Function at 0x1400329b0
Capabilities:
Check if file exists
Get file attributes
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x160
xor r14d, r14d
mov r12, rcx
xor ecx, ecx
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r14
mov rbp, r14
mov r13, r14
mov esi, r14d
mov ebx, r14d
mov rdi, rdx
call qword [sym.imp.KERNEL32.DLL_SetLastError]
mov rcx, r12
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140032ec5
test al, 0x50
jne 0x140032ec5
mov rax, qword [0x14028b4c0]
test rax, rax
jne 0x140032a34
lea rcx, str.crypt32.dll
xor edx, edx
call fcn.14002dd50
mov qword [0x14028b4c0], rax
test rax, rax
je 0x140032bd1
cmp qword [0x14028b4c8], rbx
jne 0x140032a64
lea rdx, str.CryptMsgClose
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov qword [0x14028b4c8], rax
test rax, rax
je 0x140032bd1
mov rax, qword [0x14028b4c0]
cmp qword [0x14028b4d0], rbx
jne 0x140032a94
lea rdx, str.CertCloseStore
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov qword [0x14028b4d0], rax
test rax, rax
je 0x140032bd1
mov rax, qword [0x14028b4c0]
cmp qword [0x14028b4d8], rbx
jne 0x140032ac4
lea rdx, str.CertFreeCertificateContext
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov qword [0x14028b4d8], rax
test rax, rax
je 0x140032bd1
mov rax, qword [0x14028b4c0]
cmp qword [0x14028b4e0], rbx
jne 0x140032af4
lea rdx, str.CertFindCertificateInStore
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov qword [0x14028b4e0], rax
test rax, rax
je 0x140032bd1
mov rax, qword [0x14028b4c0]
cmp qword [0x14028b4e8], rbx
jne 0x140032b24
lea rdx, str.CryptMsgGetParam
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov qword [0x14028b4e8], rax
test rax, rax
je 0x140032bd1
mov rax, qword [0x14028b4c0]
cmp qword [0x14028b4f0], rbx
jne 0x140032b54
lea rdx, str.CryptQueryObject
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov qword [0x14028b4f0], rax
test rax, rax
je 0x140032bd1
mov rax, qword [0x14028b4c0]
cmp qword [0x14028b4f8], rbx
jne 0x140032b80
lea rdx, str.CertGetNameStringA
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov qword [0x14028b4f8], rax
test rax, rax
je 0x140032bd1
mov rax, qword [0x14028b4c0]
cmp qword [0x14028b500], rbx
jne 0x140032bac
lea rdx, str.CryptDecodeObjectEx
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov qword [0x14028b500], rax
test rax, rax
je 0x140032bd1
mov rax, qword [0x14028b4c0]
cmp qword [0x14028b508], rbx
jne 0x140032bdb
lea rdx, str.CertGetIssuerCertificateFromStore
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov qword [0x14028b508], rax
test rax, rax
jne 0x140032bdb
mov ebx, 0x7e
jmp 0x140032eca
mov qword [rsp + 0x50], r14
lea rax, [rsp + 0x68]
mov r9d, 2
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x60]
lea ecx, [r9 - 1]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x78]
mov r8d, 0x400
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x7c]
mov rdx, r12
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r14d
call qword [0x14028b4f0]
mov esi, eax
test eax, eax
jne 0x140032c46
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov ebx, eax
jmp 0x140032eca
mov rcx, qword [rsp + 0x68]
xor r9d, r9d
lea rax, [rsp + 0x1a0]
lea edx, [r9 + 6]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [0x14028b4e8]
mov esi, eax
test eax, eax
jne 0x140032c7b
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov ebx, eax
jmp 0x140032eca
mov edx, dword [rsp + 0x1a0]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.DLL_LocalAlloc]
mov rbp, rax
test rax, rax
jne 0x140032ca5
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov esi, r14d
mov ebx, eax
jmp 0x140032eca
mov rcx, qword [rsp + 0x68]
xor r8d, r8d
lea rax, [rsp + 0x1a0]
lea edx, [r8 + 6]
mov r9, rbp
mov qword [rsp + 0x20], rax
call qword [0x14028b4e8]
mov esi, eax
test eax, eax
jne 0x140032cda
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov ebx, eax
jmp 0x140032eca
mov rax, qword [rbp + 8]
lea rcx, [rsp + 0xc0]
mov r9d, 0xb0000
mov qword [rcx], rax
mov rax, qword [rbp + 0x10]
xor r8d, r8d
mov qword [rcx + 8], rax
mov rax, qword [rbp + 0x18]
lea rcx, [rsp + 0x98]
mov qword [rcx], rax
mov rax, qword [rbp + 0x20]
mov edx, 0x10001
mov qword [rcx + 8], rax
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x90]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rax
call qword [0x14028b4e0]
mov r13, rax
test rax, rax
jne 0x140032d4b
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov esi, r14d
mov ebx, eax
jmp 0x140032eca
test rdi, rdi
je 0x140032d6a
mov rcx, rax
call fcn.14002c690
mov dword [rdi], eax
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov ebx, eax
test eax, eax
jne 0x140032eca
lea rdx, [rsp + 0x70]
mov rcx, rbp
call fcn.14002c9b0
test eax, eax
jne 0x140032d82
xor eax, eax
mov qword [rsp + 0x70], rax
mov rdx, qword [rsp + 0x60]
lea r8, [rsp + 0x70]
mov rcx, rbp
call fcn.14002ca70
test eax, eax
jne 0x140032dc6
lea rdx, [rsp + 0x70]
mov rcx, rbp
call fcn.14002cf40
test eax, eax
jne 0x140032dc6
mov esi, r14d
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov ebx, eax
test eax, eax
jne 0x140032eca
mov ebx, 0x80096005
jmp 0x140032eca
mov ecx, 0x23f0
call fcn.14002e940
test eax, eax
jne 0x140032df4
mov rcx, r12
call fcn.14002dfb0
test eax, eax
je 0x140032df4
call fcn.14002e170
test eax, eax
jne 0x140032df4
lea esi, [rax + 1]
mov ebx, r14d
jmp 0x140032eca
mov rax, qword [0x14028b5a0]
test rax, rax
jne 0x140032e1a
lea rcx, str.wintrust.dll
xor edx, edx
call fcn.14002dd50
mov qword [0x14028b5a0], rax
test rax, rax
je 0x140032e3f
cmp qword [0x14028b5a8], r14
jne 0x140032e4c
lea rdx, str.WinVerifyTrust
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov qword [0x14028b5a8], rax
test rax, rax
jne 0x140032e4c
mov esi, r14d
mov ebx, 0x7e
jmp 0x140032eca
mov esi, r14d
mov edi, r14d
mov edx, edi
mov rcx, r12
call fcn.14002c1c0
test eax, eax
je 0x140032e6b
inc edi
mov ebx, eax
cmp edi, 1
jb 0x140032e52
jmp 0x140032e70
mov esi, 1
cmp ebx, 0x800b010a
jne 0x140032eca
mov rcx, qword [rsp + 0x60]
lea r9, [rsp + 0x1a8]
xor r8d, r8d
mov rdx, r13
mov dword [rsp + 0x1a8], r14d
call qword [0x14028b508]
mov rdi, rax
test rax, rax
je 0x140032eca
mov rcx, qword [rax + 0x18]
add rcx, 0x78
call fcn.14002f850
test eax, eax
je 0x140032eba
mov esi, 1
mov ebx, r14d
mov rcx, rdi
call qword [0x14028b4d8]
jmp 0x140032eca
mov ebx, 2
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_LocalFree]
test r13, r13
je 0x140032ee1
mov rcx, r13
call qword [0x14028b4d8]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140032ef3
xor edx, edx
call qword [0x14028b4d0]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140032f03
call qword [0x14028b4c8]
mov ecx, ebx
call qword [sym.imp.KERNEL32.DLL_SetLastError]
lea r11, [rsp + 0x160]
mov eax, esi
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret