Function at 0x10a1347
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 0x14]
push ebx
xor ebx, ebx
push esi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 4], ebx
cmp eax, ebx
je 0x10a1371
mov dword [eax], ebx
mov eax, dword [ebp + 0x18]
cmp eax, ebx
je 0x10a137a
mov dword [eax], ebx
mov eax, dword [ebp + 0x1c]
cmp eax, ebx
je 0x10a1383
mov dword [eax], ebx
push edi
push 2
call dword [sym.imp.ADVAPI32.dll_ImpersonateSelf]
test eax, eax
jne 0x10a13a7
call fcn.0108edc3
mov esi, eax
push esi
push 0x10890197
call fcn.010893e6
jmp 0x10a168d
xor edi, edi
inc edi
push edi
push 0x101e5c0
mov dword [ebp - 0x1c], edi
call fcn.010a40b6
mov esi, eax
cmp esi, ebx
je 0x10a13c6
push esi
push 0x108e0197
jmp 0x10a139d
push edi
push 0x10027ac
call fcn.010a40b6
mov esi, eax
cmp esi, ebx
je 0x10a13df
push esi
push 0x10910197
jmp 0x10a139d
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x10a13fc
call fcn.0108edc3
mov esi, eax
push esi
push 0x10970197
jmp 0x10a139d
test al, 0x10
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
je 0x10a141a
call fcn.0109efc6
mov esi, eax
cmp esi, ebx
je 0x10a1430
push esi
push 0x109d0197
jmp 0x10a139d
call fcn.0108e981
mov esi, eax
cmp esi, ebx
je 0x10a1430
push esi
push 0x10a20197
jmp 0x10a139d
push 7
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 8]
call sub.certcli.dll_Ordinal_223
mov esi, eax
cmp esi, ebx
je 0x10a1453
push esi
push 0x10a60197
jmp 0x10a139d
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.CRYPT32.dll_PFXIsPFXBlob]
test eax, eax
jne 0x10a1471
mov esi, 0x8007000d
push esi
push 0x10ad0197
jmp 0x10a139d
mov eax, dword [ebp + 0x10]
neg eax
sbb eax, eax
and eax, 0x4000
or eax, 0x21
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x28]
push eax
call fcn.0109110f
mov edi, eax
mov dword [ebp - 0x14], edi
cmp edi, ebx
jne 0x10a14a8
call fcn.0108edc3
mov esi, eax
push esi
push 0x10b70197
jmp 0x10a139d
push ebx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push 1
push edi
call fcn.0109dd00
mov esi, eax
cmp esi, ebx
je 0x10a14cb
push esi
push 0x10c10197
jmp 0x10a139d
mov eax, dword [ebp - 4]
cmp eax, ebx
jne 0x10a14e2
mov esi, 0x80092007
push esi
push 0x10c60197
jmp 0x10a139d
shl eax, 3
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp + 8], eax
cmp eax, ebx
jne 0x10a1502
mov esi, 0x8007000e
push esi
push 0x10cf0197
jmp 0x10a1550
push eax
lea eax, [ebp - 4]
push eax
push ebx
push ebx
push 1
push edi
call fcn.0109dd00
mov esi, eax
cmp esi, ebx
je 0x10a151f
push esi
push 0x10d90197
jmp 0x10a1550
push dword [ebp + 8]
push dword [ebp - 4]
call fcn.0109e415
mov esi, eax
cmp esi, ebx
je 0x10a1538
push esi
push 0x10dc0197
jmp 0x10a1550
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0xc]
call fcn.0108d84e
mov esi, eax
cmp esi, ebx
je 0x10a155a
push esi
push 0x10df0197
call fcn.010893e6
jmp 0x10a1661
cmp dword [ebp - 4], ebx
jbe 0x10a1641
mov eax, dword [ebp + 8]
mov edi, dword [eax + ebx*8]
cmp dword [edi + 0xc], 1
jb 0x10a16ff
mov eax, dword [edi + 0x10]
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov esi, dword [eax + 0xc]
and dword [ebp + 0xc], 0
add esi, 0x38
test ebx, ebx
jbe 0x10a15c0
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [eax + ecx*8]
mov eax, dword [eax + 0x10]
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov eax, dword [eax + 0xc]
add eax, 0x38
push eax
push esi
push 1
call dword [sym.imp.CRYPT32.dll_CertComparePublicKeyInfo]
test eax, eax
jne 0x10a15c0
inc dword [ebp + 0xc]
cmp dword [ebp + 0xc], ebx
jb 0x10a158e
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x18]
push eax
mov eax, dword [edi + 0x10]
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov eax, dword [eax + 0xc]
push 0x2000003
add eax, 0x30
push eax
push 1
call fcn.0109173c
test eax, eax
je 0x10a15f7
push eax
push 0x11050197
call fcn.010893e6
cmp dword [ebp - 0x18], 0
je 0x10a1606
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [ebx + 1]
mov dword [ebp - 0x20], eax
sub eax, dword [ebp - 4]
neg eax
sbb eax, eax
not eax
and eax, dword [ebp + 0x1c]
push eax
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
push dword [ebp - 0x10]
call fcn.010a1234
mov esi, eax
test esi, esi
jne 0x10a170c
mov ebx, dword [ebp - 0x20]
cmp ebx, dword [ebp - 4]
jb 0x10a1563
xor ebx, ebx
mov eax, dword [ebp + 0x14]
cmp eax, ebx
je 0x10a1650
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
mov dword [ebp - 0xc], ebx
mov eax, dword [ebp + 0x18]
cmp eax, ebx
je 0x10a165f
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov dword [ebp - 8], ebx
xor esi, esi
cmp dword [ebp + 8], ebx
je 0x10a168d
xor edi, edi
cmp dword [ebp - 4], ebx
jbe 0x10a1684
mov eax, dword [ebp + 8]
mov eax, dword [eax + edi*8]
cmp eax, ebx
je 0x10a167e
push eax
call dword [sym.imp.CRYPT32.dll_CertFreeCertificateChain]
inc edi
cmp edi, dword [ebp - 4]
jb 0x10a166d
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edi, dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 8], ebx
je 0x10a169d
push dword [ebp - 8]
call edi
cmp dword [ebp - 0xc], ebx
je 0x10a16a7
push dword [ebp - 0xc]
call edi
cmp dword [ebp - 0x10], ebx
je 0x10a16b1
push dword [ebp - 0x10]
call edi
cmp dword [ebp - 0x14], ebx
je 0x10a16cb
push 1
push dword [ebp - 0x14]
call fcn.0109f1b6
push 2
push dword [ebp - 0x14]
call dword [sym.imp.CRYPT32.dll_CertCloseStore]
cmp dword [ebp - 0x24], ebx
je 0x10a16d5
push dword [ebp - 0x24]
call edi
pop edi
cmp dword [ebp - 0x1c], ebx
je 0x10a16f7
push ebx
push 0x101e5c0
call fcn.010a40b6
push ebx
push 0x10027ac
call fcn.010a40b6
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov eax, esi
pop esi
pop ebx
leave
ret 0x18
mov esi, 0x8007000d
push esi
push 0x10eb0197
jmp 0x10a1712
push esi
push 0x111e0197
call fcn.010893e6
xor ebx, ebx
jmp 0x10a1661