Function at 0x4252c1
Capabilities:
Check if file exists
Check mutex on windows
Copy file
Delete file
Get common file path
Get file attributes
Get session user name
Identify system language via api
Log keystrokes via polling
Parse pe header
Resolve function by parsing pe exports
Terminate thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x664
mov eax, dword [0x4d8300]
xor eax, esp
mov dword [esp + 0x660], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor ebx, ebx
mov dword [esp + 0x64], eax
mov eax, dword [ebp + 0x10]
push edi
mov dword [esp + 0x48], eax
mov dword [esp + 0x7c], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x8c], ebx
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx eax, ax
mov dword [esp + 0x84], eax
xor eax, eax
inc eax
mov dword [esp + 0x24], ebx
mov dword [esp + 0x34], eax
lea eax, [esp + 0x20]
push eax
push 0x20019
push ebx
push str.SoftwareMicrosoftVisualStudio
push SHChangeNotifyRegister
mov dword [esp + 0x58], ebx
mov dword [esp + 0x88], ebx
mov dword [esp + 0x8c], ebx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x80], ebx
mov dword [esp + 0x34], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
neg eax
sbb ebx, ebx
inc ebx
cmp dword [esp + 0x20], 0
mov dword [esp + 0x2c], ebx
je 0x42536e
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov dword [esp + 0x80], 4
mov edi, 0x103
mov dword [esp + 0x20], eax
push edi
push eax
mov dword [esp + 0x40], eax
mov byte [esp + 0x258], al
lea eax, [esp + 0x259]
push eax
call fcn.00478bc0
add esp, 0xc
mov byte [esp + 0x148], 0
lea eax, [esp + 0x149]
push edi
push 0
push eax
call fcn.00478bc0
add esp, 0xc
mov byte [esp + 0x358], 0
lea eax, [esp + 0x359]
push edi
push 0
push eax
call fcn.00478bc0
mov ax, word [0x4ba3b0]
xor ecx, ecx
movaps xmm0, xmmword [0x4d42b0]
add esp, 0xc
mov word [esp + 0x30], ax
mov al, byte [0x4ba3b2]
mov byte [esp + 0x32], al
xor eax, eax
inc eax
mov dword [esp + 0x28], ecx
mov dword [esp + 0xec], eax
mov dword [esp + 0xfc], eax
mov dword [esp + 0x10c], eax
mov eax, 0x4b4dda
push eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x44], ecx
mov dword [esp + 0x74], ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0xbc], str.extra_devs
mov dword [esp + 0xc0], ecx
mov dword [esp + 0xc4], ecx
mov dword [esp + 0xc8], 0x78
mov dword [esp + 0xcc], 0x4c1544
mov dword [esp + 0xd0], ecx
mov dword [esp + 0xd4], ecx
mov dword [esp + 0xd8], 0x67
mov dword [esp + 0xdc], str.help
mov dword [esp + 0xe0], ecx
mov dword [esp + 0xe4], ecx
mov dword [esp + 0xe8], 0x68
mov dword [esp + 0xec], 0x4c1550
mov dword [esp + 0xf4], ecx
mov dword [esp + 0xf8], 0x69
mov dword [esp + 0xfc], str.locale
mov dword [esp + 0x104], ecx
mov dword [esp + 0x108], 0x6c
mov dword [esp + 0x10c], str.filesystem
mov dword [esp + 0x114], ecx
mov dword [esp + 0x118], 0x66
mov dword [esp + 0x11c], str.wait
movups xmmword [esp + 0x120], xmm0
mov dword [esp + 0x130], ecx
mov dword [esp + 0x134], ecx
mov dword [esp + 0x138], ecx
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryA]
push 0x104
lea eax, [esp + 0x464]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [esp + 0x460]
push eax
call fcn.004891c7
pop ecx
mov ecx, edi
sub ecx, eax
push ecx
lea eax, [esp + 0x464]
push 0x4c1570
push eax
call fcn.0048c503
add esp, 0xc
lea eax, [esp + 0x460]
mov esi, 0x800
push str.SetDefaultDllDirectories
push esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x51dd08], eax
test eax, eax
je 0x425580
push esi
call eax
push str._FormatUsb_init__n
call fcn.0042ed57
pop ecx
lea eax, [esp + 0x80]
push eax
lea eax, [esp + 0x8c]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x4255b7
cmp dword [esp + 0x88], 0x6c696e
jne 0x4255b7
xor eax, eax
inc eax
jmp 0x4255b9
xor eax, eax
mov dword [0x4dca74], eax
mov eax, 0x4be7f0
push eax
push eax
call fcn.00481660
neg eax
pop ecx
sbb eax, eax
inc eax
pop ecx
mov dword [0x522064], eax
call fcn.0041d20b
test eax, eax
jne 0x4255f8
call fcn.0042fc51
push eax
push str.Could_not_get_current_directory:__s
call fcn.0042ed57
pop ecx
pop ecx
mov byte [0x5222c0], 0
call fcn.0041d29c
mov esi, 0x521f60
test eax, eax
jne 0x425678
call fcn.0042fc51
push eax
push str.Could_not_get_system_directory:__s
call fcn.0042ed57
push str.C:WindowsSystem32
call fcn.004816f0
add esp, 0xc
mov ecx, 0x104
inc eax
cmp eax, ecx
jae 0x42563b
push str.C:WindowsSystem32
call fcn.004816f0
pop ecx
inc eax
jmp 0x42563d
mov eax, ecx
push eax
push str.C:WindowsSystem32
push esi
call fcn.00476fc0
add esp, 0xc
push str.C:WindowsSystem32
call fcn.004816f0
pop ecx
inc eax
mov ecx, 0x104
cmp eax, ecx
jae 0x42566f
push str.C:WindowsSystem32
call fcn.004816f0
pop ecx
inc eax
jmp 0x425671
mov eax, ecx
mov byte [eax + 0x521f5f], 0
call fcn.0041d376
test eax, eax
jne 0x4256f7
call fcn.0042fc51
push eax
push str.Could_not_get_temp_directory:__s
call fcn.0042ed57
push 0x4c162c
call fcn.004816f0
add esp, 0xc
mov ecx, 0x104
inc eax
cmp eax, ecx
jae 0x4256b6
push 0x4c162c
call fcn.004816f0
pop ecx
inc eax
jmp 0x4256b8
mov eax, ecx
push eax
push 0x4c162c
push 0x5221a0
call fcn.00476fc0
add esp, 0xc
push 0x4c162c
call fcn.004816f0
pop ecx
inc eax
mov ecx, 0x104
cmp eax, ecx
jae 0x4256ee
push 0x4c162c
call fcn.004816f0
pop ecx
inc eax
jmp 0x4256f0
mov eax, ecx
mov byte [eax + 0x52219f], 0
push esi
call fcn.004816f0
pop ecx
inc eax
mov ecx, 0x104
cmp eax, ecx
jae 0x425712
push esi
call fcn.004816f0
pop ecx
inc eax
jmp 0x425714
mov eax, ecx
push eax
push esi
push 0x522080
call fcn.00476fc0
add esp, 0xc
push esi
call fcn.004816f0
pop ecx
inc eax
mov ecx, 0x104
cmp eax, ecx
jae 0x42573e
push esi
call fcn.004816f0
pop ecx
inc eax
jmp 0x425740
mov eax, ecx
mov byte [eax + 0x52207f], 0
call fcn.0042d76b
test eax, eax
je 0x425817
call fcn.0041d309
test eax, eax
jne 0x4257c4
call fcn.0042fc51
push eax
push str.Could_not_get_Windows_directory:__s
call fcn.0042ed57
mov esi, str.C:Windows
push esi
call fcn.004816f0
add esp, 0xc
mov ecx, 0x104
inc eax
cmp eax, ecx
jae 0x42578f
push esi
call fcn.004816f0
pop ecx
inc eax
jmp 0x425791
mov eax, ecx
push eax
push esi
push 0x522080
call fcn.00476fc0
add esp, 0xc
push esi
call fcn.004816f0
pop ecx
inc eax
mov ecx, 0x104
cmp eax, ecx
jae 0x4257bb
push esi
call fcn.004816f0
pop ecx
inc eax
jmp 0x4257bd
mov eax, ecx
mov byte [eax + 0x52207f], 0
push str.Sysnative
call fcn.004816f0
mov esi, eax
mov dword [esp], 0x522080
call fcn.004816f0
pop ecx
mov ecx, edi
sub ecx, eax
lea eax, [esi + 1]
cmp eax, ecx
jae 0x4257f7
push str.Sysnative
call fcn.004816f0
lea edi, [eax + 1]
jmp 0x425803
push 0x522080
call fcn.004816f0
sub edi, eax
pop ecx
push edi
push str.Sysnative
push 0x522080
call fcn.00481780
add esp, 0xc
mov eax, dword [0x51dd10]
mov edi, str._NULL_
test eax, eax
jne 0x425854
push str.__wgetmainargs
mov ecx, str.Msvcrt
call fcn.004078b4
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x51dd10], eax
test eax, eax
jne 0x425854
push str.Could_not_access_UTF_16_args
call fcn.0042ed57
pop ecx
jmp 0x425c37
and dword [esp + 0x14], 0
lea ecx, [esp + 0x8c]
push ecx
xor edx, edx
lea ecx, [esp + 0xb8]
inc edx
push edx
push ecx
lea ecx, [esp + 0x9c]
push ecx
lea ecx, [esp + 0x2c]
push ecx
call eax
add esp, 0x14
push 4
push dword [esp + 0x20]
call fcn.0047b53f
mov dword [esp + 0x18], eax
pop ecx
pop ecx
test eax, eax
je 0x425c37
xor esi, esi
cmp dword [esp + 0x1c], esi
jle 0x425933
mov ecx, dword [esp + 0x90]
mov ecx, dword [ecx + esi*4]
call fcn.0041851b
mov ecx, dword [esp + 0x10]
push 0x4c1684
push eax
mov dword [ecx + esi*4], eax
call fcn.00481660
mov ecx, dword [esp + 0x2c]
test eax, eax
mov eax, 0x96
cmove ecx, eax
mov eax, dword [esp + 0x18]
push 0x4c1688
mov dword [esp + 0x30], ecx
push dword [eax + esi*4]
call fcn.00481660
add esp, 0x10
test eax, eax
je 0x425906
mov eax, dword [esp + 0x10]
push str.__gui
push dword [eax + esi*4]
call fcn.00481660
pop ecx
pop ecx
test eax, eax
jne 0x42590d
xor eax, eax
inc eax
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x10]
push str._InvokerPRAID
push dword [eax + esi*4]
call fcn.0048ad35
pop ecx
pop ecx
test eax, eax
je 0x425943
inc esi
cmp esi, dword [esp + 0x1c]
jl 0x4258a4
mov eax, dword [esp + 0x10]
mov edi, dword [eax]
push edi
call fcn.004816f0
lea esi, [edi - 1]
pop ecx
add esi, eax
jmp 0x425956
xor eax, eax
inc eax
mov dword [0x4dcaa4], eax
jmp 0x425c40
cmp byte [esi], 0x5c
je 0x42595a
dec esi
cmp esi, edi
ja 0x425950
push 0x70
push esi
call fcn.00478d20
pop ecx
pop ecx
test eax, eax
jne 0x425986
push 0x50
push esi
call fcn.00478d20
pop ecx
pop ecx
test eax, eax
je 0x42598b
push 0x50
push esi
call fcn.00478d20
pop ecx
pop ecx
cmp byte [eax + 1], 0x48
je 0x42598b
mov byte [esp + 0x30], 0x61
cmp dword [esp + 0x3c], 0
jne 0x425a08
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_AttachConsole]
test eax, eax
je 0x425a08
push str.Enabling_console_line_hogger
call fcn.0042ed57
pop ecx
xor esi, esi
inc esi
push 0
mov dword [esp + 0x48], esi
call fcn.0047b645
pop ecx
push eax
push 0x4b979c
push str.CONIN_
call fcn.0047b519
add esp, 0xc
push esi
call fcn.0047b645
pop ecx
push eax
mov edi, 0x4b04e8
mov esi, str.CONOUT_
push edi
push esi
call fcn.0047b519
add esp, 0xc
push 2
call fcn.0047b645
pop ecx
push eax
push edi
push esi
call fcn.0047b519
add esp, 0xc
call fcn.0047bab7
call fcn.0042519d
mov dword [esp + 0x70], eax
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x7c]
mov ecx, dword [esp + 0x1c]
push 0
push eax
lea eax, [esp + 0xc0]
push eax
push str.xghf:i:w:l:
call fcn.0043e6d0
add esp, 0x10
mov edi, str._NULL_
cmp eax, 0xffffffff
je 0x425c37
cmp eax, 0x69
jg 0x425b52
je 0x425afb
sub eax, 0x61
je 0x425bcf
sub eax, 5
je 0x425a79
sub eax, 1
je 0x425bcf
sub eax, 1
jne 0x425b61
mov ebx, dword [esp + 0x10]
mov ecx, dword [ebx]
call fcn.004250b7
jmp 0x4270ec
mov eax, dword [0x520564]
movzx eax, byte [eax]
push eax
call fcn.004871f0
pop ecx
test eax, eax
je 0x425ac4
push 0
push 0
push dword [0x520564]
call fcn.00488ec4
add esp, 0xc
mov esi, eax
mov dword [0x4da87c], esi
cmp esi, 0xffffffff
jl 0x425ab0
cmp esi, 9
jl 0x425ab9
or esi, 0xffffffff
mov dword [0x4da87c], esi
mov dword [0x4da880], esi
jmp 0x425bcf
xor esi, esi
mov eax, dword [esi*4 + 0x4b07e0]
mov ecx, edi
test eax, eax
cmovne ecx, eax
mov eax, dword [0x520564]
push ecx
test eax, eax
mov ecx, edi
cmovne ecx, eax
push ecx
call fcn.0048ad35
pop ecx
pop ecx
test eax, eax
je 0x425aa0
inc esi
cmp esi, 9
jb 0x425ac6
mov esi, dword [0x4da87c]
jmp 0x425aa6
push 0
push dword [0x520564]
call fcn.0048c7fb
pop ecx
pop ecx
cmp eax, 0xffffffff
je 0x425b3f
push dword [0x4dca18]
call fcn.004812c6
and dword [0x4dca18], 0
pop ecx
push dword [0x520564]
call fcn.00487101
mov dword [0x4dca18], eax
xor eax, eax
inc eax
mov dword [0x51daf4], eax
jmp 0x425bce
push dword [0x520564]
push str.Could_not_find_ISO_image__s_n
call fcn.0041c90e
pop ecx
jmp 0x425bce
sub eax, 0x6c
je 0x425b87
sub eax, 0xb
je 0x425b76
sub eax, 1
je 0x425b6c
xor eax, eax
lea esi, [eax + 1]
mov dword [esp + 0x14], esi
jmp 0x425bd3
xor eax, eax
inc eax
mov dword [0x4dcaa0], eax
jmp 0x425bcf
push dword [0x520564]
call fcn.00489021
mov dword [esp + 0x28], eax
jmp 0x425bce
mov eax, dword [0x520564]
movzx eax, byte [eax]
push eax
call fcn.004871f0
pop ecx
test eax, eax
je 0x425bb5
push 0
push 0
push dword [0x520564]
call fcn.00488ec4
add esp, 0xc
mov dword [esp + 0x84], eax
jmp 0x425bcf
push dword [esp + 0x28]
call fcn.004812c6
pop ecx
push dword [0x520564]
call fcn.00487101
mov dword [esp + 0x2c], eax
pop ecx
mov esi, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x7c]
mov ecx, dword [esp + 0x1c]
push 0
push eax
lea eax, [esp + 0xc0]
push eax
push str.xghf:i:w:l:
call fcn.0043e6d0
add esp, 0x10
cmp eax, 0xffffffff
jne 0x425a3a
test esi, esi
je 0x425c32
push str.Command_line_arguments:
call fcn.0042ed57
xor eax, eax
inc eax
mov esi, eax
pop ecx
cmp dword [esp + 0x1c], eax
jle 0x425c32
mov ebx, dword [esp + 0x10]
push dword [ebx + esi*4]
call fcn.0042ed57
inc esi
pop ecx
cmp esi, dword [esp + 0x1c]
jl 0x425c1e
mov ebx, dword [esp + 0x2c]
mov edi, str._NULL_
cmp dword [0x4dcaa4], 0
je 0x425c4b
push str.AppStore_version_detected
call fcn.0042ed57
pop ecx
push 0x5222c0
push str._s_formatusb.ini
lea eax, [esp + 0x360]
push 0x104
push eax
call fcn.00403163
lea edx, [esp + 0x40]
mov byte [esp + 0x46b], 0
lea ecx, [esp + 0x368]
call fcn.0041d3e3
xor edx, edx
xor ecx, ecx
mov esi, eax
call fcn.0041ac38
mov ecx, dword [str.Akeo_Consulting]
mov edx, edi
test ecx, ecx
cmovne edx, ecx
test eax, eax
push edx
cmovne edi, eax
push edi
call fcn.00481660
add esp, 0x18
neg eax
sbb eax, eax
inc eax
or eax, ebx
mov dword [esp + 0x14], eax
test esi, esi
je 0x425cc8
lea eax, [esp + 0x358]
push esi
mov dword [0x4dca08], eax
call fcn.00481623
pop ecx
cmp dword [0x4dca08], 0
mov ecx, str.registry
mov eax, str.INI_file
cmove eax, ecx
push eax
push str.Will_use_settings_from__s
call fcn.0042ed57
cmp dword [0x4dca08], 0
pop ecx
pop ecx
je 0x425cfe
call fcn.0041d4b2
xor ebx, ebx
mov esi, eax
inc ebx
jmp 0x425d21
push 0x1ff
mov esi, 0x51d748
mov byte [0x51d748], 0
xor ebx, ebx
mov edx, str.Locale
push esi
inc ebx
push ebx
call fcn.0041525b
add esp, 0xc
cmp byte [esi], 0
je 0x425d3e
push esi
call fcn.00487101
pop ecx
push eax
push str.found_locale__s
mov dword [esp + 0x30], eax
call fcn.0042ed57
pop ecx
pop ecx
mov ecx, str.PreserveTimestamps
mov dword [0x521f14], ebx
mov dword [0x521f18], ebx
call fcn.0041d52b
mov ecx, str.UseProperSizeUnits
mov dword [0x4dca38], eax
call fcn.0041d52b
neg eax
mov ecx, str.UseVds
sbb eax, eax
inc eax
mov dword [0x521f20], eax
call fcn.0041d52b
mov ecx, str.EnableUsbDebug
mov dword [0x4dca20], eax
call fcn.0041d52b
push 3
test eax, eax
mov dword [0x5223d8], eax
pop ecx
cmovne ecx, ebx
mov dword [0x4da428], ecx
mov ecx, str.DisableFakeDrivesCheck
call fcn.0041d52b
neg eax
mov ecx, str.EnableWindowsDualUefiBiosMode
sbb eax, eax
inc eax
mov dword [0x522468], eax
call fcn.0041d52b
mov ecx, str.ForceLargeFat32Formatting
mov dword [0x52218c], eax
call fcn.0041d52b
mov ecx, str.EnableVmdkDetection
mov dword [0x5223c8], eax
call fcn.0041d52b
mov ecx, str.EnableFileIndexing
mov dword [0x521dd4], eax
call fcn.0041d52b
mov ecx, str.DisableVHDs
mov dword [0x5223cc], eax
call fcn.0041d52b
neg eax
mov ecx, str.EnableExtraHashes
sbb eax, eax
inc eax
mov dword [0x4da380], eax
call fcn.0041d52b
mov ecx, str.IgnoreBootMarker
mov dword [0x4dcab0], eax
call fcn.0041d52b
cmp dword [0x4dca08], 0
mov dword [0x4dca88], eax
je 0x425e30
mov ecx, str.DefaultThreadPriority
call fcn.0041577a
jmp 0x425e4a
push 4
lea eax, [esp + 0x30]
mov edx, str.DefaultThreadPriority
push eax
push 4
call fcn.0041525b
mov eax, dword [esp + 0x38]
add esp, 0xc
inc eax
push 0
mov dword [0x4da374], eax
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
push 0x58
push esi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
movd xmm0, eax
cvtdq2ps xmm0, xmm0
divss xmm0, dword [0x4d1eb0]
movss dword [0x4da37c], xmm0
cmp esi, 0xffffffff
je 0x425e8c
test esi, esi
je 0x425e8c
push esi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
xor ecx, ecx
call fcn.004143b2
mov ecx, str.rufus.loc
call fcn.00403761
mov edi, eax
push 0x22
pop esi
cmp word [edi], si
jne 0x425ec9
push edi
call fcn.004891c7
pop ecx
cmp word [edi + eax*2 - 2], si
jne 0x425ec9
push edi
call fcn.004891c7
pop ecx
xor ecx, ecx
mov word [edi + eax*2 - 2], cx
lea eax, [edi + 2]
push eax
jmp 0x425eca
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov esi, eax
call fcn.004812c6
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp ebx, 0xffffffff
jne 0x42605a
push str.loc_file_not_found_in_current_directory___embedded_one_will_be_used
call fcn.0042ed57
pop ecx
mov ecx, dword [0x5223d4]
lea eax, [esp + 0x2c]
push 0
push eax
push str.embedded.loc
push 0xa
mov edx, 0x1f4
call fcn.0042df9d
add esp, 0x10
mov edi, eax
lea eax, [esp + 0x148]
push eax
push ecx
call fcn.00407dce
pop ecx
pop ecx
test eax, eax
je 0x425f3d
cmp byte [esp + 0x148], 0
jne 0x425f91
mov ebx, str.rufus.loc
push ebx
call fcn.004816f0
inc eax
mov esi, 0x104
pop ecx
cmp eax, esi
jae 0x425f5d
push ebx
call fcn.004816f0
pop ecx
inc eax
jmp 0x425f5f
mov eax, esi
push eax
lea eax, [esp + 0x14c]
push ebx
push eax
call fcn.00476fc0
add esp, 0xc
push ebx
call fcn.004816f0
inc eax
pop ecx
cmp eax, esi
jae 0x425f87
push ebx
call fcn.004816f0
pop ecx
inc eax
jmp 0x425f89
mov eax, esi
mov byte [esp + eax + 0x147], 0
push ecx
push ecx
push 2
push ecx
push ecx
mov edx, 0xc0000000
lea ecx, [esp + 0x15c]
call fcn.0041d1c3
mov esi, eax
add esp, 0x14
cmp esi, 0xffffffff
je 0x426022
push ecx
lea eax, [esp + 0x84]
mov edx, edi
push eax
push dword [esp + 0x34]
mov ecx, esi
call fcn.0043032f
add esp, 0xc
test eax, eax
je 0x426022
lea eax, [esp + 0x148]
push eax
push str.localization:_extracted_data_to__s
call fcn.0042ed57
pop ecx
pop ecx
test esi, esi
je 0x425fee
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
inc ebx
lea ecx, [esp + 0x148]
call fcn.00418a1a
test eax, eax
je 0x4270c5
mov eax, dword [esp + 0x28]
test eax, eax
jne 0x4260a6
mov ecx, dword [esp + 0x84]
call fcn.00414dda
jmp 0x4260af
call fcn.0042fc51
push eax
lea eax, [esp + 0x14c]
push eax
push str.localization:_unable_to_extract__s:__s
call fcn.0042ed57
add esp, 0xc
cmp esi, 0xffffffff
je 0x4270e8
test esi, esi
je 0x4270e8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4270e8
push str.rufus.loc
push 0x5222c0
push 0x4ba068
lea eax, [esp + 0x154]
push 0x104
push eax
call fcn.00403163
add esp, 0x14
mov byte [esp + 0x24b], 0
lea eax, [esp + 0x148]
xor ebx, ebx
inc ebx
mov dword [esp + 0x74], ebx
push eax
push str.using_external_loc_file__s
call fcn.0042ed57
pop ecx
pop ecx
jmp 0x425ff1
mov edx, ebx
mov ecx, eax
call fcn.00414e49
mov dword [0x4dca4c], eax
test eax, eax
je 0x4270c5
mov ecx, eax
call fcn.00414f4a
mov word [0x4d8f94], ax
call fcn.0042d847
cmp dword [0x4da388], 0x61
jge 0x426130
mov edx, dword [0x4dca4c]
lea ecx, [esp + 0x148]
call fcn.00418e4f
mov eax, dword [0x4dca4c]
mov edx, 0x181010
mov ecx, dword [eax + 4]
mov eax, 0x1010
and ecx, ebx
push ecx
cmovne eax, edx
mov dword [0x4dca1c], ecx
push eax
push 0xcdd
call fcn.00414768
pop ecx
push eax
push 0xcde
call fcn.00414768
pop ecx
mov edx, eax
xor ecx, ecx
call fcn.0041a990
add esp, 0xc
jmp 0x4270e8
call fcn.0042ea70
test eax, eax
jne 0x426188
push str.FATAL:_No_administrative_privileges_
call fcn.0042ed57
mov edx, dword [0x4dca4c]
pop ecx
lea ecx, [esp + 0x148]
call fcn.00418e4f
mov eax, dword [0x4dca4c]
mov edx, 0x181010
mov ecx, dword [eax + 4]
mov eax, 0x1010
and ecx, ebx
push ecx
cmovne eax, edx
mov dword [0x4dca1c], ecx
push eax
push 0xcd8
call fcn.00414768
pop ecx
push eax
push 0xcd9
jmp 0x426119
mov esi, dword [esp + 0x48]
test esi, esi
je 0x4261b3
push esi
call fcn.004816f0
mov ebx, dword [esp + 0x28]
pop ecx
cmp eax, 2
jne 0x4261b7
cmp byte [esi], 0x2f
jne 0x4261b7
cmp byte [esi + 1], 0x57
mov eax, 0x96
cmove ebx, eax
jmp 0x4261b7
mov ebx, dword [esp + 0x24]
mov esi, dword [sym.imp.KERNEL32.dll_CreateMutexA]
xor eax, eax
push str.Global_FormatUsb
inc eax
push eax
push 0
call esi
jmp 0x4261fe
test edi, edi
je 0x427068
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x426210
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
push str.Global_FormatUsb
inc eax
push eax
push 0
call esi
dec ebx
mov edi, eax
mov dword [esp + 0x40], edi
test ebx, ebx
jg 0x4261cc
test edi, edi
je 0x427068
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x427068
mov eax, dword [esp + 0x68]
push 6
push 0
mov dword [0x5223d4], eax
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov ecx, str.Riched20
call fcn.004078b4
test eax, eax
jne 0x426254
call fcn.0042fc51
push eax
push str.Could_not_load_RichEdit_library___some_dialogs_may_not_display:__s_n
call fcn.0042ed57
pop ecx
pop ecx
call fcn.0041c761
push 0x9e
push ecx
push ecx
xor ecx, ecx
call fcn.0042e7af
add esp, 0xc
mov dword [esp + 0x78], eax
lea ecx, [esp + 0x34]
call fcn.004038f1
test eax, eax
jne 0x42628f
push str.Could_not_get_AutoMount_status
call fcn.0042ed57
xor ebx, ebx
inc ebx
pop ecx
mov dword [esp + 0x34], ebx
jmp 0x4262bf
cmp dword [esp + 0x34], 0
jne 0x4262bc
push str.AutoMount_was_detected_as_disabled___temporarily_re_enabling_it
call fcn.0042ed57
xor ebx, ebx
pop ecx
inc ebx
mov ecx, ebx
call fcn.0040389b
test eax, eax
jne 0x4262bf
push str.Failed_to_enable_AutoMount
call fcn.0042ed57
pop ecx
jmp 0x4262bf
xor ebx, ebx
inc ebx
mov eax, dword [0x4dca4c]
mov ecx, dword [0x4dcab4]
push dword [eax + 0x14]
mov eax, 0xffe
sub eax, ecx
push str.Localization_set_to__s
push eax
lea eax, [ecx + 0x5205a0]
push eax
call fcn.00403163
push 0x5205a0
mov byte [0x52159d], 0
call fcn.004816f0
add esp, 0x14
mov word [eax + 0x5205a0], 0xa0d
add eax, 2
mov dword [0x4dcab4], eax
cmp eax, 0x1000
jae 0x427315
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
mov byte [eax + 0x5205a0], 0
mov eax, dword [0x4dca4c]
mov byte [0x4d8ecc], bl
mov eax, dword [eax + 4]
and eax, ebx
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
mov dword [0x4dca1c], eax
push dword [0x4dca70]
and dword [0x51daa4], 0
mov byte [0x521840], 0
call fcn.004812c6
and dword [0x4dca70], 0
xor eax, eax
cmp dword [0x4dca1c], eax
pop ecx
setne al
push eax
call dword [sym.imp.USER32.dll_SetProcessDefaultLayout]
mov edx, dword [0x4dca4c]
lea ecx, [esp + 0x148]
call fcn.00418e4f
test eax, eax
je 0x4263aa
cmp dword [0x4dca08], 0
mov eax, dword [0x4dca4c]
mov esi, dword [eax + 0x14]
je 0x4264f1
push ecx
mov edx, esi
mov ecx, str.Locale
call fcn.00419446
pop ecx
xor esi, esi
inc esi
cmp dword [esp + 0x14], 0
jne 0x4263fa
cmp dword [0x4dca1c], 0
mov eax, 0x1034
push ecx
mov ecx, 0x181034
cmovne eax, ecx
push eax
push 0xcdf
call fcn.00414768
pop ecx
push eax
push 0xce0
call fcn.00414768
pop ecx
mov edx, eax
xor ecx, ecx
call fcn.0041a990
add esp, 0xc
cmp eax, 6
jne 0x4270e8
mov dword [esp + 0x14], esi
mov eax, dword [esp + 0x18]
test eax, eax
je 0x426409
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0x65
pop ecx
call fcn.004349ec
push 0
push 0x422c5a
push 0
mov esi, eax
push esi
push dword [esp + 0x78]
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
push esi
mov dword [esp + 0x1c], eax
call fcn.004812c6
mov esi, dword [esp + 0x1c]
pop ecx
test esi, esi
je 0x427043
mov ecx, dword [0x4da86c]
mov edx, 0xffff0000
cmp ecx, edx
jle 0x426468
mov eax, dword [0x4da870]
cmp eax, edx
jle 0x426468
xor edx, edx
inc edx
push edx
xor edx, edx
push edx
push edx
push eax
push ecx
push edx
push esi
call dword [sym.imp.USER32.dll_SetWindowPos]
push 0
xor eax, eax
inc eax
push eax
push 0x233
push esi
mov esi, dword [sym.imp.USER32.dll_ChangeWindowMessageFilterEx]
call esi
push 0
xor eax, eax
inc eax
push eax
push 0x4a
push dword [esp + 0x24]
call esi
push 0
xor eax, eax
inc eax
push eax
push 0x49
push dword [esp + 0x24]
call esi
call fcn.00434d0f
cmp dword [0x51f048], 0
jne 0x4264d1
push 2
xor eax, eax
push eax
push eax
push 0x434bfb
push eax
push 3
pop eax
push eax
push eax
call dword [sym.imp.USER32.dll_SetWinEventHook]
mov dword [0x51f048], eax
test eax, eax
jne 0x4264d1
push str.Warning:_Could_not_set_alert_prompt_hook
call fcn.0042ed57
pop ecx
mov esi, dword [esp + 0x18]
xor eax, eax
inc eax
push eax
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
xor eax, eax
push eax
push eax
push eax
jmp 0x4268f5
test esi, esi
jne 0x4264f9
xor eax, eax
jmp 0x426500
push esi
call fcn.004816f0
pop ecx
push eax
push esi
xor esi, esi
mov edx, str.Locale
inc esi
push esi
call fcn.0041550f
add esp, 0xc
jmp 0x4263ad
mov eax, 0x104
cmp dword [esp + 0x50], eax
jne 0x426534
test dword [esp + 0x58], 0x20000000
jne 0x426534
xor eax, eax
inc eax
mov esi, eax
jmp 0x42653f
xor esi, esi
cmp dword [esp + 0x50], eax
jne 0x42654c
xor eax, eax
inc eax
cmp dword [esp + 0x54], 0x12
je 0x42654c
mov dword [esp + 0x38], eax
jmp 0x426561
push 0x12
call ebx
mov ecx, dword [esp + 0x20]
test ax, ax
push 1
pop eax
cmovs ecx, eax
mov dword [esp + 0x20], ecx
push dword [0x4dca7c]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4265a5
push 0x11
call ebx
test ax, ax
jns 0x4265a5
mov edx, dword [esp + 0x50]
mov eax, dword [esp + 0x54]
cmp edx, 0x100
jne 0x4265ad
cmp eax, 0x41
jne 0x4265ad
push 0xffffffffffffffff
push 0
push 0xb1
push dword [0x4dca98]
call edi
jmp 0x4268ef
mov eax, dword [esp + 0x54]
mov edx, dword [esp + 0x50]
test esi, esi
je 0x4265c4
cmp eax, 0x11
jne 0x4265c4
mov ecx, dword [0x4da370]
mov dword [0x51d9e8], ecx
jmp 0x4265ca
mov ecx, dword [0x51d9e8]
test ecx, ecx
jne 0x4265e7
push 0x11
call ebx
mov edx, dword [esp + 0x50]
test ax, ax
mov eax, dword [esp + 0x54]
jns 0x426607
cmp edx, 0x100
jne 0x426607
cmp eax, 0x4c
jne 0x426607
and dword [0x51d9e8], 0
push 0
push 0x41e
push 0x111
push dword [0x522464]
jmp 0x42659e
test esi, esi
je 0x426620
cmp eax, 0x11
je 0x4268ef
and dword [0x51d9e8], 0
jmp 0x4268ef
mov ecx, 0x104
cmp edx, ecx
jne 0x426720
cmp eax, 0xbb
je 0x426661
cmp eax, 0xbd
je 0x426649
cmp eax, 0x6b
je 0x426661
cmp eax, 0x6d
jne 0x426720
cmp eax, 0x6b
je 0x426661
mov eax, dword [0x4da374]
or ecx, 0xffffffff
cmp eax, 0xfffffffe
jle 0x426704
jmp 0x426674
xor eax, eax
lea ecx, [eax + 1]
mov eax, dword [0x4da374]
cmp eax, 2
jge 0x426704
add eax, ecx
mov dword [0x4da374], eax
dec eax
cmp dword [0x4dca08], 0
je 0x4266b9
push eax
push 0x4bc4a4
lea eax, [esp + 0x144]
push 0xc
push eax
call fcn.00403163
add esp, 0xc
mov byte [esp + 0x14b], 0
lea edx, [esp + 0x140]
mov ecx, str.DefaultThreadPriority
call fcn.00419446
pop ecx
jmp 0x4266d3
mov dword [esp + 0x48], eax
mov edx, str.DefaultThreadPriority
push 4
lea eax, [esp + 0x4c]
push eax
push 4
call fcn.0041550f
add esp, 0xc
mov eax, dword [0x51d9c0]
test eax, eax
je 0x4266e9
push dword [0x4da374]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [0x50caf8]
test eax, eax
je 0x4266ff
push dword [0x4da374]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [0x4da374]
push eax
push 0xcf6
push 0xdac
push 0
push 0
call fcn.00414c2d
add esp, 0x14
jmp 0x4268ef
cmp dword [0x4da370], 0
jne 0x426fc7
cmp edx, ecx
jne 0x426e49
cmp eax, 0xbe
jne 0x42677f
xor edx, edx
cmp dword [0x5223d8], edx
sete dl
xor ecx, ecx
inc ecx
mov dword [0x5223d8], edx
mov eax, edx
xor eax, ecx
mov ecx, str.EnableUsbDebug
lea eax, [eax*2 + 1]
mov dword [0x4da428], eax
call fcn.0041d561
push 0xcc6
call fcn.00414768
mov edx, dword [0x5223d8]
jmp 0x426deb
cmp eax, 0xbc
jne 0x4267ab
xor eax, eax
cmp dword [0x4da2b4], eax
push 0xcd2
sete al
mov dword [0x4da2b4], eax
call fcn.00414768
mov edx, dword [0x4da2b4]
jmp 0x426fba
cmp eax, 0x42
jne 0x4267e5
xor edx, edx
mov ecx, str.DisableFakeDrivesCheck
cmp dword [0x522468], edx
sete dl
xor eax, eax
inc eax
mov dword [0x522468], edx
xor edx, eax
call fcn.0041d561
push 0xcb8
call fcn.00414768
mov edx, dword [0x522468]
jmp 0x426fba
cmp eax, 0x43
jne 0x42680a
push 0
push 0
push 0x147
push dword [0x5222a4]
call edi
test eax, eax
js 0x4268ef
mov ecx, eax
jmp 0x426c4f
cmp eax, 0x44
jne 0x4269b6
push str.rufus_files
push 0x5222c0
push 0x4ba068
push ecx
lea eax, [esp + 0x260]
push eax
call fcn.00403163
add esp, 0x14
lea eax, [esp + 0x250]
xor ecx, ecx
mov byte [esp + 0x353], cl
push eax
push 0xcc0
push 0xdac
push ecx
push ecx
call fcn.00414c2d
add esp, 0x14
lea eax, [esp + 0x250]
push eax
call fcn.004816f0
pop ecx
push 2
lea esi, [eax + 2]
push esi
call fcn.0047b53f
pop ecx
pop ecx
push 3
mov edi, eax
xor ecx, ecx
pop eax
push esi
mov dword [esp + 0x9c], eax
mov eax, 0x414
push edi
push 0xffffffffffffffff
mov word [esp + 0xb0], ax
lea eax, [esp + 0x25c]
push eax
push ecx
push 0xfde9
mov dword [esp + 0xac], ecx
mov dword [esp + 0xb4], edi
mov dword [esp + 0xb8], ecx
mov dword [esp + 0xbe], ecx
mov dword [esp + 0xc2], ecx
mov dword [esp + 0xc6], ecx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [esp + 0x94]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test edi, edi
je 0x4268e9
push edi
call fcn.004812c6
pop ecx
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0
lea eax, [esp + 0x58]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x426518
mov eax, dword [0x4dcabc]
test eax, eax
je 0x42691a
push 0
push 0
push 0x10
push eax
call edi
cmp dword [0x51daf0], 0
je 0x4270e8
and dword [0x51daf0], 0
xor esi, esi
lea ecx, [esi + 1]
call fcn.004143f4
lea ecx, [esi + 1]
call fcn.004143b2
mov eax, dword [0x4dca4c]
mov ecx, dword [0x4dcab4]
push dword [eax + 0x14]
mov eax, 0xffe
sub eax, ecx
push str.Localization_set_to__s
push eax
lea eax, [ecx + 0x5205a0]
push eax
call fcn.00403163
push 0x5205a0
mov byte [0x52159d], 0
call fcn.004816f0
add esp, 0x14
mov word [eax + 0x5205a0], 0xa0d
add eax, 2
mov dword [0x4dcab4], eax
cmp eax, 0x1000
jae 0x427315
mov byte [eax + 0x5205a0], 0
xor ecx, ecx
mov eax, dword [0x4dca4c]
inc ecx
mov byte [0x4d8ecc], cl
mov eax, dword [eax + 4]
and eax, ecx
jmp 0x426339
cmp eax, 0x45
jne 0x4269fa
xor edx, edx
mov ecx, str.EnableWindowsDualUefiBiosMode
cmp dword [0x52218c], edx
sete dl
mov dword [0x52218c], edx
call fcn.0041d561
push 0xcc2
call fcn.00414768
mov edx, dword [0x52218c]
pop ecx
mov ecx, eax
call fcn.00422740
xor ecx, ecx
call fcn.0041da5d
jmp 0x4268ef
cmp eax, 0x46
jne 0x426a50
xor eax, eax
cmp dword [0x4dcaa0], eax
push 0xcb5
sete al
mov dword [0x4dcaa0], eax
call fcn.00414768
mov edx, dword [0x4dcaa0]
pop ecx
mov ecx, eax
call fcn.00422740
xor ecx, ecx
call fcn.00436c69
xor eax, eax
cmp dword [0x4dcaa0], eax
setne al
push eax
push 0x3fe
push dword [0x522464]
call dword [sym.imp.USER32.dll_CheckDlgButton]
jmp 0x4268ef
cmp eax, 0x47
jne 0x426a8a
xor edx, edx
mov ecx, str.DisableVHDs
cmp dword [0x4da380], edx
sete dl
xor eax, eax
inc eax
mov dword [0x4da380], edx
xor edx, eax
call fcn.0041d561
push 0xcec
call fcn.00414768
mov edx, dword [0x4da380]
jmp 0x426deb
cmp eax, 0x48
jne 0x426abf
xor edx, edx
mov ecx, str.EnableExtraHashes
cmp dword [0x4dcab0], edx
sete dl
mov dword [0x4dcab0], edx
call fcn.0041d561
push 0xcf0
call fcn.00414768
mov edx, dword [0x4dcab0]
jmp 0x426fba
cmp eax, 0x49
jne 0x426b1b
xor eax, eax
cmp dword [0x4d97ac], eax
push 0xcbe
sete al
mov dword [0x4d97ac], eax
call fcn.00414768
mov edx, dword [0x4d97ac]
pop ecx
mov ecx, eax
call fcn.00422740
cmp dword [0x4dca18], 0
je 0x4268ef
push 0
push 0x3f6
xor eax, eax
inc eax
push 0x111
push dword [esp + 0x24]
mov dword [0x51daf4], eax
mov dword [0x51d700], eax
jmp 0x42659e
cmp eax, 0x4a
jne 0x426b45
xor eax, eax
cmp dword [0x4d8fec], eax
push 0xcb9
sete al
mov dword [0x4d8fec], eax
call fcn.00414768
mov edx, dword [0x4d8fec]
jmp 0x426fba
cmp eax, 0x4b
jne 0x426b6f
xor eax, eax
cmp dword [0x4d97a8], eax
push 0xcba
sete al
mov dword [0x4d97a8], eax
call fcn.00414768
mov edx, dword [0x4d97a8]
jmp 0x426fba
cmp eax, 0x4c
jne 0x426ba4
xor edx, edx
mov ecx, str.ForceLargeFat32Formatting
cmp dword [0x5223c8], edx
sete dl
mov dword [0x5223c8], edx
call fcn.0041d561
push 0xcb6
call fcn.00414768
mov edx, dword [0x5223c8]
jmp 0x426deb
cmp eax, 0x4d
jne 0x426bd9
xor edx, edx
mov ecx, str.IgnoreBootMarker
cmp dword [0x4dca88], edx
sete dl
mov dword [0x4dca88], edx
call fcn.0041d561
push 0xcf7
call fcn.00414768
mov edx, dword [0x4dca88]
jmp 0x426fba
cmp eax, 0x4e
jne 0x426c03
xor eax, eax
cmp dword [0x4dca34], eax
push 0xcbc
sete al
mov dword [0x4dca34], eax
call fcn.00414768
mov edx, dword [0x4dca34]
jmp 0x426fba
cmp eax, 0x4f
jne 0x426c12
call fcn.00422760
jmp 0x4268ef
cmp eax, 0x50
jne 0x426c59
push 0
push 0
push 0x147
push dword [0x5222a4]
call edi
push 0
mov esi, eax
push esi
push 0x150
push dword [0x5222a4]
call edi
push ecx
push ecx
mov ecx, eax
call fcn.00405a32
pop ecx
pop ecx
test eax, eax
je 0x4268ef
mov ecx, esi
call fcn.00436373
jmp 0x4268ef
cmp eax, 0x51
jne 0x426c9d
xor edx, edx
mov ecx, str.EnableFileIndexing
cmp dword [0x5223cc], edx
sete dl
mov dword [0x5223cc], edx
call fcn.0041d561
xor ebx, ebx
cmp dword [0x5223cc], ebx
push 0xcda
sete bl
call fcn.00414768
pop ecx
mov edx, ebx
mov ecx, eax
call fcn.00422740
jmp 0x426d80
cmp eax, 0x52
jne 0x426cd6
mov edx, str.FormatUsbFormatUsb
call fcn.0041d42a
neg eax
sbb eax, eax
add eax, 0xcb1
push eax
push 0xdac
push 0
push 0
call fcn.00414c2d
add esp, 0x10
mov edx, 0x4b6bd8
call fcn.0041d42a
jmp 0x4268ef
cmp eax, 0x53
jne 0x426d00
xor eax, eax
cmp dword [0x4da884], eax
push 0xcb4
sete al
mov dword [0x4da884], eax
call fcn.00414768
mov edx, dword [0x4da884]
jmp 0x426deb
cmp eax, 0x54
jne 0x426d35
xor edx, edx
mov ecx, str.PreserveTimestamps
cmp dword [0x4dca38], edx
sete dl
mov dword [0x4dca38], edx
call fcn.0041d561
push 0xcc5
call fcn.00414768
mov edx, dword [0x4dca38]
jmp 0x426fba
cmp eax, 0x55
jne 0x426d8b
xor edx, edx
mov ecx, str.UseProperSizeUnits
cmp dword [0x521f20], edx
sete dl
xor eax, eax
inc eax
mov dword [0x521f20], edx
xor edx, eax
call fcn.0041d561
xor ebx, ebx
cmp dword [0x521f20], ebx
push 0xcbf
sete bl
call fcn.00414768
pop ecx
mov edx, ebx
mov ecx, eax
call fcn.00422740
xor ecx, ecx
call fcn.00436c69
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
jmp 0x4268ef
cmp eax, 0x56
jne 0x426dbb
xor edx, edx
mov ecx, str.UseVds
cmp dword [0x4dca20], edx
sete dl
mov dword [0x4dca20], edx
call fcn.0041d561
mov edx, dword [0x4dca20]
mov ecx, 0x4c1b80
jmp 0x426fbd
cmp eax, 0x57
jne 0x426df8
xor edx, edx
mov ecx, str.EnableVmdkDetection
cmp dword [0x521dd4], edx
sete dl
mov dword [0x521dd4], edx
call fcn.0041d561
push 0xcc1
call fcn.00414768
mov edx, dword [0x521dd4]
pop ecx
mov ecx, eax
call fcn.00422740
jmp 0x426f6a
cmp eax, 0x58
jne 0x426e1f
push 0xcb7
push 0x7d0
push 0
push 0
call fcn.00414c2d
add esp, 0x10
and dword [0x51d9b8], 0
jmp 0x4268ef
cmp eax, 0x59
jne 0x426e34
xor eax, eax
cmp dword [0x4dca50], eax
setle al
jmp 0x426fa5
cmp eax, 0x5a
jne 0x426fc7
xor eax, eax
inc eax
and dword [0x4dca24], 0
jmp 0x426e75
mov esi, 0x100
cmp edx, esi
jne 0x426fc7
cmp eax, 0x5a
jne 0x426ea3
push 0x11
call ebx
test ax, ax
jns 0x426e95
push 0x12
call ebx
test ax, ax
jns 0x426e95
xor eax, eax
inc eax
mov dword [0x4dca24], eax
push 0
push 0x3eb
push 0x111
push dword [esp + 0x24]
mov dword [0x4dca30], eax
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x4268ef
cmp dword [esp + 0x50], esi
jne 0x426fc7
mov eax, dword [esp + 0x54]
cmp eax, 0x46
jne 0x426f80
push 0x11
call ebx
test ax, ax
jns 0x426f76
push 0x12
call ebx
test ax, ax
jns 0x426f76
xor eax, eax
cmp dword [0x4dcaa8], eax
sete al
mov dword [0x4dcaa8], eax
test eax, eax
je 0x426eea
mov eax, dword [0x4dcaa0]
mov dword [esp + 0x6c], eax
xor eax, eax
lea ecx, [eax + 1]
jmp 0x426eee
mov ecx, dword [esp + 0x6c]
xor eax, eax
mov dword [0x4dcaa0], ecx
test ecx, ecx
setne al
push eax
push 0x3fe
push dword [0x522464]
call dword [sym.imp.USER32.dll_CheckDlgButton]
push 0xcd7
call fcn.00414768
mov edx, dword [0x4dcaa8]
pop ecx
mov ecx, eax
call fcn.00422740
mov ecx, dword [0x4dcaa8]
mov edx, str.disabled
test ecx, ecx
mov eax, str.enabled
mov ecx, 0x4b4dda
cmove eax, edx
push eax
mov eax, str.CAUTION:
cmove eax, ecx
push eax
push str._sListing_of_non_USB_removable_drives__s
call fcn.0042ed57
add esp, 0xc
cmp dword [0x4dcaa8], 0
je 0x426f6a
push str.By_using_this_unofficial_cheat_mode_you_forfeit_ANY_RIGHT_to_complain_if_you_lose_valuable_data_
call fcn.0042ed57
pop ecx
xor ecx, ecx
call fcn.00436c69
jmp 0x4268ef
cmp dword [esp + 0x50], esi
jne 0x426fc7
mov eax, dword [esp + 0x54]
cmp eax, 0x59
jne 0x426fc7
push 0x11
call ebx
test ax, ax
jns 0x426fc7
push 0x12
call ebx
test ax, ax
jns 0x426fc7
xor ecx, ecx
cmp dword [0x4dca50], ecx
push 2
pop eax
cmovg eax, ecx
push 0xcbb
mov dword [0x4dca50], eax
call fcn.00414768
mov edx, dword [0x4dca50]
pop ecx
mov ecx, eax
call fcn.00422740
jmp 0x4268ef
cmp dword [esp + 0x20], 0
je 0x426ffa
push 0x12
call ebx
test ax, ax
js 0x426ffa
and dword [esp + 0x20], 0
cmp dword [esp + 0x38], 0
jne 0x426ff5
mov eax, dword [0x50caec]
inc eax
push 3
cdq
pop ecx
idiv ecx
mov dword [0x50caec], edx
and dword [esp + 0x38], 0
mov esi, dword [sym.imp.USER32.dll_IsDialogMessageW]
lea eax, [esp + 0x4c]
push eax
push dword [esp + 0x1c]
call esi
test eax, eax
jne 0x4268ef
lea eax, [esp + 0x4c]
push eax
push dword [0x4dca7c]
call esi
test eax, eax
jne 0x4268ef
lea eax, [esp + 0x4c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x4c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x4268ef
cmp dword [0x4dca1c], 0
mov eax, 0x1010
push ecx
mov ecx, 0x181010
mov edx, str.Could_not_create_Window
cmovne eax, ecx
push eax
push str.DialogBox_failure
jmp 0x426121
mov edx, dword [0x4dca4c]
lea ecx, [esp + 0x148]
call fcn.00418e4f
mov eax, dword [0x4dca4c]
xor edi, edi
inc edi
mov edx, 0x181010
mov ecx, dword [eax + 4]
mov eax, 0x1010
and ecx, edi
push ecx
cmovne eax, edx
mov dword [0x4dca1c], ecx
push eax
push 0xbb9
call fcn.00414768
pop ecx
push eax
push 0xbba
call fcn.00414768
pop ecx
mov edx, eax
xor ecx, ecx
call fcn.0041a990
mov ebx, dword [esp + 0x1c]
add esp, 0xc
jmp 0x4270ef
push str.FATAL:_Could_not_access_locale_
call fcn.0042ed57
mov dword [esp], 0x1010
push str.Fatal_error
push str.The_locale_data_is_missing_or_invalid._This_application_will_now_exit.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ebx, dword [esp + 0x10]
xor edi, edi
inc edi
cmp dword [esp + 0x44], 0
je 0x427118
cmp dword [esp + 0x3c], 0
jne 0x427118
mov esi, dword [esp + 0x70]
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
cmp esi, 0xffffffff
je 0x427118
test esi, esi
je 0x427118
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x4dca04]
test eax, eax
je 0x427129
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
cmp dword [esp + 0x74], 0
jne 0x427146
cmp byte [esp + 0x148], 0
je 0x427146
lea ecx, [esp + 0x148]
call fcn.00407d9b
call fcn.00433053
push dword [0x51f048]
call dword [sym.imp.USER32.dll_UnhookWinEvent]
and dword [0x51f048], 0
xor ecx, ecx
call fcn.004143f4
push dword [0x4dca18]
call fcn.004812c6
and dword [0x4dca18], 0
pop ecx
push dword [0x4dca44]
call fcn.004812c6
and dword [0x4dca44], 0
pop ecx
push dword [esp + 0x28]
call fcn.004812c6
pop ecx
push dword [0x4dca64]
call fcn.004812c6
and dword [0x4dca64], 0
pop ecx
push dword [0x4dca68]
call fcn.004812c6
and dword [0x4dca68], 0
pop ecx
push dword [0x4dc5d8]
call fcn.004812c6
and dword [0x4dc5d8], 0
pop ecx
push dword [0x4dca70]
call fcn.004812c6
and dword [0x4dca70], 0
pop ecx
push dword [0x4dca00]
call fcn.004812c6
and dword [0x4dca00], 0
pop ecx
test ebx, ebx
je 0x42721b
xor esi, esi
cmp dword [esp + 0x1c], esi
jle 0x427214
push dword [ebx + esi*4]
call fcn.004812c6
and dword [ebx + esi*4], 0
inc esi
pop ecx
cmp esi, dword [esp + 0x1c]
jl 0x427200
push ebx
call fcn.004812c6
pop ecx
xor ebx, ebx
cmp dword [esp + 0x78], ebx
je 0x427230
push ebx
push ecx
push ecx
mov ecx, edi
call fcn.0042e7af
add esp, 0xc
cmp dword [esp + 0x34], 0
jne 0x42724d
xor ecx, ecx
call fcn.0040389b
test eax, eax
jne 0x42724d
push str.Failed_to_restore_AutoMount_to_disabled
call fcn.0042ed57
pop ecx
cmp dword [0x4dcab4], 0
je 0x427267
push 0x5205a0
push 0x4b04c8
call fcn.0042ed57
pop ecx
pop ecx
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esi, ebx
mov dword [0x4dcab4], ebx
jmp 0x427288
cmp esi, 0xa
jg 0x427293
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
push str.rufus.com
call edi
test eax, eax
je 0x427277
push dword [esp + 0x40]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x4272c3
mov ecx, 0xffff
add ax, cx
mov word [0x4dca14], ax
movzx eax, ax
push dword [eax*4 + 0x5223e0]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ax, word [0x4dca14]
test ax, ax
jne 0x4272a5
cmp dword [esp + 0x44], 0
je 0x4272f1
push 3
pop eax
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
call dword [sym.imp.KERNEL32.dll_FreeConsole]
push str._FormatUsb_exit__n
call fcn.0042ed57
pop ecx
mov ecx, dword [esp + 0x66c]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00475c80
mov esp, ebp
pop ebp
ret 0x10
call fcn.00475db1
int3