Function at 0x403d60
Capabilities:
Check if file exists
Create directory
Create process on windows
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46385f
mov eax, dword fs:[0]
push eax
mov eax, 0x18e0
call fcn.00446a40
mov eax, dword [0x482308]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea ecx, [ebp - 0x14b0]
mov dword [ebp - 4], 0
call fcn.0041441e
lea ecx, [ebp - 0x121c]
mov byte [ebp - 4], 1
call fcn.0041441e
lea ecx, [ebp - 0x142c]
mov byte [ebp - 4], 2
call fcn.0041441e
lea ecx, [ebp - 0x17c8]
mov byte [ebp - 4], 3
call fcn.0041441e
lea ecx, [ebp - 0x13a8]
mov byte [ebp - 4], 4
call fcn.0041441e
lea ecx, [ebp - 0x1744]
mov byte [ebp - 4], 5
call fcn.0041441e
lea ecx, [ebp - 0x12a0]
mov byte [ebp - 4], 6
call fcn.0041441e
lea ecx, [ebp - 0x1324]
mov byte [ebp - 4], 7
call fcn.0041441e
lea ecx, [ebp - 0x16c0]
mov byte [ebp - 4], 8
call fcn.0041441e
lea ecx, [ebp - 0x163c]
mov byte [ebp - 4], 9
call fcn.0041441e
lea ecx, [ebp - 0x18d0]
mov byte [ebp - 4], 0xa
call fcn.0041441e
lea ecx, [ebp - 0x15b8]
mov byte [ebp - 4], 0xb
call fcn.0041441e
lea ecx, [ebp - 0x184c]
mov byte [ebp - 4], 0xc
call fcn.0041441e
push 0x104
lea eax, [ebp - 0x31c]
mov byte [ebp - 4], 0xd
push 0
push eax
call fcn.00447640
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x18d8]
add esp, 0xc
push eax
lea eax, [ebp - 0x18d4]
push eax
push esi
call fcn.00405a60
test eax, eax
jne 0x403e95
xor esi, esi
jmp 0x404453
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00447640
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0xffffffffffffffff
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x1198]
call fcn.004143fa
lea eax, [ebp - 0x1198]
mov byte [ebp - 4], 0xe
push eax
lea ecx, [ebp - 0x17c8]
call fcn.00414593
lea ecx, [ebp - 0x1198]
mov byte [ebp - 4], 0xd
call fcn.00414510
movzx esi, si
lea eax, [ebp - 0x14b0]
push esi
push str._c:windows_syswow64
push eax
call fcn.00414a20
push esi
lea eax, [ebp - 0x121c]
push str._c:windowspantherunattend.xml
push eax
call fcn.00414a20
push esi
lea eax, [ebp - 0x142c]
push str._c:windows_system32config_system
push eax
call fcn.00414a20
push esi
lea eax, [ebp - 0x15b8]
push str._c:Program_FilesSysCeo
push eax
call fcn.00414a20
push esi
lea eax, [ebp - 0x16c0]
push str._c:Program_FilesSysCeoDrvCeo
push eax
call fcn.00414a20
push esi
lea eax, [ebp - 0x163c]
push str._c:Program_FilesCeoMsxx
push eax
call fcn.00414a20
add esp, 0x48
lea eax, [ebp - 0x3a4]
mov ecx, edi
push 1
push str.reg.exe
push eax
call fcn.00405f00
push eax
lea ecx, [ebp - 0x13a8]
mov byte [ebp - 4], 0xf
call fcn.00414593
lea ecx, [ebp - 0x3a4]
mov byte [ebp - 4], 0xd
call fcn.00414510
push 1
push str.7z.exe
lea eax, [ebp - 0x3a4]
mov ecx, edi
push eax
call fcn.00405f00
push eax
lea ecx, [ebp - 0x1744]
mov byte [ebp - 4], 0x10
call fcn.00414593
lea ecx, [ebp - 0x3a4]
mov byte [ebp - 4], 0xd
call fcn.00414510
lea eax, [ebp - 0x1324]
push str.oobewindeploy.exe
push eax
call fcn.00414a20
add esp, 8
lea ecx, [ebp - 0x14b0]
call fcn.00411afa
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push eax
call edi
lea ecx, [ebp - 0x142c]
mov dword [ebp - 0x18d8], eax
call fcn.00411afa
push eax
lea ecx, [ebp - 0x13a8]
call fcn.00411afa
push eax
lea eax, [ebp - 0x12a0]
push str._s_load__HKEY_USERS_tmpLoadSYSTEM____s_
push eax
call fcn.00414a20
add esp, 0x10
lea ecx, [ebp - 0x12a0]
call fcn.00411afa
xor ecx, ecx
mov dword [ebp - 0x1158], 0x44
mov word [ebp - 0x1116], cx
xorps xmm0, xmm0
mov word [ebp - 0x1128], cx
lea ecx, [ebp - 0x18ec]
push ecx
lea ecx, [ebp - 0x1158]
movlpd qword [ebp - 0x1154], xmm0
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push eax
push 0
movups xmmword [ebp - 0x18ec], xmm0
mov dword [ebp - 0x112c], 1
movlpd qword [ebp - 0x114c], xmm0
movlpd qword [ebp - 0x1144], xmm0
movlpd qword [ebp - 0x113c], xmm0
movlpd qword [ebp - 0x1134], xmm0
movlpd qword [ebp - 0x1126], xmm0
movlpd qword [ebp - 0x111e], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x404108
push 0xffffffffffffffff
push dword [ebp - 0x18ec]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x18d4]
push eax
push dword [ebp - 0x18ec]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x18e8]
call esi
push dword [ebp - 0x18ec]
call esi
push 0xffffffffffffffff
push str.CmdLine
lea ecx, [ebp - 0x3a4]
call fcn.004143fa
push 0xffffffffffffffff
push str.tmpLoadSYSTEMSetup
lea ecx, [ebp - 0x1198]
mov byte [ebp - 4], 0x11
call fcn.004143fa
push 0x100
lea eax, [ebp - 0x110]
mov byte [ebp - 4], 0x13
push 0
push eax
call fcn.00447640
add esp, 0xc
mov dword [ebp - 0x18d4], 0x100
lea eax, [ebp - 0x18dc]
lea ecx, [ebp - 0x1198]
push eax
push 1
push 0
call fcn.00411afa
push eax
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4041e3
lea eax, [ebp - 0x18d4]
push eax
lea eax, [ebp - 0x110]
push eax
push 0
push 0
lea ecx, [ebp - 0x3a4]
call fcn.00411afa
push eax
push dword [ebp - 0x18dc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4041e3
push 0xffffffffffffffff
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x1534]
call fcn.004143fa
push eax
lea ecx, [ebp - 0x1324]
mov byte [ebp - 4], 0x14
call fcn.00414593
lea ecx, [ebp - 0x1534]
call fcn.00414510
push dword [ebp - 0x18dc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x1198]
call fcn.00414510
lea ecx, [ebp - 0x3a4]
mov byte [ebp - 4], 0xd
call fcn.00414510
push 0
push str.oobewindeploy.exe
lea ecx, [ebp - 0x1324]
call fcn.004148d9
test eax, eax
js 0x404365
lea ecx, [ebp - 0x121c]
call fcn.00411afa
push eax
call edi
test eax, eax
jne 0x404365
lea ecx, [ebp - 0x1198]
call fcn.0041441e
push 0x5c
lea ecx, [ebp - 0x121c]
mov byte [ebp - 4], 0x15
call fcn.00415042
push eax
lea eax, [ebp - 0x1534]
push eax
lea ecx, [ebp - 0x121c]
call fcn.00414caf
push eax
lea ecx, [ebp - 0x1198]
mov byte [ebp - 4], 0x16
call fcn.00414593
lea ecx, [ebp - 0x1534]
mov byte [ebp - 4], 0x15
call fcn.00414510
lea ecx, [ebp - 0x1198]
call fcn.00411afa
push eax
call edi
test eax, eax
jne 0x4042a0
push eax
lea ecx, [ebp - 0x1198]
call fcn.00411afa
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x200
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.00447640
lea ecx, [ebp - 0x31c]
add esp, 0xc
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4042c0
sub ecx, edx
je 0x4042e6
lea eax, [ebp - 0x31c]
push eax
lea eax, [ebp - 0x210]
push str._RunSynchronousCommand_wcm:action_add__________________________________Order_20__Order_________________________________Path__s__Path________________________________Description_InDeploy__Description_________________________________RunSynchronousCommand_
push eax
call fcn.00406ab0
add esp, 0xc
mov ecx, 0x37d
lea edi, [ebp - 0x1114]
mov esi, str.__xml_version_1.0__encoding_utf_8____________________________unattend_xmlns_urn:schemas_microsoft_com:unattend___________________________settings_pass_specialize____________________________component_name_Microsoft_Windows_Deployment__processorArchitecture__s__publicKeyToken_31bf3856ad364e35__language_neutral__versionScope_nonSxS__xmlns:wcm_http:__schemas.microsoft.com_WMIConfig_2002_State__xmlns:xsi_http:__www.w3.org_2001_XMLSchema_instance___n__________________________RunSynchronous___________________________RunSynchronousCommand_wcm:action_add___________________________Order_1__Order____________________________Path_cmd__c_net_user_Administrator__active:yes__Path__________________________Description_EnableAdmin__Description___________________________RunSynchronousCommand_________________________s_________________________RunSynchronousCommand_wcm:action_add___________________________Order_2__Order___________________________Path_cmd__c_net_user_Administrator_ploc__active:yes__Path__________________________Description_EnableAdmin_ploc__Description___________________________RunSynchronousCommand___________________________RunSynchronousCommand_wcm:action_add____________________________Order_3__Order___________________________Path_reg_add_HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem__v_ConsentPromptBehaviorAdmin__t_REG_DWORD__d_0__f__Path___________________________Description_UnConsentPromptBehaviorAdmin__Description_____________________________RunSynchronousCommand________________________________RunSynchronousCommand_wcm:action_add____________________________Order_4__Order_____________________________Path_reg_add_HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem__v_FilterAdministratorToken__t_REG_DWORD__d_0__f__Path____________________________Description_FilterAdministratorToken__Description_____________________________RunSynchronousCommand____________________________RunSynchronous___________________________________component________________________________________settings________________________________________settings_pass_oobeSystem___________________________component_name_Microsoft_Windows_Shell_Setup__processorArchitecture__s__publicKeyToken_31bf3856ad364e35__language_neutral__versionScope_nonSxS__xmlns:wcm_http:__schemas.microsoft.com_WMIConfig_2002_State__xmlns:xsi_http:__www.w3.org_2001_XMLSchema_instance____________________________OOBE___________________________HideEULAPage_true__HideEULAPage___________________________HideWirelessSetupInOOBE_true__HideWirelessSetupInOOBE__________________________NetworkLocation_Work__NetworkLocation___________________________ProtectYourPC_2__ProtectYourPC_____________________________SkipMachineOOBE_true__SkipMachineOOBE__________________________SkipUserOOBE_true__SkipUserOOBE______________________________OOBE_______________________________RegisteredOrganization_PRC__RegisteredOrganization____________________________RegisteredOwner_Windows_User__RegisteredOwner____________________________FirstLogonCommands____________________________SynchronousCommand_wcm:action_add_____________________________CommandLine__s__CommandLine__________________________Description_22__Description_______________________________Order_1__Order_______________________________RequiresUserInput_false__RequiresUserInput_____________________________SynchronousCommand_______________________________FirstLogonCommands_______________________________component________________________________________settings_________________________________________unattend_
rep movsd dword es:[edi], dword [esi]
push 0x47a2d0
lea ecx, [ebp - 0x121c]
movsb byte es:[edi], byte [esi]
call fcn.00411afa
push eax
call fcn.004544d1
mov esi, eax
add esp, 8
test esi, esi
je 0x404350
cmp dword [ebp - 0x18d8], 0
mov ecx, 0x47a2dc
push 0x479380
mov eax, str.amd64
cmove eax, ecx
lea ecx, [ebp - 0x210]
push eax
push ecx
push eax
lea eax, [ebp - 0x1114]
push eax
push esi
call fcn.00401240
push esi
call fcn.0044d882
add esp, 0x1c
lea ecx, [ebp - 0x1198]
mov byte [ebp - 4], 0xd
call fcn.00414510
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x13a8]
call fcn.00411afa
push eax
lea eax, [ebp - 0x12a0]
push str._s_unload__HKEY_USERS_tmpLoadSYSTEM_
push eax
call fcn.00414a20
add esp, 0xc
lea ecx, [ebp - 0x12a0]
call fcn.00411afa
xor ecx, ecx
mov dword [ebp - 0x1158], 0x44
mov word [ebp - 0x1116], cx
xorps xmm0, xmm0
mov word [ebp - 0x1128], cx
lea ecx, [ebp - 0x18ec]
push ecx
lea ecx, [ebp - 0x1158]
movlpd qword [ebp - 0x1154], xmm0
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push eax
push 0
movups xmmword [ebp - 0x18ec], xmm0
mov dword [ebp - 0x112c], 1
movlpd qword [ebp - 0x114c], xmm0
movlpd qword [ebp - 0x1144], xmm0
movlpd qword [ebp - 0x113c], xmm0
movlpd qword [ebp - 0x1134], xmm0
movlpd qword [ebp - 0x1126], xmm0
movlpd qword [ebp - 0x111e], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x40444e
push 0xffffffffffffffff
push dword [ebp - 0x18ec]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x18d8]
push eax
push dword [ebp - 0x18ec]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x18e8]
call esi
push dword [ebp - 0x18ec]
call esi
mov esi, 1
lea ecx, [ebp - 0x184c]
call fcn.00414510
lea ecx, [ebp - 0x15b8]
call fcn.00414510
lea ecx, [ebp - 0x18d0]
call fcn.00414510
lea ecx, [ebp - 0x163c]
call fcn.00414510
lea ecx, [ebp - 0x16c0]
call fcn.00414510
lea ecx, [ebp - 0x1324]
call fcn.00414510
lea ecx, [ebp - 0x12a0]
call fcn.00414510
lea ecx, [ebp - 0x1744]
call fcn.00414510
lea ecx, [ebp - 0x13a8]
call fcn.00414510
lea ecx, [ebp - 0x17c8]
call fcn.00414510
lea ecx, [ebp - 0x142c]
call fcn.00414510
lea ecx, [ebp - 0x121c]
call fcn.00414510
lea ecx, [ebp - 0x14b0]
call fcn.00414510
lea ecx, [ebp + 0xc]
call fcn.00414510
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00445e0f
mov esp, ebp
pop ebp
ret 0x88