Function at 0x1601a80fc
Capabilities:
Create thread
Set registry value

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0xb18]
sub rsp, 0xc00
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
mov rax, qword [0x160270bd8]
xor rax, rsp
mov qword [rbp + 0xaf0], rax
mov rbx, rcx
mov esi, dword [rbp + 0xb40]
mov rdi, qword [rbp + 0xb48]
xor r15d, r15d
mov dword [rsp + 0x50], r15d
or r12, 0xffffffffffffffff
mov qword [rsp + 0x58], r12
lea rcx, [rsp + 0x50]
call fcn.1600ce130
nop
mov r14, qword [rbp + 0xb50]
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], esi
mov r9d, 0x12cb
mov rcx, rbx
call fcn.160183c10
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1600bfd80]
lea rcx, [0x160273cd0]
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_InitOnceExecuteOnce]
cmp byte [0x1602742e0], r15b
je 0x1601a832d
call fcn.1601a78b4
test rax, rax
je 0x1601a832d
call fcn.1601a78b4
mov rdi, rax
test rbx, rbx
je 0x1601a825c
mov rdx, rbx
lea rcx, [rsp + 0x70]
call fcn.1600c0044
nop
lea rdx, [0x1601d4934]
test rdi, rdi
cmovne rdx, rdi
mov rax, qword [rsp + 0x78]
or ebx, 0xffffffff
mov r9d, ebx
xor r8d, r8d
lea rcx, [rsp + 0x78]
mov rax, qword [rax + 0x20]
call qword [case.0x16003fc5a.0]
mov rax, qword [rbp + 0x18]
mov r9d, ebx
xor r8d, r8d
lea rdx, [0x1601d4934]
lea rcx, [rbp + 0x18]
mov rax, qword [rax + 0x20]
call qword [case.0x16003fc5a.0]
mov edx, 0xc0041801
lea rcx, [rsp + 0x70]
call fcn.1600cd1d8
xor r9d, r9d
lea r8, str.The_catalog_is_corrupt
mov edx, 0xc0001b80
lea rcx, [rsp + 0x70]
call fcn.1600c1b70
nop
lea rcx, [rsp + 0x70]
call fcn.1600c0898
mov rax, r12
inc rax
cmp word [rdi + rax*2], r15w
jne 0x1601a825f
lea rsi, [rax + 1]
mov eax, 2
mul rsi
cmovo rax, r12
lea rdx, [0x1601d7c98]
mov rcx, rax
call fcn.16006eafc
mov rbx, rax
test rax, rax
jne 0x1601a82b4
mov rcx, qword [rbp + 0xb18]
mov edi, 0x8007000e
mov r9d, edi
lea r8, str.onecoreuap_base_appmodel_search_searchcommoninclude_recovery.h
mov edx, 0xb3
call fcn.1600b29f8
xor ecx, ecx
jmp 0x1601a82e6
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call fcn.1600b2fdc
mov edi, eax
test eax, eax
jns 0x1601a82f0
mov rcx, qword [rbp + 0xb18]
mov r9d, eax
lea r8, str.onecoreuap_base_appmodel_search_searchcommoninclude_recovery.h
mov edx, VariantTimeToSystemTime
call fcn.1600b29f8
mov rcx, rbx
call fcn.160031c48
jmp 0x1601a8410
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
mov r9, rbx
lea r8, [0x1601840a0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x1601a8321
mov rcx, rax
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
xor ecx, ecx
call fcn.160031c48
jmp 0x1601a840d
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
lea rdx, str.SOFTWAREMicrosoftWindows_Search
mov rcx, 0xffffffff80000002
call fcn.16005ab8c
test eax, eax
jle 0x1601a835e
movzx eax, ax
or eax, 0x80070000
test eax, eax
js 0x1601a839c
mov dword [rsp + 0x40], 3
mov r9d, 4
mov dword [rsp + 0x28], r9d
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r8, str.RebuildIndex
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHSetValueW]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x8e0]
call sub.msvcrt.dll_memset
test rdi, rdi
je 0x1601a83dc
mov r9, rdi
lea r8, [0x1601f9764]
mov edx, 0x104
lea rcx, [rbp + 0x8e0]
call fcn.160059e34
test eax, eax
jns 0x1601a83dc
mov word [rbp + 0x8e0], r15w
mov r9, r14
lea r8, [rbp + 0x8e0]
mov edx, esi
call fcn.1600cb4d0
cmp dword [0x160274470], r15d
jne 0x1601a840d
call fcn.16016b828
mov rcx, rbx
call fcn.1600c1fbc
mov dword [0x160274470], 1
mov edi, r15d
lea rcx, [rsp + 0x50]
call fcn.1600ce108
mov eax, edi
mov rcx, qword [rbp + 0xaf0]
xor rcx, rsp
call fcn.16006e590
lea r11, [rsp + 0xc00]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret