Function at 0x140008790
Capabilities:
Contain obfuscated stackstrings
Get disk information
Get disk information via ioctl
Read file on windows
Set registry value

Disassembly:
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x1260]
mov eax, 0x1360
call fcn.1400b2940
sub rsp, rax
mov rax, qword [0x140193440]
xor rax, rsp
mov qword [rbp + 0x1250], rax
xor esi, esi
mov dword [rsp + 0x78], ecx
mov edi, ecx
mov dword [rsp + 0x74], 0x5c3a53
xor edx, edx
lea rcx, [rbp + 0x50]
mov r8d, 0x1000
mov r12d, esi
lea r15d, [rsi - 1]
call fcn.140136960
cmp dword [0x1401d0480], 0xa0
mov r14d, esi
mov dword [rbp - 0x60], 0x5441460b
mov dword [rbp - 0x5c], 0x20202020
mov dword [rbp - 0x58], 0x41460120
mov dword [rbp - 0x54], 0x20323154
mov dword [rbp - 0x50], 0x460e2020
mov dword [rbp - 0x4c], 0x36315441
mov dword [rbp - 0x48], 0xc202020
mov dword [rbp - 0x44], 0x33544146
mov dword [rbp - 0x40], 0x20202032
jae 0x14000884c
lea rcx, str.ESP_toggling_is_only_available_for_Windows_10_or_later
call fcn.14004f910
xor eax, eax
jmp 0x140008f80
mov qword [rsp + 0x1398], rbx
mov ecx, edi
mov qword [rsp + 0x13a0], r13
call fcn.140005900
mov r9d, 1
xor edx, edx
mov r8d, r9d
mov rcx, rax
mov rbx, rax
call fcn.140005570
mov rcx, rbx
mov r13, rax
call fcn.1400e9080
cmp r13, 0xffffffffffffffff
jne 0x140008891
xor eax, eax
jmp 0x140008f70
mov qword [rsp + 0x38], rsi
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], rax
xor r9d, r9d
lea rax, [rbp + 0x50]
mov dword [rsp + 0x28], 0x1000
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0x70050
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x140008f4a
cmp dword [rsp + 0x70], esi
jbe 0x140008f4a
mov r9d, dword [rbp + 0x54]
mov edx, esi
test r9d, r9d
jle 0x140008952
mov r8d, dword [rbp + 0x50]
mov r10, qword [0x1401579e8]
mov r11, qword [0x1401579e0]
movsxd rbx, edx
test r8d, r8d
jne 0x140008912
lea rdi, [rbx + rbx*8]
shl rdi, 4
cmp byte [rbp + rdi + 0xa0], 0xef
je 0x140008ac7
cmp r8d, 1
jne 0x14000894b
lea rdi, [rbx + rbx*8]
shl rdi, 4
lea rax, [rbp + 0xa0]
add rax, rdi
je 0x14000894b
mov rcx, qword [rax]
sub rcx, r11
jne 0x14000893b
mov rcx, qword [rax + 8]
sub rcx, r10
test rcx, rcx
mov eax, esi
sete al
test eax, eax
jne 0x140008ac7
inc edx
cmp edx, r9d
jl 0x1400088f4
mov ebx, dword [rsp + 0x70]
mov edi, 1
nop dword [rax + rax]
test r15d, r15d
jns 0x140008b48
mov edx, 0x10
movzx eax, dil
lea r9, str.ToggleEsp_02u
mov dword [rsp + 0x20], eax
lea rcx, [rbp - 0x38]
lea r8, [rdx - 0x11]
call fcn.140004960
lea rcx, [rbp - 0x38]
mov byte [rbp - 0x29], sil
call fcn.1400051b0
test rax, rax
je 0x140008cb0
lea rcx, [0x1401e2d77]
mov qword [rsp + 0x60], rcx
lea r9, [0x1401e2d6c]
lea rcx, [0x1401e2d76]
mov qword [rsp + 0x58], rcx
lea r8, [0x1401e2d68]
lea rcx, [0x1401e2d75]
mov qword [rsp + 0x50], rcx
lea rdx, str._08X__04X__04X__02X_02X__02X_02X_02X_02X_02X_02X
lea rcx, [0x1401e2d74]
mov qword [rsp + 0x48], rcx
lea rcx, [0x1401e2d73]
mov qword [rsp + 0x40], rcx
lea rcx, [0x1401e2d72]
mov qword [rsp + 0x38], rcx
lea rcx, [0x1401e2d71]
mov qword [rsp + 0x30], rcx
lea rcx, [0x1401e2d70]
mov qword [rsp + 0x28], rcx
lea rcx, [0x1401e2d6e]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.140002d80
cmp eax, 0xb
jne 0x140008cb0
mov ebx, esi
cmp dword [rbp + 0x54], esi
jle 0x140008cb0
movups xmm0, xmmword [0x1401579e0]
mov edx, dword [rbp + 0x50]
test r15d, r15d
jns 0x140008cb0
cmp edx, 1
jne 0x140008c5c
movsxd rax, ebx
lea r14, [rbp + 0xb0]
lea rcx, [rax + rax*8]
shl rcx, 4
add r14, rcx
test r14, r14
je 0x140008ca5
mov rcx, qword [0x1401e2d68]
sub rcx, qword [r14]
jne 0x140008a8e
mov rcx, qword [0x1401e2d70]
sub rcx, qword [r14 + 8]
test rcx, rcx
mov eax, esi
sete al
test eax, eax
je 0x140008ca5
mov r12d, 1
mov r15d, ebx
cmp edx, r12d
jne 0x140008c8c
movsxd rax, ebx
lea rcx, [rax + rax*8]
add rcx, rcx
movups xmmword [rbp + rcx*8 + 0xa0], xmm0
jmp 0x140008ca2
mov r15d, edx
test edx, edx
js 0x140008952
cmp r8d, 1
jne 0x140008afa
lea rdx, [rbp + 0xc8]
add rdx, rdi
lea rcx, str.ESP_name:__S
call fcn.14004f910
lea rcx, [rbp + 0xb0]
add rcx, rdi
jmp 0x140008b13
mov eax, dword [rbp + 0x58]
lea rcx, [rbp - 0x70]
mov dword [rbp - 0x70], eax
mov rax, qword [rbp + rdi + 0x88]
mov qword [rbp - 0x68], rax
mov dword [rbp - 0x6c], esi
call fcn.140008200
test eax, eax
jne 0x140008b2d
lea rcx, str.ESP_toggling_data_could_not_be_stored
call fcn.14004f910
jmp 0x140008f60
mov eax, dword [rbp + 0x50]
cmp eax, 1
jne 0x140008ba5
movups xmm0, xmmword [0x140157fb0]
movups xmmword [rbp + rdi + 0xa0], xmm0
mov ebx, dword [rsp + 0x70]
mov r9d, dword [rsp + 0x70]
lea r8, [rbp + 0x50]
mov qword [rsp + 0x38], rsi
mov edx, 0x7c054
movsxd rax, r15d
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
lea rcx, [rax + rax*8]
add rcx, rcx
mov byte [rbp + rcx*8 + 0x9c], 1
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x140008cd7
call fcn.140050120
mov rdx, rax
lea rcx, str.Could_not_set_drive_layout:__s
call fcn.14004f910
jmp 0x140008f60
test eax, eax
jne 0x140008b44
mov rdx, qword [rbp + rdi + 0x88]
xor r9d, r9d
xor r8d, r8d
mov byte [rbp + rdi + 0xa0], 0xb
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140008b44
lea r9, [rbp - 0x78]
mov qword [rsp + 0x20], rsi
mov r8d, 0x200
lea rdx, [rbp + 0x1050]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140008b44
cmp dword [rbp - 0x78], 0x200
jne 0x140008b44
lea r8, [rbp + 0x1086]
mov r9d, 2
mov ecx, esi
nop dword [rax]
nop word [rax + rax]
movsxd rax, ecx
lea rdx, [rax + rax*8]
mov rax, qword [r8]
cmp rax, qword [rbp + rdx - 0x5f]
je 0x140008c3a
inc ecx
cmp ecx, 4
jb 0x140008c20
jmp 0x140008c4d
movzx eax, byte [rbp + rdx - 0x60]
lea rcx, [rbx + rbx*8]
add rcx, rcx
mov byte [rbp + rcx*8 + 0xa0], al
add r8, 0x1c
sub r9, 1
jne 0x140008c11
jmp 0x140008b44
test edx, edx
jne 0x140008a6e
mov eax, dword [rbp + 0x58]
lea r14, [rbp - 0x70]
mov dword [rbp - 0x70], eax
movsxd rax, ebx
mov dword [rbp - 0x6c], esi
lea rax, [rax + rax*8]
add rax, rax
mov rax, qword [rbp + rax*8 + 0x88]
mov qword [rbp - 0x68], rax
jmp 0x140008a77
test edx, edx
jne 0x140008ca5
movsxd rax, ebx
lea rcx, [rax + rax*8]
add rcx, rcx
mov byte [rbp + rcx*8 + 0xa0], 0xef
mov edx, dword [rbp + 0x50]
inc ebx
cmp ebx, dword [rbp + 0x54]
jl 0x140008a47
inc edi
mov eax, r15d
cmp edi, 8
jle 0x140008960
test eax, eax
jns 0x140008b48
lea rcx, str.No_partition_to_toggle
call fcn.14004f910
jmp 0x140008f60
mov qword [rsp + 0x38], rsi
xor r9d, r9d
mov qword [rsp + 0x30], rsi
xor r8d, r8d
mov dword [rsp + 0x28], esi
mov edx, 0x70140
mov rcx, r13
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x140008d16
call fcn.140050120
mov rdx, rax
lea rcx, str.Could_not_refresh_drive_layout:__s
call fcn.14004f910
test r12d, r12d
je 0x140008e70
mov edx, 0x10
movzx eax, bl
lea r9, str.ToggleEsp_02u
mov dword [rsp + 0x20], eax
lea rcx, [rbp - 0x38]
lea r8, [rdx - 0x11]
call fcn.140004960
cmp qword [0x14019f500], rsi
lea rcx, [rbp - 0x38]
mov byte [rbp - 0x29], sil
je 0x140008d66
lea rdx, [0x14015644e]
call fcn.140026ef0
mov esi, 1
jmp 0x140008f60
mov edx, 0x5c
mov qword [rbp - 0x80], rsi
mov qword [rbp - 0x70], rsi
call fcn.1400b35d4
test rax, rax
je 0x140008d96
mov r8d, 0x91
lea rdx, str.D:_a_rufus_rufus_src_registry.h
lea rcx, str.strchr_key_name_____NULL
call fcn.1400fc264
mov edx, 0x5c
lea rcx, [rbp - 0x38]
call fcn.1400b35d4
test rax, rax
jne 0x140008f43
lea rax, [rbp - 0x80]
mov r9d, 0x2001d
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x140008dd8
mov qword [rbp - 0x80], rsi
jmp 0x140008e53
mov rcx, qword [rbp - 0x80]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x40], rax
lea rdx, str.SOFTWAREAkeo_ConsultingRufus
lea rax, [rbp - 0x70]
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 7
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x140008e1d
mov qword [rbp - 0x70], rsi
jmp 0x140008e44
mov rcx, qword [rbp - 0x70]
lea rax, [0x14015644e]
mov dword [rsp + 0x28], esi
lea rdx, [rbp - 0x38]
mov r9d, 1
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x140008e53
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x140008f43
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, 1
jmp 0x140008f60
movzx edi, byte [rsp + 0x74]
lea rdx, [rbp - 0x20]
mov ecx, 0x69
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
test eax, eax
jne 0x140008ea6
call fcn.140050120
mov rdx, rax
lea rcx, str.GetLogicalDriveStrings_failed:__s
call fcn.14004f910
mov esi, 1
jmp 0x140008f60
cmp eax, 0x69
jbe 0x140008ec9
mov r8d, 0x69
lea rcx, str.GetLogicalDriveStrings:_Buffer_too_small__required__lu_vs.__zu_
mov edx, eax
call fcn.14004f910
mov esi, 1
jmp 0x140008f60
movzx eax, byte [rbp - 0x20]
lea rbx, [rbp - 0x20]
test al, al
je 0x140008f09
movsx ecx, al
call fcn.1400fc9f0
cmp dil, al
je 0x140008f43
test rbx, rbx
jne 0x140008eec
mov rax, rsi
jmp 0x140008efc
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rbx + rax], sil
jne 0x140008ef3
inc rbx
add rbx, rax
movzx eax, byte [rbx]
test al, al
jne 0x140008ed5
mov ecx, dword [rsp + 0x78]
xor r9d, r9d
movsxd rax, r15d
lea r8d, [r9 + 1]
lea rdx, [rax + rax*8]
add rdx, rdx
mov rdx, qword [rbp + rdx*8 + 0x88]
call fcn.140005a00
mov rdx, rax
lea rcx, [rsp + 0x74]
mov rbx, rax
call fcn.14000a390
mov rcx, rbx
call fcn.1400e9080
mov esi, 1
jmp 0x140008f60
call fcn.140050120
mov r8, rax
lea rcx, str.Could_not_get_layout_for_drive_0x_02x:__s
mov edx, edi
call fcn.14004f910
test r13, r13
je 0x140008f6e
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov rbx, qword [rsp + 0x1398]
mov r13, qword [rsp + 0x13a0]
mov rcx, qword [rbp + 0x1250]
xor rcx, rsp
call fcn.1400b1f80
mov rsi, qword [rsp + 0x13a8]
add rsp, 0x1360
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret