Function at 0x1401a4760
Capabilities:
Get file size
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x248
movaps xmmword [rsp + 0x230], xmm6
mov r14, rcx
mov rax, qword [0x140430040]
xor rax, rsp
mov qword [rsp + 0x228], rax
mov rbx, qword [rcx]
lea r12, [rcx + 0x548]
movsxd rcx, edx
xor eax, eax
mov qword [rsp + 0x100], rax
mov qword [rsp + 0xf8], rax
mov qword [rsp + 0xf0], rax
cmp dword [r14 + 0x3dc], 2
jne 0x1401a47e2
xor eax, eax
cmp qword [r14 + 0x4c8], 0xffffffffffffffff
setne al
lea rdx, [rax + rax*2]
mov eax, 0x3c8
cmp dword [r14 + rdx*8 + 0x578], 2
jne 0x1401a47e7
mov eax, 0x340
mov rdi, qword [r14 + rax]
mov rax, qword [0x14044c238]
mov rax, qword [rax + 0x58]
lea r13, [rcx + rcx*2]
mov rcx, qword [r12 + r13*8 + 8]
mov rcx, qword [rcx + 8]
lea r15, [rsp + 0x100]
mov edx, 0x53
mov r8, r15
call qword [str._a_]
mov esi, eax
test eax, eax
sete al
mov rdx, qword [r15]
test rdx, rdx
setne cl
test al, cl
jne 0x1401a490c
lea rdi, [rsp + 0x120]
mov r8d, 0x100
mov rcx, rdi
mov dl, 0xaa
call fcn.1402b6a10
mov r8d, 0x100
mov ecx, esi
mov rdx, rdi
call fcn.14017ab50
lea rdx, str.schannel:_Failed_to_read_remote_certificate_context:__s
mov rcx, rbx
mov r8, rax
call fcn.140158420
mov r13d, 0x3c
xor esi, esi
mov rcx, qword [rsp + 0xf0]
test rcx, rcx
je 0x1401a4886
call qword [sym.imp.CRYPT32.dll_CertFreeCertificateChainEngine]
test rsi, rsi
je 0x1401a4896
mov rcx, rsi
xor edx, edx
call qword [sym.imp.CRYPT32.dll_CertCloseStore]
mov rcx, qword [rsp + 0xf8]
test rcx, rcx
je 0x1401a48a9
call qword [sym.imp.CRYPT32.dll_CertFreeCertificateChain]
mov rcx, qword [rsp + 0x100]
test rcx, rcx
je 0x1401a48bc
call qword [sym.imp.CRYPT32.dll_CertFreeCertificateContext]
mov rcx, qword [rsp + 0x228]
xor rcx, rsp
cmp rcx, qword [0x140430040]
je 0x1401a48ed
call fcn.140278ca0
int3
lea rdx, str.schannel:_CertGetCertificateChain_trust_error_CERT_TRUST_IS_REVOKED
mov rcx, rbx
call fcn.140158420
mov r13d, 0x3c
jmp 0x1401a4873
mov eax, r13d
movaps xmm6, xmmword [rsp + 0x230]
add rsp, 0x248
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
cmp dword [r14 + 0x3dc], 2
jne 0x1401a493e
xor eax, eax
cmp qword [r14 + 0x4c8], 0xffffffffffffffff
setne al
lea rax, [rax + rax*2]
cmp dword [r14 + rax*8 + 0x578], 2
je 0x1401a493e
cmp qword [r14 + 0x610], 0
jne 0x1401a4948
jmp 0x1401a4993
cmp qword [r14 + 0x5c0], 0
je 0x1401a4993
lea rax, [r12 + r13*8]
add rax, 8
mov rax, qword [rax]
cmp byte [rax + 0x6b], 1
jne 0x1401a4993
mov ecx, 6
mov edx, 1
mov r8d, 2
xor r9d, r9d
call fcn.140157cb0
test al, al
je 0x1401a4beb
lea rdx, str.schannel:_this_version_of_Windows_is_too_old_to_support_certificate_verification_via_CA_bundle_file.
mov rcx, rbx
call fcn.140158420
mov r13d, Ordinal_79
jmp 0x1401a4871
xor esi, esi
xorps xmm0, xmm0
lea rax, [rsp + 0x90]
movaps xmmword [rax], xmm0
movaps xmmword [rax + 0x50], xmm0
movaps xmmword [rax + 0x40], xmm0
movaps xmmword [rax + 0x30], xmm0
movaps xmmword [rax + 0x20], xmm0
movaps xmmword [rax + 0x10], xmm0
mov dword [rax], 0x60
movzx r8d, byte [rbx + 0xab3]
xor r8d, 1
shl r8d, 0x1d
mov r9, qword [rdx + 0x20]
mov rcx, qword [rsp + 0xf0]
lea r10, [rsp + 0xf8]
mov qword [rsp + 0x38], r10
mov dword [rsp + 0x28], r8d
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], 0
xor r8d, r8d
call qword [sym.imp.CRYPT32.dll_CertGetCertificateChain]
test eax, eax
je 0x1401a4a61
mov rax, qword [rsp + 0xf8]
mov rax, qword [rax + 0x10]
mov rax, qword [rax]
mov eax, dword [rax + 4]
cmp byte [rbx + 0xab5], 0
mov ecx, 0xfeffffbd
mov r8d, 0xfffffffd
cmovne r8d, ecx
and r8d, eax
je 0x1401a4ab2
test al, 4
jne 0x1401a48d6
bt eax, 0x10
jae 0x1401a4a4d
lea rdx, str.schannel:_CertGetCertificateChain_trust_error_CERT_TRUST_IS_PARTIAL_CHAIN
jmp 0x1401a48dd
test al, 0x20
je 0x1401a4b70
lea rdx, str.schannel:_CertGetCertificateChain_trust_error_CERT_TRUST_IS_UNTRUSTED_ROOT
jmp 0x1401a48dd
lea rdi, [rsp + 0x120]
mov r8d, 0x100
mov rcx, rdi
mov dl, 0xaa
call fcn.1402b6a10
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x100
mov ecx, eax
mov rdx, rdi
call fcn.14017aa70
lea rdx, str.schannel:_CertGetCertificateChain_failed:__s
mov rcx, rbx
mov r8, rax
call fcn.140158420
mov qword [rsp + 0xf8], 0
jmp 0x1401a48e5
cmp dword [r14 + 0x3dc], 2
jne 0x1401a4af6
xor eax, eax
cmp qword [r14 + 0x4c8], 0xffffffffffffffff
setne al
lea rax, [rax + rax*2]
cmp dword [r14 + rax*8 + 0x578], 2
je 0x1401a4af6
cmp byte [r14 + 0x649], 0
jne 0x1401a4b00
xor r13d, r13d
jmp 0x1401a4873
lea rdx, str.schannel:_CertGetNameString___returned_no_certificate_name_information
jmp 0x1401a48dd
cmp byte [r14 + 0x5f9], 1
jne 0x1401a4ae2
mov r15, qword [rsp + 0x100]
mov rbx, qword [r14]
mov rcx, rbx
mov rdx, r15
xor r8d, r8d
xor r9d, r9d
call fcn.1401a5350
test eax, eax
je 0x1401a4aea
mov ebp, eax
mov rax, qword [fcn.140119a10]
mov r12d, ebp
lea rcx, [r12 + r12]
call qword [str._a_]
test rax, rax
je 0x1401a4b65
mov r14, rax
mov rcx, rbx
mov rdx, r15
mov r8, rax
mov r9d, ebp
call fcn.1401a5350
cmp eax, ebp
jne 0x1401a4e71
mov r13d, 0x3c
xor r15d, r15d
jmp 0x1401a4de4
mov r13d, reloc.WLDAP32.dll_Ordinal_27
jmp 0x1401a4873
test al, 1
je 0x1401a4b80
lea rdx, str.schannel:_CertGetCertificateChain_trust_error_CERT_TRUST_IS_NOT_TIME_VALID
jmp 0x1401a48dd
test r8b, 0x40
je 0x1401a4b92
lea rdx, str.schannel:_CertGetCertificateChain_trust_error_CERT_TRUST_REVOCATION_STATUS_UNKNOWN
jmp 0x1401a48dd
lea rdx, str.schannel:_CertGetCertificateChain_error_mask:_0x_08x
mov rcx, rbx
call fcn.140158420
jmp 0x1401a48e5
lea rsi, [rsp + 0x120]
mov r8d, 0x100
mov rcx, rsi
mov dl, 0xaa
call fcn.1402b6a10
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x100
mov ecx, eax
mov rdx, rsi
call fcn.14017aa70
lea rdx, str.schannel:_failed_to_create_certificate_store:__s
mov rcx, rbx
mov r8, rax
call fcn.140158420
jmp 0x1401a4988
mov qword [rsp + 0x20], 0
mov ecx, 2
xor edx, edx
xor r8d, r8d
mov r9d, 0x2000
call qword [sym.imp.CRYPT32.dll_CertOpenStore]
test rax, rax
je 0x1401a4ba6
mov rsi, rax
cmp dword [r14 + 0x3dc], 2
jne 0x1401a4c3d
xor eax, eax
cmp qword [r14 + 0x4c8], 0xffffffffffffffff
setne al
lea rcx, [rax + rax*2]
mov eax, 0x610
cmp dword [r14 + rcx*8 + 0x578], 2
jne 0x1401a4c42
mov eax, 0x5c0
movabs rcx, 0xaaaaaaaaaaaaaaaa
mov r13, qword [r14 + rax]
mov r15, qword [r14]
mov qword [rsp + 0x118], rcx
mov rcx, r13
call fcn.1401a4610
test rax, rax
je 0x1401a4d55
mov rbp, rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], Ordinal_133
mov dword [rsp + 0x20], 3
mov rcx, rax
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x1401a4cf7
mov r12, rax
mov qword [rsp + 0x60], r15
lea rdx, [rsp + 0x118]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1401a4e9b
mov r15, qword [rsp + 0x118]
cmp r15, 0x100001
jl 0x1401a4f82
lea rdx, str.schannel:_CA_file_exceeds_max_size_of__u_bytes
mov rcx, qword [rsp + 0x60]
mov r8d, 0x100000
call fcn.140158420
jmp 0x1401a4ee6
lea rdi, [rsp + 0x120]
mov r8d, 0x100
mov rcx, rdi
mov dl, 0xaa
call fcn.1402b6a10
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x100
mov ecx, eax
mov rdx, rdi
call fcn.14017aa70
lea rdx, str.schannel:_failed_to_open_CA_file__s:__s
mov rcx, r15
mov r8, r13
mov r9, rax
call fcn.140158420
mov rax, qword [fcn.140119970]
xor ecx, ecx
call qword [str._a_]
mov rax, qword [fcn.140119970]
mov rcx, rbp
jmp 0x1401a4da1
lea rdi, [rsp + 0x120]
mov r8d, 0x100
mov rcx, rdi
mov dl, 0xaa
call fcn.1402b6a10
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x100
mov ecx, eax
mov rdx, rdi
call fcn.14017aa70
lea rdx, str.schannel:_invalid_path_name_for_CA_file__s:__s
mov rcx, r15
mov r8, r13
mov r9, rax
call fcn.140158420
mov rax, qword [fcn.140119970]
xor ecx, ecx
call qword [str._a_]
mov r13d, Ordinal_79
jmp 0x1401a4873
mov r13d, reloc.WLDAP32.dll_Ordinal_27
jmp 0x1401a4ddf
lea rdx, str.schannel:_connection_hostname___s__validated_against_certificate_name___s__n
mov r8, rdi
mov r9, rbp
call fcn.1401581f0
xor r13d, r13d
mov rax, qword [fcn.140119970]
mov rcx, rbp
call qword [str._a_]
cmp r15, r12
jae 0x1401a4e41
cmp r13d, 0x3c
jne 0x1401a4e41
cmp word [r14 + r15*2], 0
je 0x1401a4e41
lea r13, [r14 + r15*2]
mov rcx, r13
call fcn.1401a46b0
test rax, rax
je 0x1401a4db2
mov rbp, rax
mov rcx, rax
mov rdx, rdi
call fcn.1401f5300
mov rcx, rbx
cmp eax, 1
je 0x1401a4dba
lea rdx, str.schannel:_connection_hostname___s__did_not_match_against_certificate_name___s__n
mov r8, rdi
mov r9, rbp
call fcn.1401581f0
mov rcx, r13
call fcn.14029c474
add r15, rax
inc r15
mov r13d, 0x3c
jmp 0x1401a4dcf
test r13d, r13d
je 0x1401a4e86
cmp r13d, 0x3c
jne 0x1401a4e60
lea rdx, str.schannel:_CertGetNameString___failed_to_match_connection_hostname___s__against_server_certificate_names
mov rcx, rbx
mov r8, rdi
call fcn.140158420
jmp 0x1401a4e80
lea rdx, str.schannel:_server_certificate_name_verification_failed
mov rcx, rbx
call fcn.140158420
jmp 0x1401a4e86
lea rdx, str.schannel:_CertGetNameString___returned_certificate_name_information_of_unexpected_size
mov rcx, rbx
call fcn.140158420
mov r13d, 0x3c
mov rax, qword [fcn.140119970]
mov rcx, r14
call qword [str._a_]
jmp 0x1401a4873
mov r15, r12
lea r12, [rsp + 0x120]
mov r8d, 0x100
mov rcx, r12
mov dl, 0xaa
call fcn.1402b6a10
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x100
mov ecx, eax
mov rdx, r12
mov r12, r15
call fcn.14017aa70
lea rdx, str.schannel:_failed_to_determine_size_of_CA_file__s:__s
mov rcx, qword [rsp + 0x60]
mov r8, r13
mov r9, rax
call fcn.140158420
mov r13d, Ordinal_79
mov qword [rsp + 0x60], 0
xor r15d, r15d
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [fcn.140119970]
mov rcx, r15
call qword [str._a_]
mov rax, qword [fcn.140119970]
mov rcx, rbp
call qword [str._a_]
cmp byte [rsp + 0x60], 0
je 0x1401a4873
xorps xmm0, xmm0
lea rcx, [rsp + 0x90]
movaps xmmword [rcx], xmm0
movaps xmmword [rcx + 0x40], xmm0
movaps xmmword [rcx + 0x30], xmm0
movaps xmmword [rcx + 0x20], xmm0
movaps xmmword [rcx + 0x10], xmm0
mov dword [rcx], 0x50
mov qword [rcx + 0x40], rsi
lea rdx, [rsp + 0xf0]
call qword [sym.imp.CRYPT32.dll_CertCreateCertificateChainEngine]
test eax, eax
je 0x1401a51a3
mov rdx, qword [rsp + 0x100]
jmp 0x1401a4995
mov r13d, reloc.WLDAP32.dll_Ordinal_27
jmp 0x1401a4eec
mov rax, qword [fcn.140119a10]
lea rcx, [r15 + 1]
call qword [str._a_]
test rax, rax
je 0x1401a4f77
mov qword [rsp + 0x88], rdi
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x80], rbp
xor ebp, ebp
test r15, r15
je 0x1401a500f
xor r12d, r12d
mov r8d, r15d
sub r8d, ebp
mov dword [rsp + 0x90], 0
mov rdi, rax
lea rdx, [rax + r12]
mov qword [rsp + 0x20], 0
mov rcx, qword [rsp + 0x70]
lea r9, [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1401a52d4
mov eax, dword [rsp + 0x90]
add ebp, eax
test eax, eax
cmove r15, r12
mov r12, rbp
cmp r15, rbp
mov rax, rdi
ja 0x1401a4fb7
jmp 0x1401a5012
xor r15d, r15d
mov qword [rsp + 0x68], r13
mov byte [rax + r15], 0
xorps xmm6, xmm6
xor r13d, r13d
mov qword [rsp + 0x78], rax
mov rbp, rax
mov rdi, qword [rsp + 0x88]
jmp 0x1401a512f
mov rcx, rbp
lea rdx, str._n_____END_CERTIFICATE_____
call fcn.14027a8f8
test rax, rax
je 0x1401a5224
mov r12, rax
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x90], rax
xor eax, eax
mov qword [rsp + 0x110], rax
mov dword [rsp + 0x10c], eax
sub r12, rbp
add r12, 0x1a
mov qword [rsp + 0x98], rbp
mov dword [rsp + 0x90], r12d
lea rcx, [rsp + 0x110]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rax
movups xmmword [rsp + 0x38], xmm6
lea rcx, [rsp + 0x10c]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], eax
mov ecx, 2
lea rdx, [rsp + 0x90]
mov r8d, 2
mov r9d, reloc.WS2_32.dll_ntohl
call qword [sym.imp.CRYPT32.dll_CryptQueryObject]
test eax, eax
je 0x1401a523a
mov r8d, dword [rsp + 0x10c]
cmp r8d, 1
jne 0x1401a52a5
mov rdx, qword [rsp + 0x110]
mov rcx, rsi
mov r8d, 4
xor r9d, r9d
call qword [sym.imp.CRYPT32.dll_CertAddCertificateContextToStore]
mov r15d, eax
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.CRYPT32.dll_CertFreeCertificateContext]
test r15d, r15d
je 0x1401a51e8
mov eax, r12d
add rbp, rax
inc r13d
cmp byte [rbp], 0
mov r15, qword [rsp + 0x60]
je 0x1401a5167
mov rcx, rbp
lea rdx, str._____BEGIN_CERTIFICATE_____
call fcn.14027a8f8
test rax, rax
je 0x1401a5167
mov rbp, rax
movzx eax, byte [rax + 0x1b]
cmp eax, 0xd
je 0x1401a5037
cmp eax, 0xa
je 0x1401a5037
test r13d, r13d
mov rbp, qword [rsp + 0x80]
mov r12, qword [rsp + 0x70]
je 0x1401a52bb
lea rdx, str.schannel:_added__d_certificate_s__from_CA_file__s_n
mov rcx, r15
mov r8d, r13d
mov r9, qword [rsp + 0x68]
call fcn.1401581f0
xor r13d, r13d
mov al, 1
mov qword [rsp + 0x60], rax
jmp 0x1401a529b
lea rdi, [rsp + 0x120]
mov r8d, 0x100
mov rcx, rdi
mov dl, 0xaa
call fcn.1402b6a10
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x100
mov ecx, eax
mov rdx, rdi
call fcn.14017aa70
lea rdx, str.schannel:_failed_to_create_certificate_chain_engine:__s
mov rcx, rbx
mov r8, rax
call fcn.140158420
jmp 0x1401a4da7
lea r15, [rsp + 0x120]
mov r8d, 0x100
mov rcx, r15
mov dl, 0xaa
call fcn.1402b6a10
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x100
mov ecx, eax
mov rdx, r15
call fcn.14017aa70
lea rdx, str.schannel:_failed_to_add_certificate_from_CA_file__s_to_certificate_store:__s
mov rcx, qword [rsp + 0x60]
jmp 0x1401a5272
lea rdx, str.schannel:_CA_file__s_is_not_correctly_formatted
mov rcx, r15
mov r8, qword [rsp + 0x68]
call fcn.140158420
jmp 0x1401a527f
lea r12, [rsp + 0x120]
mov r8d, 0x100
mov rcx, r12
mov dl, 0xaa
call fcn.1402b6a10
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x100
mov ecx, eax
mov rdx, r12
call fcn.14017aa70
lea rdx, str.schannel:_failed_to_extract_certificate_from_CA_file__s:__s
mov rcx, r15
mov r8, qword [rsp + 0x68]
mov r9, rax
call fcn.140158420
mov r13d, Ordinal_79
mov qword [rsp + 0x60], 0
mov rbp, qword [rsp + 0x80]
mov r12, qword [rsp + 0x70]
mov r15, qword [rsp + 0x78]
jmp 0x1401a4ef8
lea rdx, str.schannel:_unexpected_content_type__d_when_extracting_certificate_from_CA_file__s
mov rcx, r15
mov r9, qword [rsp + 0x68]
call fcn.140158420
jmp 0x1401a527f
lea rdx, str.schannel:_did_not_add_any_certificates_from_CA_file__s_n
mov rcx, r15
mov r8, qword [rsp + 0x68]
call fcn.1401581f0
jmp 0x1401a5194
lea r12, [rsp + 0x120]
mov r8d, 0x100
mov rcx, r12
mov dl, 0xaa
call fcn.1402b6a10
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x100
mov ecx, eax
mov rdx, r12
call fcn.14017aa70
lea rdx, str.schannel:_failed_to_read_from_CA_file__s:__s
mov rcx, qword [rsp + 0x60]
mov r8, r13
mov r9, rax
call fcn.140158420
mov r13d, Ordinal_79
mov qword [rsp + 0x60], 0
mov rbp, qword [rsp + 0x80]
mov r12, qword [rsp + 0x70]
mov r15, rdi
mov rdi, qword [rsp + 0x88]
jmp 0x1401a4ef8