Function at 0x140018f40
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0xe0]
sub rsp, 0x1e0
mov rax, qword [0x14005f020]
xor rax, rsp
mov qword [rbp + 0xd0], rax
movzx esi, r9b
mov rdi, rdx
mov rbx, rcx
mov rax, rdx
cmp qword [rdx + 0x18], 8
jb 0x140018f7e
mov rax, qword [rdx]
xor r14d, r14d
mov qword [rdx + 0x10], r14
mov word [rax], r14w
cmp qword [rcx + 0x18], 8
jb 0x140018f93
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14001916d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x14001916d
mov rax, qword [0x1400621e0]
test rax, rax
je 0x140018fce
call qword [case.0x14001392e.0]
cmp eax, 0x12c
jg 0x140019163
lea rdx, str.GetSimpleDisplayCertNameFromFile:_File__s_does_not_exist.
lea rcx, [rsp + 0x40]
call fcn.1400145b0
nop
mov qword [rsp + 0x20], rbx
lea rcx, [fcn.14000d7b0]
mov qword [rsp + 0x28], rcx
lea rcx, [0x14001b020]
mov qword [rsp + 0x30], rcx
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.14000d650
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.140014da0
mov rcx, rax
mov rax, qword [0x1400621d8]
test rax, rax
je 0x140019032
mov edx, 0x12c
call qword [case.0x14001392e.0]
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x140019075
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001906f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400194ae
call fcn.14001f790
nop
cmp byte [rbp + 0x30], 0
je 0x1400190b1
mov rcx, qword [rbp + 0x40]
test rcx, rcx
je 0x1400190ad
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14001392e.0]
mov r8, rax
test rax, rax
je 0x1400190ad
mov rcx, qword [rax]
mov rax, qword [rcx]
mov edx, 1
mov rcx, r8
call qword [case.0x14001392e.0]
mov byte [rbp + 0x30], 0
lea rcx, [rbp - 0x50]
call fcn.1400142f0
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x1400190fa
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400190f5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400194b4
call fcn.14001f790
mov qword [rbp - 0x68], r14
mov qword [rbp - 0x60], 7
mov word [rbp - 0x78], r14w
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140019159
mov rdx, qword [rsp + 0x68]
sub rdx, rcx
and rdx, 0xfffffffffffffffc
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019146
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400194b4
call fcn.14001f790
mov qword [rsp + 0x58], r14
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
lea rcx, [rsp + 0x40]
call fcn.14000d400
mov eax, 2
jmp 0x14001948b
mov dword [rbp + 0xc0], 0xaac56b
mov dword [rbp + 0xc4], 0x11d0cd44
mov dword [rbp + 0xc8], 0xc000c28c
mov dword [rbp + 0xcc], 0xee95c24f
mov qword [rbp + 0xa0], 0x20
cmp qword [rbx + 0x18], 8
jb 0x1400191aa
mov rbx, qword [rbx]
mov qword [rbp + 0xa8], rbx
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xb0], xmm0
mov qword [rbp + 0x50], 0x50
mov qword [rbp + 0x70], 1
mov qword [rbp + 0x80], 1
mov qword [rbp + 0x58], r14
mov qword [rbp + 0x60], r14
lea eax, [rsi*2 + 2]
mov dword [rbp + 0x68], eax
mov dword [rbp + 0x6c], r14d
lea rax, [rbp + 0xa0]
mov qword [rbp + 0x78], rax
mov qword [rbp + 0x88], r14
mov qword [rbp + 0x90], r14
mov eax, 0x1012
mov ecx, 0x1212
cmp byte [rbp + 0x138], r14b
cmovne eax, ecx
mov dword [rbp + 0x98], eax
mov dword [rbp + 0x9c], r14d
lea r8, [rbp + 0x50]
lea rdx, [rbp + 0xc0]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.WINTRUST.dll_WinVerifyTrust]
mov ebx, eax
test eax, eax
jne 0x140019467
mov rdx, qword [rbp + 0x88]
lea rcx, [rsp + 0x20]
call fcn.140018c90
mov rdx, rax
mov rcx, rdi
call fcn.1400054a0
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x1400192a7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400192a2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400194ba
call fcn.14001f790
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], 7
mov word [rsp + 0x20], r14w
mov rax, qword [0x1400621e0]
test rax, rax
je 0x1400192d6
call qword [case.0x14001392e.0]
cmp eax, 0x46
jg 0x140019467
lea rdx, str.GetSimpleDisplayCertNameFromFile:_Found_cert_name:__s.
lea rcx, [rsp + 0x40]
call fcn.1400145b0
nop
mov qword [rsp + 0x20], rdi
lea rcx, [fcn.14000d7b0]
mov qword [rsp + 0x28], rcx
lea rcx, [0x14001b020]
mov qword [rsp + 0x30], rcx
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.14000d650
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.140014da0
mov rcx, rax
mov rax, qword [0x1400621d8]
test rax, rax
je 0x14001933a
mov edx, 0x46
call qword [case.0x14001392e.0]
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x14001937d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019377
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400194c0
call fcn.14001f790
nop
cmp byte [rbp + 0x30], 0
je 0x1400193b9
mov rcx, qword [rbp + 0x40]
test rcx, rcx
je 0x1400193b5
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14001392e.0]
mov r8, rax
test rax, rax
je 0x1400193b5
mov rcx, qword [rax]
mov rax, qword [rcx]
mov edx, 1
mov rcx, r8
call qword [case.0x14001392e.0]
mov byte [rbp + 0x30], 0
lea rcx, [rbp - 0x50]
call fcn.1400142f0
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x140019402
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400193fd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400194a8
call fcn.14001f790
mov qword [rbp - 0x68], r14
mov qword [rbp - 0x60], 7
mov word [rbp - 0x78], r14w
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14001945d
mov rdx, qword [rsp + 0x68]
sub rdx, rcx
and rdx, 0xfffffffffffffffc
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001944a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400194a8
call fcn.14001f790
mov qword [rsp + 0x58], r14
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
lea rcx, [rsp + 0x40]
call fcn.14000d400
mov dword [rbp + 0x80], 2
lea r8, [rbp + 0x50]
lea rdx, [rbp + 0xc0]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.WINTRUST.dll_WinVerifyTrust]
mov eax, ebx
mov rcx, qword [rbp + 0xd0]
xor rcx, rsp
call fcn.14001f770
add rsp, 0x1e0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14002b368
nop
call fcn.14002b368
nop
call fcn.14002b368
int3
call fcn.14002b368
nop
call fcn.14002b368
int3