Function at 0x160101e90
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov rax, rsp
push rsi
push rdi
push r14
sub rsp, 0x160
mov qword [rax - 0xf8], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x160270bd8]
xor rax, rsp
mov qword [rsp + 0x158], rax
mov rdi, rdx
mov rsi, rcx
mov rcx, rdx
call fcn.160066338
nop
lea rax, [rsp + 0xc8]
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0xc0], 0x41
xor r14d, r14d
mov word [rsp + 0xc8], r14w
lea rax, fcn.160040970
mov qword [rsp + 0xb0], rax
lea rdx, [rsp + 0xb0]
mov rcx, rdi
call fcn.1601018bc
mov rcx, qword [rsp + 0x178]
test eax, eax
jns 0x160101f35
mov r9d, eax
lea r8, [0x1601db300]
mov edx, 0x80e
call fcn.1600b47d4
mov dword [rsp + 0x50], r14d
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], r14
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x16010201e
test al, 0x10
je 0x16010201e
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x68]
mov rdx, qword [rsp + 0xb8]
mov rcx, rdi
call fcn.1601002f4
mov rcx, qword [rsp + 0x178]
test eax, eax
jns 0x160101fa1
mov r9d, eax
lea r8, [0x1601db300]
mov edx, 0x819
call fcn.1600b47d4
mov rdx, rdi
cmp dword [rsp + 0x50], 1
jne 0x1601020d7
lea rcx, [rsp + 0x60]
call fcn.160108f34
nop
mov rcx, qword [rsp + 0x178]
mov rbx, qword [rsp + 0x60]
test rbx, rbx
jne 0x160101fdd
lea r8, [0x1601db300]
mov edx, 0x81e
call fcn.1600e4cd4
mov rcx, qword [rsi + 0x170]
mov rax, qword [rcx]
mov rdx, rbx
mov rax, qword [rax + 0x58]
call qword [case.0x16003fc5a.0]
mov rcx, qword [rsp + 0x178]
test eax, eax
jns 0x160102015
mov r9d, eax
lea r8, [0x1601db300]
mov edx, 0x820
call fcn.1600b47d4
nop
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rdx, rdi
lea rcx, str.Logon_for_user__s_as_creating_catalog
call fcn.16001a1d8
mov rdx, rdi
lea rcx, [rsp + 0x88]
call fcn.1600267e0
nop
lea rdx, str.SoftwareMicrosoftWindows_SearchGathering_ManagerApplications
lea rcx, [rsp + 0x88]
call fcn.1600098ac
mov qword [rsp + 0x60], r14
xor edx, edx
lea rcx, [rsp + 0x60]
call fcn.16005e8e8
lea rdx, [rsp + 0x88]
cmp qword [rsp + 0xa0], 8
cmovae rdx, qword [rsp + 0x88]
mov qword [rsp + 0x40], r14
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
mov ebx, 0xf003f
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000003
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
mov rcx, qword [rsp + 0x178]
test eax, eax
je 0x160102150
mov r9d, eax
lea r8, [0x1601db300]
mov edx, 0x845
call fcn.160108adc
nop
lea rcx, str.Logon_for_user__s_as_loading_catalog
call fcn.16001a1d8
cmp dword [rsp + 0x50], 2
jne 0x160102119
mov rcx, rdi
call fcn.1601a686c
mov rcx, qword [rsp + 0x178]
test eax, eax
jns 0x160102112
mov r9d, eax
lea r8, [0x1601db300]
mov edx, 0x82c
call fcn.1600b47d4
lea r8, [rsp + 0x68]
jmp 0x16010211c
mov r8, r14
mov rdx, rdi
mov rcx, qword [rsi + 0x170]
call fcn.16011cf30
mov rcx, qword [rsp + 0x178]
test eax, eax
jns 0x1601023ce
mov r9d, eax
lea r8, [0x1601db300]
mov edx, 0x831
call fcn.1600b47d4
nop
mov rdx, rdi
lea rcx, [rsp + 0x88]
call fcn.160026590
lea rdx, str.SoftwareMicrosoftWindows_SearchGather
lea rcx, [rsp + 0x88]
call fcn.1600098ac
mov qword [rsp + 0x58], r14
xor edx, edx
lea rcx, [rsp + 0x58]
call fcn.16005e8e8
lea rdx, [rsp + 0x88]
cmp qword [rsp + 0xa0], 8
cmovae rdx, qword [rsp + 0x88]
mov qword [rsp + 0x40], r14
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000003
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
mov rcx, qword [rsp + 0x178]
test eax, eax
je 0x1601021ef
mov r9d, eax
lea r8, [0x1601db300]
mov edx, 0x854
call fcn.160108adc
mov dword [rsp + 0x50], 0x4020000
mov ebx, 4
mov dword [rsp + 0x28], ebx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, ebx
xor r8d, r8d
lea rdx, str.RegVersion
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x178]
test eax, eax
je 0x160102242
mov r9d, eax
lea r8, [0x1601db300]
mov edx, 0x85b
call fcn.160108adc
mov dword [rsp + 0x50], r14d
mov dword [rsp + 0x28], ebx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, ebx
xor r8d, r8d
lea rdx, str.DebugTranFiles
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x178]
test eax, eax
je 0x16010228d
mov r9d, eax
lea r8, [0x1601db300]
mov edx, 0x862
call fcn.160108adc
mov dword [rsp + 0x50], 1
mov dword [rsp + 0x28], ebx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, ebx
xor r8d, r8d
lea rdx, str.LowDiskMinimumMBytes
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x178]
test eax, eax
je 0x1601022db
mov r9d, eax
lea r8, [0x1601db300]
mov edx, 0x869
call fcn.160108adc
lea rcx, [rsp + 0xb0]
call fcn.16005a594
mov rax, qword [rsp + 0xb0]
or r9d, 0xffffffff
mov r8d, dword [rsp + 0xc4]
mov rdx, rdi
lea rcx, [rsp + 0xb0]
mov rax, qword [rax + 0x20]
call qword [case.0x16003fc5a.0]
mov rcx, rdi
call fcn.160199330
mov rcx, qword [rsp + 0x178]
test eax, eax
jns 0x160102339
mov r9d, eax
lea r8, [0x1601db300]
mov edx, 0x86e
call fcn.1600b47d4
mov rcx, rdi
call fcn.1601a686c
mov rcx, qword [rsp + 0x178]
test eax, eax
jns 0x160102361
mov r9d, eax
lea r8, [0x1601db300]
mov edx, 0x86f
call fcn.1600b47d4
mov r8, qword [rsp + 0xb8]
mov rdx, rdi
mov rcx, qword [rsi + 0x170]
call fcn.16011a438
mov rcx, qword [rsp + 0x178]
test eax, eax
jns 0x160102399
mov r9d, eax
lea r8, [0x1601db300]
mov edx, 0x871
call fcn.1600b47d4
nop
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1601023aa
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1601023bb
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x88]
call fcn.160026228
nop
lea rcx, [rsp + 0x68]
call fcn.1600c2414
nop
lea rcx, [rsp + 0xb0]
call fcn.160040b2c
nop
xor ecx, ecx
call fcn.160066338
xor eax, eax
jmp 0x1601023fd
mov rcx, qword [rsp + 0x158]
xor rcx, rsp
call fcn.16006e590
mov rbx, qword [rsp + 0x190]
add rsp, 0x160
pop r14
pop rdi
pop rsi
ret