Function at 0x140031830
Capabilities:
Check if file exists
Get common file path
Get file attributes
Get file version info
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x4f8]
sub rsp, 0x5c0
movaps xmmword [rax - 0x48], xmm6
mov rax, qword [0x1400502a8]
xor rax, rsp
mov qword [rbp + 0x4a0], rax
xor r13d, r13d
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x68], r13
mov r14, rdx
mov qword [rbp - 0x70], r13
mov rdi, rcx
mov esi, r13d
test rdx, rdx
jne 0x14003188e
mov eax, 0x80004003
jmp 0x1400320f3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, r14
lea rdx, str.____Trust_on_catalog__S_beginning.__Last_result:_0x_x._r_n
mov r9d, eax
mov ecx, 4
call fcn.1400168a8
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r14
call fcn.140019028
test eax, eax
jns 0x1400318e0
mov r9d, eax
lea rdx, str.ERROR:_Trust_on_catalog__S_failed.__Error:_0x_x._r_n
mov r8, r14
mov ecx, 2
call fcn.1400168a8
mov eax, 0x80004005
jmp 0x1400320f3
lea rcx, [rbp - 0x68]
mov qword [rbp - 0x68], r13
mov qword [rbp - 0x60], r13
mov qword [rbp - 0x58], r13
mov qword [rbp - 0x50], r13
mov qword [rbp - 0x48], r13
call fcn.140038a38
test eax, eax
jne 0x140031945
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x57
lea rdx, str.ERROR:_Trust_on_catalog__S_failed.__Could_not_load_Crypto_Lib.__Last_result:_0x_x._r_n
test eax, eax
mov esi, 0x80004005
mov r8, r14
cmove eax, ecx
mov ecx, 2
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
cmovns ebx, esi
mov r9d, ebx
call fcn.1400168a8
jmp 0x1400320e2
mov rax, qword [rbp - 0x68]
lea rdx, [0x140048b78]
xor r8d, r8d
lea rcx, [rsp + 0x68]
call qword [0x14003f118]
test eax, eax
jne 0x140031992
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ecx, 0x57
cmove eax, ecx
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x1400320ac
mov ebx, 0x8007000d
jmp 0x1400320ac
mov r8, qword [rdi + 0x18]
mov ebx, r13d
test r8, r8
je 0x1400320dd
or rax, 0xffffffffffffffff
inc rax
cmp word [r8 + rax*2], r13w
jne 0x1400319a6
add rax, rax
mov r15d, 0x208
cmp rax, r15
jae 0x1400320dd
mov r12d, 0x104
lea rcx, [rbp + 0x80]
mov edx, r12d
call fcn.140001470
lea rcx, [rbp + 0x80]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
mov r8, r14
lea rcx, [rbp + 0x80]
mov edx, r12d
call fcn.140001584
lea rcx, [rbp + 0x80]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400320d6
test al, 0x10
jne 0x1400320d6
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
jne 0x140031a36
lea edx, [rcx + 5]
call fcn.140016188
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
je 0x140031a61
cmp dword [0x1400516e0], 4
jl 0x140031a61
lea r9, [rsp + 0x44]
mov dword [rsp + 0x44], r13d
mov r8d, 0x55
mov qword [rsp + 0x20], r13
lea rdx, str.____Got_catalog_context.__Attempting_to_determine_valid_name_for_installed_catalog._r_n
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, r15
call fcn.14003c460
mov qword [rbp - 0x78], rax
test rax, rax
je 0x140032064
lea rdx, [rbp + 0x80]
mov rcx, rax
call fcn.1400304b8
test eax, eax
js 0x14003203b
lea rcx, [rbp + 0x80]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
bt eax, 0xe
jae 0x140031afc
lea rcx, [rbp - 0x40]
mov qword [rbp - 0x40], r13
mov qword [rbp - 0x38], r13
call fcn.140016a3c
test eax, eax
je 0x140031aed
mov rax, qword [rbp - 0x40]
lea rcx, [rbp + 0x80]
xor edx, edx
call qword [0x14003f118]
test eax, eax
jne 0x140031aed
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, [rbp + 0x80]
mov ecx, 2
mov r9d, eax
lea rdx, str.ERROR:_Decryption_failed_for_file__S.__Last_result:_0x_x._r_n
call fcn.1400168a8
mov rcx, qword [rbp - 0x38]
test rcx, rcx
je 0x140031afc
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov r8, qword [rbp - 0x78]
lea rdx, [rbp + 0x80]
mov rcx, qword [rsp + 0x68]
xor r9d, r9d
mov rax, qword [rbp - 0x50]
call qword [0x14003f118]
mov qword [rbp - 0x70], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, r14
lea rdx, str.____Added_catalog__S.__Last_result:_0x_x._r_n
mov r9d, eax
mov ecx, 4
call fcn.1400168a8
cmp dword [0x140051710], r13d
jne 0x14003203b
mov eax, 1
lea rcx, [rbp + 0x290]
mov edx, 0x103
mov dword [0x140051710], eax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x14003203b
lea r8, str.CatRootF750E6C3_38EE_11D1_85E5_00C04FC295EEwmsocm.cat
mov dword [rsp + 0x4c], r13d
mov rdx, r12
mov dword [rsp + 0x44], r13d
lea rcx, [rbp + 0x290]
mov dword [rsp + 0x48], r13d
mov r15d, r13d
call fcn.140001584
lea rdx, [rsp + 0x58]
mov dword [rsp + 0x58], r13d
lea rcx, [rbp + 0x290]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov r12d, eax
xorps xmm6, xmm6
test eax, eax
jne 0x140031d69
lea rcx, [rbp + 0x290]
call fcn.140017488
test eax, eax
je 0x14003203b
xor r9d, r9d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x80
lea rcx, [rbp + 0x290]
xor edx, edx
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140032036
mov esi, 0x80004005
lea r9, [rsp + 0x78]
xor r8d, r8d
xor edx, edx
mov rcx, rax
mov r13d, esi
call qword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x140031d5e
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
test eax, eax
je 0x140031d5e
xor edx, edx
lea rcx, [rbp - 0x30]
mov r8d, 0xac
call sub.msvcrt.dll_memset
movzx eax, word [rbp - 0x40]
lea rcx, [rbp - 0x30]
movzx r12d, word [rbp - 0x3e]
xor r13d, r13d
mov dword [rsp + 0x4c], eax
movzx eax, word [rbp - 0x3a]
shl r12d, 0x10
or r12d, eax
mov dword [rsp + 0x44], r12d
call qword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
cmp eax, 0xffffffff
je 0x140031d5e
mov r8d, dword [rbp - 0x30]
lea r9d, [r13 + 1]
movzx eax, r8w
neg ax
test r8d, r8d
cmovg ax, r8w
movzx ecx, ax
mov eax, 0x88888889
mul ecx
movzx eax, word [rbp - 0x38]
movzx ecx, word [rbp - 0x3a]
shr edx, 5
cmp r8d, r9d
jge 0x140031cb9
add ax, dx
jmp 0x140031cd3
cmp ax, dx
jae 0x140031cd0
mov r8d, 0xffff
add cx, r8w
mov word [rbp - 0x3a], cx
add ax, 0x18
sub ax, dx
mov word [rbp - 0x38], ax
cmp ax, 0x17
jbe 0x140031d18
add cx, r9w
mov edx, 0xffe8
add ax, dx
mov word [rbp - 0x3a], cx
mov word [rbp - 0x38], ax
cmp cx, 0x20
jne 0x140031d18
movzx eax, word [rbp - 0x3e]
add ax, r9w
mov word [rbp - 0x3a], r9w
mov word [rbp - 0x3e], ax
cmp ax, 0xd
jne 0x140031d18
add word [rbp - 0x40], r9w
mov word [rbp - 0x3e], r9w
lea rdx, [rsp + 0x60]
movsd qword [rsp + 0x60], xmm6
lea rcx, [rbp - 0x40]
call qword [sym.imp.OLEAUT32.dll_VariantTimeToSystemTime]
test eax, eax
je 0x140031d5e
movsd xmm0, qword [rsp + 0x60]
lea rdx, [rbp - 0x40]
call qword [sym.imp.OLEAUT32.dll_UnRegisterTypeLib]
test eax, eax
je 0x140031d5e
movzx eax, word [rbp - 0x40]
movzx ecx, word [rbp - 0x3e]
mov dword [rsp + 0x4c], eax
movzx eax, word [rbp - 0x3a]
shl ecx, 0x10
or ecx, eax
mov dword [rsp + 0x44], ecx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140031dd8
mov rcx, r12
call fcn.14003c460
mov rdi, rax
test rax, rax
je 0x140032036
mov esi, 0x80004005
lea rcx, [rbp + 0x290]
mov r9, rax
mov r8d, r12d
xor edx, edx
mov r13d, esi
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x140031dd0
lea r9, [rsp + 0x70]
mov rcx, rdi
lea r8, [rbp - 0x80]
lea rdx, [0x140042140]
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x140031dd0
mov rax, qword [rbp - 0x80]
xor r13d, r13d
mov ecx, dword [rax + 8]
mov eax, dword [rax + 0xc]
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x4c], ecx
mov rcx, rdi
call fcn.14003c408
test r13d, r13d
jne 0x140032034
xor r13d, r13d
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x80]
mov dword [rsp + 0x58], r13d
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov r12d, eax
test eax, eax
jne 0x140031fad
lea rcx, [rbp + 0x80]
call fcn.140017488
test eax, eax
je 0x140032034
mov qword [rsp + 0x30], r13
lea r8d, [r13 + 1]
mov dword [rsp + 0x28], 0x80
lea rcx, [rbp + 0x80]
xor r9d, r9d
mov dword [rsp + 0x20], 3
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140032034
lea r9, [rbp - 0x80]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x140031f9d
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
test eax, eax
je 0x140031f9d
xor edx, edx
lea rcx, [rbp - 0x30]
mov r8d, 0xac
call sub.msvcrt.dll_memset
movzx r15d, word [rbp - 0x3e]
lea rcx, [rbp - 0x30]
movzx r12d, word [rbp - 0x40]
mov esi, r13d
movzx eax, word [rbp - 0x3a]
shl r15d, 0x10
or r15d, eax
mov dword [rsp + 0x48], r12d
call qword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
cmp eax, 0xffffffff
je 0x140031f9d
mov r8d, dword [rbp - 0x30]
lea r9d, [r13 + 1]
movzx ecx, r8w
mov eax, 0x88888889
neg cx
test r8d, r8d
cmovg cx, r8w
movzx ecx, cx
mul ecx
movzx eax, word [rbp - 0x38]
movzx ecx, word [rbp - 0x3a]
shr edx, 5
cmp r8d, r9d
jge 0x140031ef9
add ax, dx
jmp 0x140031f13
cmp ax, dx
jae 0x140031f10
mov r8d, 0xffff
add cx, r8w
mov word [rbp - 0x3a], cx
add ax, 0x18
sub ax, dx
mov word [rbp - 0x38], ax
cmp ax, 0x17
jbe 0x140031f58
add cx, r9w
mov edx, 0xffe8
add ax, dx
mov word [rbp - 0x3a], cx
mov word [rbp - 0x38], ax
cmp cx, 0x20
jne 0x140031f58
movzx eax, word [rbp - 0x3e]
add ax, r9w
mov word [rbp - 0x3a], r9w
mov word [rbp - 0x3e], ax
cmp ax, 0xd
jne 0x140031f58
add word [rbp - 0x40], r9w
mov word [rbp - 0x3e], r9w
lea rdx, [rsp + 0x60]
movsd qword [rsp + 0x60], xmm6
lea rcx, [rbp - 0x40]
call qword [sym.imp.OLEAUT32.dll_VariantTimeToSystemTime]
test eax, eax
je 0x140031f9d
movsd xmm0, qword [rsp + 0x60]
lea rdx, [rbp - 0x40]
call qword [sym.imp.OLEAUT32.dll_UnRegisterTypeLib]
test eax, eax
je 0x140031f9d
movzx eax, word [rbp - 0x40]
movzx r15d, word [rbp - 0x3e]
mov dword [rsp + 0x48], eax
movzx eax, word [rbp - 0x3a]
shl r15d, 0x10
or r15d, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r12d, dword [rsp + 0x48]
jmp 0x140032013
mov rcx, r12
call fcn.14003c460
mov rdi, rax
test rax, rax
je 0x140032034
mov r9, rax
lea rcx, [rbp + 0x80]
mov r8d, r12d
xor edx, edx
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x140032006
lea r9, [rsp + 0x70]
mov rcx, rdi
lea r8, [rsp + 0x78]
lea rdx, [0x140042140]
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x140032006
mov rax, qword [rsp + 0x78]
mov esi, r13d
mov r12d, dword [rax + 8]
mov r15d, dword [rax + 0xc]
jmp 0x14003200b
mov r12d, dword [rsp + 0x48]
mov rcx, rdi
call fcn.14003c408
test esi, esi
jne 0x140032034
cmp r12d, dword [rsp + 0x4c]
jne 0x140032025
cmp r15d, dword [rsp + 0x44]
je 0x140032034
mov eax, 1
mov dword [0x140051710], eax
mov esi, eax
jmp 0x140032036
mov esi, ebx
mov rdi, qword [rsp + 0x50]
mov rcx, qword [rbp - 0x78]
call fcn.14003c408
mov rax, qword [rbp - 0x70]
test rax, rax
je 0x140032064
mov rcx, qword [rsp + 0x68]
mov rdx, rax
mov rax, qword [rbp - 0x58]
xor r8d, r8d
call qword [0x14003f118]
jmp 0x14003209b
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
mov ebx, 0x8007000d
or ecx, 0x80070000
lea rdx, str.ERROR:_Could_not_add_catalog__S.__Result:_0x_x._r_n
test eax, eax
mov r8, r14
cmovle ecx, eax
test ecx, ecx
cmovns ecx, ebx
mov ebx, ecx
mov r9d, ecx
mov ecx, 2
call fcn.1400168a8
mov rcx, qword [rsp + 0x68]
xor edx, edx
mov rax, qword [rbp - 0x60]
call qword [0x14003f118]
mov r9d, ebx
lea rdx, str.____Trust_on_catalog__S_complete.__Result:_0x_x._r_n
mov r8, r14
mov ecx, 4
call fcn.1400168a8
test esi, esi
je 0x1400320e2
mov rdx, r14
mov rcx, rdi
call fcn.140031830
mov ebx, eax
jmp 0x1400320e2
mov ebx, 0x80070002
jmp 0x1400320e2
mov ebx, 0x8000ffff
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x1400320f1
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rbp + 0x4a0]
xor rcx, rsp
call fcn.14003c810
lea r11, [rsp + 0x5c0]
mov rbx, qword [r11 + 0x50]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret