Function at 0x1401352d0
Capabilities:
Copy file
Set file attributes
Set registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x210]
sub rsp, 0x310
mov qword [rbp - 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x358], rbx
mov rax, qword [0x140418a10]
xor rax, rsp
mov qword [rbp + 0x200], rax
mov rdi, r9
mov qword [rbp - 0x78], r9
mov qword [rbp - 0x70], r8
mov r12, rcx
mov qword [rbp - 0x80], rcx
xor r13d, r13d
mov r14d, dword [rbp + 0x270]
nop dword [rax + rax]
mov esi, r13d
mov r15, r13
mov qword [rbp - 0x20], r13
xor bl, bl
mov byte [rsp + 0x50], bl
test rdi, rdi
je 0x14013537f
mov ecx, 0x10
call fcn.1402b968c
mov qword [rsp + 0x58], rax
test rax, rax
je 0x14013536a
lea rdx, str.Prepare
mov rcx, rax
call fcn.140134ee0
jmp 0x14013536d
mov rax, r13
mov r9, rax
xor r8d, r8d
mov edx, r14d
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageW]
mov rcx, r12
call fcn.1401763d0
test al, al
jne 0x14013539f
lea r15, str.lock
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x140135972
mov ecx, 0x18
call fcn.1402b968c
mov rbx, rax
test rax, rax
je 0x140135533
lea rax, vtable.HitmanPro35::Kickstart::Fat32.0
mov qword [rbx], rax
mov qword [rbx + 8], r12
mov qword [rbx + 0x10], 0x3f
test rdi, rdi
je 0x14013540a
mov ecx, 0x10
call fcn.1402b968c
mov qword [rsp + 0x58], rax
test rax, rax
je 0x1401353f5
lea rdx, str.Erase
mov rcx, rax
call fcn.140134ee0
jmp 0x1401353f8
mov rax, r13
mov r9, rax
xor r8d, r8d
mov edx, r14d
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageW]
mov rcx, r12
call fcn.1401765e0
test al, al
jne 0x14013542a
lea r15, str.lock
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x140135526
test rdi, rdi
je 0x140135469
mov ecx, 0x10
call fcn.1402b968c
mov qword [rsp + 0x58], rax
test rax, rax
je 0x140135454
lea rdx, str.Format
mov rcx, rax
call fcn.140134ee0
jmp 0x140135457
mov rax, r13
mov r9, rax
xor r8d, r8d
mov edx, r14d
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageW]
lea rdx, str.HITMANPRO
mov rcx, rbx
call fcn.140136160
test al, al
jne 0x140135490
lea r15, str.format
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x140135526
test rdi, rdi
je 0x1401354cf
mov ecx, 0x10
call fcn.1402b968c
mov qword [rsp + 0x58], rax
test rax, rax
je 0x1401354ba
lea rdx, str.Write
mov rcx, rax
call fcn.140134ee0
jmp 0x1401354bd
mov rax, r13
mov r9, rax
xor r8d, r8d
mov edx, r14d
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageW]
lea rdx, [rbp - 0x20]
mov rcx, r12
call fcn.140135bc0
test al, al
jne 0x1401354e9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x140135522
lea rcx, [rbp - 0x30]
call qword [sym.imp.RPCRT4.dll_UuidCreate]
mov r8d, 0xdddddddd
test eax, eax
cmove r8d, dword [rbp - 0x30]
mov rcx, r12
call fcn.1401766c0
test al, al
jne 0x14013551d
lea r15, str.partitions
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x140135526
mov byte [rsp + 0x50], 1
mov r15, qword [rbp - 0x20]
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
mov rcx, qword [r12 + 0x78]
test rcx, rcx
je 0x140135576
mov qword [rsp + 0x38], r13
lea rax, [rbp - 0x68]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
mov edx, 0x90020
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
lea rcx, str.dismount
test eax, eax
cmovne rcx, r15
mov r15, rcx
mov bl, 1
mov rcx, qword [r12 + 0x78]
test rcx, rcx
je 0x1401355d4
mov qword [rsp + 0x38], r13
lea rax, [rbp - 0x64]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
mov edx, 0x9001c
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
movzx ebx, bl
test eax, eax
cmove ebx, r13d
mov rcx, qword [r12 + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [r12 + 0x78], r13
lea rax, str.unlock
test bl, bl
cmovne rax, r15
mov r15, rax
mov ecx, 0xd05
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, r12
call fcn.140176550
test al, al
jne 0x140135602
lea r15, str.update
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
xor bl, bl
mov byte [rsp + 0x50], bl
jmp 0x140135607
movzx ebx, byte [rsp + 0x50]
mov ecx, 0xd05
call qword [sym.imp.KERNEL32.dll_Sleep]
test bl, bl
je 0x140135972
mov rcx, r12
call fcn.140176320
movzx ebx, al
mov byte [rsp + 0x50], al
test al, al
jne 0x14013563c
lea r15, str.volume
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test bl, bl
je 0x140135972
movabs rax, 0x5c003a005f
mov qword [rbp - 0x20], rax
movzx eax, word [r12 + 8]
mov word [rbp - 0x20], ax
mov rdx, qword [rbp - 0x70]
lea rcx, [rbp - 0x60]
call fcn.1400b91c0
nop
mov r14, qword [rbp - 0x58]
mov rax, r14
mov r12, qword [rbp - 0x60]
sub rax, r12
sar rax, 3
test rax, rax
je 0x1401357d6
nop word [rax + rax]
add r14, 0xfffffffffffffff8
mov rdi, qword [r14]
mov qword [rbp - 0x58], r14
test bl, bl
je 0x1401357bf
mov rbx, qword [rbp - 0x78]
test rbx, rbx
je 0x140135711
mov ecx, 0x10
cmp byte [rdi + 0x10], 0
je 0x1401356dc
call fcn.1402b968c
mov qword [rsp + 0x58], rax
test rax, rax
je 0x1401356d7
lea r8, [0x140348ca0]
mov rcx, rax
call fcn.140134fe0
jmp 0x1401356da
mov rax, r13
jmp 0x1401356fc
call fcn.1402b968c
mov qword [rsp + 0x58], rax
test rax, rax
je 0x1401356f9
mov r8, qword [rdi + 8]
mov rcx, rax
call fcn.140134fe0
jmp 0x1401356fc
mov rax, r13
mov r9, rax
xor r8d, r8d
mov edx, dword [rbp + 0x270]
mov rcx, rbx
call qword [sym.imp.USER32.dll_PostMessageW]
mov r8, qword [rdi + 8]
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x10]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
test rax, rax
je 0x1401357ba
mov ebx, 3
nop dword [rax]
nop word [rax + rax]
xor r8d, r8d
lea rdx, [rbp - 0x10]
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x1401357a5
lea r15, str.copy
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov r8d, eax
lea rdx, [rbp - 0x10]
lea rcx, str._s_error__d_r_n
call fcn.1402bbf64
cmp esi, 0x15
jne 0x140135797
cmp ebx, 1
jle 0x140135797
lea rcx, str.____retrying..._r_n
call fcn.1402bbf64
mov ecx, 0xd05
call qword [sym.imp.KERNEL32.dll_Sleep]
dec ebx
test ebx, ebx
jg 0x140135740
xor bl, bl
mov byte [rsp + 0x50], bl
jmp 0x1401357bf
cmp byte [rdi + 0x10], 0
je 0x1401357ba
mov edx, 2
lea rcx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
movzx ebx, byte [rsp + 0x50]
mov rax, r14
sub rax, r12
sar rax, 3
test rax, rax
jne 0x140135690
mov rdi, qword [rbp - 0x78]
test r12, r12
je 0x1401357e3
mov rcx, r12
call fcn.1402177e0
test bl, bl
je 0x140135967
test rdi, rdi
je 0x140135833
mov ecx, 0x10
call fcn.1402b968c
mov qword [rsp + 0x58], rax
test rax, rax
je 0x140135815
lea rdx, str.Remove
mov rcx, rax
call fcn.140134ee0
jmp 0x140135818
mov rax, r13
mov r9, rax
xor r8d, r8d
mov r14d, dword [rbp + 0x270]
mov edx, r14d
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x14013583a
mov r14d, dword [rbp + 0x270]
mov r12, qword [rbp - 0x80]
mov rcx, r12
call fcn.1401761c0
mov ecx, 0xd05
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x14042c9e0]
test al, 1
jne 0x140135889
or eax, 1
mov dword [0x14042c9e0], eax
lea rax, vtable.Core::Win32::RegistryKey.0
mov qword [0x14042c9e8], rax
mov qword [0x14042c9f0], 0xffffffff80000002
lea rcx, [0x1403017d0]
call fcn.1402bb344
mov qword [rbp - 0x20], r13
mov qword [rsp + 0x40], r13
lea rax, [rbp - 0x20]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x14034ee50]
mov rcx, qword [0x14042c9f0]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ebx, eax
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
jne 0x1401358f9
lea ecx, [rbx + 0x10]
call fcn.1402b968c
mov rbx, rax
test rax, rax
je 0x1401358f9
mov rax, qword [rbp - 0x20]
lea rcx, vtable.Core::Win32::RegistryKey.0
mov qword [rbx], rcx
mov qword [rbx + 8], rax
jmp 0x1401358fc
mov rbx, r13
test rbx, rbx
je 0x140135960
lea rcx, [rbp - 0x60]
call fcn.1400cafe0
nop
lea rdx, [rbp - 0x48]
mov rcx, rax
call fcn.1400cb0d0
mov ecx, dword [rax + 0xc]
mov rdx, qword [rax]
lea eax, [rcx + rcx]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
mov r9d, 1
xor r8d, r8d
lea rdx, str.LastKickstartCreated
mov rcx, qword [rbx + 8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp dword [rbp - 0x40], 0
jle 0x140135953
mov rcx, qword [rbp - 0x48]
call fcn.1402b9c20
nop
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
movzx ebx, byte [rsp + 0x50]
jmp 0x140135972
mov r14d, dword [rbp + 0x270]
mov r12, qword [rbp - 0x80]
test rdi, rdi
je 0x140135af2
test bl, bl
jne 0x140135aba
mov qword [rsp + 0x78], r13
mov edx, 0x11
lea rcx, [rsp + 0x70]
call fcn.1401ff260
mov eax, dword [rsp + 0x78]
inc eax
movsxd rdx, eax
mov r9d, 0x11
lea r8, str.Kickstart_Failure
mov rcx, qword [rsp + 0x70]
call fcn.1402bd21c
mov edx, 0x11
lea rcx, [rsp + 0x70]
call fcn.140200570
nop
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x60]
call fcn.1400f57b0
nop
cmp dword [rsp + 0x78], 0
jle 0x1401359e8
mov rcx, qword [rsp + 0x70]
call fcn.1402b9c20
lea rdx, str._r_n_r_n
lea rcx, [rsp + 0x60]
call fcn.1401fd8b0
mov r8d, esi
lea rdx, [0x1403542b0]
lea rcx, [rsp + 0x60]
call fcn.1401fdb30
test r15, r15
je 0x140135a26
mov r8, r15
lea rdx, [0x140354308]
lea rcx, [rsp + 0x60]
call fcn.1401fdb30
mov r9d, 0x15
lea r8, [0x1403542e0]
mov rdx, qword [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 4
jne 0x140135a60
cmp dword [rsp + 0x68], 0
jle 0x140135330
mov rcx, qword [rsp + 0x60]
call fcn.1402b9c20
jmp 0x140135330
mov ecx, 0x10
call fcn.1402b968c
mov qword [rsp + 0x58], rax
test rax, rax
je 0x140135a89
mov r8d, esi
lea rdx, str.Failed
mov rcx, rax
call fcn.140135110
mov r13, rax
mov r9, r13
xor r8d, r8d
mov edx, r14d
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageW]
mov ecx, 0x29a
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
cmp dword [rsp + 0x68], 0
jle 0x140135af2
mov rcx, qword [rsp + 0x60]
call fcn.1402b9c20
jmp 0x140135af2
mov ecx, 0x10
call fcn.1402b968c
mov qword [rsp + 0x58], rax
test rax, rax
je 0x140135ae0
lea rdx, str.Done
mov rcx, rax
call fcn.140134ee0
mov r13, rax
mov r9, r13
xor r8d, r8d
mov edx, r14d
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageW]
movzx eax, bl
mov rcx, qword [rbp + 0x200]
xor rcx, rsp
call fcn.1402b9610
mov rbx, qword [rsp + 0x358]
add rsp, 0x310
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret