Function at 0x14003d3d0
Capabilities:
Check if file exists
Check mutex on windows
Copy file
Delete file
Extract resource via kernel32 functions
Get common file path
Get session user name
Get token membership
Identify system language via api
Log keystrokes via polling
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x6a0]
sub rsp, 0x7a0
mov rax, qword [0x140193440]
xor rax, rsp
mov qword [rbp + 0x690], rax
xor r12d, r12d
mov qword [rbp + 0x1a0], r8
mov dword [rbp - 0x4c], r12d
mov dword [rsp + 0x68], r12d
mov dword [rbp + 4], r12d
mov qword [rbp + 8], rcx
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov ebx, 1
mov dword [rbp - 0x68], r12d
movzx eax, ax
lea rdx, str.SoftwareMicrosoftVisualStudio
mov dword [rsp + 0x6c], eax
mov r9d, 0x20019
lea rax, [rbp - 0x58]
mov dword [rsp + 0x74], r12d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000001
mov dword [rbp - 0x3c], r12d
mov r15d, r12d
mov dword [rbp - 0x44], r12d
mov dword [rbp - 0x40], r12d
mov r14d, r12d
mov dword [rbp - 0x80], ebx
mov qword [rbp - 0x58], r12
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov rcx, qword [rbp - 0x58]
mov r13d, r12d
test eax, eax
sete r13b
test rcx, rcx
je 0x14003d495
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edx, edx
mov dword [rsp + 0x78], r12d
mov r8d, 0x103
mov dword [rbp - 0x6c], r12d
lea rcx, [rbp + 0x371]
mov dword [rbp - 0x50], r12d
mov dword [rbp - 0x48], 4
mov byte [rbp + 0x370], r12b
call fcn.140136960
xor edx, edx
mov byte [rbp + 0x260], r12b
mov r8d, 0x103
lea rcx, [rbp + 0x261]
call fcn.140136960
xor edx, edx
mov byte [rbp + 0x480], r12b
mov r8d, 0x103
lea rcx, [rbp + 0x481]
call fcn.140136960
movzx eax, word [0x140162384]
lea rcx, [0x14015644e]
mov word [rsp + 0x70], ax
movzx eax, byte [0x140162386]
mov byte [rsp + 0x72], al
lea rax, str.extra_devs
mov qword [rbp + 0x60], rax
lea rax, [0x1401633ec]
mov qword [rbp + 0x80], rax
lea rax, str.help
mov qword [rbp + 0xa0], rax
lea rax, [0x1401633f8]
mov qword [rbp + 0xc0], rax
lea rax, str.locale
mov qword [rbp + 0xe0], rax
lea rax, str.filesystem
mov qword [rbp + 0x100], rax
lea rax, str.wait
mov qword [rbp + 0x120], rax
mov qword [rbp - 0x60], r12
mov qword [rbp - 0x78], r12
mov qword [rbp - 8], r12
mov qword [rbp + 0x10], r12
mov qword [rbp - 0x58], r12
mov dword [rbp + 0x68], r12d
mov qword [rbp + 0x70], r12
mov dword [rbp + 0x78], 0x78
mov dword [rbp + 0x88], r12d
mov qword [rbp + 0x90], r12
mov dword [rbp + 0x98], 0x67
mov dword [rbp + 0xa8], r12d
mov qword [rbp + 0xb0], r12
mov dword [rbp + 0xb8], 0x68
mov dword [rbp + 0xc8], ebx
mov qword [rbp + 0xd0], r12
mov dword [rbp + 0xd8], 0x69
mov dword [rbp + 0xe8], ebx
mov qword [rbp + 0xf0], r12
mov dword [rbp + 0xf8], 0x6c
mov dword [rbp + 0x108], ebx
mov qword [rbp + 0x110], r12
mov dword [rbp + 0x118], 0x66
mov dword [rbp + 0x128], ebx
mov qword [rbp + 0x130], r12
mov dword [rbp + 0x138], 0x77
mov qword [rbp + 0x140], r12
mov dword [rbp + 0x148], r12d
mov qword [rbp + 0x150], r12
mov dword [rbp + 0x158], r12d
call qword [sym.imp.KERNEL32.dll_SetDllDirectoryA]
mov ecx, 0x800
call qword [sym.imp.KERNEL32.dll_SetDefaultDllDirectories]
lea rcx, str._Rufus_init__n
call fcn.14004f910
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x50]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x14003d67c
cmp dword [rbp - 0x50], 0x6c696e
mov eax, ebx
je 0x14003d67f
mov eax, r12d
mov edx, 2
mov dword [0x14019f584], eax
mov ecx, 0x104
mov dword [0x1401e84a4], ebx
call fcn.1400c537c
mov rdi, rax
test rax, rax
jne 0x14003d6b0
lea ecx, [rax + 0xe]
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14003d765
mov r8d, 0x104
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test ebx, ebx
je 0x14003d74a
lea ecx, [rbx - 1]
test ecx, ecx
je 0x14003d6f6
lea rdx, [rdi + rcx*2]
nop word [rax + rax]
cmp word [rdx], 0x5c
je 0x14003d6f1
sub rdx, 2
add ecx, 0xffffffff
jne 0x14003d6e0
jmp 0x14003d6f6
mov word [rdi + rcx*2], r12w
mov qword [rsp + 0x38], r12
mov r9d, 0xffffffff
mov qword [rsp + 0x30], r12
mov r8, rdi
lea r12, [0x1401e8240]
mov dword [rsp + 0x28], 0x104
xor edx, edx
mov qword [rsp + 0x20], r12
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebx, eax
test eax, eax
jne 0x14003d751
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
mov ebx, eax
call fcn.1400e9080
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14003d765
lea r12, [0x1401e8240]
mov rcx, rdi
call fcn.1400e9080
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
jne 0x14003d790
call fcn.140050120
mov rdx, rax
lea rcx, str.Could_not_get_application_directory:__s
call fcn.14004f910
movzx eax, word [0x140163460]
mov word [0x1401e8240], ax
mov byte [0x1401e8242], r14b
jmp 0x14003d7b2
mov r9, 0xffffffffffffffff
lea r8, [0x140156078]
mov edx, 0x104
mov rcx, r12
call fcn.1400e917c
movzx eax, word [0x140163460]
lea r12, [0x1401e7fc0]
mov word [0x1401e7fc0], ax
mov rcx, r12
mov byte [0x1401e7fc2], r14b
call fcn.14002e7b0
xor esi, esi
xor r9d, r9d
mov qword [rsp + 0x30], rsi
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x2000000
mov rcx, rax
mov rbx, rax
mov dword [rsp + 0x20], 3
lea r8d, [rsi + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test rbx, rbx
je 0x14003d816
mov rcx, rbx
call fcn.1400e9080
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp rdi, 0xffffffffffffffff
je 0x14003d8b5
mov rdx, r12
mov rcx, rdi
call fcn.14002f3e0
test eax, eax
je 0x14003d8b5
lea rdx, [0x140155cc0]
mov rcx, r12
call fcn.1400b3650
cmp rax, r12
je 0x14003d85f
lea rdx, [0x140163464]
mov rcx, r12
call fcn.1400b3650
cmp rax, r12
jne 0x14003d8b5
lea rdx, [0x1401e7fc4]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rdx + rax], r14b
jne 0x14003d870
inc rax
mov ebx, 0x104
cmp rax, rbx
mov rcx, r12
cmovb rbx, rax
mov r8, rbx
call fcn.1401362c0
mov r9, 0xffffffffffffffff
mov byte [rbx + r12 - 1], r14b
lea r8, [0x140156078]
mov edx, 0x104
mov rcx, r12
call fcn.1400e917c
jmp 0x14003d8e7
call fcn.140050120
mov r8, rax
lea rcx, str.Could_not_get_current_directory_from__s:__s
mov rdx, r12
call fcn.14004f910
movzx eax, word [0x140163460]
mov word [0x1401e7fc0], ax
mov byte [0x1401e7fc2], r14b
cmp rdi, 0xffffffffffffffff
je 0x14003d8f5
test rdi, rdi
je 0x14003d8f5
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 2
mov ecx, 0x104
call fcn.1400c537c
mov rdx, rax
mov ecx, 0x104
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea rax, [0x1401e84c0]
test edi, edi
je 0x14003d965
xor ecx, ecx
mov r8, rbx
mov qword [rsp + 0x38], rcx
xor edx, edx
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 0x104
lea r9d, [rcx - 1]
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test eax, eax
jne 0x14003d965
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test rbx, rbx
je 0x14003d972
mov rcx, rbx
call fcn.1400e9080
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
jne 0x14003d9d7
call fcn.140050120
mov rdx, rax
lea rcx, str.Could_not_get_temp_directory:__s
call fcn.14004f910
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [r12 + rax], r14b
jne 0x14003d9a0
inc rax
lea rdi, [0x1401e84c0]
mov ebx, 0x104
mov rdx, r12
cmp rax, rbx
mov rcx, rdi
cmovb rbx, rax
mov r8, rbx
call fcn.1401362c0
mov byte [rbx + rdi - 1], r14b
jmp 0x14003db32
lea rcx, [0x1401e84c0]
call fcn.14002e7b0
mov rbx, rax
xor r9d, r9d
xor eax, eax
mov edx, 0x80000000
mov qword [rsp + 0x30], rax
mov rcx, rbx
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
lea r8d, [rax + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test rbx, rbx
je 0x14003da2a
mov rcx, rbx
call fcn.1400e9080
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rsi, [0x1401e84c0]
cmp rdi, 0xffffffffffffffff
je 0x14003dad5
mov rdx, rsi
mov rcx, rdi
call fcn.14002f3e0
test eax, eax
je 0x14003dad5
lea rdx, [0x140155cc0]
mov rcx, rsi
call fcn.1400b3650
cmp rax, rsi
je 0x14003da7e
lea rdx, [0x140163464]
mov rcx, rsi
call fcn.1400b3650
cmp rax, rsi
jne 0x14003dad5
lea rdx, [0x1401e84c4]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rdx + rax], r14b
jne 0x14003da90
inc rax
mov ebx, 0x104
cmp rax, rbx
mov rcx, rsi
cmovb rbx, rax
mov r8, rbx
call fcn.1401362c0
mov r9, 0xffffffffffffffff
mov byte [rbx + rsi - 1], r14b
lea r8, [0x140156078]
mov edx, 0x104
mov rcx, rsi
call fcn.1400e917c
jmp 0x14003db24
call fcn.140050120
mov r8, rax
lea rcx, str.Could_not_get_actual_temp_directory_from__s:__s
mov rdx, rsi
call fcn.14004f910
mov rax, 0xffffffffffffffff
inc rax
cmp byte [r12 + rax], r14b
jne 0x14003daf3
inc rax
mov ebx, 0x104
cmp rax, rbx
mov rdx, r12
mov rcx, rsi
cmovb rbx, rax
mov r8, rbx
call fcn.1401362c0
mov byte [rbx + rsi - 1], r14b
cmp rdi, 0xffffffffffffffff
je 0x14003db32
test rdi, rdi
je 0x14003db32
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 2
mov ecx, 0x104
call fcn.1400c537c
mov edx, 0x104
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea rax, [0x1401e83a0]
test edi, edi
je 0x14003dba2
xor ecx, ecx
mov r8, rbx
mov qword [rsp + 0x38], rcx
xor edx, edx
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 0x104
lea r9d, [rcx - 1]
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test eax, eax
jne 0x14003dba2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test rbx, rbx
je 0x14003dbaf
mov rcx, rbx
call fcn.1400e9080
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
jne 0x14003dbf0
call fcn.140050120
mov rdx, rax
lea rcx, str.Could_not_get_system_directory:__s
call fcn.14004f910
movups xmm0, xmmword [str.C:WindowsSystem32]
mov eax, dword [0x140163538]
mov dword [0x1401e83b0], eax
movups xmmword [0x1401e83a0], xmm0
mov byte [0x1401e83b3], r14b
lea rdi, [0x1401e8720]
mov r8d, 0x1c
mov rdx, rdi
call fcn.14002f160
test eax, eax
jne 0x14003dc5d
call fcn.140050120
mov rdx, rax
lea rcx, str.Could_not_get_app_data_directory:__s
call fcn.14004f910
mov rax, 0xffffffffffffffff
lea rsi, [0x1401e84c0]
nop dword [rax + rax]
inc rax
cmp byte [rsi + rax], r14b
jne 0x14003dc30
inc rax
mov ebx, 0x104
cmp rax, rbx
mov rdx, rsi
mov rcx, rdi
cmovb rbx, rax
mov r8, rbx
call fcn.1401362c0
mov byte [rbx + rdi - 1], r14b
jmp 0x14003dc64
lea rsi, [0x1401e84c0]
lea rdi, [0x1401e80e0]
mov r8d, 0x28
mov rdx, rdi
call fcn.14002f160
test eax, eax
jne 0x14003dccb
call fcn.140050120
mov rdx, rax
lea rcx, str.Could_not_get_user_directory:__s
call fcn.14004f910
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rsi + rax], r14b
jne 0x14003dca0
inc rax
mov ebx, 0x104
cmp rax, rbx
mov rdx, rsi
mov rcx, rdi
cmovb rbx, rax
mov r8, rbx
call fcn.1401362c0
mov byte [rbx + rdi - 1], r14b
mov rax, 0xffffffffffffffff
lea rdx, [0x1401e83a0]
nop dword [rax]
inc rax
cmp byte [rdx + rax], r14b
jne 0x14003dce0
inc rax
lea rcx, [0x1401e85e0]
mov ebx, 0x104
cmp rax, rbx
cmovb rbx, rax
mov r8, rbx
call fcn.1401362c0
lea rax, [0x1401e85e0]
mov rdx, r12
lea rcx, str.Cur_dir:__s
mov byte [rbx + rax - 1], r14b
call fcn.14004f910
lea rbx, [0x1401e8240]
mov rdx, rbx
lea rcx, str.App_dir:__s
call fcn.14004f910
lea rdx, [0x1401e85e0]
lea rcx, str.Sys_dir:__s
call fcn.14004f910
mov rdx, rdi
lea rcx, str.Usr_dir:__s
call fcn.14004f910
lea rdx, [0x1401e8720]
lea rcx, str.Dat_dir:__s
call fcn.14004f910
mov rdx, rsi
lea rcx, str.Tmp_dir:__s
call fcn.14004f910
lea r9, str._srufus.app
mov qword [rsp + 0x20], rbx
mov edx, 0x104
lea rcx, [rbp + 0x370]
mov r8, 0xffffffffffffffff
call fcn.140004960
lea rcx, [rbp + 0x370]
mov byte [rbp + 0x473], r14b
call fcn.14002e7b0
mov rcx, rax
mov rbx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edi, eax
test rbx, rbx
je 0x14003ddce
mov rcx, rbx
call fcn.1400e9080
test edi, edi
je 0x14003dde1
mov dword [0x1401a03d8], 1
jmp 0x14003e235
mov rax, qword [0x1401e2c48]
test rax, rax
jne 0x14003de26
lea rcx, str.Msvcrt
call fcn.14002e530
mov rcx, rax
lea rdx, str.__wgetmainargs
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401e2c48], rax
test rax, rax
jne 0x14003de26
lea rcx, str.Could_not_access_UTF_16_args
call fcn.14004f910
jmp 0x14003e22c
xor ebx, ebx
lea rcx, [rbp + 4]
mov qword [rsp + 0x20], rcx
lea r8, [rbp + 0x58]
lea rdx, [rbp + 0x18]
mov r12d, ebx
lea rcx, [rsp + 0x68]
lea r9d, [rbx + 1]
call rax
movsxd rcx, dword [rsp + 0x68]
lea edx, [rbx + 8]
call fcn.1400c537c
mov qword [rbp - 0x78], rax
mov rdi, rax
test rax, rax
je 0x14003e22c
mov esi, ebx
cmp dword [rsp + 0x68], ebx
jle 0x14003df24
mov edi, ebx
mov rcx, qword [rbp + 0x18]
mov rcx, qword [rdi + rcx]
call fcn.14002e6e0
mov rbx, rax
mov rax, qword [rbp - 0x78]
mov qword [rdi + rax], rbx
movzx ecx, byte [rbx]
sub ecx, 0x2f
jne 0x14003dea8
movzx ecx, byte [rbx + 1]
sub ecx, 0x57
jne 0x14003dea8
movzx ecx, byte [rbx + 2]
xor edx, edx
movzx eax, dl
sub ecx, eax
jmp 0x14003deaa
xor edx, edx
test ecx, ecx
mov eax, 0x96
cmove r15d, eax
cmp byte [rbx], 0x2d
mov dword [rbp - 0x68], r15d
jne 0x14003deca
cmp byte [rbx + 1], 0x67
jne 0x14003deca
cmp byte [rbx + 2], r12b
je 0x14003def3
mov rcx, rdx
lea rdx, str.__gui
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rbx + rcx]
inc rcx
cmp al, byte [rdx + rcx - 1]
jne 0x14003def9
cmp rcx, 6
jne 0x14003dee0
mov r14d, 1
lea rdx, str._InvokerPRAID
mov rcx, rbx
call fcn.140108174
test eax, eax
je 0x14003ddd2
inc esi
add rdi, 8
cmp esi, dword [rsp + 0x68]
jl 0x14003de72
mov rdi, qword [rbp - 0x78]
mov rcx, qword [rdi]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp byte [rcx + rax], r12b
jne 0x14003df30
lea rbx, [rcx - 1]
add rbx, rax
cmp rbx, rcx
jbe 0x14003df52
cmp byte [rbx], 0x5c
je 0x14003df52
dec rbx
cmp rbx, rcx
ja 0x14003df45
mov edx, 0x70
mov rcx, rbx
call fcn.1400b35d4
test rax, rax
jne 0x14003df87
lea edx, [rax + 0x50]
mov rcx, rbx
call fcn.1400b35d4
test rax, rax
je 0x14003df8c
mov edx, 0x50
mov rcx, rbx
call fcn.1400b35d4
cmp byte [rax + 1], 0x48
je 0x14003df8c
mov byte [rsp + 0x70], 0x61
test r14d, r14d
jne 0x14003e020
mov ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_AttachConsole]
test eax, eax
je 0x14003e020
lea rcx, str.Enabling_console_line_hogger
call fcn.14004f910
mov ebx, 1
xor ecx, ecx
mov dword [rbp - 0x3c], ebx
call fcn.1400c5538
mov r8, rax
lea rdx, [0x14015af50]
lea rcx, str.CONIN_
call fcn.1400c5334
mov ecx, ebx
call fcn.1400c5538
mov r8, rax
lea rdx, [0x14014fa14]
lea rcx, str.CONOUT_
call fcn.1400c5334
lea ecx, [rbx + 1]
call fcn.1400c5538
mov r8, rax
lea rdx, [0x14014fa14]
lea rcx, str.CONOUT_
call fcn.1400c5334
call fcn.1400c5ef0
call fcn.14003d0e0
mov qword [rbp + 0x10], rax
jmp 0x14003e025
mov ebx, 1
mov ecx, dword [rsp + 0x68]
lea r9, [rbp + 0x60]
xor eax, eax
lea r8, str.ghxf:i:l:w:z:
mov dword [rsp + 0x28], eax
mov rdx, rdi
lea rax, [rbp - 0x4c]
mov qword [rsp + 0x20], rax
call fcn.140070110
cmp eax, 0xffffffff
je 0x14003e22c
xor esi, esi
nop word [rax + rax]
add eax, 0xffffff9f
cmp eax, 0x19
ja case.0x14003e089.98
lea r15, [0x140000000]
cdqe
movzx eax, byte [r15 + rax + 0x419e8]
mov ecx, dword [r15 + rax*4 + 0x419c4]
add rcx, r15
jmp rcx
mov dword [0x14019f5c4], ebx
jmp case.0x14003e089.97
mov rcx, qword [0x14019f508]
call fcn.1400e9080
xor eax, eax
mov edx, 0x104
mov rcx, rbx
mov qword [0x14019f508], rax
call fcn.1400c537c
mov qword [0x14019f508], rax
mov rsi, rax
test rax, rax
je 0x14003e1c0
mov rcx, qword [0x1401e66c8]
call fcn.14002e7b0
mov edx, 2
mov ecx, 0x104
mov r14, rax
call fcn.1400c537c
lea r9, [rbp + 0x190]
mov r8, rax
mov edx, 0x104
mov rcx, r14
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r15d, eax
test ebx, ebx
je 0x14003e14d
xor eax, eax
mov r8, rdi
mov qword [rsp + 0x38], rax
xor edx, edx
mov qword [rsp + 0x30], rax
mov ecx, 0xfde9
mov dword [rsp + 0x28], 0x104
lea r9d, [rax - 1]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x14003e14d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r15d, eax
test rdi, rdi
je 0x14003e15a
mov rcx, rdi
call fcn.1400e9080
test r14, r14
je 0x14003e167
mov rcx, r14
call fcn.1400e9080
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [0x14019f508]
call fcn.14002f5a0
test al, 0x10
je 0x14003e1b1
mov rdx, qword [0x14019f508]
lea rcx, str.Could_not_find_image__s_n
call fcn.14002d680
mov rcx, qword [0x14019f508]
call fcn.1400e9080
mov rdi, qword [rbp - 0x78]
xor esi, esi
mov qword [0x14019f508], rsi
lea ebx, [rsi + 1]
jmp case.0x14003e089.97
mov rdi, qword [rbp - 0x78]
mov ebx, 1
mov dword [0x1401e2a24], ebx
xor esi, esi
mov ecx, dword [rsp + 0x68]
lea rax, [rbp - 0x4c]
mov dword [rsp + 0x28], esi
lea r9, [rbp + 0x60]
lea r8, str.ghxf:i:l:w:z:
mov qword [rsp + 0x20], rax
mov rdx, rdi
call fcn.140070110
cmp eax, 0xffffffff
jne 0x14003e060
test r12d, r12d
je 0x14003e22c
lea rcx, str.Command_line_arguments:
call fcn.14004f910
cmp dword [rsp + 0x68], 1
mov edi, ebx
jle 0x14003e22c
mov rbx, qword [rbp - 0x78]
add rbx, 8
mov rdx, qword [rbx]
lea rcx, [0x14014f9f0]
call fcn.14004f910
inc edi
lea rbx, [rbx + 8]
cmp edi, dword [rsp + 0x68]
jl 0x14003e211
cmp dword [0x1401a03d8], 0
je 0x14003e241
lea rcx, str.AppStore_version_detected
call fcn.14004f910
lea rcx, [0x1401e8240]
mov edx, 0x104
mov qword [rsp + 0x20], rcx
lea r9, str._srufus.ini
lea rcx, [rbp + 0x480]
mov r8, 0xffffffffffffffff
call fcn.140004960
xor r12d, r12d
mov byte [rbp + 0x583], 0
lea rcx, [rbp + 0x480]
mov qword [rbp + 0x180], r12
call fcn.14002e7b0
mov rsi, rax
cmp byte [rsp + 0x70], r12b
jne 0x14003e4d0
mov r15d, 1
lea edx, [r12 + 2]
mov ecx, r15d
call fcn.1400c537c
mov rbx, rax
jmp 0x14003e545
mov rax, qword [0x1401e66c8]
movzx ecx, byte [rax]
call fcn.1400fe0a0
test eax, eax
je 0x14003e2df
mov rcx, qword [0x1401e66c8]
xor r8d, r8d
xor edx, edx
call fcn.140102588
mov dword [rsp + 0x6c], eax
jmp case.0x14003e089.97
mov rcx, qword [rbp - 0x60]
call fcn.1400e9080
mov rcx, qword [0x1401e66c8]
test rcx, rcx
jne 0x14003e2fd
mov qword [rbp - 0x60], rsi
jmp case.0x14003e089.97
call fcn.1400fcc44
mov qword [rbp - 0x60], rax
jmp case.0x14003e089.97
mov rax, qword [0x1401e66c8]
movzx ecx, byte [rax]
call fcn.1400fe0a0
test eax, eax
je 0x14003e339
mov rcx, qword [0x1401e66c8]
xor r8d, r8d
xor edx, edx
call fcn.140102588
mov ebx, eax
mov dword [0x1401977f8], eax
jmp 0x14003e38e
xor eax, eax
lea rdi, [0x14014ffa0]
mov ebx, eax
mov rax, qword [rdi]
lea r8, str._NULL_
mov rcx, qword [0x1401e66c8]
test rax, rax
mov rdx, r8
cmovne rdx, rax
test rcx, rcx
cmove rcx, r8
call fcn.140108174
test eax, eax
je 0x14003e382
inc ebx
add rdi, 8
cmp ebx, 9
jb 0x14003e344
mov ebx, dword [0x1401977f8]
jmp 0x14003e388
mov dword [0x1401977f8], ebx
mov rdi, qword [rbp - 0x78]
xor esi, esi
lea eax, [rbx + 1]
cmp eax, 9
jbe 0x14003e3a1
mov ebx, 0xffffffff
mov dword [0x1401977f8], ebx
mov dword [0x1401977fc], ebx
mov ebx, 1
jmp case.0x14003e089.97
mov rcx, qword [0x1401e66c8]
call fcn.140108ec0
mov dword [rbp - 0x68], eax
jmp case.0x14003e089.97
mov rcx, qword [0x1401e66c8]
xor edx, edx
lea r8d, [rdx + 0x10]
call fcn.140102588
mov dword [rsp + 0x74], eax
jmp case.0x14003e089.97
mov r12d, ebx
jmp case.0x14003e089.97
mov rcx, qword [rdi]
lea r9, [rbp + 0x590]
xor r12d, r12d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], r12
call fcn.14010b9e8
lea rdx, [rbp + 0x590]
lea rcx, str._nUsage:__s___x____g____h____f_FILESYSTEM____i_PATH____l_LOCALE____w_TIMEOUT__n
call fcn.14002d680
lea rcx, str.___x____extra_devs_n
call fcn.14002d680
lea rcx, str._____List_extra_devices__such_as_USB_HDDs_n
call fcn.14002d680
lea rcx, str.___g____gui_n
call fcn.14002d680
lea rcx, str._____Start_in_GUI_mode__disable_the_rufus.com_commandline_hogger__n
call fcn.14002d680
lea rcx, str.___i_PATH____isoPATH_n
call fcn.14002d680
lea rcx, str._____Select_the_ISO_image_pointed_by_PATH_to_be_used_on_startup_n
call fcn.14002d680
lea rcx, str.___l_LOCALE____localeLOCALE_n
call fcn.14002d680
lea rcx, str._____Select_the_locale_to_be_used_on_startup_n
call fcn.14002d680
lea rcx, str.___f_FILESYSTEM____filesystemFILESYSTEM_n
call fcn.14002d680
lea rcx, str._____Preselect_the_file_system_to_be_preferred_when_formatting_n
call fcn.14002d680
lea rcx, str.___w_TIMEOUT____waitTIMEOUT_n
call fcn.14002d680
lea rcx, str._____Wait_TIMEOUT_tens_of_seconds_for_the_global_application_mutex_to_be_released._n
call fcn.14002d680
lea rcx, str._____Used_when_launching_a_newer_version_of_Rufus_from_a_running_application._n
call fcn.14002d680
lea rcx, str.___h____help_n
call fcn.14002d680
lea rcx, str._____This_usage_guide._n
call fcn.14002d680
jmp 0x14003f516
mov dword [rsp + 0x28], r12d
lea r8, [rsp + 0x70]
mov r9d, 0xffffffff
mov qword [rsp + 0x20], r12
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rdi, eax
cmp edi, 1
jle 0x14003e53c
mov rcx, rdi
mov edx, 2
call fcn.1400c537c
mov rbx, rax
test rax, rax
je 0x14003e53c
mov dword [rsp + 0x28], edi
lea r8, [rsp + 0x70]
mov r9d, 0xffffffff
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, edi
je 0x14003e53f
mov rcx, rbx
call fcn.1400e9080
mov rbx, r12
mov r15d, 1
mov r8, rbx
lea rcx, [rbp + 0x180]
mov rdx, rsi
call fcn.1400e94b0
test rsi, rsi
je 0x14003e564
mov rcx, rsi
call fcn.1400e9080
test rbx, rbx
je 0x14003e571
mov rcx, rbx
call fcn.1400e9080
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.140029520
test rax, rax
lea rcx, str._NULL_
lea rdx, [0x14015fd80]
cmove rax, rcx
mov rcx, rax
call fcn.140113960
mov rdi, qword [rbp + 0x180]
test eax, eax
mov r14d, r12d
sete r14b
or r14d, r13d
lea r13, [0x1401e8240]
mov dword [rsp + 0x7c], r14d
test rdi, rdi
je 0x14003e60d
lea rax, [rbp + 0x480]
mov qword [0x14019f500], rax
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rax + r13], r12b
jne 0x14003e5d3
inc rax
lea rsi, [0x1401e8720]
mov ebx, 0x104
mov rdx, r13
cmp rax, rbx
mov rcx, rsi
cmovb rbx, rax
mov r8, rbx
call fcn.1401362c0
mov rcx, rdi
mov byte [rbx + rsi - 1], r12b
call fcn.1400e9730
cmp qword [0x14019f500], r12
lea rax, str.INI_file
lea rdx, str.registry
cmovne rdx, rax
lea rcx, str.Will_use_settings_from__s
call fcn.14004f910
lea rcx, str.Locale
call fcn.1400302a0
cmp byte [rax], r12b
je 0x14003e65e
mov rcx, rax
call fcn.1400fcc44
mov rdx, rax
mov qword [rbp - 0x60], rax
lea rcx, str.found_locale__s
call fcn.14004f910
mov rdx, qword [0x14019f500]
test rdx, rdx
je 0x14003e69f
mov r8d, r15d
lea rcx, str.ShowAdvancedDriveProperties
mov edi, r12d
call fcn.140026d90
mov rbx, rax
test rax, rax
je 0x14003e69b
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.140102588
mov rcx, rbx
mov edi, eax
call fcn.1400e9080
test edi, edi
jmp 0x14003e6ca
lea r9, [rsp + 0x60]
mov dword [rsp + 0x20], 4
mov r8d, 4
lea rdx, str.ShowAdvancedDriveProperties
mov rcx, 0xffffffff80000001
call fcn.14002fa70
cmp dword [rsp + 0x60], r12d
mov rdx, qword [0x14019f500]
mov ecx, r12d
setne cl
mov dword [0x1401e8344], ecx
test rdx, rdx
je 0x14003e717
mov r8d, r15d
lea rcx, str.ShowAdvancedFormatOptions
mov edi, r12d
call fcn.140026d90
mov rbx, rax
test rax, rax
je 0x14003e713
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.140102588
mov rcx, rbx
mov edi, eax
call fcn.1400e9080
test edi, edi
jmp 0x14003e742
lea r9, [rsp + 0x60]
mov dword [rsp + 0x20], 4
mov r8d, 4
lea rdx, str.ShowAdvancedFormatOptions
mov rcx, 0xffffffff80000001
call fcn.14002fa70
cmp dword [rsp + 0x60], r12d
mov rdx, qword [0x14019f500]
mov ecx, r12d
setne cl
mov dword [0x1401e8348], ecx
test rdx, rdx
je 0x14003e78f
mov r8d, r15d
lea rcx, str.PreserveTimestamps
mov edi, r12d
call fcn.140026d90
mov rbx, rax
test rax, rax
je 0x14003e78b
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.140102588
mov rcx, rbx
mov edi, eax
call fcn.1400e9080
test edi, edi
jmp 0x14003e7ba
lea r9, [rsp + 0x60]
mov dword [rsp + 0x20], 4
mov r8d, 4
lea rdx, str.PreserveTimestamps
mov rcx, 0xffffffff80000001
call fcn.14002fa70
cmp dword [rsp + 0x60], r12d
mov rdx, qword [0x14019f500]
mov ecx, r12d
setne cl
mov dword [0x14019f538], ecx
test rdx, rdx
je 0x14003e807
mov r8d, r15d
lea rcx, str.UseProperSizeUnits
mov edi, r12d
call fcn.140026d90
mov rbx, rax
test rax, rax
je 0x14003e803
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.140102588
mov rcx, rbx
mov edi, eax
call fcn.1400e9080
test edi, edi
jmp 0x14003e832
lea r9, [rsp + 0x60]
mov dword [rsp + 0x20], 4
mov r8d, 4
lea rdx, str.UseProperSizeUnits
mov rcx, 0xffffffff80000001
call fcn.14002fa70
cmp dword [rsp + 0x60], r12d
mov ecx, r12d
mov qword [rbp + 0x180], r12
sete cl
mov qword [rbp + 0x170], r12
mov dword [0x1401e8358], ecx
mov edx, 6
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov qword [rsp + 0x40], r12
xor r9d, r9d
mov dword [rsp + 0x38], r12d
xor r8d, r8d
mov qword [rsp + 0x30], r12
xor ecx, ecx
mov dword [rsp + 0x28], 3
lea edx, [r9 - 1]
mov dword [rsp + 0x20], 2
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
xor edx, edx
lea rax, [rbp + 0x170]
lea r9, [0x140138e40]
mov qword [rsp + 0x20], rax
lea rcx, [0x140157e00]
lea r8d, [rdx + 0x14]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov ebx, eax
test eax, eax
je 0x14003e8cc
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
call fcn.140050120
lea rcx, str.Notice:_Disabling_VDS__Could_not_create_VDS_Loader_Instance:__s_
jmp 0x14003e901
mov rcx, qword [rbp + 0x170]
lea r8, [rbp + 0x180]
lea rdx, [0x1401560f4]
mov rax, qword [rcx]
call qword [rax + 0x18]
mov ebx, eax
test eax, eax
je 0x14003e909
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
call fcn.140050120
lea rcx, str.Notice:_Disabling_VDS__Could_not_load_VDS_Service:__s_
mov rdx, rax
call fcn.14004f910
mov rcx, qword [rbp + 0x180]
test rcx, rcx
je 0x14003e91b
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x170]
test rcx, rcx
je 0x14003e92d
mov rax, qword [rcx]
call qword [rax + 0x10]
test ebx, ebx
je 0x14003e943
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [0x14019f0a0], 0xc003001f
mov rdx, qword [0x14019f500]
test ebx, ebx
mov eax, r12d
sete al
mov dword [0x1401954e8], eax
test rdx, rdx
je 0x14003e992
mov r8d, r15d
lea rcx, str.UseVds
mov edi, r12d
call fcn.140026d90
mov rbx, rax
test rax, rax
je 0x14003e98e
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.140102588
mov rcx, rbx
mov edi, eax
call fcn.1400e9080
test edi, edi
jmp 0x14003e9bd
lea r9, [rsp + 0x60]
mov dword [rsp + 0x20], 4
mov r8d, 4
lea rdx, str.UseVds
mov rcx, 0xffffffff80000001
call fcn.14002fa70
cmp dword [rsp + 0x60], r12d
mov ecx, r12d
setne cl
test ecx, ecx
je 0x14003e9d3
cmp dword [0x1401954e8], r12d
mov eax, r15d
jne 0x14003e9d6
mov eax, r12d
mov rdx, qword [0x14019f500]
mov dword [0x14019f514], eax
test rdx, rdx
je 0x14003ea1d
mov r8d, r15d
lea rcx, str.EnableUsbDebug
mov edi, r12d
call fcn.140026d90
mov rbx, rax
test rax, rax
je 0x14003ea19
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.140102588
mov rcx, rbx
mov edi, eax
call fcn.1400e9080
test edi, edi
jmp 0x14003ea48
lea r9, [rsp + 0x60]
mov dword [rsp + 0x20], 4
mov r8d, 4
lea rdx, str.EnableUsbDebug
mov rcx, 0xffffffff80000001
call fcn.14002fa70
cmp dword [rsp + 0x60], r12d
mov rdx, qword [0x14019f500]
mov eax, r12d
setne al
mov dword [0x1401e8840], eax
xor eax, 1
lea eax, [rax*2 + 1]
mov dword [0x140196fa4], eax
test rdx, rdx
je 0x14003eaa5
mov r8d, r15d
lea rcx, str.DisableRufusMBR
mov edi, r12d
call fcn.140026d90
mov rbx, rax
test rax, rax
je 0x14003eaa1
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.140102588
mov rcx, rbx
mov edi, eax
call fcn.1400e9080
test edi, edi
jmp 0x14003ead0
lea r9, [rsp + 0x60]
mov dword [rsp + 0x20], 4
mov r8d, 4
lea rdx, str.DisableRufusMBR
mov rcx, 0xffffffff80000001
call fcn.14002fa70
cmp dword [rsp + 0x60], r12d
mov rdx, qword [0x14019f500]
mov ecx, r12d
sete cl
mov dword [0x140196f40], ecx
test rdx, rdx
je 0x14003eb1d
mov r8d, r15d
lea rcx, str.DisableFakeDrivesCheck
mov edi, r12d
call fcn.140026d90
mov rbx, rax
test rax, rax
je 0x14003eb19
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.140102588
mov rcx, rbx
mov edi, eax
call fcn.1400e9080
test edi, edi
jmp 0x14003eb48
lea r9, [rsp + 0x60]
mov dword [rsp + 0x20], 4
mov r8d, 4
lea rdx, str.DisableFakeDrivesCheck
mov rcx, 0xffffffff80000001
call fcn.14002fa70
cmp dword [rsp + 0x60], r12d
mov rdx, qword [0x14019f500]
mov ecx, r12d
sete cl
mov dword [0x1401e8a70], ecx
test rdx, rdx
je 0x14003eb95
mov r8d, r15d
lea rcx, str.EnableWindowsDualUefiBiosMode
mov edi, r12d
call fcn.140026d90
mov rbx, rax
test rax, rax
je 0x14003eb91
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.140102588
mov rcx, rbx
mov edi, eax
call fcn.1400e9080
test edi, edi
jmp 0x14003ebc0
lea r9, [rsp + 0x60]
mov dword [rsp + 0x20], 4
mov r8d, 4
lea rdx, str.EnableWindowsDualUefiBiosMode
mov rcx, 0xffffffff80000001
call fcn.14002fa70
cmp dword [rsp + 0x60], r12d
mov rdx, qword [0x14019f500]
mov ecx, r12d
setne cl
mov dword [0x1401e86f8], ecx
test rdx, rdx
je 0x14003ec0d
mov r8d, r15d
lea rcx, str.ForceLargeFat32Formatting
mov edi, r12d
call fcn.140026d90
mov rbx, rax
test rax, rax
je 0x14003ec09
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.140102588
mov rcx, rbx
mov edi, eax
call fcn.1400e9080
test edi, edi
jmp 0x14003ec38
lea r9, [rsp + 0x60]
mov dword [rsp + 0x20], 4
mov r8d, 4
lea rdx, str.ForceLargeFat32Formatting
mov rcx, 0xffffffff80000001
call fcn.14002fa70
cmp dword [rsp + 0x60], r12d
mov rdx, qword [0x14019f500]
mov ecx, r12d
setne cl
mov dword [0x1401e8824], ecx
test rdx, rdx
je 0x14003ec85
mov r8d, r15d
lea rcx, str.EnableVmdkDetection
mov edi, r12d
call fcn.140026d90
mov rbx, rax
test rax, rax
je 0x14003ec81
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.140102588
mov rcx, rbx
mov edi, eax
call fcn.1400e9080
test edi, edi
jmp 0x14003ecb0
lea r9, [rsp + 0x60]
mov dword [rsp + 0x20], 4
mov r8d, 4
lea rdx, str.EnableVmdkDetection
mov rcx, 0xffffffff80000001
call fcn.14002fa70
cmp dword [rsp + 0x60], r12d
mov rdx, qword [0x14019f500]
mov ecx, r12d
setne cl
mov dword [0x1401e8210], ecx
test rdx, rdx
je 0x14003ecfd
mov r8d, r15d
lea rcx, str.EnableFileIndexing
mov edi, r12d
call fcn.140026d90
mov rbx, rax
test rax, rax
je 0x14003ecf9
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.140102588
mov rcx, rbx
mov edi, eax
call fcn.1400e9080
test edi, edi
jmp 0x14003ed28
lea r9, [rsp + 0x60]
mov dword [rsp + 0x20], 4
mov r8d, 4
lea rdx, str.EnableFileIndexing
mov rcx, 0xffffffff80000001
call fcn.14002fa70
cmp dword [rsp + 0x60], r12d
mov rdx, qword [0x14019f500]
mov ecx, r12d
setne cl
mov dword [0x1401e8828], ecx
test rdx, rdx
je 0x14003ed75
mov r8d, r15d
lea rcx, str.DisableVHDs
mov edi, r12d
call fcn.140026d90
mov rbx, rax
test rax, rax
je 0x14003ed71
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.140102588
mov rcx, rbx
mov edi, eax
call fcn.1400e9080
test edi, edi
jmp 0x14003eda0
lea r9, [rsp + 0x60]
mov dword [rsp + 0x20], 4
mov r8d, 4
lea rdx, str.DisableVHDs
mov rcx, 0xffffffff80000001
call fcn.14002fa70
cmp dword [rsp + 0x60], r12d
mov rdx, qword [0x14019f500]
mov ecx, r12d
sete cl
mov dword [0x140196f74], ecx
test rdx, rdx
je 0x14003eded
mov r8d, r15d
lea rcx, str.EnableExtraHashes
mov edi, r12d
call fcn.140026d90
mov rbx, rax
test rax, rax
je 0x14003ede9
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.140102588
mov rcx, rbx
mov edi, eax
call fcn.1400e9080
test edi, edi
jmp 0x14003ee18
lea r9, [rsp + 0x60]
mov dword [rsp + 0x20], 4
mov r8d, 4
lea rdx, str.EnableExtraHashes
mov rcx, 0xffffffff80000001
call fcn.14002fa70
cmp dword [rsp + 0x60], r12d
mov rdx, qword [0x14019f500]
mov ecx, r12d
setne cl
mov dword [0x1401a0400], ecx
test rdx, rdx
je 0x14003ee65
mov r8d, r15d
lea rcx, str.ExpertMode
mov edi, r12d
call fcn.140026d90
mov rbx, rax
test rax, rax
je 0x14003ee61
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.140102588
mov rcx, rbx
mov edi, eax
call fcn.1400e9080
test edi, edi
jmp 0x14003ee90
lea r9, [rsp + 0x60]
mov dword [rsp + 0x20], 4
mov r8d, 4
lea rdx, str.ExpertMode
mov rcx, 0xffffffff80000001
call fcn.14002fa70
cmp dword [rsp + 0x60], r12d
mov rdx, qword [0x14019f500]
mov ecx, r12d
setne cl
mov dword [0x14019f5a8], ecx
test rdx, rdx
je 0x14003eedd
mov r8d, r15d
lea rcx, str.IgnoreBootMarker
mov edi, r12d
call fcn.140026d90
mov rbx, rax
test rax, rax
je 0x14003eed9
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.140102588
mov rcx, rbx
mov edi, eax
call fcn.1400e9080
test edi, edi
jmp 0x14003ef08
lea r9, [rsp + 0x60]
mov dword [rsp + 0x20], 4
mov r8d, 4
lea rdx, str.IgnoreBootMarker
mov rcx, 0xffffffff80000001
call fcn.14002fa70
cmp dword [rsp + 0x60], r12d
mov rdx, qword [0x14019f500]
mov ecx, r12d
setne cl
mov dword [0x14019f5b0], ecx
test rdx, rdx
je 0x14003ef55
mov r8d, r15d
lea rcx, str.PersistentLog
mov edi, r12d
call fcn.140026d90
mov rbx, rax
test rax, rax
je 0x14003ef51
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.140102588
mov rcx, rbx
mov edi, eax
call fcn.1400e9080
test edi, edi
jmp 0x14003ef80
lea r9, [rsp + 0x60]
mov dword [rsp + 0x20], 4
mov r8d, 4
lea rdx, str.PersistentLog
mov rcx, 0xffffffff80000001
call fcn.14002fa70
cmp dword [rsp + 0x60], r12d
mov ecx, r12d
setne cl
mov dword [0x14019f59c], ecx
lea rcx, str.PreferredSaveImageType
call fcn.1400302a0
mov rdx, qword [0x14019f500]
mov qword [0x1401a03d0], rax
test rdx, rdx
je 0x14003efde
mov r8d, r15d
lea rcx, str.WindowsUserExperienceOptions
mov ebx, r12d
call fcn.140026d90
mov rdi, rax
test rax, rax
je 0x14003f008
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.140102588
mov rcx, rdi
mov ebx, eax
call fcn.1400e9080
jmp 0x14003f008
lea r9, [rsp + 0x60]
mov dword [rsp + 0x20], 4
mov r8d, 4
lea rdx, str.WindowsUserExperienceOptions
mov rcx, 0xffffffff80000001
call fcn.14002fa70
mov ebx, dword [rsp + 0x60]
mov ecx, ebx
shr ecx, 0x10
test ecx, ecx
je 0x14003f025
mov eax, ecx
and ecx, ebx
not eax
and eax, dword [0x140196f98]
or eax, ecx
mov dword [0x140196f98], eax
mov rdx, qword [0x14019f500]
test rdx, rdx
je 0x14003f064
mov r8d, r15d
lea rcx, str.DefaultThreadPriority
mov edi, r12d
call fcn.140026d90
mov rbx, rax
test rax, rax
je 0x14003f08e
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.140102588
mov rcx, rbx
mov edi, eax
call fcn.1400e9080
jmp 0x14003f08e
lea r9, [rsp + 0x60]
mov dword [rsp + 0x20], 4
mov r8d, 4
lea rdx, str.DefaultThreadPriority
mov rcx, 0xffffffff80000001
call fcn.14002fa70
mov edi, dword [rsp + 0x60]
lea eax, [rdi + 1]
xor ecx, ecx
mov dword [0x140196f64], eax
call qword [sym.imp.USER32.dll_GetDC]
mov rcx, rax
mov edx, 0x58
mov rbx, rax
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
lea rcx, [rbx - 1]
movd xmm0, eax
cvtdq2ps xmm0, xmm0
divss xmm0, dword [0x140176fb0]
movss dword [0x140196f6c], xmm0
cmp rcx, 0xfffffffffffffffd
ja 0x14003f0dc
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
xor ecx, ecx
call fcn.14001fef0
lea rax, str.rufus.loc
mov edx, 0x104
mov qword [rsp + 0x28], rax
lea r9, [0x1401638d0]
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x20], r13
lea rcx, [rbp + 0x260]
call fcn.140004960
lea rcx, [rbp + 0x260]
mov byte [rbp + 0x363], r12b
call fcn.14002e7b0
mov rdi, rax
cmp word [rax], 0x22
jne 0x14003f178
mov rax, 0xffffffffffffffff
nop word [rax + rax]
cmp word [rdi + rax*2 + 2], r12w
lea rax, [rax + 1]
jne 0x14003f140
cmp word [rdi + rax*2 - 2], 0x22
jne 0x14003f178
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
cmp word [rdi + rax*2 + 2], r12w
lea rax, [rax + 1]
jne 0x14003f160
mov word [rdi + rax*2 - 2], r12w
lea rcx, [rdi + 2]
jmp 0x14003f17b
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
mov ebx, eax
call fcn.1400e9080
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp esi, 0xffffffff
jne 0x14003f8f6
lea rcx, str.loc_file_not_found_in_current_directory___embedded_one_will_be_used
call fcn.14004f910
mov rbx, qword [0x1401e8838]
mov edx, 0x1f4
mov rcx, rbx
mov r8d, 0xa
mov r13, r12
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdi, rax
test rax, rax
jne 0x14003f1f8
call fcn.140050120
mov r8, rax
lea rdx, str.embedded.loc
lea rcx, str.Could_not_locate_resource__s:__s
call fcn.14004f910
mov r12d, dword [rsp + 0x60]
jmp 0x14003f249
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
test rax, rax
jne 0x14003f22e
call fcn.140050120
mov r8, rax
lea rdx, str.embedded.loc
lea rcx, str.Could_not_load_resource__s:__s
call fcn.14004f910
mov r12d, dword [rsp + 0x60]
jmp 0x14003f249
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, rsi
mov r12d, eax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r13, rax
lea rcx, [0x1401e84c0]
call fcn.14002e7b0
cmp byte [0x1401569ec], 0
mov r14, rax
jne 0x14003f273
mov edx, 2
mov rcx, r15
call fcn.1400c537c
mov rbx, rax
jmp 0x14003f2e0
xor esi, esi
lea r15, [0x1401569ec]
mov dword [rsp + 0x28], esi
mov r8, r15
xor edx, edx
mov qword [rsp + 0x20], rsi
mov ecx, 0xfde9
lea r9d, [rsi - 1]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rdi, eax
cmp edi, 1
jle 0x14003f2dd
mov rcx, rdi
lea edx, [rsi + 2]
call fcn.1400c537c
mov rbx, rax
test rax, rax
je 0x14003f2dd
mov dword [rsp + 0x28], edi
lea r9d, [rsi - 1]
mov r8, r15
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, edi
je 0x14003f2e0
mov rcx, rbx
call fcn.1400e9080
mov rbx, rsi
mov edx, 2
mov ecx, 0x104
call fcn.1400c537c
mov r9, rax
xor r8d, r8d
mov rdx, rbx
mov rcx, r14
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r15d, eax
test esi, esi
je 0x14003f358
xor eax, eax
mov r9d, 0xffffffff
mov qword [rsp + 0x38], rax
mov r8, rdi
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0x260]
mov dword [rsp + 0x28], 0x104
mov ecx, 0xfde9
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
test eax, eax
jne 0x14003f358
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r15d, eax
test rdi, rdi
je 0x14003f365
mov rcx, rdi
call fcn.1400e9080
test rbx, rbx
je 0x14003f372
mov rcx, rbx
call fcn.1400e9080
test r14, r14
je 0x14003f37f
mov rcx, r14
call fcn.1400e9080
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
je 0x14003f8c9
cmp byte [rbp + 0x260], 0
je 0x14003f8c9
lea rcx, [rbp + 0x260]
call fcn.14002e7b0
mov rdi, rax
mov r15d, 1
xor eax, eax
xor r9d, r9d
mov qword [rsp + 0x30], rax
mov r8d, r15d
mov dword [rsp + 0x28], 0x80
mov edx, 0xc0000000
mov rcx, rdi
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test rdi, rdi
je 0x14003f3f5
mov rcx, rdi
call fcn.1400e9080
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp rbx, 0xffffffffffffffff
je 0x14003f4c2
lea r9, [rbp - 0x48]
mov r8d, r12d
mov rdx, r13
mov rcx, rbx
call fcn.140050f30
test eax, eax
je 0x14003f4c2
lea rdx, [rbp + 0x260]
lea rcx, str.localization:_extracted_data_to__s
call fcn.14004f910
test rbx, rbx
je 0x14003f442
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r14d, dword [rsp + 0x7c]
lea rsi, [0x1401e67a0]
xor r12d, r12d
lea rcx, [rbp + 0x260]
call fcn.1400261b0
test eax, eax
je 0x14003f498
mov rax, qword [rbp - 0x60]
test rax, rax
jne 0x14003f9d8
mov r8, qword [0x14019f0d8]
lea r10, [0x14019f0d0]
cmp r8, r10
jne 0x14003f974
lea rcx, str.localization:_the_locale_list_is_empty__n
call fcn.14004f910
mov qword [0x14019f558], r12
lea rcx, str.FATAL:_Could_not_access_locale_
call fcn.14004f910
mov r9d, 0x1010
lea r8, str.Fatal_error
lea rdx, str.The_locale_data_is_missing_or_invalid._This_application_will_now_exit.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x14003f50f
call fcn.140050120
mov r8, rax
lea rdx, [rbp + 0x260]
lea rcx, str.FATAL:_Unable_to_extract_loc_file__s:__s
call fcn.14004f910
lea rax, [rbx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14003f4f0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r9d, 0x1010
lea r8, str.Fatal_error
lea rdx, str.Unable_to_extract_localization_file._This_application_will_now_exit.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor r12d, r12d
lea r15, [0x140000000]
lea rcx, [0x1401e8240]
call fcn.14002e7b0
mov rcx, rax
mov rbx, rax
call fcn.14010389c
test rbx, rbx
je 0x14003f53a
mov rcx, rbx
call fcn.1400e9080
mov rbx, qword [rbp + 0x10]
test rbx, rbx
je 0x14003f593
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
cmp rbx, 0xffffffffffffffff
je 0x14003f55b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.rufus.com
mov ebx, r12d
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x14003f593
nop
cmp ebx, 0xa
jg 0x14003f593
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.rufus.com
inc ebx
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x14003f570
mov rcx, qword [0x14019f4f8]
mov r14d, 1
test rcx, rcx
je 0x14003f5ae
mov edx, r14d
call qword [sym.imp.KERNEL32.dll_TerminateThread]
cmp dword [rbp - 0x44], 0
jne 0x14003f613
cmp byte [rbp + 0x260], 0
je 0x14003f613
lea rcx, [rbp + 0x260]
call fcn.14002e7b0
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test rbx, rbx
je 0x14003f5ec
mov rcx, rbx
call fcn.1400e9080
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
jne 0x14003f613
call fcn.140050120
mov r8, rax
lea rdx, [rbp + 0x260]
lea rcx, str.Could_not_delete__s:__s
call fcn.14004f910
lea rbx, [0x1401e41b8]
mov edi, 0x80
nop
mov rcx, qword [rbx - 0x18]
test rcx, rcx
je 0x14003f646
call qword [sym.imp.USER32.dll_DestroyWindow]
mov rcx, qword [rbx]
call fcn.1400e9080
mov qword [rbx], r12
mov qword [rbx - 8], r12
mov qword [rbx - 0x18], r12
mov qword [rbx - 0x10], r12
add rbx, 0x20
sub rdi, 1
jne 0x14003f620
mov rcx, qword [0x1401e4070]
call qword [sym.imp.USER32.dll_UnhookWinEvent]
xor ecx, ecx
mov qword [0x1401e4070], r12
call fcn.1400200b0
mov rcx, qword [0x14019f508]
call fcn.1400e9080
mov rcx, qword [0x14019f528]
mov qword [0x14019f508], r12
call fcn.1400e9080
mov rcx, qword [rbp - 0x60]
mov qword [0x14019f528], r12
call fcn.1400e9080
mov rcx, qword [0x14019f570]
call fcn.1400e9080
mov rcx, qword [0x14019f578]
mov qword [0x14019f570], r12
call fcn.1400e9080
mov rcx, qword [0x14019f0b0]
mov qword [0x14019f578], r12
call fcn.1400e9080
mov rcx, qword [0x14019f588]
mov qword [0x14019f0b0], r12
call fcn.1400e9080
mov rcx, qword [0x14019f4f0]
mov qword [0x14019f588], r12
call fcn.1400e9080
mov rcx, qword [0x1401a03f8]
mov qword [0x14019f4f0], r12
call fcn.1400e9080
mov rsi, qword [rbp - 0x78]
mov qword [0x1401a03f8], r12
test rsi, rsi
je 0x14003f741
cmp dword [rsp + 0x68], 0
mov edi, r12d
jle 0x14003f739
mov rbx, rsi
mov rcx, qword [rbx]
call fcn.1400e9080
mov qword [rbx], r12
lea rbx, [rbx + 8]
inc edi
cmp edi, dword [rsp + 0x68]
jl 0x14003f722
mov rcx, rsi
call fcn.1400e9080
cmp dword [rbp - 0x40], 0
je 0x14003f754
mov ecx, r14d
mov dword [rsp + 0x20], r12d
call fcn.14004e980
cmp dword [rbp - 0x80], 0
jne 0x14003f7df
xor r9d, r9d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80
lea rcx, str..MountPointManager
xor edx, edx
mov dword [rsp + 0x60], r12d
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14003f7d3
mov qword [rsp + 0x38], r12
lea r8, [rsp + 0x60]
mov qword [rsp + 0x30], r12
mov r9d, 4
mov dword [rsp + 0x28], r12d
mov edx, 0x6dc040
mov rcx, rax
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x14003f7df
lea rcx, str.Failed_to_restore_AutoMount_to_disabled
call fcn.14004f910
cmp qword [0x1401d0520], 0
je 0x14003f7fc
lea rdx, [0x1401e67a0]
lea rcx, [0x14014f9f0]
call fcn.14004f910
cmp dword [rbp - 0x3c], 0
mov qword [0x1401d0520], r12
je 0x14003f838
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov dword [rsp + 0x30], 3
xor r9d, r9d
mov rcx, rax
mov dword [rsp + 0x28], r12d
xor r8d, r8d
mov dword [rsp + 0x20], r12d
xor edx, edx
call qword [sym.imp.USER32.dll_SetWindowPos]
call qword [sym.imp.KERNEL32.dll_FreeConsole]
call qword [sym.imp.ole32.dll_CoUninitialize]
movzx eax, word [0x14019f0a4]
test ax, ax
je 0x14003f877
mov ebx, 0xffff
nop
add ax, bx
movzx ecx, ax
mov word [0x14019f0a4], ax
mov rcx, qword [r15 + rcx*8 + 0x1e8860]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
movzx eax, word [0x14019f0a4]
test ax, ax
jne 0x14003f850
mov rcx, qword [rbp - 8]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14003f88b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str._Rufus_exit__n
call fcn.14004f910
xor eax, eax
mov rcx, qword [rbp + 0x690]
xor rcx, rsp
call fcn.1400b1f80
lea r11, [rsp + 0x7a0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140050120
mov rdx, rax
lea rcx, str.FATAL:_Unable_to_create_temp_loc_file:__s
call fcn.14004f910
mov r9d, 0x1010
lea r8, str.Fatal_error
lea rdx, str.Unable_to_create_temporary_localization_file._This_application_will_now_exit.
jmp 0x14003f504
mov rax, qword [0x1401d0520]
lea rsi, [0x1401e67a0]
mov edi, 0xffc
mov dword [rbp - 0x44], r15d
sub rdi, rax
lea r9, str.Using_external_loc_file__s
mov r8, 0xffffffffffffffff
mov rdx, rdi
lea rbx, [rax + rsi]
lea rax, [rbp + 0x260]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.140004960
mov rax, 0xffffffffffffffff
mov byte [rbx + rdi - 1], r12b
inc rax
cmp byte [rsi + rax], r12b
jne 0x14003f945
mov word [rax + rsi], 0xa0d
add rax, 2
mov qword [0x1401d0520], rax
cmp rax, 0x1000
jae 0x1400419bc
mov byte [rax + rsi], r12b
jmp 0x14003f451
mov r9d, dword [rsp + 0x6c]
lea rbx, [r8 - 0x28]
lea rax, [rbx + 0x28]
cmp rax, r10
je 0x14003f9bf
nop word [rax + rax]
movzx eax, byte [rbx + 1]
mov rcx, r12
test al, al
je 0x14003f9b2
mov edx, eax
mov rax, qword [rbx + 0x10]
cmp dword [rax], r9d
je 0x14003f9e6
inc rcx
add rax, 4
cmp rcx, rdx
jl 0x14003f9a1
mov rax, qword [rbx + 0x30]
lea rbx, [rax - 0x28]
cmp rax, r10
jne 0x14003f990
lea rbx, [r8 - 0x28]
mov edx, r9d
mov r8, qword [rbx + 0x18]
lea rcx, str.localization:_could_not_find_locale_for_LCID:_0x_04X._Will_default_to__s_n
call fcn.14004f910
jmp 0x14003f9e6
mov edx, r15d
mov rcx, rax
call fcn.140020fa0
mov rbx, rax
mov qword [0x14019f558], rbx
test rbx, rbx
je 0x14003f498
mov rcx, rbx
call fcn.140021130
lea rcx, [0x1401d0480]
mov word [0x1401941e8], ax
call fcn.14004c040
mov eax, dword [0x1401d0480]
cmp eax, 0x61
jbe 0x140041954
mov ecx, dword [rsp + 0x74]
test ecx, ecx
je 0x14003fa30
mov eax, ecx
mov dword [0x1401d0480], ecx
cmp eax, 0x61
jbe 0x140041954
lea r9, [rsp + 0x60]
mov dword [rsp + 0x6c], r12d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystemEnableLUA
mov qword [rbp + 0x180], 0xffffffffffffffff
mov rcx, 0xffffffff80000002
mov dword [rbp + 0x170], 0
mov word [rbp + 0x174], 0x500
call fcn.14004b080
cmp dword [rsp + 0x60], 1
jne 0x14003fb16
lea rcx, str.Note:_UAC_is_active
call fcn.14004f910
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp + 0x180]
mov edx, 8
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x14003fac3
call fcn.140050120
mov rdx, rax
lea rcx, str.Could_not_get_current_process_token:__s
call fcn.14004f910
jmp 0x14003fb95
mov rcx, qword [rbp + 0x180]
lea rax, [rbp]
mov r9d, 4
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x74]
lea edx, [r9 + 0x10]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x14003fb05
call fcn.140050120
mov rdx, rax
lea rcx, str.Could_not_get_token_information:__s
call fcn.14004f910
jmp 0x14003fb95
cmp dword [rsp + 0x74], 0
mov eax, r12d
setne al
mov dword [rsp + 0x6c], eax
jmp 0x14003fb95
lea rcx, str.Note:_UAC_is_either_disabled_or_not_available
call fcn.14004f910
lea rax, [rbp + 0x190]
mov r9d, 0x220
mov qword [rsp + 0x50], rax
lea rcx, [rbp + 0x170]
mov dword [rsp + 0x48], r12d
mov r8d, 0x20
mov dword [rsp + 0x40], r12d
mov dl, 2
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x14003fb95
mov rdx, qword [rbp + 0x190]
lea r8, [rsp + 0x6c]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x14003fb88
mov dword [rsp + 0x6c], r12d
mov rcx, qword [rbp + 0x190]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov rcx, qword [rbp + 0x180]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14003fbac
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x6c], 0
jne 0x14003fc70
lea rcx, str.FATAL:_No_administrative_privileges_
call fcn.14004f910
mov rdx, qword [0x14019f558]
lea rcx, [rbp + 0x260]
call fcn.1400266d0
mov rax, qword [0x14019f558]
mov ecx, 0xcd8
movzx edi, word [0x1401941e8]
mov esi, dword [rax + 4]
and esi, 1
mov dword [0x14019f510], esi
call fcn.1400207e0
mov ecx, 0xcd9
mov rbx, rax
call fcn.1400207e0
mov rcx, rax
call fcn.14002e7b0
mov rcx, rbx
mov r15, rax
call fcn.14002e7b0
mov r9d, 0x1010
mov word [rsp + 0x20], di
mov ecx, 0x181010
test esi, esi
mov r8, rax
mov rdx, r15
cmovne r9d, ecx
mov r14, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxExW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test r15, r15
je 0x14003fc56
mov rcx, r15
call fcn.1400e9080
test r14, r14
je 0x14003fc63
mov rcx, r14
call fcn.1400e9080
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14003f50f
mov rcx, qword [rbp + 0x1a0]
test rcx, rcx
je 0x14003fcbd
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x14003fc83
cmp rax, 2
jne 0x14003fcbd
cmp byte [rcx], 0x2f
jne 0x14003fcbd
cmp byte [rcx + 1], 0x57
jne 0x14003fcbd
lea r8, str.Global_Rufus
mov edx, r15d
xor ecx, ecx
mov ebx, 0x96
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov rdi, rax
mov qword [rbp - 8], rax
jmp 0x14003fce0
lea r8, str.Global_Rufus
mov edx, r15d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ebx, dword [rbp - 0x68]
mov rdi, rax
mov qword [rbp - 8], rax
test ebx, ebx
jle 0x14003fd29
nop dword [rax]
test rdi, rdi
je 0x140041913
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14003fd32
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r8, str.Global_Rufus
mov edx, r15d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
dec ebx
mov qword [rbp - 8], rax
mov rdi, rax
test ebx, ebx
jg 0x14003fce0
test rdi, rdi
je 0x140041913
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x140041913
mov r13, qword [rbp + 8]
mov edx, 6
xor ecx, ecx
mov qword [0x1401e8838], r13
call qword [sym.imp.ole32.dll_CoInitializeEx]
lea rcx, str.Riched20
call fcn.14002e530
test rax, rax
jne 0x14003fd80
call fcn.140050120
mov rdx, rax
lea rcx, str.Could_not_load_RichEdit_library___some_dialogs_may_not_display:__s
call fcn.14004f910
call fcn.14002d400
xor ecx, ecx
mov dword [rsp + 0x20], 0x9e
call fcn.14004e980
xor r9d, r9d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80
lea rcx, str..MountPointManager
xor edx, edx
mov dword [rbp - 0x40], eax
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14003fe39
mov qword [rsp + 0x38], r12
lea rax, [rbp]
mov qword [rsp + 0x30], rax
xor r9d, r9d
lea rax, [rbp - 0x80]
mov dword [rsp + 0x28], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0x6d003c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x14003fe39
cmp dword [rbp - 0x80], 0
jne 0x14003fe50
lea rcx, str.AutoMount_was_detected_as_disabled___temporarily_re_enabling_it
call fcn.14004f910
mov ecx, r15d
call fcn.140005420
test eax, eax
jne 0x14003fe50
lea rcx, str.Failed_to_enable_AutoMount
call fcn.14004f910
jmp 0x14003fe50
lea rcx, str.Could_not_get_AutoMount_status
call fcn.14004f910
mov dword [rbp - 0x80], r15d
nop dword [rax]
xor eax, eax
mov dword [rbp + 0x160], r12d
xor ecx, ecx
mov r8d, r12d
cpuid
mov dword [rbp + 0x164], ebx
mov r10d, r12d
mov dword [rbp + 0x168], ecx
mov r9d, eax
mov dword [rbp + 0x16c], edx
cmp eax, 1
jb 0x14003fe99
mov eax, r15d
xor ecx, ecx
cpuid
mov r8d, ecx
mov dword [rbp + 0x160], eax
mov dword [rbp + 0x164], ebx
mov dword [rbp + 0x16c], edx
cmp r9d, 7
jb 0x14003febd
mov eax, 7
xor ecx, ecx
cpuid
mov r10d, ebx
mov dword [rbp + 0x160], eax
mov dword [rbp + 0x168], ecx
mov dword [rbp + 0x16c], edx
bt r8d, 0x13
setb cl
bt r8d, 9
setb al
test al, cl
je 0x14003fedb
mov eax, r15d
bt r10d, 0x1d
jb 0x14003fede
mov eax, r12d
mov dword [0x14019f090], eax
xor ecx, ecx
xor eax, eax
mov dword [rbp + 0x160], r12d
cpuid
mov dword [rbp + 0x164], ebx
mov r8d, r12d
mov dword [rbp + 0x168], ecx
mov r10d, r12d
mov dword [rbp + 0x16c], edx
mov r9d, eax
cmp eax, 1
jb 0x14003ff2d
mov eax, r15d
xor ecx, ecx
cpuid
mov r8d, ecx
mov dword [rbp + 0x160], eax
mov dword [rbp + 0x164], ebx
mov dword [rbp + 0x16c], edx
cmp r9d, 7
jb 0x14003ff51
mov eax, 7
xor ecx, ecx
cpuid
mov r10d, ebx
mov dword [rbp + 0x160], eax
mov dword [rbp + 0x168], ecx
mov dword [rbp + 0x16c], edx
bt r8d, 0x13
setb cl
bt r8d, 9
setb al
test al, cl
je 0x14003ff6f
mov eax, r15d
bt r10d, 0x1d
jb 0x14003ff72
mov eax, r12d
mov dword [0x14019f094], eax
lea r9, str._sdismFfuProvider.dll
lea rax, [0x1401e85e0]
mov edx, 0x104
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x20], rax
lea rcx, [rbp + 0x370]
call fcn.140004960
lea rcx, [rbp + 0x370]
mov byte [rbp + 0x473], 0
call fcn.14002e7b0
xor edx, edx
mov rcx, rax
mov rbx, rax
call fcn.14010acac
mov edi, eax
test rbx, rbx
je 0x14003ffd2
mov rcx, rbx
call fcn.1400e9080
mov rax, qword [0x1401d0520]
lea r9, str.Localization_set_to__s
test edi, edi
mov ecx, r12d
mov edi, 0xffc
mov r8, 0xffffffffffffffff
sete cl
sub rdi, rax
lea rbx, [rax + rsi]
mov dword [0x14019f534], ecx
mov rax, qword [0x14019f558]
mov rdx, rdi
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x20], rcx
mov rcx, rbx
call fcn.140004960
mov rax, 0xffffffffffffffff
mov byte [rbx + rdi - 1], 0
lea rdx, [0x1401e67a0]
nop
inc rax
cmp byte [rdx + rax], 0
jne 0x140040030
mov word [rax + rdx], 0xa0d
add rax, 2
mov qword [0x1401d0520], rax
cmp rax, 0x1000
jae 0x1400419bc
mov rsi, qword [rbp - 0x58]
mov ebx, 0x181034
mov r12d, esi
mov r15d, 0x12
nop dword [rax + rax]
mov byte [rax + rdx], 0
xor edi, edi
mov rax, qword [0x14019f558]
mov byte [0x140194188], 1
mov dword [0x1401e29c0], edi
mov ecx, dword [rax + 4]
and ecx, 1
mov byte [0x1401e7a40], 0
mov dword [0x14019f510], ecx
mov rcx, qword [0x14019f588]
call fcn.1400e9080
cmp dword [0x14019f510], edi
mov ecx, edi
mov qword [0x14019f588], rdi
setne cl
call qword [sym.imp.USER32.dll_SetProcessDefaultLayout]
mov rdx, qword [0x14019f558]
lea rcx, [rbp + 0x260]
call fcn.1400266d0
test eax, eax
je 0x14004012f
cmp qword [0x14019f500], rdi
mov rax, qword [0x14019f558]
mov r9, qword [rax + 0x18]
je 0x1400400fd
mov rdx, r9
lea rcx, str.Locale
call fcn.140026ef0
jmp 0x14004012f
test r9, r9
jne 0x140040107
mov rax, rdi
jmp 0x140040119
mov rax, 0xffffffffffffffff
nop
inc rax
cmp byte [r9 + rax], dil
jne 0x140040110
mov r8d, 1
mov dword [rsp + 0x20], eax
lea rdx, str.Locale
call fcn.14002fc90
test r14d, r14d
jne 0x1400401d7
cmp dword [0x14019f510], r14d
mov esi, 0x1034
movzx edi, word [0x1401941e8]
mov ecx, 0xcdf
cmovne esi, ebx
call fcn.1400207e0
mov ecx, 0xce0
mov rbx, rax
call fcn.1400207e0
mov rcx, rax
call fcn.14002e7b0
mov rcx, rbx
mov r14, rax
call fcn.14002e7b0
mov r9d, esi
mov word [rsp + 0x20], di
mov r8, rax
mov rdx, r14
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.USER32.dll_MessageBoxExW]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test r14, r14
je 0x1400401a8
mov rcx, r14
call fcn.1400e9080
test rbx, rbx
je 0x1400401b5
mov rcx, rbx
call fcn.1400e9080
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp edi, 6
jne 0x14003f50c
mov rsi, qword [rbp - 0x58]
mov r14d, 1
mov dword [rsp + 0x7c], r14d
xor edi, edi
test rsi, rsi
je 0x1400401e5
mov rcx, rsi
call qword [sym.imp.USER32.dll_DestroyWindow]
mov ecx, 0x65
call fcn.140059510
mov rbx, rax
test rax, rax
jne 0x140040210
mov r8d, 0x726
lea rdx, str.D:_a_rufus_rufus_src_stdlg.c
lea rcx, str.rcTemplate___NULL
call fcn.1400fc264
lea r9, [0x140038f80]
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
mov rcx, rbx
mov qword [rbp - 0x58], rax
mov rsi, rax
call fcn.1400e9080
test rsi, rsi
je 0x1400417c7
mov r8d, dword [0x1401977e8]
mov ebx, 1
cmp r8d, 0xffff0000
jle 0x14004027f
mov r9d, dword [0x1401977ec]
cmp r9d, 0xffff0000
jle 0x14004027f
mov dword [rsp + 0x30], ebx
xor edx, edx
mov dword [rsp + 0x28], edi
mov rcx, rsi
mov dword [rsp + 0x20], edi
call qword [sym.imp.USER32.dll_SetWindowPos]
xor r9d, r9d
mov r8d, ebx
mov edx, 0x233
mov rcx, rsi
call qword [sym.imp.USER32.dll_ChangeWindowMessageFilterEx]
xor r9d, r9d
mov r8d, ebx
mov rcx, rsi
lea edx, [r9 + 0x4a]
call qword [sym.imp.USER32.dll_ChangeWindowMessageFilterEx]
xor r9d, r9d
mov r8d, ebx
mov rcx, rsi
lea edx, [r9 + 0x49]
call qword [sym.imp.USER32.dll_ChangeWindowMessageFilterEx]
call fcn.140059cc0
cmp qword [0x1401e4070], 0
jne 0x140040307
mov edx, 3
mov dword [rsp + 0x30], 2
mov ecx, edx
mov dword [rsp + 0x28], edi
lea r9, [0x140059ae0]
mov dword [rsp + 0x20], edi
xor r8d, r8d
call qword [sym.imp.USER32.dll_SetWinEventHook]
mov qword [0x1401e4070], rax
test rax, rax
jne 0x140040307
lea rcx, str.Warning:_Could_not_set_alert_prompt_hook
call fcn.14004f910
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, rsi
call qword [sym.imp.USER32.dll_UpdateWindow]
xor r9d, r9d
lea rcx, [rbp - 0x38]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x140040931
mov r14d, dword [rbp - 0x6c]
mov r13d, 1
nop
mov eax, dword [rbp - 0x30]
cmp eax, 0x104
jne 0x140040359
test qword [rbp - 0x20], 0x20000000
jne 0x140040359
mov ebx, r13d
jmp 0x140040362
mov ebx, edi
cmp eax, 0x104
jne 0x140040371
cmp qword [rbp - 0x28], r15
je 0x140040371
mov edi, dword [rsp + 0x78]
mov r14d, r13d
jmp 0x140040389
mov ecx, r15d
call qword [sym.imp.USER32.dll_GetKeyState]
mov edi, dword [rsp + 0x78]
test ax, ax
cmovs edi, r13d
mov dword [rsp + 0x78], edi
mov rcx, qword [0x14019f5a0]
call qword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x1400403d9
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1400403d9
cmp dword [rbp - 0x30], 0x100
mov rcx, qword [rbp - 0x28]
jne 0x1400403dd
cmp rcx, 0x41
jne 0x1400403dd
lea r9, [rcx - 0x42]
xor r8d, r8d
lea edx, [rcx + 0x70]
mov rcx, qword [0x14019f5c8]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x140040905
mov rcx, qword [rbp - 0x28]
test ebx, ebx
je 0x1400403f3
cmp rcx, 0x11
jne 0x1400403f3
mov eax, dword [0x140196f60]
mov dword [0x1401e29bc], eax
cmp dword [0x1401e29bc], 0
jne 0x140040419
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
mov rcx, qword [rbp - 0x28]
test ax, ax
jns 0x140040447
cmp dword [rbp - 0x30], 0x100
jne 0x140040447
cmp rcx, 0x4c
jne 0x140040447
mov rcx, qword [0x1401e8a68]
xor edi, edi
xor r9d, r9d
mov dword [0x1401e29bc], edi
mov edx, 0x111
mov r8d, 0x41e
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x140040907
cmp dword [0x1401e29bc], 0
jne 0x14004046d
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
mov rcx, qword [rbp - 0x28]
test ax, ax
jns 0x14004047d
cmp dword [rbp - 0x30], 0x100
jne 0x14004047d
cmp rcx, 0x54
jne 0x14004047d
call fcn.14004a370
jmp 0x140040905
cmp dword [0x1401e29bc], 0
jne 0x1400404ab
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
mov rcx, qword [rbp - 0x28]
test ax, ax
jns 0x14004054c
cmp dword [rbp - 0x30], 0x100
jne 0x14004054c
cmp rcx, 0x50
jne 0x14004054c
xor edi, edi
cmp dword [0x14019f59c], edi
mov eax, edi
sete al
cmp qword [0x14019f500], rdi
mov dword [0x14019f59c], eax
je 0x140040519
lea edx, [rcx - 0x44]
mov dword [rsp + 0x20], eax
lea r8, [rcx - 0x51]
lea rcx, [rbp + 0x1a0]
lea r9, [0x14015e598]
call fcn.140004960
lea rdx, [rbp + 0x1a0]
mov byte [rbp + 0x1ab], dil
lea rcx, str.PersistentLog
call fcn.140026ef0
mov ebx, dword [0x14019f59c]
mov ecx, 0xd08
jmp 0x140041711
lea r9, [rsp + 0x60]
mov dword [rsp + 0x60], eax
mov r8d, 4
mov dword [rsp + 0x20], 4
lea rdx, str.PersistentLog
call fcn.14002fc90
mov ebx, dword [0x14019f59c]
mov ecx, 0xd08
jmp 0x140041711
test ebx, ebx
je 0x140040567
cmp rcx, 0x11
je 0x140040905
xor edi, edi
mov dword [0x1401e29bc], edi
jmp 0x140040907
cmp dword [rbp - 0x30], 0x104
jne 0x14004068b
cmp rcx, 0xbb
je 0x1400405b2
cmp rcx, 0xbd
je 0x140040596
cmp rcx, 0x6b
je 0x1400405b2
cmp rcx, 0x6d
jne 0x14004068b
cmp rcx, 0x6b
je 0x1400405b2
mov eax, dword [0x140196f64]
mov ecx, 0xffffffff
cmp eax, 0xfffffffe
jle 0x14004066d
jmp 0x1400405c4
mov eax, dword [0x140196f64]
mov ecx, r13d
cmp eax, 2
jge 0x14004066d
add eax, ecx
mov dword [0x140196f64], eax
dec eax
cmp qword [0x14019f500], 0
je 0x140040614
mov edx, 0xc
mov dword [rsp + 0x20], eax
lea r9, [0x14015e598]
lea rcx, [rbp + 0x190]
lea r8, [rdx - 0xd]
call fcn.140004960
lea rdx, [rbp + 0x190]
mov byte [rbp + 0x19b], 0
lea rcx, str.DefaultThreadPriority
call fcn.140026ef0
jmp 0x140040637
lea r9, [rsp + 0x74]
mov dword [rsp + 0x74], eax
mov r8d, 4
mov dword [rsp + 0x20], 4
lea rdx, str.DefaultThreadPriority
call fcn.14002fc90
mov rcx, qword [0x14019f548]
test rcx, rcx
je 0x14004064f
mov edx, dword [0x140196f64]
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rcx, qword [0x1401d0548]
test rcx, rcx
je 0x140040667
mov edx, dword [0x140196f64]
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [0x140196f64]
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
mov r9d, 0xcf6
mov r8d, 0xdac
call fcn.140020c90
jmp 0x140040905
cmp dword [0x140196f60], 0
jne 0x14004173b
cmp dword [rbp - 0x30], 0x104
jne 0x140041478
cmp rcx, 0xbe
jne 0x14004075b
xor edi, edi
cmp dword [0x1401e8840], edi
mov ecx, edi
sete cl
mov eax, ecx
mov dword [0x1401e8840], ecx
xor eax, r13d
cmp qword [0x14019f500], rdi
lea eax, [rax*2 + 1]
mov dword [0x140196fa4], eax
je 0x140040728
mov dword [rsp + 0x20], ecx
lea r9, [0x14015e598]
lea rcx, [rbp + 0x180]
lea edx, [rdi + 0xc]
lea r8, [rdi - 1]
call fcn.140004960
lea rdx, [rbp + 0x180]
mov byte [rbp + 0x18b], dil
lea rcx, str.EnableUsbDebug
call fcn.140026ef0
mov ebx, dword [0x1401e8840]
mov ecx, 0xcc6
jmp 0x1400413b8
lea r9, [rsp + 0x60]
mov dword [rsp + 0x60], ecx
mov r8d, 4
mov dword [rsp + 0x20], 4
lea rdx, str.EnableUsbDebug
call fcn.14002fc90
mov ebx, dword [0x1401e8840]
mov ecx, 0xcc6
jmp 0x1400413b8
cmp rcx, 0xbc
jne 0x140040790
xor edi, edi
mov ecx, 0xcd2
cmp dword [0x140196df8], edi
mov ebx, edi
sete bl
mov dword [0x140196df8], ebx
call fcn.1400207e0
xor ebx, r13d
lea r9d, [rbx + 0xcb2]
jmp 0x140041722
cmp rcx, 0x41
jne 0x140040834
xor edi, edi
cmp dword [0x140196f40], edi
mov eax, edi
sete al
mov dword [0x140196f40], eax
xor eax, r13d
cmp qword [0x14019f500], rdi
je 0x140040801
lea edx, [rcx - 0x35]
mov dword [rsp + 0x20], eax
lea r8, [rcx - 0x42]
lea rcx, [rbp + 0x170]
lea r9, [0x14015e598]
call fcn.140004960
lea rdx, [rbp + 0x170]
mov byte [rbp + 0x17b], dil
lea rcx, str.DisableRufusMBR
call fcn.140026ef0
mov ebx, dword [0x140196f40]
mov ecx, 0xd15
jmp 0x140041711
lea r9, [rsp + 0x60]
mov dword [rsp + 0x60], eax
mov r8d, 4
mov dword [rsp + 0x20], 4
lea rdx, str.DisableRufusMBR
call fcn.14002fc90
mov ebx, dword [0x140196f40]
mov ecx, 0xd15
jmp 0x140041711
cmp rcx, 0x42
jne 0x1400408d8
xor edi, edi
cmp dword [0x1401e8a70], edi
mov eax, edi
sete al
mov dword [0x1401e8a70], eax
xor eax, r13d
cmp qword [0x14019f500], rdi
je 0x1400408a5
lea edx, [rcx - 0x36]
mov dword [rsp + 0x20], eax
lea r8, [rcx - 0x43]
lea rcx, [rbp + 0x220]
lea r9, [0x14015e598]
call fcn.140004960
lea rdx, [rbp + 0x220]
mov byte [rbp + 0x22b], dil
lea rcx, str.DisableFakeDrivesCheck
call fcn.140026ef0
mov ebx, dword [0x1401e8a70]
mov ecx, 0xcb8
jmp 0x140041711
lea r9, [rsp + 0x60]
mov dword [rsp + 0x60], eax
mov r8d, 4
mov dword [rsp + 0x20], 4
lea rdx, str.DisableFakeDrivesCheck
call fcn.14002fc90
mov ebx, dword [0x1401e8a70]
mov ecx, 0xcb8
jmp 0x140041711
cmp rcx, 0x43
jne 0x1400409f4
mov rcx, qword [0x1401e8710]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x147
call qword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
js 0x140040905
mov ecx, eax
call fcn.14005c4a0
xor edi, edi
xor r9d, r9d
lea rcx, [rbp - 0x38]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x140040340
mov r13, qword [rbp + 8]
lea ebx, [rax + 1]
mov dword [rbp - 0x6c], r14d
mov r14d, dword [rsp + 0x7c]
mov rcx, qword [0x1401d0528]
test rcx, rcx
je 0x14004094d
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
call qword [sym.imp.USER32.dll_SendMessageW]
cmp dword [0x1401e2a20], 0
je 0x14003f50c
mov ecx, ebx
mov dword [0x1401e2a20], edi
call fcn.1400200b0
mov ecx, ebx
call fcn.14001fef0
mov rax, qword [0x14019f558]
lea rbx, [0x1401e67a0]
add rbx, qword [0x1401d0520]
lea r9, str.Localization_set_to__s
mov edi, 0xffc
mov r8, 0xffffffffffffffff
sub rdi, qword [0x1401d0520]
mov rcx, qword [rax + 0x18]
mov rdx, rdi
mov qword [rsp + 0x20], rcx
mov rcx, rbx
call fcn.140004960
mov rax, 0xffffffffffffffff
mov byte [rbx + rdi - 1], 0
lea rdx, [0x1401e67a0]
inc rax
cmp byte [rdx + rax], 0
jne 0x1400409c4
mov word [rax + rdx], 0xa0d
mov ebx, 0x181034
add rax, 2
mov qword [0x1401d0520], rax
cmp rax, 0x1000
jae 0x1400419bc
jmp 0x140040070
cmp rcx, 0x44
jne 0x140040afa
lea rax, [0x1401569ec]
mov edx, 0x104
mov qword [rsp + 0x28], rax
lea r8, [rcx - 0x45]
lea rax, [0x1401e8720]
lea r9, [0x14015bcec]
mov qword [rsp + 0x20], rax
lea rcx, [rbp + 0x370]
call fcn.140004960
lea rax, [rbp + 0x370]
mov byte [rbp + 0x473], 0
mov r9d, 0xcc0
mov qword [rsp + 0x20], rax
mov r8d, 0xdac
mov edx, r13d
xor ecx, ecx
call fcn.140020c90
lea rax, [rbp + 0x370]
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140040a70
add rbx, 2
mov edx, 2
mov rcx, rbx
call fcn.1400c537c
mov rdi, rax
mov dword [rsp + 0x28], ebx
xor eax, eax
mov dword [rbp + 0x28], 3
mov ecx, 0x614
mov qword [rbp + 0x20], rax
mov word [rbp + 0x40], cx
lea r8, [rbp + 0x370]
xorps xmm0, xmm0
mov qword [rbp + 0x30], rdi
lea r9d, [rax - 1]
mov qword [rbp + 0x38], rax
xor edx, edx
mov dword [rbp + 0x44], eax
mov ecx, 0xfde9
mov qword [rsp + 0x20], rdi
movdqu xmmword [rbp + 0x48], xmm0
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rcx, [rbp + 0x20]
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
test rdi, rdi
je 0x140040aee
mov rcx, rdi
call fcn.1400e9080
mov dword [0x1401e27e4], r13d
jmp 0x140040905
cmp rcx, 0x45
jne 0x140040bb9
xor edi, edi
cmp dword [0x1401e86f8], edi
mov eax, edi
sete al
cmp qword [0x14019f500], rdi
mov dword [0x1401e86f8], eax
je 0x140040b5a
lea edx, [rcx - 0x39]
mov dword [rsp + 0x20], eax
lea r8, [rcx - 0x46]
lea rcx, [rbp + 0x240]
lea r9, [0x14015e598]
call fcn.140004960
lea rdx, [rbp + 0x240]
mov byte [rbp + 0x24b], dil
lea rcx, str.EnableWindowsDualUefiBiosMode
call fcn.140026ef0
jmp 0x140040b7d
lea r9, [rsp + 0x60]
mov dword [rsp + 0x60], eax
mov r8d, 4
mov dword [rsp + 0x20], 4
lea rdx, str.EnableWindowsDualUefiBiosMode
call fcn.14002fc90
mov ebx, dword [0x1401e86f8]
mov ecx, 0xcc2
call fcn.1400207e0
neg ebx
mov qword [rsp + 0x20], rax
mov r8d, 0xdac
sbb r9d, r9d
xor edx, edx
add r9d, 0xcb3
xor ecx, ecx
call fcn.140020c90
xor ecx, ecx
call fcn.1400310a0
jmp 0x140040907
cmp rcx, 0x46
jne 0x140040c25
xor edi, edi
mov ecx, 0xcb5
cmp dword [0x14019f5c4], edi
mov ebx, edi
sete bl
mov dword [0x14019f5c4], ebx
call fcn.1400207e0
xor ebx, r13d
mov qword [rsp + 0x20], rax
xor edx, edx
xor ecx, ecx
mov r8d, 0xdac
lea r9d, [rbx + 0xcb2]
call fcn.140020c90
xor ecx, ecx
call fcn.14005d130
cmp dword [0x14019f5c4], edi
mov r8d, edi
mov rcx, qword [0x1401e8a68]
mov edx, 0x3fe
setne r8b
call qword [sym.imp.USER32.dll_CheckDlgButton]
jmp 0x140040907
cmp rcx, 0x47
jne 0x140040cc9
xor edi, edi
cmp dword [0x140196f74], edi
mov eax, edi
sete al
mov dword [0x140196f74], eax
xor eax, r13d
cmp qword [0x14019f500], rdi
je 0x140040c96
lea edx, [rcx - 0x3b]
mov dword [rsp + 0x20], eax
lea r8, [rcx - 0x48]
lea rcx, [rbp + 0x250]
lea r9, [0x14015e598]
call fcn.140004960
lea rdx, [rbp + 0x250]
mov byte [rbp + 0x25b], dil
lea rcx, str.DisableVHDs
call fcn.140026ef0
mov ebx, dword [0x140196f74]
mov ecx, 0xcec
jmp 0x1400413b8
lea r9, [rsp + 0x60]
mov dword [rsp + 0x60], eax
mov r8d, 4
mov dword [rsp + 0x20], 4
lea rdx, str.DisableVHDs
call fcn.14002fc90
mov ebx, dword [0x140196f74]
mov ecx, 0xcec
jmp 0x1400413b8
cmp rcx, 0x48
jne 0x140040d6a
xor edi, edi
cmp dword [0x1401a0400], edi
mov eax, edi
sete al
cmp qword [0x14019f500], rdi
mov dword [0x1401a0400], eax
je 0x140040d37
lea edx, [rcx - 0x3c]
mov dword [rsp + 0x20], eax
lea r8, [rcx - 0x49]
lea rcx, [rbp + 0x1b0]
lea r9, [0x14015e598]
call fcn.140004960
lea rdx, [rbp + 0x1b0]
mov byte [rbp + 0x1bb], dil
lea rcx, str.EnableExtraHashes
call fcn.140026ef0
mov ebx, dword [0x1401a0400]
mov ecx, 0xcf0
jmp 0x140041711
lea r9, [rsp + 0x60]
mov dword [rsp + 0x60], eax
mov r8d, 4
mov dword [rsp + 0x20], 4
lea rdx, str.EnableExtraHashes
call fcn.14002fc90
mov ebx, dword [0x1401a0400]
mov ecx, 0xcf0
jmp 0x140041711
cmp rcx, 0x49
jne 0x140040de2
xor edi, edi
mov ecx, 0xcbe
cmp dword [0x140194558], edi
mov ebx, edi
sete bl
mov dword [0x140194558], ebx
call fcn.1400207e0
xor ebx, r13d
mov qword [rsp + 0x20], rax
xor edx, edx
xor ecx, ecx
mov r8d, 0xdac
lea r9d, [rbx + 0xcb2]
call fcn.140020c90
cmp qword [0x14019f508], rdi
je 0x140040907
xor r9d, r9d
mov dword [0x1401e2a24], r13d
mov edx, 0x111
mov dword [0x1401e24fc], r13d
mov r8d, 0x3f6
mov rcx, rsi
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x140040907
cmp rcx, 0x4a
jne 0x140040e14
xor edi, edi
mov ecx, 0xcb9
cmp dword [0x140194318], edi
mov ebx, edi
sete bl
mov dword [0x140194318], ebx
call fcn.1400207e0
xor ebx, r13d
lea r9d, [rbx + 0xcb2]
jmp 0x140041722
cmp rcx, 0x4b
jne 0x140040e46
xor edi, edi
mov ecx, 0xcba
cmp dword [0x1401944a8], edi
mov ebx, edi
sete bl
mov dword [0x1401944a8], ebx
call fcn.1400207e0
xor ebx, r13d
lea r9d, [rbx + 0xcb2]
jmp 0x140041722
cmp rcx, 0x4c
jne 0x140040ee7
xor edi, edi
cmp dword [0x1401e8824], edi
mov eax, edi
sete al
cmp qword [0x14019f500], rdi
mov dword [0x1401e8824], eax
je 0x140040eb4
lea edx, [rcx - 0x40]
mov dword [rsp + 0x20], eax
lea r8, [rcx - 0x4d]
lea rcx, [rbp + 0x1c0]
lea r9, [0x14015e598]
call fcn.140004960
lea rdx, [rbp + 0x1c0]
mov byte [rbp + 0x1cb], dil
lea rcx, str.ForceLargeFat32Formatting
call fcn.140026ef0
mov ebx, dword [0x1401e8824]
mov ecx, 0xcb6
jmp 0x1400413b8
lea r9, [rsp + 0x60]
mov dword [rsp + 0x60], eax
mov r8d, 4
mov dword [rsp + 0x20], 4
lea rdx, str.ForceLargeFat32Formatting
call fcn.14002fc90
mov ebx, dword [0x1401e8824]
mov ecx, 0xcb6
jmp 0x1400413b8
cmp rcx, 0x4d
jne 0x140040f88
xor edi, edi
cmp dword [0x14019f5b0], edi
mov eax, edi
sete al
cmp qword [0x14019f500], rdi
mov dword [0x14019f5b0], eax
je 0x140040f55
lea edx, [rcx - 0x41]
mov dword [rsp + 0x20], eax
lea r8, [rcx - 0x4e]
lea rcx, [rbp + 0x1d0]
lea r9, [0x14015e598]
call fcn.140004960
lea rdx, [rbp + 0x1d0]
mov byte [rbp + 0x1db], dil
lea rcx, str.IgnoreBootMarker
call fcn.140026ef0
mov ebx, dword [0x14019f5b0]
mov ecx, 0xcf7
jmp 0x140041711
lea r9, [rsp + 0x60]
mov dword [rsp + 0x60], eax
mov r8d, 4
mov dword [rsp + 0x20], 4
lea rdx, str.IgnoreBootMarker
call fcn.14002fc90
mov ebx, dword [0x14019f5b0]
mov ecx, 0xcf7
jmp 0x140041711
cmp rcx, 0x4e
jne 0x140040fba
xor edi, edi
mov ecx, 0xcbc
cmp dword [0x14019f530], edi
mov ebx, edi
sete bl
mov dword [0x14019f530], ebx
call fcn.1400207e0
xor ebx, r13d
lea r9d, [rbx + 0xcb2]
jmp 0x140041722
cmp rcx, 0x4f
jne 0x140040fca
call fcn.14001f060
jmp 0x140040905
cmp rcx, 0x50
jne 0x140041019
call fcn.1400207e0
neg ebx
sbb r9d, r9d
add r9d, 0xcb3
xor edx, edx
mov qword [rsp + 0x20], rax
xor ecx, ecx
mov r8d, 0xdac
call fcn.140020c90
xor ecx, ecx
call fcn.14005d130
jmp 0x140040907
cmp dword [rbp - 0x30], 0x100
jne 0x14004173b
cmp rcx, 0x5a
jne 0x1400414e4
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1400414d3
mov ecx, r15d
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1400414d3
xor r9d, r9d
mov dword [0x14019f524], r13d
mov edx, 0x111
mov dword [0x14019f518], r13d
mov r8d, 0x3eb
mov rcx, rsi
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x140040905
cmp dword [rbp - 0x30], 0x100
jne 0x14004173b
mov rcx, qword [rbp - 0x28]
cmp rcx, 0x45
jne 0x1400415bc
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1400415ab
mov ecx, r15d
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1400415ab
xor edi, edi
cmp dword [0x14019f5a8], edi
mov eax, edi
sete al
cmp qword [0x14019f500], rdi
mov dword [0x14019f5a8], eax
je 0x140041578
lea r9, [0x14015e598]
mov dword [rsp + 0x20], eax
lea edx, [rdi + 0xc]
lea r8, [rdi - 1]
lea rcx, [rbp + 0x160]
call fcn.140004960
lea rdx, [rbp + 0x160]
mov byte [rbp + 0x16b], dil
lea rcx, str.ExpertMode
call fcn.140026ef0
mov ebx, dword [0x14019f5a8]
mov ecx, 0xd13
jmp 0x140041711
lea r9, [rsp + 0x60]
mov dword [rsp + 0x60], eax
mov r8d, 4
mov dword [rsp + 0x20], 4
lea rdx, str.ExpertMode
call fcn.14002fc90
mov ebx, dword [0x14019f5a8]
mov ecx, 0xd13
jmp 0x140041711
cmp dword [rbp - 0x30], 0x100
jne 0x14004173b
mov rcx, qword [rbp - 0x28]
cmp rcx, 0x46
jne 0x1400416ce
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1400416c1
mov ecx, r15d
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1400416c1
xor edi, edi
cmp dword [0x1401a03dc], edi
mov eax, edi
sete al
mov dword [0x1401a03dc], eax
test eax, eax
je 0x140041615
mov eax, dword [0x14019f5c4]
mov dword [rbp - 0x70], eax
mov eax, r13d
mov r12d, dword [rbp - 0x70]
jmp 0x140041618
mov eax, r12d
mov rcx, qword [0x1401e8a68]
test eax, eax
mov r8d, edi
mov dword [0x14019f5c4], eax
setne r8b
mov edx, 0x3fe
call qword [sym.imp.USER32.dll_CheckDlgButton]
mov ebx, dword [0x1401a03dc]
mov ecx, 0xcd7
call fcn.1400207e0
neg ebx
mov qword [rsp + 0x20], rax
mov r8d, 0xdac
sbb r9d, r9d
xor edx, edx
add r9d, 0xcb3
xor ecx, ecx
call fcn.140020c90
mov eax, dword [0x1401a03dc]
lea rcx, str.enabled
test eax, eax
lea r8, str.disabled
lea rax, str.CAUTION:
cmovne r8, rcx
lea rdx, [0x14015644e]
lea rcx, str._sListing_of_non_USB_removable_drives__s
cmovne rdx, rax
call fcn.14004f910
cmp dword [0x1401a03dc], edi
je 0x1400416b5
lea rcx, str.By_using_this_unofficial_cheat_mode_you_forfeit_ANY_RIGHT_to_complain_if_you_lose_valuable_data_
call fcn.14004f910
xor ecx, ecx
call fcn.14005d130
jmp 0x140040907
cmp dword [rbp - 0x30], 0x100
jne 0x14004173b
mov rcx, qword [rbp - 0x28]
cmp rcx, 0x59
jne 0x14004173b
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x14004173b
mov ecx, r15d
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x14004173b
cmp dword [0x14019f53c], 0
mov ebx, 2
mov edi, 0
mov ecx, 0xcbb
cmovg ebx, edi
mov dword [0x14019f53c], ebx
call fcn.1400207e0
neg ebx
sbb r9d, r9d
add r9d, 0xcb3
xor edx, edx
mov qword [rsp + 0x20], rax
xor ecx, ecx
mov r8d, 0xdac
call fcn.140020c90
jmp 0x140040907
test edi, edi
je 0x14004177e
mov ecx, r15d
call qword [sym.imp.USER32.dll_GetKeyState]
xor edi, edi
test ax, ax
js 0x140041780
mov dword [rsp + 0x78], edi
test r14d, r14d
jne 0x140041779
mov ecx, dword [0x1401a0404]
mov eax, 0x55555556
inc ecx
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
sub ecx, eax
mov dword [0x1401a0404], ecx
mov r14d, edi
jmp 0x140041780
xor edi, edi
lea rdx, [rbp - 0x38]
mov rcx, rsi
call qword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
jne 0x140040907
mov rcx, qword [0x14019f5a0]
lea rdx, [rbp - 0x38]
call qword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
jne 0x140040907
lea rcx, [rbp - 0x38]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp - 0x38]
call qword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x140040907
cmp dword [0x14019f510], 0
lea r8, str.Could_not_create_Window
movzx r15d, word [0x1401941e8]
mov ecx, 0x181010
mov ebx, 0x1010
cmovne ebx, ecx
xor r12d, r12d
mov dword [rsp + 0x28], r12d
xor edx, edx
mov ecx, 0xfde9
mov qword [rsp + 0x20], r12
lea r9d, [r12 - 1]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rdi, eax
cmp edi, 1
jle 0x140041854
mov rcx, rdi
lea edx, [r12 + 2]
call fcn.1400c537c
mov rsi, rax
test rax, rax
je 0x140041854
mov dword [rsp + 0x28], edi
lea r9d, [r12 - 1]
lea r8, str.Could_not_create_Window
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, edi
je 0x140041857
mov rcx, rsi
call fcn.1400e9080
mov rsi, r12
mov dword [rsp + 0x28], r12d
lea r8, str.DialogBox_failure
mov r9d, 0xffffffff
mov qword [rsp + 0x20], r12
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd r14, eax
cmp r14d, 1
jle 0x1400418ca
mov rcx, r14
mov edx, 2
call fcn.1400c537c
mov rdi, rax
test rax, rax
je 0x1400418ca
mov dword [rsp + 0x28], r14d
lea r8, str.DialogBox_failure
mov r9d, 0xffffffff
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, r14d
je 0x1400418cd
mov rcx, rdi
call fcn.1400e9080
mov rdi, r12
mov r9d, ebx
mov word [rsp + 0x20], r15w
mov r8, rdi
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxExW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test rsi, rsi
je 0x1400418f9
mov rcx, rsi
call fcn.1400e9080
test rdi, rdi
je 0x140041906
mov rcx, rdi
call fcn.1400e9080
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14003f50f
mov rdx, qword [0x14019f558]
lea rcx, [rbp + 0x260]
call fcn.1400266d0
mov rax, qword [0x14019f558]
mov ecx, 0xbb9
movzx edi, word [0x1401941e8]
mov esi, dword [rax + 4]
and esi, 1
mov dword [0x14019f510], esi
call fcn.1400207e0
mov ecx, 0xbba
jmp 0x14003fbff
mov rdx, qword [0x14019f558]
lea rcx, [rbp + 0x260]
call fcn.1400266d0
mov rax, qword [0x14019f558]
mov ecx, 0xcdd
movzx edi, word [0x1401941e8]
mov esi, dword [rax + 4]
and esi, 1
mov dword [0x14019f510], esi
call fcn.1400207e0
cmp dword [0x1401d0480], 0x61
mov edx, r12d
mov rbx, rax
mov r8d, 0x12
mov eax, 0x16
sete dl
cmove r8d, eax
mov ecx, 0xcde
add edx, 2
call fcn.1400207e0
jmp 0x14003fc07
call fcn.1400b20a8
int3