Function at 0x466310
Capabilities:
Check if file exists
Copy file
Create directory
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c4
mov eax, dword [0x5512ec]
xor eax, ebp
mov dword [ebp - 4], eax
movups xmm0, xmmword [str._:_sources_boot.wim]
mov eax, dword [0x547278]
push ebx
movups xmmword [ebp - 0x18], xmm0
push esi
movups xmm0, xmmword [str._:_sources_appraiserres.dll]
mov dword [ebp - 8], eax
mov esi, 2
mov eax, dword [0x547294]
mov ebx, edx
movups xmmword [ebp - 0x34], xmm0
push edi
movq xmm0, qword [0x54728c]
xor edi, edi
movq qword [ebp - 0x24], xmm0
movups xmm0, xmmword [str._:_sources_appraiserres.bak]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x5472b0]
movups xmmword [ebp - 0x50], xmm0
mov byte [ebp - 0x199], cl
movq xmm0, qword [0x5472a8]
mov dword [ebp - 0x1bc], 0
mov dword [ebp - 0x1b4], 0
mov dword [ebp - 0x1b8], esi
movq qword [ebp - 0x40], xmm0
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x1a8], edi
mov dword [ebp - 0x1a4], edi
mov dword [ebp - 0x1c0], 1
cmp dword [0x55b22c], edi
jne 0x4663d7
push 0x30b
push str.D:_a_rufus_rufus_srcwue.c
push str.unattend_xml_path___NULL
call fcn.004dfbbc
add esp, 0xc
push str.Applying_Windows_customization:
call fcn.0044b0b0
add esp, 4
push 0xcfe
push 0
push 0
push 0
call fcn.0041ed70
add esp, 0x10
test ebx, 0x10000
je 0x4664b0
movsx esi, byte [ebp - 0x199]
lea eax, [ebp - 0x158]
push esi
push str._c:WindowsPanther
push 0x104
push eax
call fcn.004050d0
add esp, 0x10
mov byte [ebp - 0x55], 0
lea eax, [ebp - 0x158]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x46644c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x466a8b
push esi
push str._c:WindowsPantherunattend.xml
lea eax, [ebp - 0x158]
push 0x104
push eax
call fcn.004050d0
add esp, 0x10
mov byte [ebp - 0x55], 0
lea eax, [ebp - 0x158]
push 1
push eax
push dword [0x55b22c]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x466a8b
lea eax, [ebp - 0x158]
push eax
push str.Added__s
call fcn.0044b0b0
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
add esp, 8
mov dword [ebp - 0x1bc], 1
jmp 0x466aab
mov al, byte [ebp - 0x199]
mov byte [ebp - 0x18], al
test bl, 1
je 0x46697d
push ecx
lea edx, [ebp - 0x50]
mov byte [ebp - 0x34], al
lea ecx, [ebp - 0x34]
mov byte [ebp - 0x50], al
call fcn.00463fe0
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 4
test eax, eax
jne 0x46650a
call ebx
cmp eax, 2
je 0x46650a
call fcn.0044b6b0
push eax
lea eax, [ebp - 0x34]
push eax
push str.Could_not_rename__s:__s
call fcn.0044b0b0
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
add esp, 0xc
jmp 0x4665e0
call ebx
test eax, eax
jne 0x466525
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x34]
push eax
push str.Renamed__s___s
call fcn.0044b0b0
add esp, 0xc
cmp byte [ebp - 0x34], 0
jne 0x46653b
push 2
push 1
call fcn.004b6706
add esp, 8
mov esi, eax
jmp 0x46658e
push 0
push 0
push 0xffffffffffffffff
lea eax, [ebp - 0x34]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, eax
cmp edi, 1
jle 0x46658c
push 2
push edi
call fcn.004b6706
mov esi, eax
add esp, 8
test esi, esi
je 0x46658c
push edi
push esi
push 0xffffffffffffffff
lea eax, [ebp - 0x34]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, edi
je 0x46658e
push esi
call fcn.004d1211
add esp, 4
xor esi, esi
push 0
push 0x80
push 2
push 0
push 1
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
call ebx
mov ebx, eax
test esi, esi
je 0x4665ba
push esi
call fcn.004d1211
add esp, 4
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
call ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x34]
push eax
push str.Created__s_placeholder
call fcn.0044b0b0
add esp, 8
mov esi, 2
push 1
push 0
xorps xmm0, xmm0
mov edx, 0xcfd
movlpd qword [ebp - 0x1b0], xmm0
mov ecx, 8
push 0xcf
push dword [ebp - 0x1ac]
push dword [ebp - 0x1b0]
call fcn.0045e120
add esp, 0x14
lea eax, [ebp - 0x18]
push 2
push eax
push str.Mounting__s__d_...
call fcn.0044b0b0
add esp, 0xc
lea ecx, [ebp - 0x18]
call fcn.00461e20
test eax, eax
jne 0x466663
push str.WARNING:_This_image_appears_to_be_an_UNOFFICIAL_Windows_ISO_
call fcn.0044b0b0
add esp, 4
push str.Rufus_recommends_that_you_only_use_OFFICIAL_retail_Microsoft_Windows_images__such_as
call fcn.0044b0b0
add esp, 4
push str.the_ones_that_can_be_downloaded_through_the_download_facility_of_this_application.
call fcn.0044b0b0
mov esi, 1
add esp, 4
mov dword [ebp - 0x1b8], esi
mov edx, esi
lea ecx, [ebp - 0x18]
call fcn.00460cf0
mov edi, eax
mov dword [ebp - 0x1ac], edi
test edi, edi
je 0x466aa5
push edi
push str._sWindowsSystem32configSYSTEM
lea eax, [ebp - 0x158]
push 0x104
push eax
call fcn.004050d0
add esp, 0x10
mov byte [ebp - 0x55], 0
lea eax, [ebp - 0x1a0]
mov dword [ebp - 0x1a0], 0xffffffff
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x4666d7
call fcn.0044b6b0
push eax
push str.Could_not_get_current_process_token:__s
call fcn.0044b0b0
add esp, 8
jmp 0x46676f
push ecx
mov ecx, dword [ebp - 0x1a0]
mov edx, str.SeRestorePrivilege
call fcn.0044aa10
mov ecx, dword [ebp - 0x1a0]
mov edx, str.SeBackupPrivilege
call fcn.0044aa10
add esp, 4
lea eax, [ebp - 0x158]
push eax
push str.RUFUS_OFFLINE_HIVE
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyA]
mov esi, eax
test esi, esi
je 0x466737
push esi
call ebx
call fcn.0044b6b0
push eax
lea eax, [ebp - 0x158]
push eax
push str.Could_not_mount_offline_registry_hive__s:__s
call fcn.0044b0b0
add esp, 0xc
jmp 0x466755
push str.RUFUS_OFFLINE_HIVE
push str.HKLM
lea eax, [ebp - 0x158]
push eax
push str.Mounted_offline_registry_hive__s_to__s_s
call fcn.0044b0b0
add esp, 0x10
mov eax, dword [ebp - 0x1a0]
cmp eax, 0xffffffff
je 0x46676b
test eax, eax
je 0x46676b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x466787
push str.Falling_back_to_creating_the_registry_keys_through_unattend.xml
call fcn.0044b0b0
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
add esp, 4
jmp 0x466922
push 1
push 0
push 0xcf
push 0
push 0x65
mov edx, 0xcfd
mov ecx, 8
call fcn.0045e120
add esp, 0x14
mov dword [ebp - 0x1b4], 1
lea eax, [ebp - 0x198]
push str.RUFUS_OFFLINE_HIVE
push str._sSetup
push 0x40
push eax
call fcn.004050d0
add esp, 0x10
mov byte [ebp - 0x159], 0
lea eax, [ebp - 0x1a8]
push eax
push 0x2001d
push 0
lea eax, [ebp - 0x198]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x466817
push eax
call ebx
call fcn.0044b6b0
push eax
push str.Could_not_open_HKLMSYSTEMSetup_registry_key:__s
call fcn.0044b0b0
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
add esp, 8
jmp 0x466922
lea eax, [ebp - 0x1c4]
push eax
lea eax, [ebp - 0x1a4]
push eax
push 0
push 7
push 0
push 0
push 0
push str.LabConfig
push dword [ebp - 0x1a8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x466865
push eax
call ebx
call fcn.0044b6b0
push eax
push str.Could_not_create_HKLMSYSTEMSetupLabConfig_registry_key:__s
call fcn.0044b0b0
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
add esp, 8
jmp 0x466922
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, 0x528118
xor edi, edi
push 4
lea eax, [ebp - 0x1c0]
push eax
push 4
push 0
push dword [esi]
push dword [ebp - 0x1a4]
call ebx
test eax, eax
jne 0x4668fe
push dword [esi]
push str.Created_HKLMSYSTEMSetupLabConfig_s_registry_key
call fcn.0044b0b0
add edi, 4
add esp, 8
add esi, 4
cmp edi, 0xc
jb 0x466872
mov ecx, dword [0x55b22c]
mov edx, str._settings
push 0
push str.disabled
push str.windowsPE
call fcn.00426240
add esp, 0xc
test eax, eax
jne 0x4668d7
push str.Warning:_Could_not_disable_windowsPE_pass_from_unattend.xml
call fcn.0044b0b0
add esp, 4
push 1
push 0
push 0xcf
push 0
push 0x66
mov edx, 0xcfd
mov ecx, 8
call fcn.0045e120
mov edi, dword [ebp - 0x1ac]
jmp 0x466999
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
push eax
call ebx
call fcn.0044b6b0
push eax
push dword [esi]
push str.Could_not_set_HKLMSYSTEMSetupLabConfig_s_registry_key:__s
call fcn.0044b0b0
mov edi, dword [ebp - 0x1ac]
add esp, 0xc
push edi
push str._sAutounattend.xml
lea eax, [ebp - 0x158]
push 0x104
push eax
call fcn.004050d0
mov ecx, dword [0x55b22c]
lea edx, [ebp - 0x158]
add esp, 0xc
mov byte [ebp - 0x55], 0
call fcn.00463b60
add esp, 4
test eax, eax
jne 0x466970
call fcn.0044b6b0
push eax
push str.Could_not_create_boot.wim_Autounattend.xml:__s
call fcn.0044b0b0
add esp, 8
jmp 0x466aab
mov eax, str.Added_Autounattend.xml_to__s
lea ecx, [ebp - 0x18]
jmp 0x466a59
push 1
push 0
push 0xcf
push 0
push 0
mov edx, 0xcfd
mov ecx, 8
call fcn.0045e120
movsx esi, byte [ebp - 0x199]
lea eax, [ebp - 0x158]
add esp, 0x14
push esi
push str._c:_sources_OEM___Panther
push 0x104
push eax
call fcn.004050d0
add esp, 0x10
mov byte [ebp - 0x55], 0
lea eax, [ebp - 0x158]
push 0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExA]
test eax, eax
je 0x4669fe
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
push eax
call ebx
call fcn.0044b6b0
push eax
lea eax, [ebp - 0x158]
push eax
push str.Error:_Could_not_create_directory__s:__s
call fcn.0044b0b0
add esp, 0xc
jmp 0x466aab
push esi
push str._c:_sources_OEM___Pantherunattend.xml
lea eax, [ebp - 0x158]
push 0x104
push eax
call fcn.004050d0
mov ecx, dword [0x55b22c]
lea edx, [ebp - 0x158]
add esp, 0xc
mov byte [ebp - 0x55], 0
call fcn.00463b60
add esp, 4
test eax, eax
jne 0x466a48
call fcn.0044b6b0
push eax
lea eax, [ebp - 0x158]
push eax
push str.Could_not_create__s:__s
jmp 0x466a9d
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [ebp - 0x158]
mov eax, str.Created__s
push ecx
push eax
call fcn.0044b0b0
push 1
push 0
push 0xcf
push 0
push 0x67
mov edx, 0xcfd
mov ecx, 8
call fcn.0045e120
add esp, 0x1c
mov dword [ebp - 0x1bc], 1
jmp 0x466aab
call fcn.0044b6b0
push eax
lea eax, [ebp - 0x158]
push eax
push str.Could_not_create__s_:__s
call fcn.0044b0b0
add esp, 0xc
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0x1a4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x466abe
push eax
call esi
mov eax, dword [ebp - 0x1a8]
test eax, eax
je 0x466acb
push eax
call esi
cmp dword [ebp - 0x1b4], 0
je 0x466b36
push str.RUFUS_OFFLINE_HIVE
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyA]
test eax, eax
je 0x466b00
push eax
call ebx
call fcn.0044b6b0
push eax
push str.Could_not_unmount_offline_registry_hive:__s
call fcn.0044b0b0
add esp, 8
jmp 0x466b17
push str.RUFUS_OFFLINE_HIVE
push str.HKLM
push str.Unmounted_offline_registry_hive__s_s
call fcn.0044b0b0
add esp, 0xc
push 1
push 0
push 0xcf
push 0
push 0x68
mov edx, 0xcfd
mov ecx, 8
call fcn.0045e120
add esp, 0x14
test edi, edi
je 0x466b83
mov esi, dword [ebp - 0x1b8]
lea eax, [ebp - 0x18]
push esi
push eax
push str.Unmounting__s__d_...
call fcn.0044b0b0
add esp, 0xc
lea ecx, [ebp - 0x18]
mov edx, esi
push 1
call fcn.00461130
add esp, 4
mov edx, 0xcfd
mov ecx, 8
push 0
push 0
push 0xcf
push 0
push 0xcf
call fcn.0045e120
add esp, 0x14
push edi
call fcn.004d1211
mov ecx, dword [ebp - 4]
add esp, 4
mov eax, dword [ebp - 0x1bc]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.004a8b60
mov esp, ebp
pop ebp
ret