Function at 0x140033720
Capabilities:
Check if file exists
Check mutex on windows
Copy file
Delete file
Extract resource via kernel32 functions
Get common file path
Get file attributes
Get session user name
Get token membership
Identify system language via api
Log keystrokes via polling
Parse pe header
Terminate thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x6b0]
sub rsp, 0x7b0
mov rax, qword [0x140106438]
xor rax, rsp
mov qword [rbp + 0x6a0], rax
xor r12d, r12d
mov qword [rbp + 0x1b0], r8
mov dword [rbp - 0x4c], r12d
mov dword [rsp + 0x68], r12d
mov dword [rbp + 8], r12d
mov qword [rbp + 0x10], rcx
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov ebx, 1
mov dword [rbp - 0x68], r12d
movzx eax, ax
lea rdx, str.SoftwareMicrosoftVisualStudio
mov dword [rsp + 0x6c], eax
mov r9d, 0x20019
lea rax, [rbp - 0x58]
mov dword [rsp + 0x70], r12d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000001
mov dword [rbp - 0x3c], r12d
mov r15d, r12d
mov dword [rbp - 0x44], r12d
mov dword [rbp - 0x40], r12d
mov r14d, r12d
mov dword [rbp - 0x80], ebx
mov dword [rsp + 0x7c], r12d
mov qword [rbp - 0x58], r12
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov rcx, qword [rbp - 0x58]
mov r13d, r12d
test eax, eax
sete r13b
test rcx, rcx
je 0x1400337ea
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edx, edx
mov dword [rbp - 0x6c], r12d
mov r8d, 0x104
mov dword [rbp - 0x70], r12d
lea rcx, [rbp + 0x380]
mov dword [rbp - 0x50], r12d
mov dword [rbp - 0x48], 4
call fcn.140093c00
xor edx, edx
lea rcx, [rbp + 0x270]
mov r8d, 0x104
call fcn.140093c00
xor edx, edx
lea rcx, [rbp + 0x490]
mov r8d, 0x104
call fcn.140093c00
movzx eax, word [0x1400e30d4]
lea rcx, [0x1400d756a]
mov word [rsp + 0x74], ax
movzx eax, byte [0x1400e30d6]
mov byte [rsp + 0x76], al
lea rax, str.extra_devs
mov qword [rbp + 0x70], rax
lea rax, [0x1400e409c]
mov qword [rbp + 0x90], rax
lea rax, str.help
mov qword [rbp + 0xb0], rax
lea rax, [0x1400e40a8]
mov qword [rbp + 0xd0], rax
lea rax, str.locale
mov qword [rbp + 0xf0], rax
lea rax, str.filesystem
mov qword [rbp + 0x110], rax
lea rax, str.wait
mov qword [rbp + 0x130], rax
mov qword [rbp - 0x60], r12
mov qword [rbp - 0x78], r12
mov qword [rbp - 0x30], r12
mov qword [rbp + 0x18], r12
mov qword [rbp - 0x58], r12
mov dword [rbp + 0x78], r12d
mov qword [rbp + 0x80], r12
mov dword [rbp + 0x88], 0x78
mov dword [rbp + 0x98], r12d
mov qword [rbp + 0xa0], r12
mov dword [rbp + 0xa8], 0x67
mov dword [rbp + 0xb8], r12d
mov qword [rbp + 0xc0], r12
mov dword [rbp + 0xc8], 0x68
mov dword [rbp + 0xd8], ebx
mov qword [rbp + 0xe0], r12
mov dword [rbp + 0xe8], 0x69
mov dword [rbp + 0xf8], ebx
mov qword [rbp + 0x100], r12
mov dword [rbp + 0x108], 0x6c
mov dword [rbp + 0x118], ebx
mov qword [rbp + 0x120], r12
mov dword [rbp + 0x128], 0x66
mov dword [rbp + 0x138], ebx
mov qword [rbp + 0x140], r12
mov dword [rbp + 0x148], 0x77
mov qword [rbp + 0x150], r12
mov dword [rbp + 0x158], r12d
mov qword [rbp + 0x160], r12
mov dword [rbp + 0x168], r12d
call qword [sym.imp.KERNEL32.dll_SetDllDirectoryA]
mov ecx, 0x800
call qword [sym.imp.KERNEL32.dll_SetDefaultDllDirectories]
lea rcx, str._R3dusb_init__n
call fcn.140041aa0
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x50]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x1400339c1
cmp dword [rbp - 0x50], 0x6c696e
mov eax, ebx
je 0x1400339c4
mov eax, r12d
mov edx, 2
mov dword [0x140112954], eax
mov ecx, 0x104
mov dword [0x140159fa4], ebx
call fcn.1400966e0
mov rdi, rax
test rax, rax
jne 0x1400339f5
lea ecx, [rax + 0xe]
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140033aa9
mov r8d, 0x104
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test ebx, ebx
je 0x140033a8e
lea ecx, [rbx - 1]
test ecx, ecx
je 0x140033a36
lea rdx, [rdi + rcx*2]
nop
cmp word [rdx], 0x5c
je 0x140033a31
sub rdx, 2
add ecx, 0xffffffff
jne 0x140033a20
jmp 0x140033a36
mov word [rdi + rcx*2], r12w
mov qword [rsp + 0x38], r12
lea rax, [0x14015ad80]
mov qword [rsp + 0x30], r12
mov r8, rdi
mov r12, 0xffffffffffffffff
mov dword [rsp + 0x28], 0x104
mov r9d, r12d
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebx, eax
test eax, eax
jne 0x140033a95
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
mov ebx, eax
call fcn.14009b5a0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140033aa9
mov r12, 0xffffffffffffffff
mov rcx, rdi
call fcn.14009b5a0
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
jne 0x140033ad4
call fcn.140041e50
mov rdx, rax
lea rcx, str.Could_not_get_application_directory:__s
call fcn.140041aa0
movzx eax, word [0x1400e4110]
mov word [0x14015ad80], ax
mov byte [0x14015ad82], r14b
jmp 0x140033af6
mov r9, r12
lea r8, [0x1400d72e8]
mov edx, 0x104
lea rcx, [0x14015ad80]
call fcn.14009b5bc
movzx eax, word [0x1400e4110]
lea r12, [0x14015ab00]
mov word [0x14015ab00], ax
mov rcx, r12
mov byte [0x14015ab02], r14b
call fcn.140003550
mov rbx, rax
xor r9d, r9d
xor eax, eax
mov edx, 0x80000000
mov qword [rsp + 0x30], rax
mov rcx, rbx
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
lea r8d, [rax + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test rbx, rbx
je 0x140033b5a
mov rcx, rbx
call fcn.14009b5a0
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp rdi, 0xffffffffffffffff
je 0x140033bf5
mov rdx, r12
mov rcx, rdi
call fcn.140027900
test eax, eax
je 0x140033bf5
lea rdx, [0x1400d6f30]
mov rcx, r12
call fcn.1400930e8
cmp rax, r12
je 0x140033ba3
lea rdx, [0x1400e4114]
mov rcx, r12
call fcn.1400930e8
cmp rax, r12
jne 0x140033bf5
mov rsi, 0xffffffffffffffff
lea rdx, [0x14015ab04]
mov rax, rsi
inc rax
cmp byte [rdx + rax], r14b
jne 0x140033bb4
inc rax
mov ebx, 0x104
cmp rax, rbx
mov rcx, r12
cmovb rbx, rax
mov r8, rbx
call fcn.140093550
mov r9, rsi
mov byte [rbx + r12 - 1], r14b
lea r8, [0x1400d72e8]
mov edx, 0x104
mov rcx, r12
call fcn.14009b5bc
jmp 0x140033c27
call fcn.140041e50
mov r8, rax
lea rcx, str.Could_not_get_current_directory_from__s:__s
mov rdx, r12
call fcn.140041aa0
movzx eax, word [0x1400e4110]
mov word [0x14015ab00], ax
mov byte [0x14015ab02], r14b
cmp rdi, 0xffffffffffffffff
je 0x140033c35
test rdi, rdi
je 0x140033c35
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 2
mov ecx, 0x104
call fcn.1400966e0
mov rdx, rax
mov ecx, 0x104
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea rax, [0x140159fc0]
test edi, edi
je 0x140033ca5
xor ecx, ecx
mov r8, rbx
mov qword [rsp + 0x38], rcx
xor edx, edx
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 0x104
lea r9d, [rcx - 1]
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test eax, eax
jne 0x140033ca5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test rbx, rbx
je 0x140033cb2
mov rcx, rbx
call fcn.14009b5a0
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
jne 0x140033d17
call fcn.140041e50
mov rdx, rax
lea rcx, str.Could_not_get_temp_directory:__s
call fcn.140041aa0
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [r12 + rax], r14b
jne 0x140033ce0
inc rax
lea rdi, [0x140159fc0]
mov ebx, 0x104
mov rdx, r12
cmp rax, rbx
mov rcx, rdi
cmovb rbx, rax
mov r8, rbx
call fcn.140093550
mov byte [rbx + rdi - 1], r14b
jmp 0x140033e72
lea rcx, [0x140159fc0]
call fcn.140003550
mov rbx, rax
xor r9d, r9d
xor eax, eax
mov edx, 0x80000000
mov qword [rsp + 0x30], rax
mov rcx, rbx
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
lea r8d, [rax + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test rbx, rbx
je 0x140033d6a
mov rcx, rbx
call fcn.14009b5a0
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rsi, [0x140159fc0]
cmp rdi, 0xffffffffffffffff
je 0x140033e15
mov rdx, rsi
mov rcx, rdi
call fcn.140027900
test eax, eax
je 0x140033e15
lea rdx, [0x1400d6f30]
mov rcx, rsi
call fcn.1400930e8
cmp rax, rsi
je 0x140033dbe
lea rdx, [0x1400e4114]
mov rcx, rsi
call fcn.1400930e8
cmp rax, rsi
jne 0x140033e15
lea rdx, [0x140159fc4]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rdx + rax], r14b
jne 0x140033dd0
inc rax
mov ebx, 0x104
cmp rax, rbx
mov rcx, rsi
cmovb rbx, rax
mov r8, rbx
call fcn.140093550
mov r9, 0xffffffffffffffff
mov byte [rbx + rsi - 1], r14b
lea r8, [0x1400d72e8]
mov edx, 0x104
mov rcx, rsi
call fcn.14009b5bc
jmp 0x140033e64
call fcn.140041e50
mov r8, rax
lea rcx, str.Could_not_get_actual_temp_directory_from__s:__s
mov rdx, rsi
call fcn.140041aa0
mov rax, 0xffffffffffffffff
inc rax
cmp byte [r12 + rax], r14b
jne 0x140033e33
inc rax
mov ebx, 0x104
cmp rax, rbx
mov rdx, r12
mov rcx, rsi
cmovb rbx, rax
mov r8, rbx
call fcn.140093550
mov byte [rbx + rsi - 1], r14b
cmp rdi, 0xffffffffffffffff
je 0x140033e72
test rdi, rdi
je 0x140033e72
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 2
mov ecx, 0x104
call fcn.1400966e0
mov edx, 0x104
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea rax, [0x140159ea0]
test edi, edi
je 0x140033ee2
xor ecx, ecx
mov r8, rbx
mov qword [rsp + 0x38], rcx
xor edx, edx
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 0x104
lea r9d, [rcx - 1]
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test eax, eax
jne 0x140033ee2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test rbx, rbx
je 0x140033eef
mov rcx, rbx
call fcn.14009b5a0
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
jne 0x140033f30
call fcn.140041e50
mov rdx, rax
lea rcx, str.Could_not_get_system_directory:__s
call fcn.140041aa0
movups xmm0, xmmword [str.C:WindowsSystem32]
mov eax, dword [0x1400e41e8]
mov dword [0x140159eb0], eax
movups xmmword [0x140159ea0], xmm0
mov byte [0x140159eb3], r14b
lea rdi, [0x14015a220]
mov r8d, 0x1c
mov rdx, rdi
call fcn.140027730
test eax, eax
jne 0x140033f9d
call fcn.140041e50
mov rdx, rax
lea rcx, str.Could_not_get_app_data_directory:__s
call fcn.140041aa0
mov rax, 0xffffffffffffffff
lea rsi, [0x140159fc0]
nop dword [rax + rax]
inc rax
cmp byte [rsi + rax], r14b
jne 0x140033f70
inc rax
mov ebx, 0x104
cmp rax, rbx
mov rdx, rsi
mov rcx, rdi
cmovb rbx, rax
mov r8, rbx
call fcn.140093550
mov byte [rbx + rdi - 1], r14b
jmp 0x140033fa4
lea rsi, [0x140159fc0]
lea rdi, [0x14015ac20]
mov r8d, 0x28
mov rdx, rdi
call fcn.140027730
test eax, eax
jne 0x14003400b
call fcn.140041e50
mov rdx, rax
lea rcx, str.Could_not_get_user_directory:__s
call fcn.140041aa0
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rsi + rax], r14b
jne 0x140033fe0
inc rax
mov ebx, 0x104
cmp rax, rbx
mov rdx, rsi
mov rcx, rdi
cmovb rbx, rax
mov r8, rbx
call fcn.140093550
mov byte [rbx + rdi - 1], r14b
mov rax, 0xffffffffffffffff
lea rdx, [0x140159ea0]
nop dword [rax]
inc rax
cmp byte [rdx + rax], r14b
jne 0x140034020
inc rax
lea rcx, [0x14015a0e0]
mov ebx, 0x104
cmp rax, rbx
cmovb rbx, rax
mov r8, rbx
call fcn.140093550
lea rax, [0x14015a0e0]
mov rdx, r12
lea rcx, str.Cur_dir:__s
mov byte [rbx + rax - 1], r14b
call fcn.140041aa0
lea rbx, [0x14015ad80]
mov rdx, rbx
lea rcx, str.App_dir:__s
call fcn.140041aa0
lea rdx, [0x14015a0e0]
lea rcx, str.Sys_dir:__s
call fcn.140041aa0
mov rdx, rdi
lea rcx, str.Usr_dir:__s
call fcn.140041aa0
lea rdx, [0x14015a220]
lea rcx, str.Dat_dir:__s
call fcn.140041aa0
mov rdx, rsi
lea rcx, str.Tmp_dir:__s
call fcn.140041aa0
lea r9, str._srufus.app
mov qword [rsp + 0x20], rbx
mov edx, 0x104
lea rcx, [rbp + 0x380]
mov r8, 0xffffffffffffffff
call fcn.1400034e0
lea rcx, [rbp + 0x380]
mov byte [rbp + 0x483], r14b
call fcn.140003550
mov rcx, rax
mov rbx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edi, eax
test rbx, rbx
je 0x14003410e
mov rcx, rbx
call fcn.14009b5a0
test edi, edi
je 0x140034121
mov dword [0x1401128c0], 1
jmp 0x1400346b5
mov rax, qword [0x140155130]
test rax, rax
jne 0x140034166
lea rcx, str.Msvcrt
call fcn.140009360
mov rcx, rax
lea rdx, str.__wgetmainargs
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140155130], rax
test rax, rax
jne 0x140034166
lea rcx, str.Could_not_access_UTF_16_args
call fcn.140041aa0
jmp 0x1400346ac
xor ebx, ebx
lea rcx, [rbp + 8]
mov qword [rsp + 0x20], rcx
lea r8, [rbp + 0x60]
lea rdx, [rbp + 0x20]
mov r12d, ebx
lea rcx, [rsp + 0x68]
lea r9d, [rbx + 1]
call rax
movsxd rcx, dword [rsp + 0x68]
lea edx, [rbx + 8]
call fcn.1400966e0
mov qword [rbp - 0x78], rax
mov rdi, rax
test rax, rax
je 0x1400346ac
mov esi, ebx
cmp dword [rsp + 0x68], ebx
jle 0x140034264
mov edi, ebx
mov rcx, qword [rbp + 0x20]
mov rcx, qword [rcx + rdi]
call fcn.14001fb50
mov rbx, rax
mov rax, qword [rbp - 0x78]
mov qword [rdi + rax], rbx
movzx ecx, byte [rbx]
sub ecx, 0x2f
jne 0x1400341e8
movzx ecx, byte [rbx + 1]
sub ecx, 0x57
jne 0x1400341e8
movzx ecx, byte [rbx + 2]
xor edx, edx
movzx eax, dl
sub ecx, eax
jmp 0x1400341ea
xor edx, edx
test ecx, ecx
mov eax, 0x96
cmove r15d, eax
cmp byte [rbx], 0x2d
mov dword [rbp - 0x68], r15d
jne 0x14003420a
cmp byte [rbx + 1], 0x67
jne 0x14003420a
cmp byte [rbx + 2], r12b
je 0x140034233
mov rcx, rdx
lea rdx, str.__gui
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rbx + rcx]
inc rcx
cmp al, byte [rdx + rcx - 1]
jne 0x140034239
cmp rcx, 6
jne 0x140034220
mov r14d, 1
lea rdx, str._InvokerPRAID
mov rcx, rbx
call fcn.1400a5b5c
test eax, eax
je 0x140034112
inc esi
add rdi, 8
cmp esi, dword [rsp + 0x68]
jl 0x1400341b2
mov rdi, qword [rbp - 0x78]
mov rcx, qword [rdi]
mov rsi, 0xffffffffffffffff
mov rax, rsi
inc rax
cmp byte [rcx + rax], r12b
jne 0x140034271
lea rbx, [rcx - 1]
add rbx, rax
cmp rbx, rcx
jbe 0x140034293
cmp byte [rbx], 0x5c
je 0x140034293
dec rbx
cmp rbx, rcx
ja 0x140034286
mov edx, 0x70
mov rcx, rbx
call fcn.140093068
test rax, rax
jne 0x1400342c8
lea edx, [rax + 0x50]
mov rcx, rbx
call fcn.140093068
test rax, rax
je 0x1400342cd
mov edx, 0x50
mov rcx, rbx
call fcn.140093068
cmp byte [rax + 1], 0x48
je 0x1400342cd
mov byte [rsp + 0x74], 0x61
test r14d, r14d
jne 0x140034361
mov ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_AttachConsole]
test eax, eax
je 0x140034361
lea rcx, str.Enabling_console_line_hogger
call fcn.140041aa0
mov ebx, 1
xor ecx, ecx
mov dword [rbp - 0x3c], ebx
call fcn.14009684c
mov r8, rax
lea rdx, [0x1400dbe70]
lea rcx, str.CONIN_
call fcn.1400966b0
mov ecx, ebx
call fcn.14009684c
mov r8, rax
lea rdx, [0x1400d10c4]
lea rcx, str.CONOUT_
call fcn.1400966b0
lea ecx, [rbx + 1]
call fcn.14009684c
mov r8, rax
lea rdx, [0x1400d10c4]
lea rcx, str.CONOUT_
call fcn.1400966b0
call fcn.140096bb8
call fcn.140033430
mov qword [rbp + 0x18], rax
jmp 0x140034366
mov ebx, 1
mov ecx, dword [rsp + 0x68]
lea rax, [rbp - 0x4c]
xor r15d, r15d
lea r9, [rbp + 0x70]
mov dword [rsp + 0x28], r15d
lea r8, str.ghxf:i:l:w:z:
mov rdx, rdi
mov qword [rsp + 0x20], rax
call fcn.14005a470
cmp eax, esi
je 0x1400346ac
nop word [rax + rax]
add eax, 0xffffff9f
cmp eax, 0x19
ja case.0x1400343c9.98
lea r14, [0x140000000]
cdqe
movzx eax, byte [r14 + rax + 0x37d38]
mov ecx, dword [r14 + rax*4 + 0x37d14]
add rcx, r14
jmp rcx
mov dword [0x140111aac], ebx
jmp case.0x1400343c9.97
mov rcx, qword [0x1401128d8]
call fcn.14009b5a0
mov edx, 0x104
mov qword [0x1401128d8], r15
mov rcx, rbx
call fcn.1400966e0
mov qword [0x1401128d8], rax
mov rsi, rax
test rax, rax
je 0x14003463a
mov rcx, qword [0x140158b08]
call fcn.140003550
mov r14, rax
test rsi, rsi
jne 0x140034422
mov rdi, r15
jmp 0x140034434
mov edx, 2
mov ecx, 0x104
call fcn.1400966e0
mov rdi, rax
lea r9, [rbp + 0x1a0]
mov r8, rdi
mov edx, 0x104
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r15d, eax
test ebx, ebx
je 0x14003449d
xor eax, eax
mov r8, rdi
mov qword [rsp + 0x38], rax
xor edx, edx
mov qword [rsp + 0x30], rax
mov ecx, 0xfde9
mov dword [rsp + 0x28], 0x104
mov qword [rsp + 0x20], rsi
mov rsi, 0xffffffffffffffff
mov r9d, esi
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x1400344a4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r15d, eax
jmp 0x1400344a4
mov rsi, 0xffffffffffffffff
test rdi, rdi
je 0x1400344b1
mov rcx, rdi
call fcn.14009b5a0
test r14, r14
je 0x1400344be
mov rcx, r14
call fcn.14009b5a0
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [0x1401128d8]
call fcn.1400279d0
test al, 0x10
je 0x14003450d
mov rdx, qword [0x1401128d8]
lea rcx, str.Could_not_find_image__s_n
call fcn.1400269d0
mov rcx, qword [0x1401128d8]
call fcn.14009b5a0
mov rdi, qword [rbp - 0x78]
xor r15d, r15d
mov qword [0x1401128d8], r15
lea ebx, [r15 + 1]
jmp case.0x1400343c9.97
mov rdi, qword [rbp - 0x78]
mov ebx, 1
mov dword [0x140154f14], ebx
xor r15d, r15d
jmp case.0x1400343c9.97
mov rax, qword [0x140158b08]
movzx ecx, byte [rax]
call fcn.1400a1c80
test eax, eax
je 0x140034551
mov rcx, qword [0x140158b08]
xor r8d, r8d
xor edx, edx
call fcn.1400a3cac
mov dword [rsp + 0x6c], eax
jmp case.0x1400343c9.97
mov rcx, qword [rbp - 0x60]
call fcn.14009b5a0
mov rcx, qword [0x140158b08]
test rcx, rcx
jne 0x14003456f
mov qword [rbp - 0x60], r15
jmp case.0x1400343c9.97
call fcn.1400a1b50
mov qword [rbp - 0x60], rax
jmp case.0x1400343c9.97
mov rax, qword [0x140158b08]
movzx ecx, byte [rax]
call fcn.1400a1c80
test eax, eax
je 0x1400345a5
mov rcx, qword [0x140158b08]
xor r8d, r8d
xor edx, edx
call fcn.1400a3cac
mov ebx, eax
jmp 0x1400345f0
mov ebx, r15d
lea rdi, [0x1400d1660]
nop
mov rax, qword [rdi]
lea r8, str._NULL_
mov rcx, qword [0x140158b08]
test rax, rax
mov rdx, r8
cmovne rdx, rax
test rcx, rcx
cmove rcx, r8
call fcn.1400a5b5c
test eax, eax
je 0x1400345ec
inc ebx
add rdi, 8
cmp ebx, 9
jb 0x1400345b0
mov ebx, dword [0x14010a764]
mov rdi, qword [rbp - 0x78]
lea eax, [rbx + 1]
cmp eax, 9
cmova ebx, esi
mov dword [0x14010a764], ebx
mov dword [0x14010a778], ebx
mov ebx, 1
jmp case.0x1400343c9.97
mov rcx, qword [0x140158b08]
call fcn.1400a5c58
mov dword [rbp - 0x68], eax
jmp case.0x1400343c9.97
mov rcx, qword [0x140158b08]
xor edx, edx
lea r8d, [rdx + 0x10]
call fcn.1400a3cac
mov dword [rsp + 0x70], eax
jmp case.0x1400343c9.97
mov r12d, ebx
jmp case.0x1400343c9.97
mov rsi, 0xffffffffffffffff
mov ecx, dword [rsp + 0x68]
lea rax, [rbp - 0x4c]
mov dword [rsp + 0x28], r15d
lea r9, [rbp + 0x70]
lea r8, str.ghxf:i:l:w:z:
mov qword [rsp + 0x20], rax
mov rdx, rdi
call fcn.14005a470
cmp eax, 0xffffffff
jne 0x1400343a0
test r12d, r12d
je 0x1400346ac
lea rcx, str.Command_line_arguments:
call fcn.140041aa0
cmp dword [rsp + 0x68], 1
mov edi, ebx
jle 0x1400346ac
mov rbx, qword [rbp - 0x78]
add rbx, 8
mov rdx, qword [rbx]
lea rcx, [0x1400d10a0]
call fcn.140041aa0
inc edi
lea rbx, [rbx + 8]
cmp edi, dword [rsp + 0x68]
jl 0x140034691
cmp dword [0x1401128c0], 0
je 0x1400346c4
lea rcx, str.AppStore_version_detected
call fcn.140041aa0
xor r15d, r15d
mov r12, 0xffffffffffffffff
lea rsi, [0x14015ad80]
mov r8, r12
mov qword [rsp + 0x20], rsi
lea r9, str._sr3dusb.ini
mov edx, 0x104
lea rcx, [rbp + 0x490]
call fcn.1400034e0
lea rcx, [rbp + 0x490]
mov byte [rbp + 0x593], 0
mov qword [rbp + 0x190], r15
call fcn.140003550
lea rcx, [rsp + 0x74]
mov rdi, rax
call fcn.140003550
mov r8, rax
lea rcx, [rbp + 0x190]
mov rdx, rdi
mov rbx, rax
call fcn.14009b840
test rdi, rdi
je 0x14003473b
mov rcx, rdi
call fcn.14009b5a0
test rbx, rbx
je 0x140034748
mov rcx, rbx
call fcn.14009b5a0
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.140022e20
mov rcx, qword [str.Akeo_Consulting]
lea rdx, str._NULL_
test rcx, rcx
mov rbx, rdx
cmovne rbx, rcx
test rax, rax
cmove rax, rdx
sub rbx, rax
nop word [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + rbx]
sub edx, ecx
jne 0x140034792
inc rax
test ecx, ecx
jne 0x140034780
mov rdi, qword [rbp + 0x190]
test edx, edx
mov r14d, r15d
sete r14b
or r14d, r13d
mov dword [rsp + 0x78], r14d
test rdi, rdi
je 0x140034801
lea rax, [rbp + 0x490]
mov qword [0x1401128c8], rax
mov rax, r12
inc rax
cmp byte [rsi + rax], 0
jne 0x1400347c0
inc rax
mov ebx, 0x104
cmp rax, rbx
mov rdx, rsi
lea rsi, [0x14015a220]
cmovb rbx, rax
mov rcx, rsi
mov r8, rbx
call fcn.140093550
mov rcx, rdi
mov byte [rbx + rsi - 1], 0
call fcn.14009b928
lea rsi, [0x14015ad80]
cmp qword [0x1401128c8], 0
lea rax, str.INI_file
lea rdx, str.registry
cmovne rdx, rax
lea rcx, str.Will_use_settings_from__s
call fcn.140041aa0
lea rcx, str.Locale
call fcn.140027f30
cmp byte [rax], 0
je 0x140034853
mov rcx, rax
call fcn.1400a1b50
mov rdx, rax
mov qword [rbp - 0x60], rax
lea rcx, str.found_locale__s
call fcn.140041aa0
mov rdx, qword [0x1401128c8]
test rdx, rdx
je 0x140034986
mov r13d, 1
lea rcx, str.ShowAdvancedDriveProperties
mov r8d, r13d
mov edi, r15d
call fcn.140020e30
mov rbx, rax
test rax, rax
je 0x14003489a
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.1400a3cac
mov rcx, rbx
mov edi, eax
call fcn.14009b5a0
test edi, edi
jmp 0x1400349b7
mov rcx, qword [rdi]
lea r9, [rbp + 0x5a0]
xor r8d, r8d
mov qword [rsp + 0x20], r15
xor edx, edx
call fcn.1400a73d8
lea rdx, [rbp + 0x5a0]
lea rcx, str._nUsage:__s___x____g____h____f_FILESYSTEM____i_PATH____l_LOCALE____w_TIMEOUT__n
call fcn.1400269d0
lea rcx, str.___x____extra_devs_n
call fcn.1400269d0
lea rcx, str._____List_extra_devices__such_as_USB_HDDs_n
call fcn.1400269d0
lea rcx, str.___g____gui_n
call fcn.1400269d0
lea rcx, str._____Start_in_GUI_mode__disable_the_rufus.com_commandline_hogger__n
call fcn.1400269d0
lea rcx, str.___i_PATH____isoPATH_n
call fcn.1400269d0
lea rcx, str._____Select_the_ISO_image_pointed_by_PATH_to_be_used_on_startup_n
call fcn.1400269d0
lea rcx, str.___l_LOCALE____localeLOCALE_n
call fcn.1400269d0
lea rcx, str._____Select_the_locale_to_be_used_on_startup_n
call fcn.1400269d0
lea rcx, str.___f_FILESYSTEM____filesystemFILESYSTEM_n
call fcn.1400269d0
lea rcx, str._____Preselect_the_file_system_to_be_preferred_when_formatting_n
call fcn.1400269d0
lea rcx, str.___w_TIMEOUT____waitTIMEOUT_n
call fcn.1400269d0
lea rcx, str._____Wait_TIMEOUT_tens_of_seconds_for_the_global_application_mutex_to_be_released._n
call fcn.1400269d0
lea rcx, str._____Used_when_launching_a_newer_version_of_R3dusb_from_a_running_application._n
call fcn.1400269d0
lea rcx, str.___h____help_n
call fcn.1400269d0
lea rcx, str._____This_usage_guide._n
call fcn.1400269d0
jmp 0x1400357c7
lea r9, [rsp + 0x60]
mov dword [rsp + 0x20], 4
mov r8d, 4
lea rdx, str.ShowAdvancedDriveProperties
mov rcx, 0xffffffff80000001
call fcn.140027c60
cmp dword [rsp + 0x60], 0
mov r13d, 1
mov rdx, qword [0x1401128c8]
mov ecx, r15d
setne cl
mov dword [0x14015ae84], ecx
test rdx, rdx
je 0x140034a04
mov r8d, r13d
lea rcx, str.ShowAdvancedFormatOptions
mov edi, r15d
call fcn.140020e30
mov rbx, rax
test rax, rax
je 0x140034a00
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.1400a3cac
mov rcx, rbx
mov edi, eax
call fcn.14009b5a0
test edi, edi
jmp 0x140034a2f
lea r9, [rsp + 0x60]
mov dword [rsp + 0x20], 4
mov r8d, 4
lea rdx, str.ShowAdvancedFormatOptions
mov rcx, 0xffffffff80000001
call fcn.140027c60
cmp dword [rsp + 0x60], 0
mov rdx, qword [0x1401128c8]
mov ecx, r15d
setne cl
mov dword [0x14015ae88], ecx
test rdx, rdx
je 0x140034a7c
mov r8d, r13d
lea rcx, str.PreserveTimestamps
mov edi, r15d
call fcn.140020e30
mov rbx, rax
test rax, rax
je 0x140034a78
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.1400a3cac
mov rcx, rbx
mov edi, eax
call fcn.14009b5a0
test edi, edi
jmp 0x140034aa7
lea r9, [rsp + 0x60]
mov dword [rsp + 0x20], 4
mov r8d, 4
lea rdx, str.PreserveTimestamps
mov rcx, 0xffffffff80000001
call fcn.140027c60
cmp dword [rsp + 0x60], 0
mov rdx, qword [0x1401128c8]
mov ecx, r15d
setne cl
mov dword [0x140112908], ecx
test rdx, rdx
je 0x140034af4
mov r8d, r13d
lea rcx, str.UseProperSizeUnits
mov edi, r15d
call fcn.140020e30
mov rbx, rax
test rax, rax
je 0x140034af0
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.1400a3cac
mov rcx, rbx
mov edi, eax
call fcn.14009b5a0
test edi, edi
jmp 0x140034b1f
lea r9, [rsp + 0x60]
mov dword [rsp + 0x20], 4
mov r8d, 4
lea rdx, str.UseProperSizeUnits
mov rcx, 0xffffffff80000001
call fcn.140027c60
cmp dword [rsp + 0x60], 0
mov ecx, r15d
mov qword [rbp + 0x190], r15
sete cl
mov qword [rbp + 0x180], r15
mov dword [0x140159e70], ecx
mov edx, 6
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov qword [rsp + 0x40], r15
xor r9d, r9d
mov dword [rsp + 0x38], r15d
xor r8d, r8d
mov qword [rsp + 0x30], r15
mov edx, r12d
mov dword [rsp + 0x28], 3
xor ecx, ecx
mov dword [rsp + 0x20], 2
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
xor edx, edx
lea rax, [rbp + 0x180]
lea r9, [0x1400c0ac0]
mov qword [rsp + 0x20], rax
lea rcx, [0x1400d8cb0]
lea r8d, [rdx + 0x14]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov ebx, eax
test eax, eax
je 0x140034bb8
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
call fcn.140041e50
lea rcx, str.Notice:_Disabling_VDS__Could_not_create_VDS_Loader_Instance:__s_
jmp 0x140034bed
mov rcx, qword [rbp + 0x180]
lea r8, [rbp + 0x190]
lea rdx, [0x1400d7364]
mov rax, qword [rcx]
call qword [rax + 0x18]
mov ebx, eax
test eax, eax
je 0x140034bf5
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
call fcn.140041e50
lea rcx, str.Notice:_Disabling_VDS__Could_not_load_VDS_Service:__s_
mov rdx, rax
call fcn.140041aa0
mov rcx, qword [rbp + 0x190]
test rcx, rcx
je 0x140034c07
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x180]
test rcx, rcx
je 0x140034c19
mov rax, qword [rcx]
call qword [rax + 0x10]
test ebx, ebx
je 0x140034c2f
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [0x140111620], 0xc003001f
mov rdx, qword [0x1401128c8]
test ebx, ebx
mov eax, r15d
sete al
mov dword [0x140109ed8], eax
test rdx, rdx
je 0x140034c7e
mov r8d, r13d
lea rcx, str.UseVds
mov edi, r15d
call fcn.140020e30
mov rbx, rax
test rax, rax
je 0x140034c7a
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.1400a3cac
mov rcx, rbx
mov edi, eax
call fcn.14009b5a0
test edi, edi
jmp 0x140034ca9
lea r9, [rsp + 0x60]
mov dword [rsp + 0x20], 4
mov r8d, 4
lea rdx, str.UseVds
mov rcx, 0xffffffff80000001
call fcn.140027c60
cmp dword [rsp + 0x60], 0
mov ecx, r15d
setne cl
test ecx, ecx
je 0x140034cbf
cmp dword [0x140109ed8], 0
mov eax, r13d
jne 0x140034cc2
mov eax, r15d
mov rdx, qword [0x1401128c8]
mov dword [0x1401128e4], eax
test rdx, rdx
je 0x140034d09
mov r8d, r13d
lea rcx, str.EnableUsbDebug
mov edi, r15d
call fcn.140020e30
mov rbx, rax
test rax, rax
je 0x140034d05
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.1400a3cac
mov rcx, rbx
mov edi, eax
call fcn.14009b5a0
test edi, edi
jmp 0x140034d34
lea r9, [rsp + 0x60]
mov dword [rsp + 0x20], 4
mov r8d, 4
lea rdx, str.EnableUsbDebug
mov rcx, 0xffffffff80000001
call fcn.140027c60
cmp dword [rsp + 0x60], 0
mov rdx, qword [0x1401128c8]
mov eax, r15d
setne al
mov dword [0x14015a340], eax
xor eax, 1
lea eax, [rax*2 + 1]
mov dword [0x140109f2c], eax
test rdx, rdx
je 0x140034d91
mov r8d, r13d
lea rcx, str.DisableRufusMBR
mov edi, r15d
call fcn.140020e30
mov rbx, rax
test rax, rax
je 0x140034d8d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.1400a3cac
mov rcx, rbx
mov edi, eax
call fcn.14009b5a0
test edi, edi
jmp 0x140034dbc
lea r9, [rsp + 0x60]
mov dword [rsp + 0x20], 4
mov r8d, 4
lea rdx, str.DisableRufusMBR
mov rcx, 0xffffffff80000001
call fcn.140027c60
cmp dword [rsp + 0x60], 0
mov rdx, qword [0x1401128c8]
mov ecx, r15d
sete cl
mov dword [0x140109ee4], ecx
test rdx, rdx
je 0x140034e09
mov r8d, r13d
lea rcx, str.DisableFakeDrivesCheck
mov edi, r15d
call fcn.140020e30
mov rbx, rax
test rax, rax
je 0x140034e05
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.1400a3cac
mov rcx, rbx
mov edi, eax
call fcn.14009b5a0
test edi, edi
jmp 0x140034e34
lea r9, [rsp + 0x60]
mov dword [rsp + 0x20], 4
mov r8d, 4
lea rdx, str.DisableFakeDrivesCheck
mov rcx, 0xffffffff80000001
call fcn.140027c60
cmp dword [rsp + 0x60], 0
mov rdx, qword [0x1401128c8]
mov ecx, r15d
sete cl
mov dword [0x14015a570], ecx
test rdx, rdx
je 0x140034e81
mov r8d, r13d
lea rcx, str.EnableWindowsDualUefiBiosMode
mov edi, r15d
call fcn.140020e30
mov rbx, rax
test rax, rax
je 0x140034e7d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.1400a3cac
mov rcx, rbx
mov edi, eax
call fcn.14009b5a0
test edi, edi
jmp 0x140034eac
lea r9, [rsp + 0x60]
mov dword [rsp + 0x20], 4
mov r8d, 4
lea rdx, str.EnableWindowsDualUefiBiosMode
mov rcx, 0xffffffff80000001
call fcn.140027c60
cmp dword [rsp + 0x60], 0
mov rdx, qword [0x1401128c8]
mov ecx, r15d
setne cl
mov dword [0x14015a1f8], ecx
test rdx, rdx
je 0x140034ef9
mov r8d, r13d
lea rcx, str.ForceLargeFat32Formatting
mov edi, r15d
call fcn.140020e30
mov rbx, rax
test rax, rax
je 0x140034ef5
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.1400a3cac
mov rcx, rbx
mov edi, eax
call fcn.14009b5a0
test edi, edi
jmp 0x140034f24
lea r9, [rsp + 0x60]
mov dword [rsp + 0x20], 4
mov r8d, 4
lea rdx, str.ForceLargeFat32Formatting
mov rcx, 0xffffffff80000001
call fcn.140027c60
cmp dword [rsp + 0x60], 0
mov rdx, qword [0x1401128c8]
mov ecx, r15d
setne cl
mov dword [0x14015a324], ecx
test rdx, rdx
je 0x140034f71
mov r8d, r13d
lea rcx, str.EnableVmdkDetection
mov edi, r15d
call fcn.140020e30
mov rbx, rax
test rax, rax
je 0x140034f6d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.1400a3cac
mov rcx, rbx
mov edi, eax
call fcn.14009b5a0
test edi, edi
jmp 0x140034f9c
lea r9, [rsp + 0x60]
mov dword [rsp + 0x20], 4
mov r8d, 4
lea rdx, str.EnableVmdkDetection
mov rcx, 0xffffffff80000001
call fcn.140027c60
cmp dword [rsp + 0x60], 0
mov rdx, qword [0x1401128c8]
mov ecx, r15d
setne cl
mov dword [0x14015ad50], ecx
test rdx, rdx
je 0x140034fe9
mov r8d, r13d
lea rcx, str.EnableFileIndexing
mov edi, r15d
call fcn.140020e30
mov rbx, rax
test rax, rax
je 0x140034fe5
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.1400a3cac
mov rcx, rbx
mov edi, eax
call fcn.14009b5a0
test edi, edi
jmp 0x140035014
lea r9, [rsp + 0x60]
mov dword [rsp + 0x20], 4
mov r8d, 4
lea rdx, str.EnableFileIndexing
mov rcx, 0xffffffff80000001
call fcn.140027c60
cmp dword [rsp + 0x60], 0
mov rdx, qword [0x1401128c8]
mov ecx, r15d
setne cl
mov dword [0x14015a328], ecx
test rdx, rdx
je 0x140035061
mov r8d, r13d
lea rcx, str.DisableVHDs
mov edi, r15d
call fcn.140020e30
mov rbx, rax
test rax, rax
je 0x14003505d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.1400a3cac
mov rcx, rbx
mov edi, eax
call fcn.14009b5a0
test edi, edi
jmp 0x14003508c
lea r9, [rsp + 0x60]
mov dword [rsp + 0x20], 4
mov r8d, 4
lea rdx, str.DisableVHDs
mov rcx, 0xffffffff80000001
call fcn.140027c60
cmp dword [rsp + 0x60], 0
mov rdx, qword [0x1401128c8]
mov ecx, r15d
sete cl
mov dword [0x140109ed4], ecx
test rdx, rdx
je 0x1400350d9
mov r8d, r13d
lea rcx, str.EnableExtraHashes
mov edi, r15d
call fcn.140020e30
mov rbx, rax
test rax, rax
je 0x1400350d5
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.1400a3cac
mov rcx, rbx
mov edi, eax
call fcn.14009b5a0
test edi, edi
jmp 0x140035104
lea r9, [rsp + 0x60]
mov dword [rsp + 0x20], 4
mov r8d, 4
lea rdx, str.EnableExtraHashes
mov rcx, 0xffffffff80000001
call fcn.140027c60
cmp dword [rsp + 0x60], 0
mov rdx, qword [0x1401128c8]
mov ecx, r15d
setne cl
mov dword [0x140112960], ecx
test rdx, rdx
je 0x140035151
mov r8d, r13d
lea rcx, str.ExpertMode
mov edi, r15d
call fcn.140020e30
mov rbx, rax
test rax, rax
je 0x14003514d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.1400a3cac
mov rcx, rbx
mov edi, eax
call fcn.14009b5a0
test edi, edi
jmp 0x14003517c
lea r9, [rsp + 0x60]
mov dword [rsp + 0x20], 4
mov r8d, 4
lea rdx, str.ExpertMode
mov rcx, 0xffffffff80000001
call fcn.140027c60
cmp dword [rsp + 0x60], 0
mov rdx, qword [0x1401128c8]
mov ecx, r15d
setne cl
mov dword [0x140111a90], ecx
test rdx, rdx
je 0x1400351c9
mov r8d, r13d
lea rcx, str.IgnoreBootMarker
mov edi, r15d
call fcn.140020e30
mov rbx, rax
test rax, rax
je 0x1400351c5
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.1400a3cac
mov rcx, rbx
mov edi, eax
call fcn.14009b5a0
test edi, edi
jmp 0x1400351f4
lea r9, [rsp + 0x60]
mov dword [rsp + 0x20], 4
mov r8d, 4
lea rdx, str.IgnoreBootMarker
mov rcx, 0xffffffff80000001
call fcn.140027c60
cmp dword [rsp + 0x60], 0
mov rdx, qword [0x1401128c8]
mov ecx, r15d
setne cl
mov dword [0x140111a98], ecx
test rdx, rdx
je 0x140035241
mov r8d, r13d
lea rcx, str.PersistentLog
mov edi, r15d
call fcn.140020e30
mov rbx, rax
test rax, rax
je 0x14003523d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.1400a3cac
mov rcx, rbx
mov edi, eax
call fcn.14009b5a0
test edi, edi
jmp 0x14003526c
lea r9, [rsp + 0x60]
mov dword [rsp + 0x20], 4
mov r8d, 4
lea rdx, str.PersistentLog
mov rcx, 0xffffffff80000001
call fcn.140027c60
cmp dword [rsp + 0x60], 0
mov ecx, r15d
setne cl
mov dword [0x140111a84], ecx
lea rcx, str.PreferredSaveImageType
call fcn.140027f30
mov rdx, qword [0x1401128c8]
mov qword [0x140111ab8], rax
test rdx, rdx
je 0x1400352ca
mov r8d, r13d
lea rcx, str.WindowsUserExperienceOptions
mov ebx, r15d
call fcn.140020e30
mov rdi, rax
test rax, rax
je 0x1400352f4
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.1400a3cac
mov rcx, rdi
mov ebx, eax
call fcn.14009b5a0
jmp 0x1400352f4
lea r9, [rsp + 0x60]
mov dword [rsp + 0x20], 4
mov r8d, 4
lea rdx, str.WindowsUserExperienceOptions
mov rcx, 0xffffffff80000001
call fcn.140027c60
mov ebx, dword [rsp + 0x60]
mov ecx, ebx
shr ecx, 0x10
test ecx, ecx
je 0x140035311
mov eax, ecx
and ecx, ebx
not eax
and eax, dword [0x140109f20]
or eax, ecx
mov dword [0x140109f20], eax
mov rdx, qword [0x1401128c8]
test rdx, rdx
je 0x140035350
mov r8d, r13d
lea rcx, str.DefaultThreadPriority
mov edi, r15d
call fcn.140020e30
mov rbx, rax
test rax, rax
je 0x14003537a
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.1400a3cac
mov rcx, rbx
mov edi, eax
call fcn.14009b5a0
jmp 0x14003537a
lea r9, [rsp + 0x60]
mov dword [rsp + 0x20], 4
mov r8d, 4
lea rdx, str.DefaultThreadPriority
mov rcx, 0xffffffff80000001
call fcn.140027c60
mov edi, dword [rsp + 0x60]
lea eax, [rdi + 1]
xor ecx, ecx
mov dword [0x14010719c], eax
call qword [sym.imp.USER32.dll_GetDC]
mov rcx, rax
mov edx, 0x58
mov rbx, rax
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
lea rcx, [rbx - 1]
movd xmm0, eax
cvtdq2ps xmm0, xmm0
divss xmm0, dword [0x1400f64f8]
movss dword [0x14010750c], xmm0
cmp rcx, 0xfffffffffffffffd
ja 0x1400353c8
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
xor ecx, ecx
call fcn.14001ac70
lea rax, str.rufus.loc
mov r8, r12
mov qword [rsp + 0x28], rax
lea r9, [0x1400e4578]
mov edx, 0x104
mov qword [rsp + 0x20], rsi
lea rcx, [rbp + 0x270]
call fcn.1400034e0
lea rcx, [rbp + 0x270]
mov byte [rbp + 0x373], 0
call fcn.140003550
mov rdi, rax
cmp word [rax], 0x22
jne 0x140035458
mov rax, r12
nop word [rax + rax]
cmp word [rdi + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x140035420
cmp word [rdi + rax*2 - 2], 0x22
jne 0x140035458
mov rax, r12
nop word [rax + rax]
cmp word [rdi + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x140035440
mov word [rdi + rax*2 - 2], r15w
lea rcx, [rdi + 2]
jmp 0x14003545b
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
mov ebx, eax
call fcn.14009b5a0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp esi, 0xffffffff
jne 0x140035c5a
lea rcx, str.loc_file_not_found_in_current_directory___embedded_one_will_be_used
call fcn.140041aa0
mov rbx, qword [0x14015a338]
mov edx, 0x1f4
mov rcx, rbx
mov r8d, 0xa
mov r13, r15
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdi, rax
test rax, rax
jne 0x1400354d8
call fcn.140041e50
mov r8, rax
lea rdx, str.embedded.loc
lea rcx, str.Could_not_locate_resource__s:__s
call fcn.140041aa0
mov r15d, dword [rsp + 0x60]
jmp 0x140035529
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
test rax, rax
jne 0x14003550e
call fcn.140041e50
mov r8, rax
lea rdx, str.embedded.loc
lea rcx, str.Could_not_load_resource__s:__s
call fcn.140041aa0
mov r15d, dword [rsp + 0x60]
jmp 0x140035529
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, rsi
mov r15d, eax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r13, rax
lea rcx, [0x140159fc0]
call fcn.140003550
lea rcx, [0x1400d97a4]
mov r14, rax
call fcn.140003550
mov edx, 2
mov ecx, 0x104
mov rsi, rax
call fcn.1400966e0
mov r9, rax
xor r8d, r8d
mov rdx, rsi
mov rcx, r14
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
test edi, edi
je 0x1400355c0
xor eax, eax
mov r9, 0xffffffffffffffff
mov qword [rsp + 0x38], rax
mov r8, rbx
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0x270]
mov dword [rsp + 0x28], 0x104
mov ecx, 0xfde9
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test eax, eax
jne 0x1400355c0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
test rbx, rbx
je 0x1400355cd
mov rcx, rbx
call fcn.14009b5a0
test rsi, rsi
je 0x1400355da
mov rcx, rsi
call fcn.14009b5a0
test r14, r14
je 0x1400355e7
mov rcx, r14
call fcn.14009b5a0
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
je 0x14003578d
cmp byte [rbp + 0x270], 0
je 0x14003578d
lea rcx, [rbp + 0x270]
call fcn.140003550
mov rdi, rax
mov r12d, 1
xor eax, eax
xor r9d, r9d
mov qword [rsp + 0x30], rax
mov r8d, r12d
mov dword [rsp + 0x28], 0x80
mov edx, 0xc0000000
mov rcx, rdi
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test rdi, rdi
je 0x14003565d
mov rcx, rdi
call fcn.14009b5a0
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp rbx, 0xffffffffffffffff
je 0x140035737
lea r9, [rbp - 0x48]
mov r8d, r15d
mov rdx, r13
mov rcx, rbx
call fcn.140042b10
test eax, eax
je 0x140035737
lea rdx, [rbp + 0x270]
lea rcx, str.localization:_extracted_data_to__s
call fcn.140041aa0
test rbx, rbx
je 0x1400356aa
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r14d, dword [rsp + 0x78]
lea rsi, [0x140158be0]
mov r13d, 1
xor r15d, r15d
lea r12, [r13 - 2]
lea rcx, [rbp + 0x270]
call fcn.140020290
test eax, eax
je 0x14003570a
mov rax, qword [rbp - 0x60]
test rax, rax
jne 0x140035d2c
mov rax, qword [0x140111650]
lea r8, [0x140111648]
cmp rax, r8
jne 0x140035cd0
lea rcx, str.localization:_the_locale_list_is_empty__n
call fcn.140041aa0
mov qword [0x140112928], r15
lea rcx, str.FATAL:_Could_not_access_locale_
call fcn.140041aa0
mov r9d, 0x1010
lea r8, str.Fatal_error
lea rdx, str.The_locale_data_is_missing_or_invalid._This_application_will_now_exit.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x1400357c0
call fcn.140041e50
mov r8, rax
lea rdx, [rbp + 0x270]
lea rcx, str.FATAL:_Unable_to_extract_loc_file__s:__s
call fcn.140041aa0
lea rax, [rbx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140035765
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r9d, 0x1010
lea r8, str.Fatal_error
lea rdx, str.Unable_to_extract_localization_file._This_application_will_now_exit.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor r15d, r15d
lea r14, [0x140000000]
jmp 0x1400357cd
call fcn.140041e50
mov rdx, rax
lea rcx, str.FATAL:_Unable_to_create_temp_loc_file:__s
call fcn.140041aa0
mov r9d, 0x1010
lea r8, str.Fatal_error
lea rdx, str.Unable_to_create_temporary_localization_file._This_application_will_now_exit.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor r15d, r15d
lea r14, [0x140000000]
mov r12d, 1
lea rcx, [0x14015ad80]
call fcn.140003550
mov rcx, rax
mov rbx, rax
call fcn.1400a4200
test rbx, rbx
je 0x1400357f1
mov rcx, rbx
call fcn.14009b5a0
mov rbx, qword [rbp + 0x18]
test rbx, rbx
je 0x140035849
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
cmp rbx, 0xffffffffffffffff
je 0x140035812
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.rufus.com
mov ebx, r15d
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x140035849
cmp ebx, 0xa
jg 0x140035849
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.rufus.com
inc ebx
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x140035826
mov rcx, qword [0x140111a70]
test rcx, rcx
je 0x14003585e
mov edx, r12d
call qword [sym.imp.KERNEL32.dll_TerminateThread]
cmp dword [rbp - 0x44], 0
jne 0x1400358c3
cmp byte [rbp + 0x270], 0
je 0x1400358c3
lea rcx, [rbp + 0x270]
call fcn.140003550
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test rbx, rbx
je 0x14003589c
mov rcx, rbx
call fcn.14009b5a0
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
jne 0x1400358c3
call fcn.140041e50
mov r8, rax
lea rdx, [rbp + 0x270]
lea rcx, str.Could_not_delete__s:__s
call fcn.140041aa0
lea rbx, [0x140156668]
mov edi, 0x80
nop
mov rcx, qword [rbx - 0x18]
test rcx, rcx
je 0x1400358f6
call qword [sym.imp.USER32.dll_DestroyWindow]
mov rcx, qword [rbx]
call fcn.14009b5a0
mov qword [rbx], r15
mov qword [rbx - 8], r15
mov qword [rbx - 0x18], r15
mov qword [rbx - 0x10], r15
add rbx, 0x20
sub rdi, 1
jne 0x1400358d0
mov rcx, qword [0x140156528]
call qword [sym.imp.USER32.dll_UnhookWinEvent]
cmp dword [0x14014333c], edi
mov qword [0x140156528], r15
je 0x1400359f9
call fcn.14001abb0
mov rcx, qword [0x140111a60]
lea rax, str.embedded.loc
cmp rcx, rax
je 0x140035944
call fcn.14009b5a0
mov qword [0x140111a60], r15
call fcn.14001aad0
mov ebx, 8
nop
mov rcx, qword [rbx + r14 + 0x108490]
call fcn.14009b5a0
mov rcx, qword [rbx + r14 + 0x109110]
mov qword [rbx + r14 + 0x108490], r15
call fcn.14009b5a0
mov qword [rbx + r14 + 0x109110], r15
add rbx, 8
cmp rbx, 0xc80
jb 0x140035950
mov rcx, qword [0x140143348]
test rcx, rcx
je 0x1400359f9
mov r8d, dword [0x140143350]
mov rdi, r15
lea eax, [r8 + 1]
test eax, eax
je 0x1400359e2
mov rbx, r15
cmp dword [rcx + rbx], 0
je 0x1400359d2
mov rcx, qword [rcx + rbx + 8]
call fcn.14009b5a0
mov rax, qword [0x140143348]
mov qword [rax + rbx + 8], r15
mov r8d, dword [0x140143350]
mov rcx, qword [0x140143348]
inc rdi
lea edx, [r8 + 1]
add rbx, 0x18
cmp rdi, rdx
jb 0x1400359a8
mov qword [0x140143350], 0
call fcn.14009b5a0
mov qword [0x140143348], r15
mov rcx, qword [0x1401128d8]
call fcn.14009b5a0
mov rcx, qword [0x1401128f8]
mov qword [0x1401128d8], r15
call fcn.14009b5a0
mov rcx, qword [rbp - 0x60]
mov qword [0x1401128f8], r15
call fcn.14009b5a0
mov rcx, qword [0x140112940]
call fcn.14009b5a0
mov rcx, qword [0x140112948]
mov qword [0x140112940], r15
call fcn.14009b5a0
mov rcx, qword [0x140111630]
mov qword [0x140112948], r15
call fcn.14009b5a0
mov rcx, qword [0x140112958]
mov qword [0x140111630], r15
call fcn.14009b5a0
mov rcx, qword [0x140111a68]
mov qword [0x140112958], r15
call fcn.14009b5a0
mov rcx, qword [0x1401429d8]
mov qword [0x140111a68], r15
call fcn.14009b5a0
mov rsi, qword [rbp - 0x78]
mov qword [0x1401429d8], r15
test rsi, rsi
je 0x140035acf
cmp dword [rsp + 0x68], 0
mov edi, r15d
jle 0x140035ac7
mov rbx, rsi
mov rcx, qword [rbx]
call fcn.14009b5a0
mov qword [rbx], r15
lea rbx, [rbx + 8]
inc edi
cmp edi, dword [rsp + 0x68]
jl 0x140035ab0
mov rcx, rsi
call fcn.14009b5a0
cmp dword [rbp - 0x40], 0
je 0x140035ae2
mov ecx, r12d
mov dword [rsp + 0x20], r15d
call fcn.140041230
cmp dword [rbp - 0x80], 0
jne 0x140035b71
xor r9d, r9d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
lea rcx, str..MountPointManager
xor edx, edx
mov dword [rsp + 0x60], r15d
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140035b65
mov qword [rsp + 0x38], r15
lea rax, [rbp - 0x38]
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x60]
mov dword [rsp + 0x28], r15d
mov r9d, 4
mov edx, 0x6dc040
mov qword [rsp + 0x20], r15
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x140035b71
lea rcx, str.Failed_to_restore_AutoMount_to_disabled
call fcn.140041aa0
cmp qword [0x140142a80], 0
je 0x140035b8e
lea rdx, [0x140158be0]
lea rcx, [0x1400d10a0]
call fcn.140041aa0
cmp dword [rbp - 0x3c], 0
mov qword [0x140142a80], r15
je 0x140035bca
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov dword [rsp + 0x30], 3
xor r9d, r9d
mov rcx, rax
mov dword [rsp + 0x28], r15d
xor r8d, r8d
mov dword [rsp + 0x20], r15d
xor edx, edx
call qword [sym.imp.USER32.dll_SetWindowPos]
call qword [sym.imp.KERNEL32.dll_FreeConsole]
call qword [sym.imp.ole32.dll_CoUninitialize]
movzx eax, word [0x1401128d4]
test ax, ax
je 0x140035c08
mov ebx, 0xffff
add ax, bx
movzx ecx, ax
mov word [0x1401128d4], ax
mov rcx, qword [r14 + rcx*8 + 0x15a360]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
movzx eax, word [0x1401128d4]
test ax, ax
jne 0x140035be1
mov rcx, qword [rbp - 0x30]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140035c1c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str._R3dusb_exit__n
call fcn.140041aa0
xor eax, eax
mov rcx, qword [rbp + 0x6a0]
xor rcx, rsp
call fcn.140092060
lea r11, [rsp + 0x7b0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov rax, qword [0x140142a80]
lea rsi, [0x140158be0]
mov edi, 0xffc
mov dword [rbp - 0x44], r13d
sub rdi, rax
lea r9, str.Using_external_loc_file__s
mov r8, r12
mov rdx, rdi
lea rbx, [rax + rsi]
lea rax, [rbp + 0x270]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.1400034e0
mov rax, r12
mov byte [rbx + rdi - 1], 0
inc rax
cmp byte [rsi + rax], 0
jne 0x140035ca1
mov word [rax + rsi], 0xa0d
add rax, 2
mov qword [0x140142a80], rax
cmp rax, 0x1000
jae 0x140037d0c
mov byte [rax + rsi], 0
jmp 0x1400356c3
mov r9d, dword [rsp + 0x6c]
lea rdi, [rax - 0x28]
lea rax, [rdi + 0x28]
mov rdx, rdi
cmp rax, r8
je 0x140035d14
movzx eax, byte [rdx + 1]
mov rcx, r15
test al, al
je 0x140035d07
mov ebx, eax
mov rax, qword [rdx + 0x10]
cmp dword [rax], r9d
je 0x140035d3a
inc rcx
add rax, 4
cmp rcx, rbx
jl 0x140035cf6
mov rax, qword [rdx + 0x30]
lea rdx, [rax - 0x28]
cmp rax, r8
jne 0x140035ce5
mov r8, qword [rdi + 0x18]
lea rcx, str.localization:_could_not_find_locale_for_LCID:_0x_04X._Will_default_to__s_n
mov edx, r9d
call fcn.140041aa0
mov rdx, rdi
jmp 0x140035d3a
mov edx, r13d
mov rcx, rax
call fcn.14001ba50
mov rdx, rax
mov qword [0x140112928], rdx
test rdx, rdx
je 0x14003570a
mov rcx, rdx
call fcn.14001bb60
lea rcx, [0x1401429e0]
mov word [0x140109ee0], ax
call fcn.14003f5f0
mov eax, dword [0x1401429e0]
cmp eax, 0x51
jbe 0x140035d82
mov ecx, dword [rsp + 0x70]
test ecx, ecx
cmovne eax, ecx
mov dword [0x1401429e0], eax
cmp eax, 0x51
jae 0x140035e5c
mov rdx, qword [0x140112928]
lea rcx, [rbp + 0x270]
call fcn.1400207b0
mov rax, qword [0x140112928]
mov ecx, 0xcdd
movzx edi, word [0x140109ee0]
mov esi, dword [rax + 4]
and esi, 1
mov dword [0x1401128e0], esi
call fcn.14001b320
cmp dword [0x1401429e0], 0x51
mov rbx, rax
mov eax, 0x16
mov r8d, 0x12
cmove r8d, eax
mov ecx, 0xcde
xor eax, eax
cmp dword [0x1401429e0], 0x51
mov edx, eax
sete dl
add edx, 2
call fcn.14001b320
mov rcx, rax
call fcn.140003550
mov rcx, rbx
mov r15, rax
call fcn.140003550
mov r9d, 0x1010
mov word [rsp + 0x20], di
mov ecx, 0x181010
test esi, esi
mov r8, rax
mov rdx, r15
cmovne r9d, ecx
mov rbx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxExW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test r15, r15
je 0x140035e42
mov rcx, r15
call fcn.14009b5a0
test rbx, rbx
je 0x140035e4f
mov rcx, rbx
call fcn.14009b5a0
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1400357bd
lea r9, [rsp + 0x60]
mov dword [rsp + 0x6c], r15d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystemEnableLUA
mov qword [rbp + 0x190], r12
mov rcx, 0xffffffff80000002
mov dword [rbp + 0x180], 0
mov word [rbp + 0x184], 0x500
call fcn.14003e990
cmp dword [rsp + 0x60], 1
jne 0x140035f38
lea rcx, str.Note:_UAC_is_active
call fcn.140041aa0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp + 0x190]
mov edx, 8
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x140035ee2
call fcn.140041e50
mov rdx, rax
lea rcx, str.Could_not_get_current_process_token:__s
call fcn.140041aa0
jmp 0x140035fbc
mov rcx, qword [rbp + 0x190]
lea rax, [rbp - 0x38]
mov r9d, 4
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x70]
lea edx, [r9 + 0x10]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x140035f24
call fcn.140041e50
mov rdx, rax
lea rcx, str.Could_not_get_token_information:__s
call fcn.140041aa0
jmp 0x140035fbc
cmp dword [rsp + 0x70], 0
mov eax, r15d
setne al
mov dword [rsp + 0x6c], eax
jmp 0x140035fbc
lea rcx, str.Note:_UAC_is_either_disabled_or_not_available
call fcn.140041aa0
lea rax, [rbp + 0x1a0]
mov r9d, 0x220
mov qword [rsp + 0x50], rax
lea rcx, [rbp + 0x180]
mov dword [rsp + 0x48], r15d
mov r8d, 0x20
mov dword [rsp + 0x40], r15d
mov dl, 2
mov dword [rsp + 0x38], r15d
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x140035fbc
mov rdx, qword [rbp + 0x1a0]
lea r8, [rsp + 0x6c]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov ecx, dword [rsp + 0x6c]
test eax, eax
cmove ecx, r15d
mov dword [rsp + 0x6c], ecx
mov rcx, qword [rbp + 0x1a0]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov rcx, qword [rbp + 0x190]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140035fd3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x6c], 0
jne 0x14003602f
lea rcx, str.FATAL:_No_administrative_privileges_
call fcn.140041aa0
mov rdx, qword [0x140112928]
lea rcx, [rbp + 0x270]
call fcn.1400207b0
mov rax, qword [0x140112928]
mov ecx, 0xcd8
movzx edi, word [0x140109ee0]
mov esi, dword [rax + 4]
and esi, 1
mov dword [0x1401128e0], esi
call fcn.14001b320
mov ecx, 0xcd9
mov rbx, rax
call fcn.14001b320
jmp 0x140035df3
mov rcx, qword [rbp + 0x1b0]
test rcx, rcx
je 0x14003607a
mov rax, r12
nop
inc rax
cmp byte [rcx + rax], 0
jne 0x140036040
cmp rax, 2
jne 0x14003607a
cmp byte [rcx], 0x2f
jne 0x14003607a
cmp byte [rcx + 1], 0x57
jne 0x14003607a
lea r8, str.Global_R3dusb
mov edx, r13d
xor ecx, ecx
mov ebx, 0x96
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov rdi, rax
mov qword [rbp - 0x30], rax
jmp 0x1400360a0
lea r8, str.Global_R3dusb
mov edx, r13d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ebx, dword [rbp - 0x68]
mov rdi, rax
mov qword [rbp - 0x30], rax
test ebx, ebx
jle 0x1400360e9
nop word [rax + rax]
test rdi, rdi
je 0x140037cc3
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1400360f2
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r8, str.Global_R3dusb
mov edx, r13d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
dec ebx
mov qword [rbp - 0x30], rax
mov rdi, rax
test ebx, ebx
jg 0x1400360a0
test rdi, rdi
je 0x140037cc3
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x140037cc3
mov r13, qword [rbp + 0x10]
mov edx, 6
xor ecx, ecx
mov qword [0x14015a338], r13
call qword [sym.imp.ole32.dll_CoInitializeEx]
lea rcx, str.Riched20
call fcn.140009360
test rax, rax
jne 0x140036140
call fcn.140041e50
mov rdx, rax
lea rcx, str.Could_not_load_RichEdit_library___some_dialogs_may_not_display:__s
call fcn.140041aa0
call fcn.140026750
xor ecx, ecx
mov dword [rsp + 0x20], 0x9e
call fcn.140041230
xor r9d, r9d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
lea rcx, str..MountPointManager
xor edx, edx
mov dword [rbp - 0x40], eax
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400364ad
mov qword [rsp + 0x38], r15
lea rax, [rbp - 0x38]
mov qword [rsp + 0x30], rax
xor r9d, r9d
lea rax, [rbp - 0x80]
mov dword [rsp + 0x28], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0x6d003c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x1400364ad
cmp dword [rbp - 0x80], 0
jne 0x140036201
lea rcx, str.AutoMount_was_detected_as_disabled___temporarily_re_enabling_it
call fcn.140041aa0
mov ecx, 1
call fcn.140003ac0
test eax, eax
jne 0x140036201
lea rcx, str.Failed_to_enable_AutoMount
call fcn.140041aa0
mov r11d, 1
xor eax, eax
mov dword [rbp + 0x170], r15d
xor ecx, ecx
mov r8d, r15d
cpuid
mov dword [rbp + 0x174], ebx
mov r10d, r15d
mov dword [rbp + 0x178], ecx
mov r9d, eax
mov dword [rbp + 0x17c], edx
cmp eax, 1
jb 0x140036250
mov eax, r11d
xor ecx, ecx
cpuid
mov r8d, ecx
mov dword [rbp + 0x170], eax
mov dword [rbp + 0x174], ebx
mov dword [rbp + 0x17c], edx
cmp r9d, 7
jb 0x140036274
mov eax, 7
xor ecx, ecx
cpuid
mov r10d, ebx
mov dword [rbp + 0x170], eax
mov dword [rbp + 0x178], ecx
mov dword [rbp + 0x17c], edx
bt r8d, 0x13
setb cl
bt r8d, 9
setb al
test al, cl
je 0x140036292
mov eax, r11d
bt r10d, 0x1d
jb 0x140036295
mov eax, r15d
mov dword [0x140111610], eax
xor ecx, ecx
xor eax, eax
mov dword [rbp + 0x170], r15d
cpuid
mov dword [rbp + 0x174], ebx
mov r8d, r15d
mov dword [rbp + 0x178], ecx
mov r10d, r15d
mov dword [rbp + 0x17c], edx
mov r9d, eax
cmp eax, 1
jb 0x1400362e4
mov eax, r11d
xor ecx, ecx
cpuid
mov r8d, ecx
mov dword [rbp + 0x170], eax
mov dword [rbp + 0x174], ebx
mov dword [rbp + 0x17c], edx
cmp r9d, 7
jb 0x140036308
mov eax, 7
xor ecx, ecx
cpuid
mov r10d, ebx
mov dword [rbp + 0x170], eax
mov dword [rbp + 0x178], ecx
mov dword [rbp + 0x17c], edx
bt r8d, 0x13
setb cl
bt r8d, 9
setb al
test al, cl
je 0x140036326
mov eax, r11d
bt r10d, 0x1d
jb 0x140036329
mov eax, r15d
mov dword [0x140111614], eax
lea r9, str._sdismFfuProvider.dll
lea rax, [0x14015a0e0]
mov r8, r12
mov edx, 0x104
mov qword [rsp + 0x20], rax
lea rcx, [rbp + 0x380]
call fcn.1400034e0
lea rcx, [rbp + 0x380]
mov byte [rbp + 0x483], 0
call fcn.140003550
xor edx, edx
mov rcx, rax
mov rbx, rax
call fcn.1400a7060
mov edi, eax
test rbx, rbx
je 0x140036385
mov rcx, rbx
call fcn.14009b5a0
mov rax, qword [0x140142a80]
lea r9, str.Localization_set_to__s
test edi, edi
mov ecx, r15d
mov edi, 0xffc
mov r8, r12
sete cl
sub rdi, rax
lea rbx, [rax + rsi]
mov dword [0x140112904], ecx
mov rax, qword [0x140112928]
mov rdx, rdi
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x20], rcx
mov rcx, rbx
call fcn.1400034e0
mov rax, r12
mov byte [rbx + rdi - 1], 0
lea rdx, [0x140158be0]
nop word [rax + rax]
inc rax
cmp byte [rdx + rax], 0
jne 0x1400363e0
mov word [rax + rdx], 0xa0d
add rax, 2
mov qword [0x140142a80], rax
cmp rax, 0x1000
jae 0x140037d0c
mov rsi, qword [rbp - 0x58]
mov ebx, 0x181034
mov r12d, esi
mov r15d, 0x12
nop dword [rax + rax]
mov byte [rax + rdx], 0
xor edi, edi
mov rax, qword [0x140112928]
mov byte [0x140109ee2], 1
mov dword [0x140154ebc], edi
mov ecx, dword [rax + 4]
and ecx, 1
mov byte [0x14015a580], 0
mov dword [0x1401128e0], ecx
mov rcx, qword [0x140112958]
call fcn.14009b5a0
cmp dword [0x1401128e0], edi
mov ecx, edi
mov qword [0x140112958], rdi
setne cl
call qword [sym.imp.USER32.dll_SetProcessDefaultLayout]
mov rdx, qword [0x140112928]
lea rcx, [rbp + 0x270]
call fcn.1400207b0
test eax, eax
je 0x1400364ff
cmp qword [0x1401128c8], rdi
mov rax, qword [0x140112928]
mov r9, qword [rax + 0x18]
je 0x1400364c8
mov rdx, r9
lea rcx, str.Locale
call fcn.140020f90
jmp 0x1400364ff
lea rcx, str.Could_not_get_AutoMount_status
call fcn.140041aa0
mov r11d, 1
mov dword [rbp - 0x80], r11d
jmp 0x140036207
test r9, r9
jne 0x1400364d2
mov rax, rdi
jmp 0x1400364e9
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [r9 + rax], dil
jne 0x1400364e0
mov r8d, 1
mov dword [rsp + 0x20], eax
lea rdx, str.Locale
call fcn.14001c310
test r14d, r14d
jne 0x1400365a7
cmp dword [0x1401128e0], r14d
mov esi, 0x1034
movzx edi, word [0x140109ee0]
mov ecx, 0xcdf
cmovne esi, ebx
call fcn.14001b320
mov ecx, 0xce0
mov rbx, rax
call fcn.14001b320
mov rcx, rax
call fcn.140003550
mov rcx, rbx
mov r14, rax
call fcn.140003550
mov r9d, esi
mov word [rsp + 0x20], di
mov r8, rax
mov rdx, r14
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.USER32.dll_MessageBoxExW]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test r14, r14
je 0x140036578
mov rcx, r14
call fcn.14009b5a0
test rbx, rbx
je 0x140036585
mov rcx, rbx
call fcn.14009b5a0
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp edi, 6
jne 0x1400357bd
mov rsi, qword [rbp - 0x58]
mov r14d, 1
mov dword [rsp + 0x78], r14d
xor edi, edi
test rsi, rsi
je 0x1400365b5
mov rcx, rsi
call qword [sym.imp.USER32.dll_DestroyWindow]
mov ecx, 0x65
call fcn.1400487b0
mov rbx, rax
test rax, rax
jne 0x1400365e0
mov r8d, 0x711
lea rdx, str.C:_src_r3dusb_src_stdlg.c
lea rcx, str.rcTemplate___NULL
call fcn.1400a15c4
lea r9, [0x14002fcd0]
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
mov rcx, rbx
mov qword [rbp - 0x58], rax
mov rsi, rax
call fcn.14009b5a0
test rsi, rsi
je 0x140037c43
mov r8d, dword [0x14010a768]
mov ebx, 1
cmp r8d, 0xffff0000
jle 0x14003664f
mov r9d, dword [0x14010a76c]
cmp r9d, 0xffff0000
jle 0x14003664f
mov dword [rsp + 0x30], ebx
xor edx, edx
mov dword [rsp + 0x28], edi
mov rcx, rsi
mov dword [rsp + 0x20], edi
call qword [sym.imp.USER32.dll_SetWindowPos]
xor r9d, r9d
mov r8d, ebx
mov edx, 0x233
mov rcx, rsi
call qword [sym.imp.USER32.dll_ChangeWindowMessageFilterEx]
xor r9d, r9d
mov r8d, ebx
mov rcx, rsi
lea edx, [r9 + 0x4a]
call qword [sym.imp.USER32.dll_ChangeWindowMessageFilterEx]
xor r9d, r9d
mov r8d, ebx
mov rcx, rsi
lea edx, [r9 + 0x49]
call qword [sym.imp.USER32.dll_ChangeWindowMessageFilterEx]
call fcn.140048e30
cmp qword [0x140156528], 0
jne 0x1400366d7
mov edx, 3
mov dword [rsp + 0x30], 2
mov ecx, edx
mov dword [rsp + 0x28], edi
lea r9, [0x140048c50]
mov dword [rsp + 0x20], edi
xor r8d, r8d
call qword [sym.imp.USER32.dll_SetWinEventHook]
mov qword [0x140156528], rax
test rax, rax
jne 0x1400366d7
lea rcx, str.Warning:_Could_not_set_alert_prompt_hook
call fcn.140041aa0
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, rsi
call qword [sym.imp.USER32.dll_UpdateWindow]
xor r9d, r9d
lea rcx, [rbp - 0x28]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x140036ce1
mov r14d, dword [rbp - 0x6c]
mov r13d, 1
nop
mov eax, dword [rbp - 0x20]
cmp eax, 0x104
jne 0x140036729
test qword [rbp - 0x10], 0x20000000
jne 0x140036729
mov ebx, r13d
jmp 0x140036732
mov ebx, edi
cmp eax, 0x104
jne 0x140036741
cmp qword [rbp - 0x18], r15
je 0x140036741
mov edi, r13d
mov dword [rbp - 0x70], r13d
jmp 0x140036756
mov ecx, r15d
call qword [sym.imp.USER32.dll_GetKeyState]
mov edi, dword [rbp - 0x70]
bt ax, 0xf
cmovb r14d, r13d
mov rcx, qword [0x140111a88]
call qword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x1400367aa
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
jae 0x1400367aa
mov edx, dword [rbp - 0x20]
mov rcx, qword [rbp - 0x18]
cmp edx, 0x100
jne 0x1400367b1
cmp rcx, 0x41
jne 0x1400367b1
lea r9, [rcx - 0x42]
xor r8d, r8d
lea edx, [rcx + 0x70]
mov rcx, qword [0x140111ab0]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x140036cb8
mov rcx, qword [rbp - 0x18]
mov edx, dword [rbp - 0x20]
test ebx, ebx
je 0x1400367cc
mov eax, dword [0x140154eb8]
cmp rcx, 0x11
cmove eax, dword [0x140109f00]
mov dword [0x140154eb8], eax
cmp dword [0x140154eb8], 0
jne 0x1400367f6
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
mov edx, dword [rbp - 0x20]
mov rcx, qword [rbp - 0x18]
jae 0x140036824
cmp edx, 0x100
jne 0x140036824
cmp rcx, 0x4c
jne 0x140036824
mov rcx, qword [0x14015a568]
xor edi, edi
xor r9d, r9d
mov dword [0x140154eb8], edi
mov edx, 0x111
mov r8d, 0x41e
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x140036cba
cmp dword [0x140154eb8], 0
jne 0x140036856
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
mov edx, dword [rbp - 0x20]
mov rcx, qword [rbp - 0x18]
jae 0x1400368f7
cmp edx, 0x100
jne 0x1400368f7
cmp rcx, 0x50
jne 0x1400368f7
xor edi, edi
cmp dword [0x140111a84], edi
mov eax, edi
sete al
cmp qword [0x1401128c8], rdi
mov dword [0x140111a84], eax
je 0x1400368c4
lea edx, [rcx - 0x44]
mov dword [rsp + 0x20], eax
lea r8, [rcx - 0x51]
lea rcx, [rbp + 0x1b0]
lea r9, [0x1400df478]
call fcn.1400034e0
lea rdx, [rbp + 0x1b0]
mov byte [rbp + 0x1bb], dil
lea rcx, str.PersistentLog
call fcn.140020f90
mov ebx, dword [0x140111a84]
mov ecx, 0xd08
jmp 0x140037b8a
lea r9, [rsp + 0x60]
mov dword [rsp + 0x60], eax
mov r8d, 4
mov dword [rsp + 0x20], 4
lea rdx, str.PersistentLog
call fcn.14001c310
mov ebx, dword [0x140111a84]
mov ecx, 0xd08
jmp 0x140037b8a
test ebx, ebx
je 0x140036912
cmp rcx, 0x11
je 0x140036cb8
xor edi, edi
mov dword [0x140154eb8], edi
jmp 0x140036cba
cmp edx, 0x104
jne 0x140036a3f
cmp rcx, 0xbb
je 0x140036960
cmp rcx, 0xbd
je 0x140036940
cmp rcx, 0x6b
je 0x140036960
cmp rcx, 0x6d
jne 0x140036a3f
cmp rcx, 0x6b
je 0x140036960
mov eax, dword [0x14010719c]
mov rdx, 0xffffffffffffffff
mov ecx, edx
cmp eax, 0xfffffffe
jle 0x140036a21
jmp 0x140036979
mov eax, dword [0x14010719c]
mov ecx, r13d
cmp eax, 2
jge 0x140036a21
mov rdx, 0xffffffffffffffff
add eax, ecx
mov dword [0x14010719c], eax
dec eax
cmp qword [0x1401128c8], 0
je 0x1400369c8
mov r8, rdx
mov dword [rsp + 0x20], eax
mov edx, 0xc
lea r9, [0x1400df478]
lea rcx, [rbp + 0x1a0]
call fcn.1400034e0
lea rdx, [rbp + 0x1a0]
mov byte [rbp + 0x1ab], 0
lea rcx, str.DefaultThreadPriority
call fcn.140020f90
jmp 0x1400369eb
lea r9, [rsp + 0x70]
mov dword [rsp + 0x70], eax
mov r8d, 4
mov dword [rsp + 0x20], 4
lea rdx, str.DefaultThreadPriority
call fcn.14001c310
mov rcx, qword [0x140112918]
test rcx, rcx
je 0x140036a03
mov edx, dword [0x14010719c]
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rcx, qword [0x140142ab0]
test rcx, rcx
je 0x140036a1b
mov edx, dword [0x14010719c]
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [0x14010719c]
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
mov r9d, 0xcf6
mov r8d, 0xdac
call fcn.14001b7e0
jmp 0x140036cb8
cmp dword [0x140109f00], 0
jne 0x140037bb4
cmp edx, 0x104
jne 0x1400378e4
cmp rcx, 0xbe
jne 0x140036b0e
xor edi, edi
cmp dword [0x14015a340], edi
mov ecx, edi
sete cl
mov eax, ecx
mov dword [0x14015a340], ecx
xor eax, 1
cmp qword [0x1401128c8], rdi
lea eax, [rax*2 + 1]
mov dword [0x140109f2c], eax
je 0x140036adb
mov dword [rsp + 0x20], ecx
lea r9, [0x1400df478]
lea rcx, [rbp + 0x190]
lea edx, [rdi + 0xc]
lea r8, [rdi - 1]
call fcn.1400034e0
lea rdx, [rbp + 0x190]
mov byte [rbp + 0x19b], dil
lea rcx, str.EnableUsbDebug
call fcn.140020f90
mov ebx, dword [0x14015a340]
mov ecx, 0xcc6
jmp 0x140037824
lea r9, [rsp + 0x60]
mov dword [rsp + 0x60], ecx
mov r8d, 4
mov dword [rsp + 0x20], 4
lea rdx, str.EnableUsbDebug
call fcn.14001c310
mov ebx, dword [0x14015a340]
mov ecx, 0xcc6
jmp 0x140037824
cmp rcx, 0xbc
jne 0x140036b43
xor edi, edi
mov ecx, 0xcd2
cmp dword [0x140109edc], edi
mov ebx, edi
sete bl
mov dword [0x140109edc], ebx
call fcn.14001b320
xor ebx, 1
lea r9d, [rbx + 0xcb2]
jmp 0x140037b9b
cmp rcx, 0x41
jne 0x140036be7
xor edi, edi
cmp dword [0x140109ee4], edi
mov eax, edi
sete al
mov dword [0x140109ee4], eax
xor eax, 1
cmp qword [0x1401128c8], rdi
je 0x140036bb4
lea edx, [rcx - 0x35]
mov dword [rsp + 0x20], eax
lea r8, [rcx - 0x42]
lea rcx, [rbp + 0x180]
lea r9, [0x1400df478]
call fcn.1400034e0
lea rdx, [rbp + 0x180]
mov byte [rbp + 0x18b], dil
lea rcx, str.DisableRufusMBR
call fcn.140020f90
mov ebx, dword [0x140109ee4]
mov ecx, 0xd15
jmp 0x140037b8a
lea r9, [rsp + 0x60]
mov dword [rsp + 0x60], eax
mov r8d, 4
mov dword [rsp + 0x20], 4
lea rdx, str.DisableRufusMBR
call fcn.14001c310
mov ebx, dword [0x140109ee4]
mov ecx, 0xd15
jmp 0x140037b8a
cmp rcx, 0x42
jne 0x140036c8b
xor edi, edi
cmp dword [0x14015a570], edi
mov eax, edi
sete al
mov dword [0x14015a570], eax
xor eax, 1
cmp qword [0x1401128c8], rdi
je 0x140036c58
lea edx, [rcx - 0x36]
mov dword [rsp + 0x20], eax
lea r8, [rcx - 0x43]
lea rcx, [rbp + 0x230]
lea r9, [0x1400df478]
call fcn.1400034e0
lea rdx, [rbp + 0x230]
mov byte [rbp + 0x23b], dil
lea rcx, str.DisableFakeDrivesCheck
call fcn.140020f90
mov ebx, dword [0x14015a570]
mov ecx, 0xcb8
jmp 0x140037b8a
lea r9, [rsp + 0x60]
mov dword [rsp + 0x60], eax
mov r8d, 4
mov dword [rsp + 0x20], 4
lea rdx, str.DisableFakeDrivesCheck
call fcn.14001c310
mov ebx, dword [0x14015a570]
mov ecx, 0xcb8
jmp 0x140037b8a
cmp rcx, 0x43
jne 0x140036e60
mov rcx, qword [0x14015a210]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x147
call qword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
js 0x140036cb8
mov ecx, eax
call fcn.14004abb0
xor edi, edi
xor r9d, r9d
lea rcx, [rbp - 0x28]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x140036710
mov r13, qword [rbp + 0x10]
mov dword [rbp - 0x6c], r14d
mov r14d, dword [rsp + 0x78]
mov rcx, qword [0x140142a88]
test rcx, rcx
je 0x140036cfd
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
call qword [sym.imp.USER32.dll_SendMessageW]
cmp dword [0x140154f10], 0
je 0x1400357bd
cmp dword [0x14014333c], 0
mov dword [0x140154f10], edi
je 0x140036dc9
call fcn.14001aad0
mov ebx, 8
lea r12, [0x140000000]
nop
mov rcx, qword [rbx + r12 + 0x108490]
call fcn.14009b5a0
mov qword [rbx + r12 + 0x108490], rdi
add rbx, 8
cmp rbx, 0xc80
jb 0x140036d30
mov rcx, qword [0x140143348]
mov r12d, dword [rsp + 0x7c]
test rcx, rcx
je 0x140036dc9
mov r8d, dword [0x140143350]
lea eax, [r8 + 1]
test eax, eax
je 0x140036db4
xor eax, eax
mov ebx, eax
cmp dword [rcx + rbx], 0
je 0x140036da4
mov rcx, qword [rcx + rbx + 8]
call fcn.14009b5a0
mov rax, qword [0x140143348]
mov qword [rax + rbx + 8], 0
mov r8d, dword [0x140143350]
mov rcx, qword [0x140143348]
inc rdi
lea edx, [r8 + 1]
add rbx, 0x18
cmp rdi, rdx
jb 0x140036d76
xor ebx, ebx
mov qword [0x140143350], rbx
call fcn.14009b5a0
mov qword [0x140143348], rbx
mov ecx, 1
call fcn.14001ac70
mov rax, qword [0x140112928]
lea rbx, [0x140158be0]
add rbx, qword [0x140142a80]
lea r9, str.Localization_set_to__s
mov edi, 0xffc
mov r8, 0xffffffffffffffff
sub rdi, qword [0x140142a80]
mov rcx, qword [rax + 0x18]
mov rdx, rdi
mov qword [rsp + 0x20], rcx
mov rcx, rbx
call fcn.1400034e0
mov rax, 0xffffffffffffffff
mov byte [rbx + rdi - 1], 0
lea rdx, [0x140158be0]
nop dword [rax]
inc rax
cmp byte [rdx + rax], 0
jne 0x140036e30
mov word [rax + rdx], 0xa0d
mov ebx, 0x181034
add rax, 2
mov qword [0x140142a80], rax
cmp rax, 0x1000
jae 0x140037d0c
jmp 0x140036420
cmp rcx, 0x44
jne 0x140036f66
lea rax, [0x1400d97a4]
mov rbx, 0xffffffffffffffff
mov qword [rsp + 0x28], rax
lea r9, [0x1400dcc14]
lea rax, [0x14015a220]
mov r8, rbx
mov edx, 0x104
mov qword [rsp + 0x20], rax
lea rcx, [rbp + 0x380]
call fcn.1400034e0
lea rax, [rbp + 0x380]
mov byte [rbp + 0x483], 0
mov r9d, 0xcc0
mov qword [rsp + 0x20], rax
mov r8d, 0xdac
mov edx, r13d
xor ecx, ecx
call fcn.14001b7e0
lea rax, [rbp + 0x380]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140036ed4
add rbx, 2
mov edx, 2
mov rcx, rbx
call fcn.1400966e0
xor r13d, r13d
mov qword [rbp + 0x38], rax
mov rdi, rax
mov dword [rsp + 0x28], ebx
mov eax, 0x614
mov qword [rbp + 0x28], r13
xorps xmm0, xmm0
mov dword [rbp + 0x30], 3
lea r9, [r13 - 1]
mov qword [rbp + 0x40], r13
lea r8, [rbp + 0x380]
mov word [rbp + 0x48], ax
xor edx, edx
mov dword [rbp + 0x4c], r13d
mov ecx, 0xfde9
mov qword [rsp + 0x20], rdi
movdqu xmmword [rbp + 0x50], xmm0
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rcx, [rbp + 0x28]
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
test rdi, rdi
je 0x140036f54
mov rcx, rdi
call fcn.14009b5a0
mov r13d, 1
mov dword [0x140154cf4], r13d
jmp 0x140036cb8
cmp rcx, 0x45
jne 0x140037025
xor edi, edi
cmp dword [0x14015a1f8], edi
mov eax, edi
sete al
cmp qword [0x1401128c8], rdi
mov dword [0x14015a1f8], eax
je 0x140036fc6
lea edx, [rcx - 0x39]
mov dword [rsp + 0x20], eax
lea r8, [rcx - 0x46]
lea rcx, [rbp + 0x250]
lea r9, [0x1400df478]
call fcn.1400034e0
lea rdx, [rbp + 0x250]
mov byte [rbp + 0x25b], dil
lea rcx, str.EnableWindowsDualUefiBiosMode
call fcn.140020f90
jmp 0x140036fe9
lea r9, [rsp + 0x60]
mov dword [rsp + 0x60], eax
mov r8d, 4
mov dword [rsp + 0x20], 4
lea rdx, str.EnableWindowsDualUefiBiosMode
call fcn.14001c310
mov ebx, dword [0x14015a1f8]
mov ecx, 0xcc2
call fcn.14001b320
neg ebx
mov qword [rsp + 0x20], rax
mov r8d, 0xdac
sbb r9d, r9d
xor edx, edx
add r9d, 0xcb3
xor ecx, ecx
call fcn.14001b7e0
xor ecx, ecx
call fcn.140028520
jmp 0x140036cba
cmp rcx, 0x46
jne 0x140037091
xor edi, edi
mov ecx, 0xcb5
cmp dword [0x140111aac], edi
mov ebx, edi
sete bl
mov dword [0x140111aac], ebx
call fcn.14001b320
xor ebx, 1
mov qword [rsp + 0x20], rax
xor edx, edx
xor ecx, ecx
mov r8d, 0xdac
lea r9d, [rbx + 0xcb2]
call fcn.14001b7e0
xor ecx, ecx
call fcn.14004b6a0
cmp dword [0x140111aac], edi
mov r8d, edi
mov rcx, qword [0x14015a568]
mov edx, 0x3fe
setne r8b
call qword [sym.imp.USER32.dll_CheckDlgButton]
jmp 0x140036cba
cmp rcx, 0x47
jne 0x140037135
xor edi, edi
cmp dword [0x140109ed4], edi
mov eax, edi
sete al
mov dword [0x140109ed4], eax
xor eax, 1
cmp qword [0x1401128c8], rdi
je 0x140037102
lea edx, [rcx - 0x3b]
mov dword [rsp + 0x20], eax
lea r8, [rcx - 0x48]
lea rcx, [rbp + 0x260]
lea r9, [0x1400df478]
call fcn.1400034e0
lea rdx, [rbp + 0x260]
mov byte [rbp + 0x26b], dil
lea rcx, str.DisableVHDs
call fcn.140020f90
mov ebx, dword [0x140109ed4]
mov ecx, 0xcec
jmp 0x140037824
lea r9, [rsp + 0x60]
mov dword [rsp + 0x60], eax
mov r8d, 4
mov dword [rsp + 0x20], 4
lea rdx, str.DisableVHDs
call fcn.14001c310
mov ebx, dword [0x140109ed4]
mov ecx, 0xcec
jmp 0x140037824
cmp rcx, 0x48
jne 0x1400371d6
xor edi, edi
cmp dword [0x140112960], edi
mov eax, edi
sete al
cmp qword [0x1401128c8], rdi
mov dword [0x140112960], eax
je 0x1400371a3
lea edx, [rcx - 0x3c]
mov dword [rsp + 0x20], eax
lea r8, [rcx - 0x49]
lea rcx, [rbp + 0x1c0]
lea r9, [0x1400df478]
call fcn.1400034e0
lea rdx, [rbp + 0x1c0]
mov byte [rbp + 0x1cb], dil
lea rcx, str.EnableExtraHashes
call fcn.140020f90
mov ebx, dword [0x140112960]
mov ecx, 0xcf0
jmp 0x140037b8a
lea r9, [rsp + 0x60]
mov dword [rsp + 0x60], eax
mov r8d, 4
mov dword [rsp + 0x20], 4
lea rdx, str.EnableExtraHashes
call fcn.14001c310
mov ebx, dword [0x140112960]
mov ecx, 0xcf0
jmp 0x140037b8a
cmp rcx, 0x49
jne 0x14003724e
xor edi, edi
mov ecx, 0xcbe
cmp dword [0x140107198], edi
mov ebx, edi
sete bl
mov dword [0x140107198], ebx
call fcn.14001b320
xor ebx, 1
mov qword [rsp + 0x20], rax
xor edx, edx
xor ecx, ecx
mov r8d, 0xdac
lea r9d, [rbx + 0xcb2]
call fcn.14001b7e0
cmp qword [0x1401128d8], rdi
je 0x140036cba
xor r9d, r9d
mov dword [0x140154f14], r13d
mov edx, 0x111
mov dword [0x140154a18], r13d
mov r8d, 0x3f6
mov rcx, rsi
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x140036cba
cmp rcx, 0x4a
jne 0x140037280
xor edi, edi
mov ecx, 0xcb9
cmp dword [0x140107138], edi
mov ebx, edi
sete bl
mov dword [0x140107138], ebx
call fcn.14001b320
xor ebx, 1
lea r9d, [rbx + 0xcb2]
jmp 0x140037b9b
cmp rcx, 0x4b
jne 0x1400372b2
xor edi, edi
mov ecx, 0xcba
cmp dword [0x14010713c], edi
mov ebx, edi
sete bl
mov dword [0x14010713c], ebx
call fcn.14001b320
xor ebx, 1
lea r9d, [rbx + 0xcb2]
jmp 0x140037b9b
cmp rcx, 0x4c
jne 0x140037353
xor edi, edi
cmp dword [0x14015a324], edi
mov eax, edi
sete al
cmp qword [0x1401128c8], rdi
mov dword [0x14015a324], eax
je 0x140037320
lea edx, [rcx - 0x40]
mov dword [rsp + 0x20], eax
lea r8, [rcx - 0x4d]
lea rcx, [rbp + 0x1d0]
lea r9, [0x1400df478]
call fcn.1400034e0
lea rdx, [rbp + 0x1d0]
mov byte [rbp + 0x1db], dil
lea rcx, str.ForceLargeFat32Formatting
call fcn.140020f90
mov ebx, dword [0x14015a324]
mov ecx, 0xcb6
jmp 0x140037824
lea r9, [rsp + 0x60]
mov dword [rsp + 0x60], eax
mov r8d, 4
mov dword [rsp + 0x20], 4
lea rdx, str.ForceLargeFat32Formatting
call fcn.14001c310
mov ebx, dword [0x14015a324]
mov ecx, 0xcb6
jmp 0x140037824
cmp rcx, 0x4d
jne 0x1400373f4
xor edi, edi
cmp dword [0x140111a98], edi
mov eax, edi
sete al
cmp qword [0x1401128c8], rdi
mov dword [0x140111a98], eax
je 0x1400373c1
lea edx, [rcx - 0x41]
mov dword [rsp + 0x20], eax
lea r8, [rcx - 0x4e]
lea rcx, [rbp + 0x1e0]
lea r9, [0x1400df478]
call fcn.1400034e0
lea rdx, [rbp + 0x1e0]
mov byte [rbp + 0x1eb], dil
lea rcx, str.IgnoreBootMarker
call fcn.140020f90
mov ebx, dword [0x140111a98]
mov ecx, 0xcf7
jmp 0x140037b8a
lea r9, [rsp + 0x60]
mov dword [rsp + 0x60], eax
mov r8d, 4
mov dword [rsp + 0x20], 4
lea rdx, str.IgnoreBootMarker
call fcn.14001c310
mov ebx, dword [0x140111a98]
mov ecx, 0xcf7
jmp 0x140037b8a
cmp rcx, 0x4e
jne 0x140037426
xor edi, edi
mov ecx, 0xcbc
cmp dword [0x140112900], edi
mov ebx, edi
sete bl
mov dword [0x140112900], ebx
call fcn.14001b320
xor ebx, 1
lea r9d, [rbx + 0xcb2]
jmp 0x140037b9b
cmp rcx, 0x4f
jne 0x140037436
call fcn.14001a290
jmp 0x140036cb8
cmp rcx, 0x50
jne 0x140037485
mov rcx, qword [0x14015a210]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x147
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x14015a210]
xor r9d, r9d
movsxd r8, eax
mov edx, 0x150
mov rbx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, eax
call fcn.140006230
test eax, eax
je 0x140036cb8
mov ecx, ebx
jmp 0x140036cb3
cmp rcx, 0x51
jne 0x140037526
xor edi, edi
cmp dword [0x14015a328], edi
mov eax, edi
sete al
cmp qword [0x1401128c8], rdi
mov dword [0x14015a328], eax
je 0x1400374f3
lea edx, [rcx - 0x45]
mov dword [rsp + 0x20], eax
lea r8, [rcx - 0x52]
lea rcx, [rbp + 0x240]
lea r9, [0x1400df478]
call fcn.1400034e0
lea rdx, [rbp + 0x240]
mov byte [rbp + 0x24b], dil
lea rcx, str.EnableFileIndexing
call fcn.140020f90
mov ebx, dword [0x14015a328]
mov ecx, 0xcda
jmp 0x140037b8a
lea r9, [rsp + 0x60]
mov dword [rsp + 0x60], eax
mov r8d, 4
mov dword [rsp + 0x20], 4
lea rdx, str.EnableFileIndexing
call fcn.14001c310
mov ebx, dword [0x14015a328]
mov ecx, 0xcda
jmp 0x140037b8a
cmp rcx, 0x52
jne 0x140037564
lea rdx, str.Alex313031R3dusb
call fcn.140027b60
neg eax
mov r8d, 0xdac
sbb r9d, r9d
xor edx, edx
add r9d, 0xcb1
xor ecx, ecx
call fcn.14001b7e0
lea rdx, [0x1400e4948]
call fcn.140027b60
jmp 0x140036cb8
cmp rcx, 0x53
jne 0x140037596
call fcn.14001b320
neg ebx
sbb r9d, r9d
add r9d, 0xcb3
xor edx, edx
mov qword [rsp + 0x20], rax
xor ecx, ecx
mov r8d, 0xdac
call fcn.14001b7e0
xor ecx, ecx
call fcn.14004b6a0
jmp 0x140036cba
cmp edx, 0x100
jne 0x140037bb4
cmp rcx, 0x5a
jne 0x140037956
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
mov ebx, 0x8000
test bx, ax
je 0x140037943
mov ecx, r15d
call qword [sym.imp.USER32.dll_GetKeyState]
test bx, ax
je 0x140037943
xor r9d, r9d
mov dword [0x1401128f4], r13d
mov edx, 0x111
mov dword [0x1401128e8], r13d
mov r8d, 0x3eb
mov rcx, rsi
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x140036cb8
cmp dword [rbp - 0x20], 0x100
jne 0x140037bb4
mov rcx, qword [rbp - 0x18]
jmp 0x14003795b
mov ebx, 0x8000
cmp rcx, 0x45
jne 0x140037a33
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
test bx, ax
je 0x140037a22
mov ecx, r15d
call qword [sym.imp.USER32.dll_GetKeyState]
test bx, ax
je 0x140037a22
xor edi, edi
cmp dword [0x140111a90], edi
mov eax, edi
sete al
cmp qword [0x1401128c8], rdi
mov dword [0x140111a90], eax
je 0x1400379ef
lea r9, [0x1400df478]
mov dword [rsp + 0x20], eax
lea edx, [rdi + 0xc]
lea r8, [rdi - 1]
lea rcx, [rbp + 0x170]
call fcn.1400034e0
lea rdx, [rbp + 0x170]
mov byte [rbp + 0x17b], dil
lea rcx, str.ExpertMode
call fcn.140020f90
mov ebx, dword [0x140111a90]
mov ecx, 0xd13
jmp 0x140037b8a
lea r9, [rsp + 0x60]
mov dword [rsp + 0x60], eax
mov r8d, 4
mov dword [rsp + 0x20], 4
lea rdx, str.ExpertMode
call fcn.14001c310
mov ebx, dword [0x140111a90]
mov ecx, 0xd13
jmp 0x140037b8a
cmp dword [rbp - 0x20], 0x100
jne 0x140037bb4
mov rcx, qword [rbp - 0x18]
cmp rcx, 0x46
jne 0x140037b47
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
test bx, ax
je 0x140037b3a
mov ecx, r15d
call qword [sym.imp.USER32.dll_GetKeyState]
test bx, ax
je 0x140037b3a
xor edi, edi
cmp dword [0x1401128c4], edi
mov eax, edi
sete al
mov dword [0x1401128c4], eax
test eax, eax
je 0x140037a8e
mov eax, dword [0x140111aac]
mov dword [rsp + 0x7c], eax
mov eax, r13d
mov r12d, dword [rsp + 0x7c]
jmp 0x140037a91
mov eax, r12d
mov rcx, qword [0x14015a568]
test eax, eax
mov r8d, edi
mov dword [0x140111aac], eax
setne r8b
mov edx, 0x3fe
call qword [sym.imp.USER32.dll_CheckDlgButton]
mov ebx, dword [0x1401128c4]
mov ecx, 0xcd7
call fcn.14001b320
neg ebx
mov qword [rsp + 0x20], rax
mov r8d, 0xdac
sbb r9d, r9d
xor edx, edx
add r9d, 0xcb3
xor ecx, ecx
call fcn.14001b7e0
mov eax, dword [0x1401128c4]
lea rcx, str.enabled
test eax, eax
lea r8, str.disabled
lea rax, str.CAUTION:
cmovne r8, rcx
lea rdx, [0x1400d756a]
lea rcx, str._sListing_of_non_USB_removable_drives__s
cmovne rdx, rax
call fcn.140041aa0
cmp dword [0x1401128c4], edi
je 0x140037b2e
lea rcx, str.By_using_this_unofficial_cheat_mode_you_forfeit_ANY_RIGHT_to_complain_if_you_lose_valuable_data_
call fcn.140041aa0
xor ecx, ecx
call fcn.14004b6a0
jmp 0x140036cba
cmp dword [rbp - 0x20], 0x100
jne 0x140037bb4
mov rcx, qword [rbp - 0x18]
cmp rcx, 0x59
jne 0x140037bb4
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
test bx, ax
je 0x140037bb4
mov ecx, r15d
call qword [sym.imp.USER32.dll_GetKeyState]
test bx, ax
je 0x140037bb4
cmp dword [0x14011290c], 0
mov ebx, 2
mov edi, 0
mov ecx, 0xcbb
cmovg ebx, edi
mov dword [0x14011290c], ebx
call fcn.14001b320
neg ebx
sbb r9d, r9d
add r9d, 0xcb3
xor edx, edx
mov qword [rsp + 0x20], rax
xor ecx, ecx
mov r8d, 0xdac
call fcn.14001b7e0
jmp 0x140036cba
test r14d, r14d
je 0x140037bfa
mov ecx, r15d
call qword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
jb 0x140037bfa
xor eax, eax
mov r14d, eax
test edi, edi
jne 0x140037bf3
mov ecx, dword [0x140142a7c]
mov eax, 0x55555556
inc ecx
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
sub ecx, eax
mov dword [0x140142a7c], ecx
xor edi, edi
mov dword [rbp - 0x70], edi
jmp 0x140037bfc
xor edi, edi
lea rdx, [rbp - 0x28]
mov rcx, rsi
call qword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
jne 0x140036cba
mov rcx, qword [0x140111a88]
lea rdx, [rbp - 0x28]
call qword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
jne 0x140036cba
lea rcx, [rbp - 0x28]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp - 0x28]
call qword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x140036cba
cmp dword [0x1401128e0], 0
mov ecx, 0x181010
movzx ebx, word [0x140109ee0]
mov r14d, 0x1010
cmovne r14d, ecx
lea rcx, str.Could_not_create_Window
call fcn.140003550
lea rcx, str.DialogBox_failure
mov rsi, rax
call fcn.140003550
mov r9d, r14d
mov word [rsp + 0x20], bx
mov r8, rax
mov rdx, rsi
xor ecx, ecx
mov rdi, rax
call qword [sym.imp.USER32.dll_MessageBoxExW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test rsi, rsi
je 0x140037ca9
mov rcx, rsi
call fcn.14009b5a0
test rdi, rdi
je 0x140037cb6
mov rcx, rdi
call fcn.14009b5a0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1400357bd
mov rdx, qword [0x140112928]
lea rcx, [rbp + 0x270]
call fcn.1400207b0
mov rax, qword [0x140112928]
mov ecx, 0xbb9
movzx edi, word [0x140109ee0]
mov esi, dword [rax + 4]
and esi, 1
mov dword [0x1401128e0], esi
call fcn.14001b320
mov ecx, 0xbba
mov rbx, rax
call fcn.14001b320
jmp 0x140035df3
call fcn.140092188
int3