Function at 0x14003cd10
Capabilities:
Check if file exists
Check mutex on windows
Copy file
Delete file
Extract resource via kernel32 functions
Get common file path
Get session user name
Get token membership
Identify system language via api
Log keystrokes via polling
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x6a0]
sub rsp, 0x7a0
mov rax, qword [0x140193440]
xor rax, rsp
mov qword [rbp + 0x690], rax
xor r12d, r12d
mov qword [rbp + 0x1a0], r8
mov dword [rbp - 0x4c], r12d
mov dword [rsp + 0x68], r12d
mov dword [rbp + 4], r12d
mov qword [rbp + 8], rcx
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov ebx, 1
mov dword [rbp - 0x68], r12d
movzx eax, ax
lea rdx, str.SoftwareMicrosoftVisualStudio
mov dword [rsp + 0x6c], eax
mov r9d, 0x20019
lea rax, [rbp - 0x58]
mov dword [rsp + 0x74], r12d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000001
mov dword [rbp - 0x3c], r12d
mov r15d, r12d
mov dword [rbp - 0x44], r12d
mov dword [rbp - 0x40], r12d
mov r14d, r12d
mov dword [rbp - 0x80], ebx
mov qword [rbp - 0x58], r12
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov rcx, qword [rbp - 0x58]
mov r13d, r12d
test eax, eax
sete r13b
test rcx, rcx
je 0x14003cdd5
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edx, edx
mov dword [rsp + 0x78], r12d
mov r8d, 0x103
mov dword [rbp - 0x6c], r12d
lea rcx, [rbp + 0x371]
mov dword [rbp - 0x50], r12d
mov dword [rbp - 0x48], 4
mov byte [rbp + 0x370], r12b
call fcn.140136540
xor edx, edx
mov byte [rbp + 0x260], r12b
mov r8d, 0x103
lea rcx, [rbp + 0x261]
call fcn.140136540
xor edx, edx
mov byte [rbp + 0x480], r12b
mov r8d, 0x103
lea rcx, [rbp + 0x481]
call fcn.140136540
movzx eax, word [0x140162434]
lea rcx, [0x1401564ce]
mov word [rsp + 0x70], ax
movzx eax, byte [0x140162436]
mov byte [rsp + 0x72], al
lea rax, str.extra_devs
mov qword [rbp + 0x60], rax
lea rax, [0x14016349c]
mov qword [rbp + 0x80], rax
lea rax, str.help
mov qword [rbp + 0xa0], rax
lea rax, [0x1401634a8]
mov qword [rbp + 0xc0], rax
lea rax, str.locale
mov qword [rbp + 0xe0], rax
lea rax, str.filesystem
mov qword [rbp + 0x100], rax
lea rax, str.wait
mov qword [rbp + 0x120], rax
mov qword [rbp - 0x60], r12
mov qword [rbp - 0x78], r12
mov qword [rbp - 8], r12
mov qword [rbp + 0x10], r12
mov qword [rbp - 0x58], r12
mov dword [rbp + 0x68], r12d
mov qword [rbp + 0x70], r12
mov dword [rbp + 0x78], 0x78
mov dword [rbp + 0x88], r12d
mov qword [rbp + 0x90], r12
mov dword [rbp + 0x98], 0x67
mov dword [rbp + 0xa8], r12d
mov qword [rbp + 0xb0], r12
mov dword [rbp + 0xb8], 0x68
mov dword [rbp + 0xc8], ebx
mov qword [rbp + 0xd0], r12
mov dword [rbp + 0xd8], 0x69
mov dword [rbp + 0xe8], ebx
mov qword [rbp + 0xf0], r12
mov dword [rbp + 0xf8], 0x6c
mov dword [rbp + 0x108], ebx
mov qword [rbp + 0x110], r12
mov dword [rbp + 0x118], 0x66
mov dword [rbp + 0x128], ebx
mov qword [rbp + 0x130], r12
mov dword [rbp + 0x138], 0x77
mov qword [rbp + 0x140], r12
mov dword [rbp + 0x148], r12d
mov qword [rbp + 0x150], r12
mov dword [rbp + 0x158], r12d
call qword [sym.imp.KERNEL32.dll_SetDllDirectoryA]
mov ecx, 0x800
call qword [sym.imp.KERNEL32.dll_SetDefaultDllDirectories]
lea rcx, str._Rufus_init__n
call fcn.14004f2f0
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x50]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x14003cfbc
cmp dword [rbp - 0x50], 0x6c696e
mov eax, ebx
je 0x14003cfbf
mov eax, r12d
mov edx, 2
mov dword [0x14019f604], eax
mov ecx, 0x104
mov dword [0x1401e8424], ebx
call fcn.1400c4f6c
mov rdi, rax
test rax, rax
jne 0x14003cff2
mov ecx, 0xe
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14003d0a5
mov r8d, 0x104
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test ebx, ebx
je 0x14003d08a
lea ecx, [rbx - 1]
test ecx, ecx
je 0x14003d036
lea rdx, [rdi + rcx*2]
nop dword [rax]
cmp word [rdx], 0x5c
je 0x14003d031
sub rdx, 2
add ecx, 0xffffffff
jne 0x14003d020
jmp 0x14003d036
mov word [rdi + rcx*2], r12w
mov qword [rsp + 0x38], r12
mov r9d, 0xffffffff
mov qword [rsp + 0x30], r12
mov r8, rdi
lea r12, [0x1401e81c0]
mov dword [rsp + 0x28], 0x104
xor edx, edx
mov qword [rsp + 0x20], r12
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebx, eax
test eax, eax
jne 0x14003d091
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
mov ebx, eax
call fcn.1400e8c70
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14003d0a5
lea r12, [0x1401e81c0]
mov rcx, rdi
call fcn.1400e8c70
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
jne 0x14003d0d0
call fcn.14004fba0
mov rdx, rax
lea rcx, str.Could_not_get_application_directory:__s
call fcn.14004f2f0
movzx eax, word [0x140163510]
mov word [0x1401e81c0], ax
mov byte [0x1401e81c2], r14b
jmp 0x14003d0f2
mov r9, 0xffffffffffffffff
lea r8, [0x1401560f8]
mov edx, 0x104
mov rcx, r12
call fcn.1400e8d6c
movzx eax, word [0x140163510]
lea r12, [0x1401e7f40]
mov word [0x1401e7f40], ax
mov rcx, r12
mov byte [0x1401e7f42], r14b
call fcn.14002e8b0
xor esi, esi
xor r9d, r9d
mov qword [rsp + 0x30], rsi
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x2000000
mov r8d, 1
mov rcx, rax
mov dword [rsp + 0x20], 3
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test rbx, rbx
je 0x14003d158
mov rcx, rbx
call fcn.1400e8c70
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp rdi, 0xffffffffffffffff
je 0x14003d1f8
mov rdx, r12
mov rcx, rdi
call fcn.14002f4f0
test eax, eax
je 0x14003d1f8
lea rdx, [0x140155d40]
mov rcx, r12
call fcn.1400b4230
cmp rax, r12
je 0x14003d1a5
lea rdx, [0x140163514]
mov rcx, r12
call fcn.1400b4230
cmp rax, r12
jne 0x14003d1f8
lea rdx, [0x1401e7f44]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rdx + rax], r14b
jne 0x14003d1b3
inc rax
mov ebx, 0x104
cmp rax, rbx
mov rcx, r12
cmovb rbx, rax
mov r8, rbx
call fcn.140135ea0
mov r9, 0xffffffffffffffff
mov byte [rbx + r12 - 1], r14b
lea r8, [0x1401560f8]
mov edx, 0x104
mov rcx, r12
call fcn.1400e8d6c
jmp 0x14003d22a
call fcn.14004fba0
mov r8, rax
lea rcx, str.Could_not_get_current_directory_from__s:__s
mov rdx, r12
call fcn.14004f2f0
movzx eax, word [0x140163510]
mov word [0x1401e7f40], ax
mov byte [0x1401e7f42], r14b
cmp rdi, 0xffffffffffffffff
je 0x14003d238
test rdi, rdi
je 0x14003d238
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 2
mov ecx, 0x104
call fcn.1400c4f6c
mov rdx, rax
mov ecx, 0x104
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea rax, [0x1401e8440]
test edi, edi
je 0x14003d2aa
xor ecx, ecx
mov r9d, 0xffffffff
mov qword [rsp + 0x38], rcx
mov r8, rbx
mov qword [rsp + 0x30], rcx
xor edx, edx
mov dword [rsp + 0x28], 0x104
mov ecx, 0xfde9
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test eax, eax
jne 0x14003d2aa
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test rbx, rbx
je 0x14003d2b7
mov rcx, rbx
call fcn.1400e8c70
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
jne 0x14003d317
call fcn.14004fba0
mov rdx, rax
lea rcx, str.Could_not_get_temp_directory:__s
call fcn.14004f2f0
mov rax, 0xffffffffffffffff
nop
inc rax
cmp byte [r12 + rax], r14b
jne 0x14003d2e0
inc rax
lea rdi, [0x1401e8440]
mov ebx, 0x104
mov rdx, r12
cmp rax, rbx
mov rcx, rdi
cmovb rbx, rax
mov r8, rbx
call fcn.140135ea0
mov byte [rbx + rdi - 1], r14b
jmp 0x14003d472
lea rcx, [0x1401e8440]
call fcn.14002e8b0
mov rbx, rax
xor r9d, r9d
xor eax, eax
mov edx, 0x80000000
mov qword [rsp + 0x30], rax
mov r8d, 1
mov dword [rsp + 0x28], 0x2000000
mov rcx, rbx
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test rbx, rbx
je 0x14003d36c
mov rcx, rbx
call fcn.1400e8c70
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rsi, [0x1401e8440]
cmp rdi, 0xffffffffffffffff
je 0x14003d415
mov rdx, rsi
mov rcx, rdi
call fcn.14002f4f0
test eax, eax
je 0x14003d415
lea rdx, [0x140155d40]
mov rcx, rsi
call fcn.1400b4230
cmp rax, rsi
je 0x14003d3c0
lea rdx, [0x140163514]
mov rcx, rsi
call fcn.1400b4230
cmp rax, rsi
jne 0x14003d415
lea rdx, [0x1401e8444]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp byte [rdx + rax], r14b
jne 0x14003d3d0
inc rax
mov ebx, 0x104
cmp rax, rbx
mov rcx, rsi
cmovb rbx, rax
mov r8, rbx
call fcn.140135ea0
mov r9, 0xffffffffffffffff
mov byte [rbx + rsi - 1], r14b
lea r8, [0x1401560f8]
mov edx, 0x104
mov rcx, rsi
call fcn.1400e8d6c
jmp 0x14003d464
call fcn.14004fba0
mov r8, rax
lea rcx, str.Could_not_get_actual_temp_directory_from__s:__s
mov rdx, rsi
call fcn.14004f2f0
mov rax, 0xffffffffffffffff
inc rax
cmp byte [r12 + rax], r14b
jne 0x14003d433
inc rax
mov ebx, 0x104
cmp rax, rbx
mov rdx, r12
mov rcx, rsi
cmovb rbx, rax
mov r8, rbx
call fcn.140135ea0
mov byte [rbx + rsi - 1], r14b
cmp rdi, 0xffffffffffffffff
je 0x14003d472
test rdi, rdi
je 0x14003d472
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 2
mov ecx, 0x104
call fcn.1400c4f6c
mov edx, 0x104
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea rax, [0x1401e8320]
test edi, edi
je 0x14003d4e4
xor ecx, ecx
mov r9d, 0xffffffff
mov qword [rsp + 0x38], rcx
mov r8, rbx
mov qword [rsp + 0x30], rcx
xor edx, edx
mov dword [rsp + 0x28], 0x104
mov ecx, 0xfde9
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test eax, eax
jne 0x14003d4e4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test rbx, rbx
je 0x14003d4f1
mov rcx, rbx
call fcn.1400e8c70
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
jne 0x14003d532
call fcn.14004fba0
mov rdx, rax
lea rcx, str.Could_not_get_system_directory:__s
call fcn.14004f2f0
movups xmm0, xmmword [str.C:WindowsSystem32]
mov eax, dword [0x1401635e8]
mov dword [0x1401e8330], eax
movups xmmword [0x1401e8320], xmm0
mov byte [0x1401e8333], r14b
lea rdi, [0x1401e86a0]
mov r8d, 0x1c
mov rdx, rdi
call fcn.14002f270
test eax, eax
jne 0x14003d59d
call fcn.14004fba0
mov rdx, rax
lea rcx, str.Could_not_get_app_data_directory:__s
call fcn.14004f2f0
mov rax, 0xffffffffffffffff
lea rsi, [0x1401e8440]
nop dword [rax]
inc rax
cmp byte [rsi + rax], r14b
jne 0x14003d570
inc rax
mov ebx, 0x104
cmp rax, rbx
mov rdx, rsi
mov rcx, rdi
cmovb rbx, rax
mov r8, rbx
call fcn.140135ea0
mov byte [rbx + rdi - 1], r14b
jmp 0x14003d5a4
lea rsi, [0x1401e8440]
lea rdi, [0x1401e8060]
mov r8d, 0x28
mov rdx, rdi
call fcn.14002f270
test eax, eax
jne 0x14003d60b
call fcn.14004fba0
mov rdx, rax
lea rcx, str.Could_not_get_user_directory:__s
call fcn.14004f2f0
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rsi + rax], r14b
jne 0x14003d5e0
inc rax
mov ebx, 0x104
cmp rax, rbx
mov rdx, rsi
mov rcx, rdi
cmovb rbx, rax
mov r8, rbx
call fcn.140135ea0
mov byte [rbx + rdi - 1], r14b
mov rax, 0xffffffffffffffff
lea rdx, [0x1401e8320]
nop dword [rax]
inc rax
cmp byte [rdx + rax], r14b
jne 0x14003d620
inc rax
lea rcx, [0x1401e8560]
mov ebx, 0x104
cmp rax, rbx
cmovb rbx, rax
mov r8, rbx
call fcn.140135ea0
lea rax, [0x1401e8560]
mov rdx, r12
lea rcx, str.Cur_dir:__s
mov byte [rbx + rax - 1], r14b
call fcn.14004f2f0
lea rbx, [0x1401e81c0]
mov rdx, rbx
lea rcx, str.App_dir:__s
call fcn.14004f2f0
lea rdx, [0x1401e8560]
lea rcx, str.Sys_dir:__s
call fcn.14004f2f0
mov rdx, rdi
lea rcx, str.Usr_dir:__s
call fcn.14004f2f0
lea rdx, [0x1401e86a0]
lea rcx, str.Dat_dir:__s
call fcn.14004f2f0
mov rdx, rsi
lea rcx, str.Tmp_dir:__s
call fcn.14004f2f0
lea r9, str._srufus.app
mov qword [rsp + 0x20], rbx
mov edx, 0x104
lea rcx, [rbp + 0x370]
mov r8, 0xffffffffffffffff
call fcn.140004fd0
lea rcx, [rbp + 0x370]
mov byte [rbp + 0x473], r14b
call fcn.14002e8b0
mov rcx, rax
mov rbx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edi, eax
test rbx, rbx
je 0x14003d70e
mov rcx, rbx
call fcn.1400e8c70
test edi, edi
je 0x14003d721
mov dword [0x1401a0458], 1
jmp 0x14003db84
mov rax, qword [0x1401e2bf8]
test rax, rax
jne 0x14003d766
lea rcx, str.Msvcrt
call fcn.14002e630
mov rcx, rax
lea rdx, str.__wgetmainargs
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401e2bf8], rax
test rax, rax
jne 0x14003d766
lea rcx, str.Could_not_access_UTF_16_args
call fcn.14004f2f0
jmp 0x14003db7b
lea rcx, [rbp + 4]
xor ebx, ebx
mov qword [rsp + 0x20], rcx
lea r8, [rbp + 0x58]
lea rcx, [rsp + 0x68]
mov r9d, 1
lea rdx, [rbp + 0x18]
mov r12d, ebx
call rax
movsxd rcx, dword [rsp + 0x68]
mov edx, 8
call fcn.1400c4f6c
mov qword [rbp - 0x78], rax
mov rdi, rax
test rax, rax
je 0x14003db7b
mov esi, ebx
cmp dword [rsp + 0x68], ebx
jle 0x14003d866
mov edi, ebx
nop word [rax + rax]
mov rcx, qword [rbp + 0x18]
mov rcx, qword [rdi + rcx]
call fcn.14002e7e0
mov rbx, rax
mov rax, qword [rbp - 0x78]
mov qword [rdi + rax], rbx
movzx ecx, byte [rbx]
sub ecx, 0x2f
jne 0x14003d7f6
movzx ecx, byte [rbx + 1]
sub ecx, 0x57
jne 0x14003d7f6
movzx ecx, byte [rbx + 2]
xor edx, edx
movzx eax, dl
sub ecx, eax
jmp 0x14003d7f8
xor edx, edx
test ecx, ecx
mov eax, 0x96
cmove r15d, eax
cmp byte [rbx], 0x2d
mov dword [rbp - 0x68], r15d
jne 0x14003d818
cmp byte [rbx + 1], 0x67
jne 0x14003d818
cmp byte [rbx + 2], r12b
je 0x14003d835
mov rcx, rdx
lea rdx, str.__gui
movzx eax, byte [rbx + rcx]
inc rcx
cmp al, byte [rdx + rcx - 1]
jne 0x14003d83b
cmp rcx, 6
jne 0x14003d822
mov r14d, 1
lea rdx, str._InvokerPRAID
mov rcx, rbx
call fcn.140107d64
test eax, eax
je 0x14003d712
inc esi
add rdi, 8
cmp esi, dword [rsp + 0x68]
jl 0x14003d7c0
mov rdi, qword [rbp - 0x78]
mov rcx, qword [rdi]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], r12b
jne 0x14003d870
lea rbx, [rcx - 1]
add rbx, rax
cmp rbx, rcx
jbe 0x14003d892
cmp byte [rbx], 0x5c
je 0x14003d892
dec rbx
cmp rbx, rcx
ja 0x14003d885
mov edx, 0x70
mov rcx, rbx
call fcn.1400b41b4
test rax, rax
jne 0x14003d8c9
mov edx, 0x50
mov rcx, rbx
call fcn.1400b41b4
test rax, rax
je 0x14003d8ce
mov edx, 0x50
mov rcx, rbx
call fcn.1400b41b4
cmp byte [rax + 1], 0x48
je 0x14003d8ce
mov byte [rsp + 0x70], 0x61
test r14d, r14d
jne 0x14003d964
mov ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_AttachConsole]
test eax, eax
je 0x14003d964
lea rcx, str.Enabling_console_line_hogger
call fcn.14004f2f0
mov ebx, 1
xor ecx, ecx
mov dword [rbp - 0x3c], ebx
call fcn.1400c5128
mov r8, rax
lea rdx, [0x14015b0f0]
lea rcx, str.CONIN_
call fcn.1400c4f24
mov ecx, ebx
call fcn.1400c5128
mov r8, rax
lea rdx, [0x14014fa44]
lea rcx, str.CONOUT_
call fcn.1400c4f24
mov ecx, 2
call fcn.1400c5128
mov r8, rax
lea rdx, [0x14014fa44]
lea rcx, str.CONOUT_
call fcn.1400c4f24
call fcn.1400c5ae0
call fcn.14003ca20
mov qword [rbp + 0x10], rax
jmp 0x14003d969
mov ebx, 1
mov ecx, dword [rsp + 0x68]
lea r9, [rbp + 0x60]
xor eax, eax
lea r8, str.ghxf:i:l:w:z:
mov dword [rsp + 0x28], eax
mov rdx, rdi
lea rax, [rbp - 0x4c]
mov qword [rsp + 0x20], rax
call fcn.14006f6d0
cmp eax, 0xffffffff
je 0x14003db7b
xor esi, esi
nop word [rax + rax]
add eax, 0xffffff9f
cmp eax, 0x19
ja case.0x14003d9c9.98
lea r15, [0x140000000]
cdqe
movzx eax, byte [r15 + rax + 0x41390]
mov ecx, dword [r15 + rax*4 + 0x4136c]
add rcx, r15
jmp rcx
mov dword [0x14019f644], ebx
jmp case.0x14003d9c9.97
mov rcx, qword [0x14019f588]
call fcn.1400e8c70
xor eax, eax
mov edx, 0x104
mov rcx, rbx
mov qword [0x14019f588], rax
call fcn.1400c4f6c
mov qword [0x14019f588], rax
mov rsi, rax
test rax, rax
je 0x14003db04
mov rcx, qword [0x1401e6648]
call fcn.14002e8b0
mov edx, 2
mov ecx, 0x104
mov r14, rax
call fcn.1400c4f6c
lea r9, [rbp + 0x190]
mov r8, rax
mov edx, 0x104
mov rcx, r14
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r15d, eax
test ebx, ebx
je 0x14003da8f
xor eax, eax
mov r9d, 0xffffffff
mov qword [rsp + 0x38], rax
mov r8, rdi
mov qword [rsp + 0x30], rax
xor edx, edx
mov dword [rsp + 0x28], 0x104
mov ecx, 0xfde9
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x14003da8f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r15d, eax
test rdi, rdi
je 0x14003da9c
mov rcx, rdi
call fcn.1400e8c70
test r14, r14
je 0x14003daa9
mov rcx, r14
call fcn.1400e8c70
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [0x14019f588]
call fcn.14002f6b0
test al, 0x10
je 0x14003daf5
mov rdx, qword [0x14019f588]
lea rcx, str.Could_not_find_image__s_n
call fcn.14002d780
mov rcx, qword [0x14019f588]
call fcn.1400e8c70
mov rdi, qword [rbp - 0x78]
xor esi, esi
mov qword [0x14019f588], rsi
mov ebx, 1
jmp case.0x14003d9c9.97
mov rdi, qword [rbp - 0x78]
mov ebx, 1
mov dword [0x1401e29d4], ebx
xor esi, esi
mov ecx, dword [rsp + 0x68]
lea rax, [rbp - 0x4c]
mov dword [rsp + 0x28], esi
lea r9, [rbp + 0x60]
lea r8, str.ghxf:i:l:w:z:
mov qword [rsp + 0x20], rax
mov rdx, rdi
call fcn.14006f6d0
cmp eax, 0xffffffff
jne 0x14003d9a0
test r12d, r12d
je 0x14003db7b
lea rcx, str.Command_line_arguments:
call fcn.14004f2f0
cmp dword [rsp + 0x68], 1
mov edi, ebx
jle 0x14003db7b
mov rbx, qword [rbp - 0x78]
add rbx, 8
nop word [rax + rax]
mov rdx, qword [rbx]
lea rcx, [0x14014fa20]
call fcn.14004f2f0
inc edi
lea rbx, [rbx + 8]
cmp edi, dword [rsp + 0x68]
jl 0x14003db60
cmp dword [0x1401a0458], 0
je 0x14003db90
lea rcx, str.AppStore_version_detected
call fcn.14004f2f0
lea rcx, [0x1401e81c0]
mov edx, 0x104
mov qword [rsp + 0x20], rcx
lea r9, str._srufus.ini
lea rcx, [rbp + 0x480]
mov r8, 0xffffffffffffffff
call fcn.140004fd0
xor r12d, r12d
mov byte [rbp + 0x583], 0
lea rcx, [rbp + 0x480]
mov qword [rbp + 0x180], r12
call fcn.14002e8b0
mov rsi, rax
cmp byte [rsp + 0x70], r12b
jne 0x14003de21
mov r15d, 1
mov edx, 2
mov ecx, r15d
call fcn.1400c4f6c
mov rbx, rax
jmp 0x14003de96
mov rax, qword [0x1401e6648]
movzx ecx, byte [rax]
call fcn.1400fdc90
test eax, eax
je 0x14003dc2e
mov rcx, qword [0x1401e6648]
xor r8d, r8d
xor edx, edx
call fcn.140102178
mov dword [rsp + 0x6c], eax
jmp case.0x14003d9c9.97
mov rcx, qword [rbp - 0x60]
call fcn.1400e8c70
mov rcx, qword [0x1401e6648]
test rcx, rcx
jne 0x14003dc4c
mov qword [rbp - 0x60], rsi
jmp case.0x14003d9c9.97
call fcn.1400fc834
mov qword [rbp - 0x60], rax
jmp case.0x14003d9c9.97
mov rax, qword [0x1401e6648]
movzx ecx, byte [rax]
call fcn.1400fdc90
test eax, eax
je 0x14003dc88
mov rcx, qword [0x1401e6648]
xor r8d, r8d
xor edx, edx
call fcn.140102178
mov ebx, eax
mov dword [0x1401977f8], eax
jmp 0x14003dcdd
xor eax, eax
lea rdi, [0x14014ffd0]
mov ebx, eax
mov rax, qword [rdi]
lea r8, str._NULL_
mov rcx, qword [0x1401e6648]
test rax, rax
mov rdx, r8
cmovne rdx, rax
test rcx, rcx
cmove rcx, r8
call fcn.140107d64
test eax, eax
je 0x14003dcd1
inc ebx
add rdi, 8
cmp ebx, 9
jb 0x14003dc93
mov ebx, dword [0x1401977f8]
jmp 0x14003dcd7
mov dword [0x1401977f8], ebx
mov rdi, qword [rbp - 0x78]
xor esi, esi
lea eax, [rbx + 1]
cmp eax, 9
jbe 0x14003dcf0
mov ebx, 0xffffffff
mov dword [0x1401977f8], ebx
mov dword [0x1401977fc], ebx
mov ebx, 1
jmp case.0x14003d9c9.97
mov rcx, qword [0x1401e6648]
call fcn.140108ab0
mov dword [rbp - 0x68], eax
jmp case.0x14003d9c9.97
mov rcx, qword [0x1401e6648]
xor edx, edx
mov r8d, 0x10
call fcn.140102178
mov dword [rsp + 0x74], eax
jmp case.0x14003d9c9.97
mov r12d, ebx
jmp case.0x14003d9c9.97
mov rcx, qword [rdi]
lea r9, [rbp + 0x590]
xor r12d, r12d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], r12
call fcn.14010b5d8
lea rdx, [rbp + 0x590]
lea rcx, str._nUsage:__s___x____g____h____f_FILESYSTEM____i_PATH____l_LOCALE____w_TIMEOUT__n
call fcn.14002d780
lea rcx, str.___x____extra_devs_n
call fcn.14002d780
lea rcx, str._____List_extra_devices__such_as_USB_HDDs_n
call fcn.14002d780
lea rcx, str.___g____gui_n
call fcn.14002d780
lea rcx, str._____Start_in_GUI_mode__disable_the_rufus.com_commandline_hogger__n
call fcn.14002d780
lea rcx, str.___i_PATH____isoPATH_n
call fcn.14002d780
lea rcx, str._____Select_the_ISO_image_pointed_by_PATH_to_be_used_on_startup_n
call fcn.14002d780
lea rcx, str.___l_LOCALE____localeLOCALE_n
call fcn.14002d780
lea rcx, str._____Select_the_locale_to_be_used_on_startup_n
call fcn.14002d780
lea rcx, str.___f_FILESYSTEM____filesystemFILESYSTEM_n
call fcn.14002d780
lea rcx, str._____Preselect_the_file_system_to_be_preferred_when_formatting_n
call fcn.14002d780
lea rcx, str.___w_TIMEOUT____waitTIMEOUT_n
call fcn.14002d780
lea rcx, str._____Wait_TIMEOUT_tens_of_seconds_for_the_global_application_mutex_to_be_released._n
call fcn.14002d780
lea rcx, str._____Used_when_launching_a_newer_version_of_Rufus_from_a_running_application._n
call fcn.14002d780
lea rcx, str.___h____help_n
call fcn.14002d780
lea rcx, str._____This_usage_guide._n
call fcn.14002d780
jmp 0x14003ee43
mov dword [rsp + 0x28], r12d
lea r8, [rsp + 0x70]
mov r9d, 0xffffffff
mov qword [rsp + 0x20], r12
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rdi, eax
cmp edi, 1
jle 0x14003de8d
mov rcx, rdi
mov edx, 2
call fcn.1400c4f6c
mov rbx, rax
test rax, rax
je 0x14003de8d
mov dword [rsp + 0x28], edi
lea r8, [rsp + 0x70]
mov r9d, 0xffffffff
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, edi
je 0x14003de90
mov rcx, rbx
call fcn.1400e8c70
mov rbx, r12
mov r15d, 1
mov r8, rbx
lea rcx, [rbp + 0x180]
mov rdx, rsi
call fcn.1400e90a0
test rsi, rsi
je 0x14003deb5
mov rcx, rsi
call fcn.1400e8c70
test rbx, rbx
je 0x14003dec2
mov rcx, rbx
call fcn.1400e8c70
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.1400295f0
test rax, rax
lea rcx, str._NULL_
lea rdx, [0x14015fe30]
cmove rax, rcx
mov rcx, rax
call fcn.140113550
mov rdi, qword [rbp + 0x180]
test eax, eax
mov r14d, r12d
sete r14b
or r14d, r13d
lea r13, [0x1401e81c0]
mov dword [rsp + 0x7c], r14d
test rdi, rdi
je 0x14003df5e
lea rax, [rbp + 0x480]
mov qword [0x14019f580], rax
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rax + r13], r12b
jne 0x14003df24
inc rax
lea rsi, [0x1401e86a0]
mov ebx, 0x104
mov rdx, r13
cmp rax, rbx
mov rcx, rsi
cmovb rbx, rax
mov r8, rbx
call fcn.140135ea0
mov rcx, rdi
mov byte [rbx + rsi - 1], r12b
call fcn.1400e9320
cmp qword [0x14019f580], r12
lea rax, str.INI_file
lea rdx, str.registry
cmovne rdx, rax
lea rcx, str.Will_use_settings_from__s
call fcn.14004f2f0
lea rcx, str.Locale
call fcn.1400303c0
cmp byte [rax], r12b
je 0x14003dfaf
mov rcx, rax
call fcn.1400fc834
mov rdx, rax
mov qword [rbp - 0x60], rax
lea rcx, str.found_locale__s
call fcn.14004f2f0
mov rdx, qword [0x14019f580]
test rdx, rdx
je 0x14003dff0
mov r8d, r15d
lea rcx, str.ShowAdvancedDriveProperties
mov edi, r12d
call fcn.140026e40
mov rbx, rax
test rax, rax
je 0x14003dfec
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.140102178
mov rcx, rbx
mov edi, eax
call fcn.1400e8c70
test edi, edi
jmp 0x14003e01b
lea r9, [rsp + 0x60]
mov dword [rsp + 0x20], 4
mov r8d, 4
lea rdx, str.ShowAdvancedDriveProperties
mov rcx, 0xffffffff80000001
call fcn.14002fb80
cmp dword [rsp + 0x60], r12d
mov rdx, qword [0x14019f580]
mov ecx, r12d
setne cl
mov dword [0x1401e82c4], ecx
test rdx, rdx
je 0x14003e068
mov r8d, r15d
lea rcx, str.ShowAdvancedFormatOptions
mov edi, r12d
call fcn.140026e40
mov rbx, rax
test rax, rax
je 0x14003e064
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.140102178
mov rcx, rbx
mov edi, eax
call fcn.1400e8c70
test edi, edi
jmp 0x14003e093
lea r9, [rsp + 0x60]
mov dword [rsp + 0x20], 4
mov r8d, 4
lea rdx, str.ShowAdvancedFormatOptions
mov rcx, 0xffffffff80000001
call fcn.14002fb80
cmp dword [rsp + 0x60], r12d
mov rdx, qword [0x14019f580]
mov ecx, r12d
setne cl
mov dword [0x1401e82c8], ecx
test rdx, rdx
je 0x14003e0e0
mov r8d, r15d
lea rcx, str.PreserveTimestamps
mov edi, r12d
call fcn.140026e40
mov rbx, rax
test rax, rax
je 0x14003e0dc
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.140102178
mov rcx, rbx
mov edi, eax
call fcn.1400e8c70
test edi, edi
jmp 0x14003e10b
lea r9, [rsp + 0x60]
mov dword [rsp + 0x20], 4
mov r8d, 4
lea rdx, str.PreserveTimestamps
mov rcx, 0xffffffff80000001
call fcn.14002fb80
cmp dword [rsp + 0x60], r12d
mov rdx, qword [0x14019f580]
mov ecx, r12d
setne cl
mov dword [0x14019f5b8], ecx
test rdx, rdx
je 0x14003e158
mov r8d, r15d
lea rcx, str.UseProperSizeUnits
mov edi, r12d
call fcn.140026e40
mov rbx, rax
test rax, rax
je 0x14003e154
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.140102178
mov rcx, rbx
mov edi, eax
call fcn.1400e8c70
test edi, edi
jmp 0x14003e183
lea r9, [rsp + 0x60]
mov dword [rsp + 0x20], 4
mov r8d, 4
lea rdx, str.UseProperSizeUnits
mov rcx, 0xffffffff80000001
call fcn.14002fb80
cmp dword [rsp + 0x60], r12d
mov ecx, r12d
mov qword [rbp + 0x180], r12
sete cl
mov qword [rbp + 0x170], r12
mov dword [0x1401e82d8], ecx
mov edx, 6
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov qword [rsp + 0x40], r12
xor r9d, r9d
mov dword [rsp + 0x38], r12d
xor r8d, r8d
mov qword [rsp + 0x30], r12
mov edx, 0xffffffff
mov dword [rsp + 0x28], 3
xor ecx, ecx
mov dword [rsp + 0x20], 2
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
lea rax, [rbp + 0x170]
xor edx, edx
lea r9, [0x140138e60]
mov qword [rsp + 0x20], rax
mov r8d, 0x14
lea rcx, [0x140157e80]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov ebx, eax
test eax, eax
je 0x14003e220
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
call fcn.14004fba0
lea rcx, str.Notice:_Disabling_VDS__Could_not_create_VDS_Loader_Instance:__s_
jmp 0x14003e255
mov rcx, qword [rbp + 0x170]
lea r8, [rbp + 0x180]
lea rdx, [0x140156174]
mov rax, qword [rcx]
call qword [rax + 0x18]
mov ebx, eax
test eax, eax
je 0x14003e25d
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
call fcn.14004fba0
lea rcx, str.Notice:_Disabling_VDS__Could_not_load_VDS_Service:__s_
mov rdx, rax
call fcn.14004f2f0
mov rcx, qword [rbp + 0x180]
test rcx, rcx
je 0x14003e26f
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x170]
test rcx, rcx
je 0x14003e281
mov rax, qword [rcx]
call qword [rax + 0x10]
test ebx, ebx
je 0x14003e297
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [0x14019f120], 0xc003001f
mov rdx, qword [0x14019f580]
test ebx, ebx
mov eax, r12d
sete al
mov dword [0x1401954e8], eax
test rdx, rdx
je 0x14003e2e6
mov r8d, r15d
lea rcx, str.UseVds
mov edi, r12d
call fcn.140026e40
mov rbx, rax
test rax, rax
je 0x14003e2e2
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.140102178
mov rcx, rbx
mov edi, eax
call fcn.1400e8c70
test edi, edi
jmp 0x14003e311
lea r9, [rsp + 0x60]
mov dword [rsp + 0x20], 4
mov r8d, 4
lea rdx, str.UseVds
mov rcx, 0xffffffff80000001
call fcn.14002fb80
cmp dword [rsp + 0x60], r12d
mov ecx, r12d
setne cl
test ecx, ecx
je 0x14003e327
cmp dword [0x1401954e8], r12d
mov eax, r15d
jne 0x14003e32a
mov eax, r12d
mov rdx, qword [0x14019f580]
mov dword [0x14019f594], eax
test rdx, rdx
je 0x14003e371
mov r8d, r15d
lea rcx, str.EnableUsbDebug
mov edi, r12d
call fcn.140026e40
mov rbx, rax
test rax, rax
je 0x14003e36d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.140102178
mov rcx, rbx
mov edi, eax
call fcn.1400e8c70
test edi, edi
jmp 0x14003e39c
lea r9, [rsp + 0x60]
mov dword [rsp + 0x20], 4
mov r8d, 4
lea rdx, str.EnableUsbDebug
mov rcx, 0xffffffff80000001
call fcn.14002fb80
cmp dword [rsp + 0x60], r12d
mov rdx, qword [0x14019f580]
mov eax, r12d
setne al
mov dword [0x1401e87c0], eax
xor eax, 1
lea eax, [rax*2 + 1]
mov dword [0x140196fa4], eax
test rdx, rdx
je 0x14003e3f9
mov r8d, r15d
lea rcx, str.DisableRufusMBR
mov edi, r12d
call fcn.140026e40
mov rbx, rax
test rax, rax
je 0x14003e3f5
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.140102178
mov rcx, rbx
mov edi, eax
call fcn.1400e8c70
test edi, edi
jmp 0x14003e424
lea r9, [rsp + 0x60]
mov dword [rsp + 0x20], 4
mov r8d, 4
lea rdx, str.DisableRufusMBR
mov rcx, 0xffffffff80000001
call fcn.14002fb80
cmp dword [rsp + 0x60], r12d
mov rdx, qword [0x14019f580]
mov ecx, r12d
sete cl
mov dword [0x140196f40], ecx
test rdx, rdx
je 0x14003e471
mov r8d, r15d
lea rcx, str.DisableFakeDrivesCheck
mov edi, r12d
call fcn.140026e40
mov rbx, rax
test rax, rax
je 0x14003e46d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.140102178
mov rcx, rbx
mov edi, eax
call fcn.1400e8c70
test edi, edi
jmp 0x14003e49c
lea r9, [rsp + 0x60]
mov dword [rsp + 0x20], 4
mov r8d, 4
lea rdx, str.DisableFakeDrivesCheck
mov rcx, 0xffffffff80000001
call fcn.14002fb80
cmp dword [rsp + 0x60], r12d
mov rdx, qword [0x14019f580]
mov ecx, r12d
sete cl
mov dword [0x1401e89f0], ecx
test rdx, rdx
je 0x14003e4e9
mov r8d, r15d
lea rcx, str.EnableWindowsDualUefiBiosMode
mov edi, r12d
call fcn.140026e40
mov rbx, rax
test rax, rax
je 0x14003e4e5
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.140102178
mov rcx, rbx
mov edi, eax
call fcn.1400e8c70
test edi, edi
jmp 0x14003e514
lea r9, [rsp + 0x60]
mov dword [rsp + 0x20], 4
mov r8d, 4
lea rdx, str.EnableWindowsDualUefiBiosMode
mov rcx, 0xffffffff80000001
call fcn.14002fb80
cmp dword [rsp + 0x60], r12d
mov rdx, qword [0x14019f580]
mov ecx, r12d
setne cl
mov dword [0x1401e8678], ecx
test rdx, rdx
je 0x14003e561
mov r8d, r15d
lea rcx, str.ForceLargeFat32Formatting
mov edi, r12d
call fcn.140026e40
mov rbx, rax
test rax, rax
je 0x14003e55d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.140102178
mov rcx, rbx
mov edi, eax
call fcn.1400e8c70
test edi, edi
jmp 0x14003e58c
lea r9, [rsp + 0x60]
mov dword [rsp + 0x20], 4
mov r8d, 4
lea rdx, str.ForceLargeFat32Formatting
mov rcx, 0xffffffff80000001
call fcn.14002fb80
cmp dword [rsp + 0x60], r12d
mov rdx, qword [0x14019f580]
mov ecx, r12d
setne cl
mov dword [0x1401e87a4], ecx
test rdx, rdx
je 0x14003e5d9
mov r8d, r15d
lea rcx, str.EnableVmdkDetection
mov edi, r12d
call fcn.140026e40
mov rbx, rax
test rax, rax
je 0x14003e5d5
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.140102178
mov rcx, rbx
mov edi, eax
call fcn.1400e8c70
test edi, edi
jmp 0x14003e604
lea r9, [rsp + 0x60]
mov dword [rsp + 0x20], 4
mov r8d, 4
lea rdx, str.EnableVmdkDetection
mov rcx, 0xffffffff80000001
call fcn.14002fb80
cmp dword [rsp + 0x60], r12d
mov rdx, qword [0x14019f580]
mov ecx, r12d
setne cl
mov dword [0x1401e8190], ecx
test rdx, rdx
je 0x14003e651
mov r8d, r15d
lea rcx, str.EnableFileIndexing
mov edi, r12d
call fcn.140026e40
mov rbx, rax
test rax, rax
je 0x14003e64d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.140102178
mov rcx, rbx
mov edi, eax
call fcn.1400e8c70
test edi, edi
jmp 0x14003e67c
lea r9, [rsp + 0x60]
mov dword [rsp + 0x20], 4
mov r8d, 4
lea rdx, str.EnableFileIndexing
mov rcx, 0xffffffff80000001
call fcn.14002fb80
cmp dword [rsp + 0x60], r12d
mov rdx, qword [0x14019f580]
mov ecx, r12d
setne cl
mov dword [0x1401e87a8], ecx
test rdx, rdx
je 0x14003e6c9
mov r8d, r15d
lea rcx, str.DisableVHDs
mov edi, r12d
call fcn.140026e40
mov rbx, rax
test rax, rax
je 0x14003e6c5
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.140102178
mov rcx, rbx
mov edi, eax
call fcn.1400e8c70
test edi, edi
jmp 0x14003e6f4
lea r9, [rsp + 0x60]
mov dword [rsp + 0x20], 4
mov r8d, 4
lea rdx, str.DisableVHDs
mov rcx, 0xffffffff80000001
call fcn.14002fb80
cmp dword [rsp + 0x60], r12d
mov rdx, qword [0x14019f580]
mov ecx, r12d
sete cl
mov dword [0x140196f74], ecx
test rdx, rdx
je 0x14003e741
mov r8d, r15d
lea rcx, str.EnableExtraHashes
mov edi, r12d
call fcn.140026e40
mov rbx, rax
test rax, rax
je 0x14003e73d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.140102178
mov rcx, rbx
mov edi, eax
call fcn.1400e8c70
test edi, edi
jmp 0x14003e76c
lea r9, [rsp + 0x60]
mov dword [rsp + 0x20], 4
mov r8d, 4
lea rdx, str.EnableExtraHashes
mov rcx, 0xffffffff80000001
call fcn.14002fb80
cmp dword [rsp + 0x60], r12d
mov rdx, qword [0x14019f580]
mov ecx, r12d
setne cl
mov dword [0x1401a0480], ecx
test rdx, rdx
je 0x14003e7b9
mov r8d, r15d
lea rcx, str.ExpertMode
mov edi, r12d
call fcn.140026e40
mov rbx, rax
test rax, rax
je 0x14003e7b5
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.140102178
mov rcx, rbx
mov edi, eax
call fcn.1400e8c70
test edi, edi
jmp 0x14003e7e4
lea r9, [rsp + 0x60]
mov dword [rsp + 0x20], 4
mov r8d, 4
lea rdx, str.ExpertMode
mov rcx, 0xffffffff80000001
call fcn.14002fb80
cmp dword [rsp + 0x60], r12d
mov rdx, qword [0x14019f580]
mov ecx, r12d
setne cl
mov dword [0x14019f628], ecx
test rdx, rdx
je 0x14003e831
mov r8d, r15d
lea rcx, str.IgnoreBootMarker
mov edi, r12d
call fcn.140026e40
mov rbx, rax
test rax, rax
je 0x14003e82d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.140102178
mov rcx, rbx
mov edi, eax
call fcn.1400e8c70
test edi, edi
jmp 0x14003e85c
lea r9, [rsp + 0x60]
mov dword [rsp + 0x20], 4
mov r8d, 4
lea rdx, str.IgnoreBootMarker
mov rcx, 0xffffffff80000001
call fcn.14002fb80
cmp dword [rsp + 0x60], r12d
mov rdx, qword [0x14019f580]
mov ecx, r12d
setne cl
mov dword [0x14019f630], ecx
test rdx, rdx
je 0x14003e8a9
mov r8d, r15d
lea rcx, str.PersistentLog
mov edi, r12d
call fcn.140026e40
mov rbx, rax
test rax, rax
je 0x14003e8a5
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.140102178
mov rcx, rbx
mov edi, eax
call fcn.1400e8c70
test edi, edi
jmp 0x14003e8d4
lea r9, [rsp + 0x60]
mov dword [rsp + 0x20], 4
mov r8d, 4
lea rdx, str.PersistentLog
mov rcx, 0xffffffff80000001
call fcn.14002fb80
cmp dword [rsp + 0x60], r12d
mov ecx, r12d
setne cl
mov dword [0x14019f61c], ecx
lea rcx, str.PreferredSaveImageType
call fcn.1400303c0
mov rdx, qword [0x14019f580]
mov qword [0x1401a0450], rax
test rdx, rdx
je 0x14003e932
mov r8d, r15d
lea rcx, str.WindowsUserExperienceOptions
mov ebx, r12d
call fcn.140026e40
mov rdi, rax
test rax, rax
je 0x14003e95c
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.140102178
mov rcx, rdi
mov ebx, eax
call fcn.1400e8c70
jmp 0x14003e95c
lea r9, [rsp + 0x60]
mov dword [rsp + 0x20], 4
mov r8d, 4
lea rdx, str.WindowsUserExperienceOptions
mov rcx, 0xffffffff80000001
call fcn.14002fb80
mov ebx, dword [rsp + 0x60]
mov ecx, ebx
shr ecx, 0x10
test ecx, ecx
je 0x14003e979
mov eax, ecx
and ebx, ecx
not eax
and eax, dword [0x140196f98]
or eax, ebx
mov dword [0x140196f98], eax
mov rdx, qword [0x14019f580]
test rdx, rdx
je 0x14003e9b8
mov r8d, r15d
lea rcx, str.DefaultThreadPriority
mov edi, r12d
call fcn.140026e40
mov rbx, rax
test rax, rax
je 0x14003e9e2
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.140102178
mov rcx, rbx
mov edi, eax
call fcn.1400e8c70
jmp 0x14003e9e2
lea r9, [rsp + 0x60]
mov dword [rsp + 0x20], 4
mov r8d, 4
lea rdx, str.DefaultThreadPriority
mov rcx, 0xffffffff80000001
call fcn.14002fb80
mov edi, dword [rsp + 0x60]
lea eax, [rdi + 1]
xor ecx, ecx
mov dword [0x140196f64], eax
call qword [sym.imp.USER32.dll_GetDC]
mov rcx, rax
mov edx, 0x58
mov rbx, rax
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
lea rcx, [rbx - 1]
movd xmm0, eax
cvtdq2ps xmm0, xmm0
divss xmm0, dword [0x140177020]
movss dword [0x140196f6c], xmm0
cmp rcx, 0xfffffffffffffffd
ja 0x14003ea30
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
xor ecx, ecx
call fcn.140020790
lea rax, str.rufus.loc
mov edx, 0x104
mov qword [rsp + 0x28], rax
lea r9, [0x140163980]
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x20], r13
lea rcx, [rbp + 0x260]
call fcn.140004fd0
lea rcx, [rbp + 0x260]
mov byte [rbp + 0x363], r12b
call fcn.14002e8b0
mov rdi, rax
cmp word [rax], 0x22
jne 0x14003eac8
mov rax, 0xffffffffffffffff
nop word [rax + rax]
cmp word [rdi + rax*2 + 2], r12w
lea rax, [rax + 1]
jne 0x14003ea90
cmp word [rdi + rax*2 - 2], 0x22
jne 0x14003eac8
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
cmp word [rdi + rax*2 + 2], r12w
lea rax, [rax + 1]
jne 0x14003eab0
mov word [rdi + rax*2 - 2], r12w
lea rcx, [rdi + 2]
jmp 0x14003eacb
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
mov ebx, eax
call fcn.1400e8c70
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp esi, 0xffffffff
jne 0x14003f227
lea rcx, str.loc_file_not_found_in_current_directory___embedded_one_will_be_used
call fcn.14004f2f0
mov rbx, qword [0x1401e87b8]
mov edx, 0x1f4
mov rcx, rbx
mov r8d, 0xa
mov r13, r12
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdi, rax
test rax, rax
jne 0x14003eb48
call fcn.14004fba0
mov r8, rax
lea rdx, str.embedded.loc
lea rcx, str.Could_not_locate_resource__s:__s
call fcn.14004f2f0
mov r12d, dword [rsp + 0x60]
jmp 0x14003eb99
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
test rax, rax
jne 0x14003eb7e
call fcn.14004fba0
mov r8, rax
lea rdx, str.embedded.loc
lea rcx, str.Could_not_load_resource__s:__s
call fcn.14004f2f0
mov r12d, dword [rsp + 0x60]
jmp 0x14003eb99
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, rsi
mov r12d, eax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r13, rax
lea rcx, [0x1401e8440]
call fcn.14002e8b0
cmp byte [0x140156a6c], 0
mov r14, rax
jne 0x14003ebc3
mov edx, 2
mov rcx, r15
call fcn.1400c4f6c
mov rbx, rax
jmp 0x14003ec36
xor esi, esi
lea r15, [0x140156a6c]
mov dword [rsp + 0x28], esi
mov r8, r15
mov r9d, 0xffffffff
mov qword [rsp + 0x20], rsi
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rdi, eax
cmp edi, 1
jle 0x14003ec33
mov rcx, rdi
mov edx, 2
call fcn.1400c4f6c
mov rbx, rax
test rax, rax
je 0x14003ec33
mov dword [rsp + 0x28], edi
mov r9d, 0xffffffff
mov r8, r15
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, edi
je 0x14003ec36
mov rcx, rbx
call fcn.1400e8c70
mov rbx, rsi
mov edx, 2
mov ecx, 0x104
call fcn.1400c4f6c
mov r9, rax
xor r8d, r8d
mov rdx, rbx
mov rcx, r14
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r15d, eax
test esi, esi
je 0x14003ecae
xor eax, eax
mov r9d, 0xffffffff
mov qword [rsp + 0x38], rax
mov r8, rdi
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0x260]
mov dword [rsp + 0x28], 0x104
mov ecx, 0xfde9
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
test eax, eax
jne 0x14003ecae
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r15d, eax
test rdi, rdi
je 0x14003ecbb
mov rcx, rdi
call fcn.1400e8c70
test rbx, rbx
je 0x14003ecc8
mov rcx, rbx
call fcn.1400e8c70
test r14, r14
je 0x14003ecd5
mov rcx, r14
call fcn.1400e8c70
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
je 0x14003f1fa
cmp byte [rbp + 0x260], 0
je 0x14003f1fa
lea rcx, [rbp + 0x260]
call fcn.14002e8b0
mov rdi, rax
mov r15d, 1
xor eax, eax
xor r9d, r9d
mov qword [rsp + 0x30], rax
mov r8d, r15d
mov dword [rsp + 0x28], 0x80
mov edx, 0xc0000000
mov rcx, rdi
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test rdi, rdi
je 0x14003ed4b
mov rcx, rdi
call fcn.1400e8c70
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp rbx, 0xffffffffffffffff
je 0x14003edef
lea r9, [rbp - 0x48]
mov r8d, r12d
mov rdx, r13
mov rcx, rbx
call fcn.140050980
test eax, eax
je 0x14003edef
lea rdx, [rbp + 0x260]
lea rcx, str.localization:_extracted_data_to__s
call fcn.14004f2f0
test rbx, rbx
je 0x14003ed94
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r14d, dword [rsp + 0x7c]
lea rsi, [0x1401e6720]
xor r12d, r12d
lea rcx, [rbp + 0x260]
call fcn.140026250
test eax, eax
je 0x140041337
mov rax, qword [rbp - 0x60]
test rax, rax
jne 0x14003f308
mov r8, qword [0x14019f158]
lea r10, [0x14019f150]
cmp r8, r10
jne 0x14003f2a5
lea rcx, str.localization:_the_locale_list_is_empty__n
call fcn.14004f2f0
mov rbx, r12
jmp 0x14003f316
call fcn.14004fba0
mov r8, rax
lea rdx, [rbp + 0x260]
lea rcx, str.FATAL:_Unable_to_extract_loc_file__s:__s
call fcn.14004f2f0
lea rax, [rbx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14003ee1d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r9d, 0x1010
lea r8, str.Fatal_error
lea rdx, str.Unable_to_extract_localization_file._This_application_will_now_exit.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor r12d, r12d
lea r15, [0x140000000]
lea rcx, [0x1401e81c0]
call fcn.14002e8b0
mov rcx, rax
mov rbx, rax
call fcn.14010348c
test rbx, rbx
je 0x14003ee67
mov rcx, rbx
call fcn.1400e8c70
mov rbx, qword [rbp + 0x10]
test rbx, rbx
je 0x14003eec3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
cmp rbx, 0xffffffffffffffff
je 0x14003ee88
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.rufus.com
mov ebx, r12d
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x14003eec3
nop dword [rax]
cmp ebx, 0xa
jg 0x14003eec3
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.rufus.com
inc ebx
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x14003eea0
mov rcx, qword [0x14019f578]
mov r14d, 1
test rcx, rcx
je 0x14003eede
mov edx, r14d
call qword [sym.imp.KERNEL32.dll_TerminateThread]
cmp dword [rbp - 0x44], 0
jne 0x14003ef43
cmp byte [rbp + 0x260], 0
je 0x14003ef43
lea rcx, [rbp + 0x260]
call fcn.14002e8b0
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test rbx, rbx
je 0x14003ef1c
mov rcx, rbx
call fcn.1400e8c70
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
jne 0x14003ef43
call fcn.14004fba0
mov r8, rax
lea rdx, [rbp + 0x260]
lea rcx, str.Could_not_delete__s:__s
call fcn.14004f2f0
lea rbx, [0x1401e4168]
mov edi, 0x80
nop
mov rcx, qword [rbx - 0x18]
test rcx, rcx
je 0x14003ef76
call qword [sym.imp.USER32.dll_DestroyWindow]
mov rcx, qword [rbx]
call fcn.1400e8c70
mov qword [rbx], r12
mov qword [rbx - 8], r12
mov qword [rbx - 0x18], r12
mov qword [rbx - 0x10], r12
add rbx, 0x20
sub rdi, 1
jne 0x14003ef50
mov rcx, qword [0x1401e4020]
call qword [sym.imp.USER32.dll_UnhookWinEvent]
xor ecx, ecx
mov qword [0x1401e4020], r12
call fcn.140020950
mov rcx, qword [0x14019f588]
call fcn.1400e8c70
mov rcx, qword [0x14019f5a8]
mov qword [0x14019f588], r12
call fcn.1400e8c70
mov rcx, qword [rbp - 0x60]
mov qword [0x14019f5a8], r12
call fcn.1400e8c70
mov rcx, qword [0x14019f5f0]
call fcn.1400e8c70
mov rcx, qword [0x14019f5f8]
mov qword [0x14019f5f0], r12
call fcn.1400e8c70
mov rcx, qword [0x14019f130]
mov qword [0x14019f5f8], r12
call fcn.1400e8c70
mov rcx, qword [0x14019f608]
mov qword [0x14019f130], r12
call fcn.1400e8c70
mov rcx, qword [0x14019f570]
mov qword [0x14019f608], r12
call fcn.1400e8c70
mov rcx, qword [0x1401a0478]
mov qword [0x14019f570], r12
call fcn.1400e8c70
mov rsi, qword [rbp - 0x78]
mov qword [0x1401a0478], r12
test rsi, rsi
je 0x14003f071
cmp dword [rsp + 0x68], 0
mov edi, r12d
jle 0x14003f069
mov rbx, rsi
mov rcx, qword [rbx]
call fcn.1400e8c70
mov qword [rbx], r12
lea rbx, [rbx + 8]
inc edi
cmp edi, dword [rsp + 0x68]
jl 0x14003f052
mov rcx, rsi
call fcn.1400e8c70
cmp dword [rbp - 0x40], 0
je 0x14003f084
mov ecx, r14d
mov dword [rsp + 0x20], r12d
call fcn.14004e3e0
cmp dword [rbp - 0x80], 0
jne 0x14003f111
mov qword [rsp + 0x30], r12
lea rcx, str..MountPointManager
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], 3
mov r8d, 3
mov dword [rsp + 0x60], r12d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14003f105
mov qword [rsp + 0x38], r12
lea r8, [rsp + 0x60]
mov qword [rsp + 0x30], r12
mov r9d, 4
mov dword [rsp + 0x28], r12d
mov edx, 0x6dc040
mov rcx, rax
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x14003f111
lea rcx, str.Failed_to_restore_AutoMount_to_disabled
call fcn.14004f2f0
cmp qword [0x1401d05a0], 0
je 0x14003f12e
lea rdx, [0x1401e6720]
lea rcx, [0x14014fa20]
call fcn.14004f2f0
cmp dword [rbp - 0x3c], 0
mov qword [0x1401d05a0], r12
je 0x14003f16a
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov dword [rsp + 0x30], 3
xor r9d, r9d
mov rcx, rax
mov dword [rsp + 0x28], r12d
xor r8d, r8d
mov dword [rsp + 0x20], r12d
xor edx, edx
call qword [sym.imp.USER32.dll_SetWindowPos]
call qword [sym.imp.KERNEL32.dll_FreeConsole]
call qword [sym.imp.ole32.dll_CoUninitialize]
movzx eax, word [0x14019f124]
test ax, ax
je 0x14003f1a8
mov ebx, 0xffff
add ax, bx
movzx ecx, ax
mov word [0x14019f124], ax
mov rcx, qword [r15 + rcx*8 + 0x1e87e0]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
movzx eax, word [0x14019f124]
test ax, ax
jne 0x14003f181
mov rcx, qword [rbp - 8]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14003f1bc
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str._Rufus_exit__n
call fcn.14004f2f0
xor eax, eax
mov rcx, qword [rbp + 0x690]
xor rcx, rsp
call fcn.1400b2a30
lea r11, [rsp + 0x7a0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14004fba0
mov rdx, rax
lea rcx, str.FATAL:_Unable_to_create_temp_loc_file:__s
call fcn.14004f2f0
mov r9d, 0x1010
lea r8, str.Fatal_error
lea rdx, str.Unable_to_create_temporary_localization_file._This_application_will_now_exit.
jmp 0x14003ee31
mov rax, qword [0x1401d05a0]
lea rsi, [0x1401e6720]
mov edi, 0xffc
mov dword [rbp - 0x44], r15d
sub rdi, rax
lea r9, str.Using_external_loc_file__s
mov r8, 0xffffffffffffffff
mov rdx, rdi
lea rbx, [rax + rsi]
lea rax, [rbp + 0x260]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.140004fd0
mov rax, 0xffffffffffffffff
mov byte [rbx + rdi - 1], r12b
inc rax
cmp byte [rsi + rax], r12b
jne 0x14003f276
mov word [rax + rsi], 0xa0d
add rax, 2
mov qword [0x1401d05a0], rax
cmp rax, 0x1000
jae 0x140041364
mov byte [rax + rsi], r12b
jmp 0x14003eda3
mov r9d, dword [rsp + 0x6c]
lea rbx, [r8 - 0x28]
lea rax, [rbx + 0x28]
cmp rax, r10
je 0x14003f2ef
nop word [rax + rax]
movzx eax, byte [rbx + 1]
mov rcx, r12
test al, al
je 0x14003f2e2
mov edx, eax
mov rax, qword [rbx + 0x10]
cmp dword [rax], r9d
je 0x14003f316
inc rcx
add rax, 4
cmp rcx, rdx
jl 0x14003f2d1
mov rax, qword [rbx + 0x30]
lea rbx, [rax - 0x28]
cmp rax, r10
jne 0x14003f2c0
lea rbx, [r8 - 0x28]
mov edx, r9d
mov r8, qword [rbx + 0x18]
lea rcx, str.localization:_could_not_find_locale_for_LCID:_0x_04X._Will_default_to__s_n
call fcn.14004f2f0
jmp 0x14003f316
mov edx, r15d
mov rcx, rax
call fcn.140021820
mov rbx, rax
mov qword [0x14019f5d8], rbx
test rbx, rbx
je 0x140041337
mov rcx, rbx
call fcn.1400219b0
lea rcx, [0x1401d0500]
mov word [0x1401941e8], ax
call fcn.14004ba90
mov eax, dword [0x1401d0500]
cmp eax, 0x61
jbe 0x1400412cf
mov ecx, dword [rsp + 0x74]
test ecx, ecx
je 0x14003f360
mov eax, ecx
mov dword [0x1401d0500], ecx
cmp eax, 0x61
jbe 0x1400412cf
lea r9, [rsp + 0x60]
mov dword [rsp + 0x6c], r12d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystemEnableLUA
mov qword [rbp + 0x180], 0xffffffffffffffff
mov rcx, 0xffffffff80000002
mov dword [rbp + 0x170], 0
mov word [rbp + 0x174], 0x500
call fcn.14004aad0
cmp dword [rsp + 0x60], 1
jne 0x14003f447
lea rcx, str.Note:_UAC_is_active
call fcn.14004f2f0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp + 0x180]
mov edx, 8
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x14003f3f3
call fcn.14004fba0
mov rdx, rax
lea rcx, str.Could_not_get_current_process_token:__s
call fcn.14004f2f0
jmp 0x14003f4c6
mov rcx, qword [rbp + 0x180]
lea rax, [rbp]
mov r9d, 4
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x74]
mov edx, 0x14
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x14003f436
call fcn.14004fba0
mov rdx, rax
lea rcx, str.Could_not_get_token_information:__s
call fcn.14004f2f0
jmp 0x14003f4c6
cmp dword [rsp + 0x74], 0
mov eax, r12d
setne al
mov dword [rsp + 0x6c], eax
jmp 0x14003f4c6
lea rcx, str.Note:_UAC_is_either_disabled_or_not_available
call fcn.14004f2f0
lea rax, [rbp + 0x190]
mov r9d, 0x220
mov qword [rsp + 0x50], rax
lea rcx, [rbp + 0x170]
mov dword [rsp + 0x48], r12d
mov r8d, 0x20
mov dword [rsp + 0x40], r12d
mov dl, 2
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x14003f4c6
mov rdx, qword [rbp + 0x190]
lea r8, [rsp + 0x6c]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x14003f4b9
mov dword [rsp + 0x6c], r12d
mov rcx, qword [rbp + 0x190]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov rcx, qword [rbp + 0x180]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14003f4dd
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x6c], 0
jne 0x14003f5a1
lea rcx, str.FATAL:_No_administrative_privileges_
call fcn.14004f2f0
mov rdx, qword [0x14019f5d8]
lea rcx, [rbp + 0x260]
call fcn.140026780
mov rax, qword [0x14019f5d8]
mov ecx, 0xcd8
movzx edi, word [0x1401941e8]
mov esi, dword [rax + 4]
and esi, 1
mov dword [0x14019f590], esi
call fcn.140021050
mov ecx, 0xcd9
mov rbx, rax
call fcn.140021050
mov rcx, rax
call fcn.14002e8b0
mov rcx, rbx
mov r15, rax
call fcn.14002e8b0
mov r9d, 0x1010
mov word [rsp + 0x20], di
mov ecx, 0x181010
test esi, esi
mov r8, rax
mov rdx, r15
cmovne r9d, ecx
mov r14, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxExW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test r15, r15
je 0x14003f587
mov rcx, r15
call fcn.1400e8c70
test r14, r14
je 0x14003f594
mov rcx, r14
call fcn.1400e8c70
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14003ee3c
mov rcx, qword [rbp + 0x1a0]
test rcx, rcx
je 0x14003f5ee
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x14003f5b4
cmp rax, 2
jne 0x14003f5ee
cmp byte [rcx], 0x2f
jne 0x14003f5ee
cmp byte [rcx + 1], 0x57
jne 0x14003f5ee
lea r8, str.Global_Rufus
mov edx, r15d
xor ecx, ecx
mov ebx, 0x96
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov rdi, rax
mov qword [rbp - 8], rax
jmp 0x14003f610
lea r8, str.Global_Rufus
mov edx, r15d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ebx, dword [rbp - 0x68]
mov rdi, rax
mov qword [rbp - 8], rax
test ebx, ebx
jle 0x14003f659
nop
test rdi, rdi
je 0x14004128e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14003f662
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r8, str.Global_Rufus
mov edx, r15d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
dec ebx
mov qword [rbp - 8], rax
mov rdi, rax
test ebx, ebx
jg 0x14003f610
test rdi, rdi
je 0x14004128e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x14004128e
mov r13, qword [rbp + 8]
mov edx, 6
xor ecx, ecx
mov qword [0x1401e87b8], r13
call qword [sym.imp.ole32.dll_CoInitializeEx]
lea rcx, str.Riched20
call fcn.14002e630
test rax, rax
jne 0x14003f6b0
call fcn.14004fba0
mov rdx, rax
lea rcx, str.Could_not_load_RichEdit_library___some_dialogs_may_not_display:__s
call fcn.14004f2f0
call fcn.14002d500
xor ecx, ecx
mov dword [rsp + 0x20], 0x9e
call fcn.14004e3e0
mov qword [rsp + 0x30], r12
lea rcx, str..MountPointManager
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], 3
mov r8d, 3
mov dword [rbp - 0x40], eax
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14003f76b
mov qword [rsp + 0x38], r12
lea rax, [rbp]
mov qword [rsp + 0x30], rax
xor r9d, r9d
lea rax, [rbp - 0x80]
mov dword [rsp + 0x28], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0x6d003c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x14003f76b
cmp dword [rbp - 0x80], 0
jne 0x14003f77b
lea rcx, str.AutoMount_was_detected_as_disabled___temporarily_re_enabling_it
call fcn.14004f2f0
mov ecx, r15d
call fcn.140005aa0
test eax, eax
jne 0x14003f77b
lea rcx, str.Failed_to_enable_AutoMount
call fcn.14004f2f0
jmp 0x14003f77b
lea rcx, str.Could_not_get_AutoMount_status
call fcn.14004f2f0
mov dword [rbp - 0x80], r15d
xor eax, eax
mov dword [rbp + 0x160], r12d
xor ecx, ecx
mov r8d, r12d
cpuid
mov dword [rbp + 0x164], ebx
mov r10d, r12d
mov dword [rbp + 0x168], ecx
mov r9d, eax
mov dword [rbp + 0x16c], edx
cmp eax, 1
jb 0x14003f7c4
mov eax, r15d
xor ecx, ecx
cpuid
mov r8d, ecx
mov dword [rbp + 0x160], eax
mov dword [rbp + 0x164], ebx
mov dword [rbp + 0x16c], edx
cmp r9d, 7
jb 0x14003f7e8
mov eax, 7
xor ecx, ecx
cpuid
mov r10d, ebx
mov dword [rbp + 0x160], eax
mov dword [rbp + 0x168], ecx
mov dword [rbp + 0x16c], edx
bt r8d, 0x13
setb cl
bt r8d, 9
setb al
test al, cl
je 0x14003f806
mov eax, r15d
bt r10d, 0x1d
jb 0x14003f809
mov eax, r12d
mov dword [0x14019f110], eax
xor ecx, ecx
xor eax, eax
mov dword [rbp + 0x160], r12d
cpuid
mov dword [rbp + 0x164], ebx
mov r8d, r12d
mov dword [rbp + 0x168], ecx
mov r10d, r12d
mov dword [rbp + 0x16c], edx
mov r9d, eax
cmp eax, 1
jb 0x14003f858
mov eax, r15d
xor ecx, ecx
cpuid
mov r8d, ecx
mov dword [rbp + 0x160], eax
mov dword [rbp + 0x164], ebx
mov dword [rbp + 0x16c], edx
cmp r9d, 7
jb 0x14003f87c
mov eax, 7
xor ecx, ecx
cpuid
mov r10d, ebx
mov dword [rbp + 0x160], eax
mov dword [rbp + 0x168], ecx
mov dword [rbp + 0x16c], edx
bt r8d, 0x13
setb cl
bt r8d, 9
setb al
test al, cl
je 0x14003f89a
mov eax, r15d
bt r10d, 0x1d
jb 0x14003f89d
mov eax, r12d
mov dword [0x14019f114], eax
lea r9, str._sdismFfuProvider.dll
lea rax, [0x1401e8560]
mov edx, 0x104
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x20], rax
lea rcx, [rbp + 0x370]
call fcn.140004fd0
lea rcx, [rbp + 0x370]
mov byte [rbp + 0x473], 0
call fcn.14002e8b0
xor edx, edx
mov rcx, rax
mov rbx, rax
call fcn.14010a89c
mov edi, eax
test rbx, rbx
je 0x14003f8fd
mov rcx, rbx
call fcn.1400e8c70
mov rax, qword [0x1401d05a0]
lea r9, str.Localization_set_to__s
test edi, edi
mov ecx, r12d
mov edi, 0xffc
mov r8, 0xffffffffffffffff
sete cl
sub rdi, rax
lea rbx, [rax + rsi]
mov dword [0x14019f5b4], ecx
mov rax, qword [0x14019f5d8]
mov rdx, rdi
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x20], rcx
mov rcx, rbx
call fcn.140004fd0
mov rax, 0xffffffffffffffff
mov byte [rbx + rdi - 1], 0
inc rax
cmp byte [rsi + rax], 0
jne 0x14003f953
mov word [rax + rsi], 0xa0d
add rax, 2
mov qword [0x1401d05a0], rax
cmp rax, 0x1000
jae 0x140041364
mov byte [rax + rsi], 0
mov r15d, 0x12
mov rsi, qword [rbp - 0x58]
mov r12d, esi
mov rax, qword [0x14019f5d8]
mov ebx, 0x181034
mov byte [0x140194188], 1
nop dword [rax]
mov ecx, dword [rax + 4]
and ecx, 1
mov dword [0x14019f590], ecx
mov rcx, qword [0x14019f608]
xor edi, edi
mov dword [0x1401e2970], edi
mov byte [0x1401e79c0], 0
call fcn.1400e8c70
cmp dword [0x14019f590], edi
mov ecx, edi
mov qword [0x14019f608], rdi
setne cl
call qword [sym.imp.USER32.dll_SetProcessDefaultLayout]
mov rdx, qword [0x14019f5d8]
lea rcx, [rbp + 0x260]
call fcn.140026780
test eax, eax
je 0x14003fa4f
cmp qword [0x14019f580], rdi
mov rax, qword [0x14019f5d8]
mov r9, qword [rax + 0x18]
je 0x14003fa1b
mov rdx, r9
lea rcx, str.Locale
call fcn.140026fa0
jmp 0x14003fa4f
test r9, r9
jne 0x14003fa25
mov rax, rdi
jmp 0x14003fa39
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [r9 + rax], dil
jne 0x14003fa30
mov r8d, 1
mov dword [rsp + 0x20], eax
lea rdx, str.Locale
call fcn.14002fda0
test r14d, r14d
jne 0x14003faf7
cmp dword [0x14019f590], r14d
mov esi, 0x1034
movzx edi, word [0x1401941e8]
mov ecx, 0xcdf
cmovne esi, ebx
call fcn.140021050
mov ecx, 0xce0
mov rbx, rax
call fcn.140021050
mov rcx, rax
call fcn.14002e8b0
mov rcx, rbx
mov r14, rax
call fcn.14002e8b0
mov r9d, esi
mov word [rsp + 0x20], di
mov r8, rax
mov rdx, r14
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.USER32.dll_MessageBoxExW]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test r14, r14
je 0x14003fac8
mov rcx, r14
call fcn.1400e8c70
test rbx, rbx
je 0x14003fad5
mov rcx, rbx
call fcn.1400e8c70
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp edi, 6
jne 0x14003ee39
mov rsi, qword [rbp - 0x58]
mov r14d, 1
mov dword [rsp + 0x7c], r14d
xor edi, edi
test rsi, rsi
je 0x14003fb05
mov rcx, rsi
call qword [sym.imp.USER32.dll_DestroyWindow]
mov ecx, 0x65
call fcn.140058d60
mov rbx, rax
test rax, rax
jne 0x14003fb30
mov r8d, 0x726
lea rdx, str.D:_a_rufus_rufus_src_stdlg.c
lea rcx, str.rcTemplate___NULL
call fcn.1400fbe54
lea r9, [0x140038f20]
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
mov rcx, rbx
mov qword [rbp - 0x58], rax
mov rsi, rax
call fcn.1400e8c70
test rsi, rsi
je 0x140041140
mov r8d, dword [0x1401977e8]
mov ebx, 1
cmp r8d, 0xffff0000
jle 0x14003fb9f
mov r9d, dword [0x1401977ec]
cmp r9d, 0xffff0000
jle 0x14003fb9f
mov dword [rsp + 0x30], ebx
xor edx, edx
mov dword [rsp + 0x28], edi
mov rcx, rsi
mov dword [rsp + 0x20], edi
call qword [sym.imp.USER32.dll_SetWindowPos]
xor r9d, r9d
mov r8d, ebx
mov edx, 0x233
mov rcx, rsi
call qword [sym.imp.USER32.dll_ChangeWindowMessageFilterEx]
xor r9d, r9d
mov r8d, ebx
mov edx, 0x4a
mov rcx, rsi
call qword [sym.imp.USER32.dll_ChangeWindowMessageFilterEx]
xor r9d, r9d
mov r8d, ebx
mov edx, 0x49
mov rcx, rsi
call qword [sym.imp.USER32.dll_ChangeWindowMessageFilterEx]
call fcn.140059510
cmp qword [0x1401e4020], 0
jne 0x14003fc29
mov edx, 3
mov dword [rsp + 0x30], 2
mov ecx, edx
mov dword [rsp + 0x28], edi
lea r9, [0x140059330]
mov dword [rsp + 0x20], edi
xor r8d, r8d
call qword [sym.imp.USER32.dll_SetWinEventHook]
mov qword [0x1401e4020], rax
test rax, rax
jne 0x14003fc29
lea rcx, str.Warning:_Could_not_set_alert_prompt_hook
call fcn.14004f2f0
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, rsi
call qword [sym.imp.USER32.dll_UpdateWindow]
xor r9d, r9d
lea rcx, [rbp - 0x38]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x140040270
mov r14d, dword [rbp - 0x6c]
mov r13d, 1
mov eax, dword [rbp - 0x30]
cmp eax, 0x104
jne 0x14003fc7a
test qword [rbp - 0x20], 0x20000000
jne 0x14003fc7a
mov ebx, r13d
jmp 0x14003fc83
mov ebx, edi
cmp eax, 0x104
jne 0x14003fc92
cmp qword [rbp - 0x28], r15
je 0x14003fc92
mov edi, dword [rsp + 0x78]
mov r14d, r13d
jmp 0x14003fcaa
mov ecx, r15d
call qword [sym.imp.USER32.dll_GetKeyState]
mov edi, dword [rsp + 0x78]
test ax, ax
cmovs edi, r13d
mov dword [rsp + 0x78], edi
mov rcx, qword [0x14019f620]
call qword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x14003fcff
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x14003fcff
cmp dword [rbp - 0x30], 0x100
mov rcx, qword [rbp - 0x28]
jne 0x14003fd03
cmp rcx, 0x41
jne 0x14003fd03
mov rcx, qword [0x14019f648]
mov r9, 0xffffffffffffffff
xor r8d, r8d
mov edx, 0xb1
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x140040242
mov rcx, qword [rbp - 0x28]
test ebx, ebx
je 0x14003fd19
cmp rcx, 0x11
jne 0x14003fd19
mov eax, dword [0x140196f60]
mov dword [0x1401e296c], eax
cmp dword [0x1401e296c], 0
jne 0x14003fd3f
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
mov rcx, qword [rbp - 0x28]
test ax, ax
jns 0x14003fd6d
cmp dword [rbp - 0x30], 0x100
jne 0x14003fd6d
cmp rcx, 0x4c
jne 0x14003fd6d
mov rcx, qword [0x1401e89e8]
xor edi, edi
xor r9d, r9d
mov dword [0x1401e296c], edi
mov edx, 0x111
mov r8d, 0x41e
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x140040244
cmp dword [0x1401e296c], 0
jne 0x14003fd93
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
mov rcx, qword [rbp - 0x28]
test ax, ax
jns 0x14003fda3
cmp dword [rbp - 0x30], 0x100
jne 0x14003fda3
cmp rcx, 0x54
jne 0x14003fda3
call fcn.140049d70
jmp 0x140040242
cmp dword [0x1401e296c], 0
jne 0x14003fdd1
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
mov rcx, qword [rbp - 0x28]
test ax, ax
jns 0x14003fe77
cmp dword [rbp - 0x30], 0x100
jne 0x14003fe77
cmp rcx, 0x50
jne 0x14003fe77
xor edi, edi
cmp dword [0x14019f61c], edi
mov eax, edi
sete al
cmp qword [0x14019f580], rdi
mov dword [0x14019f61c], eax
je 0x14003fe44
lea r9, [0x14015e738]
mov dword [rsp + 0x20], eax
mov edx, 0xc
lea rcx, [rbp + 0x1a0]
mov r8, 0xffffffffffffffff
call fcn.140004fd0
lea rdx, [rbp + 0x1a0]
mov byte [rbp + 0x1ab], dil
lea rcx, str.PersistentLog
call fcn.140026fa0
mov ebx, dword [0x14019f61c]
mov ecx, 0xd08
jmp 0x14004108a
lea r9, [rsp + 0x60]
mov dword [rsp + 0x60], eax
mov r8d, 4
mov dword [rsp + 0x20], 4
lea rdx, str.PersistentLog
call fcn.14002fda0
mov ebx, dword [0x14019f61c]
mov ecx, 0xd08
jmp 0x14004108a
test ebx, ebx
je 0x14003fe92
cmp rcx, 0x11
je 0x140040242
xor edi, edi
mov dword [0x1401e296c], edi
jmp 0x140040244
cmp dword [rbp - 0x30], 0x104
jne 0x14003ffb9
cmp rcx, 0xbb
je 0x14003fedd
cmp rcx, 0xbd
je 0x14003fec1
cmp rcx, 0x6b
je 0x14003fedd
cmp rcx, 0x6d
jne 0x14003ffb9
cmp rcx, 0x6b
je 0x14003fedd
mov eax, dword [0x140196f64]
mov ecx, 0xffffffff
cmp eax, 0xfffffffe
jle 0x14003ff9b
jmp 0x14003feef
mov eax, dword [0x140196f64]
mov ecx, r13d
cmp eax, 2
jge 0x14003ff9b
add eax, ecx
mov dword [0x140196f64], eax
dec eax
cmp qword [0x14019f580], 0
je 0x14003ff42
lea r9, [0x14015e738]
mov dword [rsp + 0x20], eax
mov edx, 0xc
lea rcx, [rbp + 0x190]
mov r8, 0xffffffffffffffff
call fcn.140004fd0
lea rdx, [rbp + 0x190]
mov byte [rbp + 0x19b], 0
lea rcx, str.DefaultThreadPriority
call fcn.140026fa0
jmp 0x14003ff65
lea r9, [rsp + 0x74]
mov dword [rsp + 0x74], eax
mov r8d, 4
mov dword [rsp + 0x20], 4
lea rdx, str.DefaultThreadPriority
call fcn.14002fda0
mov rcx, qword [0x14019f5c8]
test rcx, rcx
je 0x14003ff7d
mov edx, dword [0x140196f64]
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rcx, qword [0x1401d05c8]
test rcx, rcx
je 0x14003ff95
mov edx, dword [0x140196f64]
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [0x140196f64]
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
mov r9d, 0xcf6
mov r8d, 0xdac
call fcn.140021510
jmp 0x140040242
cmp dword [0x140196f60], 0
jne 0x1400410b4
cmp dword [rbp - 0x30], 0x104
jne 0x140040dec
cmp rcx, 0xbe
jne 0x14004008e
xor edi, edi
cmp dword [0x1401e87c0], edi
mov ecx, edi
sete cl
mov eax, ecx
mov dword [0x1401e87c0], ecx
xor eax, r13d
cmp qword [0x14019f580], rdi
lea eax, [rax*2 + 1]
mov dword [0x140196fa4], eax
je 0x14004005b
mov dword [rsp + 0x20], ecx
lea r9, [0x14015e738]
lea rcx, [rbp + 0x180]
mov edx, 0xc
mov r8, 0xffffffffffffffff
call fcn.140004fd0
lea rdx, [rbp + 0x180]
mov byte [rbp + 0x18b], dil
lea rcx, str.EnableUsbDebug
call fcn.140026fa0
mov ebx, dword [0x1401e87c0]
mov ecx, 0xcc6
jmp 0x140040d2c
lea r9, [rsp + 0x60]
mov dword [rsp + 0x60], ecx
mov r8d, 4
mov dword [rsp + 0x20], 4
lea rdx, str.EnableUsbDebug
call fcn.14002fda0
mov ebx, dword [0x1401e87c0]
mov ecx, 0xcc6
jmp 0x140040d2c
cmp rcx, 0xbc
jne 0x1400400c3
xor edi, edi
mov ecx, 0xcd2
cmp dword [0x140196df8], edi
mov ebx, edi
sete bl
mov dword [0x140196df8], ebx
call fcn.140021050
xor ebx, r13d
lea r9d, [rbx + 0xcb2]
jmp 0x14004109b
cmp rcx, 0x41
jne 0x14004016c
xor edi, edi
cmp dword [0x140196f40], edi
mov eax, edi
sete al
mov dword [0x140196f40], eax
xor eax, r13d
cmp qword [0x14019f580], rdi
je 0x140040139
lea r9, [0x14015e738]
mov dword [rsp + 0x20], eax
mov edx, 0xc
lea rcx, [rbp + 0x170]
mov r8, 0xffffffffffffffff
call fcn.140004fd0
lea rdx, [rbp + 0x170]
mov byte [rbp + 0x17b], dil
lea rcx, str.DisableRufusMBR
call fcn.140026fa0
mov ebx, dword [0x140196f40]
mov ecx, 0xd15
jmp 0x14004108a
lea r9, [rsp + 0x60]
mov dword [rsp + 0x60], eax
mov r8d, 4
mov dword [rsp + 0x20], 4
lea rdx, str.DisableRufusMBR
call fcn.14002fda0
mov ebx, dword [0x140196f40]
mov ecx, 0xd15
jmp 0x14004108a
cmp rcx, 0x42
jne 0x140040215
xor edi, edi
cmp dword [0x1401e89f0], edi
mov eax, edi
sete al
mov dword [0x1401e89f0], eax
xor eax, r13d
cmp qword [0x14019f580], rdi
je 0x1400401e2
lea r9, [0x14015e738]
mov dword [rsp + 0x20], eax
mov edx, 0xc
lea rcx, [rbp + 0x220]
mov r8, 0xffffffffffffffff
call fcn.140004fd0
lea rdx, [rbp + 0x220]
mov byte [rbp + 0x22b], dil
lea rcx, str.DisableFakeDrivesCheck
call fcn.140026fa0
mov ebx, dword [0x1401e89f0]
mov ecx, 0xcb8
jmp 0x14004108a
lea r9, [rsp + 0x60]
mov dword [rsp + 0x60], eax
mov r8d, 4
mov dword [rsp + 0x20], 4
lea rdx, str.DisableFakeDrivesCheck
call fcn.14002fda0
mov ebx, dword [0x1401e89f0]
mov ecx, 0xcb8
jmp 0x14004108a
cmp rcx, 0x43
jne 0x140040333
mov rcx, qword [0x1401e8690]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x147
call qword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
js 0x140040242
mov ecx, eax
call fcn.14005bce0
xor edi, edi
xor r9d, r9d
lea rcx, [rbp - 0x38]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x14003fc61
mov r13, qword [rbp + 8]
mov ebx, 1
mov dword [rbp - 0x6c], r14d
mov r14d, dword [rsp + 0x7c]
mov rcx, qword [0x1401d05a8]
test rcx, rcx
je 0x14004028d
xor r9d, r9d
xor r8d, r8d
mov edx, 0x10
call qword [sym.imp.USER32.dll_SendMessageW]
cmp dword [0x1401e29d0], 0
je 0x14003ee39
mov ecx, ebx
mov dword [0x1401e29d0], edi
call fcn.140020950
mov ecx, ebx
call fcn.140020790
mov rax, qword [0x14019f5d8]
lea rbx, [0x1401e6720]
add rbx, qword [0x1401d05a0]
lea r9, str.Localization_set_to__s
mov edi, 0xffc
mov r8, 0xffffffffffffffff
sub rdi, qword [0x1401d05a0]
mov rcx, qword [rax + 0x18]
mov rdx, rdi
mov qword [rsp + 0x20], rcx
mov rcx, rbx
call fcn.140004fd0
mov rax, 0xffffffffffffffff
mov byte [rbx + rdi - 1], 0
lea rcx, [0x1401e6720]
inc rax
cmp byte [rcx + rax], 0
jne 0x140040304
mov word [rax + rcx], 0xa0d
add rax, 2
mov qword [0x1401d05a0], rax
cmp rax, 0x1000
jae 0x140041364
mov byte [rax + rcx], 0
jmp 0x14003f98a
cmp rcx, 0x44
jne 0x14004043c
lea rax, [0x140156a6c]
mov edx, 0x104
mov qword [rsp + 0x28], rax
lea r9, [0x14015be8c]
lea rax, [0x1401e86a0]
mov r8, 0xffffffffffffffff
lea rcx, [rbp + 0x370]
mov qword [rsp + 0x20], rax
call fcn.140004fd0
lea rax, [rbp + 0x370]
mov byte [rbp + 0x473], 0
mov r9d, 0xcc0
mov qword [rsp + 0x20], rax
mov r8d, 0xdac
mov edx, r13d
xor ecx, ecx
call fcn.140021510
lea rax, [rbp + 0x370]
mov rbx, 0xffffffffffffffff
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400403b0
add rbx, 2
mov edx, 2
mov rcx, rbx
call fcn.1400c4f6c
mov rdi, rax
mov dword [rsp + 0x28], ebx
xor eax, eax
mov dword [rbp + 0x28], 3
mov ecx, 0x614
mov qword [rbp + 0x20], rax
mov word [rbp + 0x40], cx
lea r8, [rbp + 0x370]
xorps xmm0, xmm0
mov qword [rbp + 0x30], rdi
mov ecx, 0xfde9
mov qword [rbp + 0x38], rax
mov r9d, 0xffffffff
mov dword [rbp + 0x44], eax
xor edx, edx
mov qword [rsp + 0x20], rdi
movdqu xmmword [rbp + 0x48], xmm0
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rcx, [rbp + 0x20]
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
test rdi, rdi
je 0x140040430
mov rcx, rdi
call fcn.1400e8c70
mov dword [0x1401e2794], r13d
jmp 0x140040242
cmp rcx, 0x45
jne 0x140040500
xor edi, edi
cmp dword [0x1401e8678], edi
mov eax, edi
sete al
cmp qword [0x14019f580], rdi
mov dword [0x1401e8678], eax
je 0x1400404a1
lea r9, [0x14015e738]
mov dword [rsp + 0x20], eax
mov edx, 0xc
lea rcx, [rbp + 0x240]
mov r8, 0xffffffffffffffff
call fcn.140004fd0
lea rdx, [rbp + 0x240]
mov byte [rbp + 0x24b], dil
lea rcx, str.EnableWindowsDualUefiBiosMode
call fcn.140026fa0
jmp 0x1400404c4
lea r9, [rsp + 0x60]
mov dword [rsp + 0x60], eax
mov r8d, 4
mov dword [rsp + 0x20], 4
lea rdx, str.EnableWindowsDualUefiBiosMode
call fcn.14002fda0
mov ebx, dword [0x1401e8678]
mov ecx, 0xcc2
call fcn.140021050
neg ebx
mov qword [rsp + 0x20], rax
mov r8d, 0xdac
sbb r9d, r9d
xor edx, edx
add r9d, 0xcb3
xor ecx, ecx
call fcn.140021510
xor ecx, ecx
call fcn.1400311c0
jmp 0x140040244
cmp rcx, 0x46
jne 0x14004056c
xor edi, edi
mov ecx, 0xcb5
cmp dword [0x14019f644], edi
mov ebx, edi
sete bl
mov dword [0x14019f644], ebx
call fcn.140021050
xor ebx, r13d
mov qword [rsp + 0x20], rax
xor edx, edx
xor ecx, ecx
mov r8d, 0xdac
lea r9d, [rbx + 0xcb2]
call fcn.140021510
xor ecx, ecx
call fcn.14005c990
cmp dword [0x14019f644], edi
mov r8d, edi
mov rcx, qword [0x1401e89e8]
mov edx, 0x3fe
setne r8b
call qword [sym.imp.USER32.dll_CheckDlgButton]
jmp 0x140040244
cmp rcx, 0x47
jne 0x140040615
xor edi, edi
cmp dword [0x140196f74], edi
mov eax, edi
sete al
mov dword [0x140196f74], eax
xor eax, r13d
cmp qword [0x14019f580], rdi
je 0x1400405e2
lea r9, [0x14015e738]
mov dword [rsp + 0x20], eax
mov edx, 0xc
lea rcx, [rbp + 0x250]
mov r8, 0xffffffffffffffff
call fcn.140004fd0
lea rdx, [rbp + 0x250]
mov byte [rbp + 0x25b], dil
lea rcx, str.DisableVHDs
call fcn.140026fa0
mov ebx, dword [0x140196f74]
mov ecx, 0xcec
jmp 0x140040d2c
lea r9, [rsp + 0x60]
mov dword [rsp + 0x60], eax
mov r8d, 4
mov dword [rsp + 0x20], 4
lea rdx, str.DisableVHDs
call fcn.14002fda0
mov ebx, dword [0x140196f74]
mov ecx, 0xcec
jmp 0x140040d2c
cmp rcx, 0x48
jne 0x1400406bb
xor edi, edi
cmp dword [0x1401a0480], edi
mov eax, edi
sete al
cmp qword [0x14019f580], rdi
mov dword [0x1401a0480], eax
je 0x140040688
lea r9, [0x14015e738]
mov dword [rsp + 0x20], eax
mov edx, 0xc
lea rcx, [rbp + 0x1b0]
mov r8, 0xffffffffffffffff
call fcn.140004fd0
lea rdx, [rbp + 0x1b0]
mov byte [rbp + 0x1bb], dil
lea rcx, str.EnableExtraHashes
call fcn.140026fa0
mov ebx, dword [0x1401a0480]
mov ecx, 0xcf0
jmp 0x14004108a
lea r9, [rsp + 0x60]
mov dword [rsp + 0x60], eax
mov r8d, 4
mov dword [rsp + 0x20], 4
lea rdx, str.EnableExtraHashes
call fcn.14002fda0
mov ebx, dword [0x1401a0480]
mov ecx, 0xcf0
jmp 0x14004108a
cmp rcx, 0x49
jne 0x140040733
xor edi, edi
mov ecx, 0xcbe
cmp dword [0x140194558], edi
mov ebx, edi
sete bl
mov dword [0x140194558], ebx
call fcn.140021050
xor ebx, r13d
mov qword [rsp + 0x20], rax
xor edx, edx
xor ecx, ecx
mov r8d, 0xdac
lea r9d, [rbx + 0xcb2]
call fcn.140021510
cmp qword [0x14019f588], rdi
je 0x140040244
xor r9d, r9d
mov dword [0x1401e29d4], r13d
mov edx, 0x111
mov dword [0x1401e24ac], r13d
mov r8d, 0x3f6
mov rcx, rsi
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x140040244
cmp rcx, 0x4a
jne 0x140040765
xor edi, edi
mov ecx, 0xcb9
cmp dword [0x140194318], edi
mov ebx, edi
sete bl
mov dword [0x140194318], ebx
call fcn.140021050
xor ebx, r13d
lea r9d, [rbx + 0xcb2]
jmp 0x14004109b
cmp rcx, 0x4b
jne 0x140040797
xor edi, edi
mov ecx, 0xcba
cmp dword [0x1401944a8], edi
mov ebx, edi
sete bl
mov dword [0x1401944a8], ebx
call fcn.140021050
xor ebx, r13d
lea r9d, [rbx + 0xcb2]
jmp 0x14004109b
cmp rcx, 0x4c
jne 0x14004083d
xor edi, edi
cmp dword [0x1401e87a4], edi
mov eax, edi
sete al
cmp qword [0x14019f580], rdi
mov dword [0x1401e87a4], eax
je 0x14004080a
lea r9, [0x14015e738]
mov dword [rsp + 0x20], eax
mov edx, 0xc
lea rcx, [rbp + 0x1c0]
mov r8, 0xffffffffffffffff
call fcn.140004fd0
lea rdx, [rbp + 0x1c0]
mov byte [rbp + 0x1cb], dil
lea rcx, str.ForceLargeFat32Formatting
call fcn.140026fa0
mov ebx, dword [0x1401e87a4]
mov ecx, 0xcb6
jmp 0x140040d2c
lea r9, [rsp + 0x60]
mov dword [rsp + 0x60], eax
mov r8d, 4
mov dword [rsp + 0x20], 4
lea rdx, str.ForceLargeFat32Formatting
call fcn.14002fda0
mov ebx, dword [0x1401e87a4]
mov ecx, 0xcb6
jmp 0x140040d2c
cmp rcx, 0x4d
jne 0x1400408e3
xor edi, edi
cmp dword [0x14019f630], edi
mov eax, edi
sete al
cmp qword [0x14019f580], rdi
mov dword [0x14019f630], eax
je 0x1400408b0
lea r9, [0x14015e738]
mov dword [rsp + 0x20], eax
mov edx, 0xc
lea rcx, [rbp + 0x1d0]
mov r8, 0xffffffffffffffff
call fcn.140004fd0
lea rdx, [rbp + 0x1d0]
mov byte [rbp + 0x1db], dil
lea rcx, str.IgnoreBootMarker
call fcn.140026fa0
mov ebx, dword [0x14019f630]
mov ecx, 0xcf7
jmp 0x14004108a
lea r9, [rsp + 0x60]
mov dword [rsp + 0x60], eax
mov r8d, 4
mov dword [rsp + 0x20], 4
lea rdx, str.IgnoreBootMarker
call fcn.14002fda0
mov ebx, dword [0x14019f630]
mov ecx, 0xcf7
jmp 0x14004108a
cmp rcx, 0x4e
jne 0x140040915
xor edi, edi
mov ecx, 0xcbc
cmp dword [0x14019f5b0], edi
mov ebx, edi
sete bl
mov dword [0x14019f5b0], ebx
call fcn.140021050
xor ebx, r13d
lea r9d, [rbx + 0xcb2]
jmp 0x14004109b
cmp rcx, 0x4f
jne 0x140040925
call fcn.14001f8f0
jmp 0x140040242
cmp rcx, 0x50
jne 0x140040974
call fcn.140021050
neg ebx
sbb r9d, r9d
add r9d, 0xcb3
xor edx, edx
mov qword [rsp + 0x20], rax
xor ecx, ecx
mov r8d, 0xdac
call fcn.140021510
xor ecx, ecx
call fcn.14005c990
jmp 0x140040244
cmp dword [rbp - 0x30], 0x100
jne 0x1400410b4
cmp rcx, 0x5a
jne 0x140040e58
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x140040e47
mov ecx, r15d
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x140040e47
xor r9d, r9d
mov dword [0x14019f5a4], r13d
mov edx, 0x111
mov dword [0x14019f598], r13d
mov r8d, 0x3eb
mov rcx, rsi
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x140040242
cmp dword [rbp - 0x30], 0x100
jne 0x1400410b4
mov rcx, qword [rbp - 0x28]
cmp rcx, 0x45
jne 0x140040f35
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x140040f24
mov ecx, r15d
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x140040f24
xor edi, edi
cmp dword [0x14019f628], edi
mov eax, edi
sete al
cmp qword [0x14019f580], rdi
mov dword [0x14019f628], eax
je 0x140040ef1
lea r9, [0x14015e738]
mov dword [rsp + 0x20], eax
mov edx, 0xc
lea rcx, [rbp + 0x160]
mov r8, 0xffffffffffffffff
call fcn.140004fd0
lea rdx, [rbp + 0x160]
mov byte [rbp + 0x16b], dil
lea rcx, str.ExpertMode
call fcn.140026fa0
mov ebx, dword [0x14019f628]
mov ecx, 0xd13
jmp 0x14004108a
lea r9, [rsp + 0x60]
mov dword [rsp + 0x60], eax
mov r8d, 4
mov dword [rsp + 0x20], 4
lea rdx, str.ExpertMode
call fcn.14002fda0
mov ebx, dword [0x14019f628]
mov ecx, 0xd13
jmp 0x14004108a
cmp dword [rbp - 0x30], 0x100
jne 0x1400410b4
mov rcx, qword [rbp - 0x28]
cmp rcx, 0x46
jne 0x140041047
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x14004103a
mov ecx, r15d
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x14004103a
xor edi, edi
cmp dword [0x1401a045c], edi
mov eax, edi
sete al
mov dword [0x1401a045c], eax
test eax, eax
je 0x140040f8e
mov eax, dword [0x14019f644]
mov dword [rbp - 0x70], eax
mov eax, r13d
mov r12d, dword [rbp - 0x70]
jmp 0x140040f91
mov eax, r12d
mov rcx, qword [0x1401e89e8]
test eax, eax
mov r8d, edi
mov dword [0x14019f644], eax
setne r8b
mov edx, 0x3fe
call qword [sym.imp.USER32.dll_CheckDlgButton]
mov ebx, dword [0x1401a045c]
mov ecx, 0xcd7
call fcn.140021050
neg ebx
mov qword [rsp + 0x20], rax
mov r8d, 0xdac
sbb r9d, r9d
xor edx, edx
add r9d, 0xcb3
xor ecx, ecx
call fcn.140021510
mov eax, dword [0x1401a045c]
lea rcx, str.enabled
test eax, eax
lea r8, str.disabled
lea rax, str.CAUTION:
cmovne r8, rcx
lea rdx, [0x1401564ce]
lea rcx, str._sListing_of_non_USB_removable_drives__s
cmovne rdx, rax
call fcn.14004f2f0
cmp dword [0x1401a045c], edi
je 0x14004102e
lea rcx, str.By_using_this_unofficial_cheat_mode_you_forfeit_ANY_RIGHT_to_complain_if_you_lose_valuable_data_
call fcn.14004f2f0
xor ecx, ecx
call fcn.14005c990
jmp 0x140040244
cmp dword [rbp - 0x30], 0x100
jne 0x1400410b4
mov rcx, qword [rbp - 0x28]
cmp rcx, 0x59
jne 0x1400410b4
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1400410b4
mov ecx, r15d
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1400410b4
cmp dword [0x14019f5bc], 0
mov ebx, 2
mov edi, 0
mov ecx, 0xcbb
cmovg ebx, edi
mov dword [0x14019f5bc], ebx
call fcn.140021050
neg ebx
sbb r9d, r9d
add r9d, 0xcb3
xor edx, edx
mov qword [rsp + 0x20], rax
xor ecx, ecx
mov r8d, 0xdac
call fcn.140021510
jmp 0x140040244
test edi, edi
je 0x1400410f7
mov ecx, r15d
call qword [sym.imp.USER32.dll_GetKeyState]
xor edi, edi
test ax, ax
js 0x1400410f9
mov dword [rsp + 0x78], edi
test r14d, r14d
jne 0x1400410f2
mov ecx, dword [0x1401a0484]
mov eax, 0x55555556
inc ecx
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
sub ecx, eax
mov dword [0x1401a0484], ecx
mov r14d, edi
jmp 0x1400410f9
xor edi, edi
lea rdx, [rbp - 0x38]
mov rcx, rsi
call qword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
jne 0x140040244
mov rcx, qword [0x14019f620]
lea rdx, [rbp - 0x38]
call qword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
jne 0x140040244
lea rcx, [rbp - 0x38]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp - 0x38]
call qword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x140040244
cmp dword [0x14019f590], 0
lea r8, str.Could_not_create_Window
movzx r15d, word [0x1401941e8]
mov ecx, 0x181010
mov ebx, 0x1010
mov r9d, 0xffffffff
cmovne ebx, ecx
xor r12d, r12d
mov dword [rsp + 0x28], r12d
xor edx, edx
mov ecx, 0xfde9
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rdi, eax
cmp edi, 1
jle 0x1400411cf
mov rcx, rdi
mov edx, 2
call fcn.1400c4f6c
mov rsi, rax
test rax, rax
je 0x1400411cf
mov dword [rsp + 0x28], edi
lea r8, str.Could_not_create_Window
mov r9d, 0xffffffff
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, edi
je 0x1400411d2
mov rcx, rsi
call fcn.1400e8c70
mov rsi, r12
mov dword [rsp + 0x28], r12d
lea r8, str.DialogBox_failure
mov r9d, 0xffffffff
mov qword [rsp + 0x20], r12
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd r14, eax
cmp r14d, 1
jle 0x140041245
mov rcx, r14
mov edx, 2
call fcn.1400c4f6c
mov rdi, rax
test rax, rax
je 0x140041245
mov dword [rsp + 0x28], r14d
lea r8, str.DialogBox_failure
mov r9d, 0xffffffff
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, r14d
je 0x140041248
mov rcx, rdi
call fcn.1400e8c70
mov rdi, r12
mov r9d, ebx
mov word [rsp + 0x20], r15w
mov r8, rdi
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxExW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test rsi, rsi
je 0x140041274
mov rcx, rsi
call fcn.1400e8c70
test rdi, rdi
je 0x140041281
mov rcx, rdi
call fcn.1400e8c70
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14003ee3c
mov rdx, qword [0x14019f5d8]
lea rcx, [rbp + 0x260]
call fcn.140026780
mov rax, qword [0x14019f5d8]
mov ecx, 0xbb9
movzx edi, word [0x1401941e8]
mov esi, dword [rax + 4]
and esi, 1
mov dword [0x14019f590], esi
call fcn.140021050
mov ecx, 0xbba
jmp 0x14003f530
mov rdx, qword [0x14019f5d8]
lea rcx, [rbp + 0x260]
call fcn.140026780
mov rax, qword [0x14019f5d8]
mov ecx, 0xcdd
movzx edi, word [0x1401941e8]
mov esi, dword [rax + 4]
and esi, 1
mov dword [0x14019f590], esi
call fcn.140021050
cmp dword [0x1401d0500], 0x61
mov edx, r12d
mov rbx, rax
mov r8d, 0x12
mov eax, 0x16
sete dl
cmove r8d, eax
mov ecx, 0xcde
add edx, 2
call fcn.140021050
jmp 0x14003f538
lea rcx, str.FATAL:_Could_not_access_locale_
call fcn.14004f2f0
mov r9d, 0x1010
lea r8, str.Fatal_error
lea rdx, str.The_locale_data_is_missing_or_invalid._This_application_will_now_exit.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x14003ee3c
call fcn.1400b2b58
int3