Function at 0x463070
Capabilities:
Create thread
Get disk size
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1dc
mov eax, dword [0x5512ec]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x147
push dword [0x5a289c]
call edi
push 0xd0f
mov esi, eax
call fcn.0041e970
add esp, 4
mov dword [ebp - 0x1b4], eax
push 0xd0e
call fcn.0041e970
add esp, 4
mov dword [ebp - 0x1b0], eax
push 0xd10
call fcn.0041e970
mov dword [ebp - 0x1ac], eax
xorps xmm0, xmm0
lea eax, [ebp - 0xa0]
mov dword [ebp - str..vhd], 0x558ab0
mov dword [ebp - 0x1d4], eax
add esp, 4
movq qword [0x59fe08], xmm0
mov ebx, 3
mov dword [ebp - 0x1d8], ebx
lea eax, [ebp - 0x1b4]
mov dword [ebp - 0x1cc], eax
movups xmmword [0x59fde8], xmm0
movups xmmword [0x59fdf8], xmm0
test esi, esi
js 0x463628
cmp dword [0x55a78c], 0
jne 0x463628
lea eax, [esi + esi*4]
push dword [eax*8 + 0x55a7fc]
lea eax, [ebp - 0xa0]
push 0x525f4c
push 0x80
push eax
call fcn.004050d0
add esp, 0x10
mov byte [ebp - 0x21], 0
push 0
push esi
push 0x150
push dword [0x5a289c]
call edi
mov esi, eax
mov dword [0x59fdec], esi
test esi, esi
js 0x4631c8
cmp esi, 0x80
jb 0x463186
cmp esi, 0xc0
jbe 0x46319d
push 0xe0
push str.D:_a_rufus_rufus_srcdrive.c
push str._DriveIndex___DRIVE_INDEX_MIN____DriveIndex___DRIVE_INDEX_MAX_
call fcn.004dfbbc
add esp, 0xc
add esi, 0xffffff80
cmp esi, 0x40
ja 0x4631c8
push esi
push str..PhysicalDrive_lu
lea eax, [ebp - 0x1c]
push 0x18
push eax
call fcn.004050d0
mov byte [ebp - 5], 0
lea eax, [ebp - 0x1c]
push eax
call fcn.004e03cf
add esp, 0x14
jmp 0x4631ca
xor eax, eax
cmp dword [0x55a77c], 0
mov dword [0x59fe00], eax
je 0x4631e1
cmp dword [0x5a319c], 1
je 0x4631ec
mov ebx, 2
mov dword [ebp - 0x1d8], ebx
mov esi, 1
mov dword [ebp - 0x1bc], 1
cmp ebx, esi
jb 0x463298
mov eax, dword [0x55b1f0]
mov ecx, str._NULL_
test eax, eax
mov dword [ebp - 0x1b8], esi
mov edx, esi
cmovne ecx, eax
mov edi, edx
mov dword [ebp - 0x1c0], ecx
mov eax, edx
nop dword [eax]
nop dword [eax + eax]
mov ecx, dword [eax*4 + 0x558aac]
mov eax, str._NULL_
add ecx, 2
cmovne eax, ecx
test ecx, ecx
mov ecx, dword [ebp - 0x1c0]
cmovne esi, edi
mov edi, dword [ebp - 0x1b8]
cmovne edi, edx
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x463276
test dl, dl
je 0x463272
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x463276
add eax, 2
add ecx, 2
test dl, dl
jne 0x463256
xor eax, eax
jmp 0x46327b
sbb eax, eax
or eax, 1
test eax, eax
je 0x463298
lea esi, [edi + 1]
mov eax, esi
mov dword [ebp - 0x1bc], esi
mov dword [ebp - 0x1b8], esi
mov edx, esi
mov edi, esi
cmp eax, ebx
jbe 0x463230
cmp esi, ebx
jbe 0x4632a6
mov dword [ebp - 0x1bc], 2
lea eax, [ebp - 0x1bc]
xor edx, edx
push eax
lea eax, [ebp - 0x1d8]
push eax
lea ecx, [edx + 1]
call fcn.0044dc20
mov dword [0x59fe04], eax
add esp, 8
mov eax, dword [ebp - 0x1bc]
test eax, eax
je 0x4632d8
cmp eax, dword [ebp - 0x1d8]
jbe 0x4632f5
push 0x46c
push str.D:_a_rufus_rufus_src_vhd.c
push str.i___0__i____UINT_img_ext.count
call fcn.004dfbbc
mov eax, dword [ebp - 0x1bc]
add esp, 0xc
mov edi, dword [eax*4 + 0x558aac]
add edi, 2
cmp dword [0x55a750], 0
mov dword [0x55b1f0], edi
je 0x463323
push ecx
mov edx, edi
mov ecx, str.PreferredSaveImageType
call fcn.00424e40
add esp, 4
jmp 0x463429
test edi, edi
jne 0x46332b
xor esi, esi
jmp 0x463339
mov esi, edi
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x463330
sub esi, ecx
push 0x5c
push str.PreferredSaveImageType
mov dword [ebp - 0x1c0], 0
mov dword [ebp - 0x1b8], 0
call fcn.004aa320
add esp, 8
test eax, eax
je 0x463377
push 0x91
push str.D:_a_rufus_rufus_src_registry.h
push str.strchr_key_name_____NULL
call fcn.004dfbbc
add esp, 0xc
push 0x5c
push str.PreferredSaveImageType
call fcn.004aa320
add esp, 8
test eax, eax
jne 0x463429
lea eax, [ebp - 0x1c0]
push eax
push 0x2001d
push 0
push 0
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x4633bf
mov dword [ebp - 0x1c0], 0
jmp 0x46341c
lea eax, [ebp - 0x1dc]
push eax
lea eax, [ebp - 0x1b8]
push eax
push 0
push 7
push 0
push 0
push 0
push str.SOFTWAREAkeo_ConsultingRufus
push dword [ebp - 0x1c0]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x4633f8
mov dword [ebp - 0x1b8], 0
jmp 0x46340f
push esi
push edi
push 1
push 0
push str.PreferredSaveImageType
push dword [ebp - 0x1b8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x1c0]
test eax, eax
je 0x46341c
push eax
call ebx
mov eax, dword [ebp - 0x1b8]
test eax, eax
je 0x463429
push eax
call ebx
mov eax, dword [ebp - 0x1bc]
sub eax, 1
je 0x463451
sub eax, 2
je 0x463445
mov dword [0x59fde8], 3
jmp 0x46345b
mov dword [0x59fde8], 0x63
jmp 0x46345b
mov dword [0x59fde8], 2
cmp dword [0x59fe00], 0
mov eax, dword [0x5a3180]
mov ecx, dword [0x5a3184]
mov dword [0x59fdf0], 0x2000000
mov dword [0x59fdf8], eax
mov dword [0x59fdfc], ecx
je 0x4635ef
cmp dword [0x59fe04], 0
je 0x4635ef
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x8002
push dword [0x5a2ae4]
call esi
cmp dword [0x59fde8], 2
mov dword [0x55a318], 0
jne 0x463545
push 0x104
lea eax, [ebp - 0x1a8]
xorps xmm0, xmm0
push eax
push dword [0x59fe04]
movlpd qword [ebp - 0x1c8], xmm0
call dword [sym.imp.KERNEL32.dll_GetVolumePathNameA]
test eax, eax
je 0x463545
push 0
push 0
lea eax, [ebp - 0x1c8]
push eax
lea eax, [ebp - 0x1a8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
je 0x463545
mov ecx, dword [0x5a3180]
mov eax, dword [0x5a3184]
add ecx, 0x200
adc eax, 0
cmp dword [ebp - 0x1c4], eax
jg 0x463545
jl 0x46352c
cmp dword [ebp - 0x1c8], ecx
jae 0x463545
push str.The_VHD_size_is_too_large_for_the_target_drive
call fcn.0044b0b0
mov dword [0x55a318], 0xc00300df
jmp 0x4635d7
xor edx, edx
xor ecx, ecx
call fcn.00430c60
mov ecx, 1
mov dword [0x55a318], 0
call fcn.0045d5c0
cmp dword [0x59fde8], 0x63
mov ecx, 0x462f60
push 0
push 0
push 0x59fde8
mov eax, 0x462bb0
cmove eax, ecx
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x55a78c], eax
test eax, eax
je 0x4635c3
push str._r_nSave_to_VHD_operation_started
call fcn.0044b0b0
add esp, 4
push 0xffffffffffffffff
push 0
push 0
push 1
call fcn.0041ed70
add esp, 0x10
push 0
push 0
push 0x8009
push dword [0x5a2ae4]
call esi
jmp 0x4635ef
push str.Unable_to_start_VHD_save_thread
call fcn.0044b0b0
mov dword [0x55a318], 0xe0031205
add esp, 4
push 0
push 0
push 0x8000
push dword [0x5a2ae4]
call dword [sym.imp.USER32.dll_PostMessageW]
cmp dword [0x55a78c], 0
jne 0x463628
push dword [0x59fe00]
call fcn.004d1211
add esp, 4
mov dword [0x59fe00], 0
push dword [0x59fe04]
call fcn.004d1211
add esp, 4
mov dword [0x59fe04], 0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a8b60
mov esp, ebp
pop ebp
ret