Function at 0x1060245
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 0x14]
push ebx
xor ebx, ebx
cmp eax, ebx
push esi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 4], ebx
je 0x106026f
mov dword [eax], ebx
mov eax, dword [ebp + 0x18]
cmp eax, ebx
je 0x1060278
mov dword [eax], ebx
mov eax, dword [ebp + 0x1c]
cmp eax, ebx
je 0x1060281
mov dword [eax], ebx
push edi
push 2
call dword [sym.imp.ADVAPI32.dll_ImpersonateSelf]
test eax, eax
jne 0x10602a0
call fcn.0106d6ff
mov esi, eax
push esi
push 0xd3a0197
jmp 0x10603c8
xor edi, edi
inc edi
push edi
push 0x1011494
mov dword [ebp - 0x1c], edi
call fcn.01061da6
mov esi, eax
cmp esi, ebx
je 0x10602c2
push esi
push 0xd3f0197
jmp 0x10603c8
push edi
push 0x10022c8
call fcn.01061da6
mov esi, eax
cmp esi, ebx
je 0x10602de
push esi
push 0xd420197
jmp 0x10603c8
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x10602fe
call fcn.0106d6ff
mov esi, eax
push esi
push 0xd480197
jmp 0x10603c8
test al, 0x10
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
je 0x106031f
call fcn.0105feda
mov esi, eax
cmp esi, ebx
je 0x1060335
push esi
push 0xd4e0197
jmp 0x10603c8
call fcn.0106d913
mov esi, eax
cmp esi, ebx
je 0x1060335
push esi
push 0xd530197
jmp 0x10603c8
push 7
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 8]
call sub.certcli.dll_Ordinal_223
mov esi, eax
cmp esi, ebx
je 0x1060355
push esi
push 0xd570197
jmp 0x10603c8
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.CRYPT32.dll_PFXIsPFXBlob]
test eax, eax
jne 0x1060370
mov esi, 0x8007000d
push esi
push 0xd5e0197
jmp 0x10603c8
push 0x21
push dword [ebp + 0xc]
lea eax, [ebp - 0x28]
push eax
call fcn.01057b4b
mov edi, eax
cmp edi, ebx
mov dword [ebp - 0x14], edi
jne 0x1060396
call fcn.0106d6ff
mov esi, eax
push esi
push 0xd680197
jmp 0x10603c8
push ebx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push 1
push edi
call fcn.0105f7a4
mov esi, eax
cmp esi, ebx
je 0x10603b6
push esi
push 0xd720197
jmp 0x10603c8
mov eax, dword [ebp - 4]
cmp eax, ebx
jne 0x10603d2
mov esi, 0x80092007
push esi
push 0xd770197
call fcn.01053610
jmp 0x106057d
shl eax, 3
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
cmp eax, ebx
mov dword [ebp + 8], eax
jne 0x10603fa
mov esi, 0x8007000e
push esi
push 0xd800197
call fcn.01053610
jmp 0x1060551
push eax
lea eax, [ebp - 4]
push eax
push ebx
push ebx
push 1
push edi
call fcn.0105f7a4
mov esi, eax
cmp esi, ebx
je 0x1060417
push esi
push 0xd8a0197
jmp 0x10603f0
push dword [ebp + 8]
push dword [ebp - 4]
call fcn.010600fd
mov esi, eax
cmp esi, ebx
je 0x1060430
push esi
push 0xd8d0197
jmp 0x10603f0
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0xc]
call fcn.01053e0b
mov esi, eax
cmp esi, ebx
je 0x106044a
push esi
push 0xd900197
jmp 0x10603f0
cmp dword [ebp - 4], ebx
jbe 0x1060531
mov eax, dword [ebp + 8]
mov edi, dword [eax + ebx*8]
cmp dword [edi + 0xc], 1
jb 0x10605ef
mov eax, dword [edi + 0x10]
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov esi, dword [eax + 0xc]
and dword [ebp + 0xc], 0
add esi, 0x38
test ebx, ebx
jbe 0x10604b0
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [eax + ecx*8]
mov eax, dword [eax + 0x10]
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov eax, dword [eax + 0xc]
add eax, 0x38
push eax
push esi
push 1
call dword [sym.imp.CRYPT32.dll_CertComparePublicKeyInfo]
test eax, eax
jne 0x10604b0
inc dword [ebp + 0xc]
cmp dword [ebp + 0xc], ebx
jb 0x106047e
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x18]
push eax
mov eax, dword [edi + 0x10]
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov eax, dword [eax + 0xc]
push 0x2000003
add eax, 0x30
push eax
push 1
call fcn.010580ea
test eax, eax
je 0x10604e7
push eax
push 0xdb60197
call fcn.01053610
cmp dword [ebp - 0x18], 0
je 0x10604f6
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [ebx + 1]
mov dword [ebp - 0x20], eax
sub eax, dword [ebp - 4]
neg eax
sbb eax, eax
not eax
and eax, dword [ebp + 0x1c]
push eax
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
push dword [ebp - 0x10]
call fcn.0105fddc
mov esi, eax
test esi, esi
jne 0x1060606
mov ebx, dword [ebp - 0x20]
cmp ebx, dword [ebp - 4]
jb 0x1060453
xor ebx, ebx
mov eax, dword [ebp + 0x14]
cmp eax, ebx
je 0x1060540
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
mov dword [ebp - 0xc], ebx
mov eax, dword [ebp + 0x18]
cmp eax, ebx
je 0x106054f
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov dword [ebp - 8], ebx
xor esi, esi
cmp dword [ebp + 8], ebx
je 0x106057d
xor edi, edi
cmp dword [ebp - 4], ebx
jbe 0x1060574
mov eax, dword [ebp + 8]
mov eax, dword [eax + edi*8]
cmp eax, ebx
je 0x106056e
push eax
call dword [sym.imp.CRYPT32.dll_CertFreeCertificateChain]
inc edi
cmp edi, dword [ebp - 4]
jb 0x106055d
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 8], ebx
mov edi, dword [sym.imp.KERNEL32.dll_LocalFree]
je 0x106058d
push dword [ebp - 8]
call edi
cmp dword [ebp - 0xc], ebx
je 0x1060597
push dword [ebp - 0xc]
call edi
cmp dword [ebp - 0x10], ebx
je 0x10605a1
push dword [ebp - 0x10]
call edi
cmp dword [ebp - 0x14], ebx
je 0x10605bb
push 1
push dword [ebp - 0x14]
call fcn.010601a1
push 2
push dword [ebp - 0x14]
call dword [sym.imp.CRYPT32.dll_CertCloseStore]
cmp dword [ebp - 0x24], ebx
je 0x10605c5
push dword [ebp - 0x24]
call edi
cmp dword [ebp - 0x1c], ebx
pop edi
je 0x10605e7
push ebx
push 0x1011494
call fcn.01061da6
push ebx
push 0x10022c8
call fcn.01061da6
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov eax, esi
pop esi
pop ebx
leave
ret 0x18
mov esi, 0x8007000d
push esi
push 0xd9c0197
call fcn.01053610
xor ebx, ebx
jmp 0x1060551
push esi
push 0xdcf0197
jmp 0x10605fa