Function at 0x4346a6
Capabilities:
Check mutex on windows
Copy file
Delete file
Delete registry key
Extract resource via kernel32 functions
Get token membership
Hide graphical window
Parse pe header
Resolve function by parsing pe exports
Terminate thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x9bc
mov eax, dword [0x4f22ec]
xor eax, esp
mov dword [esp + 0x9b8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [esp + 0x90], eax
mov dword [esp + 0x88], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0xc4], 0
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx eax, ax
mov dword [esp + 0x20], eax
xor eax, eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x74], eax
mov dword [esp + 0x9c], eax
mov dword [esp + 0xa0], eax
mov dword [esp + 0x70], eax
mov dword [esp + 0x94], eax
mov dword [esp + 0xb4], eax
lea eax, [esp + 0xb4]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftVisualStudio
push 0x80000001
mov dword [esp + 0x60], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x78], eax
mov eax, dword [esp + 0xb4]
test eax, eax
je 0x43373e
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x104
lea eax, [esp + 0x3a4]
mov dword [esp + 0x4c], 0
push 0
push eax
mov dword [esp + 0x78], 0
mov dword [esp + 0xbc], 0
mov dword [esp + 0x98], 4
call fcn.00493600
add esp, 0xc
lea eax, [esp + 0x298]
push 0x104
push 0
push eax
call fcn.00493600
add esp, 0xc
lea eax, [esp + 0x4a8]
push 0x104
push 0
push eax
call fcn.00493600
mov ax, word [0x4d36b0]
add esp, 0xc
mov word [esp + 0x44], ax
mov al, byte [0x4d36b2]
mov byte [esp + 0x46], al
xor eax, eax
push 0x4ce59a
mov dword [esp + 0x38], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x9c], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x164], str.extra_devs
mov dword [esp + 0x168], eax
mov dword [esp + 0x16c], eax
mov dword [esp + 0x170], 0x78
mov dword [esp + 0x174], 0x4da188
mov dword [esp + 0x178], eax
mov dword [esp + 0x17c], eax
mov dword [esp + 0x180], 0x67
mov dword [esp + 0x184], str.help
mov dword [esp + 0x188], eax
mov dword [esp + 0x18c], eax
mov dword [esp + 0x190], 0x68
mov dword [esp + 0x194], 0x4da194
mov dword [esp + 0x198], 1
mov dword [esp + 0x19c], eax
mov dword [esp + 0x1a0], 0x69
mov dword [esp + 0x1a4], str.locale
mov dword [esp + 0x1a8], 1
mov dword [esp + 0x1ac], eax
mov dword [esp + 0x1b0], 0x6c
mov dword [esp + 0x1b4], str.filesystem
mov dword [esp + 0x1b8], 1
mov dword [esp + 0x1bc], eax
mov dword [esp + 0x1c0], 0x66
mov dword [esp + 0x1c4], str.wait
mov dword [esp + 0x1c8], 1
mov dword [esp + 0x1cc], eax
mov dword [esp + 0x1d0], 0x77
mov dword [esp + 0x1d4], eax
mov dword [esp + 0x1d8], eax
mov dword [esp + 0x1dc], eax
mov dword [esp + 0x1e0], eax
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryA]
push str.SetDefaultDllDirectories
push 0x4da1d0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x53dd70], eax
test eax, eax
je 0x43393c
push 0x800
call eax
push str._Rufus_init__n
call fcn.004407e0
add esp, 4
lea eax, [esp + 0x8c]
push eax
lea eax, [esp + 0xb4]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x433977
cmp dword [esp + 0xb0], 0x6c696e
jne 0x433977
mov eax, 1
jmp 0x433979
xor eax, eax
push 2
push 0x104
mov dword [0x4fae00], eax
mov dword [0x542c24], 0
call fcn.0049570f
mov edi, eax
add esp, 8
test edi, edi
jne 0x4339aa
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x433a36
push 0x104
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test esi, esi
je 0x433a22
lea eax, [esi - 1]
test eax, eax
je 0x4339e4
lea ecx, [ecx]
cmp word [edi + eax*2], 0x5c
je 0x4339de
sub eax, 1
jne 0x4339d0
jmp 0x4339e4
xor ecx, ecx
mov word [edi + eax*2], cx
push 0
push 0
push 0x104
push 0x5429e0
push 0xffffffffffffffff
push edi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
test esi, esi
jne 0x433a22
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov esi, eax
call fcn.004998ec
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x433a36
push edi
call fcn.004998ec
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
jne 0x433a5e
call fcn.00440bb0
push eax
push str.Could_not_get_application_directory:__s
call fcn.004407e0
mov ax, word [0x4da228]
add esp, 8
mov word [0x5429e0], ax
mov byte [0x5429e2], 0
jmp 0x433a9a
mov ecx, 0x5429e0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x433a66
sub ecx, edx
mov eax, 0x103
sub eax, ecx
mov ecx, 2
cmp eax, 2
cmova eax, ecx
push eax
push 0x4ce338
push 0x5429e0
call fcn.00499bf0
mov ax, word [0x4da228]
add esp, 0xc
mov cl, byte [0x4da22a]
mov edx, 0x80000000
push ecx
push 0x2000000
push 3
sub esp, 8
mov word [0x542780], ax
mov ecx, 0x542780
mov byte [0x542782], 0
call fcn.00427030
mov ebx, eax
add esp, 0x14
cmp ebx, 0xffffffff
je 0x433bd4
push 2
push 0x104
call fcn.0049570f
add esp, 8
mov esi, eax
push 8
push 0x104
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFinalPathNameByHandleW]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x1c], eax
test edi, edi
je 0x433b33
push 0
push 0
push 0x104
push 0x542780
push 0xffffffffffffffff
push esi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
jne 0x433b33
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x1c], eax
test esi, esi
je 0x433b40
push esi
call fcn.004998ec
add esp, 4
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
je 0x433bd4
push 0x4cdfa0
push 0x542780
call fcn.00492960
add esp, 8
cmp eax, 0x542780
je 0x433b84
push 0x4da22c
push 0x542780
call fcn.00492960
add esp, 8
cmp eax, 0x542780
jne 0x433bd4
mov ecx, 0x542784
lea esp, [esp]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [ecx - 5], al
test al, al
jne 0x433b90
mov ecx, 0x542780
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x433ba4
sub ecx, edx
mov eax, 0x103
sub eax, ecx
mov ecx, 2
cmp eax, 2
cmova eax, ecx
push eax
push 0x4ce338
push 0x542780
call fcn.00499bf0
add esp, 0xc
jmp 0x433c04
call fcn.00440bb0
push eax
push 0x542780
push str.Could_not_get_current_directory_from__s:__s
call fcn.004407e0
mov ax, word [0x4da228]
add esp, 0xc
mov word [0x542780], ax
mov byte [0x542782], 0
cmp ebx, 0xffffffff
je 0x433c0f
test ebx, ebx
je 0x433c0f
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 2
push 0x104
call fcn.0049570f
add esp, 8
mov esi, eax
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test edi, edi
je 0x433c66
push 0
push 0
push 0x104
push 0x542c40
push 0xffffffffffffffff
push esi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
jne 0x433c66
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test esi, esi
je 0x433c73
push esi
call fcn.004998ec
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
jne 0x433cdc
call fcn.00440bb0
push eax
push str.Could_not_get_temp_directory:__s
call fcn.004407e0
mov esi, 0x542780
add esp, 8
lea ecx, [esi + 1]
lea esp, [esp]
mov al, byte [esi]
inc esi
test al, al
jne 0x433ca0
sub esi, ecx
mov ebx, 0x104
inc esi
mov eax, ebx
cmp esi, eax
cmovb eax, esi
push eax
push 0x542780
push 0x542c40
call fcn.00493080
mov eax, ebx
add esp, 0xc
cmp esi, eax
cmovb eax, esi
mov byte [eax + 0x542c3f], 0
jmp 0x433e6f
push ecx
push 0x2000000
push 3
sub esp, 8
mov edx, 0x80000000
mov ecx, 0x542c40
call fcn.00427030
mov ebx, eax
add esp, 0x14
mov edi, 0x104
cmp ebx, 0xffffffff
je 0x433e05
push 2
push edi
call fcn.0049570f
add esp, 8
mov esi, eax
push 8
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFinalPathNameByHandleW]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x1c], eax
test edi, edi
je 0x433d5f
push 0
push 0
push 0x104
push 0x542c40
push 0xffffffffffffffff
push esi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
jne 0x433d5f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x1c], eax
test esi, esi
je 0x433d6c
push esi
call fcn.004998ec
add esp, 4
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
je 0x433e00
push 0x4cdfa0
push 0x542c40
call fcn.00492960
add esp, 8
cmp eax, 0x542c40
je 0x433db0
push 0x4da22c
push 0x542c40
call fcn.00492960
add esp, 8
cmp eax, 0x542c40
jne 0x433e00
mov ecx, 0x542c44
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [ecx - 5], al
test al, al
jne 0x433db5
mov ecx, 0x542c40
lea edx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x433dd0
sub ecx, edx
mov eax, 0x103
sub eax, ecx
mov ecx, 2
cmp eax, 2
cmova eax, ecx
push eax
push 0x4ce338
push 0x542c40
call fcn.00499bf0
add esp, 0xc
jmp 0x433e64
mov edi, 0x104
call fcn.00440bb0
push eax
push 0x542c40
push str.Could_not_get_actual_temp_directory_from__s:__s
call fcn.004407e0
mov esi, 0x542780
add esp, 0xc
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x433e25
sub esi, ecx
mov eax, edi
inc esi
cmp esi, 0x104
cmovb eax, esi
push eax
push 0x542780
push 0x542c40
call fcn.00493080
add esp, 0xc
mov eax, edi
cmp esi, 0x104
cmovb eax, esi
mov byte [eax + 0x542c3f], 0
cmp ebx, 0xffffffff
je 0x433e6f
test ebx, ebx
je 0x433e6f
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 2
push 0x104
call fcn.0049570f
add esp, 8
mov esi, eax
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test edi, edi
je 0x433ec6
push 0
push 0
push 0x104
push 0x542b20
push 0xffffffffffffffff
push esi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
jne 0x433ec6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test esi, esi
je 0x433ed3
push esi
call fcn.004998ec
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
jne 0x433f2a
call fcn.00440bb0
push eax
push str.Could_not_get_system_directory:__s
call fcn.004407e0
mov eax, dword [str.C:WindowsSystem32]
add esp, 8
mov dword [0x542b20], eax
mov eax, dword [0x4da2e4]
mov dword [0x542b24], eax
mov eax, dword [0x4da2e8]
mov dword [0x542b28], eax
mov eax, dword [0x4da2ec]
mov dword [0x542b2c], eax
mov eax, dword [0x4da2f0]
mov dword [0x542b30], eax
mov byte [0x542b33], 0
push 0x208
lea eax, [esp + 0x5b4]
push 0
push eax
call fcn.00493600
mov ebx, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [esp + 0x5bc]
add esp, 0xc
push 0
push 0x1c
push eax
push 0
call ebx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0
push 0x104
push 0x542ea0
push 0xffffffffffffffff
mov esi, eax
lea eax, [esp + 0x5c4]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
jne 0x433fe7
call fcn.00440bb0
push eax
push str.Could_not_get_app_data_directory:__s
call fcn.004407e0
mov esi, 0x542c40
add esp, 8
lea ecx, [esi + 1]
lea esp, [esp]
mov al, byte [esi]
inc esi
test al, al
jne 0x433fb0
sub esi, ecx
mov edi, 0x104
inc esi
mov eax, edi
cmp esi, eax
cmovb eax, esi
push eax
push 0x542c40
push 0x542ea0
call fcn.00493080
mov eax, edi
add esp, 0xc
cmp esi, eax
cmovb eax, esi
mov byte [eax + 0x542e9f], 0
push 0x208
lea eax, [esp + 0x7bc]
push 0
push eax
call fcn.00493600
add esp, 0xc
lea eax, [esp + 0x7b8]
push 0
push 0x28
push eax
push 0
call ebx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0
push 0x104
push 0x5428a0
push 0xffffffffffffffff
mov esi, eax
lea eax, [esp + 0x7cc]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
jne 0x43409c
call fcn.00440bb0
push eax
push str.Could_not_get_user_directory:__s
call fcn.004407e0
mov esi, 0x542c40
add esp, 8
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x434063
sub esi, ecx
mov ebx, 0x104
inc esi
mov eax, ebx
cmp esi, eax
cmovb eax, esi
push eax
push 0x542c40
push 0x5428a0
call fcn.00493080
mov eax, ebx
add esp, 0xc
cmp esi, eax
cmovb eax, esi
mov byte [eax + 0x54289f], 0
jmp 0x4340a1
mov ebx, 0x104
mov esi, 0x542b20
lea ecx, [esi + 1]
lea esp, [esp]
mov al, byte [esi]
inc esi
test al, al
jne 0x4340b0
sub esi, ecx
mov eax, ebx
inc esi
cmp esi, 0x104
cmovb eax, esi
push eax
push 0x542b20
push 0x542d60
call fcn.00493080
add esp, 0xc
mov dword [esp + 0x84], 0
cmp esi, 0x104
mov eax, ebx
cmovb eax, esi
mov byte [eax + 0x542d5f], 0
lea eax, [esp + 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp dword [esp + 0x84], 0
je 0x4341fd
push 2
push 0x104
call fcn.0049570f
add esp, 8
mov esi, eax
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test edi, edi
je 0x43416f
push 0
push 0
push 0x104
push 0x542d60
push 0xffffffffffffffff
push esi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
jne 0x43416f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test esi, esi
je 0x43417c
push esi
call fcn.004998ec
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
jne 0x4341c1
call fcn.00440bb0
push eax
push str.Could_not_get_Windows_directory:__s
call fcn.004407e0
mov eax, dword [str.C:Windows]
add esp, 8
mov dword [0x542d60], eax
mov eax, dword [0x4da368]
mov dword [0x542d64], eax
mov ax, word [0x4da36c]
mov word [0x542d68], ax
mov byte [0x542d6a], 0
mov ecx, 0x542d60
lea edx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4341d0
sub ecx, edx
mov eax, 0x103
sub eax, ecx
mov ecx, 0xb
cmp eax, ecx
cmova eax, ecx
push eax
push str.Sysnative
push 0x542d60
call fcn.00499bf0
add esp, 0xc
push 0x542780
push str.Cur_dir:__s
call fcn.004407e0
push 0x5429e0
push str.App_dir:__s
call fcn.004407e0
push 0x542d60
push str.Sys_dir:__s
call fcn.004407e0
push 0x5428a0
push str.Usr_dir:__s
call fcn.004407e0
push 0x542ea0
push str.Dat_dir:__s
call fcn.004407e0
push 0x542c40
push str.Tmp_dir:__s
call fcn.004407e0
push 0x5429e0
push str._srufus.app
lea eax, [esp + 0x4e0]
push 0x104
push eax
call fcn.00403820
add esp, 0x40
mov byte [esp + 0x5ab], 0
lea ecx, [esp + 0x4a8]
call fcn.004270e0
mov ebx, str._NULL_
test eax, eax
je 0x4342a2
mov dword [0x4fb838], 1
jmp 0x434907
mov eax, dword [0x53dd78]
test eax, eax
jne 0x4342e0
push str.__wgetmainargs
push ecx
mov ecx, str.Msvcrt
call fcn.00409990
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x53dd78], eax
test eax, eax
jne 0x4342e0
push str.Could_not_access_UTF_16_args
call fcn.004407e0
add esp, 4
jmp 0x4348fe
lea ecx, [esp + 0xc4]
xor edi, edi
push ecx
push 1
lea ecx, [esp + 0x12c]
mov dword [esp + 0x24], edi
push ecx
lea ecx, [esp + 0xd4]
push ecx
lea ecx, [esp + 0x38]
push ecx
call eax
add esp, 0x14
push 4
push dword [esp + 0x2c]
call fcn.0049570f
add esp, 8
mov dword [esp + 0x18], eax
test eax, eax
je 0x4348fe
xor ecx, ecx
mov dword [esp + 0x14], ecx
cmp dword [esp + 0x28], ecx
jle 0x4344a5
mov edi, 0x96
lea esp, [esp]
mov eax, dword [esp + 0xc8]
mov ebx, dword [eax + ecx*4]
cmp word [ebx], 0
jne 0x434360
push 1
push 1
call fcn.0049570f
add esp, 8
mov esi, eax
jmp 0x4343ba
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push ebx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
cmp edi, 1
jle 0x4343b3
push 1
push edi
call fcn.0049570f
mov esi, eax
add esp, 8
test esi, esi
je 0x4343b3
push 0
push 0
push edi
push esi
push 0xffffffffffffffff
push ebx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp eax, edi
je 0x4343b5
push esi
call fcn.004998ec
add esp, 4
xor esi, esi
mov edi, 0x96
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [ecx + eax*4], esi
mov ecx, 0x4da400
mov eax, esi
lea esp, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4343f0
test dl, dl
je 0x4343ec
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4343f0
add eax, 2
add ecx, 2
test dl, dl
jne 0x4343d0
xor eax, eax
jmp 0x4343f5
sbb eax, eax
or eax, 1
mov ecx, dword [esp + 0x2c]
test eax, eax
mov eax, esi
cmove ecx, edi
mov dword [esp + 0x2c], ecx
mov ecx, 0x4da404
lea esp, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x434430
test dl, dl
je 0x43442c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x434430
add eax, 2
add ecx, 2
test dl, dl
jne 0x434410
xor eax, eax
jmp 0x434435
sbb eax, eax
or eax, 1
test eax, eax
je 0x434469
mov ecx, str.__gui
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x434460
test dl, dl
je 0x43445c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x434460
add eax, 2
add ecx, 2
test dl, dl
jne 0x434440
xor eax, eax
jmp 0x434465
sbb eax, eax
or eax, 1
test eax, eax
jne 0x434471
mov dword [esp + 0x70], 1
push str._InvokerPRAID
push esi
call fcn.004a2750
add esp, 8
test eax, eax
je 0x434293
mov ecx, dword [esp + 0x14]
inc ecx
mov dword [esp + 0x14], ecx
cmp ecx, dword [esp + 0x28]
jl 0x434340
mov eax, dword [esp + 0x18]
mov ebx, str._NULL_
xor edi, edi
mov edx, dword [eax]
mov ecx, edx
lea esi, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4344b0
sub ecx, esi
lea esi, [ecx - 1]
add esi, edx
cmp esi, edx
jbe 0x4344cc
cmp byte [esi], 0x5c
je 0x4344cc
dec esi
cmp esi, edx
ja 0x4344c2
push 0x70
push esi
call fcn.00492830
add esp, 8
test eax, eax
jne 0x4344fb
push 0x50
push esi
call fcn.00492830
add esp, 8
test eax, eax
je 0x434500
push 0x50
push esi
call fcn.00492830
add esp, 8
cmp byte [eax + 1], 0x48
je 0x434500
mov byte [esp + 0x44], 0x61
cmp dword [esp + 0x70], 0
jne 0x434594
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_AttachConsole]
test eax, eax
je 0x434594
push str.Enabling_console_line_hogger
call fcn.004407e0
add esp, 4
mov dword [esp + 0x74], 1
push 0
call fcn.00495815
add esp, 4
push eax
push 0x4d27dc
push str.CONIN_
call fcn.004956e9
add esp, 0xc
push 1
call fcn.00495815
add esp, 4
push eax
push 0x4c9bcc
push str.CONOUT_
call fcn.004956e9
add esp, 0xc
push 2
call fcn.00495815
add esp, 4
push eax
push 0x4c9bcc
push str.CONOUT_
call fcn.004956e9
add esp, 0xc
call fcn.00495b83
call fcn.00433410
mov dword [esp + 0x98], eax
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x88]
mov ecx, dword [esp + 0x28]
push 0
push eax
lea eax, [esp + 0x168]
push eax
push str.ghxf:i:l:w:z:
call fcn.00458560
add esp, 0x10
cmp eax, 0xffffffff
je 0x4348fe
add eax, 0xffffff9f
cmp eax, 0x19
ja case.0x4345d7.98
movzx eax, byte [eax + 0x43776c]
jmp dword [eax*4 + 0x437748]
mov dword [0x4fb834], 1
jmp case.0x4345d7.97
push dword [0x4fad9c]
call fcn.004998ec
add esp, 4
mov dword [0x4fad9c], 0
push 0x104
push 1
call fcn.0049570f
mov esi, eax
add esp, 8
mov dword [esp + 0x38], esi
mov dword [0x4fad9c], esi
test esi, esi
je case.0x4345d7.97
mov esi, dword [0x540e80]
test esi, esi
je 0x434699
cmp byte [esi], 0
jne 0x434647
push 2
push 1
call fcn.0049570f
add esp, 8
mov edi, eax
jmp 0x43469b
push 0
push 0
push 0xffffffffffffffff
push esi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [esp + 0x14], eax
cmp eax, 1
jle 0x434699
push 2
push eax
call fcn.0049570f
mov edi, eax
add esp, 8
test edi, edi
je 0x434699
push dword [esp + 0x14]
push edi
push 0xffffffffffffffff
push esi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, dword [esp + 0x14]
je 0x43469b
push edi
call fcn.004998ec
add esp, 4
xor edi, edi
cmp dword [esp + 0x38], 0
jne 0x4346a6
xor eax, eax
jmp 0x4346b5
push 2
push 0x104
call fcn.0049570f
add esp, 8
lea ecx, [esp + 0xc0]
mov dword [esp + 0x14], eax
push ecx
push eax
push 0x104
push edi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
mov dword [esp + 0x30], eax
mov esi, dword [esp + 0x14]
je 0x43470d
push 0
push 0
push 0x104
push dword [esp + 0x44]
push 0xffffffffffffffff
push esi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x43470d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x30], eax
test esi, esi
je 0x43471a
push esi
call fcn.004998ec
add esp, 4
test edi, edi
je 0x434727
push edi
call fcn.004998ec
add esp, 4
push dword [esp + 0x30]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [0x4fad9c]
call fcn.00427190
test al, 0x10
je 0x434771
push dword [0x4fad9c]
push str.Could_not_find_image__s_n
call fcn.00426280
push dword [0x4fad9c]
call fcn.004998ec
mov edi, dword [esp + 0x28]
add esp, 0xc
mov dword [0x4fad9c], 0
jmp case.0x4345d7.97
mov edi, dword [esp + 0x1c]
mov dword [0x53db60], 1
jmp case.0x4345d7.97
mov eax, dword [0x540e80]
movzx eax, byte [eax]
push eax
call fcn.0049f2c0
add esp, 4
test eax, eax
je 0x4347b4
push 0
push 0
push dword [0x540e80]
call fcn.004a0eca
add esp, 0xc
mov dword [esp + 0x20], eax
jmp case.0x4345d7.97
push dword [esp + 0x34]
call fcn.004998ec
mov eax, dword [0x540e80]
add esp, 4
test eax, eax
jne 0x4347d2
mov dword [esp + 0x34], eax
jmp case.0x4345d7.97
push eax
call fcn.0049f1d2
add esp, 4
mov dword [esp + 0x34], eax
jmp case.0x4345d7.97
mov eax, dword [0x540e80]
movzx eax, byte [eax]
push eax
call fcn.0049f2c0
add esp, 4
test eax, eax
je 0x43482e
push 0
push 0
push dword [0x540e80]
call fcn.004a0eca
add esp, 0xc
mov esi, eax
mov dword [0x4f47a4], esi
cmp esi, 0xffffffff
jl 0x43481d
cmp esi, 9
jl 0x434826
or esi, 0xffffffff
mov dword [0x4f47a4], esi
mov dword [0x4f47a8], esi
jmp case.0x4345d7.97
xor esi, esi
mov eax, dword [esi*4 + 0x4c9ec8]
mov ecx, ebx
test eax, eax
cmovne ecx, eax
mov eax, dword [0x540e80]
push ecx
test eax, eax
mov ecx, ebx
cmovne ecx, eax
push ecx
call fcn.004a2750
add esp, 8
test eax, eax
je 0x43480d
inc esi
cmp esi, 9
jb 0x434830
mov esi, dword [0x4f47a4]
jmp 0x434813
push dword [0x540e80]
call fcn.004a2aea
add esp, 4
mov dword [esp + 0x2c], eax
jmp case.0x4345d7.97
push 0x10
push 0
push dword [0x540e80]
call fcn.004a0eca
add esp, 0xc
jmp case.0x4345d7.97
mov edi, 1
mov dword [esp + 0x1c], edi
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x88]
mov ecx, dword [esp + 0x28]
push 0
push eax
lea eax, [esp + 0x168]
push eax
push str.ghxf:i:l:w:z:
call fcn.00458560
add esp, 0x10
cmp eax, 0xffffffff
jne 0x4345c4
test edi, edi
je 0x4348fe
push str.Command_line_arguments:
call fcn.004407e0
mov esi, 1
add esp, 4
cmp dword [esp + 0x28], esi
jle 0x4348fe
mov eax, dword [esp + 0x18]
push dword [eax + esi*4]
push 0x4c9bac
call fcn.004407e0
inc esi
add esp, 8
cmp esi, dword [esp + 0x28]
jl 0x4348e3
cmp dword [0x4fb838], 0
je 0x434914
push str.AppStore_version_detected
call fcn.004407e0
add esp, 4
push 0x5429e0
push str._srufus.ini
lea eax, [esp + 0x4b0]
push 0x104
push eax
call fcn.00403820
lea edx, [esp + 0x54]
mov byte [esp + 0x5bb], 0
lea ecx, [esp + 0x4b8]
call fcn.00427330
push 0
xor edx, edx
xor ecx, ecx
mov edi, eax
call fcn.00422b00
add esp, 0x14
mov edx, str._NULL_
test eax, eax
mov ecx, 0x4d7058
cmovne edx, eax
jmp 0x434970
mov al, byte [edx]
cmp al, byte [ecx]
jne 0x434a91
test al, al
je 0x434994
mov al, byte [edx + 1]
cmp al, byte [ecx + 1]
jne 0x434a91
add edx, 2
add ecx, 2
test al, al
jne 0x434970
xor eax, eax
jmp 0x434a96
mov ebx, dword [esp + 0x18]
lea eax, [esp + 0x5b0]
push 0
push eax
push 0
push 0
push dword [ebx]
call fcn.004a40ad
add esp, 0x14
lea eax, [esp + 0x5b0]
push eax
push str._nUsage:__s___x____g____h____f_FILESYSTEM____i_PATH____l_LOCALE____w_TIMEOUT__n
call fcn.00426280
push str.___x____extra_devs_n
call fcn.00426280
add esp, 0xc
push str._____List_extra_devices__such_as_USB_HDDs_n
call fcn.00426280
add esp, 4
push str.___g____gui_n
call fcn.00426280
add esp, 4
push str._____Start_in_GUI_mode__disable_the_rufus.com_commandline_hogger__n
call fcn.00426280
add esp, 4
push str.___i_PATH____isoPATH_n
call fcn.00426280
add esp, 4
push str._____Select_the_ISO_image_pointed_by_PATH_to_be_used_on_startup_n
call fcn.00426280
add esp, 4
push str.___l_LOCALE____localeLOCALE_n
call fcn.00426280
add esp, 4
push str._____Select_the_locale_to_be_used_on_startup_n
call fcn.00426280
add esp, 4
push str.___f_FILESYSTEM____filesystemFILESYSTEM_n
call fcn.00426280
add esp, 4
push str._____Preselect_the_file_system_to_be_preferred_when_formatting_n
call fcn.00426280
add esp, 4
push str.___w_TIMEOUT____waitTIMEOUT_n
call fcn.00426280
add esp, 4
push str._____Wait_TIMEOUT_tens_of_seconds_for_the_global_application_mutex_to_be_released._n
call fcn.00426280
add esp, 4
push str._____Used_when_launching_a_newer_version_of_Rufus_from_a_running_application._n
call fcn.00426280
add esp, 4
push str.___h____help_n
call fcn.00426280
add esp, 4
push str._____This_usage_guide._n
call fcn.00426280
add esp, 4
jmp 0x4355fe
sbb eax, eax
or eax, 1
xor ecx, ecx
test eax, eax
sete cl
or ecx, dword [esp + 0x78]
mov dword [esp + 0x38], ecx
test edi, edi
je 0x434afe
mov esi, 0x5429e0
lea eax, [esp + 0x4a8]
mov dword [0x4fad90], eax
lea ecx, [esi + 1]
lea ecx, [ecx]
mov al, byte [esi]
inc esi
test al, al
jne 0x434ac0
sub esi, ecx
mov ebx, 0x104
inc esi
mov eax, ebx
cmp esi, eax
cmovb eax, esi
push eax
push 0x5429e0
push 0x542ea0
call fcn.00493080
add esp, 0xc
cmp esi, ebx
cmovb ebx, esi
push edi
mov byte [ebx + 0x542e9f], 0
call fcn.00499b6b
add esp, 4
cmp dword [0x4fad90], 0
mov ecx, str.registry
mov eax, str.INI_file
cmove eax, ecx
push eax
push str.Will_use_settings_from__s
call fcn.004407e0
add esp, 8
mov ecx, str.Locale
call fcn.00427780
cmp byte [eax], 0
je 0x434b4a
push eax
call fcn.0049f1d2
add esp, 4
mov dword [esp + 0x34], eax
push eax
push str.found_locale__s
call fcn.004407e0
add esp, 8
mov edx, dword [0x4fad90]
test edx, edx
je 0x434b87
push 1
mov ecx, str.ShowAdvancedDriveProperties
xor edi, edi
call fcn.00420240
mov esi, eax
add esp, 4
test esi, esi
je 0x434b81
push edi
push edi
push esi
call fcn.004a0eca
add esp, 0xc
mov edi, eax
push esi
call fcn.004998ec
add esp, 4
xor ecx, ecx
test edi, edi
jmp 0x434ba8
push 4
lea eax, [esp + 0x7c]
mov edx, str.ShowAdvancedDriveProperties
push eax
push 4
mov ecx, 0x80000001
call fcn.00427520
xor ecx, ecx
add esp, 0xc
cmp dword [esp + 0x78], ecx
mov edx, dword [0x4fad90]
setne cl
mov dword [0x542ae4], ecx
test edx, edx
je 0x434bee
push 1
mov ecx, str.ShowAdvancedFormatOptions
xor edi, edi
call fcn.00420240
mov esi, eax
add esp, 4
test esi, esi
je 0x434be8
push edi
push edi
push esi
call fcn.004a0eca
add esp, 0xc
mov edi, eax
push esi
call fcn.004998ec
add esp, 4
xor ecx, ecx
test edi, edi
jmp 0x434c0f
push 4
lea eax, [esp + 0x18]
mov edx, str.ShowAdvancedFormatOptions
push eax
push 4
mov ecx, 0x80000001
call fcn.00427520
xor ecx, ecx
add esp, 0xc
cmp dword [esp + 0x14], ecx
mov edx, dword [0x4fad90]
setne cl
mov dword [0x542ae8], ecx
test edx, edx
je 0x434c55
push 1
mov ecx, str.PreserveTimestamps
xor edi, edi
call fcn.00420240
mov esi, eax
add esp, 4
test esi, esi
je 0x434c4f
push edi
push edi
push esi
call fcn.004a0eca
add esp, 0xc
mov edi, eax
push esi
call fcn.004998ec
add esp, 4
xor ecx, ecx
test edi, edi
jmp 0x434c7c
push 4
lea eax, [esp + 0xd0]
mov edx, str.PreserveTimestamps
push eax
push 4
mov ecx, 0x80000001
call fcn.00427520
xor ecx, ecx
add esp, 0xc
cmp dword [esp + 0xcc], ecx
mov edx, dword [0x4fad90]
setne cl
mov dword [0x4fadc0], ecx
test edx, edx
je 0x434cc2
push 1
mov ecx, str.UseProperSizeUnits
xor edi, edi
call fcn.00420240
mov esi, eax
add esp, 4
test esi, esi
je 0x434cbc
push edi
push edi
push esi
call fcn.004a0eca
add esp, 0xc
mov edi, eax
push esi
call fcn.004998ec
add esp, 4
xor ecx, ecx
test edi, edi
jmp 0x434ce9
push 4
lea eax, [esp + 0xd4]
mov edx, str.UseProperSizeUnits
push eax
push 4
mov ecx, 0x80000001
call fcn.00427520
xor ecx, ecx
add esp, 0xc
cmp dword [esp + 0xd0], ecx
mov ebx, dword [sym.imp.ole32.dll_CoInitializeEx]
sete cl
push 6
push 0
mov dword [0x542af0], ecx
mov dword [esp + 0x38], 0
mov dword [esp + 0x24], 0
call ebx
push 0
push 0
push 0
push 3
push 2
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
lea eax, [esp + 0x1c]
push eax
push 0x4bc5b0
push 0x14
push 0
push 0x4cfa28
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test esi, esi
je 0x434d5b
mov edi, dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
call edi
call fcn.00440bb0
push eax
push str.Notice:_Disabling_VDS__Could_not_create_VDS_Loader_Instance:__s_
jmp 0x434d8b
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x30]
push edx
push 0x4ce3a4
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0xc]
call eax
mov edi, dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, eax
test esi, esi
je 0x434d93
push esi
call edi
call fcn.00440bb0
push eax
push str.Notice:_Disabling_VDS__Could_not_load_VDS_Service:__s_
call fcn.004407e0
add esp, 8
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x434da3
mov eax, dword [ecx]
push ecx
mov eax, dword [eax + 8]
call eax
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x434db3
mov eax, dword [ecx]
push ecx
mov eax, dword [eax + 8]
call eax
test esi, esi
je 0x434dc4
push esi
call edi
mov dword [0x4fa958], 0xc003001f
mov edx, dword [0x4fad90]
xor eax, eax
test esi, esi
sete al
mov dword [0x4f4254], eax
test edx, edx
je 0x434e0d
push 1
mov ecx, str.UseVds
xor edi, edi
call fcn.00420240
mov esi, eax
add esp, 4
test esi, esi
je 0x434e07
push edi
push edi
push esi
call fcn.004a0eca
add esp, 0xc
mov edi, eax
push esi
call fcn.004998ec
add esp, 4
xor ecx, ecx
test edi, edi
jmp 0x434e34
push 4
lea eax, [esp + 0xd8]
mov edx, str.UseVds
push eax
push 4
mov ecx, 0x80000001
call fcn.00427520
xor ecx, ecx
add esp, 0xc
cmp dword [esp + 0xd4], ecx
setne cl
test ecx, ecx
je 0x434e4b
cmp dword [0x4f4254], 0
je 0x434e4b
mov eax, 1
jmp 0x434e4d
xor eax, eax
mov edx, dword [0x4fad90]
mov dword [0x4fada4], eax
test edx, edx
je 0x434e8f
push 1
mov ecx, str.EnableUsbDebug
xor edi, edi
call fcn.00420240
mov esi, eax
add esp, 4
test esi, esi
je 0x434e89
push edi
push edi
push esi
call fcn.004a0eca
add esp, 0xc
mov edi, eax
push esi
call fcn.004998ec
add esp, 4
xor eax, eax
test edi, edi
jmp 0x434eb6
push 4
lea eax, [esp + 0xdc]
mov edx, str.EnableUsbDebug
push eax
push 4
mov ecx, 0x80000001
call fcn.00427520
xor eax, eax
add esp, 0xc
cmp dword [esp + 0xd8], eax
mov edx, dword [0x4fad90]
setne al
mov dword [0x542fb4], eax
xor eax, 1
lea eax, [eax*2 + 1]
mov dword [0x4f4358], eax
test edx, edx
je 0x434f0a
push 1
mov ecx, str.DisableFakeDrivesCheck
xor edi, edi
call fcn.00420240
mov esi, eax
add esp, 4
test esi, esi
je 0x434f04
push edi
push edi
push esi
call fcn.004a0eca
add esp, 0xc
mov edi, eax
push esi
call fcn.004998ec
add esp, 4
xor ecx, ecx
test edi, edi
jmp 0x434f31
push 4
lea eax, [esp + 0xe0]
mov edx, str.DisableFakeDrivesCheck
push eax
push 4
mov ecx, 0x80000001
call fcn.00427520
xor ecx, ecx
add esp, 0xc
cmp dword [esp + 0xdc], ecx
mov edx, dword [0x4fad90]
sete cl
mov dword [0x5430c8], ecx
test edx, edx
je 0x434f77
push 1
mov ecx, str.EnableWindowsDualUefiBiosMode
xor edi, edi
call fcn.00420240
mov esi, eax
add esp, 4
test esi, esi
je 0x434f71
push edi
push edi
push esi
call fcn.004a0eca
add esp, 0xc
mov edi, eax
push esi
call fcn.004998ec
add esp, 4
xor ecx, ecx
test edi, edi
jmp 0x434f9e
push 4
lea eax, [esp + 0xe4]
mov edx, str.EnableWindowsDualUefiBiosMode
push eax
push 4
mov ecx, 0x80000001
call fcn.00427520
xor ecx, ecx
add esp, 0xc
cmp dword [esp + 0xe0], ecx
mov edx, dword [0x4fad90]
setne cl
mov dword [0x542e6c], ecx
test edx, edx
je 0x434fe4
push 1
mov ecx, str.ForceLargeFat32Formatting
xor edi, edi
call fcn.00420240
mov esi, eax
add esp, 4
test esi, esi
je 0x434fde
push edi
push edi
push esi
call fcn.004a0eca
add esp, 0xc
mov edi, eax
push esi
call fcn.004998ec
add esp, 4
xor ecx, ecx
test edi, edi
jmp 0x43500b
push 4
lea eax, [esp + 0xbc]
mov edx, str.ForceLargeFat32Formatting
push eax
push 4
mov ecx, 0x80000001
call fcn.00427520
xor ecx, ecx
add esp, 0xc
cmp dword [esp + 0xb8], ecx
mov edx, dword [0x4fad90]
setne cl
mov dword [0x542fa4], ecx
test edx, edx
je 0x435051
push 1
mov ecx, str.EnableVmdkDetection
xor edi, edi
call fcn.00420240
mov esi, eax
add esp, 4
test esi, esi
je 0x43504b
push edi
push edi
push esi
call fcn.004a0eca
add esp, 0xc
mov edi, eax
push esi
call fcn.004998ec
add esp, 4
xor ecx, ecx
test edi, edi
jmp 0x435078
push 4
lea eax, [esp + 0xc0]
mov edx, str.EnableVmdkDetection
push eax
push 4
mov ecx, 0x80000001
call fcn.00427520
xor ecx, ecx
add esp, 0xc
cmp dword [esp + 0xbc], ecx
mov edx, dword [0x4fad90]
setne cl
mov dword [0x5429c4], ecx
test edx, edx
je 0x4350be
push 1
mov ecx, str.EnableFileIndexing
xor edi, edi
call fcn.00420240
mov esi, eax
add esp, 4
test esi, esi
je 0x4350b8
push edi
push edi
push esi
call fcn.004a0eca
add esp, 0xc
mov edi, eax
push esi
call fcn.004998ec
add esp, 4
xor ecx, ecx
test edi, edi
jmp 0x4350e5
push 4
lea eax, [esp + 0x15c]
mov edx, str.EnableFileIndexing
push eax
push 4
mov ecx, 0x80000001
call fcn.00427520
xor ecx, ecx
add esp, 0xc
cmp dword [esp + 0x158], ecx
mov edx, dword [0x4fad90]
setne cl
mov dword [0x542fa8], ecx
test edx, edx
je 0x43512b
push 1
mov ecx, str.DisableVHDs
xor edi, edi
call fcn.00420240
mov esi, eax
add esp, 4
test esi, esi
je 0x435125
push edi
push edi
push esi
call fcn.004a0eca
add esp, 0xc
mov edi, eax
push esi
call fcn.004998ec
add esp, 4
xor ecx, ecx
test edi, edi
jmp 0x435152
push 4
lea eax, [esp + 0xa8]
mov edx, str.DisableVHDs
push eax
push 4
mov ecx, 0x80000001
call fcn.00427520
xor ecx, ecx
add esp, 0xc
cmp dword [esp + 0xa4], ecx
mov edx, dword [0x4fad90]
sete cl
mov dword [0x4f432c], ecx
test edx, edx
je 0x435198
push 1
mov ecx, str.EnableExtraHashes
xor edi, edi
call fcn.00420240
mov esi, eax
add esp, 4
test esi, esi
je 0x435192
push edi
push edi
push esi
call fcn.004a0eca
add esp, 0xc
mov edi, eax
push esi
call fcn.004998ec
add esp, 4
xor ecx, ecx
test edi, edi
jmp 0x4351bf
push 4
lea eax, [esp + 0xac]
mov edx, str.EnableExtraHashes
push eax
push 4
mov ecx, 0x80000001
call fcn.00427520
xor ecx, ecx
add esp, 0xc
cmp dword [esp + 0xa8], ecx
mov edx, dword [0x4fad90]
setne cl
mov dword [0x4fb84c], ecx
test edx, edx
je 0x435205
push 1
mov ecx, str.ExpertMode
xor edi, edi
call fcn.00420240
mov esi, eax
add esp, 4
test esi, esi
je 0x4351ff
push edi
push edi
push esi
call fcn.004a0eca
add esp, 0xc
mov edi, eax
push esi
call fcn.004998ec
add esp, 4
xor ecx, ecx
test edi, edi
jmp 0x43522c
push 4
lea eax, [esp + 0xb0]
mov edx, str.ExpertMode
push eax
push 4
mov ecx, 0x80000001
call fcn.00427520
xor ecx, ecx
add esp, 0xc
cmp dword [esp + 0xac], ecx
mov edx, dword [0x4fad90]
setne cl
mov dword [0x4fae14], ecx
test edx, edx
je 0x435272
push 1
mov ecx, str.IgnoreBootMarker
xor edi, edi
call fcn.00420240
mov esi, eax
add esp, 4
test esi, esi
je 0x43526c
push edi
push edi
push esi
call fcn.004a0eca
add esp, 0xc
mov edi, eax
push esi
call fcn.004998ec
add esp, 4
xor ecx, ecx
test edi, edi
jmp 0x435296
push 4
lea eax, [esp + 0x80]
mov edx, str.IgnoreBootMarker
push eax
push 4
mov ecx, 0x80000001
call fcn.00427520
xor ecx, ecx
add esp, 0xc
cmp dword [esp + 0x7c], ecx
mov edx, dword [0x4fad90]
setne cl
mov dword [0x4fae1c], ecx
test edx, edx
je 0x4352dc
push 1
mov ecx, str.PersistentLog
xor edi, edi
call fcn.00420240
mov esi, eax
add esp, 4
test esi, esi
je 0x4352d6
push edi
push edi
push esi
call fcn.004a0eca
add esp, 0xc
mov edi, eax
push esi
call fcn.004998ec
add esp, 4
xor ecx, ecx
test edi, edi
jmp 0x435303
push 4
lea eax, [esp + 0x84]
mov edx, str.PersistentLog
push eax
push 4
mov ecx, 0x80000001
call fcn.00427520
xor ecx, ecx
add esp, 0xc
cmp dword [esp + 0x80], ecx
setne cl
mov dword [0x4fae0c], ecx
mov ecx, str.PreferredSaveImageType
call fcn.00427780
mov edx, dword [0x4fad90]
mov dword [0x4fb830], eax
test edx, edx
je 0x435354
push 1
mov ecx, str.WindowsUserExperienceOptions
xor esi, esi
call fcn.00420240
mov edi, eax
add esp, 4
test edi, edi
je 0x435373
push esi
push esi
push edi
call fcn.004a0eca
add esp, 0xc
mov esi, eax
push edi
call fcn.004998ec
add esp, 4
jmp 0x435373
push 4
lea eax, [esp + 0x44]
mov edx, str.WindowsUserExperienceOptions
push eax
push 4
mov ecx, 0x80000001
call fcn.00427520
mov esi, dword [esp + 0x4c]
add esp, 0xc
mov ecx, esi
shr ecx, 0x10
test ecx, ecx
je 0x43538f
mov eax, ecx
and ecx, esi
not eax
and eax, dword [0x4f434c]
or eax, ecx
mov dword [0x4f434c], eax
mov edx, dword [0x4fad90]
test edx, edx
je 0x4353c8
push 1
mov ecx, str.DefaultThreadPriority
xor edi, edi
call fcn.00420240
mov esi, eax
add esp, 4
test esi, esi
je 0x4353e7
push edi
push edi
push esi
call fcn.004a0eca
add esp, 0xc
mov edi, eax
push esi
call fcn.004998ec
add esp, 4
jmp 0x4353e7
push 4
lea eax, [esp + 0x14]
mov edx, str.DefaultThreadPriority
push eax
push 4
mov ecx, 0x80000001
call fcn.00427520
mov edi, dword [esp + 0x1c]
add esp, 0xc
lea eax, [edi + 1]
push 0
mov dword [0x4f431c], eax
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
push 0x58
push esi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
fstp dword [esp + 0x10]
fld dword [esp + 0x10]
fdiv qword [0x4ebb60]
fstp dword [0x4f4324]
cmp esi, 0xffffffff
je 0x435430
test esi, esi
je 0x435430
push esi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
xor ecx, ecx
call fcn.0041a7e0
push str.rufus.loc
push 0x5429e0
push 0x4da668
lea eax, [esp + 0x2a4]
push 0x104
push eax
call fcn.00403820
add esp, 0x14
mov byte [esp + 0x39b], 0
lea ecx, [esp + 0x298]
call fcn.00427190
cmp eax, 0xffffffff
jne 0x435974
push str.loc_file_not_found_in_current_directory___embedded_one_will_be_used
call fcn.004407e0
mov esi, dword [0x542fb0]
add esp, 4
xor ebx, ebx
push 0xa
push 0x1f4
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x4354bf
call fcn.00440bb0
push eax
push str.embedded.loc
push str.Could_not_locate_resource__s:__s
call fcn.004407e0
mov edi, dword [esp + 0x1c]
add esp, 0xc
jmp 0x4354fe
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
jne 0x4354eb
call fcn.00440bb0
push eax
push str.embedded.loc
push str.Could_not_load_resource__s:__s
call fcn.004407e0
mov edi, dword [esp + 0x1c]
add esp, 0xc
jmp 0x4354fe
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push ebx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
lea eax, [esp + 0x298]
push eax
push ecx
call fcn.00413620
add esp, 8
test eax, eax
je 0x43594d
cmp byte [esp + 0x298], 0
je 0x43594d
push ecx
push 0x80
push 2
sub esp, 8
lea ecx, [esp + 0x2ac]
mov edx, 0xc0000000
call fcn.00427030
mov esi, eax
add esp, 0x14
cmp esi, 0xffffffff
je 0x43590e
push ecx
lea eax, [esp + 0x90]
mov edx, ebx
push eax
push edi
mov ecx, esi
call fcn.004417e0
add esp, 0xc
test eax, eax
je 0x43590e
lea eax, [esp + 0x298]
push eax
push str.localization:_extracted_data_to__s
call fcn.004407e0
add esp, 8
test esi, esi
je 0x43558d
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [sym.imp.ole32.dll_CoInitializeEx]
lea ecx, [esp + 0x298]
call fcn.0041f640
test eax, eax
je 0x4355d6
mov eax, dword [esp + 0x34]
test eax, eax
jne 0x435a4b
mov eax, dword [0x4fa97c]
cmp eax, 0x4fa978
jne 0x4359ea
push str.localization:_the_locale_list_is_empty__n
call fcn.004407e0
add esp, 4
mov dword [0x4fadd8], 0
push str.FATAL:_Could_not_access_locale_
call fcn.004407e0
add esp, 4
push 0x1010
push str.Fatal_error
push str.The_locale_data_is_missing_or_invalid._This_application_will_now_exit.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ebx, dword [esp + 0x18]
cmp dword [esp + 0x74], 0
je 0x43562a
cmp dword [esp + 0x70], 0
jne 0x43562a
mov esi, dword [esp + 0x98]
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
cmp esi, 0xffffffff
je 0x43562a
test esi, esi
je 0x43562a
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x4fad8c]
test eax, eax
je 0x43563c
push 1
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
cmp dword [esp + 0x9c], 0
jne 0x43567b
cmp byte [esp + 0x298], 0
je 0x43567b
lea ecx, [esp + 0x298]
call fcn.00409dc0
test eax, eax
jne 0x43567b
call fcn.00440bb0
push eax
lea eax, [esp + 0x29c]
push eax
push str.Could_not_delete__s:__s
call fcn.004407e0
add esp, 0xc
call fcn.00444ed0
push dword [0x53f104]
call dword [sym.imp.USER32.dll_UnhookWinEvent]
xor ecx, ecx
mov dword [0x53f104], 0
call fcn.0041a8e0
push dword [0x4fad9c]
call fcn.004998ec
add esp, 4
mov dword [0x4fad9c], 0
push dword [0x4fadd0]
call fcn.004998ec
add esp, 4
mov dword [0x4fadd0], 0
push dword [esp + 0x34]
call fcn.004998ec
add esp, 4
push dword [0x4fadf0]
call fcn.004998ec
add esp, 4
mov dword [0x4fadf0], 0
push dword [0x4fadf4]
call fcn.004998ec
add esp, 4
mov dword [0x4fadf4], 0
push dword [0x4fa960]
call fcn.004998ec
add esp, 4
mov dword [0x4fa960], 0
push dword [0x4fadfc]
call fcn.004998ec
add esp, 4
mov dword [0x4fadfc], 0
push dword [0x4fad88]
call fcn.004998ec
add esp, 4
mov dword [0x4fad88], 0
push dword [0x4fb844]
call fcn.004998ec
add esp, 4
mov dword [0x4fb844], 0
test ebx, ebx
je 0x435797
xor esi, esi
cmp dword [esp + 0x28], esi
jle 0x43578e
push dword [ebx + esi*4]
call fcn.004998ec
mov dword [ebx + esi*4], 0
add esp, 4
inc esi
cmp esi, dword [esp + 0x28]
jl 0x435775
push ebx
call fcn.004998ec
add esp, 4
cmp dword [esp + 0xa0], 0
je 0x4357b3
push 0
sub esp, 8
mov ecx, 1
call fcn.00440190
add esp, 0xc
cmp dword [esp + 0x4c], 0
jne 0x43581e
push 0
push 0x80
push 3
push 0
push 3
push 0
push str..MountPointManager
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x435811
push 0
lea eax, [esp + 0xa8]
push eax
push 0
push 0
push 4
lea eax, [esp + 0x24]
push eax
push 0x6dc040
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
jne 0x43581e
push str.Failed_to_restore_AutoMount_to_disabled
call fcn.004407e0
add esp, 4
cmp dword [0x52b91c], 0
je 0x435839
push 0x540f60
push 0x4c9bac
call fcn.004407e0
add esp, 8
mov ecx, 0x5429e0
mov dword [0x52b91c], 0
call fcn.00427270
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor esi, esi
push str.rufus.com
call edi
test eax, eax
jne 0x43587c
cmp esi, 0xa
jg 0x43587c
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.rufus.com
inc esi
call edi
test eax, eax
je 0x435860
push dword [esp + 0x3c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ax, word [0x4fad98]
test ax, ax
je 0x4358c2
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edi, 0xffff
add ax, di
mov word [0x4fad98], ax
movzx eax, ax
push dword [eax*4 + 0x542fc0]
call esi
mov ax, word [0x4fad98]
test ax, ax
jne 0x4358a2
cmp dword [esp + 0x74], 0
je 0x4358e8
push 3
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
call dword [sym.imp.KERNEL32.dll_FreeConsole]
push str._Rufus_exit__n
call fcn.004407e0
mov ecx, dword [esp + 0x9c8]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00491940
mov esp, ebp
pop ebp
ret 0x10
call fcn.00440bb0
push eax
lea eax, [esp + 0x29c]
push eax
push str.FATAL:_Unable_to_extract_loc_file__s:__s
call fcn.004407e0
add esp, 0xc
cmp esi, 0xffffffff
je 0x435939
test esi, esi
je 0x435939
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x1010
push str.Fatal_error
push str.Unable_to_extract_localization_file._This_application_will_now_exit.
jmp 0x4355f2
call fcn.00440bb0
push eax
push str.FATAL:_Unable_to_create_temp_loc_file:__s
call fcn.004407e0
add esp, 8
push 0x1010
push str.Fatal_error
push str.Unable_to_create_temporary_localization_file._This_application_will_now_exit.
jmp 0x4355f2
mov ecx, dword [0x52b91c]
lea eax, [esp + 0x298]
push eax
mov eax, 0xffc
mov dword [esp + 0xa0], 1
sub eax, ecx
push str.Using_external_loc_file__s
push eax
lea eax, [ecx + 0x540f60]
push eax
call fcn.00403820
mov ecx, 0x540f60
mov byte [0x541f5b], 0
add esp, 0x10
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4359b8
sub ecx, edx
mov word [ecx + 0x540f60], 0xa0d
add ecx, 2
mov dword [0x52b91c], ecx
cmp ecx, 0x1000
jae 0x437741
mov byte [ecx + 0x540f60], al
jmp 0x435593
lea edi, [eax - 0x1c]
mov esi, edi
lea eax, [esi + 0x1c]
cmp eax, 0x4fa978
je 0x435a33
lea esp, [esp]
movzx edx, byte [esi + 1]
xor ecx, ecx
test edx, edx
je 0x435a26
mov eax, dword [esi + 0x10]
lea ecx, [ecx]
mov ebx, dword [esp + 0x20]
cmp dword [eax], ebx
mov ebx, dword [sym.imp.ole32.dll_CoInitializeEx]
je 0x435a59
inc ecx
add eax, 4
cmp ecx, edx
jl 0x435a10
mov eax, dword [esi + 0x20]
lea esi, [eax - 0x1c]
cmp eax, 0x4fa978
jne 0x435a00
push dword [edi + 0x14]
push dword [esp + 0x24]
push str.localization:_could_not_find_locale_for_LCID:_0x_04X._Will_default_to__s_n
call fcn.004407e0
add esp, 0xc
mov esi, edi
jmp 0x435a59
mov edx, 1
mov ecx, eax
call fcn.0041b5f0
mov esi, eax
mov dword [0x4fadd8], esi
test esi, esi
je 0x4355d6
mov ecx, esi
call fcn.0041b720
mov word [0x4f42fc], ax
call fcn.0043e220
push ecx
lea eax, [esp + 0x44]
mov dword [esp + 0x18], 0
push eax
push ecx
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystemEnableLUA
mov dword [esp + 0x2c], 0xffffffff
mov ecx, 0x80000002
mov dword [esp + 0x164], 0
mov word [esp + 0x168], 0x500
call fcn.0043dd40
add esp, 0xc
cmp dword [esp + 0x40], 1
jne 0x435b48
push str.Note:_UAC_is_active
call fcn.004407e0
add esp, 4
lea eax, [esp + 0x20]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x435aff
call fcn.00440bb0
push eax
push str.Could_not_get_current_process_token:__s
call fcn.004407e0
add esp, 8
jmp 0x435ba4
lea eax, [esp + 0xc0]
push eax
push 4
lea eax, [esp + 0x88]
push eax
push 0x14
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x435b36
call fcn.00440bb0
push eax
push str.Could_not_get_token_information:__s
call fcn.004407e0
add esp, 8
jmp 0x435ba4
xor eax, eax
cmp dword [esp + 0x80], eax
setne al
mov dword [esp + 0x14], eax
jmp 0x435ba4
push str.Note:_UAC_is_either_disabled_or_not_available
call fcn.004407e0
add esp, 4
lea eax, [esp + 0x30]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [esp + 0x180]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x435ba4
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x34]
push 0
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
push dword [esp + 0x30]
neg eax
sbb eax, eax
and dword [esp + 0x18], eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [esp + 0x20]
cmp eax, 0xffffffff
je 0x435bb8
test eax, eax
je 0x435bb8
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x14], 0
jne 0x435c2b
push str.FATAL:_No_administrative_privileges_
call fcn.004407e0
mov edx, dword [0x4fadd8]
lea ecx, [esp + 0x29c]
add esp, 4
call fcn.0041fbd0
mov eax, dword [0x4fadd8]
mov edx, 0x181010
mov ecx, dword [eax + 4]
mov eax, 0x1010
and ecx, 1
push ecx
cmovne eax, edx
mov dword [0x4fada0], ecx
push eax
push 0xcd8
call fcn.0041afe0
add esp, 4
push eax
push ecx
push 0xcd9
call fcn.0041afe0
add esp, 8
mov edx, eax
xor ecx, ecx
call fcn.004226d0
add esp, 0xc
jmp 0x4355fa
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x435c6c
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x435c37
sub ecx, esi
cmp ecx, 2
jne 0x435c6c
cmp byte [edx], 0x2f
jne 0x435c6c
cmp byte [edx + 1], 0x57
jne 0x435c6c
mov esi, dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edi, 0x96
push str.Global_Rufus
push 1
push 0
call esi
mov dword [esp + 0x3c], eax
jmp 0x435c90
mov esi, dword [sym.imp.KERNEL32.dll_CreateMutexA]
push str.Global_Rufus
push 1
push 0
call esi
mov edi, dword [esp + 0x2c]
mov dword [esp + 0x3c], eax
test edi, edi
jle 0x435ccb
lea esp, [esp]
test eax, eax
je 0x4376e2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x435cd3
push dword [esp + 0x3c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.Global_Rufus
push 1
push 0
call esi
dec edi
mov dword [esp + 0x3c], eax
test edi, edi
jg 0x435c90
test eax, eax
je 0x4376e2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4376e2
mov eax, dword [esp + 0x90]
push 6
push 0
mov dword [0x542fb0], eax
call ebx
mov ecx, str.Riched20
call fcn.00409990
test eax, eax
jne 0x435d17
call fcn.00440bb0
push eax
push str.Could_not_load_RichEdit_library___some_dialogs_may_not_display:__s_n
call fcn.004407e0
add esp, 8
call fcn.00426080
push 0x9e
sub esp, 8
xor ecx, ecx
call fcn.00440190
add esp, 0xc
mov dword [esp + 0xa0], eax
push 0
push 0x80
push 3
push 0
push 3
push 0
push str..MountPointManager
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x435e01
push 0
lea eax, [esp + 0xb0]
push eax
push 4
lea eax, [esp + 0x58]
push eax
push 0
push 0
push 0x6d003c
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, eax
push edi
call ebx
test esi, esi
je 0x435e01
cmp dword [esp + 0x4c], 0
jne 0x435e16
push str.AutoMount_was_detected_as_disabled___temporarily_re_enabling_it
call fcn.004407e0
add esp, 4
mov dword [esp + 0x10], 1
push 0
push 0x80
push 3
push 0
push 3
push 0
push str..MountPointManager
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x435df5
push 0
lea eax, [esp + 0xac]
push eax
push 0
push 0
push 4
lea eax, [esp + 0x24]
push eax
push 0x6dc040
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push edi
mov esi, eax
call ebx
test esi, esi
jne 0x435e16
push str.Failed_to_enable_AutoMount
call fcn.004407e0
jmp 0x435e13
push str.Could_not_get_AutoMount_status
call fcn.004407e0
mov dword [esp + 0x50], 1
add esp, 4
xor eax, eax
mov dword [esp + 0x104], 0
xor ecx, ecx
xor edi, edi
push ebx
cpuid
mov esi, ebx
mov dword [esp + 0x144], edi
mov dword [esp + 0x130], edi
pop ebx
lea ebx, [esp + 0x104]
mov dword [ebx], eax
mov dword [ebx + 4], esi
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], edx
mov eax, dword [esp + 0x104]
cmp eax, 1
jb 0x435e86
mov eax, 1
lea edi, [esp + 0x138]
xor ecx, ecx
push ebx
cpuid
mov esi, ebx
pop ebx
mov dword [edi], eax
mov eax, dword [esp + 0x104]
mov dword [edi + 4], esi
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
mov edi, dword [esp + 0x140]
cmp eax, 7
jb 0x435eaa
mov eax, 7
xor ecx, ecx
push ebx
cpuid
mov esi, ebx
pop ebx
lea ebx, [esp + 0x128]
mov dword [ebx], eax
mov dword [ebx + 4], esi
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], edx
bt edi, 0x13
setb cl
bt edi, 9
setb al
test al, cl
je 0x435ed0
test dword [esp + 0x12c], 0x20000000
je 0x435ed0
mov eax, 1
jmp 0x435ed2
xor eax, eax
mov dword [0x4fa948], eax
xor ecx, ecx
xor eax, eax
mov dword [esp + 0x114], 0
push ebx
cpuid
xor edi, edi
mov esi, ebx
mov dword [esp + 0x154], edi
mov dword [esp + 0xec], edi
pop ebx
lea ebx, [esp + 0x114]
mov dword [ebx], eax
mov dword [ebx + 4], esi
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], edx
mov eax, dword [esp + 0x114]
cmp eax, 1
jb 0x435f47
mov eax, 1
lea edi, [esp + 0x148]
xor ecx, ecx
push ebx
cpuid
mov esi, ebx
pop ebx
mov dword [edi], eax
mov eax, dword [esp + 0x114]
mov dword [edi + 4], esi
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
mov edi, dword [esp + 0x150]
cmp eax, 7
jb 0x435f6b
mov eax, 7
xor ecx, ecx
push ebx
cpuid
mov esi, ebx
pop ebx
lea ebx, [esp + 0xe4]
mov dword [ebx], eax
mov dword [ebx + 4], esi
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], edx
bt edi, 0x13
setb cl
bt edi, 9
setb al
test al, cl
je 0x435f91
test dword [esp + 0xe8], 0x20000000
je 0x435f91
mov eax, 1
jmp 0x435f93
xor eax, eax
push 0x542d60
push str._sdismFfuProvider.dll
mov dword [0x4fa94c], eax
lea eax, [esp + 0x3a8]
push 0x104
push eax
call fcn.00403820
lea ecx, [esp + 0x3b0]
mov byte [esp + 0x4b3], 0
call fcn.00427460
mov ecx, dword [0x52b91c]
neg eax
sbb eax, eax
inc eax
mov dword [0x4fadbc], eax
mov eax, dword [0x4fadd8]
push dword [eax + 0x14]
mov eax, 0xffc
sub eax, ecx
push str.Localization_set_to__s
push eax
lea eax, [ecx + 0x540f60]
push eax
call fcn.00403820
mov ecx, 0x540f60
mov byte [0x541f5b], 0
add esp, 0x20
lea edx, [ecx + 1]
jmp 0x436010
mov al, byte [ecx]
inc ecx
test al, al
jne 0x436010
sub ecx, edx
mov word [ecx + 0x540f60], 0xa0d
add ecx, 2
mov dword [0x52b91c], ecx
cmp ecx, 0x1000
jae 0x437741
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
mov esi, 0x181034
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x436050
mov eax, dword [0x4fadd8]
push dword [0x4fadfc]
mov byte [ecx + 0x540f60], 0
mov byte [0x4f42fe], 1
mov eax, dword [eax + 4]
and eax, 1
mov byte [0x542200], 0
mov dword [0x4fada0], eax
mov dword [0x53db10], 0
call fcn.004998ec
xor eax, eax
mov dword [0x4fadfc], 0
add esp, 4
cmp dword [0x4fada0], eax
setne al
push eax
call dword [sym.imp.USER32.dll_SetProcessDefaultLayout]
mov edx, dword [0x4fadd8]
lea ecx, [esp + 0x298]
call fcn.0041fbd0
test eax, eax
je 0x43610f
cmp dword [0x4fad90], 0
mov eax, dword [0x4fadd8]
mov edx, dword [eax + 0x14]
je 0x4360e0
push ecx
mov ecx, str.Locale
call fcn.00420500
add esp, 4
jmp 0x43610f
test edx, edx
jne 0x4360e8
xor ecx, ecx
jmp 0x4360fe
mov ecx, edx
lea esi, [ecx + 1]
lea ecx, [ecx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4360f0
sub ecx, esi
mov esi, 0x181034
push ecx
push edx
push 1
mov edx, str.Locale
call fcn.0041bda0
add esp, 0xc
cmp dword [esp + 0x38], 0
jne 0x436160
cmp dword [0x4fada0], 0
mov eax, 0x1034
push ecx
cmovne eax, esi
push eax
push 0xcdf
call fcn.0041afe0
add esp, 4
push eax
push ecx
push 0xce0
call fcn.0041afe0
add esp, 8
mov edx, eax
xor ecx, ecx
call fcn.004226d0
add esp, 0xc
cmp eax, 6
jne 0x4355fa
mov dword [esp + 0x38], 1
mov eax, dword [esp + 0x24]
test eax, eax
je 0x43616f
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov ecx, 0x65
call fcn.00447110
mov esi, eax
test esi, esi
jne 0x436196
push 0x726
push str.C:UsersgamerDownloads_rufus72_rufus_7_src_stdlg.c
push str.rcTemplate___NULL
call fcn.0049ed6b
add esp, 0xc
push 0
push 0x42fc50
push 0
push esi
push dword [esp + 0xa0]
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
push esi
mov dword [esp + 0x28], eax
call fcn.004998ec
mov esi, dword [esp + 0x28]
add esp, 4
test esi, esi
je 0x4375db
mov ecx, dword [0x4f4794]
cmp ecx, 0xffff0000
jle 0x4361f1
mov eax, dword [0x4f4798]
cmp eax, 0xffff0000
jle 0x4361f1
push 1
push 0
push 0
push eax
push ecx
push 0
push esi
call dword [sym.imp.USER32.dll_SetWindowPos]
push 0
push 1
push 0x233
push esi
mov esi, dword [sym.imp.USER32.dll_ChangeWindowMessageFilterEx]
call esi
push 0
push 1
push 0x4a
push dword [esp + 0x30]
call esi
push 0
push 1
push 0x49
push dword [esp + 0x30]
call esi
call fcn.004475f0
cmp dword [0x53f104], 0
jne 0x43625d
push 2
push 0
push 0
push 0x4474b0
push 0
push 3
push 3
call dword [sym.imp.USER32.dll_SetWinEventHook]
xor ecx, ecx
mov dword [0x53f104], eax
test eax, eax
setne cl
test ecx, ecx
jne 0x43625d
push str.Warning:_Could_not_set_alert_prompt_hook
call fcn.004407e0
add esp, 4
mov esi, dword [esp + 0x24]
push 1
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0
push 0
push 0
lea eax, [esp + 0x5c]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x43669a
lea ebx, [ebx]
mov eax, dword [esp + 0x54]
cmp eax, 0x104
jne 0x4362ac
test dword [esp + 0x5c], 0x20000000
jne 0x4362ac
mov esi, 1
jmp 0x4362b5
xor esi, esi
cmp eax, 0x104
jne 0x4362c6
cmp dword [esp + 0x58], 0x12
je 0x4362c6
mov dword [esp + 0x6c], 1
jmp 0x4362df
push 0x12
call ebx
bt ax, 0xf
mov ecx, 1
mov eax, dword [esp + 0x48]
cmovb eax, ecx
mov dword [esp + 0x48], eax
push dword [0x4fae10]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x436325
push 0x11
call ebx
bt ax, 0xf
jae 0x436325
mov edx, dword [esp + 0x54]
mov ecx, dword [esp + 0x58]
cmp edx, 0x100
jne 0x43632d
cmp ecx, 0x41
jne 0x43632d
push 0xffffffffffffffff
push 0
push 0xb1
push dword [0x4fae2c]
call edi
jmp 0x436681
mov ecx, dword [esp + 0x58]
mov edx, dword [esp + 0x54]
test esi, esi
je 0x436345
mov eax, dword [0x53d948]
cmp ecx, 0x11
cmove eax, dword [0x4f4318]
mov dword [0x53d948], eax
cmp dword [0x53d948], 0
jne 0x436369
push 0x11
call ebx
bt ax, 0xf
mov edx, dword [esp + 0x54]
mov ecx, dword [esp + 0x58]
jae 0x436391
cmp edx, 0x100
jne 0x436391
cmp ecx, 0x4c
jne 0x436391
push 0
push 0x41e
push 0x111
push dword [0x5430c4]
mov dword [0x53d948], 0
call edi
jmp 0x436681
cmp dword [0x53d948], 0
jne 0x4363bd
push 0x11
call ebx
bt ax, 0xf
mov edx, dword [esp + 0x54]
mov ecx, dword [esp + 0x58]
jae 0x43644d
cmp edx, 0x100
jne 0x43644d
cmp ecx, 0x50
jne 0x43644d
xor eax, eax
cmp dword [0x4fae0c], eax
sete al
cmp dword [0x4fad90], 0
mov dword [0x4fae0c], eax
je 0x436423
push eax
push 0x4d59b0
lea eax, [esp + 0x1ec]
push 0xc
push eax
call fcn.00403820
add esp, 0xc
mov byte [esp + 0x1f3], 0
lea edx, [esp + 0x1e8]
mov ecx, str.PersistentLog
call fcn.00420500
mov esi, dword [0x4fae0c]
add esp, 4
push 0xd08
jmp 0x43752b
mov dword [esp + 0x10], eax
mov edx, str.PersistentLog
push 4
lea eax, [esp + 0x14]
push eax
push 4
call fcn.0041bda0
mov esi, dword [0x4fae0c]
add esp, 0xc
push 0xd08
jmp 0x43752b
test esi, esi
je 0x436469
cmp ecx, 0x11
je 0x436681
mov dword [0x53d948], 0
jmp 0x436681
cmp edx, 0x104
jne 0x43655c
cmp ecx, 0xbb
je 0x4364ab
cmp ecx, 0xbd
je 0x436493
cmp ecx, 0x6b
je 0x4364ab
cmp ecx, 0x6d
jne 0x43655c
cmp ecx, 0x6b
je 0x4364ab
mov eax, dword [0x4f431c]
or ecx, 0xffffffff
cmp eax, 0xfffffffe
jle 0x436551
jmp 0x4364be
mov eax, dword [0x4f431c]
mov ecx, 1
cmp eax, 2
jge 0x436551
add eax, ecx
mov dword [0x4f431c], eax
dec eax
cmp dword [0x4fad90], 0
je 0x436505
push eax
push 0x4d59b0
lea eax, [esp + 0x1f8]
push 0xc
push eax
call fcn.00403820
add esp, 0xc
mov byte [esp + 0x1ff], 0
lea edx, [esp + 0x1f4]
mov ecx, str.DefaultThreadPriority
call fcn.00420500
add esp, 4
jmp 0x436522
mov dword [esp + 0x7c], eax
mov edx, str.DefaultThreadPriority
push 4
lea eax, [esp + 0x80]
push eax
push 4
call fcn.0041bda0
add esp, 0xc
mov eax, dword [0x4fadcc]
mov esi, dword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
je 0x43653a
push dword [0x4f431c]
push eax
call esi
mov eax, dword [0x52b93c]
test eax, eax
je 0x43654c
push dword [0x4f431c]
push eax
call esi
mov eax, dword [0x4f431c]
push eax
push 0xcf6
jmp 0x43753f
cmp dword [0x4f4318], 0
jne 0x437555
cmp edx, 0x104
jne 0x4372b5
cmp ecx, 0xbe
jne 0x436635
xor ecx, ecx
cmp dword [0x542fb4], ecx
sete cl
mov eax, ecx
mov dword [0x542fb4], ecx
xor eax, 1
cmp dword [0x4fad90], 0
lea eax, [eax*2 + 1]
mov dword [0x4f4358], eax
je 0x4365e2
push ecx
push 0x4d59b0
lea eax, [esp + 0x204]
push 0xc
push eax
call fcn.00403820
add esp, 0xc
mov byte [esp + 0x20b], 0
lea edx, [esp + 0x200]
mov ecx, str.EnableUsbDebug
call fcn.00420500
add esp, 4
jmp 0x4365fc
push 4
lea eax, [esp + 0x14]
mov dword [esp + 0x14], ecx
push eax
push 4
mov edx, str.EnableUsbDebug
call fcn.0041bda0
add esp, 0xc
mov esi, dword [0x542fb4]
push 0xcc6
call fcn.0041afe0
add esp, 4
neg esi
sbb esi, esi
add esi, 0xcb3
push eax
push esi
push 0xdac
push 0
push 0
call fcn.0041b3e0
add esp, 0x14
xor ecx, ecx
call fcn.0044a010
jmp 0x436681
cmp ecx, 0xbc
jne 0x436741
xor ebx, ebx
cmp dword [0x4f42f8], ebx
push 0xcd2
sete bl
mov dword [0x4f42f8], ebx
call fcn.0041afe0
add esp, 4
xor ebx, 1
add ebx, 0xcb2
push eax
push ebx
push 0xdac
push 0
push 0
call fcn.0041b3e0
add esp, 0x14
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push 0
push 0
push 0
lea eax, [esp + 0x5c]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x436290
mov eax, dword [0x52b920]
test eax, eax
je 0x4366ac
push 0
push 0
push 0x10
push eax
call edi
cmp dword [0x53db1c], 0
je 0x4355fa
mov esi, 1
mov dword [0x53db1c], 0
mov ecx, esi
call fcn.0041a8e0
mov ecx, esi
call fcn.0041a7e0
mov eax, dword [0x4fadd8]
mov ecx, dword [0x52b91c]
push dword [eax + 0x14]
mov eax, 0xffc
sub eax, ecx
push str.Localization_set_to__s
push eax
lea eax, [ecx + 0x540f60]
push eax
call fcn.00403820
mov ecx, 0x540f60
mov byte [0x541f5b], 0
add esp, 0x10
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x436710
sub ecx, edx
mov esi, 0x181034
mov word [ecx + 0x540f60], 0xa0d
add ecx, 2
mov dword [0x52b91c], ecx
cmp ecx, 0x1000
jae 0x437741
jmp 0x436050
cmp ecx, 0x42
jne 0x4367d4
xor eax, eax
cmp dword [0x5430c8], eax
sete al
mov dword [0x5430c8], eax
xor eax, 1
cmp dword [0x4fad90], 0
je 0x4367aa
push eax
push 0x4d59b0
lea eax, [esp + 0x210]
push 0xc
push eax
call fcn.00403820
add esp, 0xc
mov byte [esp + 0x217], 0
lea edx, [esp + 0x20c]
mov ecx, str.DisableFakeDrivesCheck
call fcn.00420500
mov esi, dword [0x5430c8]
add esp, 4
push 0xcb8
jmp 0x43752b
mov dword [esp + 0x10], eax
mov edx, str.DisableFakeDrivesCheck
push 4
lea eax, [esp + 0x14]
push eax
push 4
call fcn.0041bda0
mov esi, dword [0x5430c8]
add esp, 0xc
push 0xcb8
jmp 0x43752b
cmp ecx, 0x43
jne 0x4367fe
push 0
push 0
push 0x147
push dword [0x542e7c]
call edi
test eax, eax
js 0x436681
mov ecx, eax
call fcn.00449460
jmp 0x436681
cmp ecx, 0x44
jne 0x436918
push 0x4cea00
push 0x542ea0
push 0x4d3068
lea eax, [esp + 0x3ac]
push 0x104
push eax
call fcn.00403820
add esp, 0x14
mov byte [esp + 0x4a3], 0
lea eax, [esp + 0x3a0]
push eax
push 0xcc0
push 0xdac
push 1
push 0
call fcn.0041b3e0
lea esi, [esp + 0x3b4]
add esp, 0x14
lea ecx, [esi + 1]
jmp 0x436860
mov al, byte [esi]
inc esi
test al, al
jne 0x436860
sub esi, ecx
add esi, 2
push 2
push esi
call fcn.0049570f
add esp, 8
mov dword [esp + 0xe4], 0
mov edi, eax
mov dword [esp + 0xe8], 3
mov eax, 0x414
mov dword [esp + 0xec], edi
mov word [esp + 0xf4], ax
lea eax, [esp + 0x3a0]
push esi
push edi
push 0xffffffffffffffff
push eax
push 0
push 0xfde9
mov dword [esp + 0x108], 0
mov dword [esp + 0x10e], 0
mov dword [esp + 0x112], 0
mov dword [esp + 0x116], 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [esp + 0xe4]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test edi, edi
je 0x436903
push edi
call fcn.004998ec
add esp, 4
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
mov dword [0x53d954], 1
jmp 0x436681
cmp ecx, 0x45
jne 0x4369c6
xor eax, eax
cmp dword [0x542e6c], eax
sete al
cmp dword [0x4fad90], 0
mov dword [0x542e6c], eax
je 0x436970
push eax
push 0x4d59b0
lea eax, [esp + 0x21c]
push 0xc
push eax
call fcn.00403820
add esp, 0xc
mov byte [esp + 0x223], 0
lea edx, [esp + 0x218]
mov ecx, str.EnableWindowsDualUefiBiosMode
call fcn.00420500
add esp, 4
jmp 0x43698a
mov dword [esp + 0x10], eax
mov edx, str.EnableWindowsDualUefiBiosMode
push 4
lea eax, [esp + 0x14]
push eax
push 4
call fcn.0041bda0
add esp, 0xc
mov esi, dword [0x542e6c]
push 0xcc2
call fcn.0041afe0
add esp, 4
neg esi
sbb esi, esi
add esi, 0xcb3
push eax
push esi
push 0xdac
push 0
push 0
call fcn.0041b3e0
add esp, 0x14
xor ecx, ecx
call fcn.00427ee0
jmp 0x436681
cmp ecx, 0x46
jne 0x436a2e
xor ebx, ebx
cmp dword [0x4fb834], ebx
push 0xcb5
sete bl
mov dword [0x4fb834], ebx
call fcn.0041afe0
add esp, 4
xor ebx, 1
add ebx, 0xcb2
push eax
push ebx
push 0xdac
push 0
push 0
call fcn.0041b3e0
add esp, 0x14
xor ecx, ecx
call fcn.0044a010
xor eax, eax
cmp dword [0x4fb834], eax
setne al
push eax
push 0x3fe
push dword [0x5430c4]
call dword [sym.imp.USER32.dll_CheckDlgButton]
jmp 0x43667b
cmp ecx, 0x47
jne 0x436adf
xor eax, eax
cmp dword [0x4f432c], eax
sete al
mov dword [0x4f432c], eax
xor eax, 1
cmp dword [0x4fad90], 0
je 0x436a89
push eax
push 0x4d59b0
lea eax, [esp + 0x228]
push 0xc
push eax
call fcn.00403820
add esp, 0xc
mov byte [esp + 0x22f], 0
lea edx, [esp + 0x224]
mov ecx, str.DisableVHDs
call fcn.00420500
add esp, 4
jmp 0x436aa3
mov dword [esp + 0x10], eax
mov edx, str.DisableVHDs
push 4
lea eax, [esp + 0x14]
push eax
push 4
call fcn.0041bda0
add esp, 0xc
mov esi, dword [0x4f432c]
push 0xcec
call fcn.0041afe0
add esp, 4
neg esi
sbb esi, esi
add esi, 0xcb3
push eax
push esi
push 0xdac
push 0
push 0
call fcn.0041b3e0
add esp, 0x14
xor ecx, ecx
call fcn.0044a010
jmp 0x436681
cmp ecx, 0x48
jne 0x436b6f
xor eax, eax
cmp dword [0x4fb84c], eax
sete al
cmp dword [0x4fad90], 0
mov dword [0x4fb84c], eax
je 0x436b45
push eax
push 0x4d59b0
lea eax, [esp + 0x234]
push 0xc
push eax
call fcn.00403820
add esp, 0xc
mov byte [esp + 0x23b], 0
lea edx, [esp + 0x230]
mov ecx, str.EnableExtraHashes
call fcn.00420500
mov esi, dword [0x4fb84c]
add esp, 4
push 0xcf0
jmp 0x43752b
mov dword [esp + 0x10], eax
mov edx, str.EnableExtraHashes
push 4
lea eax, [esp + 0x14]
push eax
push 4
call fcn.0041bda0
mov esi, dword [0x4fb84c]
add esp, 0xc
push 0xcf0
jmp 0x43752b
cmp ecx, 0x49
jne 0x436be6
xor ebx, ebx
cmp dword [0x4f2f8c], ebx
push 0xcbe
sete bl
mov dword [0x4f2f8c], ebx
call fcn.0041afe0
add esp, 4
xor ebx, 1
add ebx, 0xcb2
push eax
push ebx
push 0xdac
push 0
push 0
call fcn.0041b3e0
add esp, 0x14
cmp dword [0x4fad9c], 0
je 0x43667b
push 0
push 0x3f6
push 0x111
push dword [esp + 0x30]
mov dword [0x53db60], 1
mov dword [0x53d68c], 1
call edi
jmp 0x43667b
cmp ecx, 0x4a
jne 0x436c06
xor ebx, ebx
cmp dword [0x4f2e6c], ebx
push 0xcb9
sete bl
mov dword [0x4f2e6c], ebx
jmp 0x436657
cmp ecx, 0x4b
jne 0x436c26
xor ebx, ebx
cmp dword [0x4f2f34], ebx
push 0xcba
sete bl
mov dword [0x4f2f34], ebx
jmp 0x436657
cmp ecx, 0x4c
jne 0x436cd4
xor eax, eax
cmp dword [0x542fa4], eax
sete al
cmp dword [0x4fad90], 0
mov dword [0x542fa4], eax
je 0x436c7e
push eax
push 0x4d59b0
lea eax, [esp + 0x240]
push 0xc
push eax
call fcn.00403820
add esp, 0xc
mov byte [esp + 0x247], 0
lea edx, [esp + 0x23c]
mov ecx, str.ForceLargeFat32Formatting
call fcn.00420500
add esp, 4
jmp 0x436c98
mov dword [esp + 0x10], eax
mov edx, str.ForceLargeFat32Formatting
push 4
lea eax, [esp + 0x14]
push eax
push 4
call fcn.0041bda0
add esp, 0xc
mov esi, dword [0x542fa4]
push 0xcb6
call fcn.0041afe0
add esp, 4
neg esi
sbb esi, esi
add esi, 0xcb3
push eax
push esi
push 0xdac
push 0
push 0
call fcn.0041b3e0
add esp, 0x14
xor ecx, ecx
call fcn.0044a010
jmp 0x436681
cmp ecx, 0x4d
jne 0x436d64
xor eax, eax
cmp dword [0x4fae1c], eax
sete al
cmp dword [0x4fad90], 0
mov dword [0x4fae1c], eax
je 0x436d3a
push eax
push 0x4d59b0
lea eax, [esp + 0x24c]
push 0xc
push eax
call fcn.00403820
add esp, 0xc
mov byte [esp + 0x253], 0
lea edx, [esp + 0x248]
mov ecx, str.IgnoreBootMarker
call fcn.00420500
mov esi, dword [0x4fae1c]
add esp, 4
push 0xcf7
jmp 0x43752b
mov dword [esp + 0x10], eax
mov edx, str.IgnoreBootMarker
push 4
lea eax, [esp + 0x14]
push eax
push 4
call fcn.0041bda0
mov esi, dword [0x4fae1c]
add esp, 0xc
push 0xcf7
jmp 0x43752b
cmp ecx, 0x4e
jne 0x436d84
xor ebx, ebx
cmp dword [0x4fadb8], ebx
push 0xcbc
sete bl
mov dword [0x4fadb8], ebx
jmp 0x436657
cmp ecx, 0x4f
jne 0x436d93
call fcn.0041a1c0
jmp 0x436681
cmp ecx, 0x50
jne 0x436ddc
push 0
push 0
push 0x147
push dword [0x542e7c]
call edi
push 0
mov esi, eax
push esi
push 0x150
push dword [0x542e7c]
call edi
sub esp, 8
mov ecx, eax
call fcn.004065f0
add esp, 8
test eax, eax
je 0x436681
mov ecx, esi
call fcn.00449460
jmp 0x436681
cmp ecx, 0x51
jne 0x436e6c
xor eax, eax
cmp dword [0x542fa8], eax
sete al
cmp dword [0x4fad90], 0
mov dword [0x542fa8], eax
je 0x436e42
push eax
push 0x4d59b0
lea eax, [esp + 0x294]
push 0xc
push eax
call fcn.00403820
add esp, 0xc
mov byte [esp + 0x29b], 0
lea edx, [esp + 0x290]
mov ecx, str.EnableFileIndexing
call fcn.00420500
mov esi, dword [0x542fa8]
add esp, 4
push 0xcda
jmp 0x43752b
mov dword [esp + 0x10], eax
mov edx, str.EnableFileIndexing
push 4
lea eax, [esp + 0x14]
push eax
push 4
call fcn.0041bda0
mov esi, dword [0x542fa8]
add esp, 0xc
push 0xcda
jmp 0x43752b
cmp ecx, 0x52
jne 0x436fab
lea eax, [esp + 0x2c]
mov dword [esp + 0x2c], 0
push eax
push 0x2001d
push 0
push str.SOFTWARE
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x436ea4
mov eax, 0xcb1
jmp 0x436f19
push str.Akeo_ConsultingRufus
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
test esi, esi
je 0x436efa
cmp esi, 2
je 0x436efa
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp esi, 5
jne 0x436ed1
mov eax, str.Key_is_not_empty
jmp 0x436ed6
call fcn.00440bb0
push eax
push str.Akeo_ConsultingRufus
push str.Failed_to_delete_registry_key_HKCUSoftware_s:__s
call fcn.004407e0
add esp, 0xc
push dword [esp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0xcb1
jmp 0x436f19
push dword [esp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x436f14
cmp esi, 2
je 0x436f14
mov eax, 0xcb1
jmp 0x436f19
mov eax, 0xcb0
push eax
push 0xdac
push 0
push 0
call fcn.0041b3e0
add esp, 0x10
mov dword [esp + 0x20], 0
lea eax, [esp + 0x20]
push eax
push 0x2001d
push 0
push str.SOFTWARE
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x436681
push 0x4d7058
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
test esi, esi
je 0x436f9c
cmp esi, 2
je 0x436f9c
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp esi, 5
jne 0x436f84
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x436681
cmp ecx, 0x53
jne 0x436ff6
xor ebx, ebx
cmp dword [0x4f47ac], ebx
push 0xcb4
sete bl
mov dword [0x4f47ac], ebx
call fcn.0041afe0
add esp, 4
xor ebx, 1
add ebx, 0xcb2
push eax
push ebx
push 0xdac
push 0
push 0
call fcn.0041b3e0
add esp, 0x14
xor ecx, ecx
call fcn.0044a010
jmp 0x43667b
cmp ecx, 0x54
jne 0x437086
xor eax, eax
cmp dword [0x4fadc0], eax
sete al
cmp dword [0x4fad90], 0
mov dword [0x4fadc0], eax
je 0x43705c
push eax
push 0x4d59b0
lea eax, [esp + 0x258]
push 0xc
push eax
call fcn.00403820
add esp, 0xc
mov byte [esp + 0x25f], 0
lea edx, [esp + 0x254]
mov ecx, str.PreserveTimestamps
call fcn.00420500
mov esi, dword [0x4fadc0]
add esp, 4
push 0xcc5
jmp 0x43752b
mov dword [esp + 0x10], eax
mov edx, str.PreserveTimestamps
push 4
lea eax, [esp + 0x14]
push eax
push 4
call fcn.0041bda0
mov esi, dword [0x4fadc0]
add esp, 0xc
push 0xcc5
jmp 0x43752b
cmp ecx, 0x55
jne 0x437110
xor eax, eax
cmp dword [0x542af0], eax
sete al
mov dword [0x542af0], eax
xor eax, 1
cmp dword [0x4fad90], 0
je 0x4370e1
push eax
push 0x4d59b0
lea eax, [esp + 0x264]
push 0xc
push eax
call fcn.00403820
add esp, 0xc
mov byte [esp + 0x26b], 0
lea edx, [esp + 0x260]
mov ecx, str.UseProperSizeUnits
call fcn.00420500
add esp, 4
jmp 0x4370fb
mov dword [esp + 0x10], eax
mov edx, str.UseProperSizeUnits
push 4
lea eax, [esp + 0x14]
push eax
push 4
call fcn.0041bda0
add esp, 0xc
xor ebx, ebx
cmp dword [0x542af0], ebx
push 0xcbf
sete bl
jmp 0x436fc6
cmp ecx, 0x56
jne 0x4371a8
cmp dword [0x4f4254], 0
je 0x436681
xor eax, eax
cmp dword [0x4fada4], eax
sete al
cmp dword [0x4fad90], 0
mov dword [0x4fada4], eax
je 0x437175
push eax
push 0x4d59b0
lea eax, [esp + 0x270]
push 0xc
push eax
call fcn.00403820
add esp, 0xc
mov byte [esp + 0x277], 0
lea edx, [esp + 0x26c]
mov ecx, str.UseVds
call fcn.00420500
add esp, 4
jmp 0x43718f
mov dword [esp + 0x10], eax
mov edx, str.UseVds
push 4
lea eax, [esp + 0x14]
push eax
push 4
call fcn.0041bda0
add esp, 0xc
mov eax, dword [0x4fada4]
neg eax
push 0x4daa10
sbb eax, eax
add eax, 0xcb3
push eax
jmp 0x43753f
cmp ecx, 0x57
jne 0x437256
xor eax, eax
cmp dword [0x5429c4], eax
sete al
cmp dword [0x4fad90], 0
mov dword [0x5429c4], eax
je 0x437200
push eax
push 0x4d59b0
lea eax, [esp + 0x27c]
push 0xc
push eax
call fcn.00403820
add esp, 0xc
mov byte [esp + 0x283], 0
lea edx, [esp + 0x278]
mov ecx, str.EnableVmdkDetection
call fcn.00420500
add esp, 4
jmp 0x43721a
mov dword [esp + 0x10], eax
mov edx, str.EnableVmdkDetection
push 4
lea eax, [esp + 0x14]
push eax
push 4
call fcn.0041bda0
add esp, 0xc
mov esi, dword [0x5429c4]
push 0xcc1
call fcn.0041afe0
add esp, 4
neg esi
sbb esi, esi
add esi, 0xcb3
push eax
push esi
push 0xdac
push 0
push 0
call fcn.0041b3e0
add esp, 0x14
xor ecx, ecx
call fcn.0044a010
jmp 0x436681
cmp ecx, 0x58
jne 0x437280
push 0xcb7
push 0x7d0
push 0
push 0
call fcn.0041b3e0
add esp, 0x10
mov dword [0x53d94c], 0
jmp 0x436681
cmp ecx, 0x59
jne 0x4372a0
cmp edx, 0x100
jne 0x437555
cmp ecx, 0x5a
jne 0x437320
push 0x11
call ebx
mov esi, 0x8000
test si, ax
je 0x43730c
push 0x12
call ebx
test si, ax
je 0x43730c
mov dword [0x4fada8], 1
push 0
push 0x3eb
push 0x111
push dword [esp + 0x30]
mov dword [0x4fadb4], 1
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x436681
cmp dword [esp + 0x54], 0x100
jne 0x437555
mov ecx, dword [esp + 0x58]
jmp 0x437325
mov esi, 0x8000
cmp ecx, 0x45
jne 0x4373f8
push 0x11
call ebx
test si, ax
je 0x4373e6
push 0x12
call ebx
test si, ax
je 0x4373e6
xor eax, eax
cmp dword [0x4fae14], eax
sete al
cmp dword [0x4fad90], 0
mov dword [0x4fae14], eax
je 0x437397
push eax
push 0x4d59b0
lea eax, [esp + 0x288]
push 0xc
push eax
call fcn.00403820
add esp, 0xc
mov byte [esp + 0x28f], 0
lea edx, [esp + 0x284]
mov ecx, str.ExpertMode
call fcn.00420500
add esp, 4
jmp 0x4373b1
mov dword [esp + 0x10], eax
mov edx, str.ExpertMode
push 4
lea eax, [esp + 0x14]
push eax
push 4
call fcn.0041bda0
add esp, 0xc
mov esi, dword [0x4fae14]
push 0xd13
call fcn.0041afe0
add esp, 4
neg esi
sbb esi, esi
add esi, 0xcb3
push eax
push esi
push 0xdac
push 0
push 0
call fcn.0041b3e0
add esp, 0x14
jmp 0x436681
cmp dword [esp + 0x54], 0x100
jne 0x437555
mov ecx, dword [esp + 0x58]
cmp ecx, 0x46
jne 0x4374f9
push 0x11
call ebx
test si, ax
je 0x4374eb
push 0x12
call ebx
test si, ax
je 0x4374eb
xor eax, eax
cmp dword [0x4fb83c], eax
sete al
mov dword [0x4fb83c], eax
test eax, eax
je 0x437442
mov eax, dword [0x4fb834]
mov ecx, 1
mov dword [esp + 0x94], eax
jmp 0x437449
mov ecx, dword [esp + 0x94]
xor eax, eax
mov dword [0x4fb834], ecx
test ecx, ecx
setne al
push eax
push 0x3fe
push dword [0x5430c4]
call dword [sym.imp.USER32.dll_CheckDlgButton]
mov esi, dword [0x4fb83c]
push 0xcd7
call fcn.0041afe0
add esp, 4
neg esi
sbb esi, esi
add esi, 0xcb3
push eax
push esi
push 0xdac
push 0
push 0
call fcn.0041b3e0
mov ecx, dword [0x4fb83c]
add esp, 0x14
test ecx, ecx
mov edx, str.disabled
mov eax, str.enabled
mov ecx, 0x4ce59a
cmove eax, edx
push eax
mov eax, str.CAUTION:
cmove eax, ecx
push eax
push str._sListing_of_non_USB_removable_drives__s
call fcn.004407e0
add esp, 0xc
cmp dword [0x4fb83c], 0
je 0x4374df
push str.By_using_this_unofficial_cheat_mode_you_forfeit_ANY_RIGHT_to_complain_if_you_lose_valuable_data_
call fcn.004407e0
add esp, 4
xor ecx, ecx
call fcn.0044a010
jmp 0x436681
cmp dword [esp + 0x54], 0x100
jne 0x437555
mov ecx, dword [esp + 0x58]
cmp ecx, 0x59
jne 0x437555
push 0x11
call ebx
test si, ax
je 0x437555
push 0x12
call ebx
test si, ax
je 0x437555
xor eax, eax
mov esi, 2
cmp dword [0x4faddc], eax
push 0xcbb
cmovg esi, eax
mov dword [0x4faddc], esi
call fcn.0041afe0
add esp, 4
neg esi
sbb esi, esi
add esi, 0xcb3
push eax
push esi
push 0xdac
push 0
push 0
call fcn.0041b3e0
add esp, 0x14
jmp 0x436681
cmp dword [esp + 0x48], 0
je 0x437592
push 0x12
call ebx
bt ax, 0xf
jb 0x437592
cmp dword [esp + 0x6c], 0
mov dword [esp + 0x48], 0
jne 0x43758a
mov eax, dword [0x52b930]
mov ecx, 3
inc eax
cdq
idiv ecx
mov dword [0x52b930], edx
mov dword [esp + 0x6c], 0
mov esi, dword [sym.imp.USER32.dll_IsDialogMessageW]
lea eax, [esp + 0x50]
push eax
push dword [esp + 0x28]
call esi
test eax, eax
jne 0x436681
lea eax, [esp + 0x50]
push eax
push dword [0x4fae10]
call esi
test eax, eax
jne 0x436681
lea eax, [esp + 0x50]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x50]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x436681
movzx eax, word [0x4f42fc]
mov ecx, 0x181010
cmp dword [0x4fada0], 0
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0
push 0xffffffffffffffff
mov dword [esp + 0x1c], eax
mov eax, 0x1010
push str.Could_not_create_Window
push 0
cmovne eax, ecx
push 0xfde9
mov dword [esp + 0x58], eax
call ebx
mov esi, eax
cmp esi, 1
jle 0x43764f
push 2
push esi
call fcn.0049570f
mov edi, eax
add esp, 8
test edi, edi
je 0x43764f
push esi
push edi
push 0xffffffffffffffff
push str.Could_not_create_Window
push 0
push 0xfde9
call ebx
cmp eax, esi
je 0x437651
push edi
call fcn.004998ec
add esp, 4
xor edi, edi
push 0
push 0
push 0xffffffffffffffff
push str.DialogBox_failure
push 0
push 0xfde9
call ebx
mov ebx, eax
cmp ebx, 1
jle 0x4376a0
push 2
push ebx
call fcn.0049570f
mov esi, eax
add esp, 8
test esi, esi
je 0x4376a0
push ebx
push esi
push 0xffffffffffffffff
push str.DialogBox_failure
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, ebx
je 0x4376a2
push esi
call fcn.004998ec
add esp, 4
xor esi, esi
push dword [esp + 0x10]
push dword [esp + 0x44]
push esi
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxExW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test edi, edi
je 0x4376c9
push edi
call fcn.004998ec
add esp, 4
test esi, esi
je 0x4376d6
push esi
call fcn.004998ec
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x4355fa
mov edx, dword [0x4fadd8]
lea ecx, [esp + 0x298]
call fcn.0041fbd0
mov eax, dword [0x4fadd8]
mov edx, 0x181010
mov ecx, dword [eax + 4]
mov eax, 0x1010
and ecx, 1
push ecx
cmovne eax, edx
mov dword [0x4fada0], ecx
push eax
push 0xbb9
call fcn.0041afe0
add esp, 4
push eax
push ecx
push 0xbba
call fcn.0041afe0
add esp, 8
mov edx, eax
xor ecx, ecx
call fcn.004226d0
add esp, 0xc
jmp 0x4355fa
call fcn.00491a70
mov edi, edi
xchg edi, eax
dec eax
inc ebx
add ah, ah
inc edi
inc ebx
add byte [ebx - 0x12ffbcb7], bl
inc ebp
inc ebx
add byte [edi + eax*2 + 0x48660043], al
inc ebx
add dh, bl
inc ebp
inc ebx
add byte [edx + 0x48], bh
inc ebx
add byte [esi + 0x4348], cl
or byte [eax], cl
or byte [eax], cl
add dword [eax], eax
add al, byte [ebx]
or byte [eax], cl
add al, 8
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [3423012870], al
int3