You'll never get a list of the files it either removes or changes....that's proprietary information.
If you're saying that Rufus tries to hide how it configures the media, in order to apply the customisation options selected by the user, you couldn't be more wrong. Rufus is 100% Open Source, so we are very explicit and open about what we are doing so anybody who wishes to can find exactly what operations Rufus performs for
any stage of its operations.
Especially, in this case, Rufus (mostly) uses the
official method of customising Windows installation media, which Microsoft bakes into the Windows installation process (so that corporate people can tune Windows to their wishes) through the creation of an
answer file, also commonly referred to as
unattend.xml.
In this specific case, the way Rufus creates its unattend.xml is all very openly documented
here or, if you don't want to read code, you can usually find the answer file in
\sources\$OEM$\$$\Panther\.
Note that I said "mostly" above because for the TPM/Secure Boot/etc bypasses, we try to avoid using an answer file on account that it produces an unsightly command prompt window to briefly appear during the installation, so, instead, we insert the well known bypass registry keys (again, these are settings that Microsoft themselves baked into the Windows installer process and that don't require altering any binaries) into the registry hive contained in the
boot.wim pre-installation environment (and you can also find out how we do so by reading our very public code).