Function at 0x140049650
Capabilities:
Authenticate hmac
Check if file exists
Extract resource via kernel32 functions
Move file

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xf8]
sub rsp, 0x1c0
movaps xmmword [rax - 0x48], xmm6
movaps xmmword [rax - 0x58], xmm7
movaps xmmword [rax - 0x68], xmm8
movaps xmmword [rax - 0x78], xmm9
movaps xmmword [rax - 0x88], xmm10
movaps xmmword [rax - 0x98], xmm11
mov rax, qword [0x140193440]
xor rax, rsp
mov qword [rbp + 0x50], rax
xor r12d, r12d
mov qword [rsp + 0x68], rcx
cmp byte [0x1401e8fd6], r12b
mov r15d, 1
mov qword [rsp + 0x48], r12
jne 0x1400496c9
cmp dword [0x1401a03e0], r12d
je 0x14004a211
mov qword [rsp + 0x28], rdx
lea r9, [0x14015bcec]
mov edx, 0x40
mov qword [rsp + 0x20], rcx
lea rcx, [rbp + 0x10]
lea r8, [rdx - 0x41]
call fcn.140004960
lea rdx, [rsp + 0x48]
mov byte [rbp + 0x4f], r12b
lea rcx, [rbp + 0x10]
call fcn.14004fb70
mov dword [rsp + 0x50], eax
mov r13d, eax
test eax, eax
je 0x14004a211
cmp dword [0x1401a03f0], r12d
mov esi, r12d
mov r14, qword [rsp + 0x48]
jbe 0x140049a75
mov r12d, 0x57
movabs r13, 0x7e0000007e03ff
mov r8, qword [0x1401a03e8]
xor edx, edx
mov edi, esi
mov rax, 0xffffffffffffffff
mov rcx, qword [r8 + rdi*8]
inc rax
cmp byte [rcx + rax], dl
jne 0x140049748
test eax, eax
je 0x140049783
mov rcx, qword [r8 + rdi*8]
cmp byte [rcx + rdx], 0x5c
jne 0x140049769
mov byte [rcx + rdx], 0x2f
mov r8, qword [0x1401a03e8]
mov rcx, qword [r8 + rdi*8]
inc edx
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x140049776
cmp edx, eax
jb 0x140049754
mov rdx, qword [r8 + rdi*8]
mov rcx, r14
add rdx, 2
call fcn.1400b3650
mov rbx, rax
test rax, rax
je 0x140049a5f
test r15d, r15d
je 0x1400497b7
lea rdx, [rbp + 0x10]
lea rcx, str.Updating__s:
call fcn.14004f910
xor r15d, r15d
mov rcx, qword [0x1401a03e8]
mov rdx, qword [rcx + rdi*8]
lea rcx, [0x1401641b0]
add rdx, 2
call fcn.14004f910
mov rdx, qword [0x1401a03e8]
lea r8, [rbp]
xor ecx, ecx
sub rbx, r14
mov rdx, qword [rdx + rdi*8]
call fcn.140047970
test rbx, rbx
jle 0x140049807
lea rax, [r14 - 1]
add rax, rbx
cmp byte [rax], 0xa
je 0x140049807
dec rbx
dec rax
test rbx, rbx
jg 0x1400497f7
movzx eax, byte [rbx + r14]
sub al, 0x30
cmp al, 0x36
ja 0x140049818
bt r13, rax
jb 0x140049831
mov r8d, 0x880
lea rdx, str.D:_a_rufus_rufus_srchash.c
lea rcx, str.IS_HEXASCII_md5_data_pos__
call fcn.1400fc264
mov r10d, 3
lea r11, [rbp + 2]
nop dword [rax + rax]
movzx r8d, byte [r11 - 2]
lea r9d, [r10*2 - 6]
movzx ecx, r8b
mov edx, r9d
add rdx, rbx
shr cl, 4
cmp cl, 0xa
mov eax, 0x30
cmovae eax, r12d
and r8b, 0xf
add al, cl
mov byte [rdx + r14], al
cmp r8b, 0xa
mov eax, 0x30
cmovae eax, r12d
add al, r8b
movzx r8d, byte [r11 - 1]
mov byte [rdx + r14 + 1], al
movzx ecx, r8b
shr cl, 4
lea edx, [r9 + 2]
add rdx, rbx
mov eax, 0x30
cmp cl, 0xa
cmovae eax, r12d
and r8b, 0xf
add al, cl
mov byte [rdx + r14], al
cmp r8b, 0xa
mov eax, 0x30
cmovae eax, r12d
add al, r8b
movzx r8d, byte [r11]
mov byte [rdx + r14 + 1], al
movzx ecx, r8b
shr cl, 4
lea edx, [r10*2 - 2]
add rdx, rbx
mov eax, 0x30
cmp cl, 0xa
cmovae eax, r12d
and r8b, 0xf
add al, cl
mov byte [rdx + r14], al
cmp r8b, 0xa
mov eax, 0x30
cmovae eax, r12d
add al, r8b
movzx r8d, byte [r11 + 1]
mov byte [rdx + r14 + 1], al
movzx ecx, r8b
shr cl, 4
lea edx, [r10 + r10]
add rdx, rbx
mov eax, 0x30
cmp cl, 0xa
cmovae eax, r12d
and r8b, 0xf
add al, cl
mov byte [rdx + r14], al
cmp r8b, 0xa
mov eax, 0x30
cmovae eax, r12d
add al, r8b
movzx r8d, byte [r11 + 2]
mov byte [rdx + r14 + 1], al
movzx ecx, r8b
shr cl, 4
lea edx, [r10*2 + 2]
add rdx, rbx
mov eax, 0x30
cmp cl, 0xa
cmovae eax, r12d
and r8b, 0xf
add al, cl
mov byte [rdx + r14], al
cmp r8b, 0xa
mov eax, 0x30
cmovae eax, r12d
add al, r8b
mov byte [rdx + r14 + 1], al
movzx r8d, byte [r11 + 3]
lea edx, [r10*2 + 4]
add rdx, rbx
lea r11, [r11 + 8]
movzx ecx, r8b
mov eax, 0x30
shr cl, 4
cmp cl, 0xa
cmovae eax, r12d
and r8b, 0xf
add al, cl
mov byte [rdx + r14], al
cmp r8b, 0xa
mov eax, 0x30
cmovae eax, r12d
add al, r8b
movzx r8d, byte [r11 - 4]
mov byte [rdx + r14 + 1], al
movzx ecx, r8b
shr cl, 4
lea edx, [r10*2 + 6]
add rdx, rbx
mov eax, 0x30
cmp cl, 0xa
cmovae eax, r12d
and r8b, 0xf
add al, cl
mov byte [rdx + r14], al
cmp r8b, 0xa
mov eax, 0x30
cmovae eax, r12d
add al, r8b
movzx r8d, byte [r11 - 3]
mov byte [rdx + r14 + 1], al
movzx ecx, r8b
shr cl, 4
lea edx, [r10*2 + 8]
add rdx, rbx
lea r10d, [r10 + 8]
cmp cl, 0xa
mov eax, 0x30
cmovae eax, r12d
and r8b, 0xf
add al, cl
mov byte [rdx + r14], al
cmp r8b, 0xa
mov eax, 0x30
cmovae eax, r12d
add al, r8b
mov byte [rdx + r14 + 1], al
lea eax, [r10 - 3]
cmp eax, 0x10
jb 0x140049840
inc esi
cmp esi, dword [0x1401a03f0]
jb 0x140049732
mov r13d, dword [rsp + 0x50]
xor r12d, r12d
cmp dword [0x1401a03e0], 0
je 0x14004a10f
lea eax, [r13 + 0x400]
mov edi, r13d
mov ecx, eax
mov qword [rsp + 0x58], rdi
mov ebx, eax
call fcn.1400e9094
mov qword [rsp + 0x78], rax
mov r15, rax
test rax, rax
jne 0x140049ac5
mov r8d, 0x88b
lea rdx, str.D:_a_rufus_rufus_srchash.c
lea rcx, str.new_data___NULL
call fcn.1400fc264
jmp 0x14004a211
mov r9, qword [0x1401e7a30]
test r9, r9
je 0x140049b1f
lea r8, str._md5sum_totalbytes__0x_llx_n
mov rdx, rbx
mov rcx, r15
call fcn.140041a80
mov rdi, 0xffffffffffffffff
nop word [rax + rax]
inc rdi
cmp byte [r15 + rdi], 0
jne 0x140049af0
add edi, r13d
mov rsi, 0xffffffffffffffff
mov qword [rsp + 0x58], rdi
nop dword [rax]
inc rsi
cmp byte [r15 + rsi], 0
jne 0x140049b10
add rsi, r15
jmp 0x140049b22
mov rsi, r15
movsd xmm9, qword [0x140176f70]
lea rbx, str.boot.efi
movsd xmm8, qword [0x140176ef8]
mov eax, 1
movsd xmm10, qword [0x140176f50]
mov r12, r14
movsd xmm11, qword [0x140176f20]
mov r14d, 0x258
mov dword [rsp + 0x40], eax
nop
mov r13d, eax
lea r9, str._sefi_boot_s
mov edx, 0x40
lea rcx, [rbp - 0x80]
mov rax, qword [rbx + r13*8]
mov qword [rsp + 0x28], rax
lea r8, [rdx - 0x41]
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x20], rax
call fcn.140004960
lea rcx, [rbp - 0x80]
mov byte [rbp - 0x41], 0
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x140049f72
movzx eax, word [rsp + 0x40]
xor r15d, r15d
mov r13, qword [rbx + r13*8]
add ax, r14w
mov rbx, qword [0x1401e8838]
movzx edx, ax
mov rcx, rbx
lea r8d, [r15 + 0xa]
mov qword [rsp + 0x70], r15
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov r14, rax
test rax, rax
jne 0x140049bf2
call fcn.140050120
mov r8, rax
lea rcx, str.Could_not_locate_resource__s:__s
mov rdx, r13
call fcn.14004f910
jmp 0x140049c40
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r15, rax
test rax, rax
jne 0x140049c24
call fcn.140050120
mov r8, rax
lea rcx, str.Could_not_load_resource__s:__s
mov rdx, r13
call fcn.14004f910
mov r15, qword [rsp + 0x70]
jmp 0x140049c40
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, r15
mov dword [rsp + 0x60], eax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r15, rax
lea rcx, [rbp - 0x80]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x140049c50
inc rax
lea rdx, [rbp - 0x80]
mov ebx, 0x40
lea rcx, [rbp - 0x40]
cmp rax, rbx
cmovb rbx, rax
mov r8, rbx
call fcn.1401362c0
lea rcx, [rbp - 0x40]
mov byte [rbp + rbx - 0x41], 0
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x140049c90
sub rax, 4
cmp rax, 0x40
jae 0x14004a2af
mov r9, 0xffffffffffffffff
mov byte [rbp + rax - 0x40], 0
lea r8, str._original.efi
lea rcx, [rbp - 0x40]
lea edx, [r9 + 0x41]
call fcn.1400e917c
test r15, r15
je 0x140049f51
lea rcx, [rbp - 0x80]
call fcn.140041b20
lea rcx, [rbp - 0x40]
mov rbx, rax
call fcn.140041b20
mov rdx, rax
mov rcx, rbx
mov r14, rax
call qword [sym.imp.KERNEL32.dll_MoveFileW]
mov r13d, eax
test r14, r14
je 0x140049d04
mov rcx, r14
call fcn.1400e9080
test rbx, rbx
je 0x140049d11
mov rcx, rbx
call fcn.1400e9080
test r13d, r13d
je 0x140049f51
lea r8, [rbp - 0x40]
lea rdx, [rbp - 0x80]
lea rcx, str.Renamed:__s___s
call fcn.14004f910
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
lea rcx, [rbp - 0x80]
mov edx, 0xc0000000
mov dword [rsp + 0x20], 2
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x140049ef9
mov r14d, dword [rsp + 0x60]
xor r9d, r9d
mov r8d, r14d
mov rdx, r15
mov rcx, rax
call fcn.140050f30
test eax, eax
jne 0x140049df0
call fcn.140050120
mov r8, rax
lea rdx, [rbp - 0x80]
lea rcx, str.Could_not_write__s:__s.
call fcn.14004f910
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp - 0x40]
call fcn.140041b20
lea rcx, [rbp - 0x80]
mov rbx, rax
call fcn.140041b20
mov rdx, rax
mov rcx, rbx
mov r14, rax
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test r14, r14
je 0x140049dda
mov rcx, r14
call fcn.1400e9080
test rbx, rbx
je 0x140049f65
mov rcx, rbx
call fcn.1400e9080
jmp 0x140049f65
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x14019f510], 0
lea rax, [0x14015644e]
mov rcx, r14
xorps xmm7, xmm7
lea r14, [0x140166080]
cmove r14, rax
test rcx, rcx
js 0x140049e24
cvtsi2sd xmm7, rcx
jmp 0x140049e39
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2sd xmm7, rax
addsd xmm7, xmm7
mov r15, qword [0x14019f4e0]
xor ebx, ebx
comisd xmm9, xmm7
ja 0x140049e57
inc rbx
mulsd xmm7, xmm8
cmp rbx, 5
jl 0x140049e42
test rbx, rbx
jne 0x140049e7e
mov rax, qword [r15 + 0xa0]
lea r9, str._s_d_s__s
mov qword [rsp + 0x38], rax
cvttsd2si ecx, xmm7
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], ecx
jmp 0x140049ec6
movaps xmm6, xmm7
movaps xmm0, xmm7
mulsd xmm6, xmm10
call fcn.140135fe0
lea rax, str._s_0.0f_s__s
mulsd xmm0, xmm10
lea r9, str._s_0.1f_s__s
subsd xmm6, xmm0
comisd xmm11, xmm6
cmova r9, rax
mov rax, qword [r15 + rbx*8 + 0xa0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
movsd qword [rsp + 0x28], xmm7
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x20], r14
lea rcx, [0x1401e2e80]
lea edx, [r8 + 0x21]
call fcn.140004960
lea r8, [0x1401e2e80]
mov byte [0x1401e2e9f], 0
lea rcx, str.Created:__s___s_
jmp 0x140049f5c
call fcn.140050120
mov r8, rax
lea rdx, [rbp - 0x80]
lea rcx, str.Could_not_create__s:__s.
call fcn.14004f910
lea rcx, [rbp - 0x40]
call fcn.140041b20
lea rcx, [rbp - 0x80]
mov rbx, rax
call fcn.140041b20
mov rdx, rax
mov rcx, rbx
mov r14, rax
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test r14, r14
je 0x140049f42
mov rcx, r14
call fcn.1400e9080
test rbx, rbx
je 0x140049f65
mov rcx, rbx
call fcn.1400e9080
jmp 0x140049f65
lea r8, [rbp - 0x40]
lea rcx, str.Could_not_rename:__s___s
lea rdx, [rbp - 0x80]
call fcn.14004f910
mov r14d, 0x258
lea rbx, str.boot.efi
mov eax, dword [rsp + 0x40]
inc eax
mov dword [rsp + 0x40], eax
cmp eax, 0xa
jb 0x140049b60
mov rbx, qword [rsp + 0x48]
lea rdx, str._._efi_boot_boot
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrStrIA]
mov r14, rax
test rax, rax
je 0x14004a0e6
nop word [rax + rax]
lea r15, str.bootia32.efi
mov r13d, 9
nop dword [rax]
mov rdx, qword [r15]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
cmp byte [rdx + rax + 1], 0
lea rax, [rax + 1]
jne 0x140049fd0
cmp byte [rax + r14 + 0xc], 0xa
jne 0x14004a0b1
mov rax, 0xffffffffffffffff
nop
cmp byte [rdx + rax + 1], 0
lea rax, [rax + 1]
jne 0x140049ff0
lea rcx, [r14 + 0xc]
mov byte [rax + r14 + 0xc], 0
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x14004a093
mov rdi, qword [r15]
mov rcx, 0xffffffffffffffff
nop dword [rax]
inc rcx
cmp byte [rdi + rcx], 0
jne 0x14004a020
add rcx, 8
mov rax, r14
sub rax, r12
mov rdx, r12
add rax, rcx
mov rcx, rsi
mov r8d, eax
mov ebx, eax
call fcn.1401362c0
movsd xmm0, qword [str._original.efi_n]
add rsi, rbx
add dword [rsp + 0x58], 9
movsd qword [rsi], xmm0
mov eax, dword [0x140164340]
mov dword [rsi + 8], eax
movzx eax, word [0x140164344]
mov word [rsi + 0xc], ax
movzx eax, byte [0x140164346]
mov byte [rsi + 0xe], al
add rsi, 0xe
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rdi + rax], 0
jne 0x14004a083
lea r12, [r14 + 0xd]
add r12, rax
mov rcx, qword [r15]
mov rax, 0xffffffffffffffff
nop dword [rax]
cmp byte [rcx + rax + 1], 0
lea rax, [rax + 1]
jne 0x14004a0a0
mov byte [rax + r14 + 0xc], 0xa
add r15, 8
sub r13, 1
jne 0x140049fc0
lea rcx, [r14 + 0xc]
lea rdx, str._._efi_boot_boot
call qword [sym.imp.SHLWAPI.dll_StrStrIA]
mov r14, rax
test rax, rax
jne 0x140049fb0
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x48]
mov r8d, dword [rsp + 0x50]
mov rdx, r12
sub r8, r12
mov rcx, rsi
add r8, rbx
call fcn.1401362c0
mov rcx, rbx
call fcn.1400e9080
mov r14, qword [rsp + 0x78]
xor r12d, r12d
mov r13d, edi
lea rcx, [rbp + 0x10]
mov qword [rsp + 0x48], r12
call fcn.14004f5b0
mov r9d, 0xffffffff
mov dword [rsp + 0x28], r12d
lea r8, [0x14015bcf4]
mov qword [rsp + 0x20], r12
xor edx, edx
mov ecx, 0xfde9
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rdi, eax
cmp edi, 1
jle 0x14004a190
mov rcx, rdi
mov edx, 2
call fcn.1400c537c
mov rbx, rax
test rax, rax
je 0x14004a190
mov dword [rsp + 0x28], edi
lea r8, [0x14015bcf4]
mov r9d, 0xffffffff
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, edi
je 0x14004a193
mov rcx, rbx
call fcn.1400e9080
mov rbx, r12
mov r8, rbx
lea rcx, [rsp + 0x48]
mov rdx, rsi
call fcn.1400e94b0
test rsi, rsi
je 0x14004a1b0
mov rcx, rsi
call fcn.1400e9080
test rbx, rbx
je 0x14004a1bd
mov rcx, rbx
call fcn.1400e9080
mov rbx, qword [rsp + 0x48]
test rbx, rbx
jne 0x14004a1d9
lea rdx, [rbp + 0x10]
lea rcx, str.Error:_Cant_create__s
call fcn.14004f910
jmp 0x14004a209
mov r8d, r13d
mov r9, rbx
mov edx, 1
mov rcx, r14
call fcn.14010a0a0
cmp eax, r13d
je 0x14004a201
lea rdx, [rbp + 0x10]
lea rcx, str.Error:_Cant_write__s
call fcn.14004f910
mov rcx, rbx
call fcn.1400e9730
mov rcx, r14
call fcn.1400e9080
mov rcx, qword [0x1401a03e8]
test rcx, rcx
je 0x14004a25e
cmp dword [0x1401a03f0], 0
mov edi, r12d
jbe 0x14004a257
nop dword [rax]
mov ebx, edi
mov rcx, qword [rcx + rbx*8]
call fcn.1400e9080
mov rax, qword [0x1401a03e8]
inc edi
mov qword [rax + rbx*8], r12
cmp edi, dword [0x1401a03f0]
mov rcx, qword [0x1401a03e8]
jb 0x14004a230
mov dword [0x1401a03f0], r12d
call fcn.1400e9080
mov qword [0x1401a03e8], r12
mov rcx, qword [rbp + 0x50]
xor rcx, rsp
call fcn.1400b1f80
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x50]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1400b20a8
int3