Function at 0x14000686c
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x460]
sub rsp, 0x560
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x450], rax
mov r14, rdx
mov rsi, rcx
lea rdx, str.etVerifyEmbeddedSignature
lea rcx, str.Tool_windows
xor ebx, ebx
mov rdi, r8
mov r13d, ebx
call fcn.140001208
lea rdx, str.pwszSourceFile
mov rcx, rax
mov r8, rsi
mov r15, rax
call fcn.140002570
mov rcx, r15
call fcn.140001214
lea r8d, [rbx + 0x50]
lea rcx, [rsp + 0x68]
xor edx, edx
mov dword [rbp], 0xaac56b
mov dword [rbp + 4], 0x11d0cd44
mov dword [rbp + 8], 0xc000c28c
mov dword [rbp + 0xc], 0xee95c24f
mov dword [rsp + 0x60], ebx
call fcn.140009540
xor eax, eax
lea r8d, [rbx + 0x1c]
lea rcx, [rbp - 0x1c]
xor edx, edx
mov dword [rbp - 0x40], ebx
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rax
mov dword [rbp - 0x20], ebx
call fcn.140009540
lea rcx, [rbp + 0x242]
xor edx, edx
mov r8d, 0x206
mov word [rbp + 0x240], bx
call fcn.140009540
lea rcx, [rbp + 0x240]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea rcx, [rbp + 0x240]
test eax, eax
je 0x140006973
lea r8, str.Wintrust.dll
call fcn.140006704
jmp 0x14000697f
lea r8, str.C:WindowsSystem32Wintrust.dll
call fcn.1400066dc
mov rax, qword [0x14001b738]
mov dword [rdi], ebx
test rax, rax
jne 0x1400069a1
lea rcx, [rbp + 0x240]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x14001b738], rax
cmp qword [0x14001b730], rbx
jne 0x1400069cd
test rax, rax
je 0x1400069cd
lea rdx, str.WinVerifyTrust
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14001b730], rax
mov rax, qword [0x14001b738]
cmp qword [0x14001b728], rbx
jne 0x1400069f9
test rax, rax
je 0x1400069f9
lea rdx, str.WTHelperProvDataFromStateData
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14001b728], rax
mov rax, qword [0x14001b738]
mov rcx, qword [0x14001b720]
test rcx, rcx
jne 0x140006a2b
test rax, rax
je 0x140006a2b
lea rdx, str.WTHelperGetProvSignerFromChain
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
mov qword [0x14001b720], rax
mov rax, qword [0x14001b738]
mov rdx, qword [0x14001b718]
test rdx, rdx
jne 0x140006a64
test rax, rax
je 0x140006a64
lea rdx, str.WTHelperGetProvCertFromChain
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14001b720]
mov rdx, rax
mov qword [0x14001b718], rax
mov rax, qword [0x14001b738]
cmp qword [0x14001b730], rbx
je 0x1400071df
cmp qword [0x14001b728], rbx
je 0x1400071df
test rcx, rcx
je 0x1400071df
test rdx, rdx
je 0x1400071df
mov r12d, 0x20
lea rcx, [rbp - 0x40]
xor edx, edx
mov r8d, r12d
call fcn.140009540
mov dword [rbp - 0x40], r12d
mov r12d, 0x58
lea rcx, [rsp + 0x60]
mov r8d, r12d
xor edx, edx
mov qword [rbp - 0x38], rsi
mov qword [rbp - 0x30], rbx
mov qword [rbp - 0x28], rbx
call fcn.140009540
lea eax, [r12 - 0x57]
mov dword [rsp + 0x60], r12d
mov dword [rbp - 0x80], eax
mov dword [rbp - 0x70], eax
lea rax, [rbp - 0x40]
mov qword [rbp - 0x78], rax
lea rax, [rbp - 0x20]
lea r8, [rsp + 0x60]
lea rdx, [rbp]
mov r12d, 3
xor ecx, ecx
mov qword [rbp - 0x50], rax
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], 2
mov qword [rbp - 0x58], 0x1010
mov qword [rbp - 0x68], rbx
mov qword [rbp - 0x60], rbx
mov qword [rbp - 0x20], 0x20
mov dword [rbp - 0x18], r12d
call qword [0x14001b730]
cmp eax, 0x80092003
je 0x140006bd8
cmp eax, 0x80092026
je 0x140006bcc
cmp eax, 0x800b0004
je 0x140006bc0
cmp eax, 0x800b0100
je 0x140006b7e
cmp eax, 0x800b0111
je 0x140006b72
test eax, eax
je 0x140006b6a
mov dword [r14], 8
jmp 0x14000717a
mov dword [r14], ebx
jmp 0x140006c0b
mov dword [r14], 5
jmp 0x14000717a
mov dword [r14], 2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r13d, eax
cmp eax, 0x800b0001
je 0x140006bb7
cmp eax, 0x800b0003
je 0x140006baf
cmp eax, 0x800b0100
jne 0x140006c02
mov dword [r14], 2
jmp 0x14000717a
mov dword [r14], r12d
jmp 0x14000717a
mov dword [r14], 4
jmp 0x140006c02
mov dword [r14], 6
jmp 0x14000717a
mov dword [r14], 7
jmp 0x14000717a
mov rcx, rsi
mov dword [r14], 9
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140006c02
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r13d, eax
cmp eax, 2
jne 0x140006c02
mov dword [r14], 1
cmp dword [r14], ebx
jne 0x14000717a
mov rcx, qword [rbp - 0x68]
call qword [0x14001b728]
test rax, rax
je 0x140006e8d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [0x14001b720]
mov rsi, rax
test rax, rax
je 0x140006e8d
mov r12d, 0x104
lea rcx, [rbp + 0x131]
xor edx, edx
mov r8d, r12d
mov byte [rbp + 0x130], bl
call fcn.140009540
lea rcx, [rsi + 4]
lea rdx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea rdx, [rbp + 0x10]
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
movzx ecx, word [rbp + 0x1a]
movzx edx, word [rbp + 0x18]
movzx r8d, word [rbp + 0x10]
movzx eax, word [rbp + 0x1c]
movzx r10d, word [rbp + 0x12]
movzx r9d, word [rbp + 0x16]
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x38], ecx
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x28], r8d
lea rcx, [rbp + 0x130]
lea r8, str._.2d__.2d__.4d_at__.2d:_2.d:_.2d
mov edx, r12d
mov dword [rsp + 0x20], r10d
call fcn.140008cf0
lea r8, [rbp + 0x130]
lea rdx, str.szDate
mov rcx, r15
call fcn.140001354
lea rdx, str.Signature_Date
mov rcx, r15
call fcn.1400012b0
xor edx, edx
mov rcx, rsi
call qword [0x14001b718]
test rax, rax
je 0x140006e8d
mov rcx, qword [rax + 8]
call fcn.1400067f4
mov rsi, rax
test rax, rax
je 0x140006e8d
lea rdx, str.CNGemalto
mov rcx, rax
call sub.SHLWAPI.dll_StrStrIA
test rax, rax
jne 0x140006d33
lea rdx, str.CN_Gemalto
mov rcx, rsi
call sub.SHLWAPI.dll_StrStrIA
test rax, rax
je 0x140006d36
or dword [rdi], 2
lea rdx, str.OID.2.5.4.15Private_Organization__OID.1.3.6.1.4.1.311.60.2.1.3US__OID.1.3.6.1.4.1.311.60.2.1.2Delaware__SERIALNUMBER2177038__CUS__SMaryland__LBelcamp__O_Thales_DIS_CPL_USA__Inc.___CN_Thales_DIS_CPL_USA__Inc._
mov rcx, rsi
call sub.SHLWAPI.dll_StrStrIA
test rax, rax
je 0x140006d4d
or dword [rdi], 8
lea rdx, str.CNMicrosoft
mov rcx, rsi
call sub.SHLWAPI.dll_StrStrIA
test rax, rax
je 0x140006d64
or dword [rdi], 4
lea rdx, str.CNSentryBay_Limited
mov rcx, rsi
call sub.SHLWAPI.dll_StrStrIA
test rax, rax
je 0x140006dc7
lea rdx, str.CGB
mov rcx, rsi
call sub.SHLWAPI.dll_StrStrIA
test rax, rax
je 0x140006dc7
lea rdx, str.CNSentryBay_Limited
mov rcx, rsi
call sub.SHLWAPI.dll_StrStrIA
lea rcx, str.CNSentryBay_Limited
mov r12, rax
call fcn.140009480
mov rcx, rsi
add r12, rax
call fcn.140009480
add rax, rsi
cmp r12, rax
je 0x140006dc4
cmp byte [r12], 0x2c
jne 0x140006dc7
or dword [rdi], 0x10
lea rdx, str.CNGemalto
mov rcx, rsi
call sub.SHLWAPI.dll_StrStrIA
test rax, rax
jne 0x140006e42
lea rdx, str.CN_Gemalto
mov rcx, rsi
call sub.SHLWAPI.dll_StrStrIA
test rax, rax
jne 0x140006e42
lea rdx, str.OID.2.5.4.15Private_Organization__OID.1.3.6.1.4.1.311.60.2.1.3US__OID.1.3.6.1.4.1.311.60.2.1.2Delaware__SERIALNUMBER2177038__CUS__SMaryland__LBelcamp__O_Thales_DIS_CPL_USA__Inc.___CN_Thales_DIS_CPL_USA__Inc._
mov rcx, rsi
call sub.SHLWAPI.dll_StrStrIA
test rax, rax
jne 0x140006e42
lea rdx, str.CNMicrosoft
mov rcx, rsi
call sub.SHLWAPI.dll_StrStrIA
test rax, rax
jne 0x140006e42
lea rdx, str.CNSentryBay_Limited
mov rcx, rsi
call sub.SHLWAPI.dll_StrStrIA
test rax, rax
je 0x140006e3f
lea rdx, str.CGB
mov rcx, rsi
call sub.SHLWAPI.dll_StrStrIA
test rax, rax
jne 0x140006e42
or dword [rdi], 1
lea rdx, str.szCertDesc
mov r8, rsi
mov rcx, r15
call fcn.140001354
lea rdx, str.Certificate_Description
mov rcx, r15
call fcn.1400012b0
mov r8d, dword [rdi]
lea rdx, str.signedBy
mov rcx, r15
call fcn.1400013fc
lea rdx, str.SignedBy
mov rcx, r15
call fcn.1400012b0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rax, qword [rbp - 0x50]
mov r12d, 1
mov dword [rsp + 0x50], r12d
cmp dword [rax + 0xc], r12d
jb 0x14000717a
lea r8, [rsp + 0x60]
lea rdx, [rbp]
xor ecx, ecx
mov dword [rbp - 0x70], 2
call qword [0x14001b730]
test eax, eax
jne 0x14000717a
mov rax, qword [rbp - 0x50]
mov qword [rbp - 0x68], rbx
mov dword [rbp - 0x70], 1
lea r8, [rsp + 0x60]
lea rdx, [rbp]
xor ecx, ecx
mov dword [rax + 4], r12d
call qword [0x14001b730]
mov rcx, qword [rbp - 0x68]
call qword [0x14001b728]
test rax, rax
je 0x140007164
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [0x14001b720]
mov rsi, rax
test rax, rax
je 0x140007164
lea rcx, [rbp + 0x21]
xor edx, edx
mov r8d, 0x104
mov byte [rbp + 0x20], bl
call fcn.140009540
lea rcx, [rsi + 4]
lea rdx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea rdx, [rbp + 0x10]
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
movzx ecx, word [rbp + 0x1a]
movzx edx, word [rbp + 0x18]
movzx r8d, word [rbp + 0x10]
movzx eax, word [rbp + 0x1c]
movzx r10d, word [rbp + 0x12]
movzx r9d, word [rbp + 0x16]
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x38], ecx
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x28], r8d
lea rcx, [rbp + 0x20]
lea r8, str._.2d__.2d__.4d_at__.2d:_2.d:_.2d
mov edx, 0x104
mov dword [rsp + 0x20], r10d
call fcn.140008cf0
lea r8, [rbp + 0x20]
lea rdx, str.szDate
mov rcx, r15
call fcn.140001354
lea rdx, str.Signature_Date
mov rcx, r15
call fcn.1400012b0
xor edx, edx
mov rcx, rsi
call qword [0x14001b718]
test rax, rax
je 0x140007164
mov rcx, qword [rax + 8]
call fcn.1400067f4
mov rsi, rax
test rax, rax
je 0x140007164
lea rdx, str.CNGemalto
mov rcx, rax
call sub.SHLWAPI.dll_StrStrIA
test rax, rax
jne 0x140007005
lea rdx, str.CN_Gemalto
mov rcx, rsi
call sub.SHLWAPI.dll_StrStrIA
test rax, rax
je 0x140007008
or dword [rdi], 2
lea rdx, str.OID.2.5.4.15Private_Organization__OID.1.3.6.1.4.1.311.60.2.1.3US__OID.1.3.6.1.4.1.311.60.2.1.2Delaware__SERIALNUMBER2177038__CUS__SMaryland__LBelcamp__O_Thales_DIS_CPL_USA__Inc.___CN_Thales_DIS_CPL_USA__Inc._
mov rcx, rsi
call sub.SHLWAPI.dll_StrStrIA
test rax, rax
je 0x14000701f
or dword [rdi], 8
lea rdx, str.CNMicrosoft
mov rcx, rsi
call sub.SHLWAPI.dll_StrStrIA
test rax, rax
je 0x140007036
or dword [rdi], 4
lea rdx, str.CNSentryBay_Limited
mov rcx, rsi
call sub.SHLWAPI.dll_StrStrIA
test rax, rax
je 0x14000709e
lea rdx, str.CGB
mov rcx, rsi
call sub.SHLWAPI.dll_StrStrIA
test rax, rax
je 0x14000709e
lea rdx, str.CNSentryBay_Limited
mov rcx, rsi
call sub.SHLWAPI.dll_StrStrIA
lea rcx, str.CNSentryBay_Limited
mov r12, rax
call fcn.140009480
mov rcx, rsi
add r12, rax
call fcn.140009480
add rax, rsi
cmp r12, rax
je 0x140007096
cmp byte [r12], 0x2c
jne 0x140007099
or dword [rdi], 0x10
mov r12d, dword [rsp + 0x50]
lea rdx, str.CNGemalto
mov rcx, rsi
call sub.SHLWAPI.dll_StrStrIA
test rax, rax
jne 0x140007119
lea rdx, str.CN_Gemalto
mov rcx, rsi
call sub.SHLWAPI.dll_StrStrIA
test rax, rax
jne 0x140007119
lea rdx, str.OID.2.5.4.15Private_Organization__OID.1.3.6.1.4.1.311.60.2.1.3US__OID.1.3.6.1.4.1.311.60.2.1.2Delaware__SERIALNUMBER2177038__CUS__SMaryland__LBelcamp__O_Thales_DIS_CPL_USA__Inc.___CN_Thales_DIS_CPL_USA__Inc._
mov rcx, rsi
call sub.SHLWAPI.dll_StrStrIA
test rax, rax
jne 0x140007119
lea rdx, str.CNMicrosoft
mov rcx, rsi
call sub.SHLWAPI.dll_StrStrIA
test rax, rax
jne 0x140007119
lea rdx, str.CNSentryBay_Limited
mov rcx, rsi
call sub.SHLWAPI.dll_StrStrIA
test rax, rax
je 0x140007116
lea rdx, str.CGB
mov rcx, rsi
call sub.SHLWAPI.dll_StrStrIA
test rax, rax
jne 0x140007119
or dword [rdi], 1
lea rdx, str.szCertDesc
mov r8, rsi
mov rcx, r15
call fcn.140001354
lea rdx, str.Certificate_Description
mov rcx, r15
call fcn.1400012b0
mov r8d, dword [rdi]
lea rdx, str.signedBy
mov rcx, r15
call fcn.1400013fc
lea rdx, str.SignedBy
mov rcx, r15
call fcn.1400012b0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rax, qword [rbp - 0x50]
inc r12d
mov dword [rsp + 0x50], r12d
cmp r12d, dword [rax + 0xc]
jbe 0x140006ea6
lea r8, [rsp + 0x60]
lea rdx, [rbp]
xor ecx, ecx
mov dword [rbp - 0x70], 2
call qword [0x14001b730]
lea rdx, str.lStatus
mov r8d, eax
mov rcx, r15
call fcn.1400013fc
lea rdx, str.dwLastError
mov r8d, r13d
mov rcx, r15
call fcn.1400013fc
mov r8d, dword [r14]
lea rdx, str.status
mov rcx, r15
call fcn.1400013fc
lea rdx, [0x140014528]
xor r8d, r8d
mov rcx, r15
call fcn.1400013fc
jmp 0x140007299
lea rdx, str.hLibWinTrust
mov r8, rax
mov rcx, r15
call fcn.14000141c
mov r8, qword [0x14001b730]
lea rdx, str.winVerifyTrust
mov rcx, r15
call fcn.14000141c
mov r8, qword [0x14001b728]
lea rdx, str.wTHelperProvDataFromStateData
mov rcx, r15
call fcn.14000141c
mov r8, qword [0x14001b720]
lea rdx, str.wTHelperGetProvSignerFromChain
mov rcx, r15
call fcn.14000141c
mov r8, qword [0x14001b718]
lea rdx, str.wTHelperGetProvCertFromChain
mov rcx, r15
call fcn.14000141c
lea rdx, str.Failed_to_load_verification_function
mov rcx, r15
call fcn.1400012b0
mov rcx, qword [0x14001b738]
mov dword [r14], 9
test rcx, rcx
je 0x140007294
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [0x14001b738], rbx
mov qword [0x14001b730], rbx
mov qword [0x14001b728], rbx
mov qword [0x14001b720], rbx
mov qword [0x14001b718], rbx
mov ebx, 6
mov edx, ebx
mov rcx, r15
call fcn.140001238
mov eax, ebx
mov rcx, qword [rbp + 0x450]
xor rcx, rsp
call fcn.140009450
mov rbx, qword [rsp + 0x5b8]
add rsp, 0x560
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret