Function at 0x140127410
Capabilities:
Copy file
Set file attributes
Set registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x210]
sub rsp, 0x310
mov qword [rbp - 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x358], rbx
mov rax, qword [0x1403eaa10]
xor rax, rsp
mov qword [rbp + 0x200], rax
mov rdi, r9
mov qword [rbp - 0x78], r9
mov qword [rbp - 0x70], r8
mov r12, rcx
mov qword [rbp - 0x80], rcx
xor r13d, r13d
mov r14d, dword [rbp + 0x270]
nop dword [rax + rax]
mov esi, r13d
mov r15, r13
mov qword [rbp - 0x20], r13
xor bl, bl
mov byte [rsp + 0x50], bl
test rdi, rdi
je 0x1401274bf
mov ecx, 0x10
call fcn.14029806c
mov qword [rsp + 0x58], rax
test rax, rax
je 0x1401274aa
lea rdx, str.Prepare
mov rcx, rax
call fcn.140127020
jmp 0x1401274ad
mov rax, r13
mov r9, rax
xor r8d, r8d
mov edx, r14d
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageW]
mov rcx, r12
call fcn.1401659b0
test al, al
jne 0x1401274df
lea r15, str.lock
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x140127ab2
mov ecx, 0x18
call fcn.14029806c
mov rbx, rax
test rax, rax
je 0x140127673
lea rax, vtable.HitmanPro35::Kickstart::Fat32.0
mov qword [rbx], rax
mov qword [rbx + 8], r12
mov qword [rbx + 0x10], 0x3f
test rdi, rdi
je 0x14012754a
mov ecx, 0x10
call fcn.14029806c
mov qword [rsp + 0x58], rax
test rax, rax
je 0x140127535
lea rdx, str.Erase
mov rcx, rax
call fcn.140127020
jmp 0x140127538
mov rax, r13
mov r9, rax
xor r8d, r8d
mov edx, r14d
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageW]
mov rcx, r12
call fcn.140165bc0
test al, al
jne 0x14012756a
lea r15, str.lock
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x140127666
test rdi, rdi
je 0x1401275a9
mov ecx, 0x10
call fcn.14029806c
mov qword [rsp + 0x58], rax
test rax, rax
je 0x140127594
lea rdx, str.Format
mov rcx, rax
call fcn.140127020
jmp 0x140127597
mov rax, r13
mov r9, rax
xor r8d, r8d
mov edx, r14d
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageW]
lea rdx, str.HITMANPRO
mov rcx, rbx
call fcn.1401282a0
test al, al
jne 0x1401275d0
lea r15, str.format
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x140127666
test rdi, rdi
je 0x14012760f
mov ecx, 0x10
call fcn.14029806c
mov qword [rsp + 0x58], rax
test rax, rax
je 0x1401275fa
lea rdx, str.Write
mov rcx, rax
call fcn.140127020
jmp 0x1401275fd
mov rax, r13
mov r9, rax
xor r8d, r8d
mov edx, r14d
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageW]
lea rdx, [rbp - 0x20]
mov rcx, r12
call fcn.140127d00
test al, al
jne 0x140127629
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x140127662
lea rcx, [rbp - 0x30]
call qword [sym.imp.RPCRT4.dll_UuidCreate]
mov r8d, 0xdddddddd
test eax, eax
cmove r8d, dword [rbp - 0x30]
mov rcx, r12
call fcn.140165ca0
test al, al
jne 0x14012765d
lea r15, str.partitions
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x140127666
mov byte [rsp + 0x50], 1
mov r15, qword [rbp - 0x20]
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
mov rcx, qword [r12 + 0x78]
test rcx, rcx
je 0x1401276b6
mov qword [rsp + 0x38], r13
lea rax, [rbp - 0x68]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
mov edx, 0x90020
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
lea rcx, str.dismount
test eax, eax
cmovne rcx, r15
mov r15, rcx
mov bl, 1
mov rcx, qword [r12 + 0x78]
test rcx, rcx
je 0x140127714
mov qword [rsp + 0x38], r13
lea rax, [rbp - 0x64]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
mov edx, 0x9001c
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
movzx ebx, bl
test eax, eax
cmove ebx, r13d
mov rcx, qword [r12 + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [r12 + 0x78], r13
lea rax, str.unlock
test bl, bl
cmovne rax, r15
mov r15, rax
mov ecx, 0xd05
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, r12
call fcn.140165b30
test al, al
jne 0x140127742
lea r15, str.update
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
xor bl, bl
mov byte [rsp + 0x50], bl
jmp 0x140127747
movzx ebx, byte [rsp + 0x50]
mov ecx, 0xd05
call qword [sym.imp.KERNEL32.dll_Sleep]
test bl, bl
je 0x140127ab2
mov rcx, r12
call fcn.140165900
movzx ebx, al
mov byte [rsp + 0x50], al
test al, al
jne 0x14012777c
lea r15, str.volume
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test bl, bl
je 0x140127ab2
movabs rax, 0x5c003a005f
mov qword [rbp - 0x20], rax
movzx eax, word [r12 + 8]
mov word [rbp - 0x20], ax
mov rdx, qword [rbp - 0x70]
lea rcx, [rbp - 0x60]
call fcn.1400b8eb0
nop
mov r14, qword [rbp - 0x58]
mov rax, r14
mov r12, qword [rbp - 0x60]
sub rax, r12
sar rax, 3
test rax, rax
je 0x140127916
nop word [rax + rax]
add r14, 0xfffffffffffffff8
mov rdi, qword [r14]
mov qword [rbp - 0x58], r14
test bl, bl
je 0x1401278ff
mov rbx, qword [rbp - 0x78]
test rbx, rbx
je 0x140127851
mov ecx, 0x10
cmp byte [rdi + 0x10], 0
je 0x14012781c
call fcn.14029806c
mov qword [rsp + 0x58], rax
test rax, rax
je 0x140127817
lea r8, [0x140323de0]
mov rcx, rax
call fcn.140127120
jmp 0x14012781a
mov rax, r13
jmp 0x14012783c
call fcn.14029806c
mov qword [rsp + 0x58], rax
test rax, rax
je 0x140127839
mov r8, qword [rdi + 8]
mov rcx, rax
call fcn.140127120
jmp 0x14012783c
mov rax, r13
mov r9, rax
xor r8d, r8d
mov edx, dword [rbp + 0x270]
mov rcx, rbx
call qword [sym.imp.USER32.dll_PostMessageW]
mov r8, qword [rdi + 8]
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x10]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
test rax, rax
je 0x1401278fa
mov ebx, 3
nop dword [rax]
nop word [rax + rax]
xor r8d, r8d
lea rdx, [rbp - 0x10]
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x1401278e5
lea r15, str.copy
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov r8d, eax
lea rdx, [rbp - 0x10]
lea rcx, str._s_error__d_r_n
call fcn.14029a88c
cmp esi, 0x15
jne 0x1401278d7
cmp ebx, 1
jle 0x1401278d7
lea rcx, str.____retrying..._r_n
call fcn.14029a88c
mov ecx, 0xd05
call qword [sym.imp.KERNEL32.dll_Sleep]
dec ebx
test ebx, ebx
jg 0x140127880
xor bl, bl
mov byte [rsp + 0x50], bl
jmp 0x1401278ff
cmp byte [rdi + 0x10], 0
je 0x1401278fa
mov edx, 2
lea rcx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
movzx ebx, byte [rsp + 0x50]
mov rax, r14
sub rax, r12
sar rax, 3
test rax, rax
jne 0x1401277d0
mov rdi, qword [rbp - 0x78]
test r12, r12
je 0x140127923
mov rcx, r12
call fcn.1402012c0
test bl, bl
je 0x140127aa7
test rdi, rdi
je 0x140127973
mov ecx, 0x10
call fcn.14029806c
mov qword [rsp + 0x58], rax
test rax, rax
je 0x140127955
lea rdx, str.Remove
mov rcx, rax
call fcn.140127020
jmp 0x140127958
mov rax, r13
mov r9, rax
xor r8d, r8d
mov r14d, dword [rbp + 0x270]
mov edx, r14d
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x14012797a
mov r14d, dword [rbp + 0x270]
mov r12, qword [rbp - 0x80]
mov rcx, r12
call fcn.1401657a0
mov ecx, 0xd05
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x1403fe608]
test al, 1
jne 0x1401279c9
or eax, 1
mov dword [0x1403fe608], eax
lea rax, vtable.Core::Win32::RegistryKey.0
mov qword [0x1403fe5e0], rax
mov qword [0x1403fe5e8], 0xffffffff80000002
lea rcx, [0x1402de040]
call fcn.140299c6c
mov qword [rbp - 0x20], r13
mov qword [rsp + 0x40], r13
lea rax, [rbp - 0x20]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140329c48]
mov rcx, qword [0x1403fe5e8]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ebx, eax
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
jne 0x140127a39
lea ecx, [rbx + 0x10]
call fcn.14029806c
mov rbx, rax
test rax, rax
je 0x140127a39
mov rax, qword [rbp - 0x20]
lea rcx, vtable.Core::Win32::RegistryKey.0
mov qword [rbx], rcx
mov qword [rbx + 8], rax
jmp 0x140127a3c
mov rbx, r13
test rbx, rbx
je 0x140127aa0
lea rcx, [rbp - 0x60]
call fcn.1400d1620
nop
lea rdx, [rbp - 0x48]
mov rcx, rax
call fcn.1400ca9e0
mov ecx, dword [rax + 0xc]
mov rdx, qword [rax]
lea eax, [rcx + rcx]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
mov r9d, 1
xor r8d, r8d
lea rdx, str.LastKickstartCreated
mov rcx, qword [rbx + 8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp dword [rbp - 0x40], 0
jle 0x140127a93
mov rcx, qword [rbp - 0x48]
call fcn.140298600
nop
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
movzx ebx, byte [rsp + 0x50]
jmp 0x140127ab2
mov r14d, dword [rbp + 0x270]
mov r12, qword [rbp - 0x80]
test rdi, rdi
je 0x140127c32
test bl, bl
jne 0x140127bfa
mov qword [rsp + 0x78], r13
mov edx, 0x11
lea rcx, [rsp + 0x70]
call fcn.1401e9030
mov eax, dword [rsp + 0x78]
inc eax
movsxd rdx, eax
mov r9d, 0x11
lea r8, str.Kickstart_Failure
mov rcx, qword [rsp + 0x70]
call fcn.14029b4d8
mov edx, 0x11
lea rcx, [rsp + 0x70]
call fcn.1401ea290
nop
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x60]
call fcn.1400f6370
nop
cmp dword [rsp + 0x78], 0
jle 0x140127b28
mov rcx, qword [rsp + 0x70]
call fcn.140298600
lea rdx, str._r_n_r_n
lea rcx, [rsp + 0x60]
call fcn.1401e7680
mov r8d, esi
lea rdx, [0x14032e5b0]
lea rcx, [rsp + 0x60]
call fcn.1401e7900
test r15, r15
je 0x140127b66
mov r8, r15
lea rdx, [0x14032e608]
lea rcx, [rsp + 0x60]
call fcn.1401e7900
mov r9d, 0x15
lea r8, [0x14032e5e0]
mov rdx, qword [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 4
jne 0x140127ba0
cmp dword [rsp + 0x68], 0
jle 0x140127470
mov rcx, qword [rsp + 0x60]
call fcn.140298600
jmp 0x140127470
mov ecx, 0x10
call fcn.14029806c
mov qword [rsp + 0x58], rax
test rax, rax
je 0x140127bc9
mov r8d, esi
lea rdx, str.Failed
mov rcx, rax
call fcn.140127250
mov r13, rax
mov r9, r13
xor r8d, r8d
mov edx, r14d
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageW]
mov ecx, 0x29a
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
cmp dword [rsp + 0x68], 0
jle 0x140127c32
mov rcx, qword [rsp + 0x60]
call fcn.140298600
jmp 0x140127c32
mov ecx, 0x10
call fcn.14029806c
mov qword [rsp + 0x58], rax
test rax, rax
je 0x140127c20
lea rdx, str.Done
mov rcx, rax
call fcn.140127020
mov r13, rax
mov r9, r13
xor r8d, r8d
mov edx, r14d
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageW]
movzx eax, bl
mov rcx, qword [rbp + 0x200]
xor rcx, rsp
call fcn.140297ff0
mov rbx, qword [rsp + 0x358]
add rsp, 0x310
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret