Function at 0x14008be30
Capabilities:
Check if file exists
Get file attributes
Link many functions at runtime

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
push rbp
push rbx
push rsi
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov qword [rax + 8], rdi
xor edi, edi
mov qword [rax - 0x20], r12
mov esi, edi
mov qword [rax - 0x28], r13
mov r12, rcx
mov qword [rax - 0x30], r14
xor ecx, ecx
mov qword [rax - 0x38], r15
mov r13d, edi
mov r15d, edi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rdi
mov ebx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14008c385
test al, 0x50
jne 0x14008c385
mov rax, qword [0x1400e8f20]
test rax, rax
jne 0x14008bebf
xor edx, edx
lea rcx, str.crypt32.dll
call fcn.14008aa90
mov qword [0x1400e8f20], rax
test rax, rax
je 0x14008c30d
cmp qword [0x1400e8f28], rbx
jne 0x14008beef
lea rdx, str.CryptMsgClose
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400e8f28], rax
test rax, rax
je 0x14008c30d
mov rax, qword [0x1400e8f20]
cmp qword [0x1400e8f30], rbx
jne 0x14008bf1f
lea rdx, str.CertCloseStore
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400e8f30], rax
test rax, rax
je 0x14008c30d
mov rax, qword [0x1400e8f20]
cmp qword [0x1400e8f38], rbx
jne 0x14008bf4f
lea rdx, str.CertFreeCertificateContext
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400e8f38], rax
test rax, rax
je 0x14008c30d
mov rax, qword [0x1400e8f20]
cmp qword [0x1400e8f40], rbx
jne 0x14008bf7f
lea rdx, str.CertFindCertificateInStore
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400e8f40], rax
test rax, rax
je 0x14008c30d
mov rax, qword [0x1400e8f20]
cmp qword [0x1400e8f48], rbx
jne 0x14008bfaf
lea rdx, str.CryptMsgGetParam
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400e8f48], rax
test rax, rax
je 0x14008c30d
mov rax, qword [0x1400e8f20]
cmp qword [0x1400e8f50], rbx
jne 0x14008bfdf
lea rdx, str.CryptQueryObject
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400e8f50], rax
test rax, rax
je 0x14008c30d
mov rax, qword [0x1400e8f20]
cmp qword [0x1400e8f58], rbx
jne 0x14008c00f
lea rdx, str.CertGetNameStringA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400e8f58], rax
test rax, rax
je 0x14008c30d
mov rax, qword [0x1400e8f20]
cmp qword [0x1400e8f60], rbx
jne 0x14008c03f
lea rdx, str.CryptDecodeObjectEx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400e8f60], rax
test rax, rax
je 0x14008c30d
mov rax, qword [0x1400e8f20]
cmp qword [0x1400e8f68], rbx
jne 0x14008c068
lea rdx, str.CertGetIssuerCertificateFromStore
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400e8f68], rax
test rax, rax
je 0x14008c30d
cmp qword [0x1400e9020], rbx
jne 0x14008c0a0
xor edx, edx
lea rcx, str.cryptnet.dll
call fcn.14008aa90
mov qword [0x1400e9020], rax
test rax, rax
jne 0x14008c0a0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7e
mov r14d, 1
cmovne edi, r14d
jmp 0x14008c0a9
mov r14d, 1
mov edi, r14d
cmp qword [0x1400e9018], rbx
jne 0x14008c0c7
xor edx, edx
lea rcx, str.cryptbase.dll
call fcn.14008aa90
mov qword [0x1400e9018], rax
test edi, edi
je 0x14008c30d
xor edi, edi
lea rax, [rsp + 0x68]
mov qword [rsp + 0x50], rdi
mov r8d, 0x400
mov qword [rsp + 0x48], rax
mov rdx, r12
lea rax, [rsp + 0x60]
mov ecx, r14d
mov qword [rsp + 0x40], rax
lea r9d, [rdi + 2]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x7c]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], edi
call qword [0x1400e8f50]
mov esi, eax
test eax, eax
jne 0x14008c134
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x14008c38a
mov rcx, qword [rsp + 0x68]
lea rax, [rbp + 0xb0]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea edx, [r9 + 6]
call qword [0x1400e8f48]
mov esi, eax
test eax, eax
jne 0x14008c168
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x14008c38a
mov edx, dword [rbp + 0xb0]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r15, rax
test rax, rax
jne 0x14008c190
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov esi, edi
jmp 0x14008c38a
mov rcx, qword [rsp + 0x68]
lea rax, [rbp + 0xb0]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov r9, r15
lea edx, [r8 + 6]
call qword [0x1400e8f48]
mov esi, eax
test eax, eax
jne 0x14008c1c4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x14008c38a
movups xmm0, xmmword [r15 + 8]
mov rcx, qword [rsp + 0x60]
lea rax, [rbp - 0x70]
mov qword [rsp + 0x28], rdi
mov r9d, 0xb0000
movaps xmmword [rbp - 0x40], xmm0
xor r8d, r8d
movups xmm0, xmmword [r15 + 0x18]
mov edx, 0x10001
mov qword [rsp + 0x20], rax
movups xmmword [rbp - 0x68], xmm0
call qword [0x1400e8f40]
mov r13, rax
test rax, rax
jne 0x14008c214
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov esi, edi
jmp 0x14008c38a
mov rdi, qword [rbp + 0xa8]
test rdi, rdi
je 0x14008c23a
mov rcx, r13
call fcn.14008a430
mov dword [rdi], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jne 0x14008c38a
lea rdx, [rsp + 0x70]
mov rcx, r15
call fcn.1400891a0
test eax, eax
jne 0x14008c252
xor eax, eax
mov qword [rsp + 0x70], rax
mov rdx, qword [rsp + 0x60]
lea r8, [rsp + 0x70]
mov rcx, r15
call fcn.14008ba60
test eax, eax
jne 0x14008c295
lea rdx, [rsp + 0x70]
mov rcx, r15
call fcn.14008b900
test eax, eax
jne 0x14008c295
xor esi, esi
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jne 0x14008c38a
mov ebx, 0x80096005
jmp 0x14008c38a
mov ecx, 0x23f0
call fcn.14008a870
test eax, eax
jne 0x14008c2c2
mov rcx, r12
call fcn.14008a690
test eax, eax
je 0x14008c2c2
call fcn.140089260
test eax, eax
jne 0x14008c2c2
mov esi, r14d
xor ebx, ebx
jmp 0x14008c38a
cmp qword [0x1400e9000], 0
jne 0x14008c2ff
xor edx, edx
lea rcx, str.wintrust.dll
call fcn.14008aa90
mov qword [0x1400e9000], rax
test rax, rax
je 0x14008c2ff
lea rdx, str.WinVerifyTrust
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400e9008], rax
jmp 0x14008c306
mov rax, qword [0x1400e9008]
xor esi, esi
test rax, rax
jne 0x14008c314
mov ebx, 0x7e
jmp 0x14008c38a
xor edi, edi
mov edx, edi
mov rcx, r12
call fcn.14008b840
test eax, eax
je 0x14008c32f
inc edi
mov ebx, eax
cmp edi, 1
jb 0x14008c316
jmp 0x14008c332
mov esi, r14d
cmp ebx, 0x800b010a
jne 0x14008c38a
mov rcx, qword [rsp + 0x60]
lea r9, [rbp + 0xb8]
xor r8d, r8d
mov dword [rbp + 0xb8], 0
mov rdx, r13
call qword [0x1400e8f68]
mov rdi, rax
test rax, rax
je 0x14008c38a
mov rcx, qword [rax + 0x18]
add rcx, 0x78
call fcn.140089410
test eax, eax
je 0x14008c37a
mov esi, r14d
xor ebx, ebx
mov rcx, rdi
call qword [0x1400e8f38]
jmp 0x14008c38a
mov ebx, 2
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov r15, qword [rsp + 0x160]
mov r14, qword [rsp + 0x168]
mov r12, qword [rsp + 0x178]
mov rdi, qword [rsp + 0x1a0]
test r13, r13
je 0x14008c3c1
mov rcx, r13
call qword [0x1400e8f38]
mov rcx, qword [rsp + 0x60]
mov r13, qword [rsp + 0x170]
test rcx, rcx
je 0x14008c3db
xor edx, edx
call qword [0x1400e8f30]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14008c3eb
call qword [0x1400e8f28]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
add rsp, 0x180
pop rsi
pop rbx
pop rbp
ret