Function at 0x412020
Capabilities:
Check if file exists
Get file attributes
Link many functions at runtime
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x27c
mov eax, dword [0x49a11c]
xor eax, esp
mov dword [esp + 0x278], eax
mov eax, dword [esp + 0x284]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x28c]
xor ebx, ebx
push edi
push ebx
mov dword [esp + 0x24], esi
xor ebp, ebp
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4129e1
test al, 0x50
jne 0x4129e1
mov eax, dword [0x49c510]
test eax, eax
jne 0x4120a5
push eax
push str.crypt32.dll
call fcn.0040e630
add esp, 8
mov dword [0x49c510], eax
test eax, eax
je 0x4121e6
cmp dword [0x49c514], ebx
jne 0x4120cb
push str.CryptMsgClose
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x49c514], eax
test eax, eax
je 0x4121e6
mov eax, dword [0x49c510]
cmp dword [0x49c518], ebx
jne 0x4120f1
push str.CertCloseStore
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x49c518], eax
test eax, eax
je 0x4121e6
mov eax, dword [0x49c510]
cmp dword [0x49c51c], ebx
jne 0x412117
push str.CertFreeCertificateContext
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x49c51c], eax
test eax, eax
je 0x4121e6
mov eax, dword [0x49c510]
cmp dword [0x49c520], ebx
jne 0x41213d
push str.CertFindCertificateInStore
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x49c520], eax
test eax, eax
je 0x4121e6
mov eax, dword [0x49c510]
cmp dword [0x49c524], ebx
jne 0x412163
push str.CryptMsgGetParam
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x49c524], eax
test eax, eax
je 0x4121e6
mov eax, dword [0x49c510]
cmp dword [0x49c528], ebx
jne 0x412185
push str.CryptQueryObject
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x49c528], eax
test eax, eax
je 0x4121e6
mov eax, dword [0x49c510]
cmp dword [0x49c52c], ebx
jne 0x4121a7
push str.CertGetNameStringA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x49c52c], eax
test eax, eax
je 0x4121e6
mov eax, dword [0x49c510]
cmp dword [0x49c530], ebx
jne 0x4121c9
push str.CryptDecodeObjectEx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x49c530], eax
test eax, eax
je 0x4121e6
mov eax, dword [0x49c510]
cmp dword [0x49c534], ebx
jne 0x4121f0
push str.CertGetIssuerCertificateFromStore
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x49c534], eax
test eax, eax
jne 0x4121f0
mov ebx, 0x7e
jmp 0x4129e6
push 0
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x4c]
push eax
lea eax, [esp + 0x54]
push eax
lea eax, [esp + 0x5c]
push eax
push 0
push 2
push 0x400
push esi
mov esi, dword [0x49c528]
mov ecx, esi
push 1
call dword [0x485320]
call esi
mov ebp, eax
test ebp, ebp
jne 0x41223a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x4129e6
mov esi, dword [0x49c524]
lea eax, [esp + 0x2c]
push eax
push 0
push 0
push 6
push dword [esp + 0x2c]
mov ecx, esi
call dword [0x485320]
call esi
mov ebp, eax
test ebp, ebp
jne 0x41226c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x4129e6
push dword [esp + 0x2c]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
jne 0x41228e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
xor ebp, ebp
push esi
jmp 0x4129e8
mov edi, dword [0x49c524]
lea eax, [esp + 0x2c]
push eax
push esi
push 0
push 6
push dword [esp + 0x2c]
mov ecx, edi
call dword [0x485320]
call edi
mov ebp, eax
test ebp, ebp
jne 0x4122c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
jmp 0x4129e8
mov eax, dword [esi + 4]
mov ecx, dword [esi + 8]
mov edi, dword [0x49c520]
mov dword [esp + 0x94], eax
mov dword [esp + 0x98], ecx
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
push 0
mov dword [esp + 0x84], eax
lea eax, [esp + 0x80]
push eax
push 0xb0000
push 0
push 0x10001
push dword [esp + 0x28]
mov dword [esp + 0x9c], ecx
mov ecx, edi
call dword [0x485320]
call edi
mov dword [esp + 0x30], eax
test eax, eax
jne 0x41232a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
xor ebp, ebp
push esi
jmp 0x4129e8
cmp dword [esp + 0x10], ebx
je 0x41238d
mov edi, dword [0x49c52c]
lea ecx, [esp + 0x188]
push 0x100
push ecx
push 0
push 0
push 4
push eax
mov ecx, edi
mov byte [esp + 0x1a0], bl
call dword [0x485320]
call edi
push 7
lea eax, [esp + 0x18c]
push str.NVIDIA
push eax
call fcn.0045aa38
mov ecx, dword [esp + 0x1c]
add esp, 0xc
neg eax
sbb eax, eax
inc eax
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jne 0x4129c4
lea eax, [esp + 0x34]
mov dword [esp + 0x28], ebx
push eax
push esi
call fcn.0040c820
add esp, 8
test eax, eax
jne 0x4123ac
xorps xmm0, xmm0
movlpd qword [esp + 0x34], xmm0
mov eax, dword [esp + 0x14]
xor ebp, ebp
mov dword [esp + 0x24], eax
mov dword [esp + 0x10], ebp
mov dword [esp + 0x18], ebp
cmp dword [esi + 0x3c], ebp
jbe 0x4124f4
xor ebx, ebx
nop dword [eax]
test ebp, ebp
jne 0x4124f4
mov eax, dword [esi + 0x40]
push str.1.2.840.113549.1.9.6
push dword [ebx + eax]
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x4124df
mov eax, dword [esi + 0x40]
lea ecx, [esp + 0x3c]
mov edi, dword [0x49c530]
push ecx
lea ecx, [esp + 0x14]
mov eax, dword [ebx + eax + 8]
push ecx
push ebp
push 0x8000
push dword [eax]
mov ecx, edi
push dword [eax + 4]
push 0x1f4
push 0x10001
call dword [0x485320]
call edi
test eax, eax
je 0x4124f4
mov edx, dword [esp + 0x10]
mov edi, dword [0x49c520]
push ebp
mov eax, dword [edx + 4]
mov ecx, dword [edx + 8]
mov dword [esp + 0x108], eax
mov dword [esp + 0x10c], ecx
mov eax, dword [edx + 0xc]
mov ecx, dword [edx + 0x10]
mov dword [esp + 0xf4], eax
lea eax, [esp + 0xf0]
push eax
push 0xb0000
push ebp
push 0x10001
push dword [esp + 0x38]
mov dword [esp + 0x10c], ecx
mov ecx, edi
call dword [0x485320]
call edi
mov edi, eax
test edi, edi
je 0x4124f4
lea eax, [esp + 0x15c]
push eax
push dword [esp + 0x14]
call fcn.0040c820
add esp, 8
test eax, eax
je 0x4124ce
mov ecx, dword [esp + 0x15c]
mov eax, dword [esp + 0x160]
add ecx, 0x1312d00
adc eax, ebp
cmp dword [esp + 0x38], eax
ja 0x4124cc
jb 0x4124c5
cmp dword [esp + 0x34], ecx
ja 0x4124cc
mov ebp, 1
jmp 0x4124ce
xor ebp, ebp
push edi
mov edi, dword [0x49c51c]
mov ecx, edi
call dword [0x485320]
call edi
mov eax, dword [esp + 0x18]
add ebx, 0xc
inc eax
mov dword [esp + 0x18], eax
cmp eax, dword [esi + 0x3c]
jb 0x4123d0
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_LocalFree]
test ebp, ebp
jne 0x41267c
xor ebx, ebx
xor edi, edi
mov dword [esp + 0x10], ebx
cmp dword [esi + 0x3c], ebx
jbe 0x4127fc
nop word [eax + eax]
mov eax, dword [esi + 0x40]
push str.1.3.6.1.4.1.311.3.3.1
push dword [ebx + eax]
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x412547
inc edi
add ebx, 0xc
cmp edi, dword [esi + 0x3c]
jb 0x412520
push dword [esp + 0x10]
jmp 0x4127fd
mov eax, dword [esi + 0x40]
lea ecx, [edi + edi*2]
mov edi, dword [0x49c530]
mov eax, dword [eax + ecx*4 + 8]
lea ecx, [esp + 0x3c]
push ecx
lea ecx, [esp + 0x14]
push ecx
push 0
push 0x8000
push dword [eax]
mov ecx, edi
push dword [eax + 4]
push 0x21
push 0x10001
call dword [0x485320]
call edi
mov ebx, dword [esp + 0x10]
test eax, eax
je 0x4127fc
push 0
push dword [ebx + 4]
push dword [ebx + 8]
call fcn.0040ec50
add esp, 0xc
mov dword [esp + 0x24], edx
mov ebp, eax
test edx, edx
jne 0x4125ac
test ebp, ebp
je 0x4127fc
lea eax, [esp + 0x15c]
push eax
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
movzx eax, word [esp + 0x15c]
mov ebx, 0x64
cdq
mov ecx, eax
mov eax, edx
mul ebx
mov edi, eax
mov eax, ecx
mul ebx
add edi, edx
mov ecx, eax
movzx eax, word [esp + 0x15e]
cdq
add ecx, eax
adc edi, edx
mov eax, edi
mul ebx
mov edi, eax
mov eax, ecx
mul ebx
add edi, edx
mov ecx, eax
movzx eax, word [esp + 0x162]
cdq
add ecx, eax
adc edi, edx
mov eax, edi
mul ebx
mov edi, eax
mov eax, ecx
mul ebx
add edi, edx
mov ecx, eax
movzx eax, word [esp + 0x164]
cdq
add ecx, eax
adc edi, edx
mov eax, edi
mul ebx
mov edi, eax
mov eax, ecx
mul ebx
mov ecx, eax
add edi, edx
movzx eax, word [esp + 0x166]
cdq
add ecx, eax
adc edi, edx
mov eax, edi
mul ebx
mov edi, eax
mov eax, ecx
mul ebx
mov ecx, eax
add edi, edx
movzx eax, word [esp + 0x168]
cdq
add ecx, eax
mov eax, dword [esp + 0x24]
adc edi, edx
add ebp, 2
adc eax, 0
cmp edi, eax
ja 0x41253e
jb 0x412672
cmp ecx, ebp
ja 0x41253e
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0x23f0
call fcn.0040e430
mov ebx, dword [esp + 0x24]
add esp, 4
test eax, eax
jne 0x41285d
push ebx
call fcn.0040e1f0
add esp, 4
test eax, eax
je 0x41285d
mov eax, dword [0x49c538]
xorps xmm0, xmm0
movq qword [esp + 0x17c], xmm0
mov dword [esp + 0x184], 0
mov dword [esp + 0x18], 0
movups xmmword [esp + 0x16c], xmm0
test eax, eax
jne 0x4126f1
push eax
push 0x488f44
call fcn.0040e630
add esp, 8
mov dword [0x49c538], eax
test eax, eax
je 0x41284d
cmp dword [0x49c54c], 0
jne 0x412718
push 0x489020
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x49c54c], eax
test eax, eax
je 0x41284d
mov eax, dword [0x49c538]
cmp dword [0x49c550], 0
jne 0x41273f
push 0x489030
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x49c550], eax
test eax, eax
je 0x41284d
mov eax, dword [0x49c538]
cmp dword [0x49c558], 0
jne 0x412766
push str.QueryServiceStatus
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x49c558], eax
test eax, eax
je 0x41284d
mov eax, dword [0x49c538]
cmp dword [0x49c55c], 0
jne 0x412788
push 0x489054
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x49c55c], eax
test eax, eax
je 0x41284d
mov edi, dword [0x49c54c]
mov ecx, edi
push 0x80000000
push 0
push 0
call dword [0x485320]
call edi
mov ebx, eax
test ebx, ebx
je 0x412846
mov edi, dword [0x49c550]
mov ecx, edi
push 4
push str.CryptSvc
push ebx
call dword [0x485320]
call edi
mov ebp, eax
test ebp, ebp
je 0x412835
mov edi, dword [0x49c558]
lea eax, [esp + 0x16c]
push eax
push ebp
mov ecx, edi
call dword [0x485320]
call edi
test eax, eax
je case.default.0x4127f5
mov eax, dword [esp + 0x170]
add eax, 0xfffffffc
cmp eax, 3
ja case.default.0x4127f5
jmp dword [eax*4 + 0x412a44]
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor ebp, ebp
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, 0x80096005
test ebx, ebx
cmove ebx, eax
jmp 0x4129c4
mov dword [esp + 0x18], 1
mov edi, dword [0x49c55c]
mov ecx, edi
push ebp
call dword [0x485320]
call edi
mov edi, dword [0x49c55c]
mov ecx, edi
push ebx
call dword [0x485320]
call edi
cmp dword [esp + 0x18], 0
jne 0x412859
mov ebp, 1
xor ebx, ebx
jmp 0x4129c4
mov ebx, dword [esp + 0x20]
mov eax, dword [0x49c580]
test eax, eax
jne 0x41287d
push eax
push str.wintrust.dll
call fcn.0040e630
add esp, 8
mov dword [0x49c580], eax
test eax, eax
je 0x41289f
mov edi, dword [0x49c584]
test edi, edi
jne 0x4128a9
push str.WinVerifyTrust
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
mov dword [0x49c584], edi
test edi, edi
jne 0x4128a9
xor ebp, ebp
lea ebx, [ebp + 0x7e]
jmp 0x4129c4
lea eax, [esp + 0x16c]
mov dword [esp + 0x15c], 0xaac56b
mov dword [esp + 0x64], eax
xorps xmm0, xmm0
lea eax, [esp + 0x4c]
movlpd qword [esp + 0x74], xmm0
or dword [esp + 0x74], 0x1000
xor ebp, ebp
push eax
lea eax, [esp + 0x160]
mov dword [esp + 0x164], 0x11d0cd44
push eax
push 0xffffffffffffffff
mov ecx, edi
mov dword [esp + 0x170], 0xc000c28c
mov dword [esp + 0x174], 0xee95c24f
movlpd qword [esp + 0x180], xmm0
mov dword [esp + 0x178], 0x10
mov dword [esp + 0x17c], ebx
movlpd qword [esp + 0x5c], xmm0
movlpd qword [esp + 0x78], xmm0
mov dword [esp + 0x58], 0x30
mov dword [esp + 0x64], 2
mov dword [esp + 0x68], 1
mov dword [esp + 0x6c], 1
mov dword [esp + 0x74], ebp
call dword [0x485320]
call edi
mov ebx, eax
test ebx, ebx
jne 0x412964
mov ebx, dword [esp + 0x28]
lea ebp, [eax + 1]
cmp ebx, 0x800b010a
jne 0x4129c4
mov edi, dword [0x49c534]
lea eax, [esp + 0x28]
push eax
push 0
push dword [esp + 0x38]
mov ecx, edi
mov dword [esp + 0x34], 0
push dword [esp + 0x20]
call dword [0x485320]
call edi
mov edi, eax
test edi, edi
je 0x4129c4
mov ecx, dword [edi + 0xc]
add ecx, 0x44
push ecx
call fcn.0040cc40
add esp, 4
test eax, eax
je 0x4129b3
mov ebp, 1
xor ebx, ebx
push edi
mov edi, dword [0x49c51c]
mov ecx, edi
call dword [0x485320]
call edi
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [esp + 0x30]
mov esi, dword [0x49c51c]
mov ecx, esi
call dword [0x485320]
call esi
jmp 0x4129ee
mov ebx, 2
push 0
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x412a09
mov esi, dword [0x49c518]
mov ecx, esi
push 0
push eax
call dword [0x485320]
call esi
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x412a22
mov esi, dword [0x49c514]
mov ecx, esi
push eax
call dword [0x485320]
call esi
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [esp + 0x288]
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0042e033
add esp, 0x27c
ret