Function at 0x1000d147c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov r11, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xc0
mov qword [rsp + 0xb0], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov r15, r9
mov rsi, rdx
mov rdi, rcx
mov eax, dword [0x10011bd00]
mov dword [rsp + 0x38], eax
xor r13d, r13d
mov rbp, r13
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x30], r13
mov r12d, r13d
mov qword [r11 - 0x70], r13
mov dword [r11 + 0x20], r13d
cmp r9, r13
je 0x1000d14e7
mov qword [r9], r13
mov r14, qword [rsp + 0x110]
cmp r14, r13
je 0x1000d14f7
mov qword [r14], r13
mov rax, qword [rsp + 0x118]
cmp rax, r13
je 0x1000d1507
mov qword [rax], r13
mov ecx, 2
call qword [sym.imp.ADVAPI32.dll_ImpersonateSelf]
cmp eax, r13d
jne 0x1000d153c
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov ebx, eax
xor r9d, r9d
mov r8d, eax
mov edx, 0x10890197
xor ecx, ecx
call fcn.1000b51b8
jmp 0x1000d1bb2
mov r12d, 1
mov edx, r12d
lea rcx, [0x10002acd0]
call fcn.1000d39c4
mov ebx, eax
cmp eax, r13d
je 0x1000d156f
xor r9d, r9d
mov r8d, eax
mov edx, 0x108e0197
xor ecx, ecx
call fcn.1000b51b8
jmp 0x1000d1bb2
mov edx, r12d
lea rcx, [0x10000d750]
call fcn.1000d39c4
mov ebx, eax
cmp eax, r13d
je 0x1000d159c
xor r9d, r9d
mov r8d, eax
mov edx, 0x10910197
xor ecx, ecx
call fcn.1000b51b8
jmp 0x1000d1bb2
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1000d15cf
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov ebx, eax
xor r9d, r9d
mov r8d, eax
mov edx, 0x10970197
xor ecx, ecx
call fcn.1000b51b8
jmp 0x1000d1bb2
test al, 0x10
je 0x1000d1603
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.1000d0f94
mov ebx, eax
cmp eax, r13d
je 0x1000d1633
xor r9d, r9d
mov r8d, eax
mov edx, 0x109d0197
xor ecx, ecx
call fcn.1000b51b8
mov r13, qword [rsp + 0x30]
jmp 0x1000d1a07
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.1000b80c8
mov ebx, eax
cmp eax, r13d
je 0x1000d1633
xor r9d, r9d
mov r8d, eax
mov edx, 0x10a20197
xor ecx, ecx
call fcn.1000b51b8
mov r13, qword [rsp + 0x30]
jmp 0x1000d1a07
mov r9d, 7
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x78]
mov r13, qword [rsp + 0x30]
mov rcx, r13
call sub.certcli.dll_Ordinal_223
mov ebx, eax
test eax, eax
je 0x1000d166d
xor r9d, r9d
mov r8d, eax
mov edx, 0x10a60197
xor ecx, ecx
call fcn.1000b51b8
jmp 0x1000d1a07
lea rcx, [rsp + 0x70]
call qword [sym.imp.CRYPT32.dll_PFXIsPFXBlob]
test eax, eax
jne 0x1000d1699
mov r8d, 0x8007000d
mov ebx, r8d
xor r9d, r9d
mov edx, 0x10ad0197
xor ecx, ecx
call fcn.1000b51b8
jmp 0x1000d1a07
mov eax, dword [rsp + 0x38]
neg eax
sbb r8d, r8d
and r8d, 0x4000
or r8d, 0x21
mov rdx, rsi
lea rcx, [rsp + 0x70]
call fcn.1000c1428
mov rbp, rax
mov qword [rsp + 0x48], rax
test rax, rax
jne 0x1000d16ec
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov ebx, eax
xor r9d, r9d
mov r8d, eax
mov edx, 0x10b70197
xor ecx, ecx
call fcn.1000b51b8
jmp 0x1000d1a07
and qword [rsp + 0x28], 0
lea rax, [rsp + 0x108]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
mov edx, r12d
mov rcx, rbp
call fcn.1000cf3dc
mov ebx, eax
test eax, eax
je 0x1000d172f
xor r9d, r9d
mov r8d, eax
mov edx, 0x10c10197
xor ecx, ecx
call fcn.1000b51b8
jmp 0x1000d1a07
mov edi, dword [rsp + 0x108]
test edi, edi
jne 0x1000d1756
mov ebx, 0x80092007
xor r9d, r9d
mov r8d, ebx
mov edx, 0x10c60197
xor ecx, ecx
call fcn.1000b51b8
jmp 0x1000d1a07
mov rdx, rdi
shl rdx, 4
mov ecx, Ordinal_65
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
test rax, rax
jne 0x1000d178c
mov ebx, 0x8007000e
xor r9d, r9d
mov r8d, ebx
mov edx, 0x10cf0197
xor ecx, ecx
call fcn.1000b51b8
jmp 0x1000d19ce
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x108]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, r12d
mov rcx, rbp
call fcn.1000cf3dc
mov ebx, eax
test eax, eax
je 0x1000d17d3
xor r9d, r9d
mov r8d, eax
mov edx, 0x10d90197
xor ecx, ecx
call fcn.1000b51b8
mov edi, dword [rsp + 0x108]
jmp 0x1000d19ce
mov rdx, rsi
mov edi, dword [rsp + 0x108]
mov ecx, edi
call fcn.1000d1210
mov ebx, eax
test eax, eax
je 0x1000d1801
xor r9d, r9d
mov r8d, eax
mov edx, 0x10dc0197
xor ecx, ecx
call fcn.1000b51b8
jmp 0x1000d19ce
lea rdx, [rsp + 0x58]
mov rcx, qword [rsp + 0x40]
call fcn.1000b0bd4
mov ebx, eax
test eax, eax
je 0x1000d182d
xor r9d, r9d
mov r8d, eax
mov edx, 0x10df0197
xor ecx, ecx
call fcn.1000b51b8
jmp 0x1000d19ce
xor ebx, ebx
test edi, edi
je 0x1000d19ae
mov rax, rsi
mov qword [rsp + 0x60], rax
mov rax, qword [rax]
mov qword [rsp + 0x68], rax
cmp dword [rax + 0xc], r12d
jb 0x1000d1994
mov rax, qword [rax + 0x10]
mov rcx, qword [rax]
mov rax, qword [rcx + 0x10]
mov rcx, qword [rax]
mov rax, qword [rcx + 8]
mov rcx, qword [rax + 0x18]
add rcx, 0x60
and dword [rsp + 0x30], 0
test ebx, ebx
je 0x1000d18cd
mov rbp, rsi
mov r14d, dword [rsp + 0x30]
mov rdi, rcx
mov rax, qword [rbp]
mov rcx, qword [rax + 0x10]
mov rax, qword [rcx]
mov rcx, qword [rax + 0x10]
mov rax, qword [rcx]
mov rcx, qword [rax + 8]
mov r8, qword [rcx + 0x18]
add r8, 0x60
mov rdx, rdi
mov ecx, r12d
call qword [sym.imp.CRYPT32.dll_CertComparePublicKeyInfo]
test eax, eax
jne 0x1000d18b9
add r14d, r12d
add rbp, 0x10
cmp r14d, ebx
jb 0x1000d187f
mov dword [rsp + 0x30], r14d
mov edi, dword [rsp + 0x108]
mov r14, qword [rsp + 0x110]
and qword [rsp + 0x50], 0
mov rax, qword [rsp + 0x68]
mov rax, qword [rax + 0x10]
mov rcx, qword [rax]
mov rax, qword [rcx + 0x10]
mov rcx, qword [rax]
mov rax, qword [rcx + 8]
mov rdx, qword [rax + 0x18]
add rdx, 0x50
lea r9, [rsp + 0x50]
mov r8d, 0x2000003
mov ecx, r12d
call fcn.1000c1f24
test eax, eax
je 0x1000d191b
xor r9d, r9d
mov r8d, eax
mov edx, 0x11050197
xor ecx, ecx
call fcn.1000b51b8
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1000d192b
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea ebp, [rbx + 1]
xor eax, eax
cmp ebp, edi
cmove rax, qword [rsp + 0x118]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x38]
mov r8d, dword [rsp + 0x30]
mov edx, ebx
mov rcx, qword [rsp + 0x58]
call fcn.1000d0e00
mov ebx, eax
test eax, eax
jne 0x1000d1980
mov ebx, ebp
mov rax, qword [rsp + 0x60]
add rax, 0x10
mov qword [rsp + 0x60], rax
cmp ebp, edi
jb 0x1000d183f
jmp 0x1000d19ae
xor r9d, r9d
mov r8d, eax
mov edx, 0x111e0197
xor ecx, ecx
call fcn.1000b51b8
jmp 0x1000d19ce
mov r8d, 0x8007000d
mov ebx, r8d
xor r9d, r9d
mov edx, 0x10eb0197
xor ecx, ecx
call fcn.1000b51b8
jmp 0x1000d19ce
test r15, r15
je 0x1000d19c1
mov rax, qword [rsp + 0x40]
mov qword [r15], rax
and qword [rsp + 0x40], 0
test r14, r14
je 0x1000d19cc
mov qword [r14], r13
xor r13d, r13d
xor ebx, ebx
test rsi, rsi
je 0x1000d1a02
test edi, edi
je 0x1000d19f2
mov rbp, rsi
mov rcx, qword [rbp]
test rcx, rcx
je 0x1000d19e9
call qword [sym.imp.CRYPT32.dll_CertFreeCertificateChain]
add rbp, 0x10
sub rdi, r12
jne 0x1000d19da
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rbp, qword [rsp + 0x48]
jmp 0x1000d1a07
mov rbp, qword [rsp + 0x48]
test r13, r13
je 0x1000d1a15
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x40]
xor r13d, r13d
cmp rcx, r13
je 0x1000d1a28
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rax, qword [rsp + 0x58]
cmp rax, r13
je 0x1000d1a3b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp rbp, r13
je 0x1000d1bb2
mov rsi, r13
mov qword [rsp + 0x110], r13
lea r14, [0x10000d630]
mov qword [rsp + 0x80], r14
mov qword [rsp + 0x88], r13
mov qword [rsp + 0x90], r13
mov qword [rsp + 0x98], r13
mov dword [rsp + 0xa0], 0x80004005
mov dword [rsp + 0xa4], r13d
mov qword [rsp + 0xa8], r13
lea rcx, [rsp + 0x80]
call fcn.100038984
nop
xor edx, edx
mov rcx, rbp
call qword [sym.imp.CRYPT32.dll_CertEnumCertificatesInStore]
mov rbp, rax
cmp rax, r13
je 0x1000d1b60
mov r13, qword [rsp + 0x48]
test rsi, rsi
je 0x1000d1ad2
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
and qword [rsp + 0x110], 0
lea r8, [rsp + 0x110]
xor edx, edx
mov rcx, rbp
call fcn.1000cf2e4
mov rsi, qword [rsp + 0x110]
test eax, eax
jne 0x1000d1b38
cmp qword [rsi], 0
je 0x1000d1b38
mov rdx, qword [rsi]
mov eax, Ordinal_127
cmp ax, word [rdx]
jne 0x1000d1b38
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
sub rcx, r12
cmp rcx, 0x26
jne 0x1000d1b38
lea eax, [rcx + 0x57]
cmp ax, word [rdx + 0x4a]
jne 0x1000d1b38
or dword [rsi + 0x14], 0x20
lea rdx, [rsp + 0x80]
mov rcx, rsi
call fcn.1000967d8
mov rdx, rbp
mov rcx, r13
call qword [sym.imp.CRYPT32.dll_CertEnumCertificatesInStore]
mov rbp, rax
test rax, rax
jne 0x1000d1abb
test rsi, rsi
je 0x1000d1b65
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1000d1b65
mov r13, qword [rsp + 0x48]
mov qword [rsp + 0x80], r14
mov rcx, qword [rsp + 0x88]
call sub.msvcrt.dll_free
mov rcx, qword [rsp + 0x90]
call sub.msvcrt.dll_free
mov rcx, qword [rsp + 0x98]
call sub.msvcrt.dll_free
mov rcx, qword [rsp + 0xa8]
call sub.msvcrt.dll_free
mov edx, 2
mov rcx, r13
call qword [sym.imp.CRYPT32.dll_CertCloseStore]
xor r13d, r13d
mov rcx, qword [rsp + 0x78]
cmp rcx, r13
je 0x1000d1bc2
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp r12d, r13d
je 0x1000d1be9
xor edx, edx
lea rcx, [0x10002acd0]
call fcn.1000d39c4
xor edx, edx
lea rcx, [0x10000d750]
call fcn.1000d39c4
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov eax, ebx
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret