Function at 0x1400e58e0
Capabilities:
Check if file exists
Get file attributes
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x60]
sub rsp, 0x160
xor r13d, r13d
mov r15, rcx
xor ecx, ecx
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], r13
mov r14d, r13d
mov r12d, r13d
mov esi, r13d
mov ebx, r13d
mov rdi, rdx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400e5dd1
test al, 0x50
jne 0x1400e5dd1
mov rax, qword [0x140166bf8]
test rax, rax
jne 0x1400e5967
xor edx, edx
lea rcx, str.crypt32.dll
call fcn.1400e33e0
mov qword [0x140166bf8], rax
test rax, rax
je 0x1400e5b04
cmp qword [0x140166d20], rbx
jne 0x1400e5997
lea rdx, str.CryptMsgClose
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140166d20], rax
test rax, rax
je 0x1400e5b04
mov rax, qword [0x140166bf8]
cmp qword [0x140166d28], rbx
jne 0x1400e59c7
lea rdx, str.CertCloseStore
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140166d28], rax
test rax, rax
je 0x1400e5b04
mov rax, qword [0x140166bf8]
cmp qword [0x140166d30], rbx
jne 0x1400e59f7
lea rdx, str.CertFreeCertificateContext
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140166d30], rax
test rax, rax
je 0x1400e5b04
mov rax, qword [0x140166bf8]
cmp qword [0x140166d38], rbx
jne 0x1400e5a27
lea rdx, str.CertFindCertificateInStore
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140166d38], rax
test rax, rax
je 0x1400e5b04
mov rax, qword [0x140166bf8]
cmp qword [0x140166d40], rbx
jne 0x1400e5a57
lea rdx, str.CryptMsgGetParam
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140166d40], rax
test rax, rax
je 0x1400e5b04
mov rax, qword [0x140166bf8]
cmp qword [0x140166d48], rbx
jne 0x1400e5a87
lea rdx, str.CryptQueryObject
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140166d48], rax
test rax, rax
je 0x1400e5b04
mov rax, qword [0x140166bf8]
cmp qword [0x140166d50], rbx
jne 0x1400e5ab3
lea rdx, str.CertGetNameStringA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140166d50], rax
test rax, rax
je 0x1400e5b04
mov rax, qword [0x140166bf8]
cmp qword [0x140166d58], rbx
jne 0x1400e5adf
lea rdx, str.CryptDecodeObjectEx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140166d58], rax
test rax, rax
je 0x1400e5b04
mov rax, qword [0x140166bf8]
cmp qword [0x140166d60], rbx
jne 0x1400e5b0e
lea rdx, str.CertGetIssuerCertificateFromStore
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140166d60], rax
test rax, rax
jne 0x1400e5b0e
mov ebx, 0x7e
jmp 0x1400e5dd6
mov qword [rsp + 0x50], r13
lea rax, [rsp + 0x68]
mov qword [rsp + 0x48], rax
mov r9d, 2
lea rax, [rsp + 0x60]
mov r8d, 0x400
mov qword [rsp + 0x40], rax
mov rdx, r15
lea rax, [rsp + 0x78]
mov qword [rsp + 0x38], rax
lea ecx, [r9 - 1]
lea rax, [rsp + 0x7c]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r13d
call qword [0x140166d48]
mov esi, eax
test eax, eax
jne 0x1400e5b75
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x1400e5dd6
mov rcx, qword [rsp + 0x68]
lea rax, [rbp + 0xb0]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea edx, [r9 + 6]
call qword [0x140166d40]
mov esi, eax
test eax, eax
jne 0x1400e5ba9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x1400e5dd6
mov edx, dword [rbp + 0xb0]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r14, rax
test rax, rax
jne 0x1400e5bd2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov esi, r13d
jmp 0x1400e5dd6
mov rcx, qword [rsp + 0x68]
lea rax, [rbp + 0xb0]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov r9, r14
lea edx, [r8 + 6]
call qword [0x140166d40]
mov esi, eax
test eax, eax
jne 0x1400e5c06
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x1400e5dd6
movups xmm0, xmmword [r14 + 8]
mov rcx, qword [rsp + 0x60]
lea rax, [rbp - 0x70]
mov qword [rsp + 0x28], r13
mov r9d, 0xb0000
movaps xmmword [rbp - 0x40], xmm0
xor r8d, r8d
movups xmm0, xmmword [r14 + 0x18]
mov edx, 0x10001
mov qword [rsp + 0x20], rax
movups xmmword [rbp - 0x68], xmm0
call qword [0x140166d38]
mov r12, rax
test rax, rax
jne 0x1400e5c57
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov esi, r13d
jmp 0x1400e5dd6
test rdi, rdi
je 0x1400e5c76
mov rcx, r12
call fcn.1400e2f60
mov dword [rdi], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jne 0x1400e5dd6
lea rdx, [rsp + 0x70]
mov rcx, r14
call fcn.1400e1930
test eax, eax
jne 0x1400e5c8e
xor eax, eax
mov qword [rsp + 0x70], rax
mov rdx, qword [rsp + 0x60]
lea r8, [rsp + 0x70]
mov rcx, r14
call fcn.1400e4560
test eax, eax
jne 0x1400e5cd2
lea rdx, [rsp + 0x70]
mov rcx, r14
call fcn.1400e4400
test eax, eax
jne 0x1400e5cd2
mov esi, r13d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jne 0x1400e5dd6
mov ebx, 0x80096005
jmp 0x1400e5dd6
mov ecx, 0x23f0
call fcn.1400e31c0
test eax, eax
jne 0x1400e5d00
mov rcx, r15
call fcn.1400e2fe0
test eax, eax
je 0x1400e5d00
call fcn.1400e1ad0
test eax, eax
jne 0x1400e5d00
lea esi, [rax + 1]
mov ebx, r13d
jmp 0x1400e5dd6
mov rax, qword [0x140166df8]
test rax, rax
jne 0x1400e5d26
xor edx, edx
lea rcx, str.wintrust.dll
call fcn.1400e33e0
mov qword [0x140166df8], rax
test rax, rax
je 0x1400e5d4b
cmp qword [0x140166e00], r13
jne 0x1400e5d58
lea rdx, str.WinVerifyTrust
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140166e00], rax
test rax, rax
jne 0x1400e5d58
mov esi, r13d
mov ebx, 0x7e
jmp 0x1400e5dd6
mov esi, r13d
mov edi, r13d
nop
mov edx, edi
mov rcx, r15
call fcn.1400e4340
test eax, eax
je 0x1400e5d79
inc edi
mov ebx, eax
cmp edi, 1
jb 0x1400e5d60
jmp 0x1400e5d7e
mov esi, 1
cmp ebx, 0x800b010a
jne 0x1400e5dd6
mov rcx, qword [rsp + 0x60]
lea r9, [rbp + 0xb8]
xor r8d, r8d
mov dword [rbp + 0xb8], r13d
mov rdx, r12
call qword [0x140166d60]
mov rdi, rax
test rax, rax
je 0x1400e5dd6
mov rcx, qword [rax + 0x18]
add rcx, 0x78
call fcn.1400e1de0
test eax, eax
je 0x1400e5dc6
mov esi, 1
mov ebx, r13d
mov rcx, rdi
call qword [0x140166d30]
jmp 0x1400e5dd6
mov ebx, 2
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
test r12, r12
je 0x1400e5ded
mov rcx, r12
call qword [0x140166d30]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400e5dff
xor edx, edx
call qword [0x140166d28]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400e5e0f
call qword [0x140166d20]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbx, qword [rsp + 0x1a0]
mov eax, esi
add rsp, 0x160
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret