Function at 0x43be84
Capabilities:
Check mutex on windows
Copy file
Delete file
Delete registry key
Extract resource via kernel32 functions
Get token membership
Hide graphical window
Log keystrokes via polling
Parse pe header
Resolve function by parsing pe exports
Terminate thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x71c
mov eax, dword [0x5512ec]
xor eax, esp
mov dword [esp + 0x718], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [esp + 0x80], eax
mov dword [esp + 0x78], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x94], 0
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx eax, ax
mov dword [esp + 0x20], eax
xor eax, eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x90], eax
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x38], eax
lea eax, [esp + 0x38]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftVisualStudio
push 0x80000001
mov dword [esp + 0x5c], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x38]
test eax, eax
je 0x43af66
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x103
lea eax, [esp + 0x30d]
mov dword [esp + 0x48], 0
push 0
push eax
mov dword [esp + 0x44], 0
mov dword [esp + 0x80], 0
mov dword [esp + 0x88], 4
mov byte [esp + 0x314], 0
call fcn.004ab0f0
add esp, 0xc
mov byte [esp + 0x200], 0
lea eax, [esp + 0x201]
push 0x103
push 0
push eax
call fcn.004ab0f0
add esp, 0xc
mov byte [esp + 0x410], 0
lea eax, [esp + 0x411]
push 0x103
push 0
push eax
call fcn.004ab0f0
mov ax, word [0x530070]
add esp, 0xc
movaps xmm0, xmmword [0x54bee0]
mov word [esp + 0x40], ax
mov al, byte [0x530072]
mov byte [esp + 0x42], al
xor eax, eax
push 0x52ad5a
mov dword [esp + 0x38], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x40], eax
mov dword [esp + 0x88], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0xc4], str.extra_devs
mov dword [esp + 0xc8], eax
mov dword [esp + 0xcc], eax
mov dword [esp + 0xd0], 0x78
mov dword [esp + 0xd4], 0x536cf0
mov dword [esp + 0xd8], eax
mov dword [esp + 0xdc], eax
mov dword [esp + 0xe0], 0x67
mov dword [esp + 0xe4], str.help
mov dword [esp + 0xe8], eax
mov dword [esp + 0xec], eax
mov dword [esp + 0xf0], 0x68
mov dword [esp + 0xf4], 0x536cfc
mov dword [esp + 0xf8], 1
mov dword [esp + 0xfc], eax
mov dword [esp + 0x100], 0x69
mov dword [esp + 0x104], str.locale
mov dword [esp + 0x108], 1
mov dword [esp + 0x10c], eax
mov dword [esp + 0x110], 0x6c
mov dword [esp + 0x114], str.filesystem
mov dword [esp + 0x118], 1
mov dword [esp + 0x11c], eax
mov dword [esp + 0x120], 0x66
mov dword [esp + 0x124], str.wait
movups xmmword [esp + 0x128], xmm0
mov dword [esp + 0x138], eax
mov dword [esp + 0x13c], eax
mov dword [esp + 0x140], eax
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryA]
push 0x800
call dword [sym.imp.KERNEL32.dll_SetDefaultDllDirectories]
push str._Rufus_init__n
call fcn.0044b0b0
add esp, 4
lea eax, [esp + 0x7c]
push eax
lea eax, [esp + 0x78]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x43b179
cmp dword [esp + 0x74], 0x6c696e
jne 0x43b179
mov eax, 1
jmp 0x43b17b
xor eax, eax
push 2
push 0x104
mov dword [0x55a7c0], eax
mov dword [0x5a2644], 0
call fcn.004b6706
mov edi, eax
add esp, 8
test edi, edi
jne 0x43b1ac
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x43b236
push 0x104
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test esi, esi
je 0x43b222
lea eax, [esi - 1]
test eax, eax
je 0x43b1e4
nop
cmp word [edi + eax*2], 0x5c
je 0x43b1de
sub eax, 1
jne 0x43b1d0
jmp 0x43b1e4
xor ecx, ecx
mov word [edi + eax*2], cx
push 0
push 0
push 0x104
push 0x5a2400
push 0xffffffffffffffff
push edi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
test esi, esi
jne 0x43b222
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov esi, eax
call fcn.004d1211
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x43b236
push edi
call fcn.004d1211
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
jne 0x43b25e
call fcn.0044b6b0
push eax
push str.Could_not_get_application_directory:__s
call fcn.0044b0b0
mov ax, word [0x536d58]
add esp, 8
mov word [0x5a2400], ax
mov byte [0x5a2402], 0
jmp 0x43b29a
mov ecx, 0x5a2400
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x43b266
sub ecx, edx
mov eax, 0x103
sub eax, ecx
mov ecx, 2
cmp eax, 2
cmova eax, ecx
push eax
push 0x52a9b0
push 0x5a2400
call fcn.004d16a0
mov ax, word [0x536d58]
add esp, 0xc
mov cl, byte [0x536d5a]
mov edx, 0x80000000
push ecx
push 0x2000000
push 3
sub esp, 8
mov word [0x5a21a0], ax
mov ecx, 0x5a21a0
mov byte [0x5a21a2], 0
call fcn.0042cc40
mov ebx, eax
add esp, 0x14
cmp ebx, 0xffffffff
je 0x43b3d6
push 2
push 0x104
call fcn.004b6706
add esp, 8
mov esi, eax
push 8
push 0x104
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFinalPathNameByHandleW]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x140], eax
test edi, edi
je 0x43b339
push 0
push 0
push 0x104
push 0x5a21a0
push 0xffffffffffffffff
push esi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
jne 0x43b339
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x140], eax
test esi, esi
je 0x43b346
push esi
call fcn.004d1211
add esp, 4
push dword [esp + 0x140]
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
je 0x43b3d6
push 0x52a618
push 0x5a21a0
call fcn.004aa450
add esp, 8
cmp eax, 0x5a21a0
je 0x43b38d
push 0x536d5c
push 0x5a21a0
call fcn.004aa450
add esp, 8
cmp eax, 0x5a21a0
jne 0x43b3d6
mov ecx, 0x5a21a4
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [ecx - 5], al
test al, al
jne 0x43b392
mov ecx, 0x5a21a0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x43b3a6
sub ecx, edx
mov eax, 0x103
sub eax, ecx
mov ecx, 2
cmp eax, 2
cmova eax, ecx
push eax
push 0x52a9b0
push 0x5a21a0
call fcn.004d16a0
add esp, 0xc
jmp 0x43b406
call fcn.0044b6b0
push eax
push 0x5a21a0
push str.Could_not_get_current_directory_from__s:__s
call fcn.0044b0b0
mov ax, word [0x536d58]
add esp, 0xc
mov word [0x5a21a0], ax
mov byte [0x5a21a2], 0
cmp ebx, 0xffffffff
je 0x43b411
test ebx, ebx
je 0x43b411
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 2
push 0x104
call fcn.004b6706
add esp, 8
mov esi, eax
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test edi, edi
je 0x43b468
push 0
push 0
push 0x104
push 0x5a2660
push 0xffffffffffffffff
push esi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
jne 0x43b468
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test esi, esi
je 0x43b475
push esi
call fcn.004d1211
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
jne 0x43b4dc
call fcn.0044b6b0
push eax
push str.Could_not_get_temp_directory:__s
call fcn.0044b0b0
mov esi, 0x5a21a0
add esp, 8
lea ecx, [esi + 1]
nop dword [eax + eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x43b4a0
sub esi, ecx
mov ebx, 0x104
inc esi
mov eax, ebx
cmp esi, eax
cmovb eax, esi
push eax
push 0x5a21a0
push 0x5a2660
call fcn.004aab70
mov eax, ebx
add esp, 0xc
cmp esi, eax
cmovb eax, esi
mov byte [eax + 0x5a265f], 0
jmp 0x43b67a
push ecx
push 0x2000000
push 3
sub esp, 8
mov edx, 0x80000000
mov ecx, 0x5a2660
call fcn.0042cc40
mov ebx, eax
add esp, 0x14
mov edi, 0x104
cmp ebx, 0xffffffff
je 0x43b609
push 2
push edi
call fcn.004b6706
add esp, 8
mov esi, eax
push 8
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFinalPathNameByHandleW]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x140], eax
test edi, edi
je 0x43b565
push 0
push 0
push 0x104
push 0x5a2660
push 0xffffffffffffffff
push esi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
jne 0x43b565
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x140], eax
test esi, esi
je 0x43b572
push esi
call fcn.004d1211
add esp, 4
push dword [esp + 0x140]
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
je 0x43b604
push 0x52a618
push 0x5a2660
call fcn.004aa450
add esp, 8
cmp eax, 0x5a2660
je 0x43b5b9
push 0x536d5c
push 0x5a2660
call fcn.004aa450
add esp, 8
cmp eax, 0x5a2660
jne 0x43b604
mov ecx, 0x5a2664
nop
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [ecx - 5], al
test al, al
jne 0x43b5c0
mov ecx, 0x5a2660
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x43b5d4
sub ecx, edx
mov eax, 0x103
sub eax, ecx
mov ecx, 2
cmp eax, 2
cmova eax, ecx
push eax
push 0x52a9b0
push 0x5a2660
call fcn.004d16a0
add esp, 0xc
jmp 0x43b66f
mov edi, 0x104
call fcn.0044b6b0
push eax
push 0x5a2660
push str.Could_not_get_actual_temp_directory_from__s:__s
call fcn.0044b0b0
mov esi, 0x5a21a0
add esp, 0xc
lea ecx, [esi + 1]
nop dword [eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x43b630
sub esi, ecx
mov eax, edi
inc esi
cmp esi, 0x104
cmovb eax, esi
push eax
push 0x5a21a0
push 0x5a2660
call fcn.004aab70
add esp, 0xc
mov eax, edi
cmp esi, 0x104
cmovb eax, esi
mov byte [eax + 0x5a265f], 0
cmp ebx, 0xffffffff
je 0x43b67a
test ebx, ebx
je 0x43b67a
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 2
push 0x104
call fcn.004b6706
add esp, 8
mov esi, eax
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test edi, edi
je 0x43b6d1
push 0
push 0
push 0x104
push 0x5a2540
push 0xffffffffffffffff
push esi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
jne 0x43b6d1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test esi, esi
je 0x43b6de
push esi
call fcn.004d1211
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
jne 0x43b71b
call fcn.0044b6b0
push eax
push str.Could_not_get_system_directory:__s
call fcn.0044b0b0
movups xmm0, xmmword [str.C:WindowsSystem32]
mov eax, dword [0x536e20]
add esp, 8
mov dword [0x5a2550], eax
movups xmmword [0x5a2540], xmm0
mov byte [0x5a2553], 0
push 0x208
lea eax, [esp + 0x51c]
push 0
push eax
call fcn.004ab0f0
mov ebx, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [esp + 0x524]
add esp, 0xc
push 0
push 0x1c
push eax
push 0
call ebx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0
push 0x104
push 0x5a28c0
push 0xffffffffffffffff
mov esi, eax
lea eax, [esp + 0x52c]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
jne 0x43b7d7
call fcn.0044b6b0
push eax
push str.Could_not_get_app_data_directory:__s
call fcn.0044b0b0
mov esi, 0x5a2660
add esp, 8
lea ecx, [esi + 1]
nop dword [eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x43b7a0
sub esi, ecx
mov edi, 0x104
inc esi
mov eax, edi
cmp esi, eax
cmovb eax, esi
push eax
push 0x5a2660
push 0x5a28c0
call fcn.004aab70
mov eax, edi
add esp, 0xc
cmp esi, eax
cmovb eax, esi
mov byte [eax + 0x5a28bf], 0
push 0x208
lea eax, [esp + 0x51c]
push 0
push eax
call fcn.004ab0f0
add esp, 0xc
lea eax, [esp + 0x518]
push 0
push 0x28
push eax
push 0
call ebx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0
push 0x104
push 0x5a22c0
push 0xffffffffffffffff
mov esi, eax
lea eax, [esp + 0x52c]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
jne 0x43b88c
call fcn.0044b6b0
push eax
push str.Could_not_get_user_directory:__s
call fcn.0044b0b0
mov esi, 0x5a2660
add esp, 8
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x43b853
sub esi, ecx
mov ebx, 0x104
inc esi
mov eax, ebx
cmp esi, eax
cmovb eax, esi
push eax
push 0x5a2660
push 0x5a22c0
call fcn.004aab70
mov eax, ebx
add esp, 0xc
cmp esi, eax
cmovb eax, esi
mov byte [eax + 0x5a22bf], 0
jmp 0x43b891
mov ebx, 0x104
mov esi, 0x5a2540
lea ecx, [esi + 1]
nop dword [eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x43b8a0
sub esi, ecx
mov eax, ebx
inc esi
cmp esi, 0x104
cmovb eax, esi
push eax
push 0x5a2540
push 0x5a2780
call fcn.004aab70
add esp, 0xc
mov dword [esp + 0x140], 0
cmp esi, 0x104
mov eax, ebx
cmovb eax, esi
mov byte [eax + 0x5a277f], 0
lea eax, [esp + 0x140]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp dword [esp + 0x140], 0
je 0x43b9e2
push 2
push 0x104
call fcn.004b6706
add esp, 8
mov esi, eax
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test edi, edi
je 0x43b95f
push 0
push 0
push 0x104
push 0x5a2780
push 0xffffffffffffffff
push esi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
jne 0x43b95f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test esi, esi
je 0x43b96c
push esi
call fcn.004d1211
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
jne 0x43b9ad
call fcn.0044b6b0
push eax
push str.Could_not_get_Windows_directory:__s
call fcn.0044b0b0
movq xmm0, qword [str.C:Windows]
add esp, 8
mov ax, word [0x536e9c]
movq qword [0x5a2780], xmm0
mov word [0x5a2788], ax
mov byte [0x5a278a], 0
mov ecx, 0x5a2780
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x43b9b5
sub ecx, edx
mov eax, 0x103
sub eax, ecx
mov ecx, 0xb
cmp eax, ecx
cmova eax, ecx
push eax
push str.Sysnative
push 0x5a2780
call fcn.004d16a0
add esp, 0xc
push 0x5a21a0
push str.Cur_dir:__s
call fcn.0044b0b0
push 0x5a2400
push str.App_dir:__s
call fcn.0044b0b0
push 0x5a2780
push str.Sys_dir:__s
call fcn.0044b0b0
push 0x5a22c0
push str.Usr_dir:__s
call fcn.0044b0b0
push 0x5a28c0
push str.Dat_dir:__s
call fcn.0044b0b0
push 0x5a2660
push str.Tmp_dir:__s
call fcn.0044b0b0
push 0x5a2400
push str._srufus.app
lea eax, [esp + 0x340]
push 0x104
push eax
call fcn.004050d0
add esp, 0x40
mov byte [esp + 0x40b], 0
lea ecx, [esp + 0x308]
call fcn.0042cde0
mov ebx, str._NULL_
test eax, eax
je 0x43ba87
mov dword [0x55b1f8], 1
jmp 0x43c0f4
mov eax, dword [0x59d72c]
test eax, eax
jne 0x43bac5
push str.__wgetmainargs
push ecx
mov ecx, str.Msvcrt
call fcn.0042c000
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x59d72c], eax
test eax, eax
jne 0x43bac5
push str.Could_not_access_UTF_16_args
call fcn.0044b0b0
add esp, 4
jmp 0x43c0eb
lea ecx, [esp + 0x94]
xor edi, edi
push ecx
push 1
lea ecx, [esp + 0xc4]
mov dword [esp + 0x148], edi
push ecx
lea ecx, [esp + 0xa4]
push ecx
lea ecx, [esp + 0x38]
push ecx
call eax
add esp, 0x14
push 4
push dword [esp + 0x2c]
call fcn.004b6706
add esp, 8
mov dword [esp + 0x14], eax
test eax, eax
je 0x43c0eb
xor ecx, ecx
mov dword [esp + 0x1c], ecx
cmp dword [esp + 0x28], ecx
jle 0x43bc85
mov edi, 0x96
mov eax, dword [esp + 0x98]
mov ebx, dword [eax + ecx*4]
cmp word [ebx], 0
jne 0x43bb41
push 1
push 1
call fcn.004b6706
add esp, 8
mov esi, eax
jmp 0x43bb9b
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push ebx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
cmp edi, 1
jle 0x43bb94
push 1
push edi
call fcn.004b6706
mov esi, eax
add esp, 8
test esi, esi
je 0x43bb94
push 0
push 0
push edi
push esi
push 0xffffffffffffffff
push ebx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp eax, edi
je 0x43bb96
push esi
call fcn.004d1211
add esp, 4
xor esi, esi
mov edi, 0x96
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov dword [ecx + eax*4], esi
mov ecx, 0x536f30
mov eax, esi
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x43bbd0
test dl, dl
je 0x43bbcc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x43bbd0
add eax, 2
add ecx, 2
test dl, dl
jne 0x43bbb0
xor eax, eax
jmp 0x43bbd5
sbb eax, eax
or eax, 1
mov ecx, dword [esp + 0x2c]
test eax, eax
mov eax, esi
cmove ecx, edi
mov dword [esp + 0x2c], ecx
mov ecx, 0x536f34
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x43bc10
test dl, dl
je 0x43bc0c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x43bc10
add eax, 2
add ecx, 2
test dl, dl
jne 0x43bbf0
xor eax, eax
jmp 0x43bc15
sbb eax, eax
or eax, 1
test eax, eax
je 0x43bc49
mov ecx, str.__gui
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x43bc40
test dl, dl
je 0x43bc3c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x43bc40
add eax, 2
add ecx, 2
test dl, dl
jne 0x43bc20
xor eax, eax
jmp 0x43bc45
sbb eax, eax
or eax, 1
test eax, eax
jne 0x43bc51
mov dword [esp + 0x18], 1
push str._InvokerPRAID
push esi
call fcn.004e7afe
add esp, 8
test eax, eax
je 0x43ba78
mov ecx, dword [esp + 0x1c]
inc ecx
mov dword [esp + 0x1c], ecx
cmp ecx, dword [esp + 0x28]
jl 0x43bb21
mov eax, dword [esp + 0x14]
mov ebx, str._NULL_
xor edi, edi
mov edx, dword [eax]
mov ecx, edx
lea esi, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x43bc90
sub ecx, esi
lea esi, [ecx - 1]
add esi, edx
cmp esi, edx
jbe 0x43bcac
cmp byte [esi], 0x5c
je 0x43bcac
dec esi
cmp esi, edx
ja 0x43bca2
push 0x70
push esi
call fcn.004aa320
add esp, 8
test eax, eax
jne 0x43bcdb
push 0x50
push esi
call fcn.004aa320
add esp, 8
test eax, eax
je 0x43bce0
push 0x50
push esi
call fcn.004aa320
add esp, 8
cmp byte [eax + 1], 0x48
je 0x43bce0
mov byte [esp + 0x40], 0x61
cmp dword [esp + 0x18], 0
jne 0x43bd7b
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_AttachConsole]
test eax, eax
je 0x43bd7b
push str.Enabling_console_line_hogger
call fcn.0044b0b0
add esp, 4
mov dword [esp + 0x90], 1
push 0
call fcn.004b6858
add esp, 4
push eax
push 0x52f1f4
push str.CONIN_
call fcn.004b66c0
add esp, 0xc
push 1
call fcn.004b6858
add esp, 4
push eax
push 0x525f6c
push str.CONOUT_
call fcn.004b66c0
add esp, 0xc
push 2
call fcn.004b6858
add esp, 4
push eax
push 0x525f6c
push str.CONOUT_
call fcn.004b66c0
add esp, 0xc
call fcn.004b7089
call fcn.0043ac40
mov dword [esp + 0x84], eax
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x78]
mov ecx, dword [esp + 0x28]
push 0
push eax
lea eax, [esp + 0xc8]
push eax
push str.ghxf:i:l:w:z:
call fcn.00466d50
add esp, 0x10
cmp eax, 0xffffffff
je 0x43c0eb
nop dword [eax + eax]
add eax, 0xffffff9f
cmp eax, 0x19
ja case.0x43bdc3.98
movzx eax, byte [eax + 0x43ef8c]
jmp dword [eax*4 + 0x43ef68]
mov dword [0x55b1f4], 1
jmp case.0x43bdc3.97
push dword [0x55a75c]
call fcn.004d1211
add esp, 4
mov dword [0x55a75c], 0
push 0x104
push 1
call fcn.004b6706
add esp, 8
mov dword [esp + 0x4c], eax
mov dword [0x55a75c], eax
test eax, eax
je case.0x43bdc3.97
mov esi, dword [0x5a08a4]
test esi, esi
je 0x43be82
cmp byte [esi], 0
jne 0x43be30
push 2
push 1
call fcn.004b6706
add esp, 8
mov edi, eax
jmp 0x43be84
push 0
push 0
push 0xffffffffffffffff
push esi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [esp + 0x18], eax
cmp eax, 1
jle 0x43be82
push 2
push eax
call fcn.004b6706
mov edi, eax
add esp, 8
test edi, edi
je 0x43be82
push dword [esp + 0x18]
push edi
push 0xffffffffffffffff
push esi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, dword [esp + 0x18]
je 0x43be84
push edi
call fcn.004d1211
add esp, 4
xor edi, edi
push 2
push 0x104
call fcn.004b6706
add esp, 8
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x54]
push ecx
push eax
push 0x104
push edi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
mov dword [esp + 0x1c], eax
mov esi, dword [esp + 0x18]
je 0x43bee8
push 0
push 0
push 0x104
push dword [esp + 0x58]
push 0xffffffffffffffff
push esi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x43bee8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x1c], eax
test esi, esi
je 0x43bef5
push esi
call fcn.004d1211
add esp, 4
test edi, edi
je 0x43bf02
push edi
call fcn.004d1211
add esp, 4
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [0x55a75c]
call fcn.0042d470
test al, 0x10
je 0x43bf4f
push dword [0x55a75c]
push str.Could_not_find_image__s_n
call fcn.0042b3d0
push dword [0x55a75c]
call fcn.004d1211
mov edi, dword [esp + 0x14c]
add esp, 0xc
mov dword [0x55a75c], 0
jmp case.0x43bdc3.97
mov edi, dword [esp + 0x140]
mov dword [0x59d518], 1
jmp case.0x43bdc3.97
mov eax, dword [0x5a08a4]
movzx eax, byte [eax]
push eax
call fcn.004e1420
add esp, 4
test eax, eax
je 0x43bf95
push 0
push 0
push dword [0x5a08a4]
call fcn.004e439f
add esp, 0xc
mov dword [esp + 0x20], eax
jmp case.0x43bdc3.97
push dword [esp + 0x34]
call fcn.004d1211
mov eax, dword [0x5a08a4]
add esp, 4
test eax, eax
jne 0x43bfb3
mov dword [esp + 0x34], eax
jmp case.0x43bdc3.97
push eax
call fcn.004e03cf
add esp, 4
mov dword [esp + 0x34], eax
jmp case.0x43bdc3.97
mov eax, dword [0x5a08a4]
movzx eax, byte [eax]
push eax
call fcn.004e1420
add esp, 4
test eax, eax
je 0x43c00f
push 0
push 0
push dword [0x5a08a4]
call fcn.004e439f
add esp, 0xc
mov esi, eax
mov dword [0x5537a4], esi
cmp esi, 0xffffffff
jl 0x43bffe
cmp esi, 9
jl 0x43c007
or esi, 0xffffffff
mov dword [0x5537a4], esi
mov dword [0x5537a8], esi
jmp case.0x43bdc3.97
xor esi, esi
mov eax, dword [esi*4 + 0x526268]
mov ecx, ebx
test eax, eax
cmovne ecx, eax
mov eax, dword [0x5a08a4]
push ecx
test eax, eax
mov ecx, ebx
cmovne ecx, eax
push ecx
call fcn.004e7afe
add esp, 8
test eax, eax
je 0x43bfee
inc esi
cmp esi, 9
jb 0x43c011
mov esi, dword [0x5537a4]
jmp 0x43bff4
push dword [0x5a08a4]
call fcn.004e83cb
add esp, 4
mov dword [esp + 0x2c], eax
jmp case.0x43bdc3.97
push 0x10
push 0
push dword [0x5a08a4]
call fcn.004e439f
add esp, 0xc
mov dword [esp + 0x30], eax
jmp case.0x43bdc3.97
mov edi, 1
mov dword [esp + 0x140], edi
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x78]
mov ecx, dword [esp + 0x28]
push 0
push eax
lea eax, [esp + 0xc8]
push eax
push str.ghxf:i:l:w:z:
call fcn.00466d50
add esp, 0x10
cmp eax, 0xffffffff
jne 0x43bdb0
test edi, edi
je 0x43c0eb
push str.Command_line_arguments:
call fcn.0044b0b0
mov esi, 1
add esp, 4
cmp dword [esp + 0x28], esi
jle 0x43c0eb
nop dword [eax + eax]
mov eax, dword [esp + 0x14]
push dword [eax + esi*4]
push 0x525f4c
call fcn.0044b0b0
inc esi
add esp, 8
cmp esi, dword [esp + 0x28]
jl 0x43c0d0
cmp dword [0x55b1f8], 0
je 0x43c101
push str.AppStore_version_detected
call fcn.0044b0b0
add esp, 4
push 0x5a2400
push str._srufus.ini
lea eax, [esp + 0x418]
push 0x104
push eax
call fcn.004050d0
lea edx, [esp + 0x50]
mov byte [esp + 0x523], 0
lea ecx, [esp + 0x420]
call fcn.0042d6c0
push 0
xor edx, edx
xor ecx, ecx
mov edi, eax
call fcn.00427830
add esp, 0x14
mov edx, str._NULL_
test eax, eax
mov ecx, 0x533a28
cmovne edx, eax
mov al, byte [edx]
cmp al, byte [ecx]
jne 0x43c275
test al, al
je 0x43c178
mov al, byte [edx + 1]
cmp al, byte [ecx + 1]
jne 0x43c275
add edx, 2
add ecx, 2
test al, al
jne 0x43c154
xor eax, eax
jmp 0x43c27a
mov ebx, dword [esp + 0x14]
lea eax, [esp + 0x518]
push 0
push eax
push 0
push 0
push dword [ebx]
call fcn.004ea907
add esp, 0x14
lea eax, [esp + 0x518]
push eax
push str._nUsage:__s___x____g____h____f_FILESYSTEM____i_PATH____l_LOCALE____w_TIMEOUT__n
call fcn.0042b3d0
push str.___x____extra_devs_n
call fcn.0042b3d0
add esp, 0xc
push str._____List_extra_devices__such_as_USB_HDDs_n
call fcn.0042b3d0
add esp, 4
push str.___g____gui_n
call fcn.0042b3d0
add esp, 4
push str._____Start_in_GUI_mode__disable_the_rufus.com_commandline_hogger__n
call fcn.0042b3d0
add esp, 4
push str.___i_PATH____isoPATH_n
call fcn.0042b3d0
add esp, 4
push str._____Select_the_ISO_image_pointed_by_PATH_to_be_used_on_startup_n
call fcn.0042b3d0
add esp, 4
push str.___l_LOCALE____localeLOCALE_n
call fcn.0042b3d0
add esp, 4
push str._____Select_the_locale_to_be_used_on_startup_n
call fcn.0042b3d0
add esp, 4
push str.___f_FILESYSTEM____filesystemFILESYSTEM_n
call fcn.0042b3d0
add esp, 4
push str._____Preselect_the_file_system_to_be_preferred_when_formatting_n
call fcn.0042b3d0
add esp, 4
push str.___w_TIMEOUT____waitTIMEOUT_n
call fcn.0042b3d0
add esp, 4
push str._____Wait_TIMEOUT_tens_of_seconds_for_the_global_application_mutex_to_be_released._n
call fcn.0042b3d0
add esp, 4
push str._____Used_when_launching_a_newer_version_of_Rufus_from_a_running_application._n
call fcn.0042b3d0
add esp, 4
push str.___h____help_n
call fcn.0042b3d0
add esp, 4
push str._____This_usage_guide._n
call fcn.0042b3d0
add esp, 4
jmp 0x43cd95
sbb eax, eax
or eax, 1
xor ecx, ecx
test eax, eax
sete cl
or ecx, dword [esp + 0x10]
mov dword [esp + 0x4c], ecx
test edi, edi
je 0x43c2df
mov esi, 0x5a2400
lea eax, [esp + 0x410]
mov dword [0x55a750], eax
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x43c2a1
sub esi, ecx
mov ebx, 0x104
inc esi
mov eax, ebx
cmp esi, eax
cmovb eax, esi
push eax
push 0x5a2400
push 0x5a28c0
call fcn.004aab70
add esp, 0xc
cmp esi, ebx
cmovb ebx, esi
push edi
mov byte [ebx + 0x5a28bf], 0
call fcn.004d1662
add esp, 4
cmp dword [0x55a750], 0
mov ecx, str.registry
mov eax, str.INI_file
cmove eax, ecx
push eax
push str.Will_use_settings_from__s
call fcn.0044b0b0
add esp, 8
mov ecx, str.Locale
call fcn.0042e210
cmp byte [eax], 0
je 0x43c32b
push eax
call fcn.004e03cf
add esp, 4
mov dword [esp + 0x34], eax
push eax
push str.found_locale__s
call fcn.0044b0b0
add esp, 8
mov edx, dword [0x55a750]
test edx, edx
je 0x43c368
push 1
mov ecx, str.ShowAdvancedDriveProperties
xor edi, edi
call fcn.004249f0
mov esi, eax
add esp, 4
test esi, esi
je 0x43c362
push edi
push edi
push esi
call fcn.004e439f
add esp, 0xc
mov edi, eax
push esi
call fcn.004d1211
add esp, 4
xor ecx, ecx
test edi, edi
jmp 0x43c389
push 4
lea eax, [esp + 0x14]
mov edx, str.ShowAdvancedDriveProperties
push eax
push 4
mov ecx, 0x80000001
call fcn.0042db00
xor ecx, ecx
add esp, 0xc
cmp dword [esp + 0x10], ecx
mov edx, dword [0x55a750]
setne cl
mov dword [0x5a2504], ecx
test edx, edx
je 0x43c3cf
push 1
mov ecx, str.ShowAdvancedFormatOptions
xor edi, edi
call fcn.004249f0
mov esi, eax
add esp, 4
test esi, esi
je 0x43c3c9
push edi
push edi
push esi
call fcn.004e439f
add esp, 0xc
mov edi, eax
push esi
call fcn.004d1211
add esp, 4
xor ecx, ecx
test edi, edi
jmp 0x43c3f0
push 4
lea eax, [esp + 0x14]
mov edx, str.ShowAdvancedFormatOptions
push eax
push 4
mov ecx, 0x80000001
call fcn.0042db00
xor ecx, ecx
add esp, 0xc
cmp dword [esp + 0x10], ecx
mov edx, dword [0x55a750]
setne cl
mov dword [0x5a2508], ecx
test edx, edx
je 0x43c436
push 1
mov ecx, str.PreserveTimestamps
xor edi, edi
call fcn.004249f0
mov esi, eax
add esp, 4
test esi, esi
je 0x43c430
push edi
push edi
push esi
call fcn.004e439f
add esp, 0xc
mov edi, eax
push esi
call fcn.004d1211
add esp, 4
xor ecx, ecx
test edi, edi
jmp 0x43c457
push 4
lea eax, [esp + 0x14]
mov edx, str.PreserveTimestamps
push eax
push 4
mov ecx, 0x80000001
call fcn.0042db00
xor ecx, ecx
add esp, 0xc
cmp dword [esp + 0x10], ecx
mov edx, dword [0x55a750]
setne cl
mov dword [0x55a780], ecx
test edx, edx
je 0x43c49d
push 1
mov ecx, str.UseProperSizeUnits
xor edi, edi
call fcn.004249f0
mov esi, eax
add esp, 4
test esi, esi
je 0x43c497
push edi
push edi
push esi
call fcn.004e439f
add esp, 0xc
mov edi, eax
push esi
call fcn.004d1211
add esp, 4
xor ecx, ecx
test edi, edi
jmp 0x43c4be
push 4
lea eax, [esp + 0x14]
mov edx, str.UseProperSizeUnits
push eax
push 4
mov ecx, 0x80000001
call fcn.0042db00
xor ecx, ecx
add esp, 0xc
cmp dword [esp + 0x10], ecx
mov ebx, dword [sym.imp.ole32.dll_CoInitializeEx]
sete cl
push 6
push 0
mov dword [0x5a2510], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x148], 0
call ebx
push 0
push 0
push 0
push 3
push 2
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
lea eax, [esp + 0x140]
push eax
push 0x5128e0
push 0x14
push 0
push 0x52c438
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test esi, esi
je 0x43c536
mov edi, dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
call edi
call fcn.0044b6b0
push eax
push str.Notice:_Disabling_VDS__Could_not_create_VDS_Loader_Instance:__s_
jmp 0x43c569
mov eax, dword [esp + 0x140]
lea edx, [esp + 0x18]
push edx
push 0x52aa1c
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0xc]
call eax
mov edi, dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, eax
test esi, esi
je 0x43c571
push esi
call edi
call fcn.0044b6b0
push eax
push str.Notice:_Disabling_VDS__Could_not_load_VDS_Service:__s_
call fcn.0044b0b0
add esp, 8
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x43c581
mov eax, dword [ecx]
push ecx
mov eax, dword [eax + 8]
call eax
mov ecx, dword [esp + 0x140]
test ecx, ecx
je 0x43c594
mov eax, dword [ecx]
push ecx
mov eax, dword [eax + 8]
call eax
test esi, esi
je 0x43c5a5
push esi
call edi
mov dword [0x55a318], 0xc003001f
mov edx, dword [0x55a750]
xor eax, eax
test esi, esi
sete al
mov dword [0x55325c], eax
test edx, edx
je 0x43c5ee
push 1
mov ecx, str.UseVds
xor edi, edi
call fcn.004249f0
mov esi, eax
add esp, 4
test esi, esi
je 0x43c5e8
push edi
push edi
push esi
call fcn.004e439f
add esp, 0xc
mov edi, eax
push esi
call fcn.004d1211
add esp, 4
xor ecx, ecx
test edi, edi
jmp 0x43c60f
push 4
lea eax, [esp + 0x14]
mov edx, str.UseVds
push eax
push 4
mov ecx, 0x80000001
call fcn.0042db00
xor ecx, ecx
add esp, 0xc
cmp dword [esp + 0x10], ecx
setne cl
test ecx, ecx
je 0x43c626
cmp dword [0x55325c], 0
je 0x43c626
mov eax, 1
jmp 0x43c628
xor eax, eax
mov edx, dword [0x55a750]
mov dword [0x55a764], eax
test edx, edx
je 0x43c66a
push 1
mov ecx, str.EnableUsbDebug
xor edi, edi
call fcn.004249f0
mov esi, eax
add esp, 4
test esi, esi
je 0x43c664
push edi
push edi
push esi
call fcn.004e439f
add esp, 0xc
mov edi, eax
push esi
call fcn.004d1211
add esp, 4
xor eax, eax
test edi, edi
jmp 0x43c68b
push 4
lea eax, [esp + 0x14]
mov edx, str.EnableUsbDebug
push eax
push 4
mov ecx, 0x80000001
call fcn.0042db00
xor eax, eax
add esp, 0xc
cmp dword [esp + 0x10], eax
mov edx, dword [0x55a750]
setne al
mov dword [0x5a29d4], eax
xor eax, 1
lea eax, [eax*2 + 1]
mov dword [0x553358], eax
test edx, edx
je 0x43c6df
push 1
mov ecx, str.DisableFakeDrivesCheck
xor edi, edi
call fcn.004249f0
mov esi, eax
add esp, 4
test esi, esi
je 0x43c6d9
push edi
push edi
push esi
call fcn.004e439f
add esp, 0xc
mov edi, eax
push esi
call fcn.004d1211
add esp, 4
xor ecx, ecx
test edi, edi
jmp 0x43c700
push 4
lea eax, [esp + 0x14]
mov edx, str.DisableFakeDrivesCheck
push eax
push 4
mov ecx, 0x80000001
call fcn.0042db00
xor ecx, ecx
add esp, 0xc
cmp dword [esp + 0x10], ecx
mov edx, dword [0x55a750]
sete cl
mov dword [0x5a2ae8], ecx
test edx, edx
je 0x43c746
push 1
mov ecx, str.EnableWindowsDualUefiBiosMode
xor edi, edi
call fcn.004249f0
mov esi, eax
add esp, 4
test esi, esi
je 0x43c740
push edi
push edi
push esi
call fcn.004e439f
add esp, 0xc
mov edi, eax
push esi
call fcn.004d1211
add esp, 4
xor ecx, ecx
test edi, edi
jmp 0x43c767
push 4
lea eax, [esp + 0x14]
mov edx, str.EnableWindowsDualUefiBiosMode
push eax
push 4
mov ecx, 0x80000001
call fcn.0042db00
xor ecx, ecx
add esp, 0xc
cmp dword [esp + 0x10], ecx
mov edx, dword [0x55a750]
setne cl
mov dword [0x5a288c], ecx
test edx, edx
je 0x43c7ad
push 1
mov ecx, str.ForceLargeFat32Formatting
xor edi, edi
call fcn.004249f0
mov esi, eax
add esp, 4
test esi, esi
je 0x43c7a7
push edi
push edi
push esi
call fcn.004e439f
add esp, 0xc
mov edi, eax
push esi
call fcn.004d1211
add esp, 4
xor ecx, ecx
test edi, edi
jmp 0x43c7ce
push 4
lea eax, [esp + 0x14]
mov edx, str.ForceLargeFat32Formatting
push eax
push 4
mov ecx, 0x80000001
call fcn.0042db00
xor ecx, ecx
add esp, 0xc
cmp dword [esp + 0x10], ecx
mov edx, dword [0x55a750]
setne cl
mov dword [0x5a29c4], ecx
test edx, edx
je 0x43c814
push 1
mov ecx, str.EnableVmdkDetection
xor edi, edi
call fcn.004249f0
mov esi, eax
add esp, 4
test esi, esi
je 0x43c80e
push edi
push edi
push esi
call fcn.004e439f
add esp, 0xc
mov edi, eax
push esi
call fcn.004d1211
add esp, 4
xor ecx, ecx
test edi, edi
jmp 0x43c835
push 4
lea eax, [esp + 0x14]
mov edx, str.EnableVmdkDetection
push eax
push 4
mov ecx, 0x80000001
call fcn.0042db00
xor ecx, ecx
add esp, 0xc
cmp dword [esp + 0x10], ecx
mov edx, dword [0x55a750]
setne cl
mov dword [0x5a23e4], ecx
test edx, edx
je 0x43c87b
push 1
mov ecx, str.EnableFileIndexing
xor edi, edi
call fcn.004249f0
mov esi, eax
add esp, 4
test esi, esi
je 0x43c875
push edi
push edi
push esi
call fcn.004e439f
add esp, 0xc
mov edi, eax
push esi
call fcn.004d1211
add esp, 4
xor ecx, ecx
test edi, edi
jmp 0x43c89c
push 4
lea eax, [esp + 0x14]
mov edx, str.EnableFileIndexing
push eax
push 4
mov ecx, 0x80000001
call fcn.0042db00
xor ecx, ecx
add esp, 0xc
cmp dword [esp + 0x10], ecx
mov edx, dword [0x55a750]
setne cl
mov dword [0x5a29c8], ecx
test edx, edx
je 0x43c8e2
push 1
mov ecx, str.DisableVHDs
xor edi, edi
call fcn.004249f0
mov esi, eax
add esp, 4
test esi, esi
je 0x43c8dc
push edi
push edi
push esi
call fcn.004e439f
add esp, 0xc
mov edi, eax
push esi
call fcn.004d1211
add esp, 4
xor ecx, ecx
test edi, edi
jmp 0x43c903
push 4
lea eax, [esp + 0x14]
mov edx, str.DisableVHDs
push eax
push 4
mov ecx, 0x80000001
call fcn.0042db00
xor ecx, ecx
add esp, 0xc
cmp dword [esp + 0x10], ecx
mov edx, dword [0x55a750]
sete cl
mov dword [0x553330], ecx
test edx, edx
je 0x43c949
push 1
mov ecx, str.EnableExtraHashes
xor edi, edi
call fcn.004249f0
mov esi, eax
add esp, 4
test esi, esi
je 0x43c943
push edi
push edi
push esi
call fcn.004e439f
add esp, 0xc
mov edi, eax
push esi
call fcn.004d1211
add esp, 4
xor ecx, ecx
test edi, edi
jmp 0x43c96a
push 4
lea eax, [esp + 0x14]
mov edx, str.EnableExtraHashes
push eax
push 4
mov ecx, 0x80000001
call fcn.0042db00
xor ecx, ecx
add esp, 0xc
cmp dword [esp + 0x10], ecx
mov edx, dword [0x55a750]
setne cl
mov dword [0x55b20c], ecx
test edx, edx
je 0x43c9b0
push 1
mov ecx, str.ExpertMode
xor edi, edi
call fcn.004249f0
mov esi, eax
add esp, 4
test esi, esi
je 0x43c9aa
push edi
push edi
push esi
call fcn.004e439f
add esp, 0xc
mov edi, eax
push esi
call fcn.004d1211
add esp, 4
xor ecx, ecx
test edi, edi
jmp 0x43c9d1
push 4
lea eax, [esp + 0x14]
mov edx, str.ExpertMode
push eax
push 4
mov ecx, 0x80000001
call fcn.0042db00
xor ecx, ecx
add esp, 0xc
cmp dword [esp + 0x10], ecx
mov edx, dword [0x55a750]
setne cl
mov dword [0x55a7d4], ecx
test edx, edx
je 0x43ca17
push 1
mov ecx, str.IgnoreBootMarker
xor edi, edi
call fcn.004249f0
mov esi, eax
add esp, 4
test esi, esi
je 0x43ca11
push edi
push edi
push esi
call fcn.004e439f
add esp, 0xc
mov edi, eax
push esi
call fcn.004d1211
add esp, 4
xor ecx, ecx
test edi, edi
jmp 0x43ca38
push 4
lea eax, [esp + 0x14]
mov edx, str.IgnoreBootMarker
push eax
push 4
mov ecx, 0x80000001
call fcn.0042db00
xor ecx, ecx
add esp, 0xc
cmp dword [esp + 0x10], ecx
mov edx, dword [0x55a750]
setne cl
mov dword [0x55a7dc], ecx
test edx, edx
je 0x43ca7e
push 1
mov ecx, str.PersistentLog
xor edi, edi
call fcn.004249f0
mov esi, eax
add esp, 4
test esi, esi
je 0x43ca78
push edi
push edi
push esi
call fcn.004e439f
add esp, 0xc
mov edi, eax
push esi
call fcn.004d1211
add esp, 4
xor ecx, ecx
test edi, edi
jmp 0x43ca9f
push 4
lea eax, [esp + 0x14]
mov edx, str.PersistentLog
push eax
push 4
mov ecx, 0x80000001
call fcn.0042db00
xor ecx, ecx
add esp, 0xc
cmp dword [esp + 0x10], ecx
setne cl
mov dword [0x55a7cc], ecx
mov ecx, str.PreferredSaveImageType
call fcn.0042e210
mov edx, dword [0x55a750]
mov dword [0x55b1f0], eax
test edx, edx
je 0x43caf0
push 1
mov ecx, str.WindowsUserExperienceOptions
xor esi, esi
call fcn.004249f0
mov edi, eax
add esp, 4
test edi, edi
je 0x43cb0f
push esi
push esi
push edi
call fcn.004e439f
add esp, 0xc
mov esi, eax
push edi
call fcn.004d1211
add esp, 4
jmp 0x43cb0f
push 4
lea eax, [esp + 0x14]
mov edx, str.WindowsUserExperienceOptions
push eax
push 4
mov ecx, 0x80000001
call fcn.0042db00
mov esi, dword [esp + 0x1c]
add esp, 0xc
mov ecx, esi
shr ecx, 0x10
test ecx, ecx
je 0x43cb2b
mov eax, ecx
and ecx, esi
not eax
and eax, dword [0x55334c]
or eax, ecx
mov dword [0x55334c], eax
mov edx, dword [0x55a750]
test edx, edx
je 0x43cb64
push 1
mov ecx, str.DefaultThreadPriority
xor edi, edi
call fcn.004249f0
mov esi, eax
add esp, 4
test esi, esi
je 0x43cb83
push edi
push edi
push esi
call fcn.004e439f
add esp, 0xc
mov edi, eax
push esi
call fcn.004d1211
add esp, 4
jmp 0x43cb83
push 4
lea eax, [esp + 0x14]
mov edx, str.DefaultThreadPriority
push eax
push 4
mov ecx, 0x80000001
call fcn.0042db00
mov edi, dword [esp + 0x1c]
add esp, 0xc
lea eax, [edi + 1]
push 0
mov dword [0x553320], eax
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
push 0x58
push esi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
movd xmm0, eax
cvtdq2ps xmm0, xmm0
divss xmm0, dword [0x549ad0]
movss dword [0x553328], xmm0
cmp esi, 0xffffffff
je 0x43cbc7
test esi, esi
je 0x43cbc7
push esi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
xor ecx, ecx
call fcn.0041e160
push str.rufus.loc
push 0x5a2400
push 0x537198
lea eax, [esp + 0x20c]
push 0x104
push eax
call fcn.004050d0
add esp, 0x14
mov byte [esp + 0x303], 0
lea ecx, [esp + 0x200]
call fcn.0042d470
cmp eax, 0xffffffff
jne 0x43d110
push str.loc_file_not_found_in_current_directory___embedded_one_will_be_used
call fcn.0044b0b0
mov esi, dword [0x5a29d0]
add esp, 4
xor ebx, ebx
push 0xa
push 0x1f4
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x43cc56
call fcn.0044b6b0
push eax
push str.embedded.loc
push str.Could_not_locate_resource__s:__s
call fcn.0044b0b0
mov edi, dword [esp + 0x1c]
add esp, 0xc
jmp 0x43cc95
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
jne 0x43cc82
call fcn.0044b6b0
push eax
push str.embedded.loc
push str.Could_not_load_resource__s:__s
call fcn.0044b0b0
mov edi, dword [esp + 0x1c]
add esp, 0xc
jmp 0x43cc95
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push ebx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
lea eax, [esp + 0x200]
push eax
push ecx
call fcn.0042d150
add esp, 8
test eax, eax
je 0x43d0e9
cmp byte [esp + 0x200], 0
je 0x43d0e9
push ecx
push 0x80
push 2
sub esp, 8
lea ecx, [esp + 0x214]
mov edx, 0xc0000000
call fcn.0042cc40
mov esi, eax
add esp, 0x14
cmp esi, 0xffffffff
je 0x43d0aa
push ecx
lea eax, [esp + 0x80]
mov edx, ebx
push eax
push edi
mov ecx, esi
call fcn.0044c2e0
add esp, 0xc
test eax, eax
je 0x43d0aa
lea eax, [esp + 0x200]
push eax
push str.localization:_extracted_data_to__s
call fcn.0044b0b0
add esp, 8
test esi, esi
je 0x43cd24
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [sym.imp.ole32.dll_CoInitializeEx]
lea ecx, [esp + 0x200]
call fcn.00423df0
test eax, eax
je 0x43cd6d
mov eax, dword [esp + 0x34]
test eax, eax
jne 0x43d1dd
mov eax, dword [0x55a33c]
cmp eax, 0x55a338
jne 0x43d186
push str.localization:_the_locale_list_is_empty__n
call fcn.0044b0b0
add esp, 4
mov dword [0x55a798], 0
push str.FATAL:_Could_not_access_locale_
call fcn.0044b0b0
add esp, 4
push 0x1010
push str.Fatal_error
push str.The_locale_data_is_missing_or_invalid._This_application_will_now_exit.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ebx, dword [esp + 0x14]
mov ecx, 0x5a2400
call fcn.0042d600
mov esi, dword [esp + 0x84]
test esi, esi
je 0x43cdec
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
cmp esi, 0xffffffff
je 0x43cdbd
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor esi, esi
push str.rufus.com
call edi
test eax, eax
jne 0x43cdec
cmp esi, 0xa
jg 0x43cdec
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.rufus.com
inc esi
call edi
test eax, eax
je 0x43cdd0
mov eax, dword [0x55a74c]
test eax, eax
je 0x43cdfe
push 1
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
cmp dword [esp + 0x88], 0
jne 0x43ce3d
cmp byte [esp + 0x200], 0
je 0x43ce3d
lea ecx, [esp + 0x200]
call fcn.0042ccf0
test eax, eax
jne 0x43ce3d
call fcn.0044b6b0
push eax
lea eax, [esp + 0x204]
push eax
push str.Could_not_delete__s:__s
call fcn.0044b0b0
add esp, 0xc
call fcn.00450c20
push dword [0x59eac0]
call dword [sym.imp.USER32.dll_UnhookWinEvent]
xor ecx, ecx
mov dword [0x59eac0], 0
call fcn.0041e260
push dword [0x55a75c]
call fcn.004d1211
add esp, 4
mov dword [0x55a75c], 0
push dword [0x55a790]
call fcn.004d1211
add esp, 4
mov dword [0x55a790], 0
push dword [esp + 0x34]
call fcn.004d1211
add esp, 4
push dword [0x55a7b0]
call fcn.004d1211
add esp, 4
mov dword [0x55a7b0], 0
push dword [0x55a7b4]
call fcn.004d1211
add esp, 4
mov dword [0x55a7b4], 0
push dword [0x55a320]
call fcn.004d1211
add esp, 4
mov dword [0x55a320], 0
push dword [0x55a7bc]
call fcn.004d1211
add esp, 4
mov dword [0x55a7bc], 0
push dword [0x55a748]
call fcn.004d1211
add esp, 4
mov dword [0x55a748], 0
push dword [0x55b204]
call fcn.004d1211
add esp, 4
mov dword [0x55b204], 0
test ebx, ebx
je 0x43cf59
xor esi, esi
cmp dword [esp + 0x28], esi
jle 0x43cf50
push dword [ebx + esi*4]
call fcn.004d1211
mov dword [ebx + esi*4], 0
add esp, 4
inc esi
cmp esi, dword [esp + 0x28]
jl 0x43cf37
push ebx
call fcn.004d1211
add esp, 4
cmp dword [esp + 0x8c], 0
je 0x43cf75
push 0
sub esp, 8
mov ecx, 1
call fcn.0044a440
add esp, 0xc
cmp dword [esp + 0x48], 0
jne 0x43cfdd
push 0
push 0x80
push 3
push 0
push 3
push 0
push str..MountPointManager
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x43cfd0
push 0
lea eax, [esp + 0x58]
push eax
push 0
push 0
push 4
lea eax, [esp + 0x24]
push eax
push 0x6dc040
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
jne 0x43cfdd
push str.Failed_to_restore_AutoMount_to_disabled
call fcn.0044b0b0
add esp, 4
cmp dword [0x55b210], 0
je 0x43cff8
push 0x5a0980
push 0x525f4c
call fcn.0044b0b0
add esp, 8
cmp dword [esp + 0x90], 0
mov dword [0x55b210], 0
je 0x43d02b
push 3
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
call dword [sym.imp.KERNEL32.dll_FreeConsole]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ax, word [0x55a758]
test ax, ax
je 0x43d070
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edi, 0xffff
nop word [eax + eax]
add ax, di
mov word [0x55a758], ax
movzx eax, ax
push dword [eax*4 + 0x5a29e0]
call esi
mov ax, word [0x55a758]
test ax, ax
jne 0x43d050
mov eax, dword [esp + 0x3c]
cmp eax, 0xffffffff
je 0x43d084
test eax, eax
je 0x43d084
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str._Rufus_exit__n
call fcn.0044b0b0
mov ecx, dword [esp + 0x728]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004a8b60
mov esp, ebp
pop ebp
ret 0x10
call fcn.0044b6b0
push eax
lea eax, [esp + 0x204]
push eax
push str.FATAL:_Unable_to_extract_loc_file__s:__s
call fcn.0044b0b0
add esp, 0xc
cmp esi, 0xffffffff
je 0x43d0d5
test esi, esi
je 0x43d0d5
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x1010
push str.Fatal_error
push str.Unable_to_extract_localization_file._This_application_will_now_exit.
jmp 0x43cd89
call fcn.0044b6b0
push eax
push str.FATAL:_Unable_to_create_temp_loc_file:__s
call fcn.0044b0b0
add esp, 8
push 0x1010
push str.Fatal_error
push str.Unable_to_create_temporary_localization_file._This_application_will_now_exit.
jmp 0x43cd89
mov ecx, dword [0x55b210]
lea eax, [esp + 0x200]
push eax
mov eax, 0xffc
mov dword [esp + 0x8c], 1
sub eax, ecx
push str.Using_external_loc_file__s
push eax
lea eax, [ecx + 0x5a0980]
push eax
call fcn.004050d0
mov ecx, 0x5a0980
mov byte [0x5a197b], 0
add esp, 0x10
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x43d154
sub ecx, edx
mov word [ecx + 0x5a0980], 0xa0d
add ecx, 2
mov dword [0x55b210], ecx
cmp ecx, 0x1000
jae 0x43ef63
mov byte [ecx + 0x5a0980], al
jmp 0x43cd2a
lea edi, [eax - 0x1c]
mov esi, edi
lea eax, [esi + 0x1c]
cmp eax, 0x55a338
je 0x43d1c5
movzx edx, byte [esi + 1]
xor ecx, ecx
test edx, edx
je 0x43d1b8
mov eax, dword [esi + 0x10]
mov ebx, dword [esp + 0x20]
cmp dword [eax], ebx
mov ebx, dword [sym.imp.ole32.dll_CoInitializeEx]
je 0x43d1eb
inc ecx
add eax, 4
cmp ecx, edx
jl 0x43d1a2
mov eax, dword [esi + 0x20]
lea esi, [eax - 0x1c]
cmp eax, 0x55a338
jne 0x43d195
push dword [edi + 0x14]
push dword [esp + 0x24]
push str.localization:_could_not_find_locale_for_LCID:_0x_04X._Will_default_to__s_n
call fcn.0044b0b0
add esp, 0xc
mov esi, edi
jmp 0x43d1eb
mov edx, 1
mov ecx, eax
call fcn.0041f000
mov esi, eax
mov dword [0x55a798], esi
test esi, esi
je 0x43cd6d
mov ecx, esi
call fcn.0041f180
mov ecx, 0x58b260
mov word [0x551f34], ax
call fcn.00448090
mov eax, dword [0x58b260]
cmp eax, 0x61
jbe 0x43eee2
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x43d22d
mov eax, ecx
mov dword [0x58b260], eax
cmp eax, 0x61
jbe 0x43eee2
push ecx
lea eax, [esp + 0x14]
mov dword [esp + 0x20], 0
push eax
push ecx
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystemEnableLUA
mov dword [esp + 0x2c], 0xffffffff
mov ecx, 0x80000002
mov dword [esp + 0x14c], 0
mov word [esp + 0x150], 0x500
call fcn.004474e0
add esp, 0xc
cmp dword [esp + 0x10], 1
jne 0x43d2fc
push str.Note:_UAC_is_active
call fcn.0044b0b0
add esp, 4
lea eax, [esp + 0x20]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x43d2bc
call fcn.0044b6b0
push eax
push str.Could_not_get_current_process_token:__s
call fcn.0044b0b0
add esp, 8
jmp 0x43d358
lea eax, [esp + 0x54]
push eax
push 4
lea eax, [esp + 0x20]
push eax
push 0x14
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x43d2ed
call fcn.0044b6b0
push eax
push str.Could_not_get_token_information:__s
call fcn.0044b0b0
add esp, 8
jmp 0x43d358
xor eax, eax
cmp dword [esp + 0x18], eax
setne al
mov dword [esp + 0x1c], eax
jmp 0x43d358
push str.Note:_UAC_is_either_disabled_or_not_available
call fcn.0044b0b0
add esp, 4
lea eax, [esp + 0x30]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [esp + 0x168]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x43d358
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x34]
push 0
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x43d34e
mov dword [esp + 0x1c], eax
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [esp + 0x20]
cmp eax, 0xffffffff
je 0x43d36c
test eax, eax
je 0x43d36c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x1c], 0
jne 0x43d3df
push str.FATAL:_No_administrative_privileges_
call fcn.0044b0b0
mov edx, dword [0x55a798]
lea ecx, [esp + 0x204]
add esp, 4
call fcn.00424380
mov eax, dword [0x55a798]
mov edx, 0x181010
mov ecx, dword [eax + 4]
mov eax, 0x1010
and ecx, 1
push ecx
cmovne eax, edx
mov dword [0x55a760], ecx
push eax
push 0xcd8
call fcn.0041e970
add esp, 4
push eax
push ecx
push 0xcd9
call fcn.0041e970
add esp, 8
mov edx, eax
xor ecx, ecx
call fcn.0042c4e0
add esp, 0xc
jmp 0x43cd91
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x43d425
mov ecx, edx
lea esi, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x43d3f0
sub ecx, esi
cmp ecx, 2
jne 0x43d425
cmp byte [edx], 0x2f
jne 0x43d425
cmp byte [edx + 1], 0x57
jne 0x43d425
mov esi, dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edi, 0x96
push str.Global_Rufus
push 1
push 0
call esi
mov dword [esp + 0x3c], eax
jmp 0x43d442
mov esi, dword [sym.imp.KERNEL32.dll_CreateMutexA]
push str.Global_Rufus
push 1
push 0
call esi
mov edi, dword [esp + 0x2c]
mov dword [esp + 0x3c], eax
test edi, edi
jle 0x43d47e
test eax, eax
je 0x43ee83
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x43d486
mov eax, dword [esp + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.Global_Rufus
push 1
push 0
call esi
dec edi
mov dword [esp + 0x3c], eax
test edi, edi
jg 0x43d442
test eax, eax
je 0x43ee83
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x43ee83
mov eax, dword [esp + 0x80]
push 6
push 0
mov dword [0x5a29d0], eax
call ebx
mov ecx, str.Riched20
call fcn.0042c000
test eax, eax
jne 0x43d4ca
call fcn.0044b6b0
push eax
push str.Could_not_load_RichEdit_library___some_dialogs_may_not_display:__s
call fcn.0044b0b0
add esp, 8
call fcn.0042b1d0
push 0x9e
sub esp, 8
xor ecx, ecx
call fcn.0044a440
add esp, 0xc
mov dword [esp + 0x8c], eax
push 0
push 0x80
push 3
push 0
push 3
push 0
push str..MountPointManager
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x43d5ae
push 0
lea eax, [esp + 0x58]
push eax
push 4
lea eax, [esp + 0x54]
push eax
push 0
push 0
push 0x6d003c
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, eax
push edi
call ebx
test esi, esi
je 0x43d5ae
cmp dword [esp + 0x48], 0
jne 0x43d5c3
push str.AutoMount_was_detected_as_disabled___temporarily_re_enabling_it
call fcn.0044b0b0
add esp, 4
mov dword [esp + 0x10], 1
push 0
push 0x80
push 3
push 0
push 3
push 0
push str..MountPointManager
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x43d5a2
push 0
lea eax, [esp + 0x58]
push eax
push 0
push 0
push 4
lea eax, [esp + 0x24]
push eax
push 0x6dc040
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push edi
mov esi, eax
call ebx
test esi, esi
jne 0x43d5c3
push str.Failed_to_enable_AutoMount
call fcn.0044b0b0
jmp 0x43d5c0
push str.Could_not_get_AutoMount_status
call fcn.0044b0b0
mov dword [esp + 0x4c], 1
add esp, 4
xor eax, eax
mov dword [esp + 0x14c], 0
xor ecx, ecx
xor edi, edi
push ebx
cpuid
mov esi, ebx
mov dword [esp + 0x178], edi
mov dword [esp + 0x164], edi
pop ebx
lea ebx, [esp + 0x14c]
mov dword [ebx], eax
mov dword [ebx + 4], esi
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], edx
mov eax, dword [esp + 0x14c]
cmp eax, 1
jb 0x43d633
mov eax, 1
lea edi, [esp + 0x16c]
xor ecx, ecx
push ebx
cpuid
mov esi, ebx
pop ebx
mov dword [edi], eax
mov eax, dword [esp + 0x14c]
mov dword [edi + 4], esi
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
mov edi, dword [esp + 0x174]
cmp eax, 7
jb 0x43d657
mov eax, 7
xor ecx, ecx
push ebx
cpuid
mov esi, ebx
pop ebx
lea ebx, [esp + 0x15c]
mov dword [ebx], eax
mov dword [ebx + 4], esi
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], edx
bt edi, 0x13
setb cl
bt edi, 9
setb al
test al, cl
je 0x43d67d
test dword [esp + 0x160], 0x20000000
je 0x43d67d
mov eax, 1
jmp 0x43d67f
xor eax, eax
mov dword [0x55a308], eax
xor ecx, ecx
xor eax, eax
mov dword [esp + 0x14c], 0
push ebx
cpuid
xor edi, edi
mov esi, ebx
mov dword [esp + 0x178], edi
mov dword [esp + 0x164], edi
pop ebx
lea ebx, [esp + 0x14c]
mov dword [ebx], eax
mov dword [ebx + 4], esi
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], edx
mov eax, dword [esp + 0x14c]
cmp eax, 1
jb 0x43d6f4
mov eax, 1
lea edi, [esp + 0x16c]
xor ecx, ecx
push ebx
cpuid
mov esi, ebx
pop ebx
mov dword [edi], eax
mov eax, dword [esp + 0x14c]
mov dword [edi + 4], esi
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
mov edi, dword [esp + 0x174]
cmp eax, 7
jb 0x43d718
mov eax, 7
xor ecx, ecx
push ebx
cpuid
mov esi, ebx
pop ebx
lea ebx, [esp + 0x15c]
mov dword [ebx], eax
mov dword [ebx + 4], esi
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], edx
bt edi, 0x13
setb cl
bt edi, 9
setb al
test al, cl
je 0x43d73e
test dword [esp + 0x160], 0x20000000
je 0x43d73e
mov eax, 1
jmp 0x43d740
xor eax, eax
push 0x5a2780
push str._sdismFfuProvider.dll
mov dword [0x55a30c], eax
lea eax, [esp + 0x310]
push 0x104
push eax
call fcn.004050d0
lea ecx, [esp + 0x318]
mov byte [esp + 0x41b], 0
call fcn.0042d8d0
mov ecx, dword [0x55b210]
neg eax
sbb eax, eax
inc eax
mov dword [0x55a77c], eax
mov eax, dword [0x55a798]
push dword [eax + 0x14]
mov eax, 0xffc
sub eax, ecx
push str.Localization_set_to__s
push eax
lea eax, [ecx + 0x5a0980]
push eax
call fcn.004050d0
mov ecx, 0x5a0980
mov byte [0x5a197b], 0
add esp, 0x20
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x43d7b8
sub ecx, edx
mov word [ecx + 0x5a0980], 0xa0d
add ecx, 2
mov dword [0x55b210], ecx
cmp ecx, 0x1000
jae 0x43ef63
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
mov esi, 0x181034
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [0x55a798]
push dword [0x55a7bc]
mov byte [ecx + 0x5a0980], 0
mov byte [0x551e6c], 1
mov eax, dword [eax + 4]
and eax, 1
mov byte [0x5a1c20], 0
mov dword [0x55a760], eax
mov dword [0x59d4c8], 0
call fcn.004d1211
xor eax, eax
mov dword [0x55a7bc], 0
add esp, 4
cmp dword [0x55a760], eax
setne al
push eax
call dword [sym.imp.USER32.dll_SetProcessDefaultLayout]
mov edx, dword [0x55a798]
lea ecx, [esp + 0x200]
call fcn.00424380
test eax, eax
je 0x43d8af
cmp dword [0x55a750], 0
mov eax, dword [0x55a798]
mov edx, dword [eax + 0x14]
je 0x43d880
push ecx
mov ecx, str.Locale
call fcn.00424e40
add esp, 4
jmp 0x43d8af
test edx, edx
jne 0x43d888
xor ecx, ecx
jmp 0x43d89e
mov ecx, edx
lea esi, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x43d890
sub ecx, esi
mov esi, 0x181034
push ecx
push edx
push 1
mov edx, str.Locale
call fcn.0042dd60
add esp, 0xc
cmp dword [esp + 0x4c], 0
jne 0x43d900
cmp dword [0x55a760], 0
mov eax, 0x1034
push ecx
cmovne eax, esi
push eax
push 0xcdf
call fcn.0041e970
add esp, 4
push eax
push ecx
push 0xce0
call fcn.0041e970
add esp, 8
mov edx, eax
xor ecx, ecx
call fcn.0042c4e0
add esp, 0xc
cmp eax, 6
jne 0x43cd91
mov dword [esp + 0x4c], 1
mov eax, dword [esp + 0x24]
test eax, eax
je 0x43d90f
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov ecx, 0x65
call fcn.00453070
mov esi, eax
test esi, esi
jne 0x43d936
push 0x726
push str.D:_a_rufus_rufus_src_stdlg.c
push str.rcTemplate___NULL
call fcn.004dfbbc
add esp, 0xc
push 0
push 0x436f60
push 0
push esi
push dword [esp + 0x90]
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
push esi
mov dword [esp + 0x28], eax
call fcn.004d1211
mov esi, dword [esp + 0x28]
add esp, 4
test esi, esi
je 0x43ed7c
mov ecx, dword [0x553794]
cmp ecx, 0xffff0000
jle 0x43d991
mov eax, dword [0x553798]
cmp eax, 0xffff0000
jle 0x43d991
push 1
push 0
push 0
push eax
push ecx
push 0
push esi
call dword [sym.imp.USER32.dll_SetWindowPos]
push 0
push 1
push 0x233
push esi
mov esi, dword [sym.imp.USER32.dll_ChangeWindowMessageFilterEx]
call esi
push 0
push 1
push 0x4a
push dword [esp + 0x30]
call esi
push 0
push 1
push 0x49
push dword [esp + 0x30]
call esi
call fcn.00453590
cmp dword [0x59eac0], 0
jne 0x43d9f6
push 2
push 0
push 0
push 0x453450
push 0
push 3
push 3
call dword [sym.imp.USER32.dll_SetWinEventHook]
mov dword [0x59eac0], eax
test eax, eax
jne 0x43d9f6
push str.Warning:_Could_not_set_alert_prompt_hook
call fcn.0044b0b0
add esp, 4
mov esi, dword [esp + 0x24]
push 1
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0
push 0
push 0
lea eax, [esp + 0x64]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x43de46
mov eax, dword [esp + 0x5c]
cmp eax, 0x104
jne 0x43da3f
test dword [esp + 0x64], 0x20000000
jne 0x43da3f
mov esi, 1
jmp 0x43da48
xor esi, esi
cmp eax, 0x104
jne 0x43da59
cmp dword [esp + 0x60], 0x12
je 0x43da59
mov dword [esp + 0x38], 1
jmp 0x43da70
push 0x12
call ebx
mov ecx, dword [esp + 0x44]
test ax, ax
mov eax, 1
cmovs ecx, eax
mov dword [esp + 0x44], ecx
push dword [0x55a7d0]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x43dab2
push 0x11
call ebx
test ax, ax
jns 0x43dab2
cmp dword [esp + 0x5c], 0x100
mov ecx, dword [esp + 0x60]
jne 0x43dab6
cmp ecx, 0x41
jne 0x43dab6
push 0xffffffffffffffff
push 0
push 0xb1
push dword [0x55a7ec]
call edi
jmp 0x43de2d
mov ecx, dword [esp + 0x60]
test esi, esi
je 0x43dac9
cmp ecx, 0x11
jne 0x43dac9
mov eax, dword [0x55331c]
mov dword [0x59d300], eax
cmp dword [0x59d300], 0
jne 0x43dae9
push 0x11
call ebx
mov ecx, dword [esp + 0x60]
test ax, ax
jns 0x43db11
cmp dword [esp + 0x5c], 0x100
jne 0x43db11
cmp ecx, 0x4c
jne 0x43db11
push 0
push 0x41e
push 0x111
push dword [0x5a2ae4]
mov dword [0x59d300], 0
call edi
jmp 0x43de2d
cmp dword [0x59d300], 0
jne 0x43db31
push 0x11
call ebx
mov ecx, dword [esp + 0x60]
test ax, ax
jns 0x43db40
cmp dword [esp + 0x5c], 0x100
jne 0x43db40
cmp ecx, 0x54
jne 0x43db40
call fcn.004467d0
jmp 0x43de2d
cmp dword [0x59d300], 0
jne 0x43db68
push 0x11
call ebx
mov ecx, dword [esp + 0x60]
test ax, ax
jns 0x43dbf8
cmp dword [esp + 0x5c], 0x100
jne 0x43dbf8
cmp ecx, 0x50
jne 0x43dbf8
xor eax, eax
cmp dword [0x55a7cc], eax
sete al
cmp dword [0x55a750], 0
mov dword [0x55a7cc], eax
je 0x43dbce
push eax
push 0x5323b0
lea eax, [esp + 0x148]
push 0xc
push eax
call fcn.004050d0
add esp, 0xc
mov byte [esp + 0x14f], 0
lea edx, [esp + 0x144]
mov ecx, str.PersistentLog
call fcn.00424e40
mov esi, dword [0x55a7cc]
add esp, 4
push 0xd08
jmp 0x43ecce
mov dword [esp + 0x10], eax
mov edx, str.PersistentLog
push 4
lea eax, [esp + 0x14]
push eax
push 4
call fcn.0042dd60
mov esi, dword [0x55a7cc]
add esp, 0xc
push 0xd08
jmp 0x43ecce
test esi, esi
je 0x43dc14
cmp ecx, 0x11
je 0x43de2d
mov dword [0x59d300], 0
jmp 0x43de2d
cmp dword [esp + 0x5c], 0x104
jne 0x43dd06
cmp ecx, 0xbb
je 0x43dc58
cmp ecx, 0xbd
je 0x43dc40
cmp ecx, 0x6b
je 0x43dc58
cmp ecx, 0x6d
jne 0x43dd06
cmp ecx, 0x6b
je 0x43dc58
mov eax, dword [0x553320]
or ecx, 0xffffffff
cmp eax, 0xfffffffe
jle 0x43dcfb
jmp 0x43dc6b
mov eax, dword [0x553320]
mov ecx, 1
cmp eax, 2
jge 0x43dcfb
add eax, ecx
mov dword [0x553320], eax
dec eax
cmp dword [0x55a750], 0
je 0x43dcb2
push eax
push 0x5323b0
lea eax, [esp + 0x184]
push 0xc
push eax
call fcn.004050d0
add esp, 0xc
mov byte [esp + 0x18b], 0
lea edx, [esp + 0x180]
mov ecx, str.DefaultThreadPriority
call fcn.00424e40
add esp, 4
jmp 0x43dccc
mov dword [esp + 0x30], eax
mov edx, str.DefaultThreadPriority
push 4
lea eax, [esp + 0x34]
push eax
push 4
call fcn.0042dd60
add esp, 0xc
mov eax, dword [0x55a78c]
mov esi, dword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
je 0x43dce4
push dword [0x553320]
push eax
call esi
mov eax, dword [0x55b228]
test eax, eax
je 0x43dcf6
push dword [0x553320]
push eax
call esi
mov eax, dword [0x553320]
push eax
push 0xcf6
jmp 0x43ece2
cmp dword [0x55331c], 0
jne 0x43ecf8
cmp dword [esp + 0x5c], 0x104
jne 0x43ea68
cmp ecx, 0xbe
jne 0x43dde1
xor ecx, ecx
cmp dword [0x5a29d4], ecx
sete cl
mov eax, ecx
mov dword [0x5a29d4], ecx
xor eax, 1
cmp dword [0x55a750], 0
lea eax, [eax*2 + 1]
mov dword [0x553358], eax
je 0x43dd8e
push ecx
push 0x5323b0
lea eax, [esp + 0x190]
push 0xc
push eax
call fcn.004050d0
add esp, 0xc
mov byte [esp + 0x197], 0
lea edx, [esp + 0x18c]
mov ecx, str.EnableUsbDebug
call fcn.00424e40
add esp, 4
jmp 0x43dda8
push 4
lea eax, [esp + 0x14]
mov dword [esp + 0x14], ecx
push eax
push 4
mov edx, str.EnableUsbDebug
call fcn.0042dd60
add esp, 0xc
mov esi, dword [0x5a29d4]
push 0xcc6
call fcn.0041e970
add esp, 4
neg esi
sbb esi, esi
add esi, 0xcb3
push eax
push esi
push 0xdac
push 0
push 0
call fcn.0041ed70
add esp, 0x14
xor ecx, ecx
call fcn.00456690
jmp 0x43de2d
cmp ecx, 0xbc
jne 0x43def1
xor ebx, ebx
cmp dword [0x553300], ebx
push 0xcd2
sete bl
mov dword [0x553300], ebx
call fcn.0041e970
add esp, 4
xor ebx, 1
add ebx, 0xcb2
push eax
push ebx
push 0xdac
push 0
push 0
call fcn.0041ed70
add esp, 0x14
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push 0
push 0
push 0
lea eax, [esp + 0x64]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x43da23
mov eax, dword [0x55b214]
test eax, eax
je 0x43de58
push 0
push 0
push 0x10
push eax
call edi
cmp dword [0x59d4d4], 0
je 0x43cd91
mov esi, 1
mov dword [0x59d4d4], 0
mov ecx, esi
call fcn.0041e260
mov ecx, esi
call fcn.0041e160
mov eax, dword [0x55a798]
mov ecx, dword [0x55b210]
push dword [eax + 0x14]
mov eax, 0xffc
sub eax, ecx
push str.Localization_set_to__s
push eax
lea eax, [ecx + 0x5a0980]
push eax
call fcn.004050d0
mov ecx, 0x5a0980
mov byte [0x5a197b], 0
add esp, 0x10
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x43dec0
sub ecx, edx
mov esi, 0x181034
mov word [ecx + 0x5a0980], 0xa0d
add ecx, 2
mov dword [0x55b210], ecx
cmp ecx, 0x1000
jae 0x43ef63
jmp 0x43d7f0
cmp ecx, 0x42
jne 0x43df84
xor eax, eax
cmp dword [0x5a2ae8], eax
sete al
mov dword [0x5a2ae8], eax
xor eax, 1
cmp dword [0x55a750], 0
je 0x43df5a
push eax
push 0x5323b0
lea eax, [esp + 0x19c]
push 0xc
push eax
call fcn.004050d0
add esp, 0xc
mov byte [esp + 0x1a3], 0
lea edx, [esp + 0x198]
mov ecx, str.DisableFakeDrivesCheck
call fcn.00424e40
mov esi, dword [0x5a2ae8]
add esp, 4
push 0xcb8
jmp 0x43ecce
mov dword [esp + 0x10], eax
mov edx, str.DisableFakeDrivesCheck
push 4
lea eax, [esp + 0x14]
push eax
push 4
call fcn.0042dd60
mov esi, dword [0x5a2ae8]
add esp, 0xc
push 0xcb8
jmp 0x43ecce
cmp ecx, 0x43
jne 0x43dfae
push 0
push 0
push 0x147
push dword [0x5a289c]
call edi
test eax, eax
js 0x43de2d
mov ecx, eax
call fcn.00455a20
jmp 0x43de2d
cmp ecx, 0x44
jne 0x43e0c8
push 0x52b2c8
push 0x5a28c0
push 0x52fa28
lea eax, [esp + 0x314]
push 0x104
push eax
call fcn.004050d0
add esp, 0x14
mov byte [esp + 0x40b], 0
lea eax, [esp + 0x308]
push eax
push 0xcc0
push 0xdac
push 1
push 0
call fcn.0041ed70
lea esi, [esp + 0x31c]
add esp, 0x14
lea ecx, [esi + 1]
nop dword [eax + eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x43e010
sub esi, ecx
add esi, 2
push 2
push esi
call fcn.004b6706
add esp, 8
mov dword [esp + 0x9c], 0
mov edi, eax
mov dword [esp + 0xa0], 3
mov eax, 0x414
mov dword [esp + 0xa4], edi
mov word [esp + 0xac], ax
lea eax, [esp + 0x308]
push esi
push edi
push 0xffffffffffffffff
push eax
push 0
push 0xfde9
mov dword [esp + 0xc0], 0
mov dword [esp + 0xc6], 0
mov dword [esp + 0xca], 0
mov dword [esp + 0xce], 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [esp + 0x9c]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test edi, edi
je 0x43e0b3
push edi
call fcn.004d1211
add esp, 4
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
mov dword [0x59d30c], 1
jmp 0x43de2d
cmp ecx, 0x45
jne 0x43e176
xor eax, eax
cmp dword [0x5a288c], eax
sete al
cmp dword [0x55a750], 0
mov dword [0x5a288c], eax
je 0x43e120
push eax
push 0x5323b0
lea eax, [esp + 0x1a8]
push 0xc
push eax
call fcn.004050d0
add esp, 0xc
mov byte [esp + 0x1af], 0
lea edx, [esp + 0x1a4]
mov ecx, str.EnableWindowsDualUefiBiosMode
call fcn.00424e40
add esp, 4
jmp 0x43e13a
mov dword [esp + 0x10], eax
mov edx, str.EnableWindowsDualUefiBiosMode
push 4
lea eax, [esp + 0x14]
push eax
push 4
call fcn.0042dd60
add esp, 0xc
mov esi, dword [0x5a288c]
push 0xcc2
call fcn.0041e970
add esp, 4
neg esi
sbb esi, esi
add esi, 0xcb3
push eax
push esi
push 0xdac
push 0
push 0
call fcn.0041ed70
add esp, 0x14
xor ecx, ecx
call fcn.0042ec60
jmp 0x43de2d
cmp ecx, 0x46
jne 0x43e1de
xor ebx, ebx
cmp dword [0x55b1f4], ebx
push 0xcb5
sete bl
mov dword [0x55b1f4], ebx
call fcn.0041e970
add esp, 4
xor ebx, 1
add ebx, 0xcb2
push eax
push ebx
push 0xdac
push 0
push 0
call fcn.0041ed70
add esp, 0x14
xor ecx, ecx
call fcn.00456690
xor eax, eax
cmp dword [0x55b1f4], eax
setne al
push eax
push 0x3fe
push dword [0x5a2ae4]
call dword [sym.imp.USER32.dll_CheckDlgButton]
jmp 0x43de27
cmp ecx, 0x47
jne 0x43e28f
xor eax, eax
cmp dword [0x553330], eax
sete al
mov dword [0x553330], eax
xor eax, 1
cmp dword [0x55a750], 0
je 0x43e239
push eax
push 0x5323b0
lea eax, [esp + 0x1b4]
push 0xc
push eax
call fcn.004050d0
add esp, 0xc
mov byte [esp + 0x1bb], 0
lea edx, [esp + 0x1b0]
mov ecx, str.DisableVHDs
call fcn.00424e40
add esp, 4
jmp 0x43e253
mov dword [esp + 0x10], eax
mov edx, str.DisableVHDs
push 4
lea eax, [esp + 0x14]
push eax
push 4
call fcn.0042dd60
add esp, 0xc
mov esi, dword [0x553330]
push 0xcec
call fcn.0041e970
add esp, 4
neg esi
sbb esi, esi
add esi, 0xcb3
push eax
push esi
push 0xdac
push 0
push 0
call fcn.0041ed70
add esp, 0x14
xor ecx, ecx
call fcn.00456690
jmp 0x43de2d
cmp ecx, 0x48
jne 0x43e31f
xor eax, eax
cmp dword [0x55b20c], eax
sete al
cmp dword [0x55a750], 0
mov dword [0x55b20c], eax
je 0x43e2f5
push eax
push 0x5323b0
lea eax, [esp + 0x1c0]
push 0xc
push eax
call fcn.004050d0
add esp, 0xc
mov byte [esp + 0x1c7], 0
lea edx, [esp + 0x1bc]
mov ecx, str.EnableExtraHashes
call fcn.00424e40
mov esi, dword [0x55b20c]
add esp, 4
push 0xcf0
jmp 0x43ecce
mov dword [esp + 0x10], eax
mov edx, str.EnableExtraHashes
push 4
lea eax, [esp + 0x14]
push eax
push 4
call fcn.0042dd60
mov esi, dword [0x55b20c]
add esp, 0xc
push 0xcf0
jmp 0x43ecce
cmp ecx, 0x49
jne 0x43e396
xor ebx, ebx
cmp dword [0x552754], ebx
push 0xcbe
sete bl
mov dword [0x552754], ebx
call fcn.0041e970
add esp, 4
xor ebx, 1
add ebx, 0xcb2
push eax
push ebx
push 0xdac
push 0
push 0
call fcn.0041ed70
add esp, 0x14
cmp dword [0x55a75c], 0
je 0x43de27
push 0
push 0x3f6
push 0x111
push dword [esp + 0x30]
mov dword [0x59d518], 1
mov dword [0x59d044], 1
call edi
jmp 0x43de27
cmp ecx, 0x4a
jne 0x43e3b6
xor ebx, ebx
cmp dword [0x551f8c], ebx
push 0xcb9
sete bl
mov dword [0x551f8c], ebx
jmp 0x43de03
cmp ecx, 0x4b
jne 0x43e3d6
xor ebx, ebx
cmp dword [0x552750], ebx
push 0xcba
sete bl
mov dword [0x552750], ebx
jmp 0x43de03
cmp ecx, 0x4c
jne 0x43e484
xor eax, eax
cmp dword [0x5a29c4], eax
sete al
cmp dword [0x55a750], 0
mov dword [0x5a29c4], eax
je 0x43e42e
push eax
push 0x5323b0
lea eax, [esp + 0x1cc]
push 0xc
push eax
call fcn.004050d0
add esp, 0xc
mov byte [esp + 0x1d3], 0
lea edx, [esp + 0x1c8]
mov ecx, str.ForceLargeFat32Formatting
call fcn.00424e40
add esp, 4
jmp 0x43e448
mov dword [esp + 0x10], eax
mov edx, str.ForceLargeFat32Formatting
push 4
lea eax, [esp + 0x14]
push eax
push 4
call fcn.0042dd60
add esp, 0xc
mov esi, dword [0x5a29c4]
push 0xcb6
call fcn.0041e970
add esp, 4
neg esi
sbb esi, esi
add esi, 0xcb3
push eax
push esi
push 0xdac
push 0
push 0
call fcn.0041ed70
add esp, 0x14
xor ecx, ecx
call fcn.00456690
jmp 0x43de2d
cmp ecx, 0x4d
jne 0x43e514
xor eax, eax
cmp dword [0x55a7dc], eax
sete al
cmp dword [0x55a750], 0
mov dword [0x55a7dc], eax
je 0x43e4ea
push eax
push 0x5323b0
lea eax, [esp + 0x1d8]
push 0xc
push eax
call fcn.004050d0
add esp, 0xc
mov byte [esp + 0x1df], 0
lea edx, [esp + 0x1d4]
mov ecx, str.IgnoreBootMarker
call fcn.00424e40
mov esi, dword [0x55a7dc]
add esp, 4
push 0xcf7
jmp 0x43ecce
mov dword [esp + 0x10], eax
mov edx, str.IgnoreBootMarker
push 4
lea eax, [esp + 0x14]
push eax
push 4
call fcn.0042dd60
mov esi, dword [0x55a7dc]
add esp, 0xc
push 0xcf7
jmp 0x43ecce
cmp ecx, 0x4e
jne 0x43e534
xor ebx, ebx
cmp dword [0x55a778], ebx
push 0xcbc
sete bl
mov dword [0x55a778], ebx
jmp 0x43de03
cmp ecx, 0x4f
jne 0x43e543
call fcn.0041d660
jmp 0x43de2d
cmp ecx, 0x50
jne 0x43e58c
push 0
push 0
push 0x147
push dword [0x5a289c]
call edi
push 0
mov esi, eax
push esi
push 0x150
push dword [0x5a289c]
call edi
sub esp, 8
mov ecx, eax
call fcn.00408820
add esp, 8
test eax, eax
je 0x43de2d
mov ecx, esi
call fcn.00455a20
jmp 0x43de2d
cmp ecx, 0x51
jne 0x43e61c
xor eax, eax
cmp dword [0x5a29c8], eax
sete al
cmp dword [0x55a750], 0
mov dword [0x5a29c8], eax
je 0x43e5f2
push eax
push 0x5323b0
lea eax, [esp + 0x1fc]
push 0xc
push eax
call fcn.004050d0
add esp, 0xc
mov byte [esp + 0x203], 0
lea edx, [esp + 0x1f8]
mov ecx, str.EnableFileIndexing
call fcn.00424e40
mov esi, dword [0x5a29c8]
add esp, 4
push 0xcda
jmp 0x43ecce
mov dword [esp + 0x10], eax
mov edx, str.EnableFileIndexing
push 4
lea eax, [esp + 0x14]
push eax
push 4
call fcn.0042dd60
mov esi, dword [0x5a29c8]
add esp, 0xc
push 0xcda
jmp 0x43ecce
cmp ecx, 0x52
jne 0x43e75e
lea eax, [esp + 0x2c]
mov dword [esp + 0x2c], 0
push eax
push 0x2001d
push 0
push str.SOFTWARE
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x43e657
mov eax, 0xcb1
jmp 0x43e6cc
push str.Akeo_ConsultingRufus
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
test esi, esi
je 0x43e6ad
cmp esi, 2
je 0x43e6ad
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp esi, 5
jne 0x43e684
mov eax, str.Key_is_not_empty
jmp 0x43e689
call fcn.0044b6b0
push eax
push str.Akeo_ConsultingRufus
push str.Failed_to_delete_registry_key_HKCUSoftware_s:__s
call fcn.0044b0b0
add esp, 0xc
push dword [esp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0xcb1
jmp 0x43e6cc
push dword [esp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x43e6c7
cmp esi, 2
je 0x43e6c7
mov eax, 0xcb1
jmp 0x43e6cc
mov eax, 0xcb0
push eax
push 0xdac
push 0
push 0
call fcn.0041ed70
add esp, 0x10
mov dword [esp + 0x20], 0
lea eax, [esp + 0x20]
push eax
push 0x2001d
push 0
push str.SOFTWARE
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x43de2d
push 0x533a28
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
test esi, esi
je 0x43e74f
cmp esi, 2
je 0x43e74f
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x43de2d
cmp ecx, 0x53
jne 0x43e7a9
xor ebx, ebx
cmp dword [0x5537ac], ebx
push 0xcb4
sete bl
mov dword [0x5537ac], ebx
call fcn.0041e970
add esp, 4
xor ebx, 1
add ebx, 0xcb2
push eax
push ebx
push 0xdac
push 0
push 0
call fcn.0041ed70
add esp, 0x14
xor ecx, ecx
call fcn.00456690
jmp 0x43de27
cmp ecx, 0x54
jne 0x43e839
xor eax, eax
cmp dword [0x55a780], eax
sete al
cmp dword [0x55a750], 0
mov dword [0x55a780], eax
je 0x43e80f
push eax
push 0x5323b0
lea eax, [esp + 0x1e4]
push 0xc
push eax
call fcn.004050d0
add esp, 0xc
mov byte [esp + 0x1eb], 0
lea edx, [esp + 0x1e0]
mov ecx, str.PreserveTimestamps
call fcn.00424e40
mov esi, dword [0x55a780]
add esp, 4
push 0xcc5
jmp 0x43ecce
mov dword [esp + 0x10], eax
mov edx, str.PreserveTimestamps
push 4
lea eax, [esp + 0x14]
push eax
push 4
call fcn.0042dd60
mov esi, dword [0x55a780]
add esp, 0xc
push 0xcc5
jmp 0x43ecce
cmp ecx, 0x55
jne 0x43e8c3
xor eax, eax
cmp dword [0x5a2510], eax
sete al
mov dword [0x5a2510], eax
xor eax, 1
cmp dword [0x55a750], 0
je 0x43e894
push eax
push 0x5323b0
lea eax, [esp + 0x1f0]
push 0xc
push eax
call fcn.004050d0
add esp, 0xc
mov byte [esp + 0x1f7], 0
lea edx, [esp + 0x1ec]
mov ecx, str.UseProperSizeUnits
call fcn.00424e40
add esp, 4
jmp 0x43e8ae
mov dword [esp + 0x10], eax
mov edx, str.UseProperSizeUnits
push 4
lea eax, [esp + 0x14]
push eax
push 4
call fcn.0042dd60
add esp, 0xc
xor ebx, ebx
cmp dword [0x5a2510], ebx
push 0xcbf
sete bl
jmp 0x43e779
cmp ecx, 0x56
jne 0x43e95b
cmp dword [0x55325c], 0
je 0x43de2d
xor eax, eax
cmp dword [0x55a764], eax
sete al
cmp dword [0x55a750], 0
mov dword [0x55a764], eax
je 0x43e928
cmp ecx, 0x57
jne 0x43ea09
xor eax, eax
cmp dword [0x5a23e4], eax
sete al
cmp dword [0x55a750], 0
mov dword [0x5a23e4], eax
je 0x43e9b3
cmp ecx, 0x58
jne 0x43ea33
cmp dword [esp + 0x5c], 0x100
jne 0x43ecf8
cmp ecx, 0x5a
jne 0x43eace
push 0x11
call ebx
test ax, ax
jns 0x43eabc
push 0x12
call ebx
test ax, ax
jns 0x43eabc
mov dword [0x55a768], 1
push 0
push 0x3eb
push 0x111
push dword [esp + 0x30]
mov dword [0x55a774], 1
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x43de2d
cmp dword [esp + 0x5c], 0x100
jne 0x43ecf8
mov ecx, dword [esp + 0x60]
cmp ecx, 0x45
jne 0x43eba1
push 0x11
call ebx
test ax, ax
jns 0x43eb8f
push 0x12
call ebx
test ax, ax
jns 0x43eb8f
xor eax, eax
cmp dword [0x55a7d4], eax
sete al
cmp dword [0x55a750], 0
mov dword [0x55a7d4], eax
je 0x43eb40
push eax
push 0x5323b0
lea eax, [esp + 0x154]
push 0xc
push eax
call fcn.004050d0
add esp, 0xc
mov byte [esp + 0x15b], 0
lea edx, [esp + 0x150]
mov ecx, str.ExpertMode
call fcn.00424e40
add esp, 4
jmp 0x43eb5a
mov dword [esp + 0x10], eax
mov edx, str.ExpertMode
push 4
lea eax, [esp + 0x14]
push eax
push 4
call fcn.0042dd60
add esp, 0xc
mov esi, dword [0x55a7d4]
push 0xd13
call fcn.0041e970
add esp, 4
neg esi
sbb esi, esi
add esi, 0xcb3
push eax
push esi
push 0xdac
push 0
push 0
call fcn.0041ed70
add esp, 0x14
jmp 0x43de2d
cmp dword [esp + 0x5c], 0x100
jne 0x43ecf8
mov ecx, dword [esp + 0x60]
cmp ecx, 0x46
jne 0x43ec9c
push 0x11
call ebx
test ax, ax
jns 0x43ec8e
push 0x12
call ebx
test ax, ax
jns 0x43ec8e
xor eax, eax
cmp dword [0x55b1fc], eax
sete al
mov dword [0x55b1fc], eax
test eax, eax
je 0x43ebe8
mov eax, dword [0x55b1f4]
mov ecx, 1
mov dword [esp + 0x50], eax
jmp 0x43ebec
mov ecx, dword [esp + 0x50]
xor eax, eax
mov dword [0x55b1f4], ecx
test ecx, ecx
setne al
push eax
push 0x3fe
push dword [0x5a2ae4]
call dword [sym.imp.USER32.dll_CheckDlgButton]
mov esi, dword [0x55b1fc]
push 0xcd7
call fcn.0041e970
add esp, 4
neg esi
sbb esi, esi
add esi, 0xcb3
push eax
push esi
push 0xdac
push 0
push 0
call fcn.0041ed70
mov ecx, dword [0x55b1fc]
add esp, 0x14
test ecx, ecx
mov edx, str.disabled
mov eax, str.enabled
mov ecx, 0x52ad5a
cmove eax, edx
push eax
mov eax, str.CAUTION:
cmove eax, ecx
push eax
push str._sListing_of_non_USB_removable_drives__s
call fcn.0044b0b0
add esp, 0xc
cmp dword [0x55b1fc], 0
je 0x43ec82
push str.By_using_this_unofficial_cheat_mode_you_forfeit_ANY_RIGHT_to_complain_if_you_lose_valuable_data_
call fcn.0044b0b0
add esp, 4
xor ecx, ecx
call fcn.00456690
jmp 0x43de2d
cmp dword [esp + 0x5c], 0x100
jne 0x43ecf8
mov ecx, dword [esp + 0x60]
cmp ecx, 0x59
jne 0x43ecf8
push 0x11
call ebx
test ax, ax
jns 0x43ecf8
push 0x12
call ebx
test ax, ax
jns 0x43ecf8
xor eax, eax
mov esi, 2
cmp dword [0x55a79c], eax
push 0xcbb
cmovg esi, eax
mov dword [0x55a79c], esi
call fcn.0041e970
add esp, 4
neg esi
sbb esi, esi
add esi, 0xcb3
push eax
push esi
push 0xdac
push 0
push 0
call fcn.0041ed70
add esp, 0x14
jmp 0x43de2d
cmp dword [esp + 0x44], 0
je 0x43ed33
push 0x12
call ebx
test ax, ax
js 0x43ed33
cmp dword [esp + 0x38], 0
mov dword [esp + 0x44], 0
jne 0x43ed2b
mov eax, dword [0x55b21c]
mov ecx, 3
inc eax
cdq
idiv ecx
mov dword [0x55b21c], edx
mov dword [esp + 0x38], 0
mov esi, dword [sym.imp.USER32.dll_IsDialogMessageW]
lea eax, [esp + 0x58]
push eax
push dword [esp + 0x28]
call esi
test eax, eax
jne 0x43de2d
lea eax, [esp + 0x58]
push eax
push dword [0x55a7d0]
call esi
test eax, eax
jne 0x43de2d
lea eax, [esp + 0x58]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x58]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x43de2d
movzx eax, word [0x551f34]
mov ecx, 0x181010
cmp dword [0x55a760], 0
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0
push 0xffffffffffffffff
mov dword [esp + 0x1c], eax
mov eax, 0x1010
push str.Could_not_create_Window
push 0
cmovne eax, ecx
push 0xfde9
mov dword [esp + 0x68], eax
call ebx
mov esi, eax
cmp esi, 1
jle 0x43edf0
push 2
push esi
call fcn.004b6706
mov edi, eax
add esp, 8
test edi, edi
je 0x43edf0
push esi
push edi
push 0xffffffffffffffff
push str.Could_not_create_Window
push 0
push 0xfde9
call ebx
cmp eax, esi
je 0x43edf2
push edi
call fcn.004d1211
add esp, 4
xor edi, edi
push 0
push 0
push 0xffffffffffffffff
push str.DialogBox_failure
push 0
push 0xfde9
call ebx
mov ebx, eax
cmp ebx, 1
jle 0x43ee41
push 2
push ebx
call fcn.004b6706
mov esi, eax
add esp, 8
test esi, esi
je 0x43ee41
push ebx
push esi
push 0xffffffffffffffff
push str.DialogBox_failure
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, ebx
je 0x43ee43
push esi
call fcn.004d1211
add esp, 4
xor esi, esi
push dword [esp + 0x10]
push dword [esp + 0x54]
push esi
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxExW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test edi, edi
je 0x43ee6a
push edi
call fcn.004d1211
add esp, 4
test esi, esi
je 0x43ee77
push esi
call fcn.004d1211
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x43cd91
mov edx, dword [0x55a798]
lea ecx, [esp + 0x200]
call fcn.00424380
mov eax, dword [0x55a798]
mov edx, 0x181010
mov ecx, dword [eax + 4]
mov eax, 0x1010
and ecx, 1
push ecx
cmovne eax, edx
mov dword [0x55a760], ecx
push eax
push 0xbb9
call fcn.0041e970
add esp, 4
push eax
push ecx
push 0xbba
call fcn.0041e970
add esp, 8
mov edx, eax
xor ecx, ecx
call fcn.0042c4e0
add esp, 0xc
jmp 0x43cd91
mov edx, dword [0x55a798]
lea ecx, [esp + 0x200]
call fcn.00424380
mov eax, dword [0x55a798]
mov edx, 0x181010
mov ecx, dword [eax + 4]
mov eax, 0x1010
and ecx, 1
push ecx
cmovne eax, edx
mov dword [0x55a760], ecx
push eax
push 0xcdd
call fcn.0041e970
mov ecx, dword [0x58b260]
add esp, 4
push eax
xor eax, eax
cmp ecx, 0x61
push ecx
sete al
lea eax, [eax*4 + 0x12]
push eax
xor eax, eax
cmp ecx, 0x61
sete al
add eax, 2
push eax
push 0xcde
call fcn.0041e970
add esp, 0x10
mov edx, eax
xor ecx, ecx
call fcn.0042c4e0
add esp, 0xc
jmp 0x43cd91
call fcn.004a8c90
jg 0x43ef2a
inc ebx
add ch, al
mov edi, 0xc17f0043
inc ebx
add cl, bl
mov ebp, 0xbf650043
inc ebx
add byte [edi - 0x40], al
inc ebx
add dl, cl
mov ebp, 0xc05b0043
inc ebx
add byte [ebx - 0x40], dh
inc ebx
add byte [eax], al
or byte [eax], cl
or byte [eax], cl
add dword [eax], eax
add al, byte [ebx]
or byte [eax], cl
add al, 8
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [3423012870], al
int3