Function at 0x4544c0
Capabilities:
Check if file exists
Copy file
Create directory
Move file
Set registry value

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
xor ebx, ebx
push ecx
sub esp, 0x1f8
mov eax, dword [ecx]
movups xmm1, xmmword [0x4b6cf0]
mov dword [ebp - 0x198], 0x6d6977
movups xmm0, xmmword [str._:_sources_boot._:_sources_apprappraiserres.dll]
movups xmm2, xmmword [0x4b6d00]
mov dword [ebp - 0x1b8], ebx
mov dword [ebp - 0x1c4], eax
movups xmm4, xmmword [str.ppraiserres.bak]
mov eax, dword [ecx + 4]
cmp dword [0x52b140], 0
movups xmmword [ebp - 0x194], xmm1
movups xmmword [ebp - 0x178], xmm1
mov dword [ebp - 0x1c8], eax
mov dword [ebp - 0x1b4], ebx
mov dword [ebp - 0x1ac], 1
movups xmmword [ebp - 0x1a8], xmm0
movups xmmword [ebp - 0x188], xmm2
movups xmmword [ebp - 0x16c], xmm4
jne 0x45456e
mov dword [esp + 8], 0x30b
mov dword [esp + 4], str.wue.c
mov dword [esp], str.unattend_xml_path___NULL
jmp 0x4548eb
mov dword [esp], str.Applying_Windows_customization:
call fcn.0043efa9
xor ecx, ecx
mov dword [esp + 0xc], 0xcfe
mov dword [esp + 8], ecx
mov dword [esp + 4], ecx
mov dword [esp], ecx
call fcn.00422ac2
mov eax, dword [ebp - 0x1c8]
and eax, 0x10000
mov dword [ebp - 0x1c0], eax
je 0x454698
movsx edi, byte [ebp - 0x1c4]
lea ebx, [ebp - 0x11c]
mov dword [esp + 8], str._c:WindowsPanther
mov dword [esp + 4], 0x104
mov esi, dword [sym.imp.msvcrt.dll__snprintf]
mov dword [esp + 0xc], edi
mov dword [esp], ebx
call esi
xor eax, eax
mov byte [ebp - 0x19], 0
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
push edx
push edx
mov dword [ebp - 0x1c0], eax
test eax, eax
jne 0x454603
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xb7
jne 0x454647
mov dword [esp + 0xc], edi
mov dword [esp + 8], str._c:WindowsPantherunattend.xml
mov dword [esp + 4], 0x104
mov dword [esp], ebx
call esi
mov byte [ebp - 0x19], 0
mov dword [esp + 8], 1
mov dword [esp + 4], ebx
mov eax, dword [0x52b140]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_CopyFileA]
mov dword [ebp - 0x1c0], eax
sub esp, 0xc
test eax, eax
jne 0x454674
call fcn.0043f53d
mov dword [esp + 4], ebx
mov esi, 2
xor ebx, ebx
mov dword [esp + 8], eax
mov dword [esp], str.Could_not_create__s_:__s
call fcn.0043efa9
xor eax, eax
mov dword [ebp - 0x1bc], eax
jmp 0x454a76
mov dword [esp + 4], ebx
mov esi, 2
xor ebx, ebx
mov dword [esp], str.Added__s
call fcn.0043efa9
xor eax, eax
mov dword [ebp - 0x1bc], eax
jmp 0x454a6c
mov al, byte [ebp - 0x1c4]
mov byte [ebp - 0x1a8], al
mov eax, dword [ebp - 0x1c8]
and eax, 1
mov dword [ebp - 0x1bc], eax
je 0x4547f9
mov al, byte [ebp - 0x1c4]
lea esi, [ebp - 0x194]
mov byte [ebp - 0x194], al
mov byte [ebp - 0x178], al
mov eax, esi
call fcn.00452330
mov ebx, eax
lea eax, [ebp - 0x178]
call fcn.00452330
mov dword [esp + 8], 1
mov dword [esp + 4], eax
mov dword [ebp - 0x1cc], eax
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.DLL_MoveFileExW]
mov edx, dword [ebp - 0x1cc]
sub esp, 0xc
mov edi, eax
test edx, edx
je 0x454717
mov dword [esp], edx
call sub.msvcrt.dll_free
test ebx, ebx
je 0x454723
mov dword [esp], ebx
call sub.msvcrt.dll_free
test edi, edi
jne 0x454750
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 2
je 0x454750
call fcn.0043f53d
mov dword [esp + 4], esi
mov dword [esp + 8], eax
mov dword [esp], str.Could_not_rename__s:__s
call fcn.0043efa9
jmp 0x4547f9
call dword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
jne 0x454774
lea eax, [ebp - 0x178]
mov dword [esp + 4], esi
mov dword [esp + 8], eax
mov dword [esp], str.Renamed__s___s
call fcn.0043efa9
lea eax, [ebp - 0x194]
call fcn.00452330
mov dword [esp + 0x14], pe_nt_image_headers32
mov esi, eax
xor eax, eax
mov dword [esp + 0x10], 2
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], 1
mov dword [esp + 4], 0xc0000000
mov dword [esp], esi
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
sub esp, 0x1c
mov ebx, eax
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edi, eax
test esi, esi
je 0x4547cf
mov dword [esp], esi
call sub.msvcrt.dll_free
mov dword [esp], edi
call dword [sym.imp.KERNEL32.DLL_SetLastError]
push esi
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
lea eax, [ebp - 0x194]
push edi
mov dword [esp + 4], eax
mov dword [esp], str.Created__s_placeholder
call fcn.0043efa9
xor ebx, ebx
mov dword [esp + 0x18], 1
mov dword [esp + 0x10], 0xcf
mov dword [esp + 0x14], ebx
mov dword [esp + 8], ebx
mov dword [esp + 0xc], ebx
mov dword [esp + 4], 0xcfd
mov dword [esp], 8
call fcn.0044d5f3
cmp dword [ebp - 0x1bc], 0
je 0x4548bc
lea ebx, [ebp - 0x1a8]
mov dword [esp + 8], 2
mov esi, 2
mov dword [esp + 4], ebx
mov dword [esp], str.Mounting__s__d_...
call fcn.0043efa9
mov dword [esp + 4], 2
mov dword [esp], ebx
call fcn.00450f4d
test eax, eax
jne 0x454899
mov dword [esp], str.WARNING:_This_image_appears_to_be_an_UNOFFICIAL_Windows_ISO_
call fcn.0043efa9
mov dword [esp], str.Rufus_recommends_that_you_only_use_OFFICIAL_retail_Microsoft_Windows_images__such_as
call fcn.0043efa9
mov dword [esp], str.the_ones_that_can_be_downloaded_through_the_download_facility_of_this_application.
call fcn.0043efa9
mov esi, dword [ebp - 0x1bc]
mov dword [esp], ebx
mov dword [esp + 4], esi
call fcn.004504a4
mov ebx, eax
test eax, eax
jne 0x454b64
xor eax, eax
mov dword [ebp - 0x1bc], eax
jmp 0x454a76
xor ebx, ebx
mov esi, 2
test byte [ebp - 0x1c8], 1
je 0x454958
test ebx, ebx
jne 0x4548f1
mov dword [esp + 8], 0x379
mov dword [esp + 4], str.wue.c
mov dword [esp], str.mount_path___NULL
call dword [0x494088]
lea edi, [ebp - 0x11c]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], str._sAutounattend.xml
mov dword [esp + 4], 0x104
mov dword [esp], edi
call dword [sym.imp.msvcrt.dll__snprintf]
mov eax, dword [0x52b140]
mov edx, edi
mov byte [ebp - 0x19], 0
call fcn.004524ee
test eax, eax
jne 0x454942
call fcn.0043f53d
mov dword [esp], str.Could_not_create_boot.wim_Autounattend.xml:__s
mov dword [esp + 4], eax
call fcn.0043efa9
jmp 0x454a76
lea eax, [ebp - 0x1a8]
mov dword [esp], str.Added_Autounattend.xml_to__s
mov dword [esp + 4], eax
jmp 0x454a2f
movsx ecx, byte [ebp - 0x1c4]
mov edx, dword [sym.imp.msvcrt.dll__snprintf]
lea edi, [ebp - 0x11c]
mov dword [esp + 0xc], ecx
mov dword [ebp - 0x1c8], ecx
mov dword [esp + 8], str._c:_sources_OEM___Panther
mov dword [esp + 4], 0x104
mov dword [esp], edi
mov dword [ebp - 0x1c4], edx
call edx
xor eax, eax
mov byte [ebp - 0x19], 0
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExA]
mov edx, dword [ebp - 0x1c4]
mov ecx, dword [ebp - 0x1c8]
sub esp, 0xc
test eax, eax
je 0x4549dc
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_SetLastError]
push ecx
call fcn.0043f53d
mov dword [esp + 4], edi
mov dword [esp + 8], eax
mov dword [esp], str.Error:_Could_not_create_directory__s:__s
jmp 0x454a1d
mov dword [esp + 0xc], ecx
mov dword [esp + 8], str._c:_sources_OEM___Pantherunattend.xml
mov dword [esp + 4], 0x104
mov dword [esp], edi
call edx
mov eax, dword [0x52b140]
mov edx, edi
mov byte [ebp - 0x19], 0
call fcn.004524ee
test eax, eax
jne 0x454a24
call fcn.0043f53d
mov dword [esp + 4], edi
mov dword [esp + 8], eax
mov dword [esp], str.Could_not_create__s:__s
call fcn.0043efa9
jmp 0x454a76
mov dword [esp + 4], edi
mov dword [esp], str.Created__s
call fcn.0043efa9
xor eax, eax
xor edx, edx
mov dword [esp], 8
mov dword [esp + 0x18], 1
mov dword [esp + 0x10], 0xcf
mov dword [esp + 0x14], eax
mov dword [esp + 8], 0x67
mov dword [esp + 0xc], edx
mov dword [esp + 4], 0xcfd
call fcn.0044d5f3
mov dword [ebp - 0x1c0], 1
mov eax, dword [ebp - 0x1b4]
test eax, eax
je 0x454a8a
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
mov eax, dword [ebp - 0x1b8]
test eax, eax
je 0x454a9e
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
cmp dword [ebp - 0x1bc], 0
je 0x454af3
mov dword [esp + 4], str.RUFUS_OFFLINE_HIVE
xor edi, edi
mov dword [esp], 0x80000002
call fcn.0043ece7
xor eax, eax
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], 1
mov dword [esp + 0x10], 0xcf
mov dword [esp + 8], 0x68
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0xcfd
mov dword [esp], 8
call fcn.0044d5f3
test ebx, ebx
je 0x454dfc
lea edi, [ebp - 0x1a8]
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp], str.Unmounting__s__d_...
call fcn.0043efa9
mov dword [esp + 8], 1
mov dword [esp + 4], esi
mov dword [esp], edi
call fcn.00450144
xor eax, eax
xor edx, edx
xor ecx, ecx
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], 0xcf
mov dword [esp + 0x14], edx
mov dword [esp + 8], 0xcf
mov dword [esp + 0xc], ecx
mov dword [esp + 4], 0xcfd
mov dword [esp], 8
call fcn.0044d5f3
jmp 0x454dfc
lea edx, [ebp - 0x11c]
mov dword [esp + 0xc], eax
mov edi, dword [sym.imp.msvcrt.dll__snprintf]
mov dword [esp], edx
mov dword [esp + 8], str._sWindowsSystem32configSYSTEM
mov dword [esp + 4], 0x104
call edi
lea edx, [ebp - 0x11c]
mov byte [ebp - 0x19], 0
mov dword [esp + 8], edx
mov dword [esp + 4], str.RUFUS_OFFLINE_HIVE
mov dword [esp], 0x80000002
call fcn.0043eb9b
test eax, eax
jne 0x454bc8
mov dword [esp], str.Falling_back_to_creating_the_registry_keys_through_unattend.xml
call fcn.0043efa9
xor ecx, ecx
mov dword [ebp - 0x1bc], ecx
jmp 0x4548c3
xor eax, eax
mov dword [esp + 0x18], 1
mov dword [esp + 0x14], eax
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0xcf
mov dword [esp + 8], 0x65
mov dword [esp + 4], 0xcfd
mov dword [esp], 8
call fcn.0044d5f3
lea edx, [ebp - 0x15c]
mov dword [esp + 0xc], str.RUFUS_OFFLINE_HIVE
mov dword [esp], edx
mov dword [esp + 8], str._sSetup
mov dword [esp + 4], 0x40
call edi
xor edx, edx
mov byte [ebp - 0x11d], 0
lea eax, [ebp - 0x1b8]
mov dword [esp + 8], edx
lea edx, [ebp - 0x15c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x2001d
mov dword [esp + 4], edx
mov dword [esp], 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
sub esp, 0x14
test eax, eax
je 0x454c7c
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_SetLastError]
push eax
call fcn.0043f53d
mov dword [esp], str.Could_not_open_HKLMSYSTEMSetup_registry_key:__s
mov dword [esp + 4], eax
jmp 0x454ce6
lea eax, [ebp - 0x1b0]
mov dword [esp + 0x14], 7
mov dword [esp + 0x20], eax
lea eax, [ebp - 0x1b4]
mov dword [esp + 0x1c], eax
xor eax, eax
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov dword [esp + 4], str.LabConfig
mov eax, dword [ebp - 0x1b8]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
sub esp, 0x24
mov edi, eax
test eax, eax
je 0x454d0d
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_SetLastError]
push edi
call fcn.0043f53d
mov dword [esp], str.Could_not_create_HKLMSYSTEMSetupLabConfig_registry_key:__s
mov dword [esp + 4], eax
call fcn.0043efa9
jmp 0x4548c3
mov eax, dword [edi*4 + 0x492b28]
mov dword [esp], str.Created_HKLMSYSTEMSetupLabConfig_s_registry_key
inc edi
mov dword [esp + 4], eax
call fcn.0043efa9
cmp edi, 3
je 0x454d7d
lea eax, [ebp - 0x1ac]
xor ecx, ecx
mov dword [esp + 0x14], 4
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 4
mov dword [esp + 8], ecx
mov eax, dword [edi*4 + 0x492b28]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x1b4]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
sub esp, 0x18
test eax, eax
je 0x454cf0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_SetLastError]
push edx
call fcn.0043f53d
mov dword [esp + 8], eax
mov eax, dword [edi*4 + 0x492b28]
mov dword [esp], str.Could_not_set_HKLMSYSTEMSetupLabConfig_s_registry_key:__s
mov dword [esp + 4], eax
call fcn.0043efa9
jmp 0x4548c3
xor eax, eax
mov dword [esp + 0xc], str.disabled
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.windowsPE
mov dword [esp + 4], str._settings
mov eax, dword [0x52b140]
mov dword [esp], eax
call fcn.00428e5e
test eax, eax
jne 0x454db8
mov dword [esp], str.Warning:_Could_not_disable_windowsPE_pass_from_unattend.xml
call fcn.0043efa9
xor eax, eax
and dword [ebp - 0x1c8], 0xfffffffe
mov dword [esp + 0x14], eax
xor eax, eax
mov dword [esp + 0x18], 1
mov dword [esp + 0x10], 0xcf
mov dword [esp + 8], 0x66
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0xcfd
mov dword [esp], 8
call fcn.0044d5f3
jmp 0x4548c3
mov dword [esp], ebx
call sub.msvcrt.dll_free
mov eax, dword [ebp - 0x1c0]
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret