Function at 0x14004aeed
Capabilities:
Check if file exists
Copy file
Create directory
Move file
Set registry value

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x218
xor r10d, r10d
cmp qword [0x140118280], 0
mov r8d, 0x30b
movabs rax, 0x6372756f735c3a3f
movabs rsi, 0x7265736961727070
movabs rdi, 0x6c6c642e736572
mov ebp, edx
mov ebx, ecx
movabs rdx, 0x2e746f6f625c7365
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], rdx
lea rcx, str.unattend_xml_path___NULL
movabs rax, 0x6372756f735c3a3f
movabs rdx, 0x61727070615c7365
mov qword [rsp + 0x9c], rdx
mov qword [rsp + 0xb8], rdx
movabs rdx, 0x6b61622e736572
mov qword [rsp + 0x94], rax
mov qword [rsp + 0xb0], rax
movabs rax, 0x7265736961727070
mov qword [rsp + 0xc4], rdx
lea rdx, str.wue.c
mov dword [rsp + 0x90], 0x6d6977
mov qword [rsp + 0xa0], rsi
mov qword [rsp + 0xa8], rdi
mov qword [rsp + 0xbc], rax
mov qword [rsp + 0x70], r10
mov qword [rsp + 0x78], r10
mov dword [rsp + 0x6c], 1
je 0x14004b2ee
lea rcx, str.Applying_Windows_customization:
mov edi, ebp
call fcn.1400380b9
mov r9d, 0xcfe
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.14001e4cb
and edi, 0x10000
je 0x14004b0dc
lea rsi, [rsp + 0x10c]
movsx ebx, bl
lea r8, str._c:WindowsPanther
mov edx, 0x104
mov r9d, ebx
mov rcx, rsi
mov rbp, qword [sym.imp.msvcrt.dll__snprintf]
call rbp
mov byte [rsp + 0x20f], 0
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
mov edi, eax
test eax, eax
jne 0x14004b05e
call qword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xb7
jne 0x14004b096
mov r9d, ebx
lea r8, str._c:WindowsPantherunattend.xml
mov edx, 0x104
mov rcx, rsi
call rbp
mov byte [rsp + 0x20f], 0
mov rcx, qword [0x140118280]
mov rdx, rsi
mov r8d, 1
call qword [sym.imp.KERNEL32.DLL_CopyFileA]
mov edi, eax
test eax, eax
jne 0x14004b0bd
call fcn.140038579
mov rdx, rsi
xor r13d, r13d
xor esi, esi
mov r8, rax
lea rcx, str.Could_not_create__s_:__s
mov r12d, 2
call fcn.1400380b9
jmp 0x14004b423
mov rdx, rsi
lea rcx, str.Added__s
xor esi, esi
xor r13d, r13d
call fcn.1400380b9
mov r12d, 2
jmp 0x14004b41e
mov r13d, ebp
mov byte [rsp + 0x80], bl
and r13d, 1
je 0x14004b21a
lea rax, [rsp + 0x94]
lea r15, [rsp + 0xb0]
mov byte [rsp + 0x94], bl
mov rcx, rax
mov byte [rsp + 0xb0], bl
mov qword [rsp + 0x58], rax
call fcn.14004903b
mov rcx, r15
mov r12, rax
call fcn.14004903b
mov r8d, 1
mov rcx, r12
mov rsi, rax
mov rdx, rax
call qword [sym.imp.KERNEL32.DLL_MoveFileExW]
mov r14d, eax
test rsi, rsi
je 0x14004b14b
mov rcx, rsi
call sub.msvcrt.dll_free
test r12, r12
je 0x14004b158
mov rcx, r12
call sub.msvcrt.dll_free
test r14d, r14d
mov r14, qword [sym.imp.KERNEL32.DLL_GetLastError]
jne 0x14004b18a
call r14
cmp eax, 2
je 0x14004b18a
call fcn.140038579
mov rdx, qword [rsp + 0x58]
lea rcx, str.Could_not_rename__s:__s
mov r8, rax
call fcn.1400380b9
jmp 0x14004b21a
call r14
test eax, eax
jne 0x14004b1a5
mov rdx, qword [rsp + 0x58]
mov r8, r15
lea rcx, str.Renamed__s___s
call fcn.1400380b9
mov rcx, qword [rsp + 0x58]
call fcn.14004903b
xor r9d, r9d
mov r8d, 1
mov edx, 0xc0000000
mov qword [rsp + 0x30], r9
mov rcx, rax
xor r9d, r9d
mov r12, rax
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.DLL_CreateFileW]
mov r15, rax
call r14
mov r14d, eax
test r12, r12
je 0x14004b1f7
mov rcx, r12
call sub.msvcrt.dll_free
mov ecx, r14d
call qword [sym.imp.KERNEL32.DLL_SetLastError]
mov rcx, r15
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov rdx, qword [rsp + 0x58]
lea rcx, str.Created__s_placeholder
call fcn.1400380b9
mov dword [rsp + 0x20], 1
xor r8d, r8d
mov r9d, 0xcf
mov edx, 0xcfd
mov ecx, 8
call fcn.140044e4a
test r13d, r13d
je 0x14004b2b9
lea rsi, [rsp + 0x80]
mov r8d, 2
lea rcx, str.Mounting__s__d_...
mov r12d, 2
mov rdx, rsi
call fcn.1400380b9
mov edx, 2
mov rcx, rsi
call fcn.140047e04
test eax, eax
jne 0x14004b29a
lea rcx, str.WARNING:_This_image_appears_to_be_an_UNOFFICIAL_Windows_ISO_
mov r12d, r13d
call fcn.1400380b9
lea rcx, str.Rufus_recommends_that_you_only_use_OFFICIAL_retail_Microsoft_Windows_images__such_as
call fcn.1400380b9
lea rcx, str.the_ones_that_can_be_downloaded_through_the_download_facility_of_this_application.
call fcn.1400380b9
mov rcx, rsi
mov edx, r12d
call fcn.140047480
mov rsi, rax
test rax, rax
jne 0x14004b4d8
xor r13d, r13d
jmp 0x14004b423
xor esi, esi
mov r12d, 2
and ebp, 1
mov r14, qword [sym.imp.msvcrt.dll__snprintf]
lea rbp, [rsp + 0x10c]
je 0x14004b350
test rsi, rsi
jne 0x14004b2f4
mov r8d, 0x379
lea rdx, str.wue.c
lea rcx, str.mount_path___NULL
call qword [sym.imp.msvcrt.dll__wassert]
mov r9, rsi
lea r8, str._sAutounattend.xml
mov edx, 0x104
mov rcx, rbp
call r14
mov rcx, qword [0x140118280]
mov rdx, rbp
mov byte [rsp + 0x20f], 0
call fcn.1400491c5
lea rdx, [rsp + 0x80]
lea rcx, str.Added_Autounattend.xml_to__s
test eax, eax
jne 0x14004b3f6
call fcn.140038579
lea rcx, str.Could_not_create_boot.wim_Autounattend.xml:__s
mov rdx, rax
call fcn.1400380b9
jmp 0x14004b423
movsx r9d, bl
lea r8, str._c:_sources_OEM___Panther
mov edx, 0x104
mov rcx, rbp
mov dword [rsp + 0x58], r9d
call r14
xor ecx, ecx
xor r8d, r8d
mov byte [rsp + 0x20f], 0
mov rdx, rbp
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExA]
mov r9d, dword [rsp + 0x58]
test eax, eax
mov ecx, eax
je 0x14004b3a6
call qword [sym.imp.KERNEL32.DLL_SetLastError]
call fcn.140038579
mov rdx, rbp
lea rcx, str.Error:_Could_not_create_directory__s:__s
mov r8, rax
jmp 0x14004b3ef
lea r8, str._c:_sources_OEM___Pantherunattend.xml
mov edx, 0x104
mov rcx, rbp
call r14
mov rcx, qword [0x140118280]
mov rdx, rbp
mov byte [rsp + 0x20f], 0
call fcn.1400491c5
mov rdx, rbp
lea rcx, str.Created__s
test eax, eax
jne 0x14004b3f6
call fcn.140038579
mov rdx, rbp
lea rcx, str.Could_not_create__s:__s
mov r8, rax
call fcn.1400380b9
jmp 0x14004b423
call fcn.1400380b9
mov r9d, 0xcf
mov r8d, 0x67
mov dword [rsp + 0x20], 1
mov edx, 0xcfd
mov ecx, 8
call fcn.140044e4a
mov edi, 1
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14004b433
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x14004b443
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r13d, r13d
je 0x14004b47e
lea rdx, str.RUFUS_OFFLINE_HIVE
mov rcx, 0xffffffff80000002
call fcn.140037e1f
mov r9d, 0xcf
mov r8d, 0x68
mov dword [rsp + 0x20], 1
mov edx, 0xcfd
mov ecx, 8
call fcn.140044e4a
test rsi, rsi
je 0x14004b708
lea rbx, [rsp + 0x80]
mov r8d, r12d
lea rcx, str.Unmounting__s__d_...
mov rdx, rbx
call fcn.1400380b9
mov edx, r12d
mov rcx, rbx
mov r8d, 1
call fcn.14004713c
xor eax, eax
mov r9d, 0xcf
mov r8d, 0xcf
mov dword [rsp + 0x20], eax
mov edx, 0xcfd
mov ecx, 8
call fcn.140044e4a
jmp 0x14004b708
lea r14, [rsp + 0x10c]
mov edx, 0x104
mov r9, rax
mov r15, qword [sym.imp.msvcrt.dll__snprintf]
mov rcx, r14
lea r8, str._sWindowsSystem32configSYSTEM
call r15
mov r8, r14
lea r14, str.RUFUS_OFFLINE_HIVE
mov rcx, 0xffffffff80000002
mov rdx, r14
mov byte [rsp + 0x20f], 0
call fcn.140037cef
test eax, eax
jne 0x14004b535
lea rcx, str.Falling_back_to_creating_the_registry_keys_through_unattend.xml
xor r13d, r13d
call fcn.1400380b9
jmp 0x14004b2c1
mov r9d, 0xcf
mov r8d, 0x65
mov edx, 0xcfd
mov dword [rsp + 0x20], 1
mov ecx, 8
call fcn.140044e4a
lea rax, [rsp + 0xcc]
mov r9, r14
lea r8, str._sSetup
mov edx, 0x40
mov rcx, rax
mov qword [rsp + 0x58], rax
call r15
lea rax, [rsp + 0x70]
mov rdx, qword [rsp + 0x58]
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov byte [rsp + 0x10b], 0
mov r9d, 0x2001d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ecx, eax
test eax, eax
je 0x14004b5c4
call qword [sym.imp.KERNEL32.DLL_SetLastError]
call fcn.140038579
lea rcx, str.Could_not_open_HKLMSYSTEMSetup_registry_key:__s
mov rdx, rax
jmp 0x14004b62c
lea rax, [rsp + 0x68]
xor ecx, ecx
xor r8d, r8d
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x78]
lea rdx, str.LabConfig
xor r15d, r15d
mov qword [rsp + 0x30], rcx
mov rcx, qword [rsp + 0x70]
lea r14, str.BypassTPMCheck
mov dword [rsp + 0x20], r8d
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x28], 7
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov ecx, eax
test eax, eax
je 0x14004b64f
call qword [sym.imp.KERNEL32.DLL_SetLastError]
call fcn.140038579
lea rcx, str.Could_not_create_HKLMSYSTEMSetupLabConfig_registry_key:__s
mov rdx, rax
call fcn.1400380b9
jmp 0x14004b2c1
mov rdx, qword [r14 + r15*8]
lea rcx, str.Created_HKLMSYSTEMSetupLabConfig_s_registry_key
inc r15
call fcn.1400380b9
cmp r15, 3
je 0x14004b6a5
lea rax, [rsp + 0x6c]
mov rdx, qword [r14 + r15*8]
mov rcx, qword [rsp + 0x78]
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, eax
test eax, eax
je 0x14004b636
call qword [sym.imp.KERNEL32.DLL_SetLastError]
call fcn.140038579
movsxd r10, r15d
lea rcx, str.Could_not_set_HKLMSYSTEMSetupLabConfig_s_registry_key:__s
mov rdx, qword [r14 + r10*8]
mov r8, rax
call fcn.1400380b9
jmp 0x14004b2c1
xor edx, edx
mov rcx, qword [0x140118280]
lea r9, str.disabled
lea r8, str.windowsPE
mov dword [rsp + 0x20], edx
lea rdx, str._settings
call fcn.140023e8c
test rax, rax
jne 0x14004b6dd
lea rcx, str.Warning:_Could_not_disable_windowsPE_pass_from_unattend.xml
call fcn.1400380b9
mov dword [rsp + 0x20], 1
mov r9d, 0xcf
mov r8d, 0x66
and ebp, 0xfffffffe
mov edx, 0xcfd
mov ecx, 8
call fcn.140044e4a
jmp 0x14004b2c1
mov rcx, rsi
call sub.msvcrt.dll_free
mov eax, edi
add rsp, 0x218
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret