Function at 0x140006140
Capabilities:
Check if file exists
Get file attributes
Link many functions at runtime

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov qword [rax + 8], r12
mov qword [rax - 0x30], r13
xor r13d, r13d
mov qword [rax - 0x38], r15
mov r14d, r13d
mov r15, rcx
mov qword [rsp + 0x60], r13
xor ecx, ecx
mov qword [rsp + 0x68], r13
mov r12d, r13d
mov esi, r13d
mov edi, r13d
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140006657
test al, 0x50
jne 0x140006657
mov rax, qword [0x1400e3e38]
test rax, rax
jne 0x1400061cb
lea rcx, str.crypt32.dll
call fcn.140004850
mov qword [0x1400e3e38], rax
test rax, rax
je 0x140006368
cmp qword [0x1400e4070], rsi
jne 0x1400061fb
lea rdx, str.CryptMsgClose
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400e4070], rax
test rax, rax
je 0x140006368
mov rax, qword [0x1400e3e38]
cmp qword [0x1400e3f48], rsi
jne 0x14000622b
lea rdx, str.CertCloseStore
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400e3f48], rax
test rax, rax
je 0x140006368
mov rax, qword [0x1400e3e38]
cmp qword [0x1400e3ea8], rsi
jne 0x14000625b
lea rdx, str.CertFreeCertificateContext
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400e3ea8], rax
test rax, rax
je 0x140006368
mov rax, qword [0x1400e3e38]
cmp qword [0x1400e3e30], rsi
jne 0x14000628b
lea rdx, str.CertFindCertificateInStore
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400e3e30], rax
test rax, rax
je 0x140006368
mov rax, qword [0x1400e3e38]
cmp qword [0x1400e3f00], rsi
jne 0x1400062bb
lea rdx, str.CryptMsgGetParam
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400e3f00], rax
test rax, rax
je 0x140006368
mov rax, qword [0x1400e3e38]
cmp qword [0x1400e3f30], rsi
jne 0x1400062eb
lea rdx, str.CryptQueryObject
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400e3f30], rax
test rax, rax
je 0x140006368
mov rax, qword [0x1400e3e38]
cmp qword [0x1400e3ee0], rsi
jne 0x140006317
lea rdx, str.CertGetNameStringA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400e3ee0], rax
test rax, rax
je 0x140006368
mov rax, qword [0x1400e3e38]
cmp qword [0x1400e3f20], rsi
jne 0x140006343
lea rdx, str.CryptDecodeObjectEx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400e3f20], rax
test rax, rax
je 0x140006368
mov rax, qword [0x1400e3e38]
cmp qword [0x1400e3ed8], rsi
jne 0x140006372
lea rdx, str.CertGetIssuerCertificateFromStore
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400e3ed8], rax
test rax, rax
jne 0x140006372
mov edi, 0x7e
jmp 0x14000665c
mov rbx, qword [0x1400e3f30]
mov rcx, rbx
call qword [fcn.1400072c0]
mov qword [rsp + 0x50], r13
lea rax, [rsp + 0x68]
mov qword [rsp + 0x48], rax
mov r9d, 2
lea rax, [rsp + 0x60]
mov r8d, 0x400
mov qword [rsp + 0x40], rax
mov rdx, r15
lea rax, [rbp + 0xa8]
mov qword [rsp + 0x38], rax
lea ecx, [r9 - 1]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x7c]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r13d
call rbx
mov esi, eax
test eax, eax
jne 0x1400063e8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x14000665c
mov rbx, qword [0x1400e3f00]
mov rcx, rbx
call qword [fcn.1400072c0]
mov rcx, qword [rsp + 0x68]
lea rax, [rbp + 0x98]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea edx, [r9 + 6]
call rbx
mov esi, eax
test eax, eax
jne 0x140006428
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x14000665c
mov edx, dword [rbp + 0x98]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r14, rax
test rax, rax
jne 0x140006451
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov esi, r13d
jmp 0x14000665c
mov rbx, qword [0x1400e3f00]
mov rcx, rbx
call qword [fcn.1400072c0]
mov rcx, qword [rsp + 0x68]
lea rax, [rbp + 0x98]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov r9, r14
lea edx, [r8 + 6]
call rbx
mov esi, eax
test eax, eax
jne 0x140006491
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x14000665c
movups xmm0, xmmword [r14 + 8]
mov rbx, qword [0x1400e3e30]
mov rcx, rbx
movaps xmmword [rbp - 0x50], xmm0
movups xmm0, xmmword [r14 + 0x18]
movups xmmword [rbp - 0x78], xmm0
call qword [fcn.1400072c0]
mov rcx, qword [rsp + 0x60]
lea rax, [rbp - 0x80]
mov qword [rsp + 0x28], r13
mov r9d, 0xb0000
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0x10001
call rbx
mov r12, rax
test rax, rax
jne 0x1400064ee
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov esi, r13d
jmp 0x14000665c
lea rdx, [rsp + 0x70]
mov rcx, r14
call fcn.1400066f0
test eax, eax
jne 0x140006506
xor eax, eax
mov qword [rsp + 0x70], rax
mov rdx, qword [rsp + 0x60]
lea r8, [rsp + 0x70]
mov rcx, r14
call fcn.1400067c0
test eax, eax
jne 0x14000654a
lea rdx, [rsp + 0x70]
mov rcx, r14
call fcn.140006be0
test eax, eax
jne 0x14000654a
mov esi, r13d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test eax, eax
jne 0x14000665c
mov edi, 0x80096005
jmp 0x14000665c
call fcn.140006ff0
test eax, eax
jne 0x140006570
mov rcx, r15
call fcn.140004c80
test eax, eax
je 0x140006570
call fcn.140005f40
test eax, eax
jne 0x140006570
lea esi, [rax + 1]
jmp 0x14000665c
mov rax, qword [0x1400e3e60]
test rax, rax
jne 0x140006594
lea rcx, str.wintrust.dll
call fcn.140004850
mov qword [0x1400e3e60], rax
test rax, rax
je 0x1400065b9
cmp qword [0x1400e3e40], rdi
jne 0x1400065c6
lea rdx, str.WinVerifyTrust
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400e3e40], rax
test rax, rax
jne 0x1400065c6
mov esi, r13d
mov edi, 0x7e
jmp 0x14000665c
mov esi, r13d
mov ebx, r13d
nop dword [rax]
mov rcx, r15
call fcn.140004e50
test eax, eax
je 0x1400065e7
inc ebx
mov edi, eax
cmp ebx, 1
jb 0x1400065d0
jmp 0x1400065ec
mov esi, 1
cmp edi, 0x800b010a
jne 0x14000665c
mov rbx, qword [0x1400e3ed8]
mov rcx, rbx
mov dword [rbp + 0xa0], r13d
call qword [fcn.1400072c0]
mov rcx, qword [rsp + 0x60]
lea r9, [rbp + 0xa0]
xor r8d, r8d
mov rdx, r12
call rbx
mov r15, rax
test rax, rax
je 0x14000665c
mov rcx, qword [rax + 0x18]
add rcx, 0x78
call fcn.140004f30
test eax, eax
je 0x140006640
mov esi, 1
mov edi, r13d
mov rbx, qword [0x1400e3ea8]
mov rcx, rbx
call qword [fcn.1400072c0]
mov rcx, r15
call rbx
jmp 0x14000665c
mov edi, 2
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov r15, qword [rsp + 0x150]
mov r13, qword [rsp + 0x158]
test r12, r12
je 0x14000668f
mov rbx, qword [0x1400e3ea8]
mov rcx, rbx
call qword [fcn.1400072c0]
mov rcx, r12
call rbx
mov r14, qword [rsp + 0x60]
mov r12, qword [rsp + 0x190]
test r14, r14
je 0x1400066b8
mov rbx, qword [0x1400e3f48]
mov rcx, rbx
call qword [fcn.1400072c0]
xor edx, edx
mov rcx, r14
call rbx
mov r14, qword [rsp + 0x68]
test r14, r14
je 0x1400066d7
mov rbx, qword [0x1400e4070]
mov rcx, rbx
call qword [fcn.1400072c0]
mov rcx, r14
call rbx
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
add rsp, 0x160
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret