Function at 0x140048e67
Capabilities:
Check if file exists
Copy file
Create directory
Move file
Set registry value

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x218
xor r10d, r10d
cmp qword [0x140112ee0], 0
mov r8d, 0x2e6
movabs rax, 0x6372756f735c3a3f
movabs rsi, 0x7265736961727070
movabs rdi, 0x6c6c642e736572
mov ebp, edx
mov ebx, ecx
movabs rdx, 0x2e746f6f625c7365
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], rdx
lea rcx, str.unattend_xml_path___NULL
movabs rax, 0x6372756f735c3a3f
movabs rdx, 0x61727070615c7365
mov qword [rsp + 0x9c], rdx
mov qword [rsp + 0xb8], rdx
movabs rdx, 0x6b61622e736572
mov qword [rsp + 0x94], rax
mov qword [rsp + 0xb0], rax
movabs rax, 0x7265736961727070
mov qword [rsp + 0xc4], rdx
lea rdx, str.wue.c
mov dword [rsp + 0x90], 0x6d6977
mov qword [rsp + 0xa0], rsi
mov qword [rsp + 0xa8], rdi
mov qword [rsp + 0xbc], rax
mov qword [rsp + 0x70], r10
mov qword [rsp + 0x78], r10
mov dword [rsp + 0x6c], 1
je 0x140049268
lea rcx, str.Applying_Windows_customization:
mov edi, ebp
call fcn.140036717
mov r9d, 0xcfe
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.14001d77b
and edi, 0x10000
je 0x140049056
lea rsi, [rsp + 0x10c]
movsx ebx, bl
lea r8, str._c:WindowsPanther
mov edx, 0x104
mov r9d, ebx
mov rcx, rsi
mov rbp, qword [sym.imp.msvcrt.dll__snprintf]
call rbp
mov byte [rsp + 0x20f], 0
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
mov edi, eax
test eax, eax
jne 0x140048fd8
call qword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xb7
jne 0x140049010
mov r9d, ebx
lea r8, str._c:WindowsPantherunattend.xml
mov edx, 0x104
mov rcx, rsi
call rbp
mov byte [rsp + 0x20f], 0
mov rcx, qword [0x140112ee0]
mov rdx, rsi
mov r8d, 1
call qword [sym.imp.KERNEL32.DLL_CopyFileA]
mov edi, eax
test eax, eax
jne 0x140049037
call fcn.140036bd7
mov rdx, rsi
xor r13d, r13d
xor esi, esi
mov r8, rax
lea rcx, str.Could_not_create__s_:__s
mov r12d, 2
call fcn.140036717
jmp 0x14004939d
mov rdx, rsi
lea rcx, str.Added__s
xor esi, esi
xor r13d, r13d
call fcn.140036717
mov r12d, 2
jmp 0x140049398
mov r13d, ebp
mov byte [rsp + 0x80], bl
and r13d, 1
je 0x140049194
lea rax, [rsp + 0x94]
lea r15, [rsp + 0xb0]
mov byte [rsp + 0x94], bl
mov rcx, rax
mov byte [rsp + 0xb0], bl
mov qword [rsp + 0x58], rax
call fcn.14004718b
mov rcx, r15
mov r12, rax
call fcn.14004718b
mov r8d, 1
mov rcx, r12
mov rsi, rax
mov rdx, rax
call qword [sym.imp.KERNEL32.DLL_MoveFileExW]
mov r14d, eax
test rsi, rsi
je 0x1400490c5
mov rcx, rsi
call sub.msvcrt.dll_free
test r12, r12
je 0x1400490d2
mov rcx, r12
call sub.msvcrt.dll_free
test r14d, r14d
mov r14, qword [sym.imp.KERNEL32.DLL_GetLastError]
jne 0x140049104
call r14
cmp eax, 2
je 0x140049104
call fcn.140036bd7
mov rdx, qword [rsp + 0x58]
lea rcx, str.Could_not_rename__s:__s
mov r8, rax
call fcn.140036717
jmp 0x140049194
call r14
test eax, eax
jne 0x14004911f
mov rdx, qword [rsp + 0x58]
mov r8, r15
lea rcx, str.Renamed__s___s
call fcn.140036717
mov rcx, qword [rsp + 0x58]
call fcn.14004718b
xor r9d, r9d
mov r8d, 1
mov edx, 0xc0000000
mov qword [rsp + 0x30], r9
mov rcx, rax
xor r9d, r9d
mov r12, rax
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.DLL_CreateFileW]
mov r15, rax
call r14
mov r14d, eax
test r12, r12
je 0x140049171
mov rcx, r12
call sub.msvcrt.dll_free
mov ecx, r14d
call qword [sym.imp.KERNEL32.DLL_SetLastError]
mov rcx, r15
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov rdx, qword [rsp + 0x58]
lea rcx, str.Created__s_placeholder
call fcn.140036717
mov dword [rsp + 0x20], 1
xor r8d, r8d
mov r9d, 0xcf
mov edx, 0xcfd
mov ecx, 8
call fcn.140043acc
test r13d, r13d
je 0x140049233
lea rsi, [rsp + 0x80]
mov r8d, 2
lea rcx, str.Mounting__s__d_...
mov r12d, 2
mov rdx, rsi
call fcn.140036717
mov edx, 2
mov rcx, rsi
call fcn.140046bd4
test eax, eax
jne 0x140049214
lea rcx, str.WARNING:_This_image_appears_to_be_an_UNOFFICIAL_Windows_ISO_
mov r12d, r13d
call fcn.140036717
lea rcx, str.Rufus_recommends_that_you_only_use_OFFICIAL_retail_Microsoft_Windows_images__such_as
call fcn.140036717
lea rcx, str.the_ones_that_can_be_downloaded_through_the_download_facility_of_this_application.
call fcn.140036717
mov rcx, rsi
mov edx, r12d
call fcn.140046253
mov rsi, rax
test rax, rax
jne 0x140049452
xor r13d, r13d
jmp 0x14004939d
xor esi, esi
mov r12d, 2
and ebp, 1
mov r14, qword [sym.imp.msvcrt.dll__snprintf]
lea rbp, [rsp + 0x10c]
je 0x1400492ca
test rsi, rsi
jne 0x14004926e
mov r8d, 0x354
lea rdx, str.wue.c
lea rcx, str.mount_path___NULL
call qword [sym.imp.msvcrt.dll__wassert]
mov r9, rsi
lea r8, str._sAutounattend.xml
mov edx, 0x104
mov rcx, rbp
call r14
mov rcx, qword [0x140112ee0]
mov rdx, rbp
mov byte [rsp + 0x20f], 0
call fcn.140047315
lea rdx, [rsp + 0x80]
lea rcx, str.Added_Autounattend.xml_to__s
test eax, eax
jne 0x140049370
call fcn.140036bd7
lea rcx, str.Could_not_create_boot.wim_Autounattend.xml:__s
mov rdx, rax
call fcn.140036717
jmp 0x14004939d
movsx r9d, bl
lea r8, str._c:_sources_OEM___Panther
mov edx, 0x104
mov rcx, rbp
mov dword [rsp + 0x58], r9d
call r14
xor ecx, ecx
xor r8d, r8d
mov byte [rsp + 0x20f], 0
mov rdx, rbp
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExA]
mov r9d, dword [rsp + 0x58]
test eax, eax
mov ecx, eax
je 0x140049320
call qword [sym.imp.KERNEL32.DLL_SetLastError]
call fcn.140036bd7
mov rdx, rbp
lea rcx, str.Error:_Could_not_create_directory__s:__s
mov r8, rax
jmp 0x140049369
lea r8, str._c:_sources_OEM___Pantherunattend.xml
mov edx, 0x104
mov rcx, rbp
call r14
mov rcx, qword [0x140112ee0]
mov rdx, rbp
mov byte [rsp + 0x20f], 0
call fcn.140047315
mov rdx, rbp
lea rcx, str.Created__s
test eax, eax
jne 0x140049370
call fcn.140036bd7
mov rdx, rbp
lea rcx, str.Could_not_create__s:__s
mov r8, rax
call fcn.140036717
jmp 0x14004939d
call fcn.140036717
mov r9d, 0xcf
mov r8d, 0x67
mov dword [rsp + 0x20], 1
mov edx, 0xcfd
mov ecx, 8
call fcn.140043acc
mov edi, 1
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x1400493ad
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1400493bd
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r13d, r13d
je 0x1400493f8
lea rdx, str.RUFUS_OFFLINE_HIVE
mov rcx, 0xffffffff80000002
call fcn.14003651f
mov r9d, 0xcf
mov r8d, 0x68
mov dword [rsp + 0x20], 1
mov edx, 0xcfd
mov ecx, 8
call fcn.140043acc
test rsi, rsi
je 0x140049682
lea rbx, [rsp + 0x80]
mov r8d, r12d
lea rcx, str.Unmounting__s__d_...
mov rdx, rbx
call fcn.140036717
mov edx, r12d
mov rcx, rbx
mov r8d, 1
call fcn.140045f0f
xor eax, eax
mov r9d, 0xcf
mov r8d, 0xcf
mov dword [rsp + 0x20], eax
mov edx, 0xcfd
mov ecx, 8
call fcn.140043acc
jmp 0x140049682
lea r14, [rsp + 0x10c]
mov edx, 0x104
mov r9, rax
mov r15, qword [sym.imp.msvcrt.dll__snprintf]
mov rcx, r14
lea r8, str._sWindowsSystem32configSYSTEM
call r15
mov r8, r14
lea r14, str.RUFUS_OFFLINE_HIVE
mov rcx, 0xffffffff80000002
mov rdx, r14
mov byte [rsp + 0x20f], 0
call fcn.1400363ef
test eax, eax
jne 0x1400494af
lea rcx, str.Falling_back_to_creating_the_registry_keys_through_unattend.xml
xor r13d, r13d
call fcn.140036717
jmp 0x14004923b
mov r9d, 0xcf
mov r8d, 0x65
mov edx, 0xcfd
mov dword [rsp + 0x20], 1
mov ecx, 8
call fcn.140043acc
lea rax, [rsp + 0xcc]
mov r9, r14
lea r8, str._sSetup
mov edx, 0x40
mov rcx, rax
mov qword [rsp + 0x58], rax
call r15
lea rax, [rsp + 0x70]
mov rdx, qword [rsp + 0x58]
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov byte [rsp + 0x10b], 0
mov r9d, 0x2001d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ecx, eax
test eax, eax
je 0x14004953e
call qword [sym.imp.KERNEL32.DLL_SetLastError]
call fcn.140036bd7
lea rcx, str.Could_not_open_HKLMSYSTEMSetup_registry_key:__s
mov rdx, rax
jmp 0x1400495a6
lea rax, [rsp + 0x68]
xor ecx, ecx
xor r8d, r8d
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x78]
lea rdx, str.LabConfig
xor r15d, r15d
mov qword [rsp + 0x30], rcx
mov rcx, qword [rsp + 0x70]
lea r14, str.BypassTPMCheck
mov dword [rsp + 0x20], r8d
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x28], 7
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov ecx, eax
test eax, eax
je 0x1400495c9
call qword [sym.imp.KERNEL32.DLL_SetLastError]
call fcn.140036bd7
lea rcx, str.Could_not_create_HKLMSYSTEMSetupLabConfig_registry_key:__s
mov rdx, rax
call fcn.140036717
jmp 0x14004923b
mov rdx, qword [r14 + r15*8]
lea rcx, str.Created_HKLMSYSTEMSetupLabConfig_s_registry_key
inc r15
call fcn.140036717
cmp r15, 3
je 0x14004961f
lea rax, [rsp + 0x6c]
mov rdx, qword [r14 + r15*8]
mov rcx, qword [rsp + 0x78]
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, eax
test eax, eax
je 0x1400495b0
call qword [sym.imp.KERNEL32.DLL_SetLastError]
call fcn.140036bd7
movsxd r10, r15d
lea rcx, str.Could_not_set_HKLMSYSTEMSetupLabConfig_s_registry_key:__s
mov rdx, qword [r14 + r10*8]
mov r8, rax
call fcn.140036717
jmp 0x14004923b
xor edx, edx
mov rcx, qword [0x140112ee0]
lea r9, str.disabled
lea r8, str.windowsPE
mov dword [rsp + 0x20], edx
lea rdx, str._settings
call fcn.14002350c
test rax, rax
jne 0x140049657
lea rcx, str.Warning:_Could_not_disable_windowsPE_pass_from_unattend.xml
call fcn.140036717
mov dword [rsp + 0x20], 1
mov r9d, 0xcf
mov r8d, 0x66
and ebp, 0xfffffffe
mov edx, 0xcfd
mov ecx, 8
call fcn.140043acc
jmp 0x14004923b
mov rcx, rsi
call sub.msvcrt.dll_free
mov eax, edi
add rsp, 0x218
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret