Function at 0x140136cc0
Capabilities:
Copy file
Set file attributes
Set registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x210]
sub rsp, 0x310
mov qword [rbp - 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x358], rbx
mov rax, qword [0x14041da10]
xor rax, rsp
mov qword [rbp + 0x200], rax
mov rdi, r9
mov qword [rbp - 0x78], r9
mov qword [rbp - 0x70], r8
mov r12, rcx
mov qword [rbp - 0x80], rcx
xor r13d, r13d
mov r14d, dword [rbp + 0x270]
nop dword [rax + rax]
mov esi, r13d
mov r15, r13
mov qword [rbp - 0x20], r13
xor bl, bl
mov byte [rsp + 0x50], bl
test rdi, rdi
je 0x140136d6f
mov ecx, 0x10
call fcn.1402bcb4c
mov qword [rsp + 0x58], rax
test rax, rax
je 0x140136d5a
lea rdx, str.Prepare
mov rcx, rax
call fcn.1401368d0
jmp 0x140136d5d
mov rax, r13
mov r9, rax
xor r8d, r8d
mov edx, r14d
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageW]
mov rcx, r12
call fcn.140178010
test al, al
jne 0x140136d8f
lea r15, str.lock
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x140137362
mov ecx, 0x18
call fcn.1402bcb4c
mov rbx, rax
test rax, rax
je 0x140136f23
lea rax, vtable.HitmanPro35::Kickstart::Fat32.0
mov qword [rbx], rax
mov qword [rbx + 8], r12
mov qword [rbx + 0x10], 0x3f
test rdi, rdi
je 0x140136dfa
mov ecx, 0x10
call fcn.1402bcb4c
mov qword [rsp + 0x58], rax
test rax, rax
je 0x140136de5
lea rdx, str.Erase
mov rcx, rax
call fcn.1401368d0
jmp 0x140136de8
mov rax, r13
mov r9, rax
xor r8d, r8d
mov edx, r14d
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageW]
mov rcx, r12
call fcn.140178220
test al, al
jne 0x140136e1a
lea r15, str.lock
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x140136f16
test rdi, rdi
je 0x140136e59
mov ecx, 0x10
call fcn.1402bcb4c
mov qword [rsp + 0x58], rax
test rax, rax
je 0x140136e44
lea rdx, str.Format
mov rcx, rax
call fcn.1401368d0
jmp 0x140136e47
mov rax, r13
mov r9, rax
xor r8d, r8d
mov edx, r14d
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageW]
lea rdx, str.HITMANPRO
mov rcx, rbx
call fcn.140137b50
test al, al
jne 0x140136e80
lea r15, str.format
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x140136f16
test rdi, rdi
je 0x140136ebf
mov ecx, 0x10
call fcn.1402bcb4c
mov qword [rsp + 0x58], rax
test rax, rax
je 0x140136eaa
lea rdx, str.Write
mov rcx, rax
call fcn.1401368d0
jmp 0x140136ead
mov rax, r13
mov r9, rax
xor r8d, r8d
mov edx, r14d
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageW]
lea rdx, [rbp - 0x20]
mov rcx, r12
call fcn.1401375b0
test al, al
jne 0x140136ed9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x140136f12
lea rcx, [rbp - 0x30]
call qword [sym.imp.RPCRT4.dll_UuidCreate]
mov r8d, 0xdddddddd
test eax, eax
cmove r8d, dword [rbp - 0x30]
mov rcx, r12
call fcn.140178300
test al, al
jne 0x140136f0d
lea r15, str.partitions
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x140136f16
mov byte [rsp + 0x50], 1
mov r15, qword [rbp - 0x20]
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
mov rcx, qword [r12 + 0x78]
test rcx, rcx
je 0x140136f66
mov qword [rsp + 0x38], r13
lea rax, [rbp - 0x68]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
mov edx, 0x90020
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
lea rcx, str.dismount
test eax, eax
cmovne rcx, r15
mov r15, rcx
mov bl, 1
mov rcx, qword [r12 + 0x78]
test rcx, rcx
je 0x140136fc4
mov qword [rsp + 0x38], r13
lea rax, [rbp - 0x64]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
mov edx, 0x9001c
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
movzx ebx, bl
test eax, eax
cmove ebx, r13d
mov rcx, qword [r12 + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [r12 + 0x78], r13
lea rax, str.unlock
test bl, bl
cmovne rax, r15
mov r15, rax
mov ecx, 0xd05
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, r12
call fcn.140178190
test al, al
jne 0x140136ff2
lea r15, str.update
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
xor bl, bl
mov byte [rsp + 0x50], bl
jmp 0x140136ff7
movzx ebx, byte [rsp + 0x50]
mov ecx, 0xd05
call qword [sym.imp.KERNEL32.dll_Sleep]
test bl, bl
je 0x140137362
mov rcx, r12
call fcn.140177f60
movzx ebx, al
mov byte [rsp + 0x50], al
test al, al
jne 0x14013702c
lea r15, str.volume
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test bl, bl
je 0x140137362
movabs rax, 0x5c003a005f
mov qword [rbp - 0x20], rax
movzx eax, word [r12 + 8]
mov word [rbp - 0x20], ax
mov rdx, qword [rbp - 0x70]
lea rcx, [rbp - 0x60]
call fcn.1400b91c0
nop
mov r14, qword [rbp - 0x58]
mov rax, r14
mov r12, qword [rbp - 0x60]
sub rax, r12
sar rax, 3
test rax, rax
je 0x1401371c6
nop word [rax + rax]
add r14, 0xfffffffffffffff8
mov rdi, qword [r14]
mov qword [rbp - 0x58], r14
test bl, bl
je 0x1401371af
mov rbx, qword [rbp - 0x78]
test rbx, rbx
je 0x140137101
mov ecx, 0x10
cmp byte [rdi + 0x10], 0
je 0x1401370cc
call fcn.1402bcb4c
mov qword [rsp + 0x58], rax
test rax, rax
je 0x1401370c7
lea r8, [0x14034d1a0]
mov rcx, rax
call fcn.1401369d0
jmp 0x1401370ca
mov rax, r13
jmp 0x1401370ec
call fcn.1402bcb4c
mov qword [rsp + 0x58], rax
test rax, rax
je 0x1401370e9
mov r8, qword [rdi + 8]
mov rcx, rax
call fcn.1401369d0
jmp 0x1401370ec
mov rax, r13
mov r9, rax
xor r8d, r8d
mov edx, dword [rbp + 0x270]
mov rcx, rbx
call qword [sym.imp.USER32.dll_PostMessageW]
mov r8, qword [rdi + 8]
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x10]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
test rax, rax
je 0x1401371aa
mov ebx, 3
nop dword [rax]
nop word [rax + rax]
xor r8d, r8d
lea rdx, [rbp - 0x10]
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x140137195
lea r15, str.copy
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov r8d, eax
lea rdx, [rbp - 0x10]
lea rcx, str._s_error__d_r_n
call fcn.1402bf424
cmp esi, 0x15
jne 0x140137187
cmp ebx, 1
jle 0x140137187
lea rcx, str.____retrying..._r_n
call fcn.1402bf424
mov ecx, 0xd05
call qword [sym.imp.KERNEL32.dll_Sleep]
dec ebx
test ebx, ebx
jg 0x140137130
xor bl, bl
mov byte [rsp + 0x50], bl
jmp 0x1401371af
cmp byte [rdi + 0x10], 0
je 0x1401371aa
mov edx, 2
lea rcx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
movzx ebx, byte [rsp + 0x50]
mov rax, r14
sub rax, r12
sar rax, 3
test rax, rax
jne 0x140137080
mov rdi, qword [rbp - 0x78]
test r12, r12
je 0x1401371d3
mov rcx, r12
call fcn.14021ae20
test bl, bl
je 0x140137357
test rdi, rdi
je 0x140137223
mov ecx, 0x10
call fcn.1402bcb4c
mov qword [rsp + 0x58], rax
test rax, rax
je 0x140137205
lea rdx, str.Remove
mov rcx, rax
call fcn.1401368d0
jmp 0x140137208
mov rax, r13
mov r9, rax
xor r8d, r8d
mov r14d, dword [rbp + 0x270]
mov edx, r14d
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x14013722a
mov r14d, dword [rbp + 0x270]
mov r12, qword [rbp - 0x80]
mov rcx, r12
call fcn.140177e00
mov ecx, 0xd05
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x140431ac0]
test al, 1
jne 0x140137279
or eax, 1
mov dword [0x140431ac0], eax
lea rax, vtable.Core::Win32::RegistryKey.0
mov qword [0x140431ac8], rax
mov qword [0x140431ad0], 0xffffffff80000002
lea rcx, [0x1403050b0]
call fcn.1402be804
mov qword [rbp - 0x20], r13
mov qword [rsp + 0x40], r13
lea rax, [rbp - 0x20]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140352cb8]
mov rcx, qword [0x140431ad0]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ebx, eax
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
jne 0x1401372e9
lea ecx, [rbx + 0x10]
call fcn.1402bcb4c
mov rbx, rax
test rax, rax
je 0x1401372e9
mov rax, qword [rbp - 0x20]
lea rcx, vtable.Core::Win32::RegistryKey.0
mov qword [rbx], rcx
mov qword [rbx + 8], rax
jmp 0x1401372ec
mov rbx, r13
test rbx, rbx
je 0x140137350
lea rcx, [rbp - 0x60]
call fcn.1400cafe0
nop
lea rdx, [rbp - 0x48]
mov rcx, rax
call fcn.1400cb0d0
mov ecx, dword [rax + 0xc]
mov rdx, qword [rax]
lea eax, [rcx + rcx]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
mov r9d, 1
xor r8d, r8d
lea rdx, str.LastKickstartCreated
mov rcx, qword [rbx + 8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp dword [rbp - 0x40], 0
jle 0x140137343
mov rcx, qword [rbp - 0x48]
call fcn.1402bd0e0
nop
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
movzx ebx, byte [rsp + 0x50]
jmp 0x140137362
mov r14d, dword [rbp + 0x270]
mov r12, qword [rbp - 0x80]
test rdi, rdi
je 0x1401374e2
test bl, bl
jne 0x1401374aa
mov qword [rsp + 0x78], r13
mov edx, 0x11
lea rcx, [rsp + 0x70]
call fcn.1402028a0
mov eax, dword [rsp + 0x78]
inc eax
movsxd rdx, eax
mov r9d, 0x11
lea r8, str.Kickstart_Failure
mov rcx, qword [rsp + 0x70]
call fcn.1402c06dc
mov edx, 0x11
lea rcx, [rsp + 0x70]
call fcn.140203bb0
nop
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x60]
call fcn.1400f6d90
nop
cmp dword [rsp + 0x78], 0
jle 0x1401373d8
mov rcx, qword [rsp + 0x70]
call fcn.1402bd0e0
lea rdx, str._r_n_r_n
lea rcx, [rsp + 0x60]
call fcn.140200ef0
mov r8d, esi
lea rdx, [0x140358878]
lea rcx, [rsp + 0x60]
call fcn.140201170
test r15, r15
je 0x140137416
mov r8, r15
lea rdx, [0x140358868]
lea rcx, [rsp + 0x60]
call fcn.140201170
mov r9d, 0x15
lea r8, [0x140358890]
mov rdx, qword [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 4
jne 0x140137450
cmp dword [rsp + 0x68], 0
jle 0x140136d20
mov rcx, qword [rsp + 0x60]
call fcn.1402bd0e0
jmp 0x140136d20
mov ecx, 0x10
call fcn.1402bcb4c
mov qword [rsp + 0x58], rax
test rax, rax
je 0x140137479
mov r8d, esi
lea rdx, str.Failed
mov rcx, rax
call fcn.140136b00
mov r13, rax
mov r9, r13
xor r8d, r8d
mov edx, r14d
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageW]
mov ecx, 0x29a
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
cmp dword [rsp + 0x68], 0
jle 0x1401374e2
mov rcx, qword [rsp + 0x60]
call fcn.1402bd0e0
jmp 0x1401374e2
mov ecx, 0x10
call fcn.1402bcb4c
mov qword [rsp + 0x58], rax
test rax, rax
je 0x1401374d0
lea rdx, str.Done
mov rcx, rax
call fcn.1401368d0
mov r13, rax
mov r9, r13
xor r8d, r8d
mov edx, r14d
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageW]
movzx eax, bl
mov rcx, qword [rbp + 0x200]
xor rcx, rsp
call fcn.1402bcad0
mov rbx, qword [rsp + 0x358]
add rsp, 0x310
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret