Function at 0x140134050
Capabilities:
Copy file
Set file attributes
Set registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x210]
sub rsp, 0x310
mov qword [rbp - 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x358], rbx
mov rax, qword [0x140415a10]
xor rax, rsp
mov qword [rbp + 0x200], rax
mov rdi, r9
mov qword [rbp - 0x78], r9
mov qword [rbp - 0x70], r8
mov r12, rcx
mov qword [rbp - 0x80], rcx
xor r13d, r13d
mov r14d, dword [rbp + 0x270]
nop dword [rax + rax]
mov esi, r13d
mov r15, r13
mov qword [rbp - 0x20], r13
xor bl, bl
mov byte [rsp + 0x50], bl
test rdi, rdi
je 0x1401340ff
mov ecx, 0x10
call fcn.1402b6dbc
mov qword [rsp + 0x58], rax
test rax, rax
je 0x1401340ea
lea rdx, str.Prepare
mov rcx, rax
call fcn.140133c60
jmp 0x1401340ed
mov rax, r13
mov r9, rax
xor r8d, r8d
mov edx, r14d
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageW]
mov rcx, r12
call fcn.140175000
test al, al
jne 0x14013411f
lea r15, str.lock
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x1401346f2
mov ecx, 0x18
call fcn.1402b6dbc
mov rbx, rax
test rax, rax
je 0x1401342b3
lea rax, vtable.HitmanPro35::Kickstart::Fat32.0
mov qword [rbx], rax
mov qword [rbx + 8], r12
mov qword [rbx + 0x10], 0x3f
test rdi, rdi
je 0x14013418a
mov ecx, 0x10
call fcn.1402b6dbc
mov qword [rsp + 0x58], rax
test rax, rax
je 0x140134175
lea rdx, str.Erase
mov rcx, rax
call fcn.140133c60
jmp 0x140134178
mov rax, r13
mov r9, rax
xor r8d, r8d
mov edx, r14d
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageW]
mov rcx, r12
call fcn.140175210
test al, al
jne 0x1401341aa
lea r15, str.lock
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x1401342a6
test rdi, rdi
je 0x1401341e9
mov ecx, 0x10
call fcn.1402b6dbc
mov qword [rsp + 0x58], rax
test rax, rax
je 0x1401341d4
lea rdx, str.Format
mov rcx, rax
call fcn.140133c60
jmp 0x1401341d7
mov rax, r13
mov r9, rax
xor r8d, r8d
mov edx, r14d
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageW]
lea rdx, str.HITMANPRO
mov rcx, rbx
call fcn.140134ee0
test al, al
jne 0x140134210
lea r15, str.format
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x1401342a6
test rdi, rdi
je 0x14013424f
mov ecx, 0x10
call fcn.1402b6dbc
mov qword [rsp + 0x58], rax
test rax, rax
je 0x14013423a
lea rdx, str.Write
mov rcx, rax
call fcn.140133c60
jmp 0x14013423d
mov rax, r13
mov r9, rax
xor r8d, r8d
mov edx, r14d
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageW]
lea rdx, [rbp - 0x20]
mov rcx, r12
call fcn.140134940
test al, al
jne 0x140134269
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x1401342a2
lea rcx, [rbp - 0x30]
call qword [sym.imp.RPCRT4.dll_UuidCreate]
mov r8d, 0xdddddddd
test eax, eax
cmove r8d, dword [rbp - 0x30]
mov rcx, r12
call fcn.1401752f0
test al, al
jne 0x14013429d
lea r15, str.partitions
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x1401342a6
mov byte [rsp + 0x50], 1
mov r15, qword [rbp - 0x20]
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
mov rcx, qword [r12 + 0x78]
test rcx, rcx
je 0x1401342f6
mov qword [rsp + 0x38], r13
lea rax, [rbp - 0x68]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
mov edx, 0x90020
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
lea rcx, str.dismount
test eax, eax
cmovne rcx, r15
mov r15, rcx
mov bl, 1
mov rcx, qword [r12 + 0x78]
test rcx, rcx
je 0x140134354
mov qword [rsp + 0x38], r13
lea rax, [rbp - 0x64]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
mov edx, 0x9001c
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
movzx ebx, bl
test eax, eax
cmove ebx, r13d
mov rcx, qword [r12 + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [r12 + 0x78], r13
lea rax, str.unlock
test bl, bl
cmovne rax, r15
mov r15, rax
mov ecx, 0xd05
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, r12
call fcn.140175180
test al, al
jne 0x140134382
lea r15, str.update
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
xor bl, bl
mov byte [rsp + 0x50], bl
jmp 0x140134387
movzx ebx, byte [rsp + 0x50]
mov ecx, 0xd05
call qword [sym.imp.KERNEL32.dll_Sleep]
test bl, bl
je 0x1401346f2
mov rcx, r12
call fcn.140174f50
movzx ebx, al
mov byte [rsp + 0x50], al
test al, al
jne 0x1401343bc
lea r15, str.volume
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test bl, bl
je 0x1401346f2
movabs rax, 0x5c003a005f
mov qword [rbp - 0x20], rax
movzx eax, word [r12 + 8]
mov word [rbp - 0x20], ax
mov rdx, qword [rbp - 0x70]
lea rcx, [rbp - 0x60]
call fcn.1400b91c0
nop
mov r14, qword [rbp - 0x58]
mov rax, r14
mov r12, qword [rbp - 0x60]
sub rax, r12
sar rax, 3
test rax, rax
je 0x140134556
nop word [rax + rax]
add r14, 0xfffffffffffffff8
mov rdi, qword [r14]
mov qword [rbp - 0x58], r14
test bl, bl
je 0x14013453f
mov rbx, qword [rbp - 0x78]
test rbx, rbx
je 0x140134491
mov ecx, 0x10
cmp byte [rdi + 0x10], 0
je 0x14013445c
call fcn.1402b6dbc
mov qword [rsp + 0x58], rax
test rax, rax
je 0x140134457
lea r8, [0x140346ce0]
mov rcx, rax
call fcn.140133d60
jmp 0x14013445a
mov rax, r13
jmp 0x14013447c
call fcn.1402b6dbc
mov qword [rsp + 0x58], rax
test rax, rax
je 0x140134479
mov r8, qword [rdi + 8]
mov rcx, rax
call fcn.140133d60
jmp 0x14013447c
mov rax, r13
mov r9, rax
xor r8d, r8d
mov edx, dword [rbp + 0x270]
mov rcx, rbx
call qword [sym.imp.USER32.dll_PostMessageW]
mov r8, qword [rdi + 8]
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x10]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
test rax, rax
je 0x14013453a
mov ebx, 3
nop dword [rax]
nop word [rax + rax]
xor r8d, r8d
lea rdx, [rbp - 0x10]
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x140134525
lea r15, str.copy
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov r8d, eax
lea rdx, [rbp - 0x10]
lea rcx, str._s_error__d_r_n
call fcn.1402b9694
cmp esi, 0x15
jne 0x140134517
cmp ebx, 1
jle 0x140134517
lea rcx, str.____retrying..._r_n
call fcn.1402b9694
mov ecx, 0xd05
call qword [sym.imp.KERNEL32.dll_Sleep]
dec ebx
test ebx, ebx
jg 0x1401344c0
xor bl, bl
mov byte [rsp + 0x50], bl
jmp 0x14013453f
cmp byte [rdi + 0x10], 0
je 0x14013453a
mov edx, 2
lea rcx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
movzx ebx, byte [rsp + 0x50]
mov rax, r14
sub rax, r12
sar rax, 3
test rax, rax
jne 0x140134410
mov rdi, qword [rbp - 0x78]
test r12, r12
je 0x140134563
mov rcx, r12
call fcn.1402150f0
test bl, bl
je 0x1401346e7
test rdi, rdi
je 0x1401345b3
mov ecx, 0x10
call fcn.1402b6dbc
mov qword [rsp + 0x58], rax
test rax, rax
je 0x140134595
lea rdx, str.Remove
mov rcx, rax
call fcn.140133c60
jmp 0x140134598
mov rax, r13
mov r9, rax
xor r8d, r8d
mov r14d, dword [rbp + 0x270]
mov edx, r14d
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x1401345ba
mov r14d, dword [rbp + 0x270]
mov r12, qword [rbp - 0x80]
mov rcx, r12
call fcn.140174df0
mov ecx, 0xd05
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x140429a18]
test al, 1
jne 0x140134609
or eax, 1
mov dword [0x140429a18], eax
lea rax, vtable.Core::Win32::RegistryKey.0
mov qword [0x1404299f0], rax
mov qword [0x1404299f8], 0xffffffff80000002
lea rcx, [0x1402fedc0]
call fcn.1402b8a74
mov qword [rbp - 0x20], r13
mov qword [rsp + 0x40], r13
lea rax, [rbp - 0x20]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x14034ce18]
mov rcx, qword [0x1404299f8]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ebx, eax
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
jne 0x140134679
lea ecx, [rbx + 0x10]
call fcn.1402b6dbc
mov rbx, rax
test rax, rax
je 0x140134679
mov rax, qword [rbp - 0x20]
lea rcx, vtable.Core::Win32::RegistryKey.0
mov qword [rbx], rcx
mov qword [rbx + 8], rax
jmp 0x14013467c
mov rbx, r13
test rbx, rbx
je 0x1401346e0
lea rcx, [rbp - 0x60]
call fcn.1400cafe0
nop
lea rdx, [rbp - 0x48]
mov rcx, rax
call fcn.1400cb0d0
mov ecx, dword [rax + 0xc]
mov rdx, qword [rax]
lea eax, [rcx + rcx]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
mov r9d, 1
xor r8d, r8d
lea rdx, str.LastKickstartCreated
mov rcx, qword [rbx + 8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp dword [rbp - 0x40], 0
jle 0x1401346d3
mov rcx, qword [rbp - 0x48]
call fcn.1402b7350
nop
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
movzx ebx, byte [rsp + 0x50]
jmp 0x1401346f2
mov r14d, dword [rbp + 0x270]
mov r12, qword [rbp - 0x80]
test rdi, rdi
je 0x140134872
test bl, bl
jne 0x14013483a
mov qword [rsp + 0x78], r13
mov edx, 0x11
lea rcx, [rsp + 0x70]
call fcn.1401fcb40
mov eax, dword [rsp + 0x78]
inc eax
movsxd rdx, eax
mov r9d, 0x11
lea r8, str.Kickstart_Failure
mov rcx, qword [rsp + 0x70]
call fcn.1402ba94c
mov edx, 0x11
lea rcx, [rsp + 0x70]
call fcn.1401fde50
nop
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x60]
call fcn.1400f4800
nop
cmp dword [rsp + 0x78], 0
jle 0x140134768
mov rcx, qword [rsp + 0x70]
call fcn.1402b7350
lea rdx, str._r_n_r_n
lea rcx, [rsp + 0x60]
call fcn.1401fb190
mov r8d, esi
lea rdx, [0x1403521e8]
lea rcx, [rsp + 0x60]
call fcn.1401fb410
test r15, r15
je 0x1401347a6
mov r8, r15
lea rdx, [0x140352240]
lea rcx, [rsp + 0x60]
call fcn.1401fb410
mov r9d, 0x15
lea r8, [0x140352218]
mov rdx, qword [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 4
jne 0x1401347e0
cmp dword [rsp + 0x68], 0
jle 0x1401340b0
mov rcx, qword [rsp + 0x60]
call fcn.1402b7350
jmp 0x1401340b0
mov ecx, 0x10
call fcn.1402b6dbc
mov qword [rsp + 0x58], rax
test rax, rax
je 0x140134809
mov r8d, esi
lea rdx, str.Failed
mov rcx, rax
call fcn.140133e90
mov r13, rax
mov r9, r13
xor r8d, r8d
mov edx, r14d
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageW]
mov ecx, 0x29a
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
cmp dword [rsp + 0x68], 0
jle 0x140134872
mov rcx, qword [rsp + 0x60]
call fcn.1402b7350
jmp 0x140134872
mov ecx, 0x10
call fcn.1402b6dbc
mov qword [rsp + 0x58], rax
test rax, rax
je 0x140134860
lea rdx, str.Done
mov rcx, rax
call fcn.140133c60
mov r13, rax
mov r9, r13
xor r8d, r8d
mov edx, r14d
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageW]
movzx eax, bl
mov rcx, qword [rbp + 0x200]
xor rcx, rsp
call fcn.1402b6d40
mov rbx, qword [rsp + 0x358]
add rsp, 0x310
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret