Function at 0x16014e758
Capabilities:
Create thread
Set registry value

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xb28]
sub rsp, 0xc00
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rax, qword [0x160270bd8]
xor rax, rsp
mov qword [rbp + 0xaf0], rax
mov ebx, r9d
mov rsi, rcx
mov r14d, dword [rbp + 0xb50]
mov rdi, qword [rbp + 0xb58]
xor r12d, r12d
mov dword [rsp + 0x50], r12d
or r13, 0xffffffffffffffff
mov qword [rsp + 0x58], r13
lea rcx, [rsp + 0x50]
call fcn.1600ce130
nop
mov r15, qword [rbp + 0xb60]
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], r14d
mov r9d, ebx
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call fcn.16014b6a0
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1600bfd80]
lea rcx, [0x160273cd0]
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_InitOnceExecuteOnce]
cmp byte [0x1602742e0], r12b
je 0x16014e990
call fcn.1601a78b4
test rax, rax
je 0x16014e990
call fcn.1601a78b4
mov rdi, rax
test rsi, rsi
je 0x16014e8bf
mov rdx, rsi
lea rcx, [rsp + 0x70]
call fcn.1600c0044
nop
lea rdx, [0x1601d4934]
test rdi, rdi
cmovne rdx, rdi
mov rax, qword [rsp + 0x78]
or ebx, 0xffffffff
mov r9d, ebx
xor r8d, r8d
lea rcx, [rsp + 0x78]
mov rax, qword [rax + 0x20]
call qword [case.0x16003fc5a.0]
mov rax, qword [rbp + 0x18]
mov r9d, ebx
xor r8d, r8d
lea rdx, [0x1601d4934]
lea rcx, [rbp + 0x18]
mov rax, qword [rax + 0x20]
call qword [case.0x16003fc5a.0]
mov edx, 0xc0041801
lea rcx, [rsp + 0x70]
call fcn.1600cd1d8
xor r9d, r9d
lea r8, str.The_catalog_is_corrupt
mov edx, 0xc0001b80
lea rcx, [rsp + 0x70]
call fcn.1600c1b70
nop
lea rcx, [rsp + 0x70]
call fcn.1600c0898
mov rax, r13
inc rax
cmp word [rdi + rax*2], r12w
jne 0x16014e8c2
lea rsi, [rax + 1]
mov eax, 2
mul rsi
cmovo rax, r13
lea rdx, [0x1601d7c98]
mov rcx, rax
call fcn.16006eafc
mov rbx, rax
test rax, rax
jne 0x16014e917
mov rcx, qword [rbp + 0xb28]
mov edi, 0x8007000e
mov r9d, edi
lea r8, str.onecoreuap_base_appmodel_search_searchcommoninclude_recovery.h
mov edx, 0xb3
call fcn.1600b29f8
xor ecx, ecx
jmp 0x16014e949
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call fcn.1600b2fdc
mov edi, eax
test eax, eax
jns 0x16014e953
mov rcx, qword [rbp + 0xb28]
mov r9d, eax
lea r8, str.onecoreuap_base_appmodel_search_searchcommoninclude_recovery.h
mov edx, VariantTimeToSystemTime
call fcn.1600b29f8
mov rcx, rbx
call fcn.160031c48
jmp 0x16014ea8b
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r12d
mov r9, rbx
lea r8, [0x1601840a0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x16014e984
mov rcx, rax
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
xor ecx, ecx
call fcn.160031c48
jmp 0x16014ea88
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
lea rdx, str.SOFTWAREMicrosoftWindows_Search
mov rcx, 0xffffffff80000002
call fcn.16005ab8c
test eax, eax
jle 0x16014e9c1
movzx eax, ax
or eax, 0x80070000
test eax, eax
js 0x16014e9ff
mov dword [rsp + 0x40], 3
mov r9d, 4
mov dword [rsp + 0x28], r9d
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r8, str.RebuildIndex
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHSetValueW]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x8e0]
call sub.msvcrt.dll_memset
test rdi, rdi
je 0x16014ea3f
mov r9, rdi
lea r8, [0x1601f9764]
mov edx, 0x104
lea rcx, [rbp + 0x8e0]
call fcn.160059e34
test eax, eax
jns 0x16014ea3f
mov word [rbp + 0x8e0], r12w
mov r9, r15
lea r8, [rbp + 0x8e0]
mov edx, r14d
call fcn.1600cb4d0
cmp dword [0x160274470], r12d
jne 0x16014ea88
call fcn.16016b828
lea rax, str.The_catalog_is_corrupt
mov qword [rsp + 0x20], rax
mov r9d, 0xc0041801
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call fcn.16016c58c
mov dword [0x160274470], 1
mov edi, r12d
lea rcx, [rsp + 0x50]
call fcn.1600ce108
mov eax, edi
mov rcx, qword [rbp + 0xaf0]
xor rcx, rsp
call fcn.16006e590
lea r11, [rsp + 0xc00]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret