Function at 0x1400075f4
Capabilities:
Check if file exists
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
xor r14d, r14d
mov edi, ecx
mov ebx, r14d
mov dword [rbp + 0x38], ebx
mov rax, qword gs:[0x30]
mov rdx, qword [rax + 0x60]
movzx r8d, word [rdx + 0x118]
movzx eax, word [rdx + 0x11c]
shl r8d, 0x10
or r8d, eax
cmp r8d, 0x60001
jb 0x140007aa6
cmp r8d, 0x60002
je 0x140007aa6
call fcn.140006434
mov rsi, rax
test rax, rax
jne 0x14000766b
call fcn.14001b570
mov edi, eax
jmp 0x140007a8a
test edi, edi
jne 0x1400076a5
lea r8, str.WinRE_Request_Restart
lea rdx, [0x140071ca0]
lea rcx, [rbp - 0x38]
call fcn.140010bd8
mov rcx, qword [0x14006f5e0]
lea ebx, [rdi + 1]
mov r8d, 0x200
mov rdx, qword [rax]
call fcn.14001cd24
mov dil, bl
test eax, eax
jne 0x1400076a8
mov dil, r14b
or r15, 0xffffffffffffffff
test bl, 1
je 0x1400076d1
mov rdx, qword [rbp - 0x38]
mov eax, r15d
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x1400076d1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
test dil, dil
je 0x1400076e0
mov edi, 0x80070bc3
jmp 0x140007a8a
call fcn.140001b5c
test rax, rax
je 0x140007ac2
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
lea rdx, [rbp - 0x50]
lea rcx, str._SystemDrive_360SysRt_
mov qword [rbp - 0x50], rax
call fcn.14001bdc4
test eax, eax
je 0x140007726
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
jmp 0x140007a6a
lea r8, str.360ldMount
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x48]
call fcn.140010bd8
mov rbx, qword [rbp - 0x48]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1400077a1
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryEmptyW]
test eax, eax
jne 0x1400077a1
lea rcx, str.wimgapi.dll
call fcn.14001b83c
mov rdi, rax
test rax, rax
je 0x1400077a1
lea rdx, str.WIMUnmountImage
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000778e
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test eax, eax
jne 0x1400077a1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rbp - 0x50]
call fcn.14001d8e4
lea rcx, [rbp - 0x18]
call fcn.1400047d0
mov edi, eax
test eax, eax
jne 0x140007a4e
lea rdx, [rbp - 0x18]
mov qword [rbp + 0x38], r14
lea rcx, [rbp - 0x20]
call fcn.14001d65c
mov r8, rax
lea rdx, str.BCD00000000Objects_
lea rcx, [rbp - 0x28]
call fcn.140010b24
mov rdx, rax
lea r8, str.Elements14000008
lea rcx, [rbp - 0x30]
call fcn.140010bd8
lea rcx, [rbp + 0x38]
mov r9d, 0x2001f
mov qword [rsp + 0x20], rcx
lea r8d, [rdi + 4]
mov rcx, 0xffffffff80000002
mov rdx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rdx, qword [rbp - 0x30]
mov ecx, r15d
add rdx, 0xffffffffffffffe8
mov ebx, eax
lock xadd dword [rdx + 0x10], ecx
add ecx, r15d
test ecx, ecx
jg 0x14000783a
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
mov rdx, qword [rbp - 0x28]
mov eax, r15d
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x14000785a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdx, qword [rbp - 0x20]
mov eax, r15d
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x14000787a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
test ebx, ebx
je 0x140007891
movzx edi, bx
or edi, 0x80070000
test ebx, ebx
cmovle edi, ebx
jmp 0x140007a32
call fcn.140001b5c
test rax, rax
je 0x140007ac2
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
mov rcx, qword [rbp + 0x38]
lea r8, [rbp + 0x48]
add rax, 0x18
lea rdx, str.Element
mov qword [rbp + 0x48], rax
call fcn.14001c3c0
test eax, eax
je 0x1400078db
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
jmp 0x140007a12
xor edx, edx
lea rcx, [rbp + 0x48]
call fcn.14001a668
lea rdx, [0x140063618]
lea rcx, [rbp - 0x40]
call fcn.14001d65c
call fcn.140001b5c
test rax, rax
je 0x140007ac2
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
mov rbx, qword [rbp + 0x48]
mov edi, r14d
add rax, 0x18
mov qword [rbp + 0x40], rax
jmp 0x140007974
mov rcx, qword [rbp - 0x40]
mov rdx, rbx
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
je 0x140007958
mov rax, r15
inc rax
cmp word [rbx + rax*2], r14w
jne 0x140007932
mov r8d, eax
lea rcx, [rbp + 0x40]
mov rdx, rbx
call fcn.140019f84
xor edx, edx
lea rcx, [rbp + 0x40]
call fcn.14001a668
jmp 0x14000795d
mov edi, 1
mov rax, r15
inc rax
cmp word [rbx + rax*2], r14w
jne 0x140007960
cdqe
lea rbx, [rbx + rax*2]
add rbx, 2
cmp word [rbx], r14w
jne 0x14000791e
xor edx, edx
lea rcx, [rbp + 0x40]
call fcn.14001a668
mov rbx, qword [rbp + 0x40]
test edi, edi
je 0x1400079d3
mov eax, dword [rbx - 0x10]
lea rdx, str.Element
mov rcx, qword [rbp + 0x38]
add eax, eax
mov dword [rsp + 0x28], eax
mov r9d, 7
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1400079c9
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
jmp 0x1400079d6
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov edi, r14d
lea rdx, [rbx - 0x18]
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x1400079f2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdx, qword [rbp - 0x40]
mov eax, r15d
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x140007a12
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdx, qword [rbp + 0x48]
mov eax, r15d
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x140007a32
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rcx, qword [rbp + 0x38]
test rcx, rcx
je 0x140007a4a
call qword [0x140057c38]
neg eax
sbb rcx, rcx
and qword [rbp + 0x38], rcx
mov rbx, qword [rbp - 0x48]
lea rdx, [rbx - 0x18]
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x140007a6a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdx, qword [rbp - 0x50]
mov eax, r15d
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x140007a8a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
test rsi, rsi
je 0x140007aa2
mov rcx, rsi
call qword [fcn.140037368]
test eax, eax
jne 0x140007aa2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, edi
jmp 0x140007aab
mov eax, 0x80004001
mov rbx, qword [rsp + 0xb0]
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80004005
call fcn.140002198
int3