Function at 0x438c34
Capabilities:
Check mutex on windows
Copy file
Delete file
Get common file path
Get session user name
Identify system language via api
Log keystrokes via polling
Move file
Parse pe header
Terminate thread
Write file on windows

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x538
mov eax, dword [ecx]
mov dword [ebp - 0x514], eax
mov eax, dword [ecx + 8]
mov dword [ebp - 0x508], eax
xor eax, eax
mov dword [ebp - 0x4e4], eax
mov dword [ebp - 0x4e0], eax
mov dword [ebp - 0x4dc], eax
call dword [sym.imp.KERNEL32.DLL_GetUserDefaultUILanguage]
mov dword [ebp - 0x4d8], 1
movzx eax, ax
mov dword [ebp - 0x50c], eax
xor eax, eax
mov dword [ebp - 0x11c], eax
lea eax, [ebp - 0x11c]
mov dword [esp + 0x10], eax
xor eax, eax
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], eax
mov dword [esp + 4], str.SoftwareMicrosoftVisualStudio
mov dword [esp], 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x51c], eax
mov eax, dword [ebp - 0x11c]
sub esp, 0x14
test eax, eax
je 0x438cdb
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
xor eax, eax
lea edi, [ebp - 0x324]
mov ecx, 0x41
xor edx, edx
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x220]
mov ecx, 0x41
mov esi, 0x492940
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x11c]
mov ecx, 0x41
mov dword [ebp - 0x4d0], edx
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x4a4]
mov ecx, 0x20
mov dword [ebp - 0x4cc], 4
rep movsd dword es:[edi], dword [esi]
mov byte [ebp - 0x4e5], 0
mov word [ebp - 0x4e7], 0x6272
mov dword [esp], 0x4a4f92
call dword [sym.imp.KERNEL32.DLL_SetDllDirectoryA]
push ecx
mov dword [esp], 0x800
call dword [sym.imp.KERNEL32.DLL_SetDefaultDllDirectories]
push ebx
mov dword [esp], str._Rufus_init__n
call fcn.0043efa9
lea eax, [ebp - 0x4cc]
mov dword [esp + 4], eax
lea eax, [ebp - 0x4d0]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
push esi
push esi
test eax, eax
je 0x438d8e
xor eax, eax
cmp dword [ebp - 0x4d0], 0x6c696e
sete al
mov dword [0x526ccc], eax
xor eax, eax
mov dword [0x526ce4], eax
mov dword [esp + 4], 2
mov dword [esp], 0x104
call sub.msvcrt.dll_calloc
mov edi, eax
test eax, eax
jne 0x438dc7
mov dword [esp], 0xe
call dword [sym.imp.KERNEL32.DLL_SetLastError]
push eax
jmp 0x438e61
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 8], 0x104
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
sub esp, 0xc
mov ebx, eax
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov esi, eax
test ebx, ebx
je 0x438e4b
dec ebx
test ebx, ebx
je 0x438e01
cmp word [edi + ebx*2], 0x5c
jne 0x438def
mov word [edi + ebx*2], 0
xor eax, eax
mov dword [esp + 0x14], 0x104
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0x10], 0x526a20
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], edi
mov dword [esp + 4], eax
mov dword [esp], 0xfde9
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
sub esp, 0x20
mov ebx, eax
test eax, eax
jne 0x438e4b
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov esi, eax
mov dword [esp], edi
call sub.msvcrt.dll_free
mov dword [esp], esi
call dword [sym.imp.KERNEL32.DLL_SetLastError]
push esi
test ebx, ebx
jne 0x438e88
call fcn.0043f53d
mov dword [esp], str.Could_not_get_application_directory:__s
mov dword [esp + 4], eax
call fcn.0043efa9
mov byte [0x526a22], 0
mov word [0x526a20], 0x5c2e
jmp 0x438ebf
mov dword [esp], 0x526a20
call sub.msvcrt.dll_strlen
mov dword [esp + 4], 0x4a6649
mov edx, eax
mov eax, 0x103
mov dword [esp], 0x526a20
sub eax, edx
mov edx, 2
cmp eax, edx
cmova eax, edx
mov dword [esp + 8], eax
call sub.msvcrt.dll_strncat
mov ecx, 3
mov edx, 0x80000000
mov eax, 0x526360
mov word [0x526360], 0x5c2e
mov byte [0x526362], 0
mov dword [esp], 0x2000000
call fcn.00430226
mov ebx, eax
cmp eax, 0xffffffff
jne 0x438f23
call fcn.0043f53d
mov dword [esp + 4], 0x526360
mov dword [esp + 8], eax
mov dword [esp], str.Could_not_get_current_directory_from__s:__s
call fcn.0043efa9
mov byte [0x526362], 0
mov word [0x526360], 0x5c2e
jmp 0x438fb2
mov edx, 0x526360
call fcn.0042ffa8
test eax, eax
je 0x438ef1
mov dword [esp + 4], 0x4a6679
mov dword [esp], 0x526360
call sub.msvcrt.dll_strstr
cmp eax, 0x526360
je 0x438f67
mov dword [esp + 4], 0x4a667e
mov dword [esp], 0x526360
call sub.msvcrt.dll_strstr
cmp eax, 0x526360
jne 0x438ef1
mov dword [esp + 4], 0x526364
mov dword [esp], 0x526360
call sub.msvcrt.dll_strcpy
mov dword [esp], 0x526360
call sub.msvcrt.dll_strlen
mov dword [esp + 4], 0x4a6649
mov edx, eax
mov eax, 0x103
mov dword [esp], 0x526360
sub eax, edx
mov edx, 2
cmp eax, edx
cmova eax, edx
mov dword [esp + 8], eax
call sub.msvcrt.dll_strncat
lea eax, [ebx - 1]
cmp eax, 0xfffffffd
ja 0x438fc4
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push ecx
mov dword [esp + 4], 2
mov dword [esp], 0x104
call sub.msvcrt.dll_calloc
mov dword [esp], 0x104
mov dword [esp + 4], eax
mov esi, eax
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
mov edi, dword [sym.imp.KERNEL32.DLL_GetLastError]
push edx
mov ebx, eax
push edx
call edi
mov dword [ebp - 0x4ec], eax
test ebx, ebx
je 0x43904b
xor eax, eax
mov dword [esp + 0x14], 0x104
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0x10], 0x5267e0
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], esi
mov dword [esp + 4], eax
mov dword [esp], 0xfde9
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
sub esp, 0x20
mov ebx, eax
test eax, eax
jne 0x43904b
call edi
mov dword [ebp - 0x4ec], eax
test esi, esi
je 0x439057
mov dword [esp], esi
call sub.msvcrt.dll_free
mov eax, dword [ebp - 0x4ec]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_SetLastError]
push esi
test ebx, ebx
jne 0x4390c3
call fcn.0043f53d
mov dword [esp], str.Could_not_get_temp_directory:__s
mov esi, 0x526360
mov dword [esp + 4], eax
call fcn.0043efa9
mov dword [esp], 0x526360
call sub.msvcrt.dll_strlen
mov edx, 0x5267e0
mov edi, edx
lea ecx, [eax + 1]
rep movsb byte es:[edi], byte [esi]
mov dword [esp], 0x526360
call sub.msvcrt.dll_strlen
mov edx, 0x5268e3
cmp eax, 0x103
je 0x4390bb
lea edx, [eax + 0x5267e0]
mov byte [edx], 0
jmp 0x4391eb
mov ecx, 3
mov edx, 0x80000000
mov eax, 0x5267e0
mov dword [esp], 0x2000000
call fcn.00430226
mov ebx, eax
cmp eax, 0xffffffff
jne 0x439146
call fcn.0043f53d
mov dword [esp + 4], 0x5267e0
mov esi, 0x526360
mov dword [esp + 8], eax
mov dword [esp], str.Could_not_get_actual_temp_directory_from__s:__s
call fcn.0043efa9
mov dword [esp], 0x526360
call sub.msvcrt.dll_strlen
mov edx, 0x5267e0
mov edi, edx
lea ecx, [eax + 1]
rep movsb byte es:[edi], byte [esi]
mov dword [esp], 0x526360
call sub.msvcrt.dll_strlen
lea edx, [eax + 0x5267e0]
cmp eax, 0x103
mov eax, 0x5268e3
cmove edx, eax
mov byte [edx], 0
jmp 0x4391d9
mov edx, 0x5267e0
call fcn.0042ffa8
test eax, eax
je 0x4390e5
mov dword [esp + 4], 0x4a6679
mov dword [esp], 0x5267e0
call sub.msvcrt.dll_strstr
cmp eax, 0x5267e0
je 0x43918e
mov dword [esp + 4], 0x4a667e
mov dword [esp], 0x5267e0
call sub.msvcrt.dll_strstr
cmp eax, 0x5267e0
jne 0x4390e5
mov dword [esp + 4], 0x5267e4
mov dword [esp], 0x5267e0
call sub.msvcrt.dll_strcpy
mov dword [esp], 0x5267e0
call sub.msvcrt.dll_strlen
mov dword [esp + 4], 0x4a6649
mov edx, eax
mov eax, 0x103
mov dword [esp], 0x5267e0
sub eax, edx
mov edx, 2
cmp eax, edx
cmova eax, edx
mov dword [esp + 8], eax
call sub.msvcrt.dll_strncat
lea eax, [ebx - 1]
cmp eax, 0xfffffffd
ja 0x4391eb
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push ecx
mov dword [esp + 4], 2
mov dword [esp], 0x104
call sub.msvcrt.dll_calloc
mov dword [esp + 4], 0x104
mov dword [esp], eax
mov esi, eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
mov edi, dword [sym.imp.KERNEL32.DLL_GetLastError]
push edx
mov ebx, eax
push edx
call edi
mov dword [ebp - 0x4ec], eax
test ebx, ebx
je 0x439272
xor eax, eax
mov dword [esp + 0x14], 0x104
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0x10], 0x526900
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], esi
mov dword [esp + 4], eax
mov dword [esp], 0xfde9
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
sub esp, 0x20
mov ebx, eax
test eax, eax
jne 0x439272
call edi
mov dword [ebp - 0x4ec], eax
test esi, esi
je 0x43927e
mov dword [esp], esi
call sub.msvcrt.dll_free
mov eax, dword [ebp - 0x4ec]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_SetLastError]
push esi
test ebx, ebx
jne 0x4392bf
call fcn.0043f53d
mov dword [esp], str.Could_not_get_system_directory:__s
mov dword [esp + 4], eax
call fcn.0043efa9
movups xmm0, xmmword [str.C:WindowsSyste]
mov dword [0x526910], 0x32336d
movups xmmword [0x526900], xmm0
mov edx, 0x1c
mov eax, 0x5265a0
call fcn.0043015a
test eax, eax
jne 0x439325
call fcn.0043f53d
mov dword [esp], str.Could_not_get_app_data_directory:__s
mov esi, 0x5267e0
mov dword [esp + 4], eax
call fcn.0043efa9
mov dword [esp], 0x5267e0
call sub.msvcrt.dll_strlen
mov edx, 0x5265a0
mov edi, edx
lea ecx, [eax + 1]
rep movsb byte es:[edi], byte [esi]
mov dword [esp], 0x5267e0
call sub.msvcrt.dll_strlen
mov edx, 0x5266a3
cmp eax, 0x103
je 0x439322
lea edx, [eax + 0x5265a0]
mov byte [edx], 0
mov edx, 0x28
mov eax, 0x526480
call fcn.0043015a
test eax, eax
jne 0x43938b
call fcn.0043f53d
mov dword [esp], str.Could_not_get_user_directory:__s
mov esi, 0x5267e0
mov dword [esp + 4], eax
call fcn.0043efa9
mov dword [esp], 0x5267e0
call sub.msvcrt.dll_strlen
mov edx, 0x526480
mov edi, edx
lea ecx, [eax + 1]
rep movsb byte es:[edi], byte [esi]
mov dword [esp], 0x5267e0
call sub.msvcrt.dll_strlen
mov edx, 0x526583
cmp eax, 0x103
je 0x439388
lea edx, [eax + 0x526480]
mov byte [edx], 0
mov dword [esp], 0x526900
mov esi, 0x526900
call sub.msvcrt.dll_strlen
mov edx, 0x5266c0
mov edi, edx
lea ecx, [eax + 1]
rep movsb byte es:[edi], byte [esi]
mov dword [esp], 0x526900
call sub.msvcrt.dll_strlen
mov edx, 0x5267c3
cmp eax, 0x103
je 0x4393c6
lea edx, [eax + 0x5266c0]
xor ecx, ecx
mov byte [edx], 0
mov dword [ebp - 0x424], ecx
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
lea edx, [ebp - 0x424]
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_IsWow64Process]
push ebx
push ebx
cmp dword [ebp - 0x424], 0
je 0x43950a
mov dword [esp + 4], 2
mov dword [esp], 0x104
call sub.msvcrt.dll_calloc
mov dword [esp + 4], 0x104
mov dword [esp], eax
mov esi, eax
call dword [sym.imp.KERNEL32.DLL_GetSystemWindowsDirectoryW]
mov edi, dword [sym.imp.KERNEL32.DLL_GetLastError]
push edx
mov ebx, eax
push edx
call edi
mov dword [ebp - 0x4ec], eax
test ebx, ebx
je 0x439480
xor eax, eax
mov dword [esp + 0x14], 0x104
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0x10], 0x5266c0
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], esi
mov dword [esp + 4], eax
mov dword [esp], 0xfde9
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
sub esp, 0x20
mov ebx, eax
test eax, eax
jne 0x439480
call edi
mov dword [ebp - 0x4ec], eax
test esi, esi
je 0x43948c
mov dword [esp], esi
call sub.msvcrt.dll_free
mov eax, dword [ebp - 0x4ec]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_SetLastError]
push esi
test ebx, ebx
jne 0x4394d3
call fcn.0043f53d
mov dword [esp], str.Could_not_get_Windows_directory:__s
mov dword [esp + 4], eax
call fcn.0043efa9
mov dword [0x5266c4], 0x6f646e69
mov dword [0x5266c0], 0x575c3a43
mov dword [0x5266c7], 0x73776f
mov dword [esp], 0x5266c0
call sub.msvcrt.dll_strlen
mov dword [esp + 4], str.Sysnative
mov edx, eax
mov eax, 0x103
mov dword [esp], 0x5266c0
sub eax, edx
mov edx, 0xb
cmp eax, edx
cmova eax, edx
mov dword [esp + 8], eax
call sub.msvcrt.dll_strncat
mov dword [esp + 4], 0x526360
lea ebx, [ebp - 0x324]
mov dword [esp], str.Cur_dir:__s
call fcn.0043efa9
mov dword [esp + 4], 0x526a20
mov dword [esp], str.App_dir:__s
call fcn.0043efa9
mov dword [esp + 4], 0x5266c0
mov dword [esp], str.Sys_dir:__s
call fcn.0043efa9
mov dword [esp + 4], 0x526480
mov dword [esp], str.Usr_dir:__s
call fcn.0043efa9
mov dword [esp + 4], 0x5265a0
mov dword [esp], str.Dat_dir:__s
call fcn.0043efa9
mov dword [esp + 4], 0x5267e0
mov dword [esp], str.Tmp_dir:__s
call fcn.0043efa9
mov dword [esp + 0xc], 0x526a20
mov dword [esp + 8], str._srufus.app
mov dword [esp + 4], 0x104
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll__snprintf]
mov eax, ebx
mov byte [ebp - 0x221], 0
call fcn.004301f7
mov dword [ebp - 0x500], eax
test eax, eax
je 0x4395f6
mov dword [0x526c70], 1
xor ecx, ecx
mov dword [ebp - 0x4f4], ecx
mov dword [ebp - 0x4f0], ecx
mov dword [ebp - 0x4ec], ecx
mov dword [ebp - 0x504], ecx
mov dword [ebp - 0x4fc], ecx
mov dword [ebp - 0x4f8], ecx
jmp 0x439e3d
cmp dword [0x5273e0], 0
jne 0x439621
mov eax, str.Msvcrt
call fcn.0042e124
mov dword [esp + 4], str.__wgetmainargs
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push edx
push edx
mov dword [0x5273e0], eax
mov eax, dword [0x5273e0]
test eax, eax
je 0x439e2c
lea edx, [ebp - 0x4dc]
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], edx
lea edx, [ebp - 0x4c8]
mov dword [esp + 8], edx
lea edx, [ebp - 0x4c4]
mov dword [esp + 4], edx
lea edx, [ebp - 0x4e0]
mov dword [esp], edx
call eax
mov dword [esp + 4], 4
mov eax, dword [ebp - 0x4e0]
mov dword [esp], eax
call sub.msvcrt.dll_calloc
mov dword [ebp - 0x4f0], eax
test eax, eax
jne 0x439763
xor edi, edi
mov dword [ebp - 0x504], edi
mov dword [ebp - 0x4fc], edi
mov dword [ebp - 0x4f8], edi
mov dword [ebp - 0x4f4], edi
mov dword [ebp - 0x4f0], edi
jmp 0x439756
inc esi
cmp dword [ebp - 0x4e0], esi
jle 0x43977b
mov eax, dword [ebp - 0x4c4]
mov eax, dword [eax + esi*4]
call fcn.0042f155
mov edi, eax
mov eax, dword [ebp - 0x4f0]
mov dword [eax + esi*4], edi
mov dword [esp + 4], 0x4a67e4
mov dword [esp], edi
call sub.msvcrt.dll_strcmp
test eax, eax
mov eax, 0x96
cmovne eax, dword [ebp - 0x4f8]
mov dword [ebp - 0x4f8], eax
mov dword [esp + 4], 0x4a67e7
mov dword [esp], edi
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x439774
mov dword [esp + 4], str.__gui
mov dword [esp], edi
call sub.msvcrt.dll_strcmp
test eax, eax
mov eax, 1
cmove ebx, eax
mov dword [esp + 4], str._InvokerPRAID
mov dword [esp], edi
call sub.msvcrt.dll__stricmp_1
mov dword [ebp - 0x4fc], eax
test eax, eax
jne 0x4396a8
mov dword [0x526c70], 1
xor esi, esi
mov dword [ebp - 0x504], esi
mov dword [ebp - 0x4f4], esi
xor ebx, ebx
mov dword [ebp - 0x4ec], ebx
jmp 0x439e3d
xor ecx, ecx
xor ebx, ebx
xor esi, esi
mov dword [ebp - 0x4f8], ecx
jmp 0x4396a9
mov ebx, 1
jmp 0x439720
mov eax, dword [ebp - 0x4f0]
mov edi, dword [eax]
mov dword [esp], edi
call sub.msvcrt.dll_strlen
lea esi, [edi + eax - 1]
cmp edi, esi
jae 0x43979b
cmp byte [esi], 0x5c
je 0x43979b
dec esi
jmp 0x43978f
mov dword [esp + 4], 0x70
mov dword [esp], esi
call sub.msvcrt.dll_strchr
test eax, eax
jne 0x4397c9
mov dword [esp + 4], 0x50
mov dword [esp], esi
call sub.msvcrt.dll_strchr
test eax, eax
je 0x4397d0
cmp byte [eax + 1], 0x48
je 0x4397d0
mov byte [ebp - 0x4e7], 0x61
test ebx, ebx
jne 0x4399ea
mov dword [esp], 0xffffffff
call dword [sym.imp.KERNEL32.DLL_AttachConsole]
push edx
test eax, eax
je 0x4399ea
mov dword [esp], str.Enabling_console_line_hogger
call fcn.0043efa9
xor eax, eax
mov esi, dword [fcn.00489b20]
mov dword [esp], eax
call esi
mov dword [esp + 4], 0x4a681b
mov dword [esp + 8], eax
mov dword [esp], str.CONIN_
call sub.msvcrt.dll_freopen
mov dword [esp], 1
call esi
mov dword [esp + 4], 0x4a6824
mov dword [esp + 8], eax
mov dword [esp], str.CONOUT_
call sub.msvcrt.dll_freopen
mov dword [esp], 2
call esi
mov dword [esp + 4], 0x4a6824
mov dword [esp + 8], eax
mov dword [esp], str.CONOUT_
call sub.msvcrt.dll_freopen
call dword [sym.imp.msvcrt.dll__flushall]
xor eax, eax
mov dword [esp + 0xc], str.rufus.com
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x4c0]
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0xa
mov dword [esp + 4], 0x1f5
mov eax, dword [0x526d60]
mov dword [esp], eax
call fcn.0043dba5
mov dword [ebp - 0x4f4], eax
test eax, eax
je 0x4399de
xor esi, esi
mov dword [esp + 8], 0x4a6838
xor edi, edi
mov dword [esp], esi
mov dword [esp + 4], 1
call dword [sym.imp.KERNEL32.DLL_CreateMutexA]
sub esp, 0xc
mov esi, eax
xor eax, eax
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], eax
mov dword [esp + 8], 1
mov dword [esp + 4], 0xc0000000
mov dword [esp], str.rufus.com
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
sub esp, 0x1c
mov edi, eax
cmp eax, 0xffffffff
je 0x43994f
xor ecx, ecx
lea eax, [ebp - 0x424]
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x4c0]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x4f4]
mov dword [esp], edi
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
lea eax, [edi - 1]
sub esp, 0x14
cmp eax, 0xfffffffd
ja 0x43994f
mov dword [esp], edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push edx
mov dword [esp + 4], 0x1c
mov dword [esp], 0xa
call sub.msvcrt.dll_calloc
mov edi, eax
test eax, eax
je 0x4399c2
movsx dx, byte [ebx + str.rufus.com]
inc ebx
mov dword [eax], 1
add eax, 0x1c
mov dword [eax - 0x14], 4
mov word [eax - 0x16], dx
cmp ebx, 9
jne 0x439969
mov dword [edi + 0xfc], 1
mov word [edi + 0x100], 0xd
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edi
mov dword [esp], 0xa
call dword [sym.imp.USER32.dll_SendInput]
sub esp, 0xc
mov dword [esp], edi
call sub.msvcrt.dll_free
test esi, esi
jne 0x4399ce
mov dword [ebp - 0x4f4], esi
jmp 0x4399de
mov dword [esp], 0xc8
call dword [sym.imp.KERNEL32.DLL_Sleep]
push eax
jmp 0x4399c6
mov dword [ebp - 0x504], 1
jmp 0x4399f8
xor eax, eax
mov dword [ebp - 0x504], eax
mov dword [ebp - 0x4f4], eax
xor eax, eax
xor edi, edi
mov dword [ebp - 0x4fc], eax
mov dword [ebp - 0x4ec], eax
lea eax, [ebp - 0x4e4]
mov dword [esp + 8], str.ghxf:i:l:w:z:
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x4a4]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x4f0]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x4e0]
mov dword [esp], eax
call fcn.004891d0
cmp eax, 0xffffffff
je 0x439df8
sub eax, 0x61
cmp eax, 0x19
ja case.0x439a51.98
jmp dword [eax*4 + 0x4a71e4]
mov dword [0x526cc8], 1
jmp case.0x439a51.97
mov eax, dword [0x525a68]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov dword [esp + 4], 0x104
mov dword [esp], 1
call sub.msvcrt.dll_calloc
test eax, eax
mov dword [0x525a68], eax
mov dword [ebp - 0x524], eax
je case.0x439a51.97
mov eax, dword [0x52c49c]
call fcn.0042e251
mov dword [esp + 4], 2
mov dword [esp], 0x104
mov ebx, eax
call sub.msvcrt.dll_calloc
mov dword [esp + 4], 0x104
mov esi, eax
lea eax, [ebp - 0x424]
mov dword [esp], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 8], esi
call dword [sym.imp.KERNEL32.DLL_GetFullPathNameW]
mov dword [ebp - 0x520], eax
mov eax, dword [sym.imp.KERNEL32.DLL_GetLastError]
sub esp, 0x10
mov dword [ebp - 0x518], eax
call eax
mov ecx, dword [ebp - 0x520]
mov edx, dword [ebp - 0x524]
mov dword [ebp - 0x510], eax
test ecx, ecx
je 0x439b4f
xor eax, eax
mov dword [esp + 0x14], 0x104
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], esi
mov dword [esp + 4], eax
mov dword [esp], 0xfde9
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
sub esp, 0x20
test eax, eax
jne 0x439b4f
mov eax, dword [ebp - 0x518]
call eax
mov dword [ebp - 0x510], eax
test esi, esi
je 0x439b5b
mov dword [esp], esi
call sub.msvcrt.dll_free
test ebx, ebx
je 0x439b67
mov dword [esp], ebx
call sub.msvcrt.dll_free
mov eax, dword [ebp - 0x510]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_SetLastError]
push eax
mov eax, dword [0x525a68]
call fcn.0042f0e6
test al, 0x10
je 0x439bb3
mov eax, dword [0x525a68]
mov dword [esp], str.Could_not_find_image__s_n
mov dword [esp + 4], eax
call sub.msvcrt.dll_printf
mov eax, dword [0x525a68]
mov dword [esp], eax
call sub.msvcrt.dll_free
xor eax, eax
mov dword [0x525a68], eax
jmp case.0x439a51.97
mov dword [0x5275a0], 1
jmp case.0x439a51.97
mov edx, dword [0x52c49c]
movzx eax, byte [edx]
sub eax, 0x30
cmp eax, 9
ja 0x439bf0
xor esi, esi
mov dword [esp], edx
mov dword [esp + 8], esi
mov dword [esp + 4], esi
call sub.msvcrt.dll_strtol
mov dword [ebp - 0x50c], eax
jmp case.0x439a51.97
mov eax, dword [ebp - 0x4ec]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [0x52c49c]
mov dword [ebp - 0x4ec], eax
test eax, eax
je case.0x439a51.97
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__strdup]
mov dword [ebp - 0x4ec], eax
jmp case.0x439a51.97
mov edx, dword [0x52c49c]
movzx eax, byte [edx]
sub eax, 0x30
cmp eax, 9
ja 0x439c4f
xor ebx, ebx
mov dword [esp], edx
mov dword [esp + 8], ebx
mov dword [esp + 4], ebx
call sub.msvcrt.dll_strtol
mov dword [0x492a3c], eax
jmp 0x439c8e
xor ebx, ebx
mov edx, dword [ebx*4 + 0x48cda0]
test edx, edx
jne 0x439c61
mov edx, 0x4a4e9f
mov eax, dword [0x52c49c]
test eax, eax
jne 0x439c6f
mov eax, 0x4a4e9f
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__stricmp]
test eax, eax
jne 0x439c88
mov dword [0x492a3c], ebx
jmp 0x439c8e
inc ebx
cmp ebx, 9
jne 0x439c51
mov eax, dword [0x492a3c]
inc eax
cmp eax, 9
jbe 0x439ca3
mov dword [0x492a3c], 0xffffffff
mov eax, dword [0x492a3c]
mov dword [0x492a40], eax
jmp case.0x439a51.97
mov eax, dword [0x52c49c]
mov dword [esp], eax
call sub.msvcrt.dll_atoi
mov dword [ebp - 0x4f8], eax
jmp case.0x439a51.97
xor edx, edx
xor eax, eax
lea ebx, [ebp - 0x424]
xor esi, esi
mov dword [esp + 8], edx
mov dword [esp + 4], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], ebx
mov eax, dword [ebp - 0x4f0]
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__splitpath]
mov dword [esp + 4], ebx
mov dword [esp], str._nUsage:__s___x____g____h____f_FILESYSTEM____i_PATH____l_LOCALE____w_TIMEOUT__n
call sub.msvcrt.dll_printf
mov dword [esp], str.___x____extra_devs
call sub.msvcrt.dll_puts
mov dword [esp], str._____List_extra_devices__such_as_USB_HDDs
call sub.msvcrt.dll_puts
mov dword [esp], str.___g____gui
call sub.msvcrt.dll_puts
mov dword [esp], str._____Start_in_GUI_mode__disable_the_rufus.com_commandline_hogger_
call sub.msvcrt.dll_puts
mov dword [esp], str.___i_PATH____isoPATH
call sub.msvcrt.dll_puts
mov dword [esp], str._____Select_the_ISO_image_pointed_by_PATH_to_be_used_on_startup
call sub.msvcrt.dll_puts
mov dword [esp], str.___l_LOCALE____localeLOCALE
call sub.msvcrt.dll_puts
mov dword [esp], str._____Select_the_locale_to_be_used_on_startup
call sub.msvcrt.dll_puts
mov dword [esp], str.___f_FILESYSTEM____filesystemFILESYSTEM
call sub.msvcrt.dll_puts
mov dword [esp], str._____Preselect_the_file_system_to_be_preferred_when_formatting
call sub.msvcrt.dll_puts
mov dword [esp], str.___w_TIMEOUT____waitTIMEOUT
call sub.msvcrt.dll_puts
mov dword [esp], str._____Wait_TIMEOUT_tens_of_seconds_for_the_global_application_mutex_to_be_released.
call sub.msvcrt.dll_puts
mov dword [esp], str._____Used_when_launching_a_newer_version_of_Rufus_from_a_running_application.
call sub.msvcrt.dll_puts
mov dword [esp], str.___h____help
call sub.msvcrt.dll_puts
mov dword [esp], str._____This_usage_guide.
call sub.msvcrt.dll_puts
xor ecx, ecx
mov dword [ebp - 0x4f8], ecx
jmp 0x43b772
xor eax, eax
mov dword [esp + 8], 0x10
mov dword [esp + 4], eax
mov eax, dword [0x52c49c]
mov dword [esp], eax
call sub.msvcrt.dll_strtol
mov dword [ebp - 0x4fc], eax
jmp case.0x439a51.97
mov edi, 1
jmp case.0x439a51.97
test edi, edi
je 0x439e3d
mov dword [esp], str.Command_line_arguments:
call fcn.0043efa9
cmp dword [ebp - 0x4e0], edi
jle 0x439e3d
mov eax, dword [ebp - 0x4f0]
mov eax, dword [eax + edi*4]
mov dword [esp], 0x4a4ea6
inc edi
mov dword [esp + 4], eax
call fcn.0043efa9
jmp 0x439e08
mov dword [esp], str.Could_not_access_UTF_16_args
call fcn.0043efa9
jmp 0x439683
cmp dword [0x526c70], 0
je 0x439e52
mov dword [esp], str.AppStore_version_detected
call fcn.0043efa9
lea ebx, [ebp - 0x11c]
mov dword [esp + 0xc], 0x526a20
mov dword [esp], ebx
mov dword [esp + 8], str._srufus.ini
mov dword [esp + 4], 0x104
call dword [sym.imp.msvcrt.dll__snprintf]
lea edx, [ebp - 0x4e7]
mov eax, ebx
mov byte [ebp - 0x19], 0
call fcn.0042ff53
mov ebx, eax
xor eax, eax
mov dword [esp + 8], eax
mov dword [esp + 4], eax
mov dword [esp], eax
call fcn.00429dcf
mov edx, dword [0x492898]
test edx, edx
jne 0x439ead
mov edx, 0x4a4e9f
test eax, eax
jne 0x439eb6
mov eax, 0x4a4e9f
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.msvcrt.dll_strcmp
mov dword [ebp - 0x510], eax
test ebx, ebx
je 0x439f1d
lea eax, [ebp - 0x11c]
mov esi, 0x526a20
mov dword [0x525a6c], eax
mov dword [esp], 0x526a20
call sub.msvcrt.dll_strlen
mov edx, 0x5265a0
mov edi, edx
lea ecx, [eax + 1]
rep movsb byte es:[edi], byte [esi]
mov dword [esp], 0x526a20
call sub.msvcrt.dll_strlen
mov edx, 0x5266a3
cmp eax, 0x103
je 0x439f12
lea edx, [eax + 0x5265a0]
mov byte [edx], 0
mov dword [esp], ebx
call sub.msvcrt.dll_fclose
cmp dword [0x525a6c], 0
mov edx, str.INI_file
mov eax, str.registry
mov dword [esp], str.Will_use_settings_from__s
cmovne eax, edx
mov dword [esp + 4], eax
call fcn.0043efa9
mov eax, str.Locale
call fcn.00430bd8
cmp byte [eax], 0
je 0x439f6f
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__strdup]
mov dword [ebp - 0x4ec], eax
mov dword [esp + 4], eax
mov dword [esp], str.found_locale__s
call fcn.0043efa9
mov eax, str.ShowAdvancedDriveProperties
call fcn.00430cb0
mov dword [0x526cbc], eax
mov eax, str.ShowAdvancedFormatOptions
call fcn.00430cb0
mov dword [0x526cb8], eax
mov eax, str.PreserveTimestamps
call fcn.00430cb0
mov dword [0x526c9c], eax
mov eax, str.UseProperSizeUnits
call fcn.00430cb0
test eax, eax
sete al
xor edi, edi
movzx eax, al
mov dword [0x526ca0], eax
mov dword [esp], edi
call fcn.004091bb
mov dword [0x492a0c], eax
mov eax, str.UseVds
call fcn.00430cb0
test eax, eax
je 0x439fdc
xor eax, eax
cmp dword [0x492a0c], 0
setne al
mov dword [0x526c78], eax
mov eax, str.EnableUsbDebug
call fcn.00430cb0
cmp eax, 1
mov dword [0x526ca4], eax
sbb eax, eax
and eax, 2
inc eax
mov dword [0x494024], eax
mov eax, str.DisableFakeDrivesCheck
call fcn.00430cb0
test eax, eax
sete al
movzx eax, al
mov dword [0x526cb0], eax
mov eax, str.EnableWindowsDualUefiBiosMode
call fcn.00430cb0
mov dword [0x526cb4], eax
mov eax, str.ForceLargeFat32Formatting
call fcn.00430cb0
mov dword [0x526ca8], eax
mov eax, str.EnableVmdkDetection
call fcn.00430cb0
mov dword [0x526cac], eax
mov eax, str.EnableFileIndexing
call fcn.00430cb0
mov dword [0x526c88], eax
mov eax, str.DisableVHDs
call fcn.00430cb0
test eax, eax
sete al
movzx eax, al
mov dword [0x492a10], eax
mov eax, str.EnableExtraHashes
call fcn.00430cb0
mov dword [0x512ac0], eax
mov eax, str.ExpertMode
call fcn.00430cb0
mov dword [0x526c64], eax
mov eax, str.IgnoreBootMarker
call fcn.00430cb0
mov dword [0x526c74], eax
mov eax, str.PersistentLog
call fcn.00430cb0
mov dword [0x526c6c], eax
mov eax, 0x4a6cc3
call fcn.00430bd8
mov dword [0x5259d8], eax
mov eax, str.WindowsUserExperienceOptions
call fcn.00430cdc
mov ecx, eax
mov edx, eax
shr ecx, 0x10
je 0x43a0d9
mov eax, ecx
and ecx, edx
not eax
and eax, dword [0x492b20]
or eax, ecx
mov dword [0x492b20], eax
mov eax, str.DefaultThreadPriority
call fcn.00430cdc
xor ecx, ecx
inc eax
mov dword [0x4929fc], eax
mov dword [esp], ecx
call dword [sym.imp.USER32.dll_GetDC]
push ebx
mov ebx, eax
mov dword [esp + 4], 0x58
mov dword [esp], eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
fld dword [0x4a7320]
push esi
push esi
mov dword [ebp - 0x500], eax
lea eax, [ebx - 1]
fidivr dword [ebp - 0x500]
fstp dword [0x492a08]
cmp eax, 0xfffffffd
ja 0x43a13b
xor eax, eax
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.USER32.dll_ReleaseDC]
push edx
push edx
xor eax, eax
lea ebx, [ebp - 0x220]
mov dword [esp], eax
call fcn.0042269f
mov dword [esp + 0x10], str.rufus.loc
mov esi, dword [sym.imp.msvcrt.dll__snprintf]
mov dword [esp + 0xc], 0x526a20
mov dword [esp + 8], 0x4a6cfa
mov dword [esp + 4], 0x104
mov dword [esp], ebx
call esi
mov eax, ebx
mov byte [ebp - 0x11d], 0
call fcn.0042f0e6
inc eax
jne 0x43a2fd
mov dword [esp], str.loc_file_not_found_in_current_directory___embedded_one_will_be_used
call fcn.0043efa9
xor eax, eax
mov dword [esp + 0xc], str.embedded.loc
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x4d4]
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0xa
mov dword [esp + 4], 0x1f4
mov eax, dword [0x526d60]
mov dword [esp], eax
call fcn.0043dba5
mov esi, eax
mov eax, ebx
call fcn.00430066
test eax, eax
je 0x43a1e2
cmp byte [ebp - 0x220], 0
jne 0x43a214
call fcn.0043f53d
mov dword [esp], str.FATAL:_Unable_to_create_temp_loc_file:__s
mov dword [esp + 4], eax
call fcn.0043efa9
mov dword [esp + 0xc], 0x1010
mov dword [esp + 8], str.Fatal_error
mov dword [esp + 4], str.Unable_to_create_temporary_localization_file._This_application_will_now_exit.
jmp 0x43a2ac
mov dword [esp], pe_nt_image_headers32
mov ecx, 2
mov edx, 0xc0000000
mov eax, ebx
call fcn.00430226
mov edi, eax
cmp eax, 0xffffffff
jne 0x43a266
call fcn.0043f53d
mov dword [esp], str.FATAL:_Unable_to_extract_loc_file__s:__s
mov dword [esp + 8], eax
lea eax, [ebp - 0x220]
mov dword [esp + 4], eax
call fcn.0043efa9
lea eax, [edi - 1]
cmp eax, 0xfffffffd
ja 0x43a294
mov dword [esp], edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push eax
jmp 0x43a294
lea eax, [ebp - 0x4cc]
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x4d4]
mov dword [esp + 4], esi
mov dword [esp + 8], eax
mov dword [esp], edi
call fcn.00440072
test eax, eax
je 0x43a233
jmp 0x43a2cf
mov dword [esp + 0xc], 0x1010
mov dword [esp + 8], str.Fatal_error
mov dword [esp + 4], str.Unable_to_extract_localization_file._This_application_will_now_exit.
xor edi, edi
xor esi, esi
mov dword [esp], edi
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
mov dword [ebp - 0x4f8], eax
sub esp, 0x10
mov dword [ebp - 0x500], eax
jmp 0x43b772
mov dword [esp + 4], ebx
mov dword [esp], str.localization:_extracted_data_to__s
call fcn.0043efa9
lea eax, [edi - 1]
cmp eax, 0xfffffffd
jbe 0x43a2f1
xor esi, esi
mov dword [ebp - 0x500], esi
jmp 0x43a35e
mov dword [esp], edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push ebx
jmp 0x43a2e7
mov eax, dword [0x528740]
mov edx, 0xffc
mov dword [esp + 0xc], ebx
mov dword [esp + 8], str.Using_external_loc_file__s
sub edx, eax
add eax, 0x527740
mov dword [esp + 4], edx
mov dword [esp], eax
call esi
mov byte [0x52873b], 0
mov dword [esp], 0x527740
call sub.msvcrt.dll_strlen
mov dword [ebp - 0x500], 1
lea edx, [eax + 2]
mov byte [eax + 0x527740], 0xd
mov dword [0x528740], edx
mov byte [eax + 0x527741], 0xa
mov byte [eax + 0x527742], 0
lea eax, [ebp - 0x220]
mov dword [esp], eax
call fcn.00427767
test eax, eax
jne 0x43a3a7
mov dword [esp], str.FATAL:_Could_not_access_locale_
call fcn.0043efa9
xor ecx, ecx
mov dword [esp + 0xc], 0x1010
mov dword [esp + 8], str.Fatal_error
mov dword [esp + 4], str.The_locale_data_is_missing_or_invalid._This_application_will_now_exit.
mov dword [esp], ecx
call dword [sym.imp.USER32.dll_MessageBoxA]
sub esp, 0x10
jmp 0x43a4b2
cmp dword [ebp - 0x4ec], 0
mov dword [esp + 4], 1
jne 0x43a3c8
mov eax, dword [ebp - 0x50c]
mov dword [esp], eax
call fcn.00422c77
jmp 0x43a3d6
mov eax, dword [ebp - 0x4ec]
mov dword [esp], eax
call fcn.00422cf3
mov dword [0x526d28], eax
test eax, eax
je 0x43a370
mov dword [esp], eax
call fcn.00422ffa
mov word [0x492a1c], ax
mov dword [esp], 0x5275c0
call fcn.0043c9fc
cmp dword [0x5275c0], 0x61
jbe 0x43a416
cmp dword [ebp - 0x4fc], 0
je 0x43a416
mov eax, dword [ebp - 0x4fc]
mov dword [0x5275c0], eax
cmp dword [0x5275c0], 0x61
ja 0x43a4b9
mov eax, dword [0x526d28]
mov dword [esp + 4], eax
lea eax, [ebp - 0x220]
mov dword [esp], eax
call fcn.00427b97
mov eax, dword [0x526d28]
movzx edi, word [0x492a1c]
mov eax, dword [eax + 4]
and eax, 1
cmp eax, 1
mov dword [0x526cd4], eax
mov dword [esp], 0xcdd
sbb ebx, ebx
and ebx, 0xffe80000
add ebx, 0x181010
call fcn.0042291e
xor edx, edx
cmp dword [0x5275c0], 0x61
mov dword [esp], 0xcde
mov esi, eax
sete al
sete dl
movzx eax, al
lea edx, [edx*4 + 0x12]
add eax, 2
mov dword [esp + 8], edx
mov dword [esp + 4], eax
call fcn.0042291e
mov dword [esp + 4], edi
mov edx, eax
mov ecx, esi
xor eax, eax
mov dword [esp], ebx
call fcn.0042f066
xor esi, esi
jmp 0x43a66f
call fcn.0043e890
test eax, eax
jne 0x43a52c
mov dword [esp], str.FATAL:_No_administrative_privileges_
call fcn.0043efa9
mov eax, dword [0x526d28]
mov dword [esp + 4], eax
lea eax, [ebp - 0x220]
mov dword [esp], eax
call fcn.00427b97
mov eax, dword [0x526d28]
movzx edi, word [0x492a1c]
mov eax, dword [eax + 4]
and eax, 1
mov dword [0x526cd4], eax
cmp eax, 1
mov dword [esp], 0xcd8
sbb ebx, ebx
and ebx, 0xffe80000
add ebx, 0x181010
call fcn.0042291e
mov dword [esp], 0xcd9
mov esi, eax
call fcn.0042291e
jmp 0x43a4a0
cmp dword [ebp - 0x508], 0
je 0x43a569
mov eax, dword [ebp - 0x508]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
cmp eax, 2
jne 0x43a569
mov eax, dword [ebp - 0x508]
cmp byte [eax], 0x2f
jne 0x43a569
cmp byte [eax + 1], 0x57
mov eax, 0x96
cmovne eax, dword [ebp - 0x4f8]
mov dword [ebp - 0x4f8], eax
xor edx, edx
mov dword [esp + 8], str.Global_Rufus
mov dword [esp + 4], 1
mov dword [esp], edx
call dword [sym.imp.KERNEL32.DLL_CreateMutexA]
sub esp, 0xc
mov esi, eax
cmp dword [ebp - 0x4f8], 0
jle 0x43a598
test esi, esi
jne 0x43a59e
jmp 0x43a5fc
test esi, esi
jne 0x43a5eb
jmp 0x43a5fc
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xb7
jne 0x43a5eb
mov dword [esp], esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push eax
mov dword [esp], 0x64
call dword [sym.imp.KERNEL32.DLL_Sleep]
push eax
xor eax, eax
mov dword [esp + 8], str.Global_Rufus
mov dword [esp + 4], 1
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_CreateMutexA]
dec dword [ebp - 0x4f8]
sub esp, 0xc
mov esi, eax
jmp 0x43a589
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xb7
jne 0x43a67c
mov eax, dword [0x526d28]
mov dword [esp + 4], eax
lea eax, [ebp - 0x220]
mov dword [esp], eax
call fcn.00427b97
mov eax, dword [0x526d28]
movzx edi, word [0x492a1c]
mov eax, dword [eax + 4]
and eax, 1
mov dword [0x526cd4], eax
cmp eax, 1
mov dword [esp], 0xbb9
sbb ebx, ebx
and ebx, 0xffe80000
add ebx, 0x181010
call fcn.0042291e
mov dword [ebp - 0x4f8], eax
mov dword [esp], 0xbba
call fcn.0042291e
mov dword [esp + 4], edi
mov dword [esp], ebx
mov ecx, dword [ebp - 0x4f8]
mov edx, eax
xor eax, eax
call fcn.0042f066
xor eax, eax
mov dword [ebp - 0x4f8], eax
jmp 0x43b772
mov eax, dword [ebp - 0x514]
xor edi, edi
mov dword [0x526d60], eax
mov dword [esp + 4], 6
mov dword [esp], edi
call dword [sym.imp.ole32.dll_CoInitializeEx]
push eax
push eax
mov eax, str.Riched20
call fcn.0042e124
test eax, eax
jne 0x43a6bf
call fcn.0043f53d
mov dword [esp], str.Could_not_load_RichEdit_library___some_dialogs_may_not_display:__s
mov dword [esp + 4], eax
call fcn.0043efa9
call fcn.0042cff6
xor ebx, ebx
mov dword [esp + 0x10], 0x9e
mov dword [esp + 0xc], str.NoDriveTypeAutorun
mov dword [esp + 8], str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
mov dword [esp + 4], 0x5275a8
mov dword [esp], ebx
call fcn.0043e48f
mov dword [ebp - 0x4f8], eax
lea eax, [ebp - 0x4d8]
mov dword [esp], eax
call fcn.004087f5
test eax, eax
jne 0x43a71e
mov dword [esp], str.Could_not_get_AutoMount_status
call fcn.0043efa9
mov dword [ebp - 0x4d8], 1
jmp 0x43a74f
cmp dword [ebp - 0x4d8], 0
jne 0x43a74f
mov dword [esp], str.AutoMount_was_detected_as_disabled___temporarily_re_enabling_it
call fcn.0043efa9
mov dword [esp], 1
call fcn.0040875b
test eax, eax
jne 0x43a74f
mov dword [esp], str.Failed_to_enable_AutoMount
call fcn.0043efa9
call fcn.004024cc
lea ebx, [ebp - 0x324]
mov dword [0x4e207c], eax
call fcn.004024e7
mov dword [0x4e2078], eax
mov dword [esp], ebx
mov dword [esp + 0xc], 0x5266c0
mov dword [esp + 8], str._sdismFfuProvider.dll
mov dword [esp + 4], 0x104
call dword [sym.imp.msvcrt.dll__snprintf]
mov eax, ebx
mov byte [ebp - 0x221], 0
call fcn.0042e251
xor ecx, ecx
mov ebx, eax
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__waccess]
test ebx, ebx
je 0x43a7c1
mov dword [ebp - 0x4fc], eax
mov dword [esp], ebx
call sub.msvcrt.dll_free
mov eax, dword [ebp - 0x4fc]
cmp dword [ebp - 0x510], 0
sete dl
cmp dword [ebp - 0x51c], 0
sete cl
or edx, ecx
test eax, eax
sete al
movzx edi, dl
xor edx, edx
xor ebx, ebx
movzx eax, al
mov dword [ebp - 0x508], edx
mov dword [0x526c68], eax
mov dword [ebp - 0x4fc], edx
mov dword [ebp - 0x50c], edx
mov edx, dword [0x526d28]
mov eax, dword [0x528740]
mov edx, dword [edx + 0x14]
mov dword [esp + 8], str.Localization_set_to__s
mov dword [esp + 0xc], edx
mov edx, 0xffc
sub edx, eax
add eax, 0x527740
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__snprintf]
mov byte [0x52873b], 0
mov dword [esp], 0x527740
call sub.msvcrt.dll_strlen
mov byte [0x492a1e], 1
mov byte [eax + 0x527740], 0xd
lea edx, [eax + 2]
mov byte [eax + 0x527741], 0xa
mov byte [eax + 0x527742], 0
mov eax, dword [0x526d28]
mov dword [0x528740], edx
mov eax, dword [eax + 4]
mov byte [0x5259e0], 0
and eax, 1
mov dword [0x526cd4], eax
xor eax, eax
mov dword [0x527550], eax
mov eax, dword [0x5259dc]
mov dword [esp], eax
call sub.msvcrt.dll_free
xor eax, eax
mov dword [0x5259dc], eax
xor eax, eax
cmp dword [0x526cd4], 0
setne al
mov dword [esp], eax
call dword [sym.imp.USER32.dll_SetProcessDefaultLayout]
push eax
mov eax, dword [0x526d28]
mov dword [esp + 4], eax
lea eax, [ebp - 0x220]
mov dword [esp], eax
call fcn.00427b97
test eax, eax
je 0x43a91e
mov eax, dword [0x526d28]
mov ecx, dword [eax + 0x14]
mov eax, dword [0x525a6c]
test eax, eax
je 0x43a8f2
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], str.Locale
call fcn.004280dd
jmp 0x43a91e
xor eax, eax
test ecx, ecx
je 0x43a90c
mov dword [esp], ecx
mov dword [ebp - 0x510], ecx
call sub.msvcrt.dll_strlen
mov ecx, dword [ebp - 0x510]
mov dword [esp], eax
mov edx, 1
mov eax, str.Locale
call fcn.0043082e
test edi, edi
je 0x43a932
test ebx, ebx
je 0x43a998
mov dword [esp], ebx
call dword [sym.imp.USER32.dll_DestroyWindow]
push eax
jmp 0x43a998
movzx eax, word [0x492a1c]
cmp dword [0x526cd4], 1
sbb edi, edi
mov dword [ebp - 0x510], eax
and edi, 0xffe80000
mov dword [esp], 0xcdf
add edi, 0x181034
call fcn.0042291e
mov dword [ebp - 0x518], eax
mov dword [esp], 0xce0
call fcn.0042291e
mov edx, eax
mov eax, dword [ebp - 0x510]
mov dword [esp], edi
mov dword [esp + 4], eax
mov ecx, dword [ebp - 0x518]
xor eax, eax
call fcn.0042f066
cmp eax, 6
je 0x43a922
jmp 0x43b772
xor eax, eax
mov dword [esp + 0xc], 0x4337f3
mov dword [esp + 8], eax
mov dword [esp + 4], 0x65
mov eax, dword [ebp - 0x514]
mov dword [esp], eax
call fcn.00445c4f
mov ebx, eax
test eax, eax
jne 0x43a9f9
cmp dword [0x526cd4], 1
movzx edx, word [0x492a1c]
mov ecx, str.DialogBox_failure
sbb eax, eax
and eax, 0xffe80000
mov dword [esp + 4], edx
mov edx, str.Could_not_create_Window
add eax, 0x181010
mov dword [esp], eax
xor eax, eax
call fcn.0042f066
jmp 0x43b772
mov eax, dword [0x492a2c]
cmp eax, 0xffff0001
jl 0x43aa3f
mov edx, dword [0x492a30]
cmp edx, 0xffff0001
jl 0x43aa3f
xor ecx, ecx
xor edi, edi
mov dword [esp + 0x18], 1
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov dword [esp], ebx
call dword [sym.imp.USER32.dll_SetWindowPos]
sub esp, 0x1c
xor edi, edi
mov dword [esp + 8], 1
mov dword [esp + 0xc], edi
mov edi, dword [sym.imp.USER32.dll_ChangeWindowMessageFilterEx]
mov dword [esp + 4], 0x233
mov dword [esp], ebx
call edi
xor eax, eax
sub esp, 0x10
mov dword [esp + 0xc], eax
mov dword [esp + 8], 1
mov dword [esp + 4], 0x4a
mov dword [esp], ebx
call edi
xor eax, eax
sub esp, 0x10
mov dword [esp + 0xc], eax
mov dword [esp + 8], 1
mov dword [esp + 4], 0x49
mov dword [esp], ebx
call edi
sub esp, 0x10
call fcn.00447162
call fcn.0044737d
test eax, eax
jne 0x43aab9
mov dword [esp], str.Warning:_Could_not_set_alert_prompt_hook
call fcn.0043efa9
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.USER32.dll_ShowWindow]
push ecx
push ecx
mov dword [esp], ebx
call dword [sym.imp.USER32.dll_UpdateWindow]
push edi
xor ecx, ecx
lea eax, [ebp - 0x4c0]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ecx
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetMessageW]
sub esp, 0x10
test eax, eax
je 0x43b719
xor edi, edi
cmp dword [ebp - 0x4bc], 0x104
jne 0x43ab23
xor eax, eax
test byte [ebp - 0x4b1], 0x20
sete al
cmp dword [ebp - 0x4b8], 0x12
mov edi, eax
jne 0x43ab48
mov dword [esp], 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
push edx
mov eax, 1
cmovns eax, dword [ebp - 0x4fc]
mov dword [ebp - 0x4fc], eax
jmp 0x43ab52
mov dword [ebp - 0x508], 1
mov eax, dword [0x526cf8]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
push ecx
test eax, eax
je 0x43abaa
mov dword [esp], 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
push edx
test ax, ax
jns 0x43abaa
cmp dword [ebp - 0x4bc], 0x100
jne 0x43abaa
cmp dword [ebp - 0x4b8], 0x41
jne 0x43abaa
xor ecx, ecx
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], ecx
mov dword [esp + 4], 0xb1
mov eax, dword [0x526d00]
jmp 0x43ac17
test edi, edi
je 0x43abc1
cmp dword [ebp - 0x4b8], 0x11
jne 0x43abc1
mov eax, dword [0x492a14]
mov dword [0x5273dc], eax
cmp dword [0x5273dc], 0
je 0x43abf6
cmp dword [ebp - 0x4b8], 0x4c
jne 0x43ac28
xor ecx, ecx
mov dword [0x5273dc], ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], 0x41e
mov dword [esp + 4], 0x111
mov eax, dword [0x526d5c]
jmp 0x43ac17
mov dword [esp], 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
push edx
test ax, ax
jns 0x43ac28
cmp dword [ebp - 0x4bc], 0x100
jne 0x43ac28
jmp 0x43abca
mov dword [esp], eax
call dword [sym.imp.USER32.dll_SendMessageW]
sub esp, 0x10
jmp 0x43aad6
cmp dword [0x5273dc], 0
je 0x43ac68
cmp dword [ebp - 0x4b8], 0x50
jne 0x43ac87
xor edx, edx
cmp dword [0x526c6c], 0
mov eax, str.PersistentLog
sete dl
mov dword [0x526c6c], edx
call fcn.00430992
mov edi, dword [0x526c6c]
mov dword [esp], 0xd08
jmp 0x43b708
mov dword [esp], 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
push edx
test ax, ax
jns 0x43ac87
cmp dword [ebp - 0x4bc], 0x100
je 0x43ac31
test edi, edi
jne 0x43ac9f
mov edx, dword [ebp - 0x4bc]
cmp edx, 0x104
jne 0x43ad76
jmp 0x43acb8
cmp dword [ebp - 0x4b8], 0x11
je 0x43aad6
xor eax, eax
mov dword [0x5273dc], eax
jmp 0x43aad6
mov eax, dword [ebp - 0x4b8]
lea ecx, [eax - 0x6b]
and ecx, 0xfffffffd
je 0x43acd5
lea ecx, [eax - 0xbb]
and ecx, 0xfffffffd
jne 0x43ad76
mov ecx, dword [0x4929fc]
cmp eax, 0x6b
je 0x43ace7
cmp eax, 0xbb
jne 0x43acf3
cmp ecx, 1
jg 0x43ad4a
mov edx, 1
jmp 0x43acfb
or edx, 0xffffffff
cmp ecx, 0xffffffff
jl 0x43ad4a
add edx, ecx
mov eax, str.DefaultThreadPriority
mov dword [0x4929fc], edx
dec edx
call fcn.00430f18
mov eax, dword [0x526ce8]
test eax, eax
je 0x43ad2c
mov edx, dword [0x4929fc]
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.KERNEL32.DLL_SetThreadPriority]
push eax
push eax
mov eax, dword [0x52a8e0]
mov edx, dword [0x4929fc]
test eax, eax
je 0x43ad4a
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_SetThreadPriority]
push eax
push eax
mov eax, dword [0x4929fc]
xor edi, edi
mov dword [esp + 0xc], 0xcf6
mov dword [esp + 8], 0xdac
mov dword [esp + 0x10], eax
mov dword [esp + 4], edi
mov dword [esp], edi
call fcn.00422ac2
jmp 0x43aad6
cmp dword [0x492a14], 0
jne 0x43ba34
cmp edx, 0x104
jne 0x43b4b5
mov eax, dword [ebp - 0x4b8]
cmp eax, 0xbe
jne 0x43adda
mov eax, dword [0x526ca4]
xor edx, edx
test eax, eax
sete dl
cmp eax, 1
sbb eax, eax
mov dword [0x526ca4], edx
and eax, 0xfffffffe
add eax, 3
mov dword [0x494024], eax
mov eax, str.EnableUsbDebug
call fcn.00430992
mov edi, dword [0x526ca4]
mov dword [esp], 0xcc6
jmp 0x43b424
cmp eax, 0xbc
jne 0x43ae05
xor edx, edx
cmp dword [0x492a18], 0
sete dl
mov dword [0x492a18], edx
mov dword [ebp - 0x510], edx
mov dword [esp], 0xcd2
jmp 0x43b488
cmp eax, 0x42
jne 0x43ae3d
xor eax, eax
cmp dword [0x526cb0], 0
sete al
setne dl
mov dword [0x526cb0], eax
movzx edx, dl
mov eax, str.DisableFakeDrivesCheck
call fcn.00430992
mov edi, dword [0x526cb0]
mov dword [esp], 0xcb8
jmp 0x43b708
cmp eax, 0x43
jne 0x43ae75
xor ecx, ecx
mov dword [esp + 4], 0x147
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ecx
mov eax, dword [0x526d20]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_SendMessageW]
sub esp, 0x10
test eax, eax
js 0x43aad6
mov dword [esp], eax
jmp 0x43b295
cmp eax, 0x44
jne 0x43afa1
lea edi, [ebp - 0x324]
mov dword [esp + 0x10], 0x4a4f69
mov dword [esp + 0xc], 0x5265a0
mov dword [esp + 8], 0x4a70b8
mov dword [esp + 4], 0x104
mov dword [esp], edi
call dword [sym.imp.msvcrt.dll__snprintf]
xor eax, eax
mov byte [ebp - 0x221], 0
mov dword [esp], eax
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], 0xcc0
mov dword [esp + 8], 0xdac
mov dword [esp + 4], 1
call fcn.00422ac2
mov dword [esp], edi
call sub.msvcrt.dll_strlen
mov dword [esp + 4], 2
lea ecx, [eax + 2]
mov dword [esp], ecx
mov dword [ebp - 0x510], ecx
call sub.msvcrt.dll_calloc
mov ecx, dword [ebp - 0x510]
mov dword [ebp - 0x420], 3
mov word [ebp - 0x414], 0x414
mov edx, eax
xor eax, eax
mov dword [ebp - 0x424], eax
xor eax, eax
mov dword [ebp - 0x418], eax
xor eax, eax
mov dword [ebp - 0x412], eax
mov dword [ebp - 0x40e], eax
mov dword [ebp - 0x40a], eax
xor eax, eax
mov dword [ebp - 0x41c], edx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ecx
mov dword [ebp - 0x510], edx
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], edi
mov dword [esp + 4], eax
mov dword [esp], 0xfde9
call dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
lea eax, [ebp - 0x424]
sub esp, 0x18
mov dword [esp], eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
push edx
mov edx, dword [ebp - 0x510]
test edx, edx
je 0x43af92
mov dword [esp], edx
call sub.msvcrt.dll_free
mov dword [0x527588], 1
jmp 0x43aad6
cmp eax, 0x45
jne 0x43afe7
xor edx, edx
cmp dword [0x526cb4], 0
mov eax, str.EnableWindowsDualUefiBiosMode
sete dl
mov dword [0x526cb4], edx
call fcn.00430992
mov edi, dword [0x526cb4]
mov dword [esp], 0xcc2
call fcn.0042291e
mov edx, edi
call fcn.0042e015
xor eax, eax
call fcn.0042e5a3
jmp 0x43aad6
cmp eax, 0x46
jne 0x43b053
xor edx, edx
cmp dword [0x526cc8], 0
sete dl
xor edi, edi
mov dword [0x526cc8], edx
mov dword [ebp - 0x510], edx
mov dword [esp], 0xcb5
call fcn.0042291e
mov edx, dword [ebp - 0x510]
call fcn.0042e015
mov dword [esp], edi
call fcn.004031f2
xor eax, eax
cmp dword [0x526cc8], 0
mov dword [esp + 4], 0x3fe
setne al
mov dword [esp + 8], eax
mov eax, dword [0x526d5c]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_CheckDlgButton]
sub esp, 0xc
jmp 0x43aad6
cmp eax, 0x47
jne 0x43b08b
xor eax, eax
cmp dword [0x492a10], 0
sete al
setne dl
mov dword [0x492a10], eax
movzx edx, dl
mov eax, str.DisableVHDs
call fcn.00430992
mov edi, dword [0x492a10]
mov dword [esp], 0xcec
jmp 0x43b424
cmp eax, 0x48
jne 0x43b0be
xor edx, edx
cmp dword [0x512ac0], 0
mov eax, str.EnableExtraHashes
sete dl
mov dword [0x512ac0], edx
call fcn.00430992
mov edi, dword [0x512ac0]
mov dword [esp], 0xcf0
jmp 0x43b708
cmp eax, 0x49
jne 0x43b131
xor edx, edx
cmp dword [0x491b98], 0
sete dl
mov dword [0x491b98], edx
mov dword [ebp - 0x510], edx
mov dword [esp], 0xcbe
call fcn.0042291e
mov edx, dword [ebp - 0x510]
call fcn.0042e015
cmp dword [0x525a68], 0
je 0x43aad6
mov dword [0x5275a0], 1
xor ecx, ecx
mov dword [0x527594], 1
mov dword [esp + 0xc], ecx
mov dword [esp + 8], 0x3f6
mov dword [esp + 4], 0x111
mov dword [esp], ebx
jmp 0x43ac1a
cmp eax, 0x4a
jne 0x43b15a
xor edx, edx
cmp dword [0x491b94], 0
sete dl
mov dword [0x491b94], edx
mov dword [ebp - 0x510], edx
mov dword [esp], 0xcb9
jmp 0x43b488
cmp eax, 0x4b
jne 0x43b183
xor edx, edx
cmp dword [0x491b90], 0
sete dl
mov dword [0x491b90], edx
mov dword [ebp - 0x510], edx
mov dword [esp], 0xcba
jmp 0x43b488
cmp eax, 0x4c
jne 0x43b1b6
xor edx, edx
cmp dword [0x526ca8], 0
mov eax, str.ForceLargeFat32Formatting
sete dl
mov dword [0x526ca8], edx
call fcn.00430992
mov edi, dword [0x526ca8]
mov dword [esp], 0xcb6
jmp 0x43b424
cmp eax, 0x4d
jne 0x43b1e9
xor edx, edx
cmp dword [0x526c74], 0
mov eax, str.IgnoreBootMarker
sete dl
mov dword [0x526c74], edx
call fcn.00430992
mov edi, dword [0x526c74]
mov dword [esp], 0xcf7
jmp 0x43b708
cmp eax, 0x4e
jne 0x43b212
xor edx, edx
cmp dword [0x526cc4], 0
sete dl
mov dword [0x526cc4], edx
mov dword [ebp - 0x510], edx
mov dword [esp], 0xcbc
jmp 0x43b488
cmp eax, 0x4f
jne 0x43b221
call fcn.00421e61
jmp 0x43aad6
cmp eax, 0x50
jne 0x43b29f
xor eax, eax
mov dword [esp + 4], 0x147
mov edx, dword [sym.imp.USER32.dll_SendMessageW]
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov eax, dword [0x526d20]
mov dword [esp], eax
mov dword [ebp - 0x510], edx
call edx
sub esp, 0x10
mov edi, eax
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], edi
mov dword [esp + 4], 0x150
mov eax, dword [0x526d20]
mov dword [esp], eax
mov edx, dword [ebp - 0x510]
call edx
xor edx, edx
sub esp, 0x10
mov dword [esp + 4], edx
mov dword [esp + 8], edx
mov dword [esp], eax
call fcn.0040ba97
test eax, eax
je 0x43aad6
mov dword [esp], edi
call fcn.00402705
jmp 0x43aad6
cmp eax, 0x51
jne 0x43b2d2
xor edx, edx
cmp dword [0x526c88], 0
mov eax, str.EnableFileIndexing
sete dl
mov dword [0x526c88], edx
call fcn.00430992
mov edi, dword [0x526c88]
mov dword [esp], 0xcda
jmp 0x43b708
cmp eax, 0x52
jne 0x43b313
mov eax, 0x4a500a
call fcn.0042feaa
mov dword [esp + 8], 0xdac
neg eax
sbb eax, eax
add eax, 0xcb1
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp], eax
call fcn.00422ac2
mov eax, 0x4a70be
call fcn.0042feaa
jmp 0x43aad6
cmp eax, 0x53
jne 0x43b339
xor edx, edx
cmp dword [0x492a48], 0
sete dl
mov dword [0x492a48], edx
mov dword [ebp - 0x510], edx
mov dword [esp], 0xcb4
jmp 0x43b3ab
cmp eax, 0x54
jne 0x43b36c
xor edx, edx
cmp dword [0x526c9c], 0
mov eax, str.PreserveTimestamps
sete dl
mov dword [0x526c9c], edx
call fcn.00430992
mov edi, dword [0x526c9c]
mov dword [esp], 0xcc5
jmp 0x43b708
cmp eax, 0x55
jne 0x43b3b8
xor eax, eax
cmp dword [0x526ca0], 0
sete al
setne dl
mov dword [0x526ca0], eax
movzx edx, dl
mov eax, str.UseProperSizeUnits
call fcn.00430992
xor edx, edx
cmp dword [0x526ca0], 0
sete dl
mov dword [ebp - 0x510], edx
mov dword [esp], 0xcbf
call fcn.0042291e
mov edx, dword [ebp - 0x510]
jmp 0x43b42b
cmp eax, 0x56
jne 0x43b3f6
cmp dword [0x492a0c], 0
je 0x43aad6
xor edx, edx
cmp dword [0x526c78], 0
mov eax, str.UseVds
sete dl
mov dword [0x526c78], edx
call fcn.00430992
mov edx, dword [0x526c78]
mov eax, 0x4a70ce
jmp 0x43b70f
cmp eax, 0x57
jne 0x43b435
xor edx, edx
cmp dword [0x526cac], 0
mov eax, str.EnableVmdkDetection
sete dl
mov dword [0x526cac], edx
call fcn.00430992
mov edi, dword [0x526cac]
mov dword [esp], 0xcc1
call fcn.0042291e
mov edx, edi
call fcn.0042e015
jmp 0x43b6b1
cmp eax, 0x58
jne 0x43b464
xor edi, edi
mov dword [esp + 0xc], 0xcb7
mov dword [esp + 8], 0x7d0
mov dword [esp + 4], edi
mov dword [esp], edi
call fcn.00422ac2
xor eax, eax
mov dword [0x5275a8], eax
jmp 0x43aad6
cmp eax, 0x59
jne 0x43b498
xor edx, edx
cmp dword [0x526c44], 0
setle dl
mov dword [0x526c44], edx
mov dword [ebp - 0x510], edx
mov dword [esp], 0xcbb
call fcn.0042291e
mov edx, dword [ebp - 0x510]
jmp 0x43b70f
cmp eax, 0x5a
jne 0x43ba34
mov dword [0x526c90], 1
xor ecx, ecx
mov dword [0x526c98], ecx
jmp 0x43b511
cmp edx, 0x100
jne 0x43ba34
cmp dword [ebp - 0x4b8], 0x5a
je 0x43b4d9
cmp dword [ebp - 0x4b8], 0x45
jne 0x43b56c
jmp 0x43b547
mov dword [esp], 0x11
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
call edi
push edx
test ax, ax
jns 0x43b535
mov dword [esp], 0x12
call edi
push edi
test ax, ax
jns 0x43b535
mov dword [0x526c90], 1
mov dword [0x526c98], 1
xor ecx, ecx
mov dword [esp], ebx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], 0x3eb
mov dword [esp + 4], 0x111
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x43ac20
cmp dword [ebp - 0x4bc], 0x100
jne 0x43ba34
jmp 0x43b4ca
mov dword [esp], 0x11
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
call edi
push edx
test ax, ax
js 0x43b577
cmp dword [ebp - 0x4bc], 0x100
jne 0x43ba34
cmp dword [ebp - 0x4b8], 0x46
jne 0x43b5d9
jmp 0x43b5b4
mov dword [esp], 0x12
call edi
push ecx
test ax, ax
jns 0x43b55c
xor edx, edx
cmp dword [0x526c64], 0
mov eax, str.ExpertMode
sete dl
mov dword [0x526c64], edx
call fcn.00430992
mov edi, dword [0x526c64]
mov dword [esp], 0xd13
jmp 0x43b708
mov dword [esp], 0x11
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
call edi
push edx
test ax, ax
js 0x43b5eb
cmp dword [ebp - 0x4bc], 0x100
jne 0x43ba34
cmp dword [ebp - 0x4b8], 0x59
jne 0x43ba34
jmp 0x43b6c0
mov dword [esp], 0x12
call edi
push edi
test ax, ax
jns 0x43b5c9
xor edx, edx
cmp dword [0x526c8c], 0
mov eax, dword [ebp - 0x50c]
sete dl
mov dword [0x526c8c], edx
jne 0x43b624
mov eax, dword [0x526cc8]
mov dword [ebp - 0x50c], eax
mov eax, 1
test eax, eax
mov dword [0x526cc8], eax
setne al
mov dword [esp + 4], 0x3fe
movzx eax, al
mov dword [esp + 8], eax
mov eax, dword [0x526d5c]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_CheckDlgButton]
mov edi, dword [0x526c8c]
sub esp, 0xc
mov dword [esp], 0xcd7
call fcn.0042291e
mov edx, edi
call fcn.0042e015
mov eax, 0x4a65e4
mov edx, str.enabled
cmp dword [0x526c8c], 0
cmove edx, eax
mov ecx, 0x4a4f92
mov eax, str.CAUTION:
mov dword [esp], str._sListing_of_non_USB_removable_drives__s
cmove eax, ecx
mov dword [esp + 8], edx
mov dword [esp + 4], eax
call fcn.0043efa9
cmp dword [0x526c8c], 0
je 0x43b6b1
mov dword [esp], str.By_using_this_unofficial_cheat_mode_you_forfeit_ANY_RIGHT_to_complain_if_you_lose_valuable_data_
call fcn.0043efa9
xor ecx, ecx
mov dword [esp], ecx
call fcn.004031f2
jmp 0x43aad6
mov dword [esp], 0x11
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
call edi
push edx
test ax, ax
jns 0x43ba34
mov dword [esp], 0x12
call edi
push ecx
test ax, ax
jns 0x43ba34
xor eax, eax
cmp dword [0x526c44], 0
setle al
lea edi, [eax + eax]
mov dword [0x526c44], edi
mov dword [esp], 0xcbb
call fcn.0042291e
mov edx, edi
call fcn.0042e015
jmp 0x43aad6
mov eax, dword [0x5299c0]
test eax, eax
je 0x43b740
xor edx, edx
mov dword [esp + 4], 0x10
mov dword [esp + 0xc], edx
mov dword [esp + 8], edx
mov dword [esp], eax
call dword [sym.imp.USER32.dll_SendMessageW]
sub esp, 0x10
cmp dword [0x527598], 0
je 0x43b772
xor eax, eax
mov edi, 1
mov dword [0x527598], eax
mov dword [esp], 1
call fcn.00422700
mov dword [esp], 1
call fcn.0042269f
jmp 0x43a7fd
mov eax, 0x526a20
call fcn.00430cf3
cmp dword [ebp - 0x4f4], 0
jne 0x43b7a3
mov eax, dword [0x523a60]
test eax, eax
je 0x43b7f6
mov dword [esp + 4], 1
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_TerminateThread]
push ecx
push ecx
jmp 0x43b7f6
mov eax, dword [ebp - 0x4f4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_ReleaseMutex]
push eax
cmp dword [ebp - 0x4f4], 0xffffffff
je 0x43b7cc
mov eax, dword [ebp - 0x4f4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push eax
xor ebx, ebx
mov dword [esp], str.rufus.com
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
push edi
test eax, eax
jne 0x43b785
cmp ebx, 0xb
je 0x43b785
mov dword [esp], 0xc8
inc ebx
call dword [sym.imp.KERNEL32.DLL_Sleep]
push eax
jmp 0x43b7ce
cmp dword [ebp - 0x500], 0
jne 0x43b832
cmp byte [ebp - 0x220], 0
je 0x43b832
lea ebx, [ebp - 0x220]
mov eax, ebx
call fcn.0042f022
test eax, eax
jne 0x43b832
call fcn.0043f53d
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
mov dword [esp], str.Could_not_delete__s:__s
call fcn.0043efa9
call fcn.004429ac
xor ebx, ebx
xor edi, edi
call fcn.004473d9
xor ecx, ecx
mov dword [esp], ecx
call fcn.00422700
mov eax, dword [0x525a68]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [0x525a60]
mov dword [0x525a68], ebx
xor ebx, ebx
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebp - 0x4ec]
mov dword [0x525a60], edi
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [0x526d74]
mov dword [esp], eax
call sub.msvcrt.dll_free
xor eax, eax
mov dword [0x526d74], eax
mov eax, dword [0x526d78]
mov dword [esp], eax
call sub.msvcrt.dll_free
xor eax, eax
mov dword [0x526d78], eax
mov eax, dword [0x4e28e8]
mov dword [esp], eax
call sub.msvcrt.dll_free
xor eax, eax
mov dword [0x4e28e8], eax
mov eax, dword [0x5259dc]
mov dword [esp], eax
call sub.msvcrt.dll_free
xor eax, eax
mov dword [0x5259dc], eax
mov eax, dword [0x523a64]
mov dword [esp], eax
call sub.msvcrt.dll_free
xor eax, eax
mov dword [0x523a64], eax
mov eax, dword [0x4e2a80]
mov dword [esp], eax
call sub.msvcrt.dll_free
xor edx, edx
cmp dword [ebp - 0x4f0], 0
mov dword [0x4e2a80], edx
je 0x43b931
mov eax, dword [ebp - 0x4f0]
cmp dword [ebp - 0x4e0], ebx
jle 0x43b929
mov eax, dword [eax + ebx*4]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebp - 0x4f0]
xor edx, edx
mov dword [eax + ebx*4], edx
inc ebx
jmp 0x43b902
mov dword [esp], eax
call sub.msvcrt.dll_free
cmp dword [ebp - 0x4f8], 0
je 0x43b964
xor eax, eax
mov dword [esp + 0xc], str.NoDriveTypeAutorun
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
mov dword [esp + 4], 0x5275a8
mov dword [esp], 1
call fcn.0043e48f
cmp dword [ebp - 0x4d8], 0
jne 0x43b987
xor edi, edi
mov dword [esp], edi
call fcn.0040875b
test eax, eax
jne 0x43b987
mov dword [esp], str.Failed_to_restore_AutoMount_to_disabled
call fcn.0043efa9
cmp dword [0x528740], 0
je 0x43b9a4
mov dword [esp + 4], 0x527740
mov dword [esp], 0x4a4ea6
call fcn.0043efa9
xor ebx, ebx
cmp dword [ebp - 0x504], 0
mov dword [0x528740], ebx
je 0x43b9eb
call dword [sym.imp.KERNEL32.DLL_GetConsoleWindow]
xor ecx, ecx
mov dword [esp + 0x18], 3
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ecx
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [sym.imp.USER32.dll_SetWindowPos]
sub esp, 0x1c
call dword [sym.imp.KERNEL32.DLL_FreeConsole]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ax, word [0x526d7c]
test ax, ax
je 0x43ba19
dec eax
mov word [0x526d7c], ax
movzx eax, ax
mov eax, dword [eax*4 + 0x526d80]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
push edx
jmp 0x43b9f1
lea eax, [esi - 1]
cmp eax, 0xfffffffd
ja 0x43bada
mov dword [esp], esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push eax
jmp 0x43bada
cmp dword [ebp - 0x4fc], 0
je 0x43ba7f
mov dword [esp], 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
push edx
test ax, ax
js 0x43ba7f
cmp dword [ebp - 0x508], 0
je 0x43ba69
xor edi, edi
mov dword [ebp - 0x508], edi
mov dword [ebp - 0x4fc], edi
jmp 0x43ba7f
mov eax, dword [0x52a418]
mov ecx, 3
inc eax
cdq
idiv ecx
mov dword [0x52a418], edx
jmp 0x43ba59
mov edx, dword [sym.imp.USER32.dll_IsDialogMessageW]
lea edi, [ebp - 0x4c0]
mov dword [esp], ebx
mov dword [esp + 4], edi
mov dword [ebp - 0x510], edx
call edx
test eax, eax
push ecx
push ecx
mov edx, dword [ebp - 0x510]
jne 0x43aad6
mov dword [esp + 4], edi
mov eax, dword [0x526cf8]
mov dword [esp], eax
call edx
push edx
push edx
test eax, eax
jne 0x43aad6
mov dword [esp], edi
call dword [sym.imp.USER32.dll_TranslateMessage]
push eax
mov dword [esp], edi
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x43aad5
mov dword [esp], str._Rufus_exit__n
call fcn.0043efa9
lea esp, [ebp - 0x10]
xor eax, eax
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10