Function at 0x4512ec
Capabilities:
Check if file exists
Copy file
Create directory
Move file
Set registry value

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
xor ebx, ebx
push ecx
sub esp, 0x1f8
mov eax, dword [ecx]
movups xmm1, xmmword [0x4b3fb0]
mov dword [ebp - 0x198], 0x6d6977
movups xmm0, xmmword [str._:_sources_boot._:_sources_apprappraiserres.dll]
movups xmm2, xmmword [0x4b3fc0]
mov dword [ebp - 0x1b8], ebx
mov dword [ebp - 0x1c4], eax
movups xmm4, xmmword [str.ppraiserres.bak]
mov eax, dword [ecx + 4]
cmp dword [0x528580], 0
movups xmmword [ebp - 0x194], xmm1
movups xmmword [ebp - 0x178], xmm1
mov dword [ebp - 0x1c8], eax
mov dword [ebp - 0x1b4], ebx
mov dword [ebp - 0x1ac], 1
movups xmmword [ebp - 0x1a8], xmm0
movups xmmword [ebp - 0x188], xmm2
movups xmmword [ebp - 0x16c], xmm4
jne 0x45139a
mov dword [esp + 8], 0x30b
mov dword [esp + 4], str.wue.c
mov dword [esp], str.unattend_xml_path___NULL
jmp 0x451781
mov dword [esp], str.Applying_Windows_customization:
call fcn.0043d9e0
xor ecx, ecx
mov dword [esp + 0xc], 0xcfe
mov dword [esp + 8], ecx
mov dword [esp + 4], ecx
mov dword [esp], ecx
call fcn.00422f82
mov eax, dword [ebp - 0x1c8]
and eax, 0x10000
mov dword [ebp - 0x1c0], eax
je 0x4514d4
movsx edi, byte [ebp - 0x1c4]
lea ebx, [ebp - 0x11c]
mov dword [esp + 0xc], str._c:WindowsPanther
mov dword [esp + 8], 0xffffffff
mov esi, dword [sym.imp.msvcrt.dll__snprintf_s]
mov dword [esp + 0x10], edi
mov dword [esp + 4], 0x104
mov dword [esp], ebx
call esi
xor eax, eax
mov byte [ebp - 0x19], 0
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
push edx
push edx
mov dword [ebp - 0x1c0], eax
test eax, eax
jne 0x451437
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xb7
jne 0x451483
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], str._c:WindowsPantherunattend.xml
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], 0x104
mov dword [esp], ebx
call esi
mov byte [ebp - 0x19], 0
mov dword [esp + 8], 1
mov dword [esp + 4], ebx
mov eax, dword [0x528580]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_CopyFileA]
mov dword [ebp - 0x1c0], eax
sub esp, 0xc
test eax, eax
jne 0x4514b0
call fcn.0043df77
mov dword [esp + 4], ebx
mov esi, 2
xor ebx, ebx
mov dword [esp + 8], eax
mov dword [esp], str.Could_not_create__s_:__s
call fcn.0043d9e0
xor eax, eax
mov dword [ebp - 0x1bc], eax
jmp 0x451924
mov dword [esp + 4], ebx
mov esi, 2
xor ebx, ebx
mov dword [esp], str.Added__s
call fcn.0043d9e0
xor eax, eax
mov dword [ebp - 0x1bc], eax
jmp 0x45191a
mov al, byte [ebp - 0x1c4]
mov byte [ebp - 0x1a8], al
mov eax, dword [ebp - 0x1c8]
and eax, 1
mov dword [ebp - 0x1bc], eax
je 0x45166d
mov al, byte [ebp - 0x1c4]
lea esi, [ebp - 0x194]
mov byte [ebp - 0x194], al
mov byte [ebp - 0x178], al
mov eax, esi
call fcn.0044f175
mov ebx, eax
lea eax, [ebp - 0x178]
call fcn.0044f175
mov dword [esp + 8], 1
mov dword [esp + 4], eax
mov dword [ebp - 0x1cc], eax
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.DLL_MoveFileExW]
mov edx, dword [ebp - 0x1cc]
sub esp, 0xc
mov edi, eax
test edx, edx
je 0x451553
mov dword [esp], edx
call sub.msvcrt.dll_free
test ebx, ebx
je 0x45155f
mov dword [esp], ebx
call sub.msvcrt.dll_free
test edi, edi
jne 0x45158c
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 2
je 0x45158c
call fcn.0043df77
mov dword [esp + 4], esi
mov dword [esp + 8], eax
mov dword [esp], str.Could_not_rename__s:__s
call fcn.0043d9e0
jmp 0x45166d
call dword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
jne 0x4515b0
lea eax, [ebp - 0x178]
mov dword [esp + 4], esi
mov dword [esp + 8], eax
mov dword [esp], str.Renamed__s___s
call fcn.0043d9e0
lea eax, [ebp - 0x194]
call fcn.0044f175
mov dword [esp + 0x14], pe_nt_image_headers32
mov esi, eax
xor eax, eax
mov dword [esp + 0x10], 2
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], 1
mov dword [esp + 4], 0xc0000000
mov dword [esp], esi
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
sub esp, 0x1c
mov ebx, eax
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edi, eax
test esi, esi
je 0x45160b
mov dword [esp], esi
call sub.msvcrt.dll_free
mov dword [esp], edi
call dword [sym.imp.KERNEL32.DLL_SetLastError]
push esi
mov dword [esp], ebx
lea ebx, [ebp - 0x194]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push edi
mov dword [esp + 4], ebx
mov dword [esp], str.Created__s_placeholder
call fcn.0043d9e0
cmp dword [0x50ff40], 0
je 0x45166d
lea eax, [ebp - 0x178]
call fcn.0044f276
sub dword [0x4dff10], eax
sbb dword [0x4dff14], edx
mov dword [esp + 8], 1
mov dword [esp + 4], ebx
mov dword [esp], 0x4dff00
call fcn.0043c061
xor ebx, ebx
mov dword [esp + 0x18], 1
mov dword [esp + 0x10], 0xcf
mov dword [esp + 0x14], ebx
mov dword [esp + 8], ebx
mov dword [esp + 0xc], ebx
mov dword [esp + 4], 0xcfd
mov dword [esp], 8
call fcn.0044a2e0
cmp dword [ebp - 0x1bc], 0
je 0x451752
cmp dword [0x50ff40], 0
lea ebx, [ebp - 0x1a8]
je 0x4516ce
mov eax, ebx
call fcn.0044f276
sub dword [0x4dff10], eax
sbb dword [0x4dff14], edx
mov dword [esp + 8], 2
mov esi, 2
mov dword [esp + 4], ebx
mov dword [esp], str.Mounting__s__d_...
call fcn.0043d9e0
mov dword [esp + 4], 2
mov dword [esp], ebx
call fcn.0044dc4b
test eax, eax
jne 0x451729
mov dword [esp], str.WARNING:_This_image_appears_to_be_an_UNOFFICIAL_Windows_ISO_
call fcn.0043d9e0
mov dword [esp], str.Rufus_recommends_that_you_only_use_OFFICIAL_retail_Microsoft_Windows_images__such_as
call fcn.0043d9e0
mov dword [esp], str.the_ones_that_can_be_downloaded_through_the_download_facility_of_this_application.
call fcn.0043d9e0
mov esi, dword [ebp - 0x1bc]
lea eax, [ebp - 0x1a8]
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.0044d1d0
mov ebx, eax
test eax, eax
jne 0x451a46
xor eax, eax
mov dword [ebp - 0x1bc], eax
jmp 0x451924
xor ebx, ebx
mov esi, 2
test byte [ebp - 0x1c8], 1
je 0x4517f6
test ebx, ebx
jne 0x451787
mov dword [esp + 8], 0x37f
mov dword [esp + 4], str.wue.c
mov dword [esp], str.mount_path___NULL
call dword [0x491228]
lea edi, [ebp - 0x11c]
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str._sAutounattend.xml
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], 0x104
mov dword [esp], edi
call dword [sym.imp.msvcrt.dll__snprintf_s]
mov eax, dword [0x528580]
mov edx, edi
mov byte [ebp - 0x19], 0
call fcn.0044f397
test eax, eax
jne 0x4517e0
call fcn.0043df77
mov dword [esp], str.Could_not_create_boot.wim_Autounattend.xml:__s
mov dword [esp + 4], eax
call fcn.0043d9e0
jmp 0x451924
lea eax, [ebp - 0x1a8]
mov dword [esp], str.Added_Autounattend.xml_to__s
mov dword [esp + 4], eax
jmp 0x4518dd
movsx ecx, byte [ebp - 0x1c4]
mov edx, dword [sym.imp.msvcrt.dll__snprintf_s]
lea edi, [ebp - 0x11c]
mov dword [esp + 0x10], ecx
mov dword [ebp - 0x1c8], ecx
mov dword [esp + 0xc], str._c:_sources_OEM___Panther
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], 0x104
mov dword [esp], edi
mov dword [ebp - 0x1c4], edx
call edx
xor eax, eax
mov byte [ebp - 0x19], 0
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExA]
mov edx, dword [ebp - 0x1c4]
mov ecx, dword [ebp - 0x1c8]
sub esp, 0xc
test eax, eax
je 0x451882
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_SetLastError]
push ecx
call fcn.0043df77
mov dword [esp + 4], edi
mov dword [esp + 8], eax
mov dword [esp], str.Error:_Could_not_create_directory__s:__s
jmp 0x4518cb
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], str._c:_sources_OEM___Pantherunattend.xml
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], 0x104
mov dword [esp], edi
call edx
mov eax, dword [0x528580]
mov edx, edi
mov byte [ebp - 0x19], 0
call fcn.0044f397
test eax, eax
jne 0x4518d2
call fcn.0043df77
mov dword [esp + 4], edi
mov dword [esp + 8], eax
mov dword [esp], str.Could_not_create__s:__s
call fcn.0043d9e0
jmp 0x451924
mov dword [esp + 4], edi
mov dword [esp], str.Created__s
call fcn.0043d9e0
xor eax, eax
xor edx, edx
mov dword [esp], 8
mov dword [esp + 0x18], 1
mov dword [esp + 0x10], 0xcf
mov dword [esp + 0x14], eax
mov dword [esp + 8], 0x67
mov dword [esp + 0xc], edx
mov dword [esp + 4], 0xcfd
call fcn.0044a2e0
mov dword [ebp - 0x1c0], 1
mov eax, dword [ebp - 0x1b4]
test eax, eax
je 0x451938
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
mov eax, dword [ebp - 0x1b8]
test eax, eax
je 0x45194c
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
cmp dword [ebp - 0x1bc], 0
je 0x4519a1
mov dword [esp + 4], str.RUFUS_OFFLINE_HIVE
xor edi, edi
mov dword [esp], 0x80000002
call fcn.0043d6da
xor eax, eax
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], 1
mov dword [esp + 0x10], 0xcf
mov dword [esp + 8], 0x68
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0xcfd
mov dword [esp], 8
call fcn.0044a2e0
test ebx, ebx
je 0x451cee
lea edi, [ebp - 0x1a8]
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp], str.Unmounting__s__d_...
call fcn.0043d9e0
mov dword [esp + 8], 1
mov dword [esp + 4], esi
mov dword [esp], edi
call fcn.0044ce58
cmp dword [0x50ff40], 0
je 0x451a0b
mov eax, edi
call fcn.0044f276
add dword [0x4dff10], eax
adc dword [0x4dff14], edx
mov dword [esp + 8], 1
mov dword [esp + 4], edi
mov dword [esp], 0x4dff00
call fcn.0043c061
xor eax, eax
xor edx, edx
xor ecx, ecx
mov dword [esp + 0x10], 0xcf
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], edx
mov dword [esp + 8], 0xcf
mov dword [esp + 0xc], ecx
mov dword [esp + 4], 0xcfd
mov dword [esp], 8
call fcn.0044a2e0
jmp 0x451cee
lea edx, [ebp - 0x11c]
mov dword [esp + 0x10], eax
mov edi, dword [sym.imp.msvcrt.dll__snprintf_s]
mov dword [esp], edx
mov dword [esp + 0xc], str._sWindowsSystem32configSYSTEM
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], 0x104
call edi
lea edx, [ebp - 0x11c]
mov byte [ebp - 0x19], 0
mov dword [esp + 8], edx
mov dword [esp + 4], str.RUFUS_OFFLINE_HIVE
mov dword [esp], 0x80000002
call fcn.0043d58e
test eax, eax
jne 0x451ab2
mov dword [esp], str.Falling_back_to_creating_the_registry_keys_through_unattend.xml
call fcn.0043d9e0
xor ecx, ecx
mov dword [ebp - 0x1bc], ecx
jmp 0x451759
xor eax, eax
mov dword [esp + 0x18], 1
mov dword [esp + 0x14], eax
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0xcf
mov dword [esp + 8], 0x65
mov dword [esp + 4], 0xcfd
mov dword [esp], 8
call fcn.0044a2e0
lea edx, [ebp - 0x15c]
mov dword [esp + 0x10], str.RUFUS_OFFLINE_HIVE
mov dword [esp], edx
mov dword [esp + 0xc], str._sSetup
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], 0x40
call edi
xor edx, edx
mov byte [ebp - 0x11d], 0
lea eax, [ebp - 0x1b8]
mov dword [esp + 8], edx
lea edx, [ebp - 0x15c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x2001d
mov dword [esp + 4], edx
mov dword [esp], 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
sub esp, 0x14
test eax, eax
je 0x451b6e
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_SetLastError]
push eax
call fcn.0043df77
mov dword [esp], str.Could_not_open_HKLMSYSTEMSetup_registry_key:__s
mov dword [esp + 4], eax
jmp 0x451bd8
lea eax, [ebp - 0x1b0]
mov dword [esp + 0x14], 7
mov dword [esp + 0x20], eax
lea eax, [ebp - 0x1b4]
mov dword [esp + 0x1c], eax
xor eax, eax
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov dword [esp + 4], str.LabConfig
mov eax, dword [ebp - 0x1b8]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
sub esp, 0x24
mov edi, eax
test eax, eax
je 0x451bff
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_SetLastError]
push edi
call fcn.0043df77
mov dword [esp], str.Could_not_create_HKLMSYSTEMSetupLabConfig_registry_key:__s
mov dword [esp + 4], eax
call fcn.0043d9e0
jmp 0x451759
mov eax, dword [edi*4 + 0x48fcc8]
mov dword [esp], str.Created_HKLMSYSTEMSetupLabConfig_s_registry_key
inc edi
mov dword [esp + 4], eax
call fcn.0043d9e0
cmp edi, 3
je 0x451c6f
lea eax, [ebp - 0x1ac]
xor ecx, ecx
mov dword [esp + 0x14], 4
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 4
mov dword [esp + 8], ecx
mov eax, dword [edi*4 + 0x48fcc8]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x1b4]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
sub esp, 0x18
test eax, eax
je 0x451be2
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_SetLastError]
push edx
call fcn.0043df77
mov dword [esp + 8], eax
mov eax, dword [edi*4 + 0x48fcc8]
mov dword [esp], str.Could_not_set_HKLMSYSTEMSetupLabConfig_s_registry_key:__s
mov dword [esp + 4], eax
call fcn.0043d9e0
jmp 0x451759
xor eax, eax
mov dword [esp + 0xc], str.disabled
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.windowsPE
mov dword [esp + 4], str._settings
mov eax, dword [0x528580]
mov dword [esp], eax
call fcn.00427d50
test eax, eax
jne 0x451caa
mov dword [esp], str.Warning:_Could_not_disable_windowsPE_pass_from_unattend.xml
call fcn.0043d9e0
xor eax, eax
and dword [ebp - 0x1c8], 0xfffffffe
mov dword [esp + 0x14], eax
xor eax, eax
mov dword [esp + 0x18], 1
mov dword [esp + 0x10], 0xcf
mov dword [esp + 8], 0x66
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0xcfd
mov dword [esp], 8
call fcn.0044a2e0
jmp 0x451759
mov dword [esp], ebx
call sub.msvcrt.dll_free
mov eax, dword [ebp - 0x1c0]
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret