Function at 0x1400190e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0xe0]
sub rsp, 0x1e0
mov rax, qword [0x14005d020]
xor rax, rsp
mov qword [rbp + 0xd0], rax
movzx esi, r9b
mov rdi, rdx
mov rbx, rcx
mov rax, rdx
cmp qword [rdx + 0x18], 8
jb 0x14001911e
mov rax, qword [rdx]
xor r14d, r14d
mov qword [rdx + 0x10], r14
mov word [rax], r14w
cmp qword [rcx + 0x18], 8
jb 0x140019133
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14001930d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x14001930d
mov rax, qword [0x1400601a0]
test rax, rax
je 0x14001916e
call qword [case.0x140013bae.0]
cmp eax, 0x12c
jg 0x140019303
lea rdx, str.GetSimpleDisplayCertNameFromFile:_File__s_does_not_exist.
lea rcx, [rsp + 0x40]
call fcn.140014830
nop
mov qword [rsp + 0x20], rbx
lea rcx, [fcn.14000dab0]
mov qword [rsp + 0x28], rcx
lea rcx, [0x14001b000]
mov qword [rsp + 0x30], rcx
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.14000d950
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.140015030
mov rcx, rax
mov rax, qword [0x140060198]
test rax, rax
je 0x1400191d2
mov edx, 0x12c
call qword [case.0x140013bae.0]
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x140019215
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001920f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001964e
call fcn.14001f834
nop
cmp byte [rbp + 0x30], 0
je 0x140019251
mov rcx, qword [rbp + 0x40]
test rcx, rcx
je 0x14001924d
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140013bae.0]
mov r8, rax
test rax, rax
je 0x14001924d
mov rcx, qword [rax]
mov rax, qword [rcx]
mov edx, 1
mov rcx, r8
call qword [case.0x140013bae.0]
mov byte [rbp + 0x30], 0
lea rcx, [rbp - 0x50]
call fcn.140014570
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x14001929a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019295
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140019654
call fcn.14001f834
mov qword [rbp - 0x68], r14
mov qword [rbp - 0x60], 7
mov word [rbp - 0x78], r14w
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1400192f9
mov rdx, qword [rsp + 0x68]
sub rdx, rcx
and rdx, 0xfffffffffffffffc
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400192e6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140019654
call fcn.14001f834
mov qword [rsp + 0x58], r14
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
lea rcx, [rsp + 0x40]
call fcn.14000d700
mov eax, 2
jmp 0x14001962b
mov dword [rbp + 0xc0], 0xaac56b
mov dword [rbp + 0xc4], 0x11d0cd44
mov dword [rbp + 0xc8], 0xc000c28c
mov dword [rbp + 0xcc], 0xee95c24f
mov qword [rbp + 0xa0], 0x20
cmp qword [rbx + 0x18], 8
jb 0x14001934a
mov rbx, qword [rbx]
mov qword [rbp + 0xa8], rbx
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xb0], xmm0
mov qword [rbp + 0x50], 0x50
mov qword [rbp + 0x70], 1
mov qword [rbp + 0x80], 1
mov qword [rbp + 0x58], r14
mov qword [rbp + 0x60], r14
lea eax, [rsi*2 + 2]
mov dword [rbp + 0x68], eax
mov dword [rbp + 0x6c], r14d
lea rax, [rbp + 0xa0]
mov qword [rbp + 0x78], rax
mov qword [rbp + 0x88], r14
mov qword [rbp + 0x90], r14
mov eax, 0x1012
mov ecx, 0x1212
cmp byte [rbp + 0x138], r14b
cmovne eax, ecx
mov dword [rbp + 0x98], eax
mov dword [rbp + 0x9c], r14d
lea r8, [rbp + 0x50]
lea rdx, [rbp + 0xc0]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.WINTRUST.dll_WinVerifyTrust]
mov ebx, eax
test eax, eax
jne 0x140019607
mov rdx, qword [rbp + 0x88]
lea rcx, [rsp + 0x20]
call fcn.140018ed0
mov rdx, rax
mov rcx, rdi
call fcn.1400057b0
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x140019447
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019442
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001965a
call fcn.14001f834
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], 7
mov word [rsp + 0x20], r14w
mov rax, qword [0x1400601a0]
test rax, rax
je 0x140019476
call qword [case.0x140013bae.0]
cmp eax, 0x46
jg 0x140019607
lea rdx, str.GetSimpleDisplayCertNameFromFile:_Found_cert_name:__s.
lea rcx, [rsp + 0x40]
call fcn.140014830
nop
mov qword [rsp + 0x20], rdi
lea rcx, [fcn.14000dab0]
mov qword [rsp + 0x28], rcx
lea rcx, [0x14001b000]
mov qword [rsp + 0x30], rcx
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.14000d950
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.140015030
mov rcx, rax
mov rax, qword [0x140060198]
test rax, rax
je 0x1400194da
mov edx, 0x46
call qword [case.0x140013bae.0]
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x14001951d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019517
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140019660
call fcn.14001f834
nop
cmp byte [rbp + 0x30], 0
je 0x140019559
mov rcx, qword [rbp + 0x40]
test rcx, rcx
je 0x140019555
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140013bae.0]
mov r8, rax
test rax, rax
je 0x140019555
mov rcx, qword [rax]
mov rax, qword [rcx]
mov edx, 1
mov rcx, r8
call qword [case.0x140013bae.0]
mov byte [rbp + 0x30], 0
lea rcx, [rbp - 0x50]
call fcn.140014570
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x1400195a2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001959d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140019648
call fcn.14001f834
mov qword [rbp - 0x68], r14
mov qword [rbp - 0x60], 7
mov word [rbp - 0x78], r14w
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1400195fd
mov rdx, qword [rsp + 0x68]
sub rdx, rcx
and rdx, 0xfffffffffffffffc
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400195ea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140019648
call fcn.14001f834
mov qword [rsp + 0x58], r14
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
lea rcx, [rsp + 0x40]
call fcn.14000d700
mov dword [rbp + 0x80], 2
lea r8, [rbp + 0x50]
lea rdx, [rbp + 0xc0]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.WINTRUST.dll_WinVerifyTrust]
mov eax, ebx
mov rcx, qword [rbp + 0xd0]
xor rcx, rsp
call fcn.14001f810
add rsp, 0x1e0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1400293c8
nop
call fcn.1400293c8
nop
call fcn.1400293c8
int3
call fcn.1400293c8
nop
call fcn.1400293c8
int3