Function at 0x10a4504
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 0x14]
push ebx
xor ebx, ebx
push esi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 4], ebx
cmp eax, ebx
je 0x10a452e
mov dword [eax], ebx
mov eax, dword [ebp + 0x18]
cmp eax, ebx
je 0x10a4537
mov dword [eax], ebx
mov eax, dword [ebp + 0x1c]
cmp eax, ebx
je 0x10a4540
mov dword [eax], ebx
push edi
push 2
call dword [sym.imp.ADVAPI32.dll_ImpersonateSelf]
test eax, eax
jne 0x10a4564
call fcn.01091f43
mov esi, eax
push esi
push 0x10890197
call fcn.0108c55a
jmp 0x10a484a
xor edi, edi
inc edi
push edi
push 0x101ecc0
mov dword [ebp - 0x1c], edi
call fcn.010a7263
mov esi, eax
cmp esi, ebx
je 0x10a4583
push esi
push 0x108e0197
jmp 0x10a455a
push edi
push 0x10027f4
call fcn.010a7263
mov esi, eax
cmp esi, ebx
je 0x10a459c
push esi
push 0x10910197
jmp 0x10a455a
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x10a45b9
call fcn.01091f43
mov esi, eax
push esi
push 0x10970197
jmp 0x10a455a
test al, 0x10
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
je 0x10a45d7
call fcn.010a2183
mov esi, eax
cmp esi, ebx
je 0x10a45ed
push esi
push 0x109d0197
jmp 0x10a455a
call fcn.01091af5
mov esi, eax
cmp esi, ebx
je 0x10a45ed
push esi
push 0x10a20197
jmp 0x10a455a
push 7
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 8]
call sub.certcli.dll_Ordinal_223
mov esi, eax
cmp esi, ebx
je 0x10a4610
push esi
push 0x10a60197
jmp 0x10a455a
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.CRYPT32.dll_PFXIsPFXBlob]
test eax, eax
jne 0x10a462e
mov esi, 0x8007000d
push esi
push 0x10ad0197
jmp 0x10a455a
mov eax, dword [ebp + 0x10]
neg eax
sbb eax, eax
and eax, 0x4000
or eax, 0x21
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x28]
push eax
call fcn.01094290
mov edi, eax
mov dword [ebp - 0x14], edi
cmp edi, ebx
jne 0x10a4665
call fcn.01091f43
mov esi, eax
push esi
push 0x10b70197
jmp 0x10a455a
push ebx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push 1
push edi
call fcn.010a0ebd
mov esi, eax
cmp esi, ebx
je 0x10a4688
push esi
push 0x10c10197
jmp 0x10a455a
mov eax, dword [ebp - 4]
cmp eax, ebx
jne 0x10a469f
mov esi, 0x80092007
push esi
push 0x10c60197
jmp 0x10a455a
shl eax, 3
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp + 8], eax
cmp eax, ebx
jne 0x10a46bf
mov esi, 0x8007000e
push esi
push 0x10cf0197
jmp 0x10a470d
push eax
lea eax, [ebp - 4]
push eax
push ebx
push ebx
push 1
push edi
call fcn.010a0ebd
mov esi, eax
cmp esi, ebx
je 0x10a46dc
push esi
push 0x10d90197
jmp 0x10a470d
push dword [ebp + 8]
push dword [ebp - 4]
call fcn.010a15d2
mov esi, eax
cmp esi, ebx
je 0x10a46f5
push esi
push 0x10dc0197
jmp 0x10a470d
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0xc]
call fcn.010909c2
mov esi, eax
cmp esi, ebx
je 0x10a4717
push esi
push 0x10df0197
call fcn.0108c55a
jmp 0x10a481e
cmp dword [ebp - 4], ebx
jbe 0x10a47fe
mov eax, dword [ebp + 8]
mov edi, dword [eax + ebx*8]
cmp dword [edi + 0xc], 1
jb 0x10a48bc
mov eax, dword [edi + 0x10]
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov esi, dword [eax + 0xc]
and dword [ebp + 0xc], 0
add esi, 0x38
test ebx, ebx
jbe 0x10a477d
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [eax + ecx*8]
mov eax, dword [eax + 0x10]
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov eax, dword [eax + 0xc]
add eax, 0x38
push eax
push esi
push 1
call dword [sym.imp.CRYPT32.dll_CertComparePublicKeyInfo]
test eax, eax
jne 0x10a477d
inc dword [ebp + 0xc]
cmp dword [ebp + 0xc], ebx
jb 0x10a474b
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x18]
push eax
mov eax, dword [edi + 0x10]
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov eax, dword [eax + 0xc]
push 0x2000003
add eax, 0x30
push eax
push 1
call fcn.010948bd
test eax, eax
je 0x10a47b4
push eax
push 0x11050197
call fcn.0108c55a
cmp dword [ebp - 0x18], 0
je 0x10a47c3
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [ebx + 1]
mov dword [ebp - 0x20], eax
sub eax, dword [ebp - 4]
neg eax
sbb eax, eax
not eax
and eax, dword [ebp + 0x1c]
push eax
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
push dword [ebp - 0x10]
call fcn.010a43f1
mov esi, eax
test esi, esi
jne 0x10a48c9
mov ebx, dword [ebp - 0x20]
cmp ebx, dword [ebp - 4]
jb 0x10a4720
xor ebx, ebx
mov eax, dword [ebp + 0x14]
cmp eax, ebx
je 0x10a480d
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
mov dword [ebp - 0xc], ebx
mov eax, dword [ebp + 0x18]
cmp eax, ebx
je 0x10a481c
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov dword [ebp - 8], ebx
xor esi, esi
cmp dword [ebp + 8], ebx
je 0x10a484a
xor edi, edi
cmp dword [ebp - 4], ebx
jbe 0x10a4841
mov eax, dword [ebp + 8]
mov eax, dword [eax + edi*8]
cmp eax, ebx
je 0x10a483b
push eax
call dword [sym.imp.CRYPT32.dll_CertFreeCertificateChain]
inc edi
cmp edi, dword [ebp - 4]
jb 0x10a482a
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edi, dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 8], ebx
je 0x10a485a
push dword [ebp - 8]
call edi
cmp dword [ebp - 0xc], ebx
je 0x10a4864
push dword [ebp - 0xc]
call edi
cmp dword [ebp - 0x10], ebx
je 0x10a486e
push dword [ebp - 0x10]
call edi
cmp dword [ebp - 0x14], ebx
je 0x10a4888
push 1
push dword [ebp - 0x14]
call fcn.010a2373
push 2
push dword [ebp - 0x14]
call dword [sym.imp.CRYPT32.dll_CertCloseStore]
cmp dword [ebp - 0x24], ebx
je 0x10a4892
push dword [ebp - 0x24]
call edi
pop edi
cmp dword [ebp - 0x1c], ebx
je 0x10a48b4
push ebx
push 0x101ecc0
call fcn.010a7263
push ebx
push 0x10027f4
call fcn.010a7263
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov eax, esi
pop esi
pop ebx
leave
ret 0x18
mov esi, 0x8007000d
push esi
push 0x10eb0197
jmp 0x10a48cf
push esi
push 0x111e0197
call fcn.0108c55a
xor ebx, ebx
jmp 0x10a481e