Function at 0x1400094a0
Capabilities:
Check if file exists
Create directory
Get file attributes
Write file on windows

Disassembly:
push rbp
push rdi
push r14
lea rbp, [rsp - 0x23e0]
mov eax, 0x24e0
call fcn.14001d860
sub rsp, rax
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x2508], rbx
mov qword [rsp + 0x2510], rsi
mov rax, qword [0x1400623d0]
xor rax, rsp
mov qword [rbp + 0x23d0], rax
mov rbx, rcx
xor r14d, r14d
mov dword [rbp + 0x17d0], r14d
xor edx, edx
mov r8d, 0x1fc
lea rcx, [rbp + 0x17d4]
call fcn.14001a650
mov dword [rbp + 0x19d0], r14d
xor edx, edx
mov r8d, 0x1fc
lea rcx, [rbp + 0x19d4]
call fcn.14001a650
mov dword [rbp + 0x11d0], r14d
xor edx, edx
mov r8d, 0x1fc
lea rcx, [rbp + 0x11d4]
call fcn.14001a650
mov dword [rbp + 0xdd0], r14d
xor edx, edx
mov r8d, 0x1fc
lea rcx, [rbp + 0xdd4]
call fcn.14001a650
mov dword [rbp + 0x1bd0], r14d
xor edx, edx
mov r8d, 0x1fc
lea rcx, [rbp + 0x1bd4]
call fcn.14001a650
mov dword [rbp + 0xfd0], r14d
xor edx, edx
mov r8d, 0x1fc
lea rcx, [rbp + 0xfd4]
call fcn.14001a650
mov dword [rbp + 0x13d0], r14d
xor edx, edx
mov r8d, 0x1fc
lea rcx, [rbp + 0x13d4]
call fcn.14001a650
mov dword [rbp + 0xbd0], r14d
xor edx, edx
mov r8d, 0x1fc
lea rcx, [rbp + 0xbd4]
call fcn.14001a650
mov qword [rsp + 0x58], r14
mov dword [rsp + 0x60], r14d
mov qword [rsp + 0x68], r14
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp + 0x7d0]
call fcn.14001a650
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp - 0x30]
call fcn.14001a650
mov rcx, rbx
call fcn.140005bd0
test eax, eax
je 0x14000a2b5
mov dword [rsp + 0x30], 1
lea rdi, [0x140065980]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x100
lea r9, [rbp - 0x30]
lea r8, [0x1400476d0]
lea rdx, str.RegFile
mov rcx, rbx
call fcn.14000e830
mov dword [rsp + 0x30], r14d
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x100
lea r9, [rbp + 0x17d0]
lea r8, [0x1400476d0]
lea rdx, str.DisplayName
mov rcx, rbx
call fcn.14000e830
mov dword [rsp + 0x30], r14d
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x100
lea r9, [rbp + 0x7d0]
lea r8, [0x1400476d0]
lea rdx, [0x14004b120]
mov rcx, rbx
call fcn.14000e830
mov dword [rsp + 0x30], r14d
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x100
lea r9, [rbp + 0x15d0]
lea r8, [0x1400476d0]
lea rdx, str.Default
mov rcx, rbx
call fcn.14000e830
mov dword [rsp + 0x30], r14d
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x100
lea r9, [rbp + 0xbd0]
lea r8, [0x1400476d0]
lea rdx, str.SortIndex
mov rcx, rbx
call fcn.14000e830
mov dword [rsp + 0x30], r14d
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x100
lea r9, [rbp + 0x19d0]
lea r8, [0x1400476d0]
lea rdx, str.ShowSearchSuggestions
mov rcx, rbx
call fcn.14000e830
mov dword [rsp + 0x30], r14d
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x100
lea r9, [rbp + 0x11d0]
lea r8, [0x1400476d0]
lea rdx, str.SuggestionsURL_JSON
mov rcx, rbx
call fcn.14000e830
mov dword [rsp + 0x30], r14d
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x100
lea r9, [rbp + 0xdd0]
lea r8, [0x1400476d0]
lea rdx, str.SuggestionsURL
mov rcx, rbx
call fcn.14000e830
mov dword [rsp + 0x30], r14d
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x100
lea r9, [rbp + 0x1bd0]
lea r8, [0x1400476d0]
lea rdx, str.FaviconURL
mov rcx, rbx
call fcn.14000e830
mov dword [rsp + 0x30], r14d
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x100
lea r9, [rbp + 0xfd0]
lea r8, [0x1400476d0]
lea rdx, str.FaviconPath
mov rcx, rbx
call fcn.14000e830
mov dword [rsp + 0x30], r14d
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x100
lea r9, [rbp + 0x13d0]
lea r8, [0x1400476d0]
lea rdx, str.PreviewURL
mov rcx, rbx
call fcn.14000e830
mov dword [rsp + 0x30], r14d
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x100
lea r9, [rbp + 0x9d0]
lea r8, [0x1400476d0]
lea rdx, str.UUID
mov rcx, rbx
call fcn.14000e830
lea rcx, [rbp + 0x9d0]
or rbx, 0xffffffffffffffff
mov rax, rbx
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x140009850
test rax, rax
jne 0x1400098a0
lea rcx, [rsp + 0x70]
call qword [sym.imp.ole32.dll_CoCreateGuid]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x70]
call qword [sym.imp.ole32.dll_StringFromCLSID]
mov rcx, qword [rsp + 0x48]
lea rdx, [rbp + 0x9d0]
sub rdx, rcx
nop dword [rax]
movzx eax, word [rcx]
mov word [rcx + rdx], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x140009890
lea r8, [rbp - 0x30]
lea rdx, [rbp + 0x7d0]
lea rcx, str._nCreating_IESearch__s_in_the_RegFile__s
call fcn.14000b8c0
lea rcx, [rbp + 0x7d0]
mov rax, rbx
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400098c1
test rax, rax
jne 0x1400098e1
lea rcx, str._nIESearchUrl_not_specified
call fcn.14001c2d0
jmp 0x14000a2b5
lea rcx, [rbp - 0x30]
mov rax, rbx
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400098f0
test rax, rax
jne 0x140009910
lea rcx, str._nRegFile_not_specified
call fcn.14001c2d0
jmp 0x14000a2b5
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140009a7b
movaps xmm0, xmmword [str.YWindows_Registry_Editor_Version_5.00_r_n]
movaps xmmword [rbp - 0x80], xmm0
movaps xmm1, xmmword [0x14004ab60]
movaps xmmword [rbp - 0x70], xmm1
movaps xmm0, xmmword [0x14004ab70]
movaps xmmword [rbp - 0x60], xmm0
movaps xmm1, xmmword [0x14004ab80]
movaps xmmword [rbp - 0x50], xmm1
movaps xmm0, xmmword [0x14004ab90]
movaps xmmword [rbp - 0x40], xmm0
mov eax, 0xfeff
mov word [rbp - 0x80], ax
lea rax, [rbp - 0x80]
mov rdi, rbx
nop word [rax + rax]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x140009970
add edi, edi
mov rcx, r14
nop
movzx eax, word [rbp + rcx - 0x30]
mov word [rbp + rcx + 0x1d0], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x140009980
mov esi, 0x5c
mov edx, esi
lea rcx, [rbp + 0x1d0]
call fcn.14001ae48
test rax, rax
je 0x1400099b2
mov word [rax], r14w
lea rdx, [0x140047570]
lea rcx, [rbp + 0x1d0]
call fcn.14001b0f4
test rax, rax
je 0x140009a0a
nop word [rax + rax]
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400099f1
xor edx, edx
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rdx, [0x140047570]
xor ecx, ecx
call fcn.14001b0f4
test rax, rax
je 0x140009a0a
mov word [rax - 2], si
jmp 0x1400099d0
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
test rax, rax
je 0x140009a61
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x40]
mov r8d, edi
lea rdx, [rbp - 0x80]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140009a7b
lea rdx, [rbp - 0x30]
lea rcx, str._nFailed_to_create__s_reg_file
call fcn.14000b8c0
mov dword [0x1400667b8], 1
lea rcx, [rbp + 0x7d0]
mov rax, rbx
inc rax
cmp word [rcx + rax*2], 0
jne 0x140009a85
test eax, eax
je 0x14000a29b
mov dword [rbp + 0x1dd0], r14d
xor edx, edx
mov r8d, 0x1fc
lea rcx, [rbp + 0x1dd4]
call fcn.14001a650
mov dword [rbp + 0x1fd0], r14d
xor edx, edx
mov r8d, 0x1fc
lea rcx, [rbp + 0x1fd4]
call fcn.14001a650
mov dword [rbp + 0x5d0], r14d
xor edx, edx
mov r8d, 0x1fc
lea rcx, [rbp + 0x5d4]
call fcn.14001a650
mov dword [rbp + 0x3d0], r14d
xor edx, edx
mov r8d, 0x1fc
lea rcx, [rbp + 0x3d4]
call fcn.14001a650
mov dword [rbp + 0x21d0], r14d
xor edx, edx
mov r8d, 0x1fc
lea rcx, [rbp + 0x21d4]
call fcn.14001a650
mov dword [rbp + 0x1d0], r14d
xor edx, edx
mov r8d, 0x1fc
lea rcx, [rbp + 0x1d4]
call fcn.14001a650
mov rcx, r14
lea rdi, [0x140000000]
nop word [rax + rax]
movzx eax, word [rcx + rdi + 0x4be60]
mov word [rbp + rcx + 0x1dd0], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x140009b50
mov rcx, r14
nop dword [rax]
movzx eax, word [rcx + rdi + 0x4bef0]
mov word [rbp + rcx + 0x1fd0], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x140009b70
lea r9, [rbp + 0x9d0]
lea r8, [rbp + 0x1dd0]
lea rdx, [0x140047fb8]
lea rcx, [rbp + 0x5d0]
call fcn.14001c9d4
lea r9, [rbp + 0x9d0]
lea r8, [rbp + 0x1fd0]
lea rdx, [0x140047fb8]
lea rcx, [rbp + 0x3d0]
call fcn.14001c9d4
mov rcx, r14
nop
movzx eax, word [rcx + rdi + 0x4bf80]
mov word [rbp + rcx + 0x21d0], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x140009bd0
lea r9, [rbp + 0x9d0]
lea r8, [rbp + 0x21d0]
lea rdx, [0x140047fb8]
lea rcx, [rbp + 0x1d0]
call fcn.14001c9d4
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
lea r9, [rbp - 0x30]
lea r8, [rbp + 0x17d0]
lea rdx, str.DisplayName
lea rcx, [rbp + 0x5d0]
call fcn.140014800
test eax, eax
je 0x14000a282
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], r14d
lea r9, [rbp - 0x30]
lea r8, [rbp + 0xfd0]
lea rdx, str.FaviconPath
lea rcx, [rbp + 0x5d0]
call fcn.140014800
test eax, eax
je 0x14000a282
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], r14d
lea r9, [rbp - 0x30]
lea r8, [rbp + 0x1bd0]
lea rdx, str.FaviconURL
lea rcx, [rbp + 0x5d0]
call fcn.140014800
test eax, eax
je 0x14000a282
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], r14d
lea r9, [rbp - 0x30]
lea r8, [rbp + 0x13d0]
lea rdx, str.PreviewUrl
lea rcx, [rbp + 0x5d0]
call fcn.140014800
test eax, eax
je 0x14000a282
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 3
lea r9, [rbp - 0x30]
lea r8, [rbp + 0x19d0]
lea rdx, str.ShowSearchSuggestions
lea rcx, [rbp + 0x5d0]
call fcn.140014800
test eax, eax
je 0x14000a282
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 3
lea r9, [rbp - 0x30]
lea r8, [rbp + 0xbd0]
lea rdx, str.SortIndex
lea rcx, [rbp + 0x5d0]
call fcn.140014800
test eax, eax
je 0x14000a282
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], r14d
lea r9, [rbp - 0x30]
lea r8, [rbp + 0xdd0]
lea rdx, str.SuggestionsURL
lea rcx, [rbp + 0x5d0]
call fcn.140014800
test eax, eax
je 0x14000a282
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], r14d
lea r9, [rbp - 0x30]
lea r8, [rbp + 0x11d0]
lea rdx, str.SuggestionsURL_JSON
lea rcx, [rbp + 0x5d0]
call fcn.140014800
test eax, eax
je 0x14000a282
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
lea r9, [rbp - 0x30]
lea r8, [rbp + 0x7d0]
lea rdx, [0x14004b120]
lea rcx, [rbp + 0x5d0]
call fcn.140014800
test eax, eax
je 0x14000a282
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
lea r9, [rbp - 0x30]
lea r8, [rbp + 0x17d0]
lea rdx, str.DisplayName
lea rcx, [rbp + 0x3d0]
call fcn.140014800
test eax, eax
je 0x14000a282
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], r14d
lea r9, [rbp - 0x30]
lea r8, [rbp + 0xfd0]
lea rdx, str.FaviconPath
lea rcx, [rbp + 0x3d0]
call fcn.140014800
test eax, eax
je 0x14000a282
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], r14d
lea r9, [rbp - 0x30]
lea r8, [rbp + 0x1bd0]
lea rdx, str.FaviconURL
lea rcx, [rbp + 0x3d0]
call fcn.140014800
test eax, eax
je 0x14000a282
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], r14d
lea r9, [rbp - 0x30]
lea r8, [rbp + 0x13d0]
lea rdx, str.PreviewUrl
lea rcx, [rbp + 0x3d0]
call fcn.140014800
test eax, eax
je 0x14000a282
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 3
lea r9, [rbp - 0x30]
lea r8, [rbp + 0x19d0]
lea rdx, str.ShowSearchSuggestions
lea rcx, [rbp + 0x3d0]
call fcn.140014800
test eax, eax
je 0x14000a282
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 3
lea r9, [rbp - 0x30]
lea r8, [rbp + 0xbd0]
lea rdx, str.SortIndex
lea rcx, [rbp + 0x3d0]
call fcn.140014800
test eax, eax
je 0x14000a282
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], r14d
lea r9, [rbp - 0x30]
lea r8, [rbp + 0xdd0]
lea rdx, str.SuggestionsURL
lea rcx, [rbp + 0x3d0]
call fcn.140014800
test eax, eax
je 0x14000a282
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], r14d
lea r9, [rbp - 0x30]
lea r8, [rbp + 0x11d0]
lea rdx, str.SuggestionsURL_JSON
lea rcx, [rbp + 0x3d0]
call fcn.140014800
test eax, eax
je 0x14000a282
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
lea r9, [rbp - 0x30]
lea r8, [rbp + 0x7d0]
lea rdx, [0x14004b120]
lea rcx, [rbp + 0x3d0]
call fcn.140014800
test eax, eax
je 0x14000a282
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
lea r9, [rbp - 0x30]
lea r8, [rbp + 0x17d0]
lea rdx, str.DisplayName
lea rcx, [rbp + 0x1d0]
call fcn.140014800
test eax, eax
je 0x14000a282
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], r14d
lea r9, [rbp - 0x30]
lea r8, [rbp + 0xfd0]
lea rdx, str.FaviconPath
lea rcx, [rbp + 0x1d0]
call fcn.140014800
test eax, eax
je 0x14000a282
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], r14d
lea r9, [rbp - 0x30]
lea r8, [rbp + 0x1bd0]
lea rdx, str.FaviconURL
lea rcx, [rbp + 0x1d0]
call fcn.140014800
test eax, eax
je 0x14000a282
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], r14d
lea r9, [rbp - 0x30]
lea r8, [rbp + 0x13d0]
lea rdx, str.PreviewUrl
lea rcx, [rbp + 0x1d0]
call fcn.140014800
test eax, eax
je 0x14000a282
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 3
lea r9, [rbp - 0x30]
lea r8, [rbp + 0x19d0]
lea rdx, str.ShowSearchSuggestions
lea rcx, [rbp + 0x1d0]
call fcn.140014800
test eax, eax
je 0x14000a282
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 3
lea r9, [rbp - 0x30]
lea r8, [rbp + 0xbd0]
lea rdx, str.SortIndex
lea rcx, [rbp + 0x1d0]
call fcn.140014800
test eax, eax
je 0x14000a282
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], r14d
lea r9, [rbp - 0x30]
lea r8, [rbp + 0xdd0]
lea rdx, str.SuggestionsURL
lea rcx, [rbp + 0x1d0]
call fcn.140014800
test eax, eax
je 0x14000a282
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], r14d
lea r9, [rbp - 0x30]
lea r8, [rbp + 0x11d0]
lea rdx, str.SuggestionsURL_JSON
lea rcx, [rbp + 0x1d0]
call fcn.140014800
test eax, eax
je 0x14000a282
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
lea r9, [rbp - 0x30]
lea r8, [rbp + 0x7d0]
lea rdx, [0x14004b120]
lea rcx, [rbp + 0x1d0]
call fcn.140014800
test eax, eax
je 0x14000a282
lea rax, [rbp + 0x15d0]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x14000a172
test rbx, rbx
je 0x14000a2b5
lea rdx, [0x1400481d4]
lea rcx, [rbp + 0x15d0]
call fcn.14001b25c
test eax, eax
je 0x14000a1e5
lea rdx, [0x14004bcec]
lea rcx, [rbp + 0x15d0]
call fcn.14001b25c
test eax, eax
je 0x14000a1e5
lea rdx, [0x14004bcf0]
lea rcx, [rbp + 0x15d0]
call fcn.14001b25c
test eax, eax
je 0x14000a1e5
lea rdx, [0x14004bcf8]
lea rcx, [rbp + 0x15d0]
call fcn.14001b25c
test eax, eax
jne 0x14000a2b5
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
lea r9, [rbp - 0x30]
lea r8, [rbp + 0x9d0]
lea rdx, str.DefaultScope
lea rcx, [rbp + 0x1dd0]
call fcn.140014800
test eax, eax
je 0x14000a269
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
lea r9, [rbp - 0x30]
lea r8, [rbp + 0x9d0]
lea rdx, str.DefaultScope
lea rcx, [rbp + 0x1fd0]
call fcn.140014800
test eax, eax
je 0x14000a269
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
lea r9, [rbp - 0x30]
lea r8, [rbp + 0x9d0]
lea rdx, str.DefaultScope
lea rcx, [rbp + 0x21d0]
call fcn.140014800
test eax, eax
jne 0x14000a2b5
lea r8, [rbp + 0x7d0]
lea rdx, [rbp - 0x30]
lea rcx, str._nError_Setting_IE_Search_Entry__s___s_as_Default
call fcn.14000b8c0
jmp 0x14000a2ab
lea r8, [rbp + 0x7d0]
lea rdx, [rbp - 0x30]
lea rcx, str._nError_Creating_IE_Search_Entry_in__s___s
call fcn.14000b8c0
jmp 0x14000a2ab
lea rdx, [rbp - 0x30]
lea rcx, str._nError_blank_IE_Search_URL_cannot_be_set_in__s
call fcn.14000b8c0
mov dword [0x1400667b8], 1
mov rcx, qword [rbp + 0x23d0]
xor rcx, rsp
call fcn.14001a120
lea r11, [rsp + 0x24e0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret