Function at 0x140018890
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0xe0]
sub rsp, 0x1e0
mov rax, qword [0x14005f020]
xor rax, rsp
mov qword [rbp + 0xd0], rax
movzx esi, r9b
mov rdi, rdx
mov rbx, rcx
mov rax, rdx
cmp qword [rdx + 0x18], 8
jb 0x1400188ce
mov rax, qword [rdx]
xor r14d, r14d
mov qword [rdx + 0x10], r14
mov word [rax], r14w
cmp qword [rcx + 0x18], 8
jb 0x1400188e3
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140018abd
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x140018abd
mov rax, qword [0x1400622b0]
test rax, rax
je 0x14001891e
call qword [case.0x1400132ae.0]
cmp eax, 0x12c
jg 0x140018ab3
lea rdx, str.GetSimpleDisplayCertNameFromFile:_File__s_does_not_exist.
lea rcx, [rsp + 0x40]
call fcn.140013f30
nop
mov qword [rsp + 0x20], rbx
lea rcx, [fcn.14000d130]
mov qword [rsp + 0x28], rcx
lea rcx, [0x14001a800]
mov qword [rsp + 0x30], rcx
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.14000cfd0
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.140014750
mov rcx, rax
mov rax, qword [0x1400622a8]
test rax, rax
je 0x140018982
mov edx, 0x12c
call qword [case.0x1400132ae.0]
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x1400189c5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400189bf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140018dfe
call fcn.14001f130
nop
cmp byte [rbp + 0x30], 0
je 0x140018a01
mov rcx, qword [rbp + 0x40]
test rcx, rcx
je 0x1400189fd
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x1400132ae.0]
mov r8, rax
test rax, rax
je 0x1400189fd
mov rcx, qword [rax]
mov rax, qword [rcx]
mov edx, 1
mov rcx, r8
call qword [case.0x1400132ae.0]
mov byte [rbp + 0x30], 0
lea rcx, [rbp - 0x50]
call fcn.140013c70
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x140018a4a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140018a45
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140018e04
call fcn.14001f130
mov qword [rbp - 0x68], r14
mov qword [rbp - 0x60], 7
mov word [rbp - 0x78], r14w
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140018aa9
mov rdx, qword [rsp + 0x68]
sub rdx, rcx
and rdx, 0xfffffffffffffffc
mov rax, rcx
cmp rdx, 0x1000
jb 0x140018a96
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140018e04
call fcn.14001f130
mov qword [rsp + 0x58], r14
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
lea rcx, [rsp + 0x40]
call fcn.14000cd80
mov eax, 2
jmp 0x140018ddb
mov dword [rbp + 0xc0], 0xaac56b
mov dword [rbp + 0xc4], 0x11d0cd44
mov dword [rbp + 0xc8], 0xc000c28c
mov dword [rbp + 0xcc], 0xee95c24f
mov qword [rbp + 0xa0], 0x20
cmp qword [rbx + 0x18], 8
jb 0x140018afa
mov rbx, qword [rbx]
mov qword [rbp + 0xa8], rbx
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xb0], xmm0
mov qword [rbp + 0x50], 0x50
mov qword [rbp + 0x70], 1
mov qword [rbp + 0x80], 1
mov qword [rbp + 0x58], r14
mov qword [rbp + 0x60], r14
lea eax, [rsi*2 + 2]
mov dword [rbp + 0x68], eax
mov dword [rbp + 0x6c], r14d
lea rax, [rbp + 0xa0]
mov qword [rbp + 0x78], rax
mov qword [rbp + 0x88], r14
mov qword [rbp + 0x90], r14
mov eax, 0x1012
mov ecx, 0x1212
cmp byte [rbp + 0x138], r14b
cmovne eax, ecx
mov dword [rbp + 0x98], eax
mov dword [rbp + 0x9c], r14d
lea r8, [rbp + 0x50]
lea rdx, [rbp + 0xc0]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.WINTRUST.dll_WinVerifyTrust]
mov ebx, eax
test eax, eax
jne 0x140018db7
mov rdx, qword [rbp + 0x88]
lea rcx, [rsp + 0x20]
call fcn.140018640
mov rdx, rax
mov rcx, rdi
call fcn.140005360
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x140018bf7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140018bf2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140018e0a
call fcn.14001f130
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], 7
mov word [rsp + 0x20], r14w
mov rax, qword [0x1400622b0]
test rax, rax
je 0x140018c26
call qword [case.0x1400132ae.0]
cmp eax, 0x46
jg 0x140018db7
lea rdx, str.GetSimpleDisplayCertNameFromFile:_Found_cert_name:__s.
lea rcx, [rsp + 0x40]
call fcn.140013f30
nop
mov qword [rsp + 0x20], rdi
lea rcx, [fcn.14000d130]
mov qword [rsp + 0x28], rcx
lea rcx, [0x14001a800]
mov qword [rsp + 0x30], rcx
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.14000cfd0
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.140014750
mov rcx, rax
mov rax, qword [0x1400622a8]
test rax, rax
je 0x140018c8a
mov edx, 0x46
call qword [case.0x1400132ae.0]
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x140018ccd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140018cc7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140018e10
call fcn.14001f130
nop
cmp byte [rbp + 0x30], 0
je 0x140018d09
mov rcx, qword [rbp + 0x40]
test rcx, rcx
je 0x140018d05
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x1400132ae.0]
mov r8, rax
test rax, rax
je 0x140018d05
mov rcx, qword [rax]
mov rax, qword [rcx]
mov edx, 1
mov rcx, r8
call qword [case.0x1400132ae.0]
mov byte [rbp + 0x30], 0
lea rcx, [rbp - 0x50]
call fcn.140013c70
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x140018d52
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140018d4d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140018df8
call fcn.14001f130
mov qword [rbp - 0x68], r14
mov qword [rbp - 0x60], 7
mov word [rbp - 0x78], r14w
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140018dad
mov rdx, qword [rsp + 0x68]
sub rdx, rcx
and rdx, 0xfffffffffffffffc
mov rax, rcx
cmp rdx, 0x1000
jb 0x140018d9a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140018df8
call fcn.14001f130
mov qword [rsp + 0x58], r14
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
lea rcx, [rsp + 0x40]
call fcn.14000cd80
mov dword [rbp + 0x80], 2
lea r8, [rbp + 0x50]
lea rdx, [rbp + 0xc0]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.WINTRUST.dll_WinVerifyTrust]
mov eax, ebx
mov rcx, qword [rbp + 0xd0]
xor rcx, rsp
call fcn.14001f110
add rsp, 0x1e0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14002ad18
nop
call fcn.14002ad18
nop
call fcn.14002ad18
int3
call fcn.14002ad18
nop
call fcn.14002ad18
int3