Function at 0x140031740
Capabilities:
Check if file exists
Get common file path
Get file attributes
Get file version info
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x4f8]
sub rsp, 0x5c0
movaps xmmword [rax - 0x48], xmm6
mov rax, qword [0x1400502a8]
xor rax, rsp
mov qword [rbp + 0x4a0], rax
xor r13d, r13d
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x68], r13
mov r14, rdx
mov qword [rbp - 0x70], r13
mov rdi, rcx
mov esi, r13d
test rdx, rdx
jne 0x14003179e
mov eax, 0x80004003
jmp 0x140032003
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, r14
lea rdx, str.____Trust_on_catalog__S_beginning.__Last_result:_0x_x._r_n
mov r9d, eax
mov ecx, 4
call fcn.140016868
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r14
call fcn.140018fe0
test eax, eax
jns 0x1400317f0
mov r9d, eax
lea rdx, str.ERROR:_Trust_on_catalog__S_failed.__Error:_0x_x._r_n
mov r8, r14
mov ecx, 2
call fcn.140016868
mov eax, 0x80004005
jmp 0x140032003
lea rcx, [rbp - 0x68]
mov qword [rbp - 0x68], r13
mov qword [rbp - 0x60], r13
mov qword [rbp - 0x58], r13
mov qword [rbp - 0x50], r13
mov qword [rbp - 0x48], r13
call fcn.140038918
test eax, eax
jne 0x140031855
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x57
lea rdx, str.ERROR:_Trust_on_catalog__S_failed.__Could_not_load_Crypto_Lib.__Last_result:_0x_x._r_n
test eax, eax
mov esi, 0x80004005
mov r8, r14
cmove eax, ecx
mov ecx, 2
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
cmovns ebx, esi
mov r9d, ebx
call fcn.140016868
jmp 0x140031ff2
mov rax, qword [rbp - 0x68]
lea rdx, [0x140048b78]
xor r8d, r8d
lea rcx, [rsp + 0x68]
call qword [0x14003f118]
test eax, eax
jne 0x1400318a2
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ecx, 0x57
cmove eax, ecx
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140031fbc
mov ebx, 0x8007000d
jmp 0x140031fbc
mov r8, qword [rdi + 0x18]
mov ebx, r13d
test r8, r8
je 0x140031fed
or rax, 0xffffffffffffffff
inc rax
cmp word [r8 + rax*2], r13w
jne 0x1400318b6
add rax, rax
mov r15d, 0x208
cmp rax, r15
jae 0x140031fed
mov r12d, 0x104
lea rcx, [rbp + 0x80]
mov edx, r12d
call fcn.140001470
lea rcx, [rbp + 0x80]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
mov r8, r14
lea rcx, [rbp + 0x80]
mov edx, r12d
call fcn.140001584
lea rcx, [rbp + 0x80]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140031fe6
test al, 0x10
jne 0x140031fe6
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
jne 0x140031946
lea edx, [rcx + 5]
call fcn.140016148
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
je 0x140031971
cmp dword [0x1400516e0], 4
jl 0x140031971
lea r9, [rsp + 0x44]
mov dword [rsp + 0x44], r13d
mov r8d, 0x55
mov qword [rsp + 0x20], r13
lea rdx, str.____Got_catalog_context.__Attempting_to_determine_valid_name_for_installed_catalog._r_n
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, r15
call fcn.14003c310
mov qword [rbp - 0x78], rax
test rax, rax
je 0x140031f74
lea rdx, [rbp + 0x80]
mov rcx, rax
call fcn.1400303c8
test eax, eax
js 0x140031f4b
lea rcx, [rbp + 0x80]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
bt eax, 0xe
jae 0x140031a0c
lea rcx, [rbp - 0x40]
mov qword [rbp - 0x40], r13
mov qword [rbp - 0x38], r13
call fcn.1400169fc
test eax, eax
je 0x1400319fd
mov rax, qword [rbp - 0x40]
lea rcx, [rbp + 0x80]
xor edx, edx
call qword [0x14003f118]
test eax, eax
jne 0x1400319fd
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, [rbp + 0x80]
mov ecx, 2
mov r9d, eax
lea rdx, str.ERROR:_Decryption_failed_for_file__S.__Last_result:_0x_x._r_n
call fcn.140016868
mov rcx, qword [rbp - 0x38]
test rcx, rcx
je 0x140031a0c
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov r8, qword [rbp - 0x78]
lea rdx, [rbp + 0x80]
mov rcx, qword [rsp + 0x68]
xor r9d, r9d
mov rax, qword [rbp - 0x50]
call qword [0x14003f118]
mov qword [rbp - 0x70], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, r14
lea rdx, str.____Added_catalog__S.__Last_result:_0x_x._r_n
mov r9d, eax
mov ecx, 4
call fcn.140016868
cmp dword [0x140051710], r13d
jne 0x140031f4b
mov eax, 1
lea rcx, [rbp + 0x290]
mov edx, 0x103
mov dword [0x140051710], eax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x140031f4b
lea r8, str.CatRootF750E6C3_38EE_11D1_85E5_00C04FC295EEwmsocm.cat
mov dword [rsp + 0x4c], r13d
mov rdx, r12
mov dword [rsp + 0x44], r13d
lea rcx, [rbp + 0x290]
mov dword [rsp + 0x48], r13d
mov r15d, r13d
call fcn.140001584
lea rdx, [rsp + 0x58]
mov dword [rsp + 0x58], r13d
lea rcx, [rbp + 0x290]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov r12d, eax
xorps xmm6, xmm6
test eax, eax
jne 0x140031c79
lea rcx, [rbp + 0x290]
call fcn.140017448
test eax, eax
je 0x140031f4b
xor r9d, r9d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x80
lea rcx, [rbp + 0x290]
xor edx, edx
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140031f46
mov esi, 0x80004005
lea r9, [rsp + 0x78]
xor r8d, r8d
xor edx, edx
mov rcx, rax
mov r13d, esi
call qword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x140031c6e
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
test eax, eax
je 0x140031c6e
xor edx, edx
lea rcx, [rbp - 0x30]
mov r8d, 0xac
call sub.msvcrt.dll_memset
movzx eax, word [rbp - 0x40]
lea rcx, [rbp - 0x30]
movzx r12d, word [rbp - 0x3e]
xor r13d, r13d
mov dword [rsp + 0x4c], eax
movzx eax, word [rbp - 0x3a]
shl r12d, 0x10
or r12d, eax
mov dword [rsp + 0x44], r12d
call qword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
cmp eax, 0xffffffff
je 0x140031c6e
mov r8d, dword [rbp - 0x30]
lea r9d, [r13 + 1]
movzx eax, r8w
neg ax
test r8d, r8d
cmovg ax, r8w
movzx ecx, ax
mov eax, 0x88888889
mul ecx
movzx eax, word [rbp - 0x38]
movzx ecx, word [rbp - 0x3a]
shr edx, 5
cmp r8d, r9d
jge 0x140031bc9
add ax, dx
jmp 0x140031be3
cmp ax, dx
jae 0x140031be0
mov r8d, 0xffff
add cx, r8w
mov word [rbp - 0x3a], cx
add ax, 0x18
sub ax, dx
mov word [rbp - 0x38], ax
cmp ax, 0x17
jbe 0x140031c28
add cx, r9w
mov edx, 0xffe8
add ax, dx
mov word [rbp - 0x3a], cx
mov word [rbp - 0x38], ax
cmp cx, 0x20
jne 0x140031c28
movzx eax, word [rbp - 0x3e]
add ax, r9w
mov word [rbp - 0x3a], r9w
mov word [rbp - 0x3e], ax
cmp ax, 0xd
jne 0x140031c28
add word [rbp - 0x40], r9w
mov word [rbp - 0x3e], r9w
lea rdx, [rsp + 0x60]
movsd qword [rsp + 0x60], xmm6
lea rcx, [rbp - 0x40]
call qword [sym.imp.OLEAUT32.dll_VariantTimeToSystemTime]
test eax, eax
je 0x140031c6e
movsd xmm0, qword [rsp + 0x60]
lea rdx, [rbp - 0x40]
call qword [sym.imp.OLEAUT32.dll_UnRegisterTypeLib]
test eax, eax
je 0x140031c6e
movzx eax, word [rbp - 0x40]
movzx ecx, word [rbp - 0x3e]
mov dword [rsp + 0x4c], eax
movzx eax, word [rbp - 0x3a]
shl ecx, 0x10
or ecx, eax
mov dword [rsp + 0x44], ecx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140031ce8
mov rcx, r12
call fcn.14003c310
mov rdi, rax
test rax, rax
je 0x140031f46
mov esi, 0x80004005
lea rcx, [rbp + 0x290]
mov r9, rax
mov r8d, r12d
xor edx, edx
mov r13d, esi
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x140031ce0
lea r9, [rsp + 0x70]
mov rcx, rdi
lea r8, [rbp - 0x80]
lea rdx, [0x140042140]
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x140031ce0
mov rax, qword [rbp - 0x80]
xor r13d, r13d
mov ecx, dword [rax + 8]
mov eax, dword [rax + 0xc]
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x4c], ecx
mov rcx, rdi
call fcn.14003c2b8
test r13d, r13d
jne 0x140031f44
xor r13d, r13d
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x80]
mov dword [rsp + 0x58], r13d
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov r12d, eax
test eax, eax
jne 0x140031ebd
lea rcx, [rbp + 0x80]
call fcn.140017448
test eax, eax
je 0x140031f44
mov qword [rsp + 0x30], r13
lea r8d, [r13 + 1]
mov dword [rsp + 0x28], 0x80
lea rcx, [rbp + 0x80]
xor r9d, r9d
mov dword [rsp + 0x20], 3
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140031f44
lea r9, [rbp - 0x80]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x140031ead
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
test eax, eax
je 0x140031ead
xor edx, edx
lea rcx, [rbp - 0x30]
mov r8d, 0xac
call sub.msvcrt.dll_memset
movzx r15d, word [rbp - 0x3e]
lea rcx, [rbp - 0x30]
movzx r12d, word [rbp - 0x40]
mov esi, r13d
movzx eax, word [rbp - 0x3a]
shl r15d, 0x10
or r15d, eax
mov dword [rsp + 0x48], r12d
call qword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
cmp eax, 0xffffffff
je 0x140031ead
mov r8d, dword [rbp - 0x30]
lea r9d, [r13 + 1]
movzx ecx, r8w
mov eax, 0x88888889
neg cx
test r8d, r8d
cmovg cx, r8w
movzx ecx, cx
mul ecx
movzx eax, word [rbp - 0x38]
movzx ecx, word [rbp - 0x3a]
shr edx, 5
cmp r8d, r9d
jge 0x140031e09
add ax, dx
jmp 0x140031e23
cmp ax, dx
jae 0x140031e20
mov r8d, 0xffff
add cx, r8w
mov word [rbp - 0x3a], cx
add ax, 0x18
sub ax, dx
mov word [rbp - 0x38], ax
cmp ax, 0x17
jbe 0x140031e68
add cx, r9w
mov edx, 0xffe8
add ax, dx
mov word [rbp - 0x3a], cx
mov word [rbp - 0x38], ax
cmp cx, 0x20
jne 0x140031e68
movzx eax, word [rbp - 0x3e]
add ax, r9w
mov word [rbp - 0x3a], r9w
mov word [rbp - 0x3e], ax
cmp ax, 0xd
jne 0x140031e68
add word [rbp - 0x40], r9w
mov word [rbp - 0x3e], r9w
lea rdx, [rsp + 0x60]
movsd qword [rsp + 0x60], xmm6
lea rcx, [rbp - 0x40]
call qword [sym.imp.OLEAUT32.dll_VariantTimeToSystemTime]
test eax, eax
je 0x140031ead
movsd xmm0, qword [rsp + 0x60]
lea rdx, [rbp - 0x40]
call qword [sym.imp.OLEAUT32.dll_UnRegisterTypeLib]
test eax, eax
je 0x140031ead
movzx eax, word [rbp - 0x40]
movzx r15d, word [rbp - 0x3e]
mov dword [rsp + 0x48], eax
movzx eax, word [rbp - 0x3a]
shl r15d, 0x10
or r15d, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r12d, dword [rsp + 0x48]
jmp 0x140031f23
mov rcx, r12
call fcn.14003c310
mov rdi, rax
test rax, rax
je 0x140031f44
mov r9, rax
lea rcx, [rbp + 0x80]
mov r8d, r12d
xor edx, edx
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x140031f16
lea r9, [rsp + 0x70]
mov rcx, rdi
lea r8, [rsp + 0x78]
lea rdx, [0x140042140]
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x140031f16
mov rax, qword [rsp + 0x78]
mov esi, r13d
mov r12d, dword [rax + 8]
mov r15d, dword [rax + 0xc]
jmp 0x140031f1b
mov r12d, dword [rsp + 0x48]
mov rcx, rdi
call fcn.14003c2b8
test esi, esi
jne 0x140031f44
cmp r12d, dword [rsp + 0x4c]
jne 0x140031f35
cmp r15d, dword [rsp + 0x44]
je 0x140031f44
mov eax, 1
mov dword [0x140051710], eax
mov esi, eax
jmp 0x140031f46
mov esi, ebx
mov rdi, qword [rsp + 0x50]
mov rcx, qword [rbp - 0x78]
call fcn.14003c2b8
mov rax, qword [rbp - 0x70]
test rax, rax
je 0x140031f74
mov rcx, qword [rsp + 0x68]
mov rdx, rax
mov rax, qword [rbp - 0x58]
xor r8d, r8d
call qword [0x14003f118]
jmp 0x140031fab
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
mov ebx, 0x8007000d
or ecx, 0x80070000
lea rdx, str.ERROR:_Could_not_add_catalog__S.__Result:_0x_x._r_n
test eax, eax
mov r8, r14
cmovle ecx, eax
test ecx, ecx
cmovns ecx, ebx
mov ebx, ecx
mov r9d, ecx
mov ecx, 2
call fcn.140016868
mov rcx, qword [rsp + 0x68]
xor edx, edx
mov rax, qword [rbp - 0x60]
call qword [0x14003f118]
mov r9d, ebx
lea rdx, str.____Trust_on_catalog__S_complete.__Result:_0x_x._r_n
mov r8, r14
mov ecx, 4
call fcn.140016868
test esi, esi
je 0x140031ff2
mov rdx, r14
mov rcx, rdi
call fcn.140031740
mov ebx, eax
jmp 0x140031ff2
mov ebx, 0x80070002
jmp 0x140031ff2
mov ebx, 0x8000ffff
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x140032001
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rbp + 0x4a0]
xor rcx, rsp
call fcn.14003c6c0
lea r11, [rsp + 0x5c0]
mov rbx, qword [r11 + 0x50]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret