp eax, 0xfffffffd
ja 0x438430
mov dword [esp], edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push eax
mov dword [esp + 4], 0x1c
mov dword [esp], 0xa
call sub.msvcrt.dll_calloc
mov edi, eax
test eax, eax
je 0x4384a3
movsx dx, byte [ebx + str.rufus.com]
inc ebx
mov dword [eax], 1
add eax, 0x1c
mov dword [eax - 0x14], 4
mov word [eax - 0x16], dx
cmp ebx, 9
jne 0x43844a
mov dword [edi + 0xfc], 1
mov word [edi + 0x100], 0xd
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edi
mov dword [esp], 0xa
call dword [sym.imp.USER32.dll_SendInput]
sub esp, 0xc
mov dword [esp], edi
call sub.msvcrt.dll_free
test esi, esi
jne 0x4384af
mov dword [ebp - 0x4f4], esi
jmp 0x4384bf
mov dword [esp], 0xc8
call dword [sym.imp.KERNEL32.DLL_Sleep]
push eax
jmp 0x4384a7
mov dword [ebp - 0x500], 1
jmp 0x4384d9
xor eax, eax
mov dword [ebp - 0x500], eax
mov dword [ebp - 0x4f4], eax
xor eax, eax
xor edi, edi
mov dword [ebp - 0x4ec], eax
lea eax, [ebp - 0x4e4]
mov dword [esp + 8], str.ghxf:i:l:w:z:
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x4a4]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x4f0]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x4e0]
mov dword [esp], eax
call fcn.00486440
cmp eax, 0xffffffff
je 0x4388cc
sub eax, 0x61
cmp eax, 0x19
ja case.0x43852c.98
jmp dword [eax*4 + 0x4a463c]
mov dword [0x524128], 1
jmp case.0x43852c.97
mov eax, dword [0x522ec8]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov dword [esp + 4], 0x104
mov dword [esp], 1
call sub.msvcrt.dll_calloc
test eax, eax
mov dword [0x522ec8], eax
mov dword [ebp - 0x514], eax
je case.0x43852c.97
mov eax, dword [0x5298dc]
call fcn.0042d0e3
mov dword [esp + 4], 2
mov dword [esp], 0x104
mov ebx, eax
call sub.msvcrt.dll_calloc
mov dword [esp + 4], 0x104
mov esi, eax
lea eax, [ebp - 0x424]
mov dword [esp], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 8], esi
call dword [sym.imp.KERNEL32.DLL_GetFullPathNameW]
mov dword [ebp - 0x510], eax
mov eax, dword [sym.imp.KERNEL32.DLL_GetLastError]
sub esp, 0x10
mov dword [ebp - 0x50c], eax
call eax
mov ecx, dword [ebp - 0x510]
mov edx, dword [ebp - 0x514]
mov dword [ebp - 0x508], eax
test ecx, ecx
je 0x43862a
xor eax, eax
mov dword [esp + 0x14], 0x104
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], esi
mov dword [esp + 4], eax
mov dword [esp], 0xfde9
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
sub esp, 0x20
test eax, eax
jne 0x43862a
mov eax, dword [ebp - 0x50c]
call eax
mov dword [ebp - 0x508], eax
test esi, esi
je 0x438636
mov dword [esp], esi
call sub.msvcrt.dll_free
test ebx, ebx
je 0x438642
mov dword [esp], ebx
call sub.msvcrt.dll_free
mov eax, dword [ebp - 0x508]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_SetLastError]
push eax
mov eax, dword [0x522ec8]
call fcn.0042df6a
test al, 0x10
je 0x43868f
mov eax, dword [0x522ec8]
mov dword [esp], str.Could_not_find_image__s_n
xor esi, esi
mov dword [esp + 4], eax
call sub.msvcrt.dll_printf
mov eax, dword [0x522ec8]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov dword [0x522ec8], esi
jmp case.0x43852c.97
mov dword [0x524a00], 1
jmp case.0x43852c.97
mov edx, dword [0x5298dc]
movzx eax, byte [edx]
sub eax, 0x30
cmp eax, 9
ja 0x4386cc
xor ebx, ebx
mov dword [esp], edx
mov dword [esp + 8], ebx
mov dword [esp + 4], ebx
call sub.msvcrt.dll_strtol
mov dword [ebp - 0x4fc], eax
jmp case.0x43852c.97
mov eax, dword [ebp - 0x4ec]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [0x5298dc]
mov dword [ebp - 0x4ec], eax
test eax, eax
je case.0x43852c.97
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__strdup]
mov dword [ebp - 0x4ec], eax
jmp case.0x43852c.97
mov edx, dword [0x5298dc]
movzx eax, byte [edx]
sub eax, 0x30
cmp eax, 9
ja 0x43872b
xor ecx, ecx
mov dword [esp], edx
mov dword [esp + 8], ecx
mov dword [esp + 4], ecx
call sub.msvcrt.dll_strtol
mov dword [0x48fbe0], eax
jmp 0x43876a
xor ebx, ebx
mov edx, dword [ebx*4 + 0x489da0]
test edx, edx
jne 0x43873d
mov edx, 0x4a21ff
mov eax, dword [0x5298dc]
test eax, eax
jne 0x43874b
mov eax, 0x4a21ff
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__stricmp]
test eax, eax
jne 0x438764
mov dword [0x48fbe0], ebx
jmp 0x43876a
inc ebx
cmp ebx, 9
jne 0x43872d
mov eax, dword [0x48fbe0]
inc eax
cmp eax, 9
jbe 0x43877f
mov dword [0x48fbe0], 0xffffffff
mov eax, dword [0x48fbe0]
mov dword [0x48fbe4], eax
jmp case.0x43852c.97
mov eax, dword [0x5298dc]
mov dword [esp], eax
call sub.msvcrt.dll_atoi
mov dword [ebp - 0x4f8], eax
jmp case.0x43852c.97
xor eax, eax
lea ebx, [ebp - 0x424]
mov dword [esp + 0x10], eax
xor eax, eax
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x4f0]
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__splitpath]
mov dword [esp + 4], ebx
mov dword [esp], str._nUsage:__s___x____g____h____f_FILESYSTEM____i_PATH____l_LOCALE____w_TIMEOUT__n
call sub.msvcrt.dll_printf
mov dword [esp], str.___x____extra_devs
call sub.msvcrt.dll_puts
mov dword [esp], str._____List_extra_devices__such_as_USB_HDDs
call sub.msvcrt.dll_puts
mov dword [esp], str.___g____gui
call sub.msvcrt.dll_puts
mov dword [esp], str._____Start_in_GUI_mode__disable_the_rufus.com_commandline_hogger_
call sub.msvcrt.dll_puts
mov dword [esp], str.___i_PATH____isoPATH
call sub.msvcrt.dll_puts
mov dword [esp], str._____Select_the_ISO_image_pointed_by_PATH_to_be_used_on_startup
call sub.msvcrt.dll_puts
mov dword [esp], str.___l_LOCALE____localeLOCALE
call sub.msvcrt.dll_puts
mov dword [esp], str._____Select_the_locale_to_be_used_on_startup
call sub.msvcrt.dll_puts
mov dword [esp], str.___f_FILESYSTEM____filesystemFILESYSTEM
call sub.msvcrt.dll_puts
mov dword [esp], str._____Preselect_the_file_system_to_be_preferred_when_formatting
call sub.msvcrt.dll_puts
mov dword [esp], str.___w_TIMEOUT____waitTIMEOUT
call sub.msvcrt.dll_puts
mov dword [esp], str._____Wait_TIMEOUT_tens_of_seconds_for_the_global_application_mutex_to_be_released.
call sub.msvcrt.dll_puts
mov dword [esp], str._____Used_when_launching_a_newer_version_of_Rufus_7_from_a_running_application.
call sub.msvcrt.dll_puts
mov dword [esp], str.___h____help
call sub.msvcrt.dll_puts
mov dword [esp], str._____This_usage_guide.
call sub.msvcrt.dll_puts
xor edx, edx
mov dword [ebp - 0x4fc], edx
jmp 0x438f3b
xor eax, eax
mov dword [esp + 8], 0x10
mov dword [esp + 4], eax
mov eax, dword [0x5298dc]
mov dword [esp], eax
call sub.msvcrt.dll_strtol
jmp case.0x43852c.97
mov edi, 1
jmp case.0x43852c.97
test edi, edi
je 0x438911
mov dword [esp], str.Command_line_arguments:
call fcn.0043d9e0
cmp dword [ebp - 0x4e0], edi
jle 0x438911
mov eax, dword [ebp - 0x4f0]
mov eax, dword [eax + edi*4]
mov dword [esp], 0x4a2206
inc edi
mov dword [esp + 4], eax
call fcn.0043d9e0
jmp 0x4388dc
mov dword [esp], str.Could_not_access_UTF_16_args
call fcn.0043d9e0
jmp 0x438170
cmp dword [0x5240d0], 0
je 0x438926
mov dword [esp], str.AppStore_version_detected
call fcn.0043d9e0
lea esi, [ebp - 0x11c]
xor edi, edi
mov dword [esp + 0x10], 0x523e80
mov dword [esp + 0xc], str._srufus_7.ini
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], 0x104
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__snprintf_s]
lea edx, [ebp - 0x4e7]
mov eax, esi
mov byte [ebp - 0x19], 0
call fcn.0042edb6
mov dword [esp + 8], edi
mov dword [esp + 4], edi
mov ebx, eax
mov dword [esp], edi
call fcn.00428ce6
test ebx, ebx
je 0x4389b0
mov dword [0x522ecc], esi
mov dword [esp], 0x523e80
call sub.msvcrt.dll_strlen
mov ecx, 0x523e80
mov edx, 0x104
inc eax
mov dword [esp], eax
mov eax, 0x523a00
call fcn.0042cf04
mov dword [esp], ebx
call sub.msvcrt.dll_fclose
cmp dword [0x522ecc], 0
mov edx, str.INI_file
mov eax, str.registry
mov dword [esp], str.Will_use_settings_from__s
cmovne eax, edx
mov dword [esp + 4], eax
call fcn.0043d9e0
mov eax, str.Locale
call fcn.0042f9eb
cmp byte [eax], 0
je 0x438a02
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__strdup]
mov dword [ebp - 0x4ec], eax
mov dword [esp + 4], eax
mov dword [esp], str.found_locale__s
call fcn.0043d9e0
mov eax, str.ShowAdvancedDriveProperties
call fcn.0042fa9d
mov dword [0x52411c], eax
mov eax, str.ShowAdvancedFormatOptions
call fcn.0042fa9d
mov dword [0x524118], eax
mov eax, str.PreserveTimestamps
call fcn.0042fa9d
mov dword [0x5240fc], eax
mov eax, str.UseProperSizeUnits
call fcn.0042fa9d
test eax, eax
sete al
xor ebx, ebx
movzx eax, al
mov dword [0x524100], eax
mov dword [esp], ebx
call fcn.00408bf3
mov dword [0x48fbb0], eax
mov eax, str.UseVds
call fcn.0042fa9d
test eax, eax
je 0x438a6f
xor eax, eax
cmp dword [0x48fbb0], 0
setne al
mov dword [0x5240d8], eax
mov eax, str.EnableUsbDebug
call fcn.0042fa9d
cmp eax, 1
mov dword [0x524104], eax
sbb eax, eax
and eax, 2
inc eax
mov dword [0x4911c4], eax
mov eax, str.DisableRufusMBR
call fcn.0042fa9d
test eax, eax
sete al
movzx eax, al
mov dword [0x48fbac], eax
mov eax, str.DisableFakeDrivesCheck
call fcn.0042fa9d
test eax, eax
sete al
movzx eax, al
mov dword [0x524110], eax
mov eax, str.EnableWindowsDualUefiBiosMode
call fcn.0042fa9d
mov dword [0x524114], eax
mov eax, str.ForceLargeFat32Formatting
call fcn.0042fa9d
mov dword [0x524108], eax
mov eax, str.EnableVmdkDetection
call fcn.0042fa9d
mov dword [0x52410c], eax
mov eax, str.EnableFileIndexing
call fcn.0042fa9d
mov dword [0x5240e8], eax
mov eax, str.DisableVHDs
call fcn.0042fa9d
test eax, eax
sete al
movzx eax, al
mov dword [0x48fbb4], eax
mov eax, str.EnableExtraHashes
call fcn.0042fa9d
mov dword [0x50ff44], eax
mov eax, str.ExpertMode
call fcn.0042fa9d
mov dword [0x5240c4], eax
mov eax, str.IgnoreBootMarker
call fcn.0042fa9d
mov dword [0x5240d4], eax
mov eax, str.PersistentLog
call fcn.0042fa9d
mov dword [0x5240cc], eax
mov eax, 0x4a4121
call fcn.0042f9eb
mov dword [0x522e38], eax
mov eax, str.WindowsUserExperienceOptions
call fcn.0042fac9
mov ecx, eax
mov edx, eax
shr ecx, 0x10
je 0x438b83
mov eax, ecx
and ecx, edx
not eax
and eax, dword [0x48fcc0]
or eax, ecx
mov dword [0x48fcc0], eax
mov eax, str.DefaultThreadPriority
xor edi, edi
call fcn.0042fac9
inc eax
mov dword [0x48fb9c], eax
mov dword [esp], edi
call dword [sym.imp.USER32.dll_GetDC]
push edx
mov ebx, eax
mov dword [esp + 4], 0x58
mov dword [esp], eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
fld dword [0x4a477c]
push ecx
push ecx
mov dword [ebp - 0x504], eax
lea eax, [ebx - 1]
fidivr dword [ebp - 0x504]
fstp dword [0x48fba8]
cmp eax, 0xfffffffd
ja 0x438be5
mov dword [esp + 4], ebx
xor ebx, ebx
mov dword [esp], ebx
call dword [sym.imp.USER32.dll_ReleaseDC]
push esi
push esi
xor ecx, ecx
lea ebx, [ebp - 0x220]
mov dword [esp], ecx
call fcn.00422b71
mov dword [esp + 0x14], str.rufus.loc
mov esi, dword [sym.imp.msvcrt.dll__snprintf_s]
mov dword [esp + 0x10], 0x523e80
mov dword [esp + 0xc], 0x4a4158
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], 0x104
mov dword [esp], ebx
call esi
mov eax, ebx
mov byte [ebp - 0x11d], 0
call fcn.0042df6a
inc eax
jne 0x438daf
mov dword [esp], str.loc_file_not_found_in_current_directory___embedded_one_will_be_used
call fcn.0043d9e0
xor edx, edx
lea eax, [ebp - 0x4d4]
mov dword [esp + 0xc], str.embedded.loc
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0xa
mov dword [esp + 4], 0x1f4
mov eax, dword [0x5241b8]
mov dword [esp], eax
call fcn.0043c5a4
mov esi, eax
mov eax, ebx
call fcn.0042eec9
test eax, eax
je 0x438c94
cmp byte [ebp - 0x220], 0
jne 0x438cc6
call fcn.0043df77
mov dword [esp], str.FATAL:_Unable_to_create_temp_loc_file:__s
mov dword [esp + 4], eax
call fcn.0043d9e0
mov dword [esp + 0xc], 0x1010
mov dword [esp + 8], str.Fatal_error
mov dword [esp + 4], str.Unable_to_create_temporary_localization_file._This_application_will_now_exit.
jmp 0x438d5e
mov dword [esp], pe_nt_image_headers32
mov ecx, 2
mov edx, 0xc0000000
mov eax, ebx
call fcn.0042f089
mov edi, eax
cmp eax, 0xffffffff
jne 0x438d18
call fcn.0043df77
mov dword [esp], str.FATAL:_Unable_to_extract_loc_file__s:__s
mov dword [esp + 8], eax
lea eax, [ebp - 0x220]
mov dword [esp + 4], eax
call fcn.0043d9e0
lea eax, [edi - 1]
cmp eax, 0xfffffffd
ja 0x438d46
mov dword [esp], edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push eax
jmp 0x438d46
lea eax, [ebp - 0x4cc]
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x4d4]
mov dword [esp + 4], esi
mov dword [esp + 8], eax
mov dword [esp], edi
call fcn.0043ebc0
test eax, eax
je 0x438ce5
jmp 0x438d81
mov dword [esp + 0xc], 0x1010
mov dword [esp + 8], str.Fatal_error
mov dword [esp + 4], str.Unable_to_extract_localization_file._This_application_will_now_exit.
xor eax, eax
xor esi, esi
mov dword [esp], eax
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
mov dword [ebp - 0x4fc], eax
sub esp, 0x10
mov dword [ebp - 0x504], eax
jmp 0x43a0e2
mov dword [esp + 4], ebx
mov dword [esp], str.localization:_extracted_data_to__s
call fcn.0043d9e0
lea eax, [edi - 1]
cmp eax, 0xfffffffd
jbe 0x438da3
xor eax, eax
mov dword [ebp - 0x504], eax
jmp 0x438e18
mov dword [esp], edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push eax
jmp 0x438d99
mov eax, dword [0x525ba0]
mov edx, 0xffc
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.Using_external_loc_file__s
sub edx, eax
add eax, 0x524ba0
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], edx
mov dword [esp], eax
call esi
mov byte [0x525b9b], 0
mov dword [esp], 0x524ba0
call sub.msvcrt.dll_strlen
mov dword [ebp - 0x504], 1
lea edx, [eax + 2]
mov byte [eax + 0x524ba0], 0xd
mov dword [0x525ba0], edx
mov byte [eax + 0x524ba1], 0xa
mov byte [eax + 0x524ba2], 0
lea eax, [ebp - 0x220]
mov dword [esp], eax
call fcn.00426651
test eax, eax
jne 0x438e63
mov dword [esp], str.FATAL:_Could_not_access_locale_
xor edi, edi
xor esi, esi
call fcn.0043d9e0
mov dword [esp + 0xc], 0x1010
mov dword [esp + 8], str.Fatal_error
mov dword [esp + 4], str.The_locale_data_is_missing_or_invalid._This_application_will_now_exit.
mov dword [esp], edi
call dword [sym.imp.USER32.dll_MessageBoxA]
sub esp, 0x10
jmp 0x43907c
cmp dword [ebp - 0x4ec], 0
mov dword [esp + 4], 1
jne 0x438e84
mov eax, dword [ebp - 0x4fc]
mov dword [esp], eax
call fcn.00423147
jmp 0x438e92
mov eax, dword [ebp - 0x4ec]
mov dword [esp], eax
call fcn.004231c3
mov dword [0x524184], eax
test eax, eax
je 0x438e2a
mov dword [esp], eax
call fcn.004234ca
mov word [0x48fbc0], ax
mov dword [esp], 0x524a20
call fcn.0043b3be
call fcn.0043d283
mov dword [ebp - 0x4fc], eax
test eax, eax
jne 0x438f42
mov dword [esp], str.FATAL:_No_administrative_privileges_
call fcn.0043d9e0
mov eax, dword [0x524184]
mov dword [esp + 4], eax
lea eax, [ebp - 0x220]
mov dword [esp], eax
call fcn.00426a81
mov eax, dword [0x524184]
movzx edi, word [0x48fbc0]
mov eax, dword [eax + 4]
and eax, 1
mov dword [0x524134], eax
cmp eax, 1
mov dword [esp], 0xcd8
sbb ebx, ebx
and ebx, 0xffe80000
add ebx, 0x181010
call fcn.00422df0
mov dword [esp], 0xcd9
mov esi, eax
call fcn.00422df0
mov dword [esp + 4], edi
mov ecx, esi
mov dword [esp], ebx
mov edx, eax
xor eax, eax
call fcn.0042deea
xor esi, esi
jmp 0x43a0e2
cmp dword [ebp + 0x10], 0
je 0x438f76
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
cmp eax, 2
jne 0x438f76
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0x2f
jne 0x438f76
cmp byte [eax + 1], 0x57
mov eax, 0x96
cmovne eax, dword [ebp - 0x4f8]
mov dword [ebp - 0x4f8], eax
xor esi, esi
mov dword [esp + 8], str.Global_Rufus_7
mov dword [esp], esi
mov dword [esp + 4], 1
call dword [sym.imp.KERNEL32.DLL_CreateMutexA]
sub esp, 0xc
mov esi, eax
cmp dword [ebp - 0x4f8], 0
jle 0x438fa5
test esi, esi
jne 0x438fab
jmp 0x439009
test esi, esi
jne 0x438ff8
jmp 0x439009
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xb7
jne 0x438ff8
mov dword [esp], esi
xor ebx, ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push edx
mov dword [esp], 0x64
call dword [sym.imp.KERNEL32.DLL_Sleep]
push ecx
mov dword [esp + 8], str.Global_Rufus_7
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.DLL_CreateMutexA]
dec dword [ebp - 0x4f8]
sub esp, 0xc
mov esi, eax
jmp 0x438f96
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xb7
jne 0x439089
mov eax, dword [0x524184]
mov dword [esp + 4], eax
lea eax, [ebp - 0x220]
mov dword [esp], eax
call fcn.00426a81
mov eax, dword [0x524184]
movzx edi, word [0x48fbc0]
mov eax, dword [eax + 4]
and eax, 1
mov dword [0x524134], eax
cmp eax, 1
mov dword [esp], 0xbb9
sbb ebx, ebx
and ebx, 0xffe80000
add ebx, 0x181010
call fcn.00422df0
mov dword [ebp - 0x4f8], eax
mov dword [esp], 0xbba
call fcn.00422df0
mov dword [esp + 4], edi
mov dword [esp], ebx
mov ecx, dword [ebp - 0x4f8]
mov edx, eax
xor eax, eax
call fcn.0042deea
xor eax, eax
mov dword [ebp - 0x4fc], eax
jmp 0x43a0e2
mov eax, dword [ebp + 8]
mov dword [0x5241b8], eax
xor eax, eax
mov dword [esp + 4], 6
mov dword [esp], eax
call dword [sym.imp.ole32.dll_CoInitializeEx]
push eax
push eax
mov eax, str.Riched20
call fcn.0042cf92
test eax, eax
jne 0x4390c9
call fcn.0043df77
mov dword [esp], str.Could_not_load_RichEdit_library___some_dialogs_may_not_display:__s
mov dword [esp + 4], eax
call fcn.0043d9e0
call fcn.0042bf4e
xor eax, eax
mov dword [esp + 0x10], 0x9e
mov dword [esp + 0xc], str.NoDriveTypeAutorun
mov dword [esp + 8], str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
mov dword [esp + 4], 0x524a08
mov dword [esp], eax
call fcn.0043ce72
mov dword [ebp - 0x4fc], eax
lea eax, [ebp - 0x4d8]
mov dword [esp], eax
call fcn.0040824a
test eax, eax
jne 0x439128
mov dword [esp], str.Could_not_get_AutoMount_status
call fcn.0043d9e0
mov dword [ebp - 0x4d8], 1
jmp 0x439159
cmp dword [ebp - 0x4d8], 0
jne 0x439159
mov dword [esp], str.AutoMount_was_detected_as_disabled___temporarily_re_enabling_it
call fcn.0043d9e0
mov dword [esp], 1
call fcn.004081b5
test eax, eax
jne 0x439159
mov dword [esp], str.Failed_to_enable_AutoMount
call fcn.0043d9e0
call fcn.004024cc
lea ebx, [ebp - 0x324]
mov dword [0x4df07c], eax
call fcn.004024e7
mov dword [0x4df078], eax
mov dword [esp], ebx
mov dword [esp + 0x10], 0x523b20
mov dword [esp + 0xc], str._sdismFfuProvider.dll
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], 0x104
call dword [sym.imp.msvcrt.dll__snprintf_s]
mov eax, ebx
mov byte [ebp - 0x221], 0
call fcn.0042d0e3
mov ebx, eax
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll__waccess]
mov edi, eax
test ebx, ebx
je 0x4391c9
mov dword [esp], ebx
call sub.msvcrt.dll_free
xor eax, eax
test edi, edi
sete al
xor edi, edi
xor ebx, ebx
mov dword [0x5240c8], eax
mov dword [ebp - 0x508], edi
mov dword [ebp - 0x4f8], edi
mov dword [ebp - 0x50c], edi
mov edx, dword [0x524184]
mov eax, dword [0x525ba0]
mov edx, dword [edx + 0x14]
mov dword [esp + 0xc], str.Localization_set_to__s
mov dword [esp + 8], 0xffffffff
mov dword [esp + 0x10], edx
mov edx, 0xffc
sub edx, eax
add eax, 0x524ba0
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__snprintf_s]
mov byte [0x525b9b], 0
mov dword [esp], 0x524ba0
call sub.msvcrt.dll_strlen
mov byte [0x48fbc2], 1
mov byte [eax + 0x524ba0], 0xd
lea edx, [eax + 2]
mov byte [eax + 0x524ba1], 0xa
mov byte [eax + 0x524ba2], 0
mov eax, dword [0x524184]
mov dword [0x525ba0], edx
xor edx, edx
mov eax, dword [eax + 4]
mov byte [0x522e40], 0
mov dword [0x5249ac], edx
and eax, 1
mov dword [0x524134], eax
mov dword [esp], eax
call dword [sym.imp.USER32.dll_SetProcessDefaultLayout]
push ecx
mov eax, dword [0x524184]
mov dword [esp + 4], eax
lea eax, [ebp - 0x220]
mov dword [esp], eax
call fcn.00426a81
test eax, eax
je 0x4392eb
mov eax, dword [0x524184]
mov edi, dword [eax + 0x14]
mov eax, dword [0x522ecc]
test eax, eax
je 0x4392c9
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov dword [esp], str.Locale
call fcn.00426fc7
jmp 0x4392eb
xor eax, eax
test edi, edi
je 0x4392d7
mov dword [esp], edi
call sub.msvcrt.dll_strlen
mov dword [esp], eax
mov ecx, edi
mov edx, 1
mov eax, str.Locale
call fcn.0042f691
test ebx, ebx
je 0x4392f9
mov dword [esp], ebx
call dword [sym.imp.USER32.dll_DestroyWindow]
push eax
xor eax, eax
mov dword [esp + 0xc], 0x4326c7
mov dword [esp + 8], eax
mov dword [esp + 4], 0x65
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00442c4a
mov ebx, eax
test eax, eax
jne 0x439357
cmp dword [0x524134], 1
movzx edx, word [0x48fbc0]
mov ecx, str.DialogBox_failure
sbb eax, eax
and eax, 0xffe80000
mov dword [esp + 4], edx
mov edx, str.Could_not_create_Window
add eax, 0x181010
mov dword [esp], eax
xor eax, eax
call fcn.0042deea
jmp 0x43a0e2
mov eax, dword [0x48fbd0]
cmp eax, 0xffff0001
jl 0x43939d
mov edx, dword [0x48fbd4]
cmp edx, 0xffff0001
jl 0x43939d
xor ecx, ecx
xor edi, edi
mov dword [esp + 0x18], 1
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov dword [esp], ebx
call dword [sym.imp.USER32.dll_SetWindowPos]
sub esp, 0x1c
xor edi, edi
mov dword [esp + 8], 1
mov dword [esp + 0xc], edi
mov edi, dword [sym.imp.USER32.dll_ChangeWindowMessageFilterEx]
mov dword [esp + 4], 0x233
mov dword [esp], ebx
call edi
xor eax, eax
sub esp, 0x10
mov dword [esp + 0xc], eax
mov dword [esp + 8], 1
mov dword [esp + 4], 0x4a
mov dword [esp], ebx
call edi
xor eax, eax
sub esp, 0x10
mov dword [esp + 0xc], eax
mov dword [esp + 8], 1
mov dword [esp + 4], 0x49
mov dword [esp], ebx
call edi
sub esp, 0x10
call fcn.00443f99
call fcn.00444143
test eax, eax
jne 0x439417
mov dword [esp], str.Warning:_Could_not_set_alert_prompt_hook
call fcn.0043d9e0
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.USER32.dll_ShowWindow]
push ecx
push ecx
mov dword [esp], ebx
call dword [sym.imp.USER32.dll_UpdateWindow]
push edi
xor ecx, ecx
lea eax, [ebp - 0x4c0]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ecx
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetMessageW]
sub esp, 0x10
test eax, eax
je 0x43a08e
xor edi, edi
cmp dword [ebp - 0x4bc], 0x104
jne 0x439481
xor eax, eax
test byte [ebp - 0x4b1], 0x20
sete al
cmp dword [ebp - 0x4b8], 0x12
mov edi, eax
jne 0x4394a6
mov dword [esp], 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
push edx
mov eax, 1
cmovns eax, dword [ebp - 0x4f8]
mov dword [ebp - 0x4f8], eax
jmp 0x4394b0
mov dword [ebp - 0x508], 1
mov eax, dword [0x524154]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
push ecx
test eax, eax
je 0x439508
mov dword [esp], 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
push edx
test ax, ax
jns 0x439508
cmp dword [ebp - 0x4bc], 0x100
jne 0x439508
cmp dword [ebp - 0x4b8], 0x41
jne 0x439508
xor ecx, ecx
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], ecx
mov dword [esp + 4], 0xb1
mov eax, dword [0x52415c]
jmp 0x439575
test edi, edi
je 0x43951f
cmp dword [ebp - 0x4b8], 0x11
jne 0x43951f
mov eax, dword [0x48fbb8]
mov dword [0x52483c], eax
cmp dword [0x52483c], 0
je 0x439554
cmp dword [ebp - 0x4b8], 0x4c
jne 0x439586
xor ecx, ecx
mov dword [0x52483c], ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], 0x41e
mov dword [esp + 4], 0x111
mov eax, dword [0x5241b4]
jmp 0x439575
mov dword [esp], 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
push edx
test ax, ax
jns 0x439586
cmp dword [ebp - 0x4bc], 0x100
jne 0x439586
jmp 0x439528
mov dword [esp], eax
call dword [sym.imp.USER32.dll_SendMessageW]
sub esp, 0x10
jmp 0x439434
cmp dword [0x52483c], 0
je 0x4395c6
cmp dword [ebp - 0x4b8], 0x50
jne 0x4395e5
xor edx, edx
cmp dword [0x5240cc], 0
mov eax, str.PersistentLog
sete dl
mov dword [0x5240cc], edx
call fcn.0042f7fd
mov edi, dword [0x5240cc]
mov dword [esp], 0xd08
jmp 0x43a07d
mov dword [esp], 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
push edx
test ax, ax
jns 0x4395e5
cmp dword [ebp - 0x4bc], 0x100
je 0x43958f
test edi, edi
jne 0x4395fd
mov edx, dword [ebp - 0x4bc]
cmp edx, 0x104
jne 0x4396d4
jmp 0x439616
cmp dword [ebp - 0x4b8], 0x11
je 0x439434
xor eax, eax
mov dword [0x52483c], eax
jmp 0x439434
mov eax, dword [ebp - 0x4b8]
lea ecx, [eax - 0x6b]
and ecx, 0xfffffffd
je 0x439633
lea ecx, [eax - 0xbb]
and ecx, 0xfffffffd
jne 0x4396d4
mov ecx, dword [0x48fb9c]
cmp eax, 0x6b
je 0x439645
cmp eax, 0xbb
jne 0x439651
cmp ecx, 1
jg 0x4396a8
mov edx, 1
jmp 0x439659
or edx, 0xffffffff
cmp ecx, 0xffffffff
jl 0x4396a8
add edx, ecx
mov eax, str.DefaultThreadPriority
mov dword [0x48fb9c], edx
dec edx
call fcn.0042fd05
mov eax, dword [0x524148]
test eax, eax
je 0x43968a
mov edx, dword [0x48fb9c]
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.KERNEL32.DLL_SetThreadPriority]
push eax
push eax
mov eax, dword [0x527d20]
mov edx, dword [0x48fb9c]
test eax, eax
je 0x4396a8
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_SetThreadPriority]
push eax
push eax
mov eax, dword [0x48fb9c]
xor edi, edi
mov dword [esp + 0xc], 0xcf6
mov dword [esp + 8], 0xdac
mov dword [esp + 0x10], eax
mov dword [esp + 4], edi
mov dword [esp], edi
call fcn.00422f82
jmp 0x439434
cmp dword [0x48fbb8], 0
jne 0x43a38f
cmp edx, 0x104
jne 0x439e2a
mov eax, dword [ebp - 0x4b8]
cmp eax, 0xbe
jne 0x439738
mov eax, dword [0x524104]
xor edx, edx
test eax, eax
sete dl
cmp eax, 1
sbb eax, eax
mov dword [0x524104], edx
and eax, 0xfffffffe
add eax, 3
mov dword [0x4911c4], eax
mov eax, str.EnableUsbDebug
call fcn.0042f7fd
mov edi, dword [0x524104]
mov dword [esp], 0xcc6
jmp 0x439dcd
cmp eax, 0xbc
jne 0x439763
xor edx, edx
cmp dword [0x48fbbc], 0
sete dl
mov dword [0x48fbbc], edx
mov dword [ebp - 0x510], edx
mov dword [esp], 0xcd2
jmp 0x439bab
cmp eax, 0x41
jne 0x43979b
xor eax, eax
cmp dword [0x48fbac], 0
sete al
setne dl
mov dword [0x48fbac], eax
movzx edx, dl
mov eax, str.DisableRufusMBR
call fcn.0042f7fd
mov edi, dword [0x48fbac]
mov dword [esp], 0xd15
jmp 0x43a07d
cmp eax, 0x42
jne 0x4397d3
xor eax, eax
cmp dword [0x524110], 0
sete al
setne dl
mov dword [0x524110], eax
movzx edx, dl
mov eax, str.DisableFakeDrivesCheck
call fcn.0042f7fd
mov edi, dword [0x524110]
mov dword [esp], 0xcb8
jmp 0x43a07d
cmp eax, 0x43
jne 0x43980b
xor ecx, ecx
mov dword [esp + 4], 0x147
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ecx
mov eax, dword [0x52417c]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_SendMessageW]
sub esp, 0x10
test eax, eax
js 0x439434
mov dword [esp], eax
jmp 0x439c3e
cmp eax, 0x44
jne 0x43993f
lea edi, [ebp - 0x324]
mov dword [esp + 0x14], 0x4a22c9
mov dword [esp + 0x10], 0x523a00
mov dword [esp + 0xc], 0x4a4518
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], 0x104
mov dword [esp], edi
call dword [sym.imp.msvcrt.dll__snprintf_s]
xor eax, eax
mov byte [ebp - 0x221], 0
mov dword [esp], eax
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], 0xcc0
mov dword [esp + 8], 0xdac
mov dword [esp + 4], 1
call fcn.00422f82
mov dword [esp], edi
call sub.msvcrt.dll_strlen
mov dword [esp + 4], 2
lea ecx, [eax + 2]
mov dword [esp], ecx
mov dword [ebp - 0x510], ecx
call sub.msvcrt.dll_calloc
mov ecx, dword [ebp - 0x510]
mov dword [ebp - 0x420], 3
mov word [ebp - 0x414], 0x614
mov edx, eax
xor eax, eax
mov dword [ebp - 0x424], eax
xor eax, eax
mov dword [ebp - 0x418], eax
xor eax, eax
mov dword [ebp - 0x412], eax
mov dword [ebp - 0x40e], eax
mov dword [ebp - 0x40a], eax
xor eax, eax
mov dword [ebp - 0x41c], edx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ecx
mov dword [ebp - 0x510], edx
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], edi
mov dword [esp + 4], eax
mov dword [esp], 0xfde9
call dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
lea eax, [ebp - 0x424]
sub esp, 0x18
mov dword [esp], eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
push edx
mov edx, dword [ebp - 0x510]
test edx, edx
je 0x439930
mov dword [esp], edx
call sub.msvcrt.dll_free
mov dword [0x5249e8], 1
jmp 0x439434
cmp eax, 0x45
jne 0x439985
xor edx, edx
cmp dword [0x524114], 0
mov eax, str.EnableWindowsDualUefiBiosMode
sete dl
mov dword [0x524114], edx
call fcn.0042f7fd
mov edi, dword [0x524114]
mov dword [esp], 0xcc2
call fcn.00422df0
mov edx, edi
call fcn.0042ce3e
xor eax, eax
call fcn.0042d435
jmp 0x439434
cmp eax, 0x46
jne 0x4399f1
xor edx, edx
cmp dword [0x524128], 0
sete dl
xor edi, edi
mov dword [0x524128], edx
mov dword [ebp - 0x510], edx
mov dword [esp], 0xcb5
call fcn.00422df0
mov edx, dword [ebp - 0x510]
call fcn.0042ce3e
mov dword [esp], edi
call fcn.004031cc
xor eax, eax
cmp dword [0x524128], 0
mov dword [esp + 4], 0x3fe
setne al
mov dword [esp + 8], eax
mov eax, dword [0x5241b4]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_CheckDlgButton]
sub esp, 0xc
jmp 0x439434
cmp eax, 0x47
jne 0x439a29
xor eax, eax
cmp dword [0x48fbb4], 0
sete al
setne dl
mov dword [0x48fbb4], eax
movzx edx, dl
mov eax, str.DisableVHDs
call fcn.0042f7fd
mov edi, dword [0x48fbb4]
mov dword [esp], 0xcec
jmp 0x439dcd
cmp eax, 0x48
jne 0x439a5c
xor edx, edx
cmp dword [0x50ff44], 0
mov eax, str.EnableExtraHashes
sete dl
mov dword [0x50ff44], edx
call fcn.0042f7fd
mov edi, dword [0x50ff44]
mov dword [esp], 0xcf0
jmp 0x43a07d
cmp eax, 0x49
jne 0x439acf
xor edx, edx
cmp dword [0x48eba0], 0
sete dl
mov dword [0x48eba0], edx
mov dword [ebp - 0x510], edx
mov dword [esp], 0xcbe
call fcn.00422df0
mov edx, dword [ebp - 0x510]
call fcn.0042ce3e
cmp dword [0x522ec8], 0
je 0x439434
mov dword [0x524a00], 1
xor ecx, ecx
mov dword [0x5249f4], 1
mov dword [esp + 0xc], ecx
mov dword [esp + 8], 0x3f6
mov dword [esp + 4], 0x111
mov dword [esp], ebx
jmp 0x439578
cmp eax, 0x4a
jne 0x439af8
xor edx, edx
cmp dword [0x48eb9c], 0
sete dl
mov dword [0x48eb9c], edx
mov dword [ebp - 0x510], edx
mov dword [esp], 0xcb9
jmp 0x439bab
cmp eax, 0x4b
jne 0x439b21
xor edx, edx
cmp dword [0x48eb98], 0
sete dl
mov dword [0x48eb98], edx
mov dword [ebp - 0x510], edx
mov dword [esp], 0xcba
jmp 0x439bab
cmp eax, 0x4c
jne 0x439b54
xor edx, edx
cmp dword [0x524108], 0
mov eax, str.ForceLargeFat32Formatting
sete dl
mov dword [0x524108], edx
call fcn.0042f7fd
mov edi, dword [0x524108]
mov dword [esp], 0xcb6
jmp 0x439dcd
cmp eax, 0x4d
jne 0x439b87
xor edx, edx
cmp dword [0x5240d4], 0
mov eax, str.IgnoreBootMarker
sete dl
mov dword [0x5240d4], edx
call fcn.0042f7fd
mov edi, dword [0x5240d4]
mov dword [esp], 0xcf7
jmp 0x43a07d
cmp eax, 0x4e
jne 0x439bbb
xor edx, edx
cmp dword [0x524124], 0
sete dl
mov dword [0x524124], edx
mov dword [ebp - 0x510], edx
mov dword [esp], 0xcbc
call fcn.00422df0
mov edx, dword [ebp - 0x510]
jmp 0x43a084
cmp eax, 0x4f
jne 0x439bca
call fcn.0042232e
jmp 0x439434
cmp eax, 0x50
jne 0x439c48
xor eax, eax
mov dword [esp + 4], 0x147
mov edx, dword [sym.imp.USER32.dll_SendMessageW]
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov eax, dword [0x52417c]
mov dword [esp], eax
mov dword [ebp - 0x510], edx
call edx
sub esp, 0x10
mov edi, eax
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], edi
mov dword [esp + 4], 0x150
mov eax, dword [0x52417c]
mov dword [esp], eax
mov edx, dword [ebp - 0x510]
call edx
xor edx, edx
sub esp, 0x10
mov dword [esp + 4], edx
mov dword [esp + 8], edx
mov dword [esp], eax
call fcn.0040b4cc
test eax, eax
je 0x439434
mov dword [esp], edi
call fcn.00402742
jmp 0x439434
cmp eax, 0x51
jne 0x439c7b
xor edx, edx
cmp dword [0x5240e8], 0
mov eax, str.EnableFileIndexing
sete dl
mov dword [0x5240e8], edx
call fcn.0042f7fd
mov edi, dword [0x5240e8]
mov dword [esp], 0xcda
jmp 0x43a07d
cmp eax, 0x52
jne 0x439cbc
mov eax, 0x4a2366
call fcn.0042ed0d
mov dword [esp + 8], 0xdac
neg eax
sbb eax, eax
add eax, 0xcb1
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp], eax
call fcn.00422f82
mov eax, 0x4a451e
call fcn.0042ed0d
jmp 0x439434
cmp eax, 0x53
jne 0x439ce2
xor edx, edx
cmp dword [0x48fbec], 0
sete dl
mov dword [0x48fbec], edx
mov dword [ebp - 0x510], edx
mov dword [esp], 0xcb4
jmp 0x439d54
cmp eax, 0x54
jne 0x439d15
xor edx, edx
cmp dword [0x5240fc], 0
mov eax, str.PreserveTimestamps
sete dl
mov dword [0x5240fc], edx
call fcn.0042f7fd
mov edi, dword [0x5240fc]
mov dword [esp], 0xcc5
jmp 0x43a07d
cmp eax, 0x55
jne 0x439d61
xor eax, eax
cmp dword [0x524100], 0
sete al
setne dl
mov dword [0x524100], eax
movzx edx, dl
mov eax, str.UseProperSizeUnits
call fcn.0042f7fd
xor edx, edx
cmp dword [0x524100], 0
sete dl
mov dword [ebp - 0x510], edx
mov dword [esp], 0xcbf
call fcn.00422df0
mov edx, dword [ebp - 0x510]
jmp 0x439dd4
cmp eax, 0x56
jne 0x439d9f
cmp dword [0x48fbb0], 0
je 0x439434
xor edx, edx
cmp dword [0x5240d8], 0
mov eax, str.UseVds
sete dl
mov dword [0x5240d8], edx
call fcn.0042f7fd
mov edx, dword [0x5240d8]
mov eax, 0x4a4526
jmp 0x43a084
cmp eax, 0x57
jne 0x439dde
xor edx, edx
cmp dword [0x52410c], 0
mov eax, str.EnableVmdkDetection
sete dl
mov dword [0x52410c], edx
call fcn.0042f7fd
mov edi, dword [0x52410c]
mov dword [esp], 0xcc1
call fcn.00422df0
mov edx, edi
call fcn.0042ce3e
jmp 0x43a026
cmp eax, 0x58
jne 0x439e0d
xor edi, edi
mov dword [esp + 0xc], 0xcb7
mov dword [esp + 8], 0x7d0
mov dword [esp + 4], edi
mov dword [esp], edi
call fcn.00422f82
xor eax, eax
mov dword [0x524a08], eax
jmp 0x439434
cmp eax, 0x5a
jne 0x43a38f
mov dword [0x5240f0], 1
xor ecx, ecx
mov dword [0x5240f8], ecx
jmp 0x439e86
cmp edx, 0x100
jne 0x43a38f
cmp dword [ebp - 0x4b8], 0x5a
je 0x439e4e
cmp dword [ebp - 0x4b8], 0x45
jne 0x439ee1
jmp 0x439ebc
mov dword [esp], 0x11
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
call edi
push edx
test ax, ax
jns 0x439eaa
mov dword [esp], 0x12
call edi
push edi
test ax, ax
jns 0x439eaa
mov dword [0x5240f0], 1
mov dword [0x5240f8], 1
xor ecx, ecx
mov dword [esp], ebx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], 0x3eb
mov dword [esp + 4], 0x111
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x43957e
cmp dword [ebp - 0x4bc], 0x100
jne 0x43a38f
jmp 0x439e3f
mov dword [esp], 0x11
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
call edi
push edx
test ax, ax
js 0x439eec
cmp dword [ebp - 0x4bc], 0x100
jne 0x43a38f
cmp dword [ebp - 0x4b8], 0x46
jne 0x439f4e
jmp 0x439f29
mov dword [esp], 0x12
call edi
push ecx
test ax, ax
jns 0x439ed1
xor edx, edx
cmp dword [0x5240c4], 0
mov eax, str.ExpertMode
sete dl
mov dword [0x5240c4], edx
call fcn.0042f7fd
mov edi, dword [0x5240c4]
mov dword [esp], 0xd13
jmp 0x43a07d
mov dword [esp], 0x11
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
call edi
push edx
test ax, ax
js 0x439f60
cmp dword [ebp - 0x4bc], 0x100
jne 0x43a38f
cmp dword [ebp - 0x4b8], 0x59
jne 0x43a38f
jmp 0x43a035
mov dword [esp], 0x12
call edi
push edi
test ax, ax
jns 0x439f3e
xor edx, edx
cmp dword [0x5240ec], 0
mov eax, dword [ebp - 0x50c]
sete dl
mov dword [0x5240ec], edx
jne 0x439f99
mov eax, dword [0x524128]
mov dword [ebp - 0x50c], eax
mov eax, 1
test eax, eax
mov dword [0x524128], eax
setne al
mov dword [esp + 4], 0x3fe
movzx eax, al
mov dword [esp + 8], eax
mov eax, dword [0x5241b4]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_CheckDlgButton]
mov edi, dword [0x5240ec]
sub esp, 0xc
mov dword [esp], 0xcd7
call fcn.00422df0
mov edx, edi
call fcn.0042ce3e
mov eax, 0x4a39d6
mov edx, str.enabled
cmp dword [0x5240ec], 0
cmove edx, eax
mov ecx, 0x4a22f4
mov eax, str.CAUTION:
mov dword [esp], str._sListing_of_non_USB_removable_drives__s
cmove eax, ecx
mov dword [esp + 8], edx
mov dword [esp + 4], eax
call fcn.0043d9e0
cmp dword [0x5240ec], 0
je 0x43a026
mov dword [esp], str.By_using_this_unofficial_cheat_mode_you_forfeit_ANY_RIGHT_to_complain_if_you_lose_valuable_data_
call fcn.0043d9e0
xor ecx, ecx
mov dword [esp], ecx
call fcn.004031cc
jmp 0x439434
mov dword [esp], 0x11
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
call edi
push edx
test ax, ax
jns 0x43a38f
mov dword [esp], 0x12
call edi
push ecx
test ax, ax
jns 0x43a38f
xor eax, eax
cmp dword [0x5240a4], 0
setle al
lea edi, [eax + eax]
mov dword [0x5240a4], edi
mov dword [esp], 0xcbb
call fcn.00422df0
mov edx, edi
call fcn.0042ce3e
jmp 0x439434
mov eax, dword [0x526e20]
test eax, eax
je 0x43a0b5
xor edx, edx
mov dword [esp + 4], 0x10
mov dword [esp + 0xc], edx
mov dword [esp + 8], edx
mov dword [esp], eax
call dword [sym.imp.USER32.dll_SendMessageW]
sub esp, 0x10
cmp dword [0x5249f8], 0
je 0x43a0e2
xor eax, eax
mov dword [0x5249f8], eax
mov dword [esp], 1
call fcn.00422bd2
mov dword [esp], 1
call fcn.00422b71
jmp 0x4391eb
mov eax, 0x523e80
call fcn.0042fae0
cmp dword [ebp - 0x4f4], 0
jne 0x43a113
mov eax, dword [0x520ee0]
test eax, eax
je 0x43a166
mov dword [esp + 4], 1
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_TerminateThread]
push edx
push edx
jmp 0x43a166
mov eax, dword [ebp - 0x4f4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_ReleaseMutex]
push eax
cmp dword [ebp - 0x4f4], 0xffffffff
je 0x43a13c
mov eax, dword [ebp - 0x4f4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push eax
xor ebx, ebx
mov dword [esp], str.rufus.com
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
push ecx
test eax, eax
jne 0x43a0f5
cmp ebx, 0xb
je 0x43a0f5
mov dword [esp], 0xc8
inc ebx
call dword [sym.imp.KERNEL32.DLL_Sleep]
push edi
jmp 0x43a13e
cmp dword [ebp - 0x504], 0
jne 0x43a1a2
cmp byte [ebp - 0x220], 0
je 0x43a1a2
lea ebx, [ebp - 0x220]
mov eax, ebx
call fcn.0042dea6
test eax, eax
jne 0x43a1a2
call fcn.0043df77
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
mov dword [esp], str.Could_not_delete__s:__s
call fcn.0043d9e0
call fcn.0044111d
xor ebx, ebx
xor edi, edi
call fcn.0044419f
xor ecx, ecx
mov dword [esp], ecx
call fcn.00422bd2
mov eax, dword [0x522ec8]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [0x522ec0]
mov dword [0x522ec8], ebx
xor ebx, ebx
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebp - 0x4ec]
mov dword [0x522ec0], edi
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [0x5241cc]
mov dword [esp], eax
call sub.msvcrt.dll_free
xor eax, eax
mov dword [0x5241cc], eax
mov eax, dword [0x5241d0]
mov dword [esp], eax
call sub.msvcrt.dll_free
xor eax, eax
mov dword [0x5241d0], eax
mov eax, dword [0x4dfd68]
mov dword [esp], eax
call sub.msvcrt.dll_free
xor eax, eax
mov dword [0x4dfd68], eax
mov eax, dword [0x520ee4]
mov dword [esp], eax
call sub.msvcrt.dll_free
xor eax, eax
mov dword [0x520ee4], eax
mov eax, dword [0x4dff20]
mov dword [esp], eax
call sub.msvcrt.dll_free
xor eax, eax
cmp dword [ebp - 0x4f0], 0
mov dword [0x4dff20], eax
je 0x43a28c
mov eax, dword [ebp - 0x4f0]
cmp dword [ebp - 0x4e0], ebx
jle 0x43a284
mov eax, dword [eax + ebx*4]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebp - 0x4f0]
xor edx, edx
mov dword [eax + ebx*4], edx
inc ebx
jmp 0x43a25d
mov dword [esp], eax
call sub.msvcrt.dll_free
cmp dword [ebp - 0x4fc], 0
je 0x43a2bf
xor eax, eax
mov dword [esp + 0xc], str.NoDriveTypeAutorun
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
mov dword [esp + 4], 0x524a08
mov dword [esp], 1
call fcn.0043ce72
cmp dword [ebp - 0x4d8], 0
jne 0x43a2e2
xor edi, edi
mov dword [esp], edi
call fcn.004081b5
test eax, eax
jne 0x43a2e2
mov dword [esp], str.Failed_to_restore_AutoMount_to_disabled
call fcn.0043d9e0
cmp dword [0x525ba0], 0
je 0x43a2ff
mov dword [esp + 4], 0x524ba0
mov dword [esp], 0x4a2206
call fcn.0043d9e0
xor ebx, ebx
cmp dword [ebp - 0x500], 0
mov dword [0x525ba0], ebx
je 0x43a346
call dword [sym.imp.KERNEL32.DLL_GetConsoleWindow]
xor ecx, ecx
mov dword [esp + 0x18], 3
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ecx
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [sym.imp.USER32.dll_SetWindowPos]
sub esp, 0x1c
call dword [sym.imp.KERNEL32.DLL_FreeConsole]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ax, word [0x5241d4]
test ax, ax
je 0x43a374
dec eax
mov word [0x5241d4], ax
movzx eax, ax
mov eax, dword [eax*4 + 0x5241e0]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
push edx
jmp 0x43a34c
lea eax, [esi - 1]
cmp eax, 0xfffffffd
ja 0x43a435
mov dword [esp], esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push eax
jmp 0x43a435
cmp dword [ebp - 0x4f8], 0
je 0x43a3da
mov dword [esp], 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
push edx
test ax, ax
js 0x43a3da
cmp dword [ebp - 0x508], 0
je 0x43a3c4
xor edi, edi
mov dword [ebp - 0x508], edi
mov dword [ebp - 0x4f8], edi
jmp 0x43a3da
mov eax, dword [0x527858]
mov ecx, 3
inc eax
cdq
idiv ecx
mov dword [0x527858], edx
jmp 0x43a3b4
mov edx, dword [sym.imp.USER32.dll_IsDialogMessageW]
lea edi, [ebp - 0x4c0]
mov dword [esp], ebx
mov dword [esp + 4], edi
mov dword [ebp - 0x510], edx
call edx
test eax, eax
push ecx
push ecx
mov edx, dword [ebp - 0x510]
jne 0x439434
mov dword [esp + 4], edi
mov eax, dword [0x524154]
mov dword [esp], eax
call edx
push edx
push edx
test eax, eax
jne 0x439434
mov dword [esp], edi
call dword [sym.imp.USER32.dll_TranslateMessage]
push eax
mov dword [esp], edi
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x439433
mov dword [esp], str._Rufus_7_exit__n
call fcn.0043d9e0
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret 0x10