Function at 0x140019d00
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0xe0]
sub rsp, 0x1e0
mov rax, qword [0x140060030]
xor rax, rsp
mov qword [rbp + 0xd0], rax
movzx esi, r9b
mov rdi, rdx
mov rbx, rcx
mov rax, rdx
cmp qword [rdx + 0x18], 8
jb 0x140019d3e
mov rax, qword [rdx]
xor r14d, r14d
mov qword [rdx + 0x10], r14
mov word [rax], r14w
cmp qword [rcx + 0x18], 8
jb 0x140019d53
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140019f2d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x140019f2d
mov rax, qword [0x140063160]
test rax, rax
je 0x140019d8e
call qword [0x1400453a0]
cmp eax, 0x12c
jg 0x140019f23
lea rdx, str.GetSimpleDisplayCertNameFromFile:_File__s_does_not_exist.
lea rcx, [rsp + 0x40]
call fcn.1400153d0
nop
mov qword [rsp + 0x20], rbx
lea rcx, [fcn.14000e460]
mov qword [rsp + 0x28], rcx
lea rcx, [0x14001c0c0]
mov qword [rsp + 0x30], rcx
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.14000e2f0
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.140015bd0
mov rcx, rax
mov rax, qword [0x140063158]
test rax, rax
je 0x140019df2
mov edx, 0x12c
call qword [0x1400453a0]
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x140019e35
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019e2f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001a26e
call fcn.140020a20
nop
cmp byte [rbp + 0x30], 0
je 0x140019e71
mov rcx, qword [rbp + 0x40]
test rcx, rcx
je 0x140019e6d
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400453a0]
mov r8, rax
test rax, rax
je 0x140019e6d
mov rcx, qword [rax]
mov rax, qword [rcx]
mov edx, 1
mov rcx, r8
call qword [0x1400453a0]
mov byte [rbp + 0x30], 0
lea rcx, [rbp - 0x50]
call fcn.140015110
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x140019eba
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019eb5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001a274
call fcn.140020a20
mov qword [rbp - 0x68], r14
mov qword [rbp - 0x60], 7
mov word [rbp - 0x78], r14w
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140019f19
mov rdx, qword [rsp + 0x68]
sub rdx, rcx
and rdx, 0xfffffffffffffffc
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019f06
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001a274
call fcn.140020a20
mov qword [rsp + 0x58], r14
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
lea rcx, [rsp + 0x40]
call fcn.14000e0a0
mov eax, 2
jmp 0x14001a24b
mov dword [rbp + 0xc0], 0xaac56b
mov dword [rbp + 0xc4], 0x11d0cd44
mov dword [rbp + 0xc8], 0xc000c28c
mov dword [rbp + 0xcc], 0xee95c24f
mov qword [rbp + 0xa0], 0x20
cmp qword [rbx + 0x18], 8
jb 0x140019f6a
mov rbx, qword [rbx]
mov qword [rbp + 0xa8], rbx
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xb0], xmm0
mov qword [rbp + 0x50], 0x50
mov qword [rbp + 0x70], 1
mov qword [rbp + 0x80], 1
mov qword [rbp + 0x58], r14
mov qword [rbp + 0x60], r14
lea eax, [rsi*2 + 2]
mov dword [rbp + 0x68], eax
mov dword [rbp + 0x6c], r14d
lea rax, [rbp + 0xa0]
mov qword [rbp + 0x78], rax
mov qword [rbp + 0x88], r14
mov qword [rbp + 0x90], r14
mov eax, 0x1012
mov ecx, 0x1212
cmp byte [rbp + 0x138], r14b
cmovne eax, ecx
mov dword [rbp + 0x98], eax
mov dword [rbp + 0x9c], r14d
lea r8, [rbp + 0x50]
lea rdx, [rbp + 0xc0]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.WINTRUST.dll_WinVerifyTrust]
mov ebx, eax
test eax, eax
jne 0x14001a227
mov rdx, qword [rbp + 0x88]
lea rcx, [rsp + 0x20]
call fcn.140019a10
mov rdx, rax
mov rcx, rdi
call fcn.140005e30
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x14001a067
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a062
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001a27a
call fcn.140020a20
movdqa xmm0, xmmword [0x1400583c0]
movdqu xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x20], r14w
mov rax, qword [0x140063160]
test rax, rax
je 0x14001a096
call qword [0x1400453a0]
cmp eax, 0x46
jg 0x14001a227
lea rdx, str.GetSimpleDisplayCertNameFromFile:_Found_cert_name:__s.
lea rcx, [rsp + 0x40]
call fcn.1400153d0
nop
mov qword [rsp + 0x20], rdi
lea rcx, [fcn.14000e460]
mov qword [rsp + 0x28], rcx
lea rcx, [0x14001c0c0]
mov qword [rsp + 0x30], rcx
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.14000e2f0
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.140015bd0
mov rcx, rax
mov rax, qword [0x140063158]
test rax, rax
je 0x14001a0fa
mov edx, 0x46
call qword [0x1400453a0]
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x14001a13d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a137
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001a280
call fcn.140020a20
nop
cmp byte [rbp + 0x30], 0
je 0x14001a179
mov rcx, qword [rbp + 0x40]
test rcx, rcx
je 0x14001a175
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400453a0]
mov r8, rax
test rax, rax
je 0x14001a175
mov rcx, qword [rax]
mov rax, qword [rcx]
mov edx, 1
mov rcx, r8
call qword [0x1400453a0]
mov byte [rbp + 0x30], 0
lea rcx, [rbp - 0x50]
call fcn.140015110
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x14001a1c2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a1bd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001a268
call fcn.140020a20
mov qword [rbp - 0x68], r14
mov qword [rbp - 0x60], 7
mov word [rbp - 0x78], r14w
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14001a21d
mov rdx, qword [rsp + 0x68]
sub rdx, rcx
and rdx, 0xfffffffffffffffc
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a20a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001a268
call fcn.140020a20
mov qword [rsp + 0x58], r14
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
lea rcx, [rsp + 0x40]
call fcn.14000e0a0
mov dword [rbp + 0x80], 2
lea r8, [rbp + 0x50]
lea rdx, [rbp + 0xc0]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.WINTRUST.dll_WinVerifyTrust]
mov eax, ebx
mov rcx, qword [rbp + 0xd0]
xor rcx, rsp
call fcn.140020a00
add rsp, 0x1e0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14002c9f4
nop
call fcn.14002c9f4
nop
call fcn.14002c9f4
int3
call fcn.14002c9f4
nop
call fcn.14002c9f4
int3