Function at 0x10a44f6
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 0x14]
push ebx
xor ebx, ebx
push esi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 4], ebx
cmp eax, ebx
je 0x10a4520
mov dword [eax], ebx
mov eax, dword [ebp + 0x18]
cmp eax, ebx
je 0x10a4529
mov dword [eax], ebx
mov eax, dword [ebp + 0x1c]
cmp eax, ebx
je 0x10a4532
mov dword [eax], ebx
push edi
push 2
call dword [sym.imp.ADVAPI32.dll_ImpersonateSelf]
test eax, eax
jne 0x10a4556
call fcn.01091f1e
mov esi, eax
push esi
push 0x10890197
call fcn.0108c503
jmp 0x10a483c
xor edi, edi
inc edi
push edi
push 0x101ec30
mov dword [ebp - 0x1c], edi
call fcn.010a72b9
mov esi, eax
cmp esi, ebx
je 0x10a4575
push esi
push 0x108e0197
jmp 0x10a454c
push edi
push 0x10027dc
call fcn.010a72b9
mov esi, eax
cmp esi, ebx
je 0x10a458e
push esi
push 0x10910197
jmp 0x10a454c
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x10a45ab
call fcn.01091f1e
mov esi, eax
push esi
push 0x10970197
jmp 0x10a454c
test al, 0x10
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
je 0x10a45c9
call fcn.010a2175
mov esi, eax
cmp esi, ebx
je 0x10a45df
push esi
push 0x109d0197
jmp 0x10a454c
call fcn.01091ad0
mov esi, eax
cmp esi, ebx
je 0x10a45df
push esi
push 0x10a20197
jmp 0x10a454c
push 7
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 8]
call sub.certcli.dll_Ordinal_223
mov esi, eax
cmp esi, ebx
je 0x10a4602
push esi
push 0x10a60197
jmp 0x10a454c
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.CRYPT32.dll_PFXIsPFXBlob]
test eax, eax
jne 0x10a4620
mov esi, 0x8007000d
push esi
push 0x10ad0197
jmp 0x10a454c
mov eax, dword [ebp + 0x10]
neg eax
sbb eax, eax
and eax, 0x4000
or eax, 0x21
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x28]
push eax
call fcn.01094269
mov edi, eax
mov dword [ebp - 0x14], edi
cmp edi, ebx
jne 0x10a4657
call fcn.01091f1e
mov esi, eax
push esi
push 0x10b70197
jmp 0x10a454c
push ebx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push 1
push edi
call fcn.010a0eaf
mov esi, eax
cmp esi, ebx
je 0x10a467a
push esi
push 0x10c10197
jmp 0x10a454c
mov eax, dword [ebp - 4]
cmp eax, ebx
jne 0x10a4691
mov esi, 0x80092007
push esi
push 0x10c60197
jmp 0x10a454c
shl eax, 3
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp + 8], eax
cmp eax, ebx
jne 0x10a46b1
mov esi, 0x8007000e
push esi
push 0x10cf0197
jmp 0x10a46ff
push eax
lea eax, [ebp - 4]
push eax
push ebx
push ebx
push 1
push edi
call fcn.010a0eaf
mov esi, eax
cmp esi, ebx
je 0x10a46ce
push esi
push 0x10d90197
jmp 0x10a46ff
push dword [ebp + 8]
push dword [ebp - 4]
call fcn.010a15c4
mov esi, eax
cmp esi, ebx
je 0x10a46e7
push esi
push 0x10dc0197
jmp 0x10a46ff
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0xc]
call fcn.0109099d
mov esi, eax
cmp esi, ebx
je 0x10a4709
push esi
push 0x10df0197
call fcn.0108c503
jmp 0x10a4810
cmp dword [ebp - 4], ebx
jbe 0x10a47f0
mov eax, dword [ebp + 8]
mov edi, dword [eax + ebx*8]
cmp dword [edi + 0xc], 1
jb 0x10a48ae
mov eax, dword [edi + 0x10]
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov esi, dword [eax + 0xc]
and dword [ebp + 0xc], 0
add esi, 0x38
test ebx, ebx
jbe 0x10a476f
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [eax + ecx*8]
mov eax, dword [eax + 0x10]
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov eax, dword [eax + 0xc]
add eax, 0x38
push eax
push esi
push 1
call dword [sym.imp.CRYPT32.dll_CertComparePublicKeyInfo]
test eax, eax
jne 0x10a476f
inc dword [ebp + 0xc]
cmp dword [ebp + 0xc], ebx
jb 0x10a473d
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x18]
push eax
mov eax, dword [edi + 0x10]
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov eax, dword [eax + 0xc]
push 0x2000003
add eax, 0x30
push eax
push 1
call fcn.0109489f
test eax, eax
je 0x10a47a6
push eax
push 0x11050197
call fcn.0108c503
cmp dword [ebp - 0x18], 0
je 0x10a47b5
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [ebx + 1]
mov dword [ebp - 0x20], eax
sub eax, dword [ebp - 4]
neg eax
sbb eax, eax
not eax
and eax, dword [ebp + 0x1c]
push eax
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
push dword [ebp - 0x10]
call fcn.010a43e3
mov esi, eax
test esi, esi
jne 0x10a48bb
mov ebx, dword [ebp - 0x20]
cmp ebx, dword [ebp - 4]
jb 0x10a4712
xor ebx, ebx
mov eax, dword [ebp + 0x14]
cmp eax, ebx
je 0x10a47ff
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
mov dword [ebp - 0xc], ebx
mov eax, dword [ebp + 0x18]
cmp eax, ebx
je 0x10a480e
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov dword [ebp - 8], ebx
xor esi, esi
cmp dword [ebp + 8], ebx
je 0x10a483c
xor edi, edi
cmp dword [ebp - 4], ebx
jbe 0x10a4833
mov eax, dword [ebp + 8]
mov eax, dword [eax + edi*8]
cmp eax, ebx
je 0x10a482d
push eax
call dword [sym.imp.CRYPT32.dll_CertFreeCertificateChain]
inc edi
cmp edi, dword [ebp - 4]
jb 0x10a481c
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edi, dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 8], ebx
je 0x10a484c
push dword [ebp - 8]
call edi
cmp dword [ebp - 0xc], ebx
je 0x10a4856
push dword [ebp - 0xc]
call edi
cmp dword [ebp - 0x10], ebx
je 0x10a4860
push dword [ebp - 0x10]
call edi
cmp dword [ebp - 0x14], ebx
je 0x10a487a
push 1
push dword [ebp - 0x14]
call fcn.010a2365
push 2
push dword [ebp - 0x14]
call dword [sym.imp.CRYPT32.dll_CertCloseStore]
cmp dword [ebp - 0x24], ebx
je 0x10a4884
push dword [ebp - 0x24]
call edi
pop edi
cmp dword [ebp - 0x1c], ebx
je 0x10a48a6
push ebx
push 0x101ec30
call fcn.010a72b9
push ebx
push 0x10027dc
call fcn.010a72b9
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov eax, esi
pop esi
pop ebx
leave
ret 0x18
mov esi, 0x8007000d
push esi
push 0x10eb0197
jmp 0x10a48c1
push esi
push 0x111e0197
call fcn.0108c503
xor ebx, ebx
jmp 0x10a4810