Function at 0x16016c228
Capabilities:
Create thread
Set registry value

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r15
lea rbp, [rax - 0xb28]
sub rsp, 0xc00
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rax, qword [0x160270bd8]
xor rax, rsp
mov qword [rbp + 0xaf0], rax
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
xor r15d, r15d
mov dword [rsp + 0x50], r15d
or r12, 0xffffffffffffffff
mov qword [rsp + 0x58], r12
lea rcx, [rsp + 0x50]
call fcn.1600ce130
nop
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
call fcn.16016bc88
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1600bfd80]
lea rcx, [0x160273cd0]
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_InitOnceExecuteOnce]
cmp byte [0x1602742e0], r15b
je 0x16016c438
call fcn.1601a78b4
test rax, rax
je 0x16016c438
call fcn.1601a78b4
mov rdi, rax
test rbx, rbx
je 0x16016c367
mov rdx, rbx
lea rcx, [rsp + 0x70]
call fcn.1600c0044
nop
lea rbx, [0x1601d4934]
mov rdx, rbx
test rdi, rdi
cmovne rdx, rdi
mov rax, qword [rsp + 0x78]
or r9d, 0xffffffff
xor r8d, r8d
lea rcx, [rsp + 0x78]
mov rax, qword [rax + 0x20]
call qword [case.0x16003fc5a.0]
test rsi, rsi
cmovne rbx, rsi
mov rax, qword [rbp + 0x18]
or r9d, 0xffffffff
xor r8d, r8d
mov rdx, rbx
lea rcx, [rbp + 0x18]
mov rax, qword [rax + 0x20]
call qword [case.0x16003fc5a.0]
mov edx, 0xc0041801
lea rcx, [rsp + 0x70]
call fcn.1600cd1d8
xor r9d, r9d
lea r8, str.The_catalog_is_corrupt
mov edx, 0xc0001b80
lea rcx, [rsp + 0x70]
call fcn.1600c1b70
nop
lea rcx, [rsp + 0x70]
call fcn.1600c0898
mov rax, r12
inc rax
cmp word [rdi + rax*2], r15w
jne 0x16016c36a
lea rsi, [rax + 1]
mov eax, 2
mul rsi
cmovo rax, r12
lea rdx, [0x1601d7c98]
mov rcx, rax
call fcn.16006eafc
mov rbx, rax
test rax, rax
jne 0x16016c3bf
mov rcx, qword [rbp + 0xb28]
mov edi, 0x8007000e
mov r9d, edi
lea r8, str.onecoreuap_base_appmodel_search_searchcommoninclude_recovery.h
mov edx, 0xb3
call fcn.1600b29f8
xor ecx, ecx
jmp 0x16016c3f1
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call fcn.1600b2fdc
mov edi, eax
test eax, eax
jns 0x16016c3fb
mov rcx, qword [rbp + 0xb28]
mov r9d, eax
lea r8, str.onecoreuap_base_appmodel_search_searchcommoninclude_recovery.h
mov edx, VariantTimeToSystemTime
call fcn.1600b29f8
mov rcx, rbx
call fcn.160031c48
jmp 0x16016c50a
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
mov r9, rbx
lea r8, [0x1601840a0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x16016c42c
mov rcx, rax
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
xor ecx, ecx
call fcn.160031c48
jmp 0x16016c507
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
lea rdx, str.SOFTWAREMicrosoftWindows_Search
mov rcx, 0xffffffff80000002
call fcn.16005ab8c
test eax, eax
jle 0x16016c469
movzx eax, ax
or eax, 0x80070000
test eax, eax
js 0x16016c4a7
mov dword [rsp + 0x40], 3
mov r9d, 4
mov dword [rsp + 0x28], r9d
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r8, str.RebuildIndex
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHSetValueW]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x8e0]
call sub.msvcrt.dll_memset
xor r9d, r9d
lea r8, [rbp + 0x8e0]
mov edx, 0xc0041801
call fcn.1600cb4d0
cmp dword [0x160274470], r15d
jne 0x16016c507
call fcn.16016b828
lea rax, str.The_catalog_is_corrupt
mov qword [rsp + 0x20], rax
mov r9d, 0xc0041801
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
call fcn.16016c58c
mov dword [0x160274470], 1
mov edi, r15d
lea rcx, [rsp + 0x50]
call fcn.1600ce108
mov eax, edi
mov rcx, qword [rbp + 0xaf0]
xor rcx, rsp
call fcn.16006e590
mov rbx, qword [rsp + 0xc30]
add rsp, 0xc00
pop r15
pop r12
pop rdi
pop rsi
pop rbp
ret