Function at 0x160183d78
Capabilities:
Create thread
Set registry value

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0xb18]
sub rsp, 0xc00
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rax, qword [0x160270bd8]
xor rax, rsp
mov qword [rbp + 0xaf0], rax
mov rbx, rcx
xor r14d, r14d
mov dword [rsp + 0x50], r14d
or r15, 0xffffffffffffffff
mov qword [rsp + 0x58], r15
lea rcx, [rsp + 0x50]
call fcn.1600ce130
nop
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov esi, 0xc0041801
mov dword [rsp + 0x20], esi
mov r9d, reloc.OLEAUT32.dll_VarDecRound
mov rcx, rbx
call fcn.160183c10
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1600bfd80]
lea rcx, [0x160273cd0]
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_InitOnceExecuteOnce]
cmp byte [0x1602742e0], r14b
je 0x160183f93
call fcn.1601a78b4
test rax, rax
je 0x160183f93
call fcn.1601a78b4
mov rdi, rax
test rbx, rbx
je 0x160183ec2
mov rdx, rbx
lea rcx, [rsp + 0x70]
call fcn.1600c0044
nop
lea rdx, [0x1601d4934]
test rdi, rdi
cmovne rdx, rdi
mov rax, qword [rsp + 0x78]
or ebx, 0xffffffff
mov r9d, ebx
xor r8d, r8d
lea rcx, [rsp + 0x78]
mov rax, qword [rax + 0x20]
call qword [case.0x16003fc5a.0]
mov rax, qword [rbp + 0x18]
mov r9d, ebx
xor r8d, r8d
lea rdx, [0x1601d4934]
lea rcx, [rbp + 0x18]
mov rax, qword [rax + 0x20]
call qword [case.0x16003fc5a.0]
mov edx, esi
lea rcx, [rsp + 0x70]
call fcn.1600cd1d8
xor r9d, r9d
lea r8, str.The_catalog_is_corrupt
mov edx, 0xc0001b80
lea rcx, [rsp + 0x70]
call fcn.1600c1b70
nop
lea rcx, [rsp + 0x70]
call fcn.1600c0898
mov rax, r15
inc rax
cmp word [rdi + rax*2], r14w
jne 0x160183ec5
lea rsi, [rax + 1]
mov eax, 2
mul rsi
cmovo rax, r15
lea rdx, [0x1601d7c98]
mov rcx, rax
call fcn.16006eafc
mov rbx, rax
test rax, rax
jne 0x160183f1a
mov rcx, qword [rbp + 0xb18]
mov edi, 0x8007000e
mov r9d, edi
lea r8, str.onecoreuap_base_appmodel_search_searchcommoninclude_recovery.h
mov edx, 0xb3
call fcn.1600b29f8
xor ecx, ecx
jmp 0x160183f4c
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call fcn.1600b2fdc
mov edi, eax
test eax, eax
jns 0x160183f56
mov rcx, qword [rbp + 0xb18]
mov r9d, eax
lea r8, str.onecoreuap_base_appmodel_search_searchcommoninclude_recovery.h
mov edx, VariantTimeToSystemTime
call fcn.1600b29f8
mov rcx, rbx
call fcn.160031c48
jmp 0x16018404a
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
mov r9, rbx
lea r8, [0x1601840a0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x160183f87
mov rcx, rax
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
xor ecx, ecx
call fcn.160031c48
jmp 0x160184047
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
lea rdx, str.SOFTWAREMicrosoftWindows_Search
mov rcx, 0xffffffff80000002
call fcn.16005ab8c
test eax, eax
jle 0x160183fc4
movzx eax, ax
or eax, 0x80070000
test eax, eax
js 0x160184002
mov dword [rsp + 0x40], 3
mov r9d, 4
mov dword [rsp + 0x28], r9d
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r8, str.RebuildIndex
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHSetValueW]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x8e0]
call sub.msvcrt.dll_memset
xor r9d, r9d
lea r8, [rbp + 0x8e0]
mov edx, esi
call fcn.1600cb4d0
cmp dword [0x160274470], r14d
jne 0x160184047
call fcn.16016b828
mov rcx, rbx
call fcn.1600c1fbc
mov dword [0x160274470], 1
mov edi, r14d
lea rcx, [rsp + 0x50]
call fcn.1600ce108
mov eax, edi
mov rcx, qword [rbp + 0xaf0]
xor rcx, rsp
call fcn.16006e590
lea r11, [rsp + 0xc00]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret